Connect. Build. Contain. Agents in the AI Governance Era
Reference https://www.meetup.com/collabnix/events/316301263/
1. Contain, Forecast, Adjudicate: Three Agent Controls No Protocol Gives You
2. Securing Your Agentic Stack (Workshop)
https://agentic.dockerworkshop.com/
https://agentic.dockerworkshop.com/#/labs/securing-the-agentic-stack-slides
https://agentic.dockerworkshop.com/#/labs/securing-the-agentic-stack
1. What it contains? What is software Artifact
SBOM
docker scout sbom --format spdx --output baseline.spdx.json catalog-service:baseline
2. From where it comes from?
Provenience
3. CI pipeline. Who approve image with vulnerabilities? Can I. verify attestation source
https://docs.docker.com/scout/deep-dive/advisory-db-sources/
match with SBOM
Now AIBOM term is emerging. https://www.ajeetraina.com/ai-bom-explained-why-your-sbom-stops-where-your-ai-system-starts
VEX: Vulnerability Exploitability eXchange
In Docker Desktop, we can filter vulnerabilities based on fixable or not
SLSA
Level 1 to 3
FIPS 140 For US
4. Can it be restricted? Sandbox
We need base image with near zero vulnerabilities.
All images shall be signed
Allow coding agent only what it needs.
"/rc" in Claude. Remote control. You will keep getting notifications in your mobile.
AI Agent
local sandbox and cloud sandbox. SBX is running on microVM. Agent can change kernel also. So SBX runs on microVM instead of container.
Inside mircoVM also we run Docker engine and docker daemon
Docker Hub have MCP policy, AI policy
Now we have SBX compose file with policy
MCP Toolkit
Hardened MCP servers
https://agentic.dockerworkshop.com/#/labs/securing-the-agentic-stack-slides/workshop-75
Docker hub
DHI Docker Hardening Images
Images and AI models also on
3. Docker sbx kits: you explorations to contain AI Agents begins here
AI Agent
https://docs.docker.com/ai/sandboxes/customize/
https://docs.docker.com/ai/sandboxes/customize/kits/
https://hub.docker.com/search?type=sbx_kit
Tools
1. MIXIN kit
It has enhanced capabilities
build agent from scratch
2. Sandbox Kit
-------
Kit has spec.yaml file
Files are payload. it can have docker compose file. certificate file etc. Some will go to sandbox and other files remain on laptop
start from Mixin kit, as Sandbox kit has many definition
Now let's have customize AI agent.
https://floci.io/ is like localstack. Cloud emulators
floci CLI is inside sandbox
1. create shell sendbox
2. run docker compose
same can be done with spec.yaml file
We have DHI for langchain also. It can be inside sandbox
4. Beyond the Agent: Building AI Systems You Can Trust
If it hallucinate then workflow has problem or model has problem?
5. The New Primitives of AI: YAML, OCI, and Agent Infrastructure
you write agent in your Jupiter Notebook
"It works on my notebook"
"docker agent"
oci artifacts
Kyverno
Kyverno Policy
- 2 types: Policy and ClusterPolicy
- Multiple Rules
- Match / Exclude
-- Match resources
kind is mandatory. names, namespaces, operations, selector are optional.
Wildcards * supported in kinds, names, namespaces
All are AND condition.
Any means OR condition
We can mention based on who created
exclude:
any:
- clusterRoles:
- cluster-admin
- subjects:
- kind: User
name: John
match AND exclude
exclude must be a subset of match
- Action
1. Validate ( allow / deny )
2. Mutate
3. Generate new K8s object
4. Verify image (Cosign/Sigstore)
- Enforce / Audit
* It uses JAMESPath
- Filter JSON
# Returns a list of container objects that match the condition
{{ request.object.spec.containers[?starts_with(image, 'nginx')] }}
validate:
message: "Nginx images are not allowed!"
deny:
conditions:
all:
# Filter the list. Use length() to count.
# If count > 0, it means a violation exists -> Block.
- key: "{{ request.object.spec.containers[?starts_with(image, 'nginx')] | length(@) }}"
operator: GreaterThan
value: 0
- pipe
Used to extract a specific field from a complex object into a flat list.
# Input: List of container objects
# Output: ["nginx:latest", "redis:alpine", "busybox"]
key: "{{ request.object.spec.containers[].image }}"
kyverno jp query -i object.json 'spec.containers[].name'
Combo (Filter + Pipe): “Get the containerPort of the container named ‘app’”
request.object.spec.containers[?name == 'app'].ports[].containerPort
You want to find the names of all volumes that are of type emptyDir.
spec.volumes[?emptyDir != null].name
kyverno jp query -i object.json "spec.volumes[?emptyDir != null]"
- null handling
Risk: {{ request.object.metadata.labels.team }} (If null -> Error).
Safe: {{ request.object.metadata.labels.team || '' }} (If null -> treat as empty string).
- The length function
Example: “A Pod must not have more than 3 containers.”
validate:
deny:
conditions:
all:
- key: "{{ request.object.spec.containers | length(@) }}"
operator: GreaterThan
value: 3
- if / else
- sum
- contain means exist : contains(request.object.metadata.labels, 'production')
advance mutate foreach
mutate:
foreach:
- list: "request.object.spec.containers"
patchStrategicMerge:
spec:
containers:
- name: "{{ element.name }}"
securityContext:
readOnlyRootFilesystem: true
* Aut-Gen: If rule for pod then automatically generate rules for Deployment, StatefulSet, DaemonSet, etc.
https://release-1-8-0.kyverno.io/docs/writing-policies/autogen/
Generate rule has synchronize flag
synchronize: true: Kyverno complete managed lifecycle
synchronize: false: Kyverno created for the first time then user can edit it manually without getting revert back like synchronize: true
* request.object is the incoming resource configuration (the new state) that is being submitted to Kubernetes API server
Documentation: https://kyverno.io/docs/policy-types/cluster-policy/variables/
# -------------------------------------------------------------
# ACTION: If Kyverno is dead, just let the request go through.
# -------------------------------------------------------------
failurePolicy: Ignore # or Fail
PolicyReport
PolicyReport stores the results of those rules.
The PolicyReport is essentially a “Health Check Report Card” for your Kubernetes resources.
Its main goal is Observability & Auditing.
It provides summary and then detail about all failures. For Example
apiVersion: wgpolicyk8s.io/v1alpha2
kind: PolicyReport
metadata:
name: polr-ns-default
namespace: default # It lives next to the Pod, not at the cluster level
labels:
app.kubernetes.io/managed-by: kyverno
summary:
pass: 0
fail: 1
warn: 0
error: 0
skip: 0
results:
- policy: require-labels # The name of the ClusterPolicy responsible
rule: check-for-team-label # The specific rule name
category: Best Practices
severity: medium
result: fail # The outcome (fail, pass, warn, error, skip)
message: "Validation error: label 'team' is required"
source: kyverno
resources: # The specific object that failed
- apiVersion: v1
kind: Pod
name: nginx
namespace: default
uid: a1b2c3d4-e5f6...
* Background scan never delete resource even with enforce mode
* For background scan following variable are not relevant
request.userInfo.*
request.operation
request.dryRun
serviceAccountName in admission context
Document: https://kyverno.io/docs/policy-reports/background/
* Cleanup policy delete pods
https://kyverno.io/docs/policy-types/cleanup-policy/
Kyverno CLI
* for given resource, policy is pass or fail
kyverno apply policy.yaml --resource pod.yaml
* test JAMESPath expression against JSON
kyverno jp query -i object.json 'metadata.labels'
* Check policy YAML is written correctly or not
kyverno validate policy.yaml
External Data Source
Purpose: It allows you to load data from outside into a variable before the rule logic (validate/mutate) runs.
In order to consume data from a ConfigMap in a rule, a context is required... The context data can then be referenced in the policy rule using JMESPath notation.
Kyverno supports 3 main data sources in context:
1. Kubernetes Resources (via API Call): Look up existing data in the cluster (e.g., ConfigMaps, Secrets, Services).
2. External APIs: Make an HTTP call to a service outside the cluster.
3. Image Registry: Fetch metadata about a container image (e.g., image size, architecture).
verifyImages:
- imageReferences:
- "ghcr.io/myorg/*"
attestors:
- entries:
- keys:
publicKeys: |-
-----BEGIN PUBLIC KEY-----
...
-----END PUBLIC KEY-----
https://main.kyverno.io/docs/policy-types/cluster-policy/external-data-sources/
Kyverno Mutate — JSON Patch
the standard patchStrategicMerge merges YAMLs together.
patchesJson6902 is a mutation method specific operations (RFC 6902 standard) to tell Kyverno exactly how to change the data.
Usage:
* Removing a field (impossible with standard merge).
* Adding an item to a specific position in a list (arrays).
* Replacing a value entirely without merging.
It follows the JSON Patch format:
* op: The action (add, remove, replace).
* path: The location of the field (e.g., /metadata/labels/mytag).
* value: The data to put there.
Example: “Add a sidecar container”
https://main.kyverno.io/docs/policy-types/cluster-policy/mutate/#rfc-6902-jsonpatch
TTL Default of Certification in Kyverno:
https://pkg.go.dev/github.com/kyverno/kyverno/pkg/tls
const (
CAValidityDuration = 365 * 24 * time.Hour // 365 days
TLSValidityDuration = 150 * 24 * time.Hour // 150 days
CertRenewalInterval = 12 * time.Hour // 12 hours
)
https://www.udemy.com/course/complete-certified-kyverno-associate-kca-exam-prep/
https://medium.com/@kienlt.qn/prepare-for-the-kyverno-certified-associate-kca-exam-c144906f9bc2
Concurrent Policies Generation Number Default!
PolicyException CRD
CEL
Hashicorp User Group Bangalore Meetup #1 : Powering the Multi-Cloud Era
Alternatives for IDP
(1) https://github.com/JanssenProject/jans https://github.com/JanssenProject/jans/tree/main/jans-keycloak-link https://imshakil.medium.com/janssen-mod-auth-openidc-module-to-test-openid-connect-single-sign-on-s… It is by Glu
(2) Vault it self support OIDC https://developer.hashicorp.com/vault/docs/secrets/identity/oidc-provider https://brian-candler.medium.com/using-vault-as-an-openid-connect-identity-provider-ee0aaef2bba2
SQL++ is for JSON data. https://www.couchbase.com/sqlplusplus/
https://techmilap.com/ is free website for hosting event
Vault can provide dynamic temporary secrets to access data for each identity used by consumer. so later on, we can audit, who has accessed data. In our case, pods use ServiceAccount (SA). here we get dynamic secret per serviceaccount. So we cannot audit which pod accessed the data. we can only audit, data is accessed by which ServiceAccount. This dynamic secret has short life so one cannot use it again. SA we can use it as many time as we want.
Vault secure data in-transit with TLS and other encryption method that is called "encryption as a service"
In terraform, state file is the most confidential.
Nomad is alternative of K8s. It can manage VM also using QEMU driver. Consul is used for networking and service. Fabio is for ingress and load balancing in Nomad.
AI for Observability
The speaker explains his solution about adding AI for observability. Where observability includes logs, traces and matrices.
Features
It does not embed log message. most sophisticated GenAI also takes maximum 2 millions token. Logs generates it in 2 seconds. So solution need to feed right data to AI. It understands form log, which field shall be feed as initial value and then instruct to feed more data.
It creates visualization dashboard based on question
It has level 0 (manual observability) to level 4 (full observability)
It uses AWS Bedrock to solve privacy issue and compliance.
In future solution : GenAI
- will understand deployment
- will understand changes between deployments and its impact : cost, error increase or decrease.
- can go to Github repo to know changes that happen
- can fix the code
- then write test (UT) so it cannot happen again
So it makes much stable environment. It can make autonomous cluster configuration
At present, the solution has
- ability to analyze exception. Root cause analysis of exception. not 100% accurate all the time. It gives list of actions, that are taken to understand & troubleshoot problem. The solution can auto run RCA for each alert.
As we know GenAI has 3 models
1. generic questions
2. RAG
3. Agent
Yes, the solution will make openAI calls. every openAI call costs money. Now cost is reducing.
Future we may have trend of : BoY RAG
