feat(adapter): Add k8tls adapter (#131)

* feat(adapter): Add k8tls adapter Signed-off-by: Anurag Rajawat <[email protected]> * refactor(adapter): Refactor adapter utils Signed-off-by: Anurag Rajawat <[email protected]> * chore: Fix license Signed-off-by: Anurag Rajawat <[email protected]> * CI: Add nimbus-k8tls job Signed-off-by: Anurag Rajawat <[email protected]> --------- Signed-off-by: Anurag Rajawat <[email protected]>
5GSEC · Jun 18, 2024 · 52c3aba · 52c3aba
1 parent 4aec2fc
commit 52c3aba
Show file tree

Hide file tree

Showing 76 changed files with 1,756 additions and 206 deletions.
diff --git a/.github/workflows/latest-release.yaml b/.github/workflows/latest-release.yaml
@@ -51,7 +51,7 @@ jobs:
     if: ${{ github.repository == '5GSEC/nimbus' && needs.files-changed.outputs.adapters == 'true' }}
     strategy:
       matrix:
-        adapters: [ "nimbus-kubearmor", "nimbus-netpol", "nimbus-kyverno" ]
+        adapters: [ "nimbus-kubearmor", "nimbus-netpol", "nimbus-kyverno", "nimbus-k8tls" ]
     name: Build and push ${{ matrix.adapters }} adapter's image
     uses: ./.github/workflows/release-image.yaml
     with:

diff --git a/.github/workflows/pr-checks.yaml b/.github/workflows/pr-checks.yaml
@@ -115,7 +115,7 @@ jobs:
     if: ${{ needs.files-changed.outputs.adapters == 'true' }}
     strategy:
       matrix:
-        adapters: [ "nimbus-kubearmor", "nimbus-netpol", "nimbus-kyverno" ]
+        adapters: [ "nimbus-kubearmor", "nimbus-netpol", "nimbus-kyverno", "nimbus-k8tls" ]
     name: Build ${{ matrix.adapters }} adapter's image
     runs-on: ubuntu-latest
     timeout-minutes: 20

diff --git a/deployments/nimbus-k8tls/.helmignore b/deployments/nimbus-k8tls/.helmignore
@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
diff --git a/deployments/nimbus-k8tls/Chart.yaml b/deployments/nimbus-k8tls/Chart.yaml
@@ -0,0 +1,9 @@
+apiVersion: v2
+type: application
+name: nimbus-k8tls
+version: 0.1.0
+appVersion: "0.1.0"
+description: Nimbus adapter for k8tls
+sources:
+  - https://github.com/5GSEC/nimbus
+kubeVersion: ">=1.25.0-0"
diff --git a/deployments/nimbus-k8tls/Readme.md b/deployments/nimbus-k8tls/Readme.md
@@ -0,0 +1,45 @@
+# Install [k8tls](https://github.com/kubearmor/k8tls) adapter
+
+Install `nimbus-k8tls` adapter using the official 5GSEC Helm charts.
+
+```shell
+helm repo add 5gsec https://5gsec.github.io/charts
+helm repo update 5gsec
+helm upgrade --install nimbus-k8tls 5gsec/nimbus-k8tls -n nimbus
+```
+
+Install `nimbus-k8tls` adapter using Helm charts locally (for testing)
+
+```bash
+cd deployments/nimbus-k8tls/
+helm upgrade --install nimbus-k8tls . -n nimbus
+```
+
+## Values
+
+| Key              | Type   | Default            | Description                                                            |
+|------------------|--------|--------------------|------------------------------------------------------------------------|
+| image.repository | string | 5gsec/nimbus-k8tls | Image repository from which to pull the `nimbus-k8tls` adapter's image |
+| image.pullPolicy | string | Always             | `nimbus-k8tls` adapter image pull policy                               |
+| image.tag        | string | latest             | `nimbus-k8tls` adapter image tag                                       |
+
+## Verify if all the resources are up and running
+
+Once done, the following resources will exist in your cluster:
+
+```shell
+$ kubectl get all -n nimbus -l app.kubernetes.io/instance=nimbus-k8tls
+NAME                     READY   STATUS    RESTARTS   AGE
+pod/nimbus-k8tls-q2tt7   1/1     Running   0          3m8s
+
+NAME                          DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE
+daemonset.apps/nimbus-k8tls   1         1         1       1            1           <none>          3m8s
+```
+
+## Uninstall the k8tls adapter
+
+To uninstall:
+
+```bash
+helm uninstall nimbus-k8tls -n nimbus
+```
diff --git a/deployments/nimbus-k8tls/templates/_helpers.tpl b/deployments/nimbus-k8tls/templates/_helpers.tpl
@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "nimbus-k8tls.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "nimbus-k8tls.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "nimbus-k8tls.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "nimbus-k8tls.labels" -}}
+helm.sh/chart: {{ include "nimbus-k8tls.chart" . }}
+{{ include "nimbus-k8tls.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "nimbus-k8tls.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "nimbus-k8tls.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "nimbus-k8tls.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "nimbus-k8tls.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
diff --git a/deployments/nimbus-k8tls/templates/daemonset.yaml b/deployments/nimbus-k8tls/templates/daemonset.yaml
@@ -0,0 +1,24 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ include "nimbus-k8tls.fullname" . }}
+  labels:
+    {{- include "nimbus-k8tls.labels" . | nindent 4 }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  selector:
+    matchLabels:
+      {{- include "nimbus-k8tls.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "nimbus-k8tls.labels" . | nindent 8 }}
+    spec:
+      serviceAccountName: {{ include "nimbus-k8tls.serviceAccountName" . }}
+      containers:
+        - name: {{ .Values.fullnameOverride }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+      terminationGracePeriodSeconds: 10
diff --git a/deployments/nimbus-k8tls/templates/role.yaml b/deployments/nimbus-k8tls/templates/role.yaml
@@ -0,0 +1,61 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: nimbus-k8tls-clusterrole
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - namespaces
+  - serviceaccounts
+  verbs:
+  - create
+  - delete
+  - get
+  - update
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - get
+  - list
+- apiGroups:
+  - batch
+  resources:
+  - cronjobs
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - update
+  - watch
+- apiGroups:
+  - intent.security.nimbus.com
+  resources:
+  - clusternimbuspolicies
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - intent.security.nimbus.com
+  resources:
+  - clusternimbuspolicies/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - clusterrolebindings
+  - clusterroles
+  verbs:
+  - create
+  - delete
+  - get
+  - update
diff --git a/deployments/nimbus-k8tls/templates/rolebinding.yaml b/deployments/nimbus-k8tls/templates/rolebinding.yaml
@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "nimbus-k8tls.fullname" . }}-clusterrole-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: nimbus-k8tls-clusterrole
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "nimbus-k8tls.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
diff --git a/deployments/nimbus-k8tls/templates/serviceaccount.yaml b/deployments/nimbus-k8tls/templates/serviceaccount.yaml
@@ -0,0 +1,10 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "nimbus-k8tls.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "nimbus-k8tls.labels" . | nindent 4 }}
+automountServiceAccountToken: {{ .Values.serviceAccount.automount }}
+{{- end }}
diff --git a/deployments/nimbus-k8tls/values.yaml b/deployments/nimbus-k8tls/values.yaml
@@ -0,0 +1,18 @@
+# Default values for nimbus-k8tls.
+
+image:
+  repository: 5gsec/nimbus-k8tls
+  pullPolicy: Always
+  tag: "latest"
+
+nameOverride: ""
+fullnameOverride: "nimbus-k8tls"
+
+serviceAccount:
+  create: true
+  automount: true
+  name: "nimbus-k8tls"
+
+securityContext:
+  runAsNonRoot: true
+  runAsUser: 65533
diff --git a/examples/clusterscoped/csib-1-all-ns-selector.yaml b/examples/clusterscoped/csib-1-all-ns-selector.yaml
@@ -1,3 +1,6 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2023 Authors of Nimbus
+
 apiVersion: intent.security.nimbus.com/v1alpha1
 kind: SecurityIntent
 metadata:

diff --git a/examples/clusterscoped/csib-2-match-names.yaml b/examples/clusterscoped/csib-2-match-names.yaml
@@ -1,3 +1,6 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2023 Authors of Nimbus
+
 apiVersion: intent.security.nimbus.com/v1alpha1
 kind: SecurityIntent
 metadata:

diff --git a/examples/clusterscoped/csib-3-exclude-names.yaml b/examples/clusterscoped/csib-3-exclude-names.yaml
@@ -1,3 +1,6 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2023 Authors of Nimbus
+
 apiVersion: intent.security.nimbus.com/v1alpha1
 kind: SecurityIntent
 metadata:

diff --git a/examples/clusterscoped/ensuretls-default.yaml b/examples/clusterscoped/ensuretls-default.yaml
@@ -0,0 +1,27 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2023 Authors of Nimbus
+
+apiVersion: intent.security.nimbus.com/v1alpha1
+kind: SecurityIntent
+metadata:
+  name: ensure-tls-default
+spec:
+  intent:
+    id: ensureTLS
+    action: Audit
+    description: |
+      Assess the TLS configuration to ensure compliance with the security standards. This includes verifying TLS protocol version,
+      certificate validity and FIPS-140-3 approved cipher suites.
+      Reference: MITRE ATT&CK Technique: FGT5011 https://fight.mitre.org/techniques/FGT5011
+---
+apiVersion: intent.security.nimbus.com/v1alpha1
+kind: ClusterSecurityIntentBinding
+metadata:
+  name: ensure-tls-default
+spec:
+  intents:
+    - name: ensure-tls-default
+  selector:
+    nsSelector:
+      matchNames:
+        - '*'
diff --git a/examples/clusterscoped/ensuretls-with-external-addresses.yaml b/examples/clusterscoped/ensuretls-with-external-addresses.yaml
@@ -0,0 +1,31 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2023 Authors of Nimbus
+
+apiVersion: intent.security.nimbus.com/v1alpha1
+kind: SecurityIntent
+metadata:
+  name: ensure-tls-external-addresses
+spec:
+  intent:
+    id: ensureTLS
+    action: Audit
+    severity: "medium"
+    description: |
+      Assess the TLS configuration to ensure compliance with the security standards. This includes verifying TLS protocol version,
+      certificate validity and FIPS-140-3 approved cipher suites.
+      Reference: MITRE ATT&CK Technique: FGT5011 https://fight.mitre.org/techniques/FGT5011
+    params:
+      # Specify domain name with its port
+      external_addresses: [ "dh480.badssl.com:443", "google.com:443", "accuknox.com:443", "apigateway-fips.us-east-1.amazonaws.com:443" ]
+---
+apiVersion: intent.security.nimbus.com/v1alpha1
+kind: ClusterSecurityIntentBinding
+metadata:
+  name: ensure-tls-external-addresses
+spec:
+  intents:
+    - name: ensure-tls-external-addresses
+  selector:
+    nsSelector:
+      matchNames:
+        - '*'