Yes, it's a myth.
Okay, hello.
Thanks for being here and this is the room and idea for today
to have some cloud security talk about the detail more
as we try to illustrate something that we can consider private clouds
in first or two is something that we have to cover.
And we try to go with it.
I'm Jordi.
I'm based in Barcelona.
I work in a principal technology innovation here in Open Nebula
systems for some years.
I was in research in HPC.
And now I'm trying to have some new features to Open Nebula
and today we will focus this part of cybersecurity in the, you know, in the, in the edge.
I'm happy to be here because this, today we will present something
that was oriented to go through the ecosystem.
In this case with people from ProLare, I don't know if you know ProLare.
The Open Cloud Security platform that I was covering more than 2,000 tests in public
and not public cloud.
And with the Open University of Catalonia,
the time you know a master instructor and we have some master tests around this.
With this, let's see what is the thing that we will cover today.
The first and only to escape more as part of information.
Do you know Open Nebula?
Yes, some of you, okay.
ProLare is clear.
Let's see more some introduction because we know that there are some people that not.
Previously my colleague Pablo presented Open Nebula
and our support to devices where H has to converge
and some initial definitions.
I have not to be a teacher, but we need an introduction.
We are in some European Commission projects
and this is important to define the H.
Because at the end, when you are talking to the H for a telecom operator, maybe the H for them
is a one megabyte, one megabyte data center.
You know, and maybe if you ask for you that what is H computing,
you can answer that maybe it can be.
This one computer that you are at home, not only
we try to go with this definition.
And the important thing here is about the latency.
The latency is trying to define if we are in the H or not.
If you can see here the image from this observatory from the Commission,
we can see that if we are below 20 milliseconds, we are in the H.
See now here we are in the H.
For this, you know, it opens a lot of you know challenges,
not only from innovation that we have to try to follow to release real things in the H.
Something that I can highlight here is the physical and cyber security
when you are in the H, theoretically.
You can have to be, you know,
or be aware of a tampering for instance, or you know,
because at the end the device or the rack can be accessible for out of the data center.
With this in mind, let's go.
This is a line with a specific, you know,
program that is called EPSI-C, that we are managing to build the
architecture.
And this is the last, the last architectural reference is in our version two.
Where you can see that we are expanding to the IoT world.
And this is that I, you know, try to explain in the in the title is that
IoT has to be covered and at the end has to be protected.
But in the way that if we were from the cloud, you know,
with the fog until the edge of this IoT device is has to be,
like the same stream.
Okay.
We are working in this project, the European project that is called OCI,
that we are expanding this architecture to reach the IoT.
And why we are doing this?
The first, Open Nebula, at the end, Open Nebula,
Assistant is the company this is behind Open Nebula.
That is an open source solution.
And this open source solution at the end with more than 20 years ago,
that, you know, was born from the university.
And now we are operating, you know, from private clouds to heavy clouds for
multi clouds.
As we have, we can provide something is now we will define Open Nebula.
This open source Apache to, you know, license.
When you can manage from your private cloud,
we will work for this until a multi cloud.
Is it this way?
We are very agnostic to the hardware.
But if you want to manage VMs, containers or Kubernetes,
throw a cluster API and a multi hypervisor environment,
throw KVM, LXC.
In a district with a way, we are, you know, facilitating this.
And this is the first step that we have to cover.
If we want to run different workloads, maybe AI ready,
in the, in the edge.
With this, and we are now in the 7-0, we have to analyze from of the
different options that we have to cover the edge.
As you can see here, we put three cases, as an example.
All, you know, for the typical private cloud solutions are not focus,
you know, to cover the edge from now, okay?
And we can say now that this support for arm,
this inclusion of arm images in our marketplace,
and mainly our reduced footprint that can be installed
in a Raspberry Pi 5, can help with edge computing.
And at the end, if you are trying to assume the continuum,
and we are trying to be not only in the private core,
that is our main, you know, business,
is to have in their phone notes.
And here you can see, as an example, for instance,
our edge gateway, an edge gateway that is at the end
for by definition, something that can aggravate services
to provide in the edge.
Because imagine, if we try to use all this private core
with networking until the edge, we are in a real problem.
Because the edge, maybe, is not being connected in the best way
that we can.
And what we are trying to reduce, this orchestration gaps,
is that your control plane is near the workload.
Always, and in the edge.
With this, you can avoid to have this orchestration gaps
that you can see here.
We can put an example in a demo.
This credentials, like edge, that can be distributed or not.
And this, you know, container risk,
when are not centralized in the data center.
With this, we compare, you know, the different types of clouds.
More centralized, more edge compute needs.
And in this case, we have to align with this cloud security
posterior management, that is the total for today.
We can see that we need something that can out it all these installations.
Because if we deploy, as you know, using infrastructure as code,
the workload in the edge, who is following that the orchestrator
that is distributed, it's okay.
And this maintain its security levels.
You know, maybe you have to maintain this without connectivity.
You can have to maintain this in the edge without to reconnect it
to this centralized cloud that we are now working on and mainly.
And this is why we start this problem integration as a part of our orchestr system.
And with this, about the problem.
I put here this image, sorry, but we can simplify the image.
With this image, the idea of problem is to, from this open cloud security mission,
is to try to out it different hyperscalers,
including, you know, Kubernetes.
And this was day born for this.
And they were doing a lot of good work.
Because at the end, you can combine or you can run pro-layer
from, you know, from your cloud, from your home, and now from the edge.
But if you can see here, maybe you are represented here from projects
in the virtualization market that you are doing, I don't know,
or you are trying to solve this with some scripting.
You are trying to check if the orchestrator is okay with some enterprise tools.
But when we are focusing the edge, the idea is that we have to enlarge this list,
and not only to cover the hyperscalers.
Because we have to include this private clouds.
And this is more or less the motivation that now,
pro-layer, with open nebula and with some databases that can be installed, you know,
out of a hyperscaler, we can combine.
And this is something that please, if you are in an open source project,
check in this case pro-layer and extensions that you can follow that we,
you know, in this case, we are illustrating with open nebula.
For what, and what you can do.
At the end pro-layer, we can have a definition.
This is this leading force, open source cloud security tool.
With some checks, we have a CLI,
the LCP, we have a specific front end to our grid, all this data to all this,
all this, all this data, and with a pro-layer, you know, you can,
you have a modular extension that you cannot, some new providers.
And this is the thing that we did.
In this case, I have to give some thanks to Danielle Rontome,
and in case Tonya Fuente, this is a city of pro-layer,
to go with this, and with this initial integration.
This contribution at the end that you can see in GitHub,
basically it is modular, and you will interact with pro-layer.
Okay.
In, you know, in a very interactive way,
flow there, in this case, the API of open nebula.
If you see the typical design and implementation,
it's something that can run in the edge or in the cloud.
And this checking is doing some audit with some tests.
We will see a type of test, that I see interesting, you know, with the orchestrator.
At the end, we have the specific connection that now is implemented
through XML, RPC API, that you know is checking the different condition
of the orchestrator to see if you fail or pass the test.
Okay.
Is the typical?
That the wheel is blue straight here, that this auditor will be in the edge near the control plane.
With this, what is the idea to have this zero-trust auditing?
You know, because at the end, your security posture can change for, I don't know,
because there are some un-ministration impact to your configuration,
your VMs, your templates, this is more or less as an example.
What is the security services and controls that we implemented now initially?
The first, and this is more or less gradually, implemented by risk, is identity.
You know, you have to ensure that you are from tent, in this case, your orchestrator,
are in the best conditions about the access.
You know, if you are passing ISO, something like that is something that they are insisting.
You have to, your control plane has to be, you know, not safe.
You have to be ensured.
The second thing is that about networking, are you exposing some services to internet
and you are not controlling this workflow?
You are exposing some APIs, maybe the orchestrator APIs.
What is the status of the firewalls of your workload in the H?
The third family that we implemented is around all the VMs in first sector.
It's at the end, are you using in the H and encrypted storage images?
At the end, we are trying to avoid tampering, someone can grab your device, your rack,
that can be in a farm, that can be in the forecast, that can be in a plant, industrial plant.
And the last is about the compliance.
That is important if you are trying to follow some of the derivatives that the commission,
you know, around this, or you are in the bank sector,
that you have to follow this.
With this premises, let's see the environment that we are okay in time.
Okay, nice. That we prepared the first.
This is, you know, lab conditions, but we will use Raspberry Pi.
In this case, this model 5, that is what you know presented previously, is capable,
you know, to have our front end.
In this case, open the control plane and a KBM hypervisor here and some workload.
In this case, we will see two virtual machines.
One that was emulating some services and the problem extension.
The second, as you can see here, is Ubuntu Sember, server with KBM,
with the last 7-0 version of Open Nebula, with a web interface that you can reach
and access to a marketplace with some different appliance.
This is very important that if now you want to test Open Nebula and see this in your laptop,
your Raspberry Pi, in your server, in your supercomputer, please use mini-1.
In two minutes, with all you know Ubuntu, if we can say, as operating system install,
you can go with Open Nebula running.
This is designed for testing, but please, if you're interested, you can use,
you have here the QR to reach the GitHub to go with the mini-1 way.
We have another option for today is not the scope of this presentation.
The second thing is important is when you have the front end installed,
you can reach our marketplace.
It's where in our marketplace, that you can, you know,
at the end, access appliances that are officially supported from the community.
For instance, next cloud, mini-1, Phoenix, et cetera.
And let's go to see this more or less in action.
Yes, let's go with this.
All you know about the GitHub, you know, this is the architecture,
or the overall architecture of Open Nebula.
Now, you can see that we can install and deploy in the DH.
And what we are, what we prepare this, if you go to our front end,
in this stage two sunstone, you will see that we have this installation in our Raspberry Pi,
and in our armed device.
You can see here that we put this name, et gateway to illustrate
that the et gateway can be represented in the, in the et,
who is providing networking, you know, and network services to the world,
or the different VMs, containers, Kubernetes that can be here,
and we will state this lab with two machines.
When we can see the network, in this case,
are the applications for the marketplace, and at the end,
that you can bring to the installation and don't lot to provide the service,
or everything can be done by API, a Terraform, Open Tofu, you know.
And we have a specific built-in network that can be extended,
you know, to the edge devices, so different glitches,
can be extended in different sites with different overlays networks.
And here we have the two VMs that are representing the lab.
The first is the agent that is auditing, in this case, the front end,
and the second, based, you know, in a little appliance,
is who is offering a function as a service, you know, inside the, the ets lab.
With this, we can conform, and with, what is the idea here with,
with, with, with Proller?
The idea with Proller is to check automatically and periodically,
the state of this front end.
Okay? We will see this in the next.
Uh, yes? We can access the video.
We can access two, throw message to the proller machine.
Only you know, for Proller.
you can visit their GitHub, was initially born
to cover hyperscalers, and now we
end the transition to cover this private approach
like Open Nebula.
At the end, we will see a report of Open Nebula
from 10th after the first installation.
You can see a lot of tests by including LLMs.
Only it was here to illustrate that you can see the project.
Only you know for the installation.
At the end, you can use poetry to have
a fresh installation for the CLI, and the idea
is to illustrate this now.
Let's go.
We are now in the pro-eller machine.
We will install the pro-eller.
At the end, there is a pre-configure credentials
to access the front end, in this case, the Open Nebula.
You know, and to have the different checks.
With this, you have an installation.
We can install it, you can execute the test,
and at the end, you can reach the results.
By default, about the families of tests
that we previously test, as you can see, we have two fails.
The first is authentication and access control.
By default, in Open Nebula, we will see what
is doing at the end, you can provide credentials in the VM
at template level, or you know, through the front end.
And if you check pro-eller, we can see the report.
You have JSON, CSV, or an HTML report with all the tests,
and you can focus on you can introduce to your CM,
or your certificate in system for security,
to reach and to remedy the results of the audit.
You can see that can be critical, it's medium.
OK, with this, and only considering the time that we have.
If we go that I have here the report for this check,
we can go through this specific test.
The first was that he detects, in some of the templates,
we can see some credentials exposed.
Well, exposed.
Inside, you know, this front end that is out of your data center.
And this is the one and the second,
with a fresh installation of Open Nebula,
is that they recommend, you know, to access the front end,
or you know the API, please use an authentication method
more, you know, secure.
With this, if we continue with the presentation,
this way, let's go with the last results.
The first is for everyone, best practices for this sovereign,
hybrid cloud, we are extending the cloud until the edge.
The first is very important, if you are not doing this,
you know, to have this hardened configuration for every PM,
you know, un-recheck with these kind of tools, where they are online.
And the second, this is how to make compliance, you know,
is that you have to replace this manual outage
that somehow it was at doing with something continuing,
maybe in the cloud is easy, but what about if you are in the edge.
And the second, you know, always, this minimum Bible permissions.
About the experimental things that we are,
and then probably is doing, and we are supporting,
is this auto remediation plus AI plus MCP,
that you know that's your own fashion?
You can see here that we have, in GitHub,
some of N6 security MCP servers list, with this inclusion,
it's included, open-nevilize,
it's included, a pro-layer, and our vision is that,
and for all this system, cloud administrator,
is that this, they are out, it probably is something,
please, remediate, okay?
And tell me, it is remediated.
And with this, my last sentence for this, for them,
people for security, people at the end,
this visibility is our first line of defense in the cloud,
and in the current competing continuum.
And only some reminders from open-nevilize,
when we have some talks this year, and we have a booth,
if you want some stickers, or we want to have some extra discussion,
extra questions, please, in level one of the building,
K, near open-tofu, if we have, I think, I don't know,
but we are there, and thank you for your time, please.
And now, questions,
questions?
Okay.
Any questions?
Yes, please.
I just have a question, because I didn't know the service
pro-layer, and can you sell for, is it pro-layer,
or not, so you could have our gap and stance of open-nevilize,
you can sell for pro-layer, or how does it exactly work?
Okay.
Yes, the audience, I don't know your name, but the audience,
is asking, at the end, you can have pro-layer in a stand-alone installation.
Yes, see, at the end, out of the cloud service that they are offering,
you can install, you know, and could you maintain,
with the siliah and all the capabilities by your own,
in your cloud that can be in the edge, without internet connection.
Okay.
Okay, please.
Thanks.
Okay, perfect.