Skip to content

Commit

Permalink
Merge pull request #50 from ScienceSoft-Inc/update_readme
Browse files Browse the repository at this point in the history
created a root Makefile and removed information from the db
  • Loading branch information
alavrovinfb authored May 10, 2023
2 parents b10d5b2 + c5d579b commit a767292
Show file tree
Hide file tree
Showing 9 changed files with 40 additions and 265 deletions.
96 changes: 22 additions & 74 deletions Makefile
Original file line number Diff line number Diff line change
@@ -1,83 +1,31 @@
## You can change these values
RELEASE_NAME_DB=db
RELEASE_NAME_MUTATOR=mutator
RELEASE_NAME_APP=app
TIMEOUT=30

.PHONY : all-darwin
all-darwin:
make minikube update-darwin docker-integrity-sum update-patch docker-mutator helm-all
@echo "==> Successfully installed"

.PHONY : all-linux
all-linux:
make minikube update-linux docker-integrity-sum update-patch docker-mutator helm-all
@echo "==> Successfully installed"

.PHONY : all-windows
all-windows:
make minikube update-linux docker-integrity-sum update-patch docker-mutator helm-all
@echo "==> Successfully installed"
# You can change these values
RELEASE_NAME_APP := app
IMAGE_EXPORT := integrity:latest
ALG := sha256
DIRS := "app,bin"

.PHONY : all
all: minikube start-minio-integrity-crd snapshots start-mutator helm-demo
@echo "==> Successfully installed all systems"

.PHONY : start-minio-integrity-crd
start-minio-integrity-crd:
make -C ./integrity-sum minio-install buildtools build docker crd-controller-build load-images crd-controller-deploy

.PHONY : snapshots
snapshots:
make -C ./integrity-sum IMAGE_EXPORT=$(IMAGE_EXPORT) ALG=$(ALG) DIRS=$(DIRS) export-fs snapshot helm-snapshot

.PHONY : start-mutator
start-mutator:
make -C ./integrity-mutator docker helm-mutator
@echo "==> Successfully installed mutator"

.PHONY : minikube
minikube:
minikube start

.PHONY : stop
stop:
helm uninstall ${RELEASE_NAME_APP}
helm uninstall ${RELEASE_NAME_MUTATOR}
helm uninstall ${RELEASE_NAME_DB}
minikube stop

.PHONY : docker-integrity-sum
docker-integrity-sum:
make -C integrity-sum docker

.PHONY : docker-mutator
docker-mutator: update-patch
make -C integrity-mutator docker

.PHONY: helm-all
helm-all: helm-database helm-mutator timeout helm-demo

.PHONY: helm-database
helm-database:
helm dependency update helm-charts/database-to-integrity-sum
helm install ${RELEASE_NAME_DB} helm-charts/database-to-integrity-sum
@echo "==> Successfully installed database"

.PHONY: helm-mutator
helm-mutator:
helm install ${RELEASE_NAME_MUTATOR} helm-charts/mutator
@echo "==> Successfully installed mutator"

.PHONY: helm-demo
helm-demo:
helm install ${RELEASE_NAME_APP} helm-charts/demo-apps-to-monitor
@echo "==> Successfully installed demo-apps"

.PHONE: timeout
timeout:
sleep ${TIMEOUT}

.PHONY: update-patch
update-patch:
cp patch-json-command.json integrity-mutator/

SECRET_DB="$$(grep 'secretName' helm-charts/database-to-integrity-sum/values.yaml | cut -d':' -f2 | tr -d '[:space:]')"
SECRET_HASHER="$$(grep 'secretNameDB' helm-charts/demo-apps-to-monitor/values.yaml | cut -d':' -f2 | tr -d '[:space:]')"
VALUE_RELEASE_NAME_APP="$$(grep 'releaseNameDB' helm-charts/demo-apps-to-monitor/values.yaml | cut -d':' -f2 | tr -d '[:space:]')"
PATCH_NAME="$$(grep -m2 'name' patch-json-command.json | tail -n1 | cut -d':' -f2 | tr -d '[:space:]' | sed 's/\"//g')"
SECRET_PATCH_NAME=${RELEASE_NAME_DB}-${SECRET_DB}
.PHONY: update-darwin
update-darwin:
sed -i '' "s/${PATCH_NAME}/${SECRET_PATCH_NAME}/" patch-json-command.json >> patch-json-command.json
sed -i '' "s/${SECRET_HASHER}/${SECRET_DB}/" helm-charts/demo-apps-to-monitor/values.yaml >> helm-charts/demo-apps-to-monitor/values.yaml
sed -i '' "s/${VALUE_RELEASE_NAME_APP}/${RELEASE_NAME_DB}/" helm-charts/demo-apps-to-monitor/values.yaml >> helm-charts/demo-apps-to-monitor/values.yaml

PHONY: update-linux
update-linux:
sed -i "s/${PATCH_NAME}/${SECRET_PATCH_NAME}/" patch-json-command.json >> patch-json-command.json
sed -i "s/${SECRET_HASHER}/${SECRET_DB}/" helm-charts/demo-apps-to-monitor/values.yaml >> helm-charts/demo-apps-to-monitor/values.yaml
sed -i "s/${VALUE_RELEASE_NAME_APP}/${RELEASE_NAME_DB}/" helm-charts/demo-apps-to-monitor/values.yaml >> helm-charts/demo-apps-to-monitor/values.yaml
100 changes: 16 additions & 84 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,19 +11,19 @@

# k8s-container-integrity-monitor

This program provides integrity monitoring that checks file or directory of container to determine whether or not they have been tampered with or corrupted.
k8s-container-integrity-monitor, which is a type of change auditing, verifies and validates these files by comparing them to the stored data in the database.
This program provides integrity monitoring that checks the container's file system to determine if they have been maliciously modified. If the program detects that files have been modified, updated, added, or compromised, it rolls back the deployment to the previous version.
This application consists of two repositories: the [integrity-sum](https://github.com/ScienceSoft-Inc/integrity-sum) and the [integrity-mutator](https://github.com/ScienceSoft-Inc/k8s-container-integrity-mutator) .

If program detects that files have been altered, updated, added or compromised, it rolls back deployments to a previous version.

k8s-container-integrity-monitor injects a `hasher container` with Integrity-sum app to your pods with the "hasher-certificates-injector-sidecar" label.
`Integrity-sum app` is the implementation of a hash calculation in golang, which monitors the checksum of files using different algorithms in Kubernetes:
Repository [integrity-sum](https://github.com/ScienceSoft-Inc/integrity-sum) injects hasher-sidecar into your modules as a sidecar container. sidecar integrity is a golang implementation of a hasher that calculates the checksum of files using various algorithms in kubernetes:
* MD5
* SHA256
* SHA1
* SHA224
* SHA384
* SHA512
* BEE2 (optional)

Repository [integrity-mutator](https://github.com/ScienceSoft-Inc/k8s-container-integrity-mutator) implements sidecar container for monitoring.

## Architecture
### Component diagram
Expand All @@ -44,11 +44,11 @@ $ git clone https://github.com/ScienceSoft-Inc/k8s-container-integrity-monitor.g
Initialize and update submodules
```
$ git submodule init
$ git submodule update
$ git submodule update --remote
```

## :hammer: Installing components
### Running locally
### Install minikube
The code only works running inside a pod in Kubernetes.
You need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster.
If you do not already have a cluster, you can create one by using `minikube`.
Expand All @@ -69,75 +69,12 @@ To work properly, you first need to set the configuration files:
+ values in the file `helm-charts/mutator/values.yaml`

## Manual start
+ Minikube start
```
minikube start
```
1) You should go to the [README.md (Generate certificates)](https://github.com/ScienceSoft-Inc/k8s-container-integrity-mutator/blob/main/README.md) in the `./k8s-container-integrity-mutator` project and set all the settings and certificates.
```
cd integrity-mutator
```
Set certificates.

You need to go to the file `patch-json-command.json`
and change `"envFrom":"secretRef":"name": "release db name and secret name"`
where `release db name and secret name` = will be release name db-variable value secretName in the file `helm-charts/database-to-integrity-sum/values.yaml`
1) You should go to the [README.md](https://github.com/ScienceSoft-Inc/k8s-container-integrity-mutator) in the `./integrity-mutator` project, set all the configurations and deploy.

Move patch-json-command to mutator directory:
```
cd ./..
cp patch-json-command.json integrity-mutator/
```
2) You should go to the [README.md](https://github.com/ScienceSoft-Inc/integrity-sum) in the `./integrity-sum`project project, set all the configurations and deploy.
However, you need to go to the `"Run application"` section and configure the dependencies that are indicated by `"Need to install dependencies"`.

Download the named modules into the module cache
```
go mod download
```

Build docker images mutator:
```
eval $(minikube docker-env)
cd integrity-mutator
docker build -t mutator .
```
or
```
eval $(minikube docker-env)
docker build -t mutator -f integrity-mutator/Dockerfile .
```
Install helm chart from the project root, for example:
```
helm install mutator helm-charts/mutator
```
2) You need to install the database using helm charts from the project root.

Update the on-disk dependencies to mirror Chart.yaml.
```
helm dependency update helm-charts/database-to-integrity-sum
```
Install helm chart from the project root, for example:
```
helm install db helm-charts/database-to-integrity-sum
```

3) You should go to the `./integrity-sum` project and set environment variables in `.env` file.

Download the named modules into the module cache
```
go mod download
```

Build docker images hasher:
```
eval $(minikube docker-env)
cd integrity-sum
docker build -t hasher .
```
or
```
eval $(minikube docker-env)
docker build -t hasher -f integrity-sum/Dockerfile .
```
Install helm chart from the project root, for example:
```
helm install app helm-charts/demo-apps-to-monitor
Expand All @@ -146,21 +83,16 @@ helm install app helm-charts/demo-apps-to-monitor
## Quick start
### Using Makefile
You can use make function.
Runs all necessary cleaning targets and dependencies for the project according your OS:
```
make all-darwin
make all-linux
make all-windows
```
Remove an installed Helm deployments and stop minikube:
```
make stop
make all
```

## Troubleshooting

Sometimes you may find that pod is injected with sidecar container as expected, check the following items:

1) The pod is in running state with `hasher-sidecar` sidecar container injected and no error logs.
2) Check if the application demo-pod has he correct labels `hasher-certificates-injector-sidecar: "true"` and installed `main-process-name`.
1) The pod is in running state with `integrity` sidecar container injected and no error logs.
2) Check if the application pod has the correct annotations as described above.
___________________________

## License
Expand Down
12 changes: 0 additions & 12 deletions helm-charts/database-to-integrity-sum/Chart.yaml

This file was deleted.

Binary file not shown.
17 changes: 0 additions & 17 deletions helm-charts/database-to-integrity-sum/templates/secrets.yaml

This file was deleted.

72 changes: 0 additions & 72 deletions helm-charts/database-to-integrity-sum/values.yaml

This file was deleted.

4 changes: 0 additions & 4 deletions helm-charts/demo-apps-to-monitor/values.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,3 @@ configMap:
name: integrity-sum-config
processName: nginx # Container process name
mountPath: etc/nginx # Tracked folder path

# Data secrets in the database
secretNameDB: secret-database-to-integrity-sum
releaseNameDB: db
2 changes: 1 addition & 1 deletion integrity-mutator
Submodule integrity-mutator updated 44 files
+14 −0 .gitignore
+4 −10 Dockerfile
+35 −18 Makefile
+58 −41 README.md
+7 −2 certificates/tls/ca-config.json
+34 −0 cmd/config.go
+12 −52 cmd/main.go
+29 −12 go.mod
+387 −110 go.sum
+9 −5 helm-charts/demo-app-to-inject/Chart.yaml
+23 −0 helm-charts/demo-app-to-inject/charts/rsyslog/.helmignore
+6 −0 helm-charts/demo-app-to-inject/charts/rsyslog/Chart.yaml
+1 −0 helm-charts/demo-app-to-inject/charts/rsyslog/templates/NOTES.txt
+52 −0 helm-charts/demo-app-to-inject/charts/rsyslog/templates/_helpers.tpl
+9 −0 helm-charts/demo-app-to-inject/charts/rsyslog/templates/configmap.yaml
+74 −0 helm-charts/demo-app-to-inject/charts/rsyslog/templates/deployment.yaml
+15 −0 helm-charts/demo-app-to-inject/charts/rsyslog/templates/pvc.yaml
+15 −0 helm-charts/demo-app-to-inject/charts/rsyslog/templates/service.yaml
+60 −0 helm-charts/demo-app-to-inject/charts/rsyslog/values.yaml
+5 −1 helm-charts/demo-app-to-inject/templates/deployment.yaml
+31 −0 helm-charts/demo-app-to-inject/templates/serviceAccount.yaml
+14 −1 helm-charts/demo-app-to-inject/values.yaml
+23 −0 helm-charts/integrity-injector/.helmignore
+24 −0 helm-charts/integrity-injector/Chart.yaml
+47 −0 helm-charts/integrity-injector/files/monitor-sidecar-config.yaml
+75 −0 helm-charts/integrity-injector/templates/_helpers.tpl
+70 −0 helm-charts/integrity-injector/templates/deployment.yaml
+15 −0 helm-charts/integrity-injector/templates/service.yaml
+12 −0 helm-charts/integrity-injector/templates/serviceaccount.yaml
+8 −0 helm-charts/integrity-injector/templates/sidecar-configmap.yaml
+45 −0 helm-charts/integrity-injector/templates/webhook.yaml
+103 −0 helm-charts/integrity-injector/values.yaml
+0 −6 helm-charts/mutator/Chart.yaml
+0 −8 helm-charts/mutator/templates/webhook-configMap.yaml
+0 −21 helm-charts/mutator/templates/webhook-configuration.yaml
+0 −29 helm-charts/mutator/templates/webhook-deployment.yaml
+0 −12 helm-charts/mutator/templates/webhook-service.yaml
+0 −39 helm-charts/mutator/values.yaml
+0 −25 patch-json-command.json
+75 −0 pkg/handlers/mutate.go
+113 −45 pkg/mutate/mutate.go
+97 −0 pkg/mutate/mutate_test.go
+102 −0 pkg/mutate/patch.go
+55 −0 pkg/mutate/patch_test.go
2 changes: 1 addition & 1 deletion integrity-sum
Submodule integrity-sum updated 136 files

0 comments on commit a767292

Please sign in to comment.