Announcing Oracle Cloud Guard Container Security

September 10, 2024 | 4 minute read
Alan Chester
Principal Product Manager
Shasi Pulijala
Principal Product Manager
Text Size 100%:

We’re pleased to announce the limited-availability (beta) release of Oracle Cloud Infrastructure (OCI) Kubernetes Engine (OKE) Container Governance through Oracle Cloud Guard’s Container Security. The integration provides a single-pane-of-glass experience for managing large-scale containerized workload compliance.

What is container governance?

Organizations are increasingly adopting containerization to build, deploy, and manage applications. Containers and Kubernetes offer unparalleled flexibility, scalability, and efficiency, making them a cornerstone of modern cloud native architectures. However, with great power comes great responsibility. As organizations scale their containerized environments, a robust governance model becomes paramount in the overall containerization strategy. Here, container governance plays a crucial role.

Container governance refers to the policies, practices, and tools that help ensure that containers operate securely and efficiently and comply with organizational and regulatory requirements. 

Policies, practices, and tools of governance.
Figure 1: Governance categories

Effective container governance is essential for the following reasons:

  • Security: By design, containers offer isolation, but that’s only one part. Misconfigurations, privilege escalations, and other security exploits can expose sensitive data and applications to threats without proper governance.
  • Regulatory compliance: Many applications are subject to strict regulatory compliance requirements, such as the Payment Card Industry (PCI) and Federal Risk and Authorization Management Program (FedRAMP). Container governance helps you address your compliance objectives.
  • Operational consistency and best practices: Maintaining consistency across hundreds or thousands of containers becomes challenging as organizations scale. Container governance helps ensure that all containers adhere to the same operational standards, reducing the risk of errors and downtime from managing deployment permutations.
  • Business continuity: Enterprise applications often have high production service license agreements (SLAs), so they have been architected with high availability, resilience, and rapid recovery in mind. Container governance can help ensure workloads that comply with organizations’ business continuity requirements are deployed.

Let OCI keep your containers in compliance

Multiple solutions exist for applying container governance to Kubernetes clusters. Examples range from native Kubernetes functionality or open source technologies that require in-depth knowledge to costly third-party solutions. 

Teaming up with Oracle Cloud Guard, OKE has created a feature that makes applying container governance to your workloads easy, using the same Cloud Guard interface used to apply overall security posture management to your tenancy. Container Governance through Cloud Guard provides customers with a secure and governed container runtime environment, such as Kubernetes. We achieve this goal through the automated detection and enforcement of security, operational, and organizational policies. You can apply this configuration to any OKE-supported node type. This feature combines Cloud Security Posture Management (CSPM) and Kubernetes Security Posture Management (KSPM). 

A recipe for Oracle-managed OCI Container Security in the Oracle Cloud Console.
Figure 2: Oracle-managed OCI Container Security recipe

The Cloud Guard and OKE solution offers the following key features and benefits:

  • Ready-to-go recipe: We provide a ready-made Oracle-managed Container Security detector recipe to streamline defining governance rules and their configuration. This recipe gives an Oracle-recommended baseline configuration for Container Governance.
  • Single pane of glass: OCI customers use Cloud Guard as their primary security posture management tool. Container governance problems and other resource misconfigurations are aggregated and displayed to you, providing you with one central location for managing and viewing your overall security posture. 
  • Robust exception management: Container Governance enables you to apply exceptions if your organization has a use case to run a workload that doesn’t comply with the baseline governance rules. This feature enables security organizations to approve and track exceptions, simplifying audits.
  • Remote monitoring: Monitoring is applied remotely to your cluster. So, it doesn’t take up cores required to host your containerized workload and is tamper-proof from within the cluster.
An example issue of the container not running as the root.
Figure 3: Example problem

 

Get started

We’re actively recruiting beta participants! Sign up for the OCI Container Security Container Governance beta.

For more information on the concepts in this blog post, Oracle Cloud Infrastructure, Oracle Cloud Guard, and Oracle Kubernetes Engine, see the following resources:

Alan Chester

Principal Product Manager

Alan is a product manager for OCI's Containers, Kubernetes, and Serverless product family.  He has a passion for security and helping applications focus primarily on their business logic versus common platform level functionality

Shasi Pulijala

Principal Product Manager

Shasi Pulijala is responsible for Oracle Cloud Guard and the integration of Cloud Guard with the Human Capital Management (HCM) Cloud and other Fusion applications. Prior to Oracle, she worked on cryptography solutions, including hardware security modules and more at Marvell Inc.


Previous Post

First Principles: Robust data breach protection with Zero Trust Packet Routing

Pradeep Vincent | 13 min read

Next Post


Zero Data Loss Autonomous Recovery Service is now available for Oracle Database@Azure

Kelly Smith | 4 min read
Oracle Chatbot
Disconnected