Skip to content

Commit b453a6c

Browse files
author
Arnas Navašinskas
committed
Adding security examples
1 parent d159871 commit b453a6c

File tree

24 files changed

+905
-0
lines changed

24 files changed

+905
-0
lines changed

‎examples/aks/aks_cluster_with_security/README.MD‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Example of AKS cluster connected to CAST AI with enabled Kvisor security agent
2+
Following example creates AKS cluster and its supporting resources.\
3+
After AKS cluster is created it is onboarded to CAST AI.\
4+
[Kvisor security agent](https://docs.cast.ai/docs/kvisor) is deployed to the cluster and security policies are enabled.\
5+
See `install_security_agent` and `kvisor_values` variables in `castai.tf` file.\
6+
Example configuration should be analysed in the following order:
7+
1. Create Virtual network - `vnet.tf`
8+
2. Create AKS cluster - `aks.tf`
9+
3. Create CAST AI related resources to connect AKS cluster to CAST AI - `castai.tf`
10+
11+
# Usage
12+
1. Rename `tf.vars.example` to `tf.vars`
13+
2. Update `tf.vars` file with your cluster name, cluster region and CAST AI API token.
14+
3. Initialize Terraform. Under example root folder run:
15+
```
16+
terraform init
17+
```
18+
4. Run Terraform apply:
19+
```
20+
terraform apply -var-file=tf.vars
21+
```
22+
5. To destroy resources created by this example:
23+
```
24+
terraform destroy -var-file=tf.vars
25+
```
26+
27+
Please refer to this guide if you run into any issues https://docs.cast.ai/docs/terraform-troubleshooting

‎examples/aks/aks_cluster_with_security/aks.tf‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# 2. Create AKS cluster.
2+
3+
resource "azurerm_kubernetes_cluster" "this" {
4+
name = var.cluster_name
5+
resource_group_name = azurerm_resource_group.this.name
6+
location = azurerm_resource_group.this.location
7+
dns_prefix = var.cluster_name
8+
node_resource_group = "${var.cluster_name}-ng"
9+
10+
default_node_pool {
11+
name = "default"
12+
# Node count has to be > 2 to successfully deploy CAST AI controller.
13+
node_count = 2
14+
vm_size = "Standard_D2_v2"
15+
vnet_subnet_id = azurerm_subnet.internal.id
16+
}
17+
18+
identity {
19+
type = "SystemAssigned"
20+
}
21+
22+
tags = {
23+
Environment = "Test"
24+
}
25+
}

‎examples/aks/aks_cluster_with_security/castai.tf‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
# 3. Connect AKS cluster to CAST AI with enabled Kvisor security agent.
2+
3+
# Configure Data sources and providers required for CAST AI connection.
4+
data "azurerm_subscription" "current" {}
5+
6+
# Configure AKS cluster connection to CAST AI using CAST AI aks-cluster module with enabled Kvisor security agent.
7+
module "castai-aks-cluster" {
8+
source = "castai/aks/castai"
9+
10+
kvisor_grpc_addr = var.kvisor_grpc_addr
11+
12+
# Kvisor is an open-source security agent from CAST AI.
13+
# install_security_agent by default installs Kvisor controller (k8s: deployment)
14+
# https://docs.cast.ai/docs/kvisor
15+
install_security_agent = true
16+
17+
# Kvisor configuration examples, enable certain features:
18+
kvisor_values = [
19+
yamlencode({
20+
controller = {
21+
extraArgs = {
22+
# UI: Vulnerability management configuration = API: IMAGE_SCANNING
23+
"image-scan-enabled" = true
24+
# UI: Compliance configuration = API: CONFIGURATION_SCANNING
25+
"kube-bench-enabled" = true
26+
"kube-linter-enabled" = true
27+
}
28+
}
29+
30+
# UI: Runtime Security = API: RUNTIME_SECURITY
31+
agent = {
32+
# In order to enable Runtime security set agent.enabled to true.
33+
# This will install Kvisor agent (k8s: daemonset)
34+
# https://docs.cast.ai/docs/sec-runtime-security
35+
"enabled" = true
36+
37+
extraArgs = {
38+
# Runtime security configuration examples:
39+
# By default, most users enable the eBPF events and file hash enricher.
40+
# For all flag explanations and code, see: https://github.com/castai/kvisor/blob/main/cmd/agent/daemon/daemon.go
41+
"ebpf-events-enabled" = true
42+
"file-hash-enricher-enabled" = true
43+
# other examples
44+
"netflow-enabled" = false
45+
"netflow-export-interval" = "30s"
46+
"ebpf-program-metrics-enabled" = false
47+
"prom-metrics-export-enabled" = false
48+
"prom-metrics-export-interval" = "30s"
49+
"process-tree-enabled" = false
50+
}
51+
}
52+
})
53+
]
54+
55+
# Deprecated, leave this empty, to prevent setting defaults.
56+
kvisor_controller_extra_args = {}
57+
58+
# Everything else...
59+
60+
wait_for_cluster_ready = false
61+
62+
install_workload_autoscaler = false
63+
install_pod_mutator = false
64+
delete_nodes_on_disconnect = var.delete_nodes_on_disconnect
65+
66+
api_url = var.castai_api_url
67+
castai_api_token = var.castai_api_token
68+
grpc_url = var.castai_grpc_url
69+
70+
aks_cluster_name = var.cluster_name
71+
aks_cluster_region = var.cluster_region
72+
node_resource_group = azurerm_kubernetes_cluster.this.node_resource_group
73+
resource_group = azurerm_kubernetes_cluster.this.resource_group_name
74+
75+
subscription_id = data.azurerm_subscription.current.subscription_id
76+
tenant_id = data.azurerm_subscription.current.tenant_id
77+
78+
default_node_configuration = module.castai-aks-cluster.castai_node_configurations["default"]
79+
80+
node_configurations = {
81+
default = {
82+
disk_cpu_ratio = 25
83+
subnets = [azurerm_subnet.internal.id]
84+
tags = var.tags
85+
}
86+
}
87+
}

‎examples/aks/aks_cluster_with_security/providers.tf‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Following providers required by AKS and Vnet resources.
2+
provider "azurerm" {
3+
features {}
4+
subscription_id = var.subscription_id
5+
}
6+
7+
provider "castai" {
8+
api_token = var.castai_api_token
9+
api_url = var.castai_api_url
10+
}
11+
12+
provider "azuread" {
13+
tenant_id = data.azurerm_subscription.current.tenant_id
14+
}
15+
16+
provider "helm" {
17+
kubernetes {
18+
host = azurerm_kubernetes_cluster.this.kube_config.0.host
19+
client_certificate = base64decode(azurerm_kubernetes_cluster.this.kube_config.0.client_certificate)
20+
client_key = base64decode(azurerm_kubernetes_cluster.this.kube_config.0.client_key)
21+
cluster_ca_certificate = base64decode(azurerm_kubernetes_cluster.this.kube_config.0.cluster_ca_certificate)
22+
}
23+
}

‎examples/aks/aks_cluster_with_security/tf.vars.example‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
cluster_name = "<place-holder>"
2+
cluster_region = "<place-holder>"
3+
castai_api_token = "<place-holder>"
4+
subscription_id = "<place-holder>"

‎examples/aks/aks_cluster_with_security/variables.tf‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# AKS cluster variables.
2+
variable "cluster_name" {
3+
type = string
4+
description = "Name of the AKS cluster, resources will be created for."
5+
}
6+
7+
variable "cluster_region" {
8+
type = string
9+
description = "Region of the AKS cluster, resources will be created for."
10+
}
11+
12+
variable "castai_api_url" {
13+
type = string
14+
description = "URL of alternative CAST AI API to be used during development or testing"
15+
default = "https://api.cast.ai"
16+
}
17+
18+
# Variables required for connecting EKS cluster to CAST AI
19+
variable "castai_api_token" {
20+
type = string
21+
description = "CAST AI API token created in console.cast.ai API Access keys section"
22+
}
23+
24+
variable "castai_grpc_url" {
25+
type = string
26+
description = "CAST AI gRPC URL used by pod pinner"
27+
default = "grpc.cast.ai:443"
28+
}
29+
30+
variable "kvisor_grpc_addr" {
31+
type = string
32+
description = "CAST AI Kvisor optimized GRPC API address"
33+
default = "kvisor.prod-master.cast.ai:443" // If your cluster is in the EU region, update the grpcAddr to: https://kvisor.prod-eu.cast.ai:443
34+
}
35+
36+
variable "delete_nodes_on_disconnect" {
37+
type = bool
38+
description = "Optional parameter, if set to true - CAST AI provisioned nodes will be deleted from cloud on cluster disconnection. For production use it is recommended to set it to false."
39+
default = true
40+
}
41+
42+
variable "tags" {
43+
type = map(any)
44+
description = "Optional tags for new cluster nodes. This parameter applies only to new nodes - tags for old nodes are not reconciled."
45+
default = {}
46+
}
47+
48+
variable "subscription_id" {
49+
type = string
50+
description = "Azure subscription ID"
51+
}

‎examples/aks/aks_cluster_with_security/versions.tf‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
terraform {
2+
required_providers {
3+
azurerm = {
4+
source = "hashicorp/azurerm"
5+
}
6+
azuread = {
7+
source = "hashicorp/azuread"
8+
}
9+
castai = {
10+
source = "castai/castai"
11+
}
12+
}
13+
required_version = ">= 0.13"
14+
}

‎examples/aks/aks_cluster_with_security/vnet.tf‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# 1. Create virtual network and resource group for the cluster.
2+
3+
resource "azurerm_resource_group" "this" {
4+
name = var.cluster_name
5+
location = var.cluster_region
6+
}
7+
8+
resource "azurerm_virtual_network" "this" {
9+
name = "${var.cluster_name}-network"
10+
location = azurerm_resource_group.this.location
11+
resource_group_name = azurerm_resource_group.this.name
12+
address_space = ["10.1.0.0/16"]
13+
}
14+
15+
resource "azurerm_subnet" "internal" {
16+
name = "internal"
17+
virtual_network_name = azurerm_virtual_network.this.name
18+
resource_group_name = azurerm_resource_group.this.name
19+
address_prefixes = ["10.1.0.0/22"]
20+
}

‎examples/eks/eks_cluster_with_security/README.MD‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# Example of EKS cluster connected to CAST AI with enabled Kvisor security agent
2+
Following this example creates EKS cluster and its supporting resources using AWS community modules.\
3+
After EKS cluster is created it is onboarded to CAST AI.\
4+
[Kvisor security agent](https://docs.cast.ai/docs/kvisor) is deployed to the cluster and security policies are enabled.\
5+
See `install_security_agent` and `kvisor_values` variables in `castai.tf` file.\
6+
Example configuration should be analysed in the following order:
7+
1. Create VPC - `vpc.tf`
8+
2. Create EKS cluster - `eks.tf`
9+
3. Create CAST AI related resources to connect EKS cluster to CAST AI in read-only mode - `castai.tf`
10+
11+
# Usage
12+
1. Rename `tf.vars.example` to `tf.vars`
13+
2. Update `tf.vars` file with your cluster name, cluster region and CAST AI API token
14+
15+
| Variable | Description |
16+
| --- | --- |
17+
| cluster_name = "" | Name of cluster |
18+
| cluster_region = "" | Name of region of cluster |
19+
| castai_api_token = "" | Cast api token |
20+
21+
3. Initialize Terraform. Under example root folder run:
22+
```
23+
terraform init
24+
```
25+
4. Run Terraform apply:
26+
```
27+
terraform apply -var-file=tf.vars
28+
```
29+
5. To destroy resources created by this example:
30+
```
31+
terraform destroy -var-file=tf.vars
32+
```
33+
34+
Please refer to this guide if you run into any issues https://docs.cast.ai/docs/terraform-troubleshooting

0 commit comments

Comments
 (0)