From 5458db93cf38028d9a5298b3dd4386f5e5872efa Mon Sep 17 00:00:00 2001 From: mathieuHa Date: Fri, 30 Dec 2022 22:20:45 +0100 Subject: [PATCH] :memo: 40 Add working exemple on kubernetes (#56) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * :memo: Add initial doc and file structure * :bento: Add struct for crowdsec * :memo: Update doc install cs * 🚧 Update exemple, add traefik settings * 📝 Update doc for kubernetes * 📝 update doc on kubernetes usage * 📝 Add read logs from traefik * 📝 Add read logs from traefik * 📝 Update doc lisibility * 📝 Update doc with new namespace * 📝 Update doc with enable plugin in traefik * 📝 Update doc on kube * 📝 Finish exemple of Kubernetes * 📝 Update after review --- README.md | 3 + exemples/kubernetes/README.md | 91 +++++++++++++++++++ exemples/kubernetes/crowdsec/service.yml | 14 +++ exemples/kubernetes/crowdsec/values.yml | 25 +++++ exemples/kubernetes/traefik/dashboard.yml | 14 +++ exemples/kubernetes/traefik/plugin.yml | 14 +++ exemples/kubernetes/traefik/values.yml | 19 ++++ exemples/kubernetes/whoami/whoami-ingress.yml | 20 ++++ .../kubernetes/whoami/whoami-services.yml | 14 +++ exemples/kubernetes/whoami/whoami.yml | 24 +++++ 10 files changed, 238 insertions(+) create mode 100644 exemples/kubernetes/README.md create mode 100644 exemples/kubernetes/crowdsec/service.yml create mode 100644 exemples/kubernetes/crowdsec/values.yml create mode 100644 exemples/kubernetes/traefik/dashboard.yml create mode 100644 exemples/kubernetes/traefik/plugin.yml create mode 100644 exemples/kubernetes/traefik/values.yml create mode 100644 exemples/kubernetes/whoami/whoami-ingress.yml create mode 100644 exemples/kubernetes/whoami/whoami-services.yml create mode 100644 exemples/kubernetes/whoami/whoami.yml diff --git a/README.md b/README.md index 088fb0e..1169322 100644 --- a/README.md +++ b/README.md @@ -475,6 +475,9 @@ Note: > This example is still in Beta and use a new version of Crowdsec (v1.4.3) at time of writing A functionnality has been disabled in Crowdsec in order to make the example work DISABLE_AGENT: "true" +6. Using Crowdsec and Traefik in Kubernetes + +A complete exemple is available in [exemples/kubernetes/README.md](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/blob/main/exemples/kubernetes/README.md) ### About diff --git a/exemples/kubernetes/README.md b/exemples/kubernetes/README.md new file mode 100644 index 0000000..521f300 --- /dev/null +++ b/exemples/kubernetes/README.md @@ -0,0 +1,91 @@ +### Kubernetes Exemple + +#### Official docs + +##### Install Kubernetes on Docker Desktop + +Install Docker Desktop + +[https://www.docker.com/products/docker-desktop/](https://www.docker.com/products/docker-desktop/) + +In settings, click on `Kubernetes` menu, and click `Enable Kubernetes`, then `Apply and Restart`. +In case of any issue, you can reset the cluster from this menu and the button `Reset Kubernetes Cluster`. + +##### Install Traefik + +[getting-started/install-traefik/#use-the-helm-chart](https://doc.traefik.io/traefik/getting-started/install-traefik/#use-the-helm-chart) + +```bash +helm repo add traefik https://traefik.github.io/charts +helm repo update +kubectl create ns traefik +helm upgrade --install --namespace=traefik \ + --values=./traefik/values.yml \ + traefik traefik/traefik +``` + +#### View the Traefik dashboard + +> Port forward the dashboard: + +```bash +kubectl --namespace=traefik port-forward $(kubectl get pods --namespace=traefik --selector "app.kubernetes.io/name=traefik" --output=name) 9000:9000 +``` + +Access the dashboard with: [localhost:9000/dashboard/#/](http://localhost:9000/dashboard/#/) + +#### Install the plugin + +```bash +kubectl apply -f traefik/plugin.yml +``` + +#### Install Whoami +```bash +kubectl apply -f whoami/whoami.yml +kubectl apply -f whoami/whoami-services.yml +kubectl apply -f whoami/whoami-ingress.yml +``` + +#### Access Whoami + +> Port forward web port of Traefik + +```bash +kubectl --namespace=traefik port-forward $(kubectl get pods --namespace=traefik --selector "app.kubernetes.io/name=traefik" --output=name) 8000:8000 +``` + +Access the whoami with: [localhost:8000/](http://localhost:8000/) + +#### Install Crowdsec + +[helm/crowdsec/crowdsec](https://artifacthub.io/packages/helm/crowdsec/crowdsec) + +```bash +helm repo add crowdsec https://crowdsecurity.github.io/helm-charts +helm repo update +kubectl create ns crowdsec +helm upgrade --install --namespace=crowdsec \ + --values=./crowdsec/values.yml \ + crowdsec crowdsec/crowdsec +``` + +#### Read Traefik Logs + +```bash +kubectl get pod --namespace traefik +kubectl logs $(kubectl get pods --namespace=traefik --selector "app.kubernetes.io/name=traefik" --output=name) --namespace traefik -f +``` + +#### Use CSCLI in Crowdsec container + +```bash +kubectl -n crowdsec exec -it $(kubectl get pods -n crowdsec --selector "k8s-app=crowdsec,type=lapi" --output=name) bash +``` + + +#### Shell in Traefik container + +```bash +kubectl -n traefik exec -it $(kubectl get pods -n traefik --selector "app.kubernetes.io/name=traefik" --output=name) sh +``` \ No newline at end of file diff --git a/exemples/kubernetes/crowdsec/service.yml b/exemples/kubernetes/crowdsec/service.yml new file mode 100644 index 0000000..766f514 --- /dev/null +++ b/exemples/kubernetes/crowdsec/service.yml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: crowdsec + namespace: crowdsec + +spec: + ports: + - name: web + port: 8080 + targetPort: web + + selector: + app: crowdsec diff --git a/exemples/kubernetes/crowdsec/values.yml b/exemples/kubernetes/crowdsec/values.yml new file mode 100644 index 0000000..2a517b8 --- /dev/null +++ b/exemples/kubernetes/crowdsec/values.yml @@ -0,0 +1,25 @@ +image: + tag: v1.4.4-rc1 + +agent: + acquisition: + - namespace: traefik + podName: traefik-* + program: traefik + env: + - name: COLLECTIONS + value: "crowdsecurity/traefik" + +lapi: + dashboard: + enabled: false + env: + - name: ENROLL_KEY + value: 40796d93c2958f9e58345514e67740e5 + - name: ENROLL_INSTANCE_NAME + value: k8s_cluster + - name: ENROLL_TAGS + value: "k8s linux test" + # If it's a test, we don't want to share signals with CrowdSec so disable the Online API. + - name: DISABLE_ONLINE_API + value: true diff --git a/exemples/kubernetes/traefik/dashboard.yml b/exemples/kubernetes/traefik/dashboard.yml new file mode 100644 index 0000000..6afb348 --- /dev/null +++ b/exemples/kubernetes/traefik/dashboard.yml @@ -0,0 +1,14 @@ +# dashboard.yaml +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: dashboard +spec: + entryPoints: + - web + routes: + - match: Host(`traefik.localhost`) && (PathPrefix(`/dashboard`) || PathPrefix(`/api`)) + kind: Rule + services: + - name: api@internal + kind: TraefikService diff --git a/exemples/kubernetes/traefik/plugin.yml b/exemples/kubernetes/traefik/plugin.yml new file mode 100644 index 0000000..263fa99 --- /dev/null +++ b/exemples/kubernetes/traefik/plugin.yml @@ -0,0 +1,14 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: bouncer + namespace: traefik +spec: + plugin: + bouncer: + CrowdsecLapiKey: 40796d93c2958f9e58345514e67740e5 + Enabled: "true" + logLevel: DEBUG + crowdsecMode: live + crowdsecLapiHost: crowdsec-service.crowdsec.svc.cluster.local:8080 + crowdsecLapiScheme: http diff --git a/exemples/kubernetes/traefik/values.yml b/exemples/kubernetes/traefik/values.yml new file mode 100644 index 0000000..9be4375 --- /dev/null +++ b/exemples/kubernetes/traefik/values.yml @@ -0,0 +1,19 @@ +image: + tag: v2.9.6 + +logs: + general: + level: DEBUG + access: + enabled: true + fields: + headers: + defaultmode: keep + +experimental: + plugins: + enabled: true + +additionalArguments: + - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin" + - "--experimental.plugins.bouncer.version=v1.1.7-beta1" diff --git a/exemples/kubernetes/whoami/whoami-ingress.yml b/exemples/kubernetes/whoami/whoami-ingress.yml new file mode 100644 index 0000000..057edae --- /dev/null +++ b/exemples/kubernetes/whoami/whoami-ingress.yml @@ -0,0 +1,20 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: whoami + namespace: traefik + annotations: + traefik.ingress.kubernetes.io/router.middlewares: traefik-bouncer@kubernetescrd + traefik.ingress.kubernetes.io/router.entrypoints: web + +spec: + rules: + - http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: whoami + port: + name: web diff --git a/exemples/kubernetes/whoami/whoami-services.yml b/exemples/kubernetes/whoami/whoami-services.yml new file mode 100644 index 0000000..c3d27cd --- /dev/null +++ b/exemples/kubernetes/whoami/whoami-services.yml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: whoami + namespace: traefik + +spec: + ports: + - name: web + port: 80 + targetPort: web + + selector: + app: whoami diff --git a/exemples/kubernetes/whoami/whoami.yml b/exemples/kubernetes/whoami/whoami.yml new file mode 100644 index 0000000..fe649b5 --- /dev/null +++ b/exemples/kubernetes/whoami/whoami.yml @@ -0,0 +1,24 @@ +kind: Deployment +apiVersion: apps/v1 +metadata: + name: whoami + namespace: traefik + labels: + app: whoami + +spec: + replicas: 1 + selector: + matchLabels: + app: whoami + template: + metadata: + labels: + app: whoami + spec: + containers: + - name: whoami + image: traefik/whoami + ports: + - name: web + containerPort: 80