diff --git a/docs/understanding_bigbang/kube-apiserver_webhooks_diagram.md b/docs/understanding_bigbang/kube-apiserver_webhooks_diagram.md
index c50063c0eca8c471823ed2b20e0a3333a2ec0183..2168dfe71dba92c9cd57332d25939a485ca1caf2 100644
--- a/docs/understanding_bigbang/kube-apiserver_webhooks_diagram.md
+++ b/docs/understanding_bigbang/kube-apiserver_webhooks_diagram.md
@@ -6,10 +6,10 @@
* Kubernetes Security Best Practice (per [kube-bench](https://github.com/aquasecurity/kube-bench)) for requests to the kube-apiserver is that requests should go through the following flow of controls:
1. mTLS Authentication via x509 certs:
* This is baked into Kubernetes
- 2. RBAC Authorization of users and Node Authentication for worker nodes
+ 1. RBAC Authorization of users and Node Authentication for worker nodes
* `--authorization-mode=Node,RBAC` flag on kube-apiserver ensures this is set.
* Deployed applications contain YAML manifests with rbac rules to minimize the rights of the application's service account.
- 3. Admission Controllers: These take effect after Authn and Authz have occurred and allow the functionality of the api-server to be extended to enable additional security controls and advanced features.
+ 1. Admission Controllers: These take effect after Authn and Authz have occurred and allow the functionality of the api-server to be extended to enable additional security controls and advanced features.
* There are apiserver plugins baked into Kubernetes that just need to be turned on like `--enable-admission-plugins=NodeRestriction` per kube-bench.
* There's also webhooks that allow extending the apiserver with custom logic, this will be overviewed in the diagram below.
@@ -27,7 +27,7 @@
#### 2. Mutating Admission Controllers
-* This improves user experience for developers. If a namespace is labeled `istio-injection=enabled`, then a developer can submit a YAML manifest where the pod only needs to reference 1 container image/the application. After the request is authenticated and authorized against the kube-apiserver, it's admission controller will see a mutating admission webhook exists and the manifest will be sent to the istiod pod in the istio-system namespace to mutate the manifest and inject an istio init container and istio envoy proxy sidecar container into the YAML manifest. This allows the developer's pod to be integrated into the service mesh with minimal configuration / effort on their part/no adjustments to their YAMLs were needed.
+* This improves user experience for developers. If a namespace is labeled `istio-injection=enabled`, then a developer can submit a YAML manifest where the pod only needs to reference 1 container image/the application. After the request is authenticated and authorized against the kube-apiserver, it's admission controller will see a mutating admission webhook exists and the manifest will be sent to the `istiod` pod in the `istio-system` namespace to mutate the manifest and inject an Istio init container and Istio envoy proxy sidecar container into the YAML manifest. This allows the developer's pod to be integrated into the service mesh with minimal configuration / effort on their part/no adjustments to their YAMLs were needed.
* Note: It's possible to use Istio CNI Plugin to eliminate the need for Istio Init Containers.
#### 3. Validating Admission Controllers
diff --git a/docs/understanding_bigbang/licensing_expectations.md b/docs/understanding_bigbang/licensing_expectations.md
index 9937d3faac73cd61885b7c8f7c3b4d0664326a2f..bc83001735fe9c2583348617cd207075a2932961 100644
--- a/docs/understanding_bigbang/licensing_expectations.md
+++ b/docs/understanding_bigbang/licensing_expectations.md
@@ -1,60 +1,62 @@
# BigBang Licensing Expectations
+
While BigBang is open source and free to use, the same cannot be said of its components. The licensing requirements of components requires a nuanced explanation. The intent of this document is to be a self service resource to help consumers of BigBang make an informed decision regarding licenses they may need to successfully deploy an ATO'able DevSecOps Platform using BigBang.
+## What Licenses Do I Need for Bigbang?
+
+There are two issues that make it difficult to figure out BigBang's license requirements:
-## What Licenses do I need for BigBang?
-There are 2 issues that make it difficult to figure out BigBang's license requirements:
1. The modular (and in some cases swappable) componentized nature of BigBang means choices affect license requirements. OS, Kubernetes Distribution, and Application decisions need to be made before license requirements can be sorted out.
-2. Freemium applications often require a license to unlock features like HA (High Availability), advanced SSO functionality with authn, authz, and audit logging of federated users, or advanced compliance controls like FIPS 140-2 mode, compliance reporting, or audit logs.
+1. Freemium applications often require a license to unlock features like HA (High Availability), advanced SSO functionality with authn, authz, and audit logging of federated users, or advanced compliance controls like FIPS 140-2 mode, compliance reporting, or audit logs.
+## What Components Could Have Licenses?
-## What components could have licenses?
1. OS / CSP(Cloud Service Providers) VM Images
* RHEL requires a subscription and comes with vendor support
* CSPs often offer licensed VM Images at additional per hour cost, these add features like offloading STIG/CIS OS hardening
* Several free Linux OS Distributions exist, including Ubuntu and free RHEL alternatives like Amazon Linux 2 and others. There are also tools like [openscap](https://www.open-scap.org/), which has ansible and bash scripts to automate STIG/CIS benchmark compliance for OS security to help automate DIY hardening of the OS.
-2. Kubernetes Distributions
+1. Kubernetes Distributions
* RedHat OpenShift, VMware TKG, and D2IQ Konvoy each require a license, that comes with support and additional features, they each offer 30-90 day trial licenses
* There are free options like kubeadm, k0s, k3s, RKE2, talos-systems, and many other CNCF compliant distributions.
* k0s, RKE2, and talos-systems are free options with optional paid Vendor Support.
-3. BigBang's Core Applications:
+1. BigBang's Core Applications:
* Many of the core applications are free open source software
* Twistlock is a core component that requires a license
* ElasticSearch is a core component that requires a license to unlock additional features, that could be considered required in some cases (more on this nuance below.)
* Although BigBang is free, support can be purchased.
-4. BigBang's AddOn Applications:
+1. BigBang's AddOn Applications:
* Also include a mix of free, freemium, and licensed products.
+## Who Purchases the Licenses?
-## Who purchases the licenses?
-Licensing of products deployable by BigBang are not covered by the BigBang team. As a general rule of thumb the acquisition of licenses is the responsibility of the end-user's organization, and product vendors should be contacted for support of their respective products. (PartyBus is an example of an exception to the rule of thumb.)
+Licensing of products deployable by BigBang are not covered by the BigBang team. As a general rule of thumb the acquisition of licenses is the responsibility of the end-user's organization, and product vendors should be contacted for support of their respective products. (PartyBus is an example of an exception to the rule of thumb.)
+## Who Decides If a Licenced Feature in a Freemium Application Is a Hard Requirement?
-## Who decides if a licenced feature in a freemium application is a hard requirement?
* The Consumer of BigBang, their security team, and their AO (Authorizing official) need to decide if licensed features constitute a hard requirement or if free tier functionality can be considered at lower impact levels or unique use cases.
* In most cases licenses will be required due to Security Controls only being available in the fully licensed version; however, users may be able to hold off on licensed versions for non-ATO'd proof of concept deployments or risk acceptance by an AO for unique scenarios.
* Even if there isn't a hard requirement for a license (like in the case of a Kubernetes Cluster), consumers of BigBang may still want to consider purchasing licenses or support contracts.
-
-## Table to help Elaborate on Nuances of Application Licensing:
-| Package | Purpose | Licenses | Notes about Licensed Features and Support |
-|-------------------------------------------------------------------------|-------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| FluxCD | GitOps<br>(Prerequisite App) | Apache License 2.0<br>(Free/OSS) | |
-| Open Policy Agent Gatekeeper | Policy Enforcement<br>(Core App) | Apache License 2.0<br>(Free/OSS) | * [Styra](https://www.openpolicyagent.org/support) is the original creator of OPA and can offer commercial support. |
-| Istio Controlplane, Istio Operator,<br>and Kiali | Service Mesh, Operator, and<br>Service Mesh Dashboard<br>(Core App) | Apache License 2.0<br>(Free/OSS) | * [Tetrate](https://www.tetrate.io/) is an Istio Vendor that can offer commercial support. |
-| Jaeger | APM (Application Performance Monitoring)<br>/ Tracing<br>(Core App) | Apache License 2.0<br>(Free/OSS) | |
-| Prometheus Operator Stack <br>(Prometheus, Grafana, AlertManager, etc.) | Metrics, Metrics Dashboard, and Alerts<br>(Core App) | Apache License 2.0<br>[Future versions will move to GNU Affero GPL v3](https://grafana.com/blog/2021/04/20/grafana-loki-tempo-relicensing-to-agplv3/)<br>(Free/OSS) | |
-| Fluentbit | Log Shipper<br>(Core App) | Apache License 2.0<br>(Free/OSS) | |
-| ECK (Elastic Cloud on Kubernetes)<br>(ElasticSearch and Kibana) | Log Storage and Log Dashboard<br>(Core App) | [Elastic License](https://github.com/elastic/cloud-on-k8s/blob/master/LICENSE.txt)<br>(Freemium) | **Enterprise features of note:** Kibana SSO, authn, authz, FIPS 140-2 mode, audit logging require an enterprise tier license.<br>**Free tier notes:** BigBang's Authservice/Authentication Proxy could be put in front of Kibana to achieve basic SSO with all or nothing access.<br>PartyBus uses licensed ElasticSearch<br>https://www.elastic.co/subscriptions<br>https://repo1.dso.mil/platform-one/big-bang/bigbang/-/blob/master/charter/packages/elasticsearch-kibana/Architecture.md#licensing |
-| Cluster Auditor | Collects OPA GK events and sends them to <br>ElasticSearch for Review<br>(Core App) | Apache License 2.0<br>(Free/OSS) | |
-| Twistlock / Prisma Cloud | Runtime Security, Security Dashboard,<br>Intrusion Prevention<br>(Core App) | Prisma Cloud Compute License<br>(Paid Product that requiring a license) | **Prisma Cloud License is required for an ATO'd cluster.** [Considering investigating alternatives](https://repo1.dso.mil/groups/platform-one/big-bang/-/epics/74)<br>Licenses are sold per node. Each defender on a node uses 7 credits and the credits are purchased in bundles of 100 credits. <br>https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/welcome/licensing<br>https://docs.paloaltonetworks.com/prisma/prisma-cloud/20-09/prisma-cloud-compute-edition-admin/install/install_kubernetes.html<br>https://repo1.dso.mil/platform-one/big-bang/bigbang/-/blob/master/charter/packages/twistlock/Architecture.md#licensing |
-| ArgoCD | GitOps<br>(AddOn App) | Apache License 2.0<br>(Free/OSS) | |
-| Velero | Backup and Recovery of Persistent Volumes<br>(AddOn App) | Apache License 2.0<br>(Free/OSS) | |
-| Keycloak | SSO (Single Sign On) and Federated Authn.<br>(AddOn App) | Apache License 2.0<br>(Free/OSS) | |
-| Authservice (and HA Proxy) | SSO Authentication Proxy<br>(AddOn App) | Apache License 2.0 <br>& GNU General Public License Version 2(Free/OSS) | |
-| Mattermost, Mattermost Operator | Self Hosted Chat<br>(AddOn App) | [Mattermost is comprised of Multiple Licenses](https://mattermost.org/licensing/) | **Enterprise features of note:** HA, Additional SSO options, prometheus metrics integration, Elasticsearch integration to optimize searching/indexing, Compliance Reporting, Audit Logs, Advanced roles and permissions.<br>**Free tier notes:** A non-HA deployment can quickly auto heal thanks to Kubernetes, the free tier can use Gitlab or P1's Keycloak implementation for Federated SSO. (MM Plugins don't need the paid version, but the need a single node instance or the paid HA for cluster awareness to prevent duplicate triggering of functions.)<br>PartyBus uses the Enterprise E20 licensed version.<br>https://repo1.dso.mil/platform-one/big-bang/bigbang/-/blob/master/charter/packages/mattermost/Architecture.md#licensing<br>https://mattermost.org/licensing/<br>https://mattermost.com/pricing-self-managed/ |
-| Minio, Minio Operator | Self Hosted S3 API compatible object storage<br>(AddOn App) | Affero General Public License Version 3<br>(Free/OSS) | Commercial Support is Available:<br>https://min.io/pricing |
-| Nexus | Generic Artifact Repository<br>(AddOn App) | Nexus Repository OSS: Eclipse Public License v1.0<br>Nexus Repository Pro: Paid Licensed product | **Enterprise features of note:** HA, SAML SSO, Auth Token Support<br>**Free tier notes:** A non-HA deployment can quickly auto heal thanks to Kubernetes, AWS S3 blob storage.<br>https://www.sonatype.com/products/repository-oss-vs-pro-features<br>https://www.sonatype.com/products/pricing |
-| Gitlab, Gitlab Runners | GitRepo, Container Registry, and <br>CICD Software Factory<br>(AddOn App) | Gitlab Community Edition: MIT Expat license<br>Gitlab Enterprise Edition: (multiple tiers) | **Premium features of note:** Release Controls, Project Management<br>**Ultimate features of note:** Unlimited Guest Users, Advanced Security Testing (Note this functionality comes from container images that may not yet be in IronBank)<br>**Free tier notes:** Free tier is fine for Proof of Concepts, but the Release Controls in Premium tier contain security controls that would be necessary for a cATO pipeline.<br>PartyBus has multiple instances of Gitlab, most use Premium, a few use Ultimate.<br>PartyBus's Gitlab pipelines integrate with additional licensed apps: Twistlock, Anchore, [Fortify](https://repo1.dso.mil/platform-one/big-bang/apps/third-party/fortify), [SD Elements](https://www.securitycompass.com/sdelements/), and others. (This is offered as a data point, it doesn't mean these are required for a cATO pipeline, the Consumer of BigBang's AO makes that call.)<br>https://about.gitlab.com/pricing/#self-managed<br>https://gitlab.com/gitlab-org/gitlab-foss/-/tree/master#editions |
-| SonarQube Community Edition | Static Code Analysis<br>(AddOn App) | SonarQube CE: GNU Lesser GPL License v3<br>(Community Edition is Free/OSS) | An Enterprise Edition Exists, but is not bundled by BigBang |
-| Anchore Enterprise Edition* | Vulnerability Scanner<br>(AddOn App) | Anchore Enterprise Edition (Paid/Licensed)<br>Anchore OpenSource Edition Apache License 2.0 (Free/OSS) | **Licensed features of note:** Proprietary Vulnerability Data Feeds for increased accuracy, NIST 800-190, Docker CIS Compliance, DoD container Policy Compliance, cATO Capable, RBAC, SSO<br>**Free tier notes:** BigBang's values file can be set to deploy the OSS version for Proof of Concept deployments.<br>PartyBus and other Platform One services use the licensed version<br>https://docs.anchore.com/current/docs/faq/#2<br>https://anchore.com/pricing/<br>https://repo1.dso.mil/platform-one/big-bang/bigbang/-/blob/master/charter/packages/anchore/Architecture.md#licensing<br>https://repo1.dso.mil/platform-one/big-bang/apps/security-tools/anchore-enterprise/-/blob/main/docs/CHART.md#adding-enterprise-components |
+## Table to Help Elaborate on Nuances of Application Licensing
+
+| Package | Purpose | Licenses | Notes about Licensed Features and Support |
+|-----------------------------------------------------------------------|---------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| FluxCD | GitOps (Prerequisite App) | Apache License 2.0 (Free/OSS) | |
+| Open Policy Agent Gatekeeper | Policy Enforcement (Core App) | Apache License 2.0 (Free/OSS) | * [Styra](https://www.openpolicyagent.org/support) is the original creator of OPA and can offer commercial support. |
+| Istio Controlplane, Istio Operator, and Kiali | Service Mesh, Operator, and Service Mesh Dashboard (Core App) | Apache License 2.0 (Free/OSS) | * [Tetrate](https://www.tetrate.io/) is an Istio Vendor that can offer commercial support. |
+| Jaeger | APM (Application Performance Monitoring) / Tracing (Core App) | Apache License 2.0 (Free/OSS) | |
+| Prometheus Operator Stack (Prometheus, Grafana, AlertManager, etc.) | Metrics, Metrics Dashboard, and Alerts (Core App) | Apache License 2.0 [Future versions will move to GNU Affero GPL v3](https://grafana.com/blog/2021/04/20/grafana-loki-tempo-relicensing-to-agplv3/) (Free/OSS) | |
+| Fluentbit | Log Shipper (Core App) | Apache License 2.0 (Free/OSS) | |
+| ECK (Elastic Cloud on Kubernetes) (ElasticSearch and Kibana) | Log Storage and Log Dashboard (Core App) | [Elastic License](https://github.com/elastic/cloud-on-k8s/blob/master/LICENSE.txt) (Freemium) | **Enterprise features of note:** Kibana SSO, authn, authz, FIPS 140-2 mode, audit logging require an enterprise tier license. **Free tier notes:** BigBang's Authservice/Authentication Proxy could be put in front of Kibana to achieve basic SSO with all or nothing access. PartyBus uses licensed ElasticSearch <https://www.elastic.co/subscriptions> <https://repo1.dso.mil/platform-one/big-bang/bigbang/-/blob/master/charter/packages/elasticsearch-kibana/Architecture.md#licensing> |
+| Cluster Auditor | Collects OPA GK events and sends them to ElasticSearch for Review (Core App) | Apache License 2.0 (Free/OSS) | |
+| Twistlock / Prisma Cloud | Runtime Security, Security Dashboard, Intrusion Prevention (Core App) | Prisma Cloud Compute License (Paid Product that requiring a license) | **Prisma Cloud License is required for an ATO'd cluster.** [Considering investigating alternatives](https://repo1.dso.mil/groups/platform-one/big-bang/-/epics/74) Licenses are sold per node. Each defender on a node uses 7 credits and the credits are purchased in bundles of 100 credits. <https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/welcome/licensing> <https://docs.paloaltonetworks.com/prisma/prisma-cloud/20-09/prisma-cloud-compute-edition-admin/install/install_kubernetes.html> <https://repo1.dso.mil/platform-one/big-bang/bigbang/-/blob/master/charter/packages/twistlock/Architecture.md#licensing> |
+| ArgoCD | GitOps (AddOn App) | Apache License 2.0 (Free/OSS) | |
+| Velero | Backup and Recovery of Persistent Volumes (AddOn App) | Apache License 2.0 (Free/OSS) | |
+| Keycloak | SSO (Single Sign On) and Federated Authn. (AddOn App) | Apache License 2.0 (Free/OSS) | |
+| Authservice (and HA Proxy) | SSO Authentication Proxy (AddOn App) | Apache License 2.0 & GNU General Public License Version 2(Free/OSS) | |
+| Mattermost, Mattermost Operator | Self Hosted Chat (AddOn App) | [Mattermost is comprised of Multiple Licenses](<https://mattermost.org/licensing/>) | **Enterprise features of note:** HA, Additional SSO options, prometheus metrics integration, Elasticsearch integration to optimize searching/indexing, Compliance Reporting, Audit Logs, Advanced roles and permissions. **Free tier notes:** A non-HA deployment can quickly auto heal thanks to Kubernetes, the free tier can use Gitlab or P1's Keycloak implementation for Federated SSO. (MM Plugins don't need the paid version, but the need a single node instance or the paid HA for cluster awareness to prevent duplicate triggering of functions.) PartyBus uses the Enterprise E20 licensed version. <https://repo1.dso.mil/platform-one/big-bang/bigbang/-/blob/master/charter/packages/mattermost/Architecture.md#licensing> <https://mattermost.org/licensing/> <https://mattermost.com/pricing-self-managed/> |
+| Minio, Minio Operator | Self Hosted S3 API compatible object storage (AddOn App) | Affero General Public License Version 3 (Free/OSS) | Commercial Support is Available: <https://min.io/pricing> |
+| Nexus | Generic Artifact Repository (AddOn App) | Nexus Repository OSS: Eclipse Public License v1.0 Nexus Repository Pro: Paid Licensed product | **Enterprise features of note:** HA, SAML SSO, Auth Token Support **Free tier notes:** A non-HA deployment can quickly auto heal thanks to Kubernetes, AWS S3 blob storage. <https://www.sonatype.com/products/repository-oss-vs-pro-features> <https://www.sonatype.com/products/pricing> |
+| Gitlab, Gitlab Runners | GitRepo, Container Registry, and CICD Software Factory (AddOn App) | Gitlab Community Edition: MIT Expat license Gitlab Enterprise Edition: (multiple tiers) | **Premium features of note:** Release Controls, Project Management **Ultimate features of note:** Unlimited Guest Users, Advanced Security Testing (Note this functionality comes from container images that may not yet be in IronBank) **Free tier notes:** Free tier is fine for Proof of Concepts, but the Release Controls in Premium tier contain security controls that would be necessary for a cATO pipeline. PartyBus has multiple instances of Gitlab, most use Premium, a few use Ultimate. PartyBus's Gitlab pipelines integrate with additional licensed apps: Twistlock, Anchore, [Fortify](https://repo1.dso.mil/platform-one/big-bang/apps/third-party/fortify), [SD Elements](https://www.securitycompass.com/sdelements/), and others. (This is offered as a data point, it doesn't mean these are required for a cATO pipeline, the Consumer of BigBang's AO makes that call.) <https://about.gitlab.com/pricing/#self-managed> <https://gitlab.com/gitlab-org/gitlab-foss/-/tree/master#editions> |
+| SonarQube Community Edition | Static Code Analysis (AddOn App) | SonarQube CE: GNU Lesser GPL License v3 (Community Edition is Free/OSS) | An Enterprise Edition Exists, but is not bundled by BigBang |
+| Anchore Enterprise Edition* | Vulnerability Scanner (AddOn App) | Anchore Enterprise Edition (Paid/Licensed) Anchore OpenSource Edition Apache License 2.0 (Free/OSS) | **Licensed features of note:** Proprietary Vulnerability Data Feeds for increased accuracy, NIST 800-190, Docker CIS Compliance, DoD container Policy Compliance, cATO Capable, RBAC, SSO **Free tier notes:** BigBang's values file can be set to deploy the OSS version for Proof of Concept deployments. PartyBus and other Platform One services use the licensed version <https://docs.anchore.com/current/docs/faq/#2> <https://anchore.com/pricing/> <https://repo1.dso.mil/platform-one/big-bang/bigbang/-/blob/master/charter/packages/anchore/Architecture.md#licensing> <https://repo1.dso.mil/platform-one/big-bang/apps/security-tools/anchore-enterprise/-/blob/main/docs/CHART.md#adding-enterprise-components> |