What Is Zero Trust?
Zero trust is a security concept that is centered around the idea that organizations should never trust anyone or anything that does not originate from their domains. Organizations seeking zero trust automatically assume that any external services it commissions have security breaches and may leak sensitive information. Simply put, the zero trust motto is: “Don’t trust anyone.”
Running Workflows with Zero Trust in Mind
Today, there are two major approaches to running CI/CD workflows:
- Using on-premises CI/CD platforms, such as Codefresh, Jenkins, and Gitlab
- Using SaaS CI/CD platforms, such as Codefresh, Gitlab, and Circle-CI
An organization that wants to achieve zero trust cannot possibly go for a SaaS option as those require users to trust the application provider with sensitive information. Sensitive information that has to be managed may include credentials for their various integrations and services (SCM system, container-registry, and Kubernetes resources). Those services can also be deployed behind a firewall, making it impossible to integrate with a SaaS solution, even if we forget about the security concerns.
This leaves us with on-prem solutions. An on-prem solution allows us to have zero trust with the CI/CD service, but it comes with the inherent drawbacks:
- The CI/CD service has to be fully deployed on your organization’s cluster, which could consume a great number of resources;
- Maintaining the service (monitoring health and installing newer versions and patches) is the responsibility of the customer;
- Getting new features and bug fixes always requires the intervention of the customer and, most of the time, both are first released to the SaaS platform long before they are ready for on-prem.
The Hybrid Solution
If you want to have a zero trust solution like the on-premise option but also enjoy all the benefits that come with SaaS technology, the hybrid model is, by far, the best option for you.
The solution requires you to install a few components on your Kubernetes infrastructure and keep a footprint, one that is far smaller compared to other on-premises solutions. This allows us to provide an experience that is almost identical to the one SaaS consumers get, featuring:
- Immediate updates and bug-fixes
- All platform stuff stays on the platform
- Low cluster resource requirements
All while keeping you in zero trust.
How Does It Work?
This is how the solution works:
1 – When using Codefresh from the browser, the Codefresh UI will request private resources (e.g., Git repositories, Codefresh YAML files, etc.) directly from the Codefresh Control Plane, instead of going to the Codefresh SaaS platform. This keeps everything behind the firewall.
2 – The Codefresh Control Plane is the only component that has access to private resources. The control plane is only accessible from within the user’s network (e.g., via VPN or proxy) and isn’t publicly exposed.
3 – Tasks like running a workflow are being pulled and executed by the Codefresh Control Plane.
Conclusion
The hybrid solution brings the best of both worlds: providing the users with a SaaS-like experience while being safe when accessing your private resources. You should no longer compromise on security to enjoy the benefits of SaaS.
To learn more about Codefresh and the benefits of the hybrid solution, please visit the following resources:
Authors
Roi Kramer – Backend developer @ Codefresh. Fan of skiing and alternative-rock and a father of two cats.
Oren Gurfinkel – RnD manager @ Codefresh. Developer and father. 🙂