Kubernetes Automated Agent Deployment

json
1
{
2
  "configs": [
3
    {
4
      "release": "k8s-guardrails",
5
      "helm_config": {
6
        "repo_name": "r7-cloudsec-repo",
7
        "release_name": "k8s-guardrails",
8
        "repo_url": "https://helm.rapid7.com/cloudsec",
9
        "version": "4.0.3"
10
      },
11
      "guardrails_config": {
12
        "api_token": "someToken",
13
        "base_url": "https://rapid7.com",
14
        "spec_ver": "2.0"
15
      },
16
      "denylist_eks": [
17
        {
18
          "region": "us-west-2",
19
          "clusters": [
20
            "cluster-1",
21
            "prod"
22
          ]
23
        }
24
      ],
25
      "denylist_aks": [
26
        {
27
          "resource_group": "rg-group",
28
          "clusters": [
29
            "my-k8s-1",
30
            "prod"
31
          ]
32
        }
33
      ],
34
      "denylist_gke": [
35
        {
36
          "location": "us-central-1",
37
          "clusters": [
38
            "prod"
39
          ]
40
        }
41
      ]
42
    }
43
  ]
44
}

For EKS clusters, a Lambda function will use the Amazon Elastic Kubernetes Service API to discover and validate clusters. For each valid cluster, the Helm chart for the Guardrails agent will be fetched from the appropriate Helm repository, then a CloudWatch Event Pattern will be created and will invoke the Lambda function.

To setup automatic deployment for AWS EKS:

1. Download the Auto Deployer (r7-ics-deployer-tf) from InsightCloudSec and extract the files.
2. Change into the AWS Auto Deployer directory (this example assumes the Auto Deployer was added to the Downloads directory): cd ~/Downloads/r7-ics-deployer-tf/auto-deployer-aws
3. Update the terraform/terraform.tfvars file as necessary using terraform/variables.tf as a guide.
   • At a minimum, you'll need to provide a value for deployer_config_url (references the location of the configuration file you created in Step 2).
4. Create and verify a terraform plan: terraform plan -out "auto-deployer-aws-plan"
5. Apply the plan: terraform apply "auto-deployer-aws-plan"
6. Optionally, if you would like to enable event-based deployment, e.g., each time a new EKS cluster has been created, you will need to configure permissions per cluster using eksctl before deploying the agent. Review the AWS EKS Remote Scanner Setup for details (the process is the same for the automated deployment).

For AKS clusters, an Azure Function will interact with the Azure Kubernetes Service API to discover and validate clusters. For each valid cluster, the Helm chart for the Guardrails agent will be obtained from the Helm repository, then an Event Subscription will be created to invoke the Function. Event-based deployment, e.g., each time a new AKS cluster has been created, is enabled out-of-the-box with no additional configuration.

To setup automatic deployment for Azure AKS:

1. Download the Auto Deployer (r7-ics-deployer-tf) from InsightCloudSec and extract the files.
2. Change into the Azure Auto Deployer directory (this example assumes the Auto Deployer was added to the Downloads directory): cd ~/Downloads/r7-ics-deployer-tf/auto-deployer-azure
3. Update the terraform/terraform.tfvars file as necessary using terraform/variables.tf as a guide.
   • At a minimum, you'll need to provide a value for deployer_config_url (references the location of the configuration file you created in Step 2) as well as the following variables (these values can be recycled from an existing, onboarded Azure account):
     • client_id
     • client_secret
     • subscription_id
     • tenant_id
     • object_id (this can be found on the Overview page for the App Registration associated with InsightCloudSec/the deployer)
4. Create and verify a terraform plan: terraform plan -out "auto-deployer-azure-plan"
5. Apply the plan: terraform apply "auto-deployer-azure-plan"

For GKE clusters, a Cloud Run Function will utilize the Google Kubernetes Engine API to list and validate clusters. For each valid cluster, the Helm chart will be fetched from the official Helm repository or a private Helm repository if required, then a new Cloud Pub/Sub trigger will be created that will invoke the function. Event-based deployment, e.g., each time a new GKE cluster has been created, is enabled out-of-the-box with no additional configuration.

To setup automatic deployment for GCP GKE:

1. Ensure Docker and its CLI are installed on your machine.

2. Download the Auto Deployer (r7-ics-deployer-tf) from InsightCloudSec and extract the files.

3. Change into the GCP Auto Deployer directory (this example assumes the Auto Deployer was added to the Downloads directory): cd ~/Downloads/r7-ics-deployer-tf/auto-deployer-google

4. Update the terraform/terraform.tfvars file as necessary using terraform/variables.tf as a guide.

   • At a minimum, you'll need to provide a value for image (this can be a custom value) and deployer_config_url (references the location of the configuration file you created in Step 2) as well as the following variables (these values can be recycled from an existing, onboarded GCP account):
     • secret_file

   Storage Bucket Owner Permissions Required

   The role associated with InsightCloudSec that will be used to run the deployer inside the relevant GCP Project will need to have the following GCP roles:

   • Storage Bucket Owner
   • Kubernetes Engine Admin
   • Eventarc Event Receiver
   • Cloud Run Invoker

5. Run the build script with a custom Image name and a valid GCP Project ID: ./build-deploy.sh <project-id> <image-name>

6. Create and verify a terraform plan: terraform plan -out "auto-deployer-google-plan"

7. Apply the plan: terraform apply "auto-deployer-google-plan"