diff --git a/Makefile b/Makefile index 0d42f25..7497c68 100644 --- a/Makefile +++ b/Makefile @@ -10,7 +10,7 @@ run: build .PHONY: run-container run-container: - docker compose up --build + docker compose up --build -f deployments/unorchestrated/docker-compose.yaml .PHONY: build build: diff --git a/deployments/ecs/ecs-task-execution-role-policy.json b/deployments/ecs/ecs-task-execution-role-policy.json new file mode 100644 index 0000000..6984a97 --- /dev/null +++ b/deployments/ecs/ecs-task-execution-role-policy.json @@ -0,0 +1,17 @@ +{ + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "ecr:GetAuthorizationToken", + "ecr:BatchCheckLayerAvailability", + "ecr:GetDownloadUrlForLayer", + "ecr:BatchGetImage", + "logs:CreateLogStream", + "logs:PutLogEvents" + ], + "Resource": "*" + } + ] +} diff --git a/deployments/ecs/service-template.json b/deployments/ecs/service-template.json new file mode 100644 index 0000000..d6661f9 --- /dev/null +++ b/deployments/ecs/service-template.json @@ -0,0 +1,171 @@ +{ + "services": [ + { + "serviceArn": "", + "serviceName": "armored-container-service", + "clusterArn": "", + "loadBalancers": [], + "serviceRegistries": [], + "status": "ACTIVE", + "desiredCount": 1, + "runningCount": 1, + "pendingCount": 0, + "launchType": "FARGATE", + "platformVersion": "LATEST", + "platformFamily": "Linux", + "taskDefinition": "", + "deploymentConfiguration": { + "deploymentCircuitBreaker": { + "enable": true, + "rollback": true + }, + "maximumPercent": 200, + "minimumHealthyPercent": 100 + }, + "deployments": [ + { + "id": "ecs-svc/5095800472445100540", + "status": "PRIMARY", + "taskDefinition": "", + "desiredCount": 1, + "pendingCount": 0, + "runningCount": 1, + "failedTasks": 0, + "createdAt": "2023-07-21T08:51:00.958000+05:30", + "updatedAt": "2023-07-21T08:55:31.914000+05:30", + "launchType": "FARGATE", + "platformVersion": "1.4.0", + "platformFamily": "Linux", + "networkConfiguration": { + "awsvpcConfiguration": { + "subnets": [ + "" + ], + "securityGroups": [ + "" + ], + "assignPublicIp": "ENABLED" + } + }, + "rolloutState": "COMPLETED", + "rolloutStateReason": "ECS deployment ecs-svc/5095800472445100540 completed." + } + ], + "roleArn": "", + "events": [ + { + "id": "4830fc3a-888e-42e0-9aaa-b5bbe577516a", + "createdAt": "2023-07-21T14:55:57.171000+05:30", + "message": "(service armored-container-service) has reached a steady state." + }, + { + "id": "9adf848e-5746-48a6-9ddf-bf6e91aabdfe", + "createdAt": "2023-07-21T08:55:31.919000+05:30", + "message": "(service armored-container-service) has reached a steady state." + }, + { + "id": "7876ab74-6a06-4eec-9204-83a578e06c82", + "createdAt": "2023-07-21T08:55:31.918000+05:30", + "message": "(service armored-container-service) (deployment ecs-svc/5095800472445100540) deployment completed." + }, + { + "id": "c4287cf2-6715-4dc3-a765-755ad0d9d4b3", + "createdAt": "2023-07-21T08:52:53.739000+05:30", + "message": "(service armored-container-service) has stopped 1 running tasks: (task 18227ab7d612451eac7fa799285fac34)." + }, + { + "id": "e079943b-56a2-41ca-a137-5c95d0c6ffbe", + "createdAt": "2023-07-21T08:51:28.038000+05:30", + "message": "(service armored-container-service) has started 1 tasks: (task 8b696488625c43b29917bc0011d514a0)." + }, + { + "id": "9c9f0895-6e14-40db-873e-e88f4e3076c8", + "createdAt": "2023-07-21T05:35:16.087000+05:30", + "message": "(service armored-container-service) has reached a steady state." + }, + { + "id": "1606f4cc-7ef1-4207-94e0-51909503d096", + "createdAt": "2023-07-20T23:34:59.019000+05:30", + "message": "(service armored-container-service) has reached a steady state." + }, + { + "id": "c7f1d66f-a53c-4fdb-98bf-d0b4fd043a57", + "createdAt": "2023-07-20T17:34:50.060000+05:30", + "message": "(service armored-container-service) has reached a steady state." + }, + { + "id": "00e875cf-d912-419b-9622-c5469c907e3c", + "createdAt": "2023-07-20T17:34:50.059000+05:30", + "message": "(service armored-container-service) (deployment ecs-svc/1917268798230133817) deployment completed." + }, + { + "id": "f6426454-b74f-4611-9141-2118a3c72473", + "createdAt": "2023-07-20T17:32:45.974000+05:30", + "message": "(service armored-container-service) has stopped 1 running tasks: (task 445da4a243334c2da49816bc8e4512c6)." + }, + { + "id": "84711db2-558e-4a86-bbf4-8a4cd22ecdd7", + "createdAt": "2023-07-20T17:31:27.654000+05:30", + "message": "(service armored-container-service) has started 1 tasks: (task 18227ab7d612451eac7fa799285fac34)." + }, + { + "id": "1c4d7266-e709-4ba9-9847-ba29806235e5", + "createdAt": "2023-07-20T16:45:35.519000+05:30", + "message": "(service armored-container-service) has reached a steady state." + }, + { + "id": "13e0d28e-7ca4-4f60-9fd4-102fe9ce43ec", + "createdAt": "2023-07-20T16:45:35.518000+05:30", + "message": "(service armored-container-service) (deployment ecs-svc/0095785089613403979) deployment completed." + }, + { + "id": "5c8c861e-4a2e-4a51-ab07-f03d6248292c", + "createdAt": "2023-07-20T16:43:22.581000+05:30", + "message": "(service armored-container-service) has stopped 1 running tasks: (task 9afc04248a984b8282619bef1c23ec19)." + }, + { + "id": "4df652dc-6a1f-418f-9e90-4bb2d4d1f647", + "createdAt": "2023-07-20T16:42:13.912000+05:30", + "message": "(service armored-container-service) has started 1 tasks: (task 445da4a243334c2da49816bc8e4512c6)." + }, + { + "id": "25eff47b-5fcc-4a5d-b75b-b29fea6c6df0", + "createdAt": "2023-07-20T16:29:48.915000+05:30", + "message": "(service armored-container-service) has reached a steady state." + }, + { + "id": "b67b857b-2989-4d49-9eb9-1dd361207cec", + "createdAt": "2023-07-20T16:29:48.914000+05:30", + "message": "(service armored-container-service) (deployment ecs-svc/5137600825021193598) deployment completed." + }, + { + "id": "f951a069-73d5-417c-94a8-dc4f9bfb089a", + "createdAt": "2023-07-20T16:27:26.557000+05:30", + "message": "(service armored-container-service) has started 1 tasks: (task 9afc04248a984b8282619bef1c23ec19)." + } + ], + "createdAt": "2023-07-20T16:27:23.049000+05:30", + "placementConstraints": [], + "placementStrategy": [], + "networkConfiguration": { + "awsvpcConfiguration": { + "subnets": [ + "" + ], + "securityGroups": [ + "" + ] + } + }, + "schedulingStrategy": "REPLICA", + "deploymentController": { + "type": "ECS" + }, + "createdBy": "", + "enableECSManagedTags": true, + "propagateTags": "NONE", + "enableExecuteCommand": false + } + ], + "failures": [] +} diff --git a/deployments/ecs/task-template.json b/deployments/ecs/task-template.json new file mode 100644 index 0000000..7366bc8 --- /dev/null +++ b/deployments/ecs/task-template.json @@ -0,0 +1,95 @@ +{ + "family": "", + "containerDefinitions": [ + { + "name": "", + "image": "", + "cpu": 0, + "essential": true, + "command": [ + "kubearmor/bluelock", + "" + ], + "environment": [ + { + "name": "K8S", + "value": "false" + }, + { + "name": "CONTAINERNAME", + "value": "" + }, + { + "name": "RELAYSERVERURL", + "value": "http://:" + } + ], + "mountPoints": [ + { + "sourceVolume": "kubearmor-dir", + "containerPath": "/kubearmor", + "readOnly": true + } + ], + "volumesFrom": [], + "dependsOn": [ + { + "containerName": "bluelock", + "condition": "SUCCESS" + } + ], + "logConfiguration": { + "logDriver": "awslogs", + "options": { + "awslogs-create-group": "true", + "awslogs-group": "/ecs/", + "awslogs-region": "us-east-2", + "awslogs-stream-prefix": "ecs" + } + } + }, + { + "name": "bluelock", + "image": "delusionaloptimist/bluelock:latest", + "cpu": 0, + "portMappings": [], + "essential": false, + "environment": [], + "mountPoints": [ + { + "sourceVolume": "kubearmor-dir", + "containerPath": "/kubearmor", + "readOnly": false + } + ], + "volumesFrom": [], + "logConfiguration": { + "logDriver": "awslogs", + "options": { + "awslogs-create-group": "true", + "awslogs-group": "/ecs/", + "awslogs-region": "us-east-2", + "awslogs-stream-prefix": "ecs" + } + } + } + ], + "taskRoleArn": "", + "executionRoleArn": "", + "networkMode": "awsvpc", + "volumes": [ + { + "name": "kubearmor-dir", + "host": {} + } + ], + "requiresCompatibilities": [ + "FARGATE" + ], + "cpu": "256", + "memory": "512", + "runtimePlatform": { + "cpuArchitecture": "X86_64", + "operatingSystemFamily": "LINUX" + } +} diff --git a/deployments/kubernetes/deployment.yaml b/deployments/kubernetes/deployment.yaml new file mode 100644 index 0000000..9661917 --- /dev/null +++ b/deployments/kubernetes/deployment.yaml @@ -0,0 +1,86 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + # EDIT + name: +spec: + replicas: 1 + selector: + matchLabels: + # EDIT + kubearmor.io/container.name: + template: + metadata: + labels: + # EDIT + kubearmor.io/container.name: + spec: + # init contianer injects bluelock binary into a shared volume + initContainers: + - name: bluelock + image: daemon1024/bluelock + imagePullPolicy: Always + volumeMounts: + - mountPath: /kubearmor + name: kubearmor-dir + + # shared volume + volumes: + - emptyDir: {} + name: kubearmor-dir + + # service account used by kubearmor, don't change this + serviceAccountName: kubearmor + + containers: + # EDIT - specify a container name + - name: + # EDIT - specify a container image + image: + # EDIT - specify image pull policy + imagePullPolicy: Always + + # this executes bluelock, don't change this + command: + - /kubearmor/bluelock + + # EDIT - replace with your default command + args: + - "" + + # shared volume mount + volumeMounts: + - mountPath: /kubearmor + name: kubearmor-dir + env: + # needed for connecting with relay-server + - name: "RELAYSERVERURL" + value: "http://kubearmor.kube-system.svc.cluster.local:32767" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: kubearmor-clusterrolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin +subjects: +- kind: ServiceAccount + name: kubearmor + namespace: default +- kind: ServiceAccount + name: kubearmor + namespace: kube-system +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: kubearmor + namespace: default +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: kubearmor + namespace: kube-system diff --git a/relay-deployment.yaml b/deployments/kubernetes/relay-deployment.yaml similarity index 91% rename from relay-deployment.yaml rename to deployments/kubernetes/relay-deployment.yaml index 48a7e0e..5eced7d 100644 --- a/relay-deployment.yaml +++ b/deployments/kubernetes/relay-deployment.yaml @@ -10,9 +10,6 @@ spec: - name: "grpc-port" port: 32767 protocol: TCP - - name: "http-port" - port: 2801 - protocol: TCP --- apiVersion: apps/v1 kind: Deployment @@ -40,7 +37,6 @@ spec: imagePullPolicy: Always ports: - containerPort: 32767 - - containerPort: 2801 resources: requests: cpu: 250m diff --git a/deployments/unorchestrated/docker-compose.yaml b/deployments/unorchestrated/docker-compose.yaml new file mode 100644 index 0000000..7cdd50b --- /dev/null +++ b/deployments/unorchestrated/docker-compose.yaml @@ -0,0 +1,58 @@ +version: '3.8' +volumes: + kubearmor-dir: {} +services: + # copy kubearmor binary to a shared vol + # REQUIRED + bluelock: + container_name: bluelock + build: + context: . + image: delusionaloptimist/bluelock:latest + #image: accuknox/bluelock:latest + volumes: + - kubearmor-dir:/kubearmor + + # relay server + kubearmor-relay-server: + # REQUIRED FIELDS + image: delusionaloptimist/kubearmor-relay-server:latest + #image: kubearmor/kubearmor-relay-server:latest + command: ["-k8s=false"] + + # OPTIONAL FIELDS + container_name: kubearmor-relay-server + # depending on your network mode + networks: + - bluelock-test-net + ports: + # gRPC port for relay + # clients and kubearmor both connect to this + - "32767:32767" + + + # application container + # update service name + : + # REQUIRED FIELDS + depends_on: + - bluelock + image: + volumes: + - kubearmor-dir:/kubearmor + entrypoint: + - "/kubearmor/bluelock" + # edit this and set your command + command: + - "" + environment: + # in docker private network mode, container name can be used to access a container + - RELAYSERVERURL=http://kubearmor-relay-server:32767 + - K8S=false + # this is the container name that would be used to match policies + # doesn't have to be + - CONTAINERNAME= + + # OPTIONAL FIELDS + networks: + - bluelock-test-net diff --git a/docs/ecs.md b/docs/ecs.md new file mode 100644 index 0000000..bb98209 --- /dev/null +++ b/docs/ecs.md @@ -0,0 +1,136 @@ +# ECS Fargate +ECS is a managed container service from AWS. Unlike EKS, it isn't based on Kubernetes and thus, the lack of a control plane API makes it difficult to manage orchestration of policies, networking between containers and other such features which KubeArmor generally depends on. + +Also, ECS can run on fargate enabled nodes making containers secure but at the same time more difficult to monitor. For instance, it isn't possible to mount container runtime socket in containers running in fargate nodes thus, we can only get limited metadata about the containers. + +# Getting started +Create a Fargate enabled ECS cluster by following the [official guide](https://docs.aws.amazon.com/AmazonECS/latest/userguide/create-cluster-console-v2.html). + +## Deployment models +There are two deployments models currently supported by KubeArmor with ECS. One deploys KubeArmor Relay Server in a VM outside the ECS cluster and the other deploys it inside the cluster as a task. +* [With Relay deployed externally](#external-relay-deployment) +* [Wtih Relay deployed in-cluster](#in-cluster-relay-deployment) + +### External relay deployment + +#### Deployment diagram +![External relay deployment](res/kubearmor-ecs-with-external-relay.svg) + +#### Deploying Relay Server +You can use any bare metal or cloud VM which can run Docker containers to deploy KubeArmor relay-server. +The relay-server is accessed by both the user and KubeArmor. The best approach is to give the VM running relay server a public IP. +To deploy relay-server as a Docker container, run: +```bash +docker run -d --name=kubearmor-relay-server --network=host -e "K8S=false" delusionaloptimist/kubearmor-relay-server:latest +``` +This will start the relay and it'll start actively listening for incoming connections for receiving/sending logs and policies. + +#### Deploying KubeArmor protected applications on ECS +1. For this demo, we'll be deploying the [sample-task](../examples/ecs/sample-task.json) which creates a reverse shell accessible over port 1337. + + **Specifying command** + The first part of your command would always need to be path to KubeArmor binary mounted by the shared volume. + The rest of it will be default commmand. + ```json + "command": [ + "kubearmor/bluelock", + "socat", + "TCP-LISTEN:1337,reuseaddr,fork", + "EXEC:bash,pty,stderr,setsid,sigint,sane" + ], + ``` + + **KubeArmor configuration** + Configuration is specified using environment variables. + ```json + "environment": [ + { + "name": "K8S", + "value": "false" + }, + { + "name": "CONTAINERNAME", + "value": "armored-container" + }, + { + "name": "RELAYSERVERURL", + "value": "http://:" + } + ], + ``` + `CONTAINERNAME` is used to match container policies. + `RELAYSERVERURL` is the public address of the VM running relay-server. This will be used by KubeArmor for sending logs and receiving policies. If no port is specified, port 80 is used. Substitute this value in the sample-task. + + You can follow the [task-template](../deployments/ecs/task-template.json) to create your own task definitions. Some values are intentionally `REDACTED` or enclosed within `<>` as they contain information that user is expected to complete. + + You should also follow the [offical guide](https://docs.aws.amazon.com/AmazonECS/latest/userguide/create-task-definition.html) for creating ECS task definitions according to your needs. + + **IAM** + A Basic KubeArmor setup should work with the default `taskExecutionRole` IAM permissions granted to all ECS tasks. While creating a new task you have the option to let AWS create it for you. Will be using this role itself for this demo. + If your application needs access to AWS APIs, you can follow [ECS task execution role guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_execution_IAM_role.html) to create an IAM role with required permissions and add it to your task as `taskRole`. You can also reference the [sample task role policy](../deployments/ecs/ecs-task-execution-role-policy.json). + + +2. Once you have created the task defintion, you should deploy it as a service in your ECS cluster. + + Follow [Creating an ECS service using the console](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/create-service-console-v2.html). + + For this demo, our task will need a public IP. Thus, make sure you enable public IP in the network section while creating a service. + + **Note On ServiceConnect** + ServiceConnect is a networking mode in ECS which injects Envoy proxies and configures ECS ServiceDiscovery for service to service communication. All the ingress and egress traffic goes through these proxies. + By default Envoy has a setting to timeout inactive connections within 15 seconds and they recommend [disabling](https://www.envoyproxy.io/docs/envoy/latest/faq/configuration/timeouts#route-timeouts) this for workloads which use stream connections. However, currently there is no option provided in ECS to configure the proxies. See [aws/containers-roadmap#1958](https://github.com/aws/containers-roadmap/issues/1958) for reference. + Thus, this mode does work with KubeArmor but is still not recommended to use until AWS resolves the issues. + + In absence of ServiceConnect, you'll need to setup ServiceDiscovery for your services manually. AWS has removed ServiceDiscovery configuration in the new console and the only way it can be configured while creation is using the [classic console](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/create-service.html). + + +#### Verifying setup +**Prequisite** +- Install karmor (kubearmor-client) on your system using the [installation steps](https://github.com/kubearmor/kubearmor-client). +- To validate the demo workload, make sure you have socat on your system. + +**Creating a reverse shell** +From your cluster's main page, navigate to the task running the demo container and copy the public IP from the Network tab. +On your system create a reverse shell into the application with: +```bash +socat - TCP::1337 +``` +You should now be able to execute Linux commands. + +**Telemetry logs** +For getting telemetry logs, you can run: +```bash +karmor logs --gRPC=: --logFilter=all +``` +Try running some commands in the reverse shell we created earlier, you'll see telemetry logs showing up in karmor's output. + +If you want to get only policy alerts remove the `--logFilter` flag. + +**Policy enforcement** +A sample policy which enforce on the demo `armored-container` is available at [examples/ecs/sample-block-policy.yaml](../examples/ecs/sample-block-policy.yaml) + +If your container is named differently, you'll need to set the selector as the value of `CONTAINERNAME` environment variable set in KubeArmor configuration. +```yaml + selector: + matchLabels: + kubearmor.io/container.name: '' +``` +You can also set the selector as `*` if you wish to enforce this policy upon all containers. +```yaml + selector: + matchLabels: + kubearmor.io/container.name: '*' +``` + +Apply the sample policy with: +```bash +karmor vm policy add examples/ecs/sample-block-policy.yaml --gRPC=: +``` + +For CRUD operations on policies see +```bash +karmor vm policy help +``` + +### In-Cluster relay deployment +TODO diff --git a/docs/res/kubearmor-ecs-with-external-relay.svg b/docs/res/kubearmor-ecs-with-external-relay.svg new file mode 100644 index 0000000..2583cd9 --- /dev/null +++ b/docs/res/kubearmor-ecs-with-external-relay.svg @@ -0,0 +1,17 @@ + + + + + + + + KubeArmor Relay ServerKubeArmorentrypoint.shexecTask 1KubeArmorentrypoint.shexecTask 2awsvpckarmor/accuknox-cliECS With External RelayRemote VMPoliciesLogsPoliciesLogs \ No newline at end of file diff --git a/saas-demo.md b/docs/saas-demo-eks.md similarity index 97% rename from saas-demo.md rename to docs/saas-demo-eks.md index 1cf7536..05954be 100644 --- a/saas-demo.md +++ b/docs/saas-demo-eks.md @@ -23,7 +23,6 @@ ![](https://hackmd.io/_uploads/S12tfh6rn.png) - # Deployment Modification to add runtime protection to your workload The parent binary responsible for runtime security is portable. We need to mount it to the container have it spawn the entrypoint. @@ -70,9 +69,7 @@ Modified Deployment: name: kubearmor-dir env: - name: "RELAYSERVERURL" - value: "http://kubearmor.kube-system.svc.cluster.local:2801" - #- name: "SIDEKICK_URL" - # value: "http://kubearmor.kube-system.svc.cluster.local:2801" + value: "http://kubearmor.kube-system.svc.cluster.local:32767" ... ``` diff --git a/ecs/sample-service.json b/ecs/sample-service.json deleted file mode 100644 index a71cc1b..0000000 --- a/ecs/sample-service.json +++ /dev/null @@ -1,172 +0,0 @@ -{ - "services": [ - { - "serviceArn": "", - "serviceName": "armored-container-service", - "clusterArn": "", - "loadBalancers": [], - "serviceRegistries": [], - "status": "ACTIVE", - "desiredCount": 1, - "runningCount": 1, - "pendingCount": 0, - "launchType": "FARGATE", - "platformVersion": "LATEST", - "platformFamily": "Linux", - "taskDefinition": "", - "deploymentConfiguration": { - "deploymentCircuitBreaker": { - "enable": true, - "rollback": true - }, - "maximumPercent": 200, - "minimumHealthyPercent": 100 - }, - "deployments": [ - { - "id": "ecs-svc/5095800472445100540", - "status": "PRIMARY", - "taskDefinition": "", - "desiredCount": 1, - "pendingCount": 0, - "runningCount": 1, - "failedTasks": 0, - "createdAt": "2023-07-21T08:51:00.958000+05:30", - "updatedAt": "2023-07-21T08:55:31.914000+05:30", - "launchType": "FARGATE", - "platformVersion": "1.4.0", - "platformFamily": "Linux", - "networkConfiguration": { - "awsvpcConfiguration": { - "subnets": [ - "" - ], - "securityGroups": [ - "" - ], - "assignPublicIp": "ENABLED" - } - }, - "rolloutState": "COMPLETED", - "rolloutStateReason": "ECS deployment ecs-svc/5095800472445100540 completed." - } - ], - "roleArn": "", - "events": [ - { - "id": "4830fc3a-888e-42e0-9aaa-b5bbe577516a", - "createdAt": "2023-07-21T14:55:57.171000+05:30", - "message": "(service armored-container-service) has reached a steady state." - }, - { - "id": "9adf848e-5746-48a6-9ddf-bf6e91aabdfe", - "createdAt": "2023-07-21T08:55:31.919000+05:30", - "message": "(service armored-container-service) has reached a steady state." - }, - { - "id": "7876ab74-6a06-4eec-9204-83a578e06c82", - "createdAt": "2023-07-21T08:55:31.918000+05:30", - "message": "(service armored-container-service) (deployment ecs-svc/5095800472445100540) deployment completed." - }, - { - "id": "c4287cf2-6715-4dc3-a765-755ad0d9d4b3", - "createdAt": "2023-07-21T08:52:53.739000+05:30", - "message": "(service armored-container-service) has stopped 1 running tasks: (task 18227ab7d612451eac7fa799285fac34)." - }, - { - "id": "e079943b-56a2-41ca-a137-5c95d0c6ffbe", - "createdAt": "2023-07-21T08:51:28.038000+05:30", - "message": "(service armored-container-service) has started 1 tasks: (task 8b696488625c43b29917bc0011d514a0)." - }, - { - "id": "9c9f0895-6e14-40db-873e-e88f4e3076c8", - "createdAt": "2023-07-21T05:35:16.087000+05:30", - "message": "(service armored-container-service) has reached a steady state." - }, - { - "id": "1606f4cc-7ef1-4207-94e0-51909503d096", - "createdAt": "2023-07-20T23:34:59.019000+05:30", - "message": "(service armored-container-service) has reached a steady state." - }, - { - "id": "c7f1d66f-a53c-4fdb-98bf-d0b4fd043a57", - "createdAt": "2023-07-20T17:34:50.060000+05:30", - "message": "(service armored-container-service) has reached a steady state." - }, - { - "id": "00e875cf-d912-419b-9622-c5469c907e3c", - "createdAt": "2023-07-20T17:34:50.059000+05:30", - "message": "(service armored-container-service) (deployment ecs-svc/1917268798230133817) deployment completed." - }, - { - "id": "f6426454-b74f-4611-9141-2118a3c72473", - "createdAt": "2023-07-20T17:32:45.974000+05:30", - "message": "(service armored-container-service) has stopped 1 running tasks: (task 445da4a243334c2da49816bc8e4512c6)." - }, - { - "id": "84711db2-558e-4a86-bbf4-8a4cd22ecdd7", - "createdAt": "2023-07-20T17:31:27.654000+05:30", - "message": "(service armored-container-service) has started 1 tasks: (task 18227ab7d612451eac7fa799285fac34)." - }, - { - "id": "1c4d7266-e709-4ba9-9847-ba29806235e5", - "createdAt": "2023-07-20T16:45:35.519000+05:30", - "message": "(service armored-container-service) has reached a steady state." - }, - { - "id": "13e0d28e-7ca4-4f60-9fd4-102fe9ce43ec", - "createdAt": "2023-07-20T16:45:35.518000+05:30", - "message": "(service armored-container-service) (deployment ecs-svc/0095785089613403979) deployment completed." - }, - { - "id": "5c8c861e-4a2e-4a51-ab07-f03d6248292c", - "createdAt": "2023-07-20T16:43:22.581000+05:30", - "message": "(service armored-container-service) has stopped 1 running tasks: (task 9afc04248a984b8282619bef1c23ec19)." - }, - { - "id": "4df652dc-6a1f-418f-9e90-4bb2d4d1f647", - "createdAt": "2023-07-20T16:42:13.912000+05:30", - "message": "(service armored-container-service) has started 1 tasks: (task 445da4a243334c2da49816bc8e4512c6)." - }, - { - "id": "25eff47b-5fcc-4a5d-b75b-b29fea6c6df0", - "createdAt": "2023-07-20T16:29:48.915000+05:30", - "message": "(service armored-container-service) has reached a steady state." - }, - { - "id": "b67b857b-2989-4d49-9eb9-1dd361207cec", - "createdAt": "2023-07-20T16:29:48.914000+05:30", - "message": "(service armored-container-service) (deployment ecs-svc/5137600825021193598) deployment completed." - }, - { - "id": "f951a069-73d5-417c-94a8-dc4f9bfb089a", - "createdAt": "2023-07-20T16:27:26.557000+05:30", - "message": "(service armored-container-service) has started 1 tasks: (task 9afc04248a984b8282619bef1c23ec19)." - } - ], - "createdAt": "2023-07-20T16:27:23.049000+05:30", - "placementConstraints": [], - "placementStrategy": [], - "networkConfiguration": { - "awsvpcConfiguration": { - "subnets": [ - "" - ], - "securityGroups": [ - "" - ], - "assignPublicIp": "ENABLED" - } - }, - "schedulingStrategy": "REPLICA", - "deploymentController": { - "type": "ECS" - }, - "createdBy": "", - "enableECSManagedTags": true, - "propagateTags": "NONE", - "enableExecuteCommand": false - } - ], - "failures": [] -} diff --git a/ecs/sample-task.json b/ecs/sample-task.json deleted file mode 100644 index 2ceb260..0000000 --- a/ecs/sample-task.json +++ /dev/null @@ -1,106 +0,0 @@ -{ - "family": "armored-container", - "containerDefinitions": [ - { - "name": "armored-container", - "image": "delusionaloptimist/ka-socat:latest", - "cpu": 0, - "portMappings": [ - { - "name": "armored-container-1337-tcp", - "containerPort": 1337, - "hostPort": 1337, - "protocol": "tcp", - "appProtocol": "http" - } - ], - "essential": true, - "command": [ - "kubearmor/bluelock", - "socat", - "TCP-LISTEN:1337,reuseaddr,fork", - "EXEC:bash,pty,stderr,setsid,sigint,sane" - ], - "environment": [ - { - "name": "CONTAINERNAME", - "value": "armored-container" - }, - { - "name": "RELAYSERVERURL", - "value": "http://:" - }, - { - "name": "K8S", - "value": "false" - } - ], - "mountPoints": [ - { - "sourceVolume": "kubearmor-dir", - "containerPath": "/kubearmor", - "readOnly": true - } - ], - "volumesFrom": [], - "dependsOn": [ - { - "containerName": "bluelock", - "condition": "SUCCESS" - } - ], - "logConfiguration": { - "logDriver": "awslogs", - "options": { - "awslogs-create-group": "true", - "awslogs-group": "/ecs/armored-container", - "awslogs-region": "us-east-2", - "awslogs-stream-prefix": "ecs" - } - } - }, - { - "name": "bluelock", - "image": "delusionaloptimist/bluelock:latest", - "cpu": 0, - "portMappings": [], - "essential": false, - "environment": [], - "mountPoints": [ - { - "sourceVolume": "kubearmor-dir", - "containerPath": "/kubearmor", - "readOnly": false - } - ], - "volumesFrom": [], - "logConfiguration": { - "logDriver": "awslogs", - "options": { - "awslogs-create-group": "true", - "awslogs-group": "/ecs/armored-container", - "awslogs-region": "us-east-2", - "awslogs-stream-prefix": "ecs" - } - } - } - ], - "taskRoleArn": "", - "executionRoleArn": "", - "networkMode": "awsvpc", - "volumes": [ - { - "name": "kubearmor-dir", - "host": {} - } - ], - "requiresCompatibilities": [ - "FARGATE" - ], - "cpu": "256", - "memory": "512", - "runtimePlatform": { - "cpuArchitecture": "X86_64", - "operatingSystemFamily": "LINUX" - } -} diff --git a/examples/ecs/ecs-task-execution-role-policy.json b/examples/ecs/ecs-task-execution-role-policy.json new file mode 100644 index 0000000..6984a97 --- /dev/null +++ b/examples/ecs/ecs-task-execution-role-policy.json @@ -0,0 +1,17 @@ +{ + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "ecr:GetAuthorizationToken", + "ecr:BatchCheckLayerAvailability", + "ecr:GetDownloadUrlForLayer", + "ecr:BatchGetImage", + "logs:CreateLogStream", + "logs:PutLogEvents" + ], + "Resource": "*" + } + ] +} diff --git a/ecs/sample-block-policy.yaml b/examples/ecs/sample-block-policy.yaml similarity index 100% rename from ecs/sample-block-policy.yaml rename to examples/ecs/sample-block-policy.yaml diff --git a/examples/ecs/sample-service.json b/examples/ecs/sample-service.json new file mode 100644 index 0000000..ecf9691 --- /dev/null +++ b/examples/ecs/sample-service.json @@ -0,0 +1,172 @@ +{ + "services": [ + { + "serviceArn": "", + "serviceName": "armored-container-service", + "clusterArn": "", + "loadBalancers": [], + "serviceRegistries": [], + "status": "ACTIVE", + "desiredCount": 1, + "runningCount": 1, + "pendingCount": 0, + "launchType": "FARGATE", + "platformVersion": "LATEST", + "platformFamily": "Linux", + "taskDefinition": "", + "deploymentConfiguration": { + "deploymentCircuitBreaker": { + "enable": true, + "rollback": true + }, + "maximumPercent": 200, + "minimumHealthyPercent": 100 + }, + "deployments": [ + { + "id": "ecs-svc/5095800472445100540", + "status": "PRIMARY", + "taskDefinition": "", + "desiredCount": 1, + "pendingCount": 0, + "runningCount": 1, + "failedTasks": 0, + "createdAt": "2023-07-21T08:51:00.958000+05:30", + "updatedAt": "2023-07-21T08:55:31.914000+05:30", + "launchType": "FARGATE", + "platformVersion": "1.4.0", + "platformFamily": "Linux", + "networkConfiguration": { + "awsvpcConfiguration": { + "subnets": [ + "" + ], + "securityGroups": [ + "" + ], + "assignPublicIp": "ENABLED" + } + }, + "rolloutState": "COMPLETED", + "rolloutStateReason": "ECS deployment ecs-svc/5095800472445100540 completed." + } + ], + "roleArn": "", + "events": [ + { + "id": "4830fc3a-888e-42e0-9aaa-b5bbe577516a", + "createdAt": "2023-07-21T14:55:57.171000+05:30", + "message": "(service armored-container-service) has reached a steady state." + }, + { + "id": "9adf848e-5746-48a6-9ddf-bf6e91aabdfe", + "createdAt": "2023-07-21T08:55:31.919000+05:30", + "message": "(service armored-container-service) has reached a steady state." + }, + { + "id": "7876ab74-6a06-4eec-9204-83a578e06c82", + "createdAt": "2023-07-21T08:55:31.918000+05:30", + "message": "(service armored-container-service) (deployment ecs-svc/5095800472445100540) deployment completed." + }, + { + "id": "c4287cf2-6715-4dc3-a765-755ad0d9d4b3", + "createdAt": "2023-07-21T08:52:53.739000+05:30", + "message": "(service armored-container-service) has stopped 1 running tasks: (task 18227ab7d612451eac7fa799285fac34)." + }, + { + "id": "e079943b-56a2-41ca-a137-5c95d0c6ffbe", + "createdAt": "2023-07-21T08:51:28.038000+05:30", + "message": "(service armored-container-service) has started 1 tasks: (task 8b696488625c43b29917bc0011d514a0)." + }, + { + "id": "9c9f0895-6e14-40db-873e-e88f4e3076c8", + "createdAt": "2023-07-21T05:35:16.087000+05:30", + "message": "(service armored-container-service) has reached a steady state." + }, + { + "id": "1606f4cc-7ef1-4207-94e0-51909503d096", + "createdAt": "2023-07-20T23:34:59.019000+05:30", + "message": "(service armored-container-service) has reached a steady state." + }, + { + "id": "c7f1d66f-a53c-4fdb-98bf-d0b4fd043a57", + "createdAt": "2023-07-20T17:34:50.060000+05:30", + "message": "(service armored-container-service) has reached a steady state." + }, + { + "id": "00e875cf-d912-419b-9622-c5469c907e3c", + "createdAt": "2023-07-20T17:34:50.059000+05:30", + "message": "(service armored-container-service) (deployment ecs-svc/1917268798230133817) deployment completed." + }, + { + "id": "f6426454-b74f-4611-9141-2118a3c72473", + "createdAt": "2023-07-20T17:32:45.974000+05:30", + "message": "(service armored-container-service) has stopped 1 running tasks: (task 445da4a243334c2da49816bc8e4512c6)." + }, + { + "id": "84711db2-558e-4a86-bbf4-8a4cd22ecdd7", + "createdAt": "2023-07-20T17:31:27.654000+05:30", + "message": "(service armored-container-service) has started 1 tasks: (task 18227ab7d612451eac7fa799285fac34)." + }, + { + "id": "1c4d7266-e709-4ba9-9847-ba29806235e5", + "createdAt": "2023-07-20T16:45:35.519000+05:30", + "message": "(service armored-container-service) has reached a steady state." + }, + { + "id": "13e0d28e-7ca4-4f60-9fd4-102fe9ce43ec", + "createdAt": "2023-07-20T16:45:35.518000+05:30", + "message": "(service armored-container-service) (deployment ecs-svc/0095785089613403979) deployment completed." + }, + { + "id": "5c8c861e-4a2e-4a51-ab07-f03d6248292c", + "createdAt": "2023-07-20T16:43:22.581000+05:30", + "message": "(service armored-container-service) has stopped 1 running tasks: (task 9afc04248a984b8282619bef1c23ec19)." + }, + { + "id": "4df652dc-6a1f-418f-9e90-4bb2d4d1f647", + "createdAt": "2023-07-20T16:42:13.912000+05:30", + "message": "(service armored-container-service) has started 1 tasks: (task 445da4a243334c2da49816bc8e4512c6)." + }, + { + "id": "25eff47b-5fcc-4a5d-b75b-b29fea6c6df0", + "createdAt": "2023-07-20T16:29:48.915000+05:30", + "message": "(service armored-container-service) has reached a steady state." + }, + { + "id": "b67b857b-2989-4d49-9eb9-1dd361207cec", + "createdAt": "2023-07-20T16:29:48.914000+05:30", + "message": "(service armored-container-service) (deployment ecs-svc/5137600825021193598) deployment completed." + }, + { + "id": "f951a069-73d5-417c-94a8-dc4f9bfb089a", + "createdAt": "2023-07-20T16:27:26.557000+05:30", + "message": "(service armored-container-service) has started 1 tasks: (task 9afc04248a984b8282619bef1c23ec19)." + } + ], + "createdAt": "2023-07-20T16:27:23.049000+05:30", + "placementConstraints": [], + "placementStrategy": [], + "networkConfiguration": { + "awsvpcConfiguration": { + "subnets": [ + "" + ], + "securityGroups": [ + "" + ], + "assignPublicIp": "ENABLED" + } + }, + "schedulingStrategy": "REPLICA", + "deploymentController": { + "type": "ECS" + }, + "createdBy": "", + "enableECSManagedTags": true, + "propagateTags": "NONE", + "enableExecuteCommand": false + } + ], + "failures": [] +} diff --git a/examples/ecs/sample-task.json b/examples/ecs/sample-task.json new file mode 100644 index 0000000..d8f6c41 --- /dev/null +++ b/examples/ecs/sample-task.json @@ -0,0 +1,106 @@ +{ + "family": "armored-container", + "containerDefinitions": [ + { + "name": "armored-container", + "image": "delusionaloptimist/ka-socat:latest", + "cpu": 0, + "portMappings": [ + { + "name": "armored-container-1337-tcp", + "containerPort": 1337, + "hostPort": 1337, + "protocol": "tcp", + "appProtocol": "http" + } + ], + "essential": true, + "command": [ + "kubearmor/bluelock", + "socat", + "TCP-LISTEN:1337,reuseaddr,fork", + "EXEC:bash,pty,stderr,setsid,sigint,sane" + ], + "environment": [ + { + "name": "CONTAINERNAME", + "value": "armored-container" + }, + { + "name": "RELAYSERVERURL", + "value": "http://:" + }, + { + "name": "K8S", + "value": "false" + } + ], + "mountPoints": [ + { + "sourceVolume": "kubearmor-dir", + "containerPath": "/kubearmor", + "readOnly": true + } + ], + "volumesFrom": [], + "dependsOn": [ + { + "containerName": "bluelock", + "condition": "SUCCESS" + } + ], + "logConfiguration": { + "logDriver": "awslogs", + "options": { + "awslogs-create-group": "true", + "awslogs-group": "/ecs/armored-container", + "awslogs-region": "us-east-2", + "awslogs-stream-prefix": "ecs" + } + } + }, + { + "name": "bluelock", + "image": "delusionaloptimist/bluelock:latest", + "cpu": 0, + "portMappings": [], + "essential": false, + "environment": [], + "mountPoints": [ + { + "sourceVolume": "kubearmor-dir", + "containerPath": "/kubearmor", + "readOnly": false + } + ], + "volumesFrom": [], + "logConfiguration": { + "logDriver": "awslogs", + "options": { + "awslogs-create-group": "true", + "awslogs-group": "/ecs/armored-container", + "awslogs-region": "us-east-2", + "awslogs-stream-prefix": "ecs" + } + } + } + ], + "taskRoleArn": "", + "executionRoleArn": "", + "networkMode": "awsvpc", + "volumes": [ + { + "name": "kubearmor-dir", + "host": {} + } + ], + "requiresCompatibilities": [ + "FARGATE" + ], + "cpu": "256", + "memory": "512", + "runtimePlatform": { + "cpuArchitecture": "X86_64", + "operatingSystemFamily": "LINUX" + } +} diff --git a/deployment.yaml b/examples/kubernetes/deployment.yaml similarity index 68% rename from deployment.yaml rename to examples/kubernetes/deployment.yaml index 3061252..812582c 100644 --- a/deployment.yaml +++ b/examples/kubernetes/deployment.yaml @@ -21,6 +21,7 @@ spec: initContainers: - name: bluelock image: daemon1024/bluelock + #image: accuknox/bluelock imagePullPolicy: Always volumeMounts: - mountPath: /kubearmor @@ -28,8 +29,14 @@ spec: containers: - name: armored-container image: daemon1024/ka-socat-demo + #image: accuknox/ka-socat-demo imagePullPolicy: Always - command: ["/kubearmor/bluelock","socat", "TCP-LISTEN:1337,reuseaddr,fork", "EXEC:bash,pty,stderr,setsid,sigint,sane"] + command: + - "/kubearmor/bluelock" + args: + - "socat" + - "TCP-LISTEN:1337,reuseaddr,fork" + - "EXEC:bash,pty,stderr,setsid,sigint,sane" ports: - containerPort: 1337 volumeMounts: @@ -37,19 +44,7 @@ spec: name: kubearmor-dir env: - name: "RELAYSERVERURL" - value: "http://kubearmor.kube-system.svc.cluster.local:2801" - #- name: sidekick-container - # image: falcosecurity/falcosidekick:latest - # ports: - # - name: sidekick-port - # containerPort: 2801 - # env: - # - name: "DEBUG" - # value: "true" - # - name: "DISCORD_WEBHOOKURL" - # value: "https://discord.com/api/webhooks/1093242887153659965/WYPwFw34KfU-2p587Iw1b9hrn2t8cEqsNzoBmaZiHqRvNGwN3neAIQjBd8PxlR_n0qrh" - # - name: "DISCORD_MINIMUMPRIORITY" - # value: "debug" + value: "http://kubearmor.kube-system.svc.cluster.local:32767" --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding diff --git a/docker-compose.yaml b/examples/unorhcestrated/docker-compose.yaml similarity index 78% rename from docker-compose.yaml rename to examples/unorhcestrated/docker-compose.yaml index 51a70c4..0806348 100644 --- a/docker-compose.yaml +++ b/examples/unorhcestrated/docker-compose.yaml @@ -10,7 +10,7 @@ services: build: context: . image: delusionaloptimist/bluelock:latest - #image: bluelock:latest + #image: accuknox/bluelock:latest volumes: - kubearmor-dir:/kubearmor @@ -32,17 +32,21 @@ services: container_name: armored-container depends_on: - bluelock - image: ka-socat:latest - command: ["/kubearmor/bluelock","socat", "TCP-LISTEN:1337,reuseaddr,fork", "EXEC:bash,pty,stderr,setsid,sigint,sane"] + image: delusionaloptimist/ka-socat:latest + entrypoint: + - "/kubearmor/bluelock" + command: + - "socat" + - "TCP-LISTEN:1337,reuseaddr,fork" + - "EXEC:bash,pty,stderr,setsid,sigint,sane" volumes: - kubearmor-dir:/kubearmor networks: - bluelock-test-net ports: - # for testing purposes + # reverse shell for testing - "1337:1337" environment: - # in docker private network container name can be used to access a container - RELAYSERVERURL=http://kubearmor-relay-server:32767 - K8S=false - CONTAINERNAME=armored-container