{"id":20858829,"url":"https://github.com/controlplaneio/threat-modelling-zero-trust-talk","last_synced_at":"2025-09-05T16:33:20.737Z","repository":{"id":160295365,"uuid":"605113949","full_name":"controlplaneio/threat-modelling-zero-trust-talk","owner":"controlplaneio","description":null,"archived":false,"fork":false,"pushed_at":"2023-05-02T07:38:09.000Z","size":9314,"stargazers_count":11,"open_issues_count":0,"forks_count":0,"subscribers_count":19,"default_branch":"main","last_synced_at":"2025-05-12T22:52:09.505Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/controlplaneio.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-02-22T13:29:33.000Z","updated_at":"2024-11-08T09:01:41.000Z","dependencies_parsed_at":"2023-05-03T20:16:52.053Z","dependency_job_id":null,"html_url":"https://github.com/controlplaneio/threat-modelling-zero-trust-talk","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/controlplaneio/threat-modelling-zero-trust-talk","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/controlplaneio%2Fthreat-modelling-zero-trust-talk","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/controlplaneio%2Fthreat-modelling-zero-trust-talk/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/controlplaneio%2Fthreat-modelling-zero-trust-talk/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/controlplaneio%2Fthreat-modelling-zero-trust-talk/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/controlplaneio","download_url":"https://codeload.github.com/controlplaneio/threat-modelling-zero-trust-talk/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/controlplaneio%2Fthreat-modelling-zero-trust-talk/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":266567582,"owners_count":23949382,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-07-22T02:00:09.085Z","response_time":66,"last_error":null,"robots_txt_status":null,"robots_txt_updated_at":null,"robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-18T04:47:41.196Z","updated_at":"2025-07-22T20:33:04.791Z","avatar_url":"https://github.com/controlplaneio.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Threat Modelling Zero Trust Demo\n\nThis repo demonstrates how the example architecture from the ControlPlane talk `What can go wrong when you trust nobody? \nThreat Modelling Zero Trust`, can be run locally in a Kind cluster. This allows us to spin up components quickly and \neasily, with only a small amount of cloud resources required. Understanding each component in more detail by configuring\nintegrations in this manner will ultimately lead to a more comprehensive threat model.\n\n:warning: This is a proof of concept to support the talk and reinforce the benefits of prototyping early when threat\nmodelling. You are free to use this code as a starting point but don't run it in a production environment.\n\nTwo demonstrations are included:\n- Demo 1 - Authenticate to AWS from a Pod in our Kind cluster, using an SVID issued by the cluster's SPIRE server.\n- Demo 2 - Deploy two workloads in an Istio service mesh, with External Authorisation set up using OPA sidecars. \nOPA policy bundles are downloaded from an S3 bucket. Istio is integrated with SPIRE, and Rego traffic authorisation \npolicies are based on X.509 SVIDs provided to our workloads via SPIRE.\n\n## Prereqs\n\nIn order to run the examples, an active set of AWS credentials must be available when running the various commands.\n\nThis examples uses a number of S3 Buckets, in order to ensure you get unique names, you set the `NAME` environment\nvariable to something unique to you.\n\n```shell\nexport NAME=something-unique-to-you\n```\n\n## Infra Up\n\n1. Create a Kind cluster and preload third party images\n2. Build and load the various images used in the demo\n3. Deploy SPIRE with OIDC Discovery exposed using an S3 Bucket\n\nMore details can be found [here](spire/README.md).\n\n```shell\nmake cluster-up cluster-preload-images\nmake image-build-load-jwks-retriever \\\n  image-build-load-s3-consumer \\\n  image-build-load-jwt-retriever \\\n  image-build-load-opa-istio-kms\nmake spire-deploy\n```\n\nThese are the key components for this deployment: \n\n* [SPIRE OIDC Bucket](spire/infra/oidc-bucket.tf)\n* [SPIRE OIDC Provider](spire/infra/oidc-provider.tf)\n* [Templated configuration files](spire/infra/templates)\n* [JWKS Retriever](jwks-retriever/main.go)\nAvailable after `make spire-deploy`\n* [SPIRE OIDC Discovery Document](spire/oidc/openid-configuration)\n* [SPIRE JWKS](spire/oidc/keys)\n\n## Example One\n\nIn this scenario an example service retrieves an object from an S3 bucket.\n\nMore details can be found [here](s3-consumer/README.md).\n\n1. Deploy the s3-consumer application\n2. Verify everything is working\n3. Cleanup\n\n```shell\nmake example-one-deploy\n```\n\n[Check](https://localhost:30000/flair)\n\n```shell\nmake example-one-clean\n```\n\n* [Target Bucket](s3-consumer/infra/target-bucket.tf) and access policy\n* [Federated Role](s3-consumer/infra/target-bucket-federated-role.tf)\n* [S3 Consumer](s3-consumer/main.go) manually exchanging the SPIRE JWT SVID for temporary AWS Credentials\n* View the application logs\n\n## Example Two\n\nIn this scenario we deploy Istio with SPIRE provided X.509 SVIDs for mTLS and a customised OPA Istio sidecar that uses\nour custom bundle signing plugin utilising KMS keys. Kyverno injects the sidecars into the two workloads and the OPA \nsidecar reads the JWT SVID from a shared volume and exchanges this for temporary credentials to access S3 and KMS.\n\nMore details can be found [here](opa-istio-kms/README.md).\n\n1. Deploy Kyverno and Istio\n2. Sign and publish the OPA Bundle and deploy the example workloads\n3. Check the Istio certs are issued by SPIRE\n4. Check the communication uses Istio's External Authorisation (and spell it properly)\n5. Cleanup\n\n```shell\nmake kyverno-deploy istio-deploy\nmake example-two-opa-publish example-two-deploy\nmake example-two-check-istio-certs\nmake example-two-send-requests\nmake example-two-delete istio-clean\n```\n\n* [OPA Policy Bucket](istio/infra/opa-policy-bucket.tf)\n* [OPA Bundle Signing Keys](istio/infra/opa-signing-keys.tf)\n* [OPA Role](istio/infra/opa-role.tf)\n* [Templated configuration files](istio/infra/templates)\n  * Istio Operator configuration\n  * Kyverno policy to inject configured OPA sidecar\n  * Istio configuration for loading and verifying the bundles from S3 using KMS and automagic AWS credentials\n* [JWT Watcher](jwt-retriever/main.go)\nAvailable after `make istio-deploy`\n* [OPA Policy](opa/example.rego) from template\n\n## Infra Down\n\n1. Delete the S3 resources for SPIRE and the Kind cluster\n\n```shell\nmake spire-clean cluster-down\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcontrolplaneio%2Fthreat-modelling-zero-trust-talk","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcontrolplaneio%2Fthreat-modelling-zero-trust-talk","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcontrolplaneio%2Fthreat-modelling-zero-trust-talk/lists"}