Install CloudDefense suite on a Kubernetes cluster

Pre-requisites
There are three main pre-requisites for a production grade cdefense installation on-premises
1.A managed Postgres instance (for AWS RDS db.r5.large)
1.enable automated backups
2.A kubernetes cluster (/examples/eks) with at least two nodegroups
1.node group for jobs
1.each node has { label: job }
2.node group for all else
1.(optional) each node has { label: cdefense }
3.A cluster auto-scaler
Install kafka
Download the kafka helm repo (bitnami)
helm repo add bitnami https://charts.bitnami.com/bitnami
(optional) create/edit values.yaml
nodeSelector:
  label: external
Install kafka helm
helm install kafka bitnami/kafka -f values.yaml
Install cdefense
add cdefense helm repo
helm repo add cdefense https://clouddefenseai.github.io/charts/  
update repos
helm repo update
clone the repo
git clone https://github.com/CloudDefenseAI/charts
create roles, role binding and service accounts
kubectl apply -f charts/cdefense/rbac
create secrets
kubectl apply -f charts/cdefense/secrets
Install cdefense helm
helm install cdefense cdefense --debug
or
helm upgrade cdefense cdefense/cdefense --debug
Configure Social Authentication
In order to sign in with different identity providers (for ex. github), create ID and secrets
Github
go to github developer settings​
create a New OAuth App
Homepage URL is the base_url
Authorization callback URL is https://{base_url}/auth/realms/cdefense/broker/github/endpoint​
create secrets for authservice
create a secret for authservice
apiVersion: v1
kind: Secret
metadata:
  name: authservice-secrets
  type: Opaque
stringData:
  SENDGRID_KEY: 
  GOOGLE_CLIENT_ID: 
  GOOGLE_CLIENT_SECRET: 
  GITHUB_CLIENT_ID: 
  GITHUB_CLIENT_SECRET: 
  GITLAB_APPLICATION_ID: 
  GITLAB_APPLICATION_SECRET: 
  BITBUCKET_KEY: 
  BITBUCKET_SECRET: 
  MICROSOFT_CLIENT_ID: 
  MICROSOFT_CLIENT_SECRET: 
kubectl apply -f authservice-secrets.yaml
restart authservice pod
How to change location of logs
update value.yaml
api:
  logs: 
    region: <REGION>
    bucket: <BUCKET>
in case of private bucket
Edit the scan-server-secrets.yaml file
  AWS_SCAN_S3_ACCESS_KEY: <AWS_SCAN_S3_ACCESS_KEY>
  AWS_SCAN_S3_SECRET_KEY: <AWS_SCAN_S3_SECRET_KEY>
kubectl apply -f scan-server-secrets.yaml
or update secrets on cluster
encode values as base64 strings
AWS_SCAN_S3_ACCESS_KEY=<AWS_ACCESS_KEY>
BASE64_AWS_SCAN_S3_ACCESS_KEY=$(echo $AWS_SCAN_S3_ACCESS_KEY | base64)
AWS_SCAN_S3_SECRET_KEY=<AWS_SECRET_KEY>
BASE64_AWS_SCAN_S3_ACCESS_KEY=$(echo $AWS_SCAN_S3_SECRET_KEY | base64)
edit scan-server-secrets
kubectl edit secret scan-server-secrets
  AWS_SCAN_S3_ACCESS_KEY: <BASE64_AWS_SCAN_S3_ACCESS_KEY>
  AWS_SCAN_S3_SECRET_KEY: <BASE64_AWS_SCAN_S3_SECRET_KEY>
save and restart api pod
kubectl delete pod api-<some-string>

Last modified 9mo ago