Skip to content

Commit bb0660b

Browse files
temblekingiruNéstor Salceda
authored
feat: Add single-project deployment in K8s (#63)
* feat: Add single-project deployment in K8s * chore(test): refactor tf backend usage (#62) * Update CONTRIBUTE.md * chore(doc): add Q3 troubleshooting * chore(doc): Q3 * fix: Update build Co-authored-by: iru <[email protected]> Co-authored-by: Néstor Salceda <[email protected]>
1 parent 3354854 commit bb0660b

File tree

10 files changed

+272
-0
lines changed

10 files changed

+272
-0
lines changed

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,7 @@ Notice that:
126126
```
127127
error starting scan runner for image ****: rpc error: code = PermissionDenied desc = Cloud Build API has not been used in project *** before or it is disabled.
128128
Enable it by visiting https://console.developers.google.com/apis/api/cloudbuild.googleapis.com/overview?project=*** then retry.
129+
129130
If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry
130131
```
131132
A3: Do as the error says and activate CloudBuild API. Check the list of all the required APIs that need to be activated per feature module.

‎examples/single-project-k8s/README.md‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
# Sysdig Secure for Cloud in GCP :: Single-Account on Kubernetes Cluster
2+
3+
Deploy Sysdig Secure for Cloud in a provided existing Kubernetes Cluster.
4+
5+
- Sysdig **Helm** charts will be used to deploy the secure-for-cloud stack:
6+
- [Cloud-Connector Chart](https://charts.sysdig.com/charts/cloud-connector/)
7+
- Because these charts require specific GCP credentials to be passed by parameter, a new service account + key will
8+
be created within the project. See [`credentials.tf`](./credentials.tf)
9+
- Used architecture is similar to [single-project](../single-project) but changing Cloud Run <---> with an existing K8s
10+
11+
All the required resources and workloads will be run under the same GCP project.
12+
13+
## Prerequisites
14+
15+
Minimum requirements:
16+
17+
1. `gcloud` credentials configuration
18+
2. A Kubernetes cluster configured within your `~/.kube/config`
19+
3. Secure requirements, as input variable value
20+
```
21+
sysdig_secure_api_token=<SECURE_API_TOKEN>
22+
```
23+
24+
## Usage
25+
26+
For quick testing, use this snippet on your terraform files
27+
28+
```terraform
29+
module "secure_for_cloud_gcp_single_project_k8s" {
30+
source = "sysdiglabs/secure-for-cloud/google//examples/single-project-k8s"
31+
32+
project_id = "your-project-id"
33+
sysdig_secure_api_token = "00000000-1111-2222-3333-444444444444"
34+
}
35+
```
36+
37+
See [inputs summary](#inputs) or module module [`variables.tf`](./variables.tf) file for more optional configuration.
38+
39+
Notice that:
40+
41+
* This example will create resources that **cost money**. Run `terraform destroy` when you don't need them anymore.
42+
* All created resources will be created within the tags `product:sysdig-secure-for-cloud`.
43+
44+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
45+
## Requirements
46+
47+
| Name | Version |
48+
|------|---------|
49+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.15.0 |
50+
| <a name="requirement_google"></a> [google](#requirement\_google) | >= 3.67.0 |
51+
| <a name="requirement_helm"></a> [helm](#requirement\_helm) | >=2.3.0 |
52+
| <a name="requirement_sysdig"></a> [sysdig](#requirement\_sysdig) | >= 0.5.19 |
53+
54+
## Providers
55+
56+
| Name | Version |
57+
|------|---------|
58+
| <a name="provider_google"></a> [google](#provider\_google) | >= 3.67.0 |
59+
| <a name="provider_helm"></a> [helm](#provider\_helm) | >=2.3.0 |
60+
61+
## Modules
62+
63+
| Name | Source | Version |
64+
|------|--------|---------|
65+
| <a name="module_connector_project_sink"></a> [connector\_project\_sink](#module\_connector\_project\_sink) | ../../modules/infrastructure/project_sink | |
66+
67+
## Resources
68+
69+
| Name | Type |
70+
|------|------|
71+
| [google_pubsub_subscription.subscription](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/pubsub_subscription) | resource |
72+
| [google_pubsub_subscription_iam_member.pull](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/pubsub_subscription_iam_member) | resource |
73+
| [google_service_account.connector_sa](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account) | resource |
74+
| [google_service_account_key.connector_sa_key](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account_key) | resource |
75+
| [helm_release.cloud_connector](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
76+
77+
## Inputs
78+
79+
| Name | Description | Type | Default | Required |
80+
|------|-------------|------|---------|:--------:|
81+
| <a name="input_project_id"></a> [project\_id](#input\_project\_id) | Project ID where the secure-for-cloud workload is going to be deployed | `string` | n/a | yes |
82+
| <a name="input_sysdig_secure_api_token"></a> [sysdig\_secure\_api\_token](#input\_sysdig\_secure\_api\_token) | Sysdig's Secure API Token | `string` | n/a | yes |
83+
| <a name="input_cloud_connector_image"></a> [cloud\_connector\_image](#input\_cloud\_connector\_image) | Cloud-connector image to deploy | `string` | `"quay.io/sysdig/cloud-connector"` | no |
84+
| <a name="input_location"></a> [location](#input\_location) | Zone where the stack will be deployed | `string` | `"us-central1"` | no |
85+
| <a name="input_name"></a> [name](#input\_name) | Name to be assigned to all child resources. A suffix may be added internally when required. Use default value unless you need to install multiple instances | `string` | `"sfc"` | no |
86+
| <a name="input_sysdig_secure_endpoint"></a> [sysdig\_secure\_endpoint](#input\_sysdig\_secure\_endpoint) | Sysdig Secure API endpoint | `string` | `"https://secure.sysdig.com"` | no |
87+
88+
## Outputs
89+
90+
No outputs.
91+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
92+
93+
## Authors
94+
95+
Module is maintained and supported by [Sysdig](https://sysdig.com).
96+
97+
## License
98+
99+
Apache 2 Licensed. See LICENSE for full details.

‎examples/single-project-k8s/cloud-connector.tf‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
module "connector_project_sink" {
2+
source = "../../modules/infrastructure/project_sink"
3+
name = "${var.name}-cloudconnector"
4+
5+
filter = local.connector_filter
6+
}
7+
8+
resource "google_pubsub_subscription" "subscription" {
9+
name = var.name
10+
topic = module.connector_project_sink.pubsub_topic_name
11+
12+
labels = {
13+
product = "sysdig-secure-for-cloud"
14+
}
15+
16+
# 20 minutes
17+
message_retention_duration = "1200s"
18+
retain_acked_messages = false
19+
20+
ack_deadline_seconds = 20
21+
22+
expiration_policy {
23+
ttl = "300000.5s"
24+
}
25+
retry_policy {
26+
minimum_backoff = "10s"
27+
}
28+
29+
enable_message_ordering = false
30+
}
31+
32+
resource "helm_release" "cloud_connector" {
33+
name = "cloud-connector"
34+
35+
repository = "https://charts.sysdig.com"
36+
chart = "cloud-connector"
37+
38+
create_namespace = true
39+
namespace = var.name
40+
atomic = true
41+
timeout = 60
42+
43+
set_sensitive {
44+
name = "sysdig.secureAPIToken"
45+
value = var.sysdig_secure_api_token
46+
}
47+
48+
set {
49+
name = "sysdig.url"
50+
value = var.sysdig_secure_endpoint
51+
}
52+
53+
set {
54+
name = "sysdig.verifySSL"
55+
value = local.verify_ssl
56+
}
57+
58+
set {
59+
name = "image.repository"
60+
value = var.cloud_connector_image
61+
}
62+
63+
values = [
64+
<<EOF
65+
rules: []
66+
ingestors:
67+
- gcp-auditlog-pubsub:
68+
project: ${var.project_id}
69+
subscription: ${google_pubsub_subscription.subscription.name}
70+
notifiers: []
71+
gcpCredentials: |
72+
${jsonencode(jsondecode(base64decode(google_service_account_key.connector_sa_key.private_key)))}
73+
EOF
74+
]
75+
}

‎examples/single-project-k8s/credentials.tf‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
resource "google_service_account" "connector_sa" {
2+
account_id = "${var.name}-cloudconnector"
3+
display_name = "Service account for cloud-connector"
4+
}
5+
6+
resource "google_service_account_key" "connector_sa_key" {
7+
service_account_id = google_service_account.connector_sa.name
8+
}
9+
10+
resource "google_pubsub_subscription_iam_member" "pull" {
11+
subscription = google_pubsub_subscription.subscription.name
12+
role = "roles/pubsub.subscriber"
13+
member = "serviceAccount:${google_service_account.connector_sa.email}"
14+
}

‎examples/single-project-k8s/main.tf‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
locals {
2+
verify_ssl = length(regexall("^https://.*?\\.sysdig.com/?", var.sysdig_secure_endpoint)) != 0
3+
connector_filter = <<EOT
4+
logName=~"^projects/${var.project_id}/logs/cloudaudit.googleapis.com" AND -resource.type="k8s_cluster"
5+
EOT
6+
}
7+
8+
provider "google" {
9+
project = var.project_id
10+
region = var.location
11+
}
12+
13+
# TODO review ways to pass content as input var
14+
provider "helm" {
15+
kubernetes {
16+
config_path = "~/.kube/config"
17+
}
18+
}

‎examples/single-project-k8s/outputs.tf‎

Whitespace-only changes.

‎examples/single-project-k8s/variables.tf‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# Mandatory vars
2+
variable "sysdig_secure_api_token" {
3+
type = string
4+
description = "Sysdig's Secure API Token"
5+
}
6+
7+
variable "project_id" {
8+
type = string
9+
description = "Project ID where the secure-for-cloud workload is going to be deployed"
10+
}
11+
12+
# --------------------------
13+
# optionals, with defaults
14+
# --------------------------
15+
variable "location" {
16+
type = string
17+
default = "us-central1"
18+
description = "Zone where the stack will be deployed"
19+
}
20+
21+
variable "sysdig_secure_endpoint" {
22+
type = string
23+
default = "https://secure.sysdig.com"
24+
description = "Sysdig Secure API endpoint"
25+
}
26+
27+
variable "name" {
28+
type = string
29+
description = "Name to be assigned to all child resources. A suffix may be added internally when required. Use default value unless you need to install multiple instances"
30+
default = "sfc"
31+
32+
validation {
33+
condition = can(regex("^[a-z0-9]+$", var.name))
34+
error_message = "ERROR: Invalid name. must contain only lowercase letters (a-z) and numbers (0-9)."
35+
}
36+
}
37+
38+
variable "cloud_connector_image" {
39+
type = string
40+
description = "Cloud-connector image to deploy"
41+
default = "quay.io/sysdig/cloud-connector"
42+
}

‎examples/single-project-k8s/versions.tf‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
terraform {
2+
required_version = ">= 0.15.0"
3+
required_providers {
4+
google = {
5+
source = "hashicorp/google"
6+
version = ">= 3.67.0"
7+
}
8+
sysdig = {
9+
source = "sysdiglabs/sysdig"
10+
version = ">= 0.5.19"
11+
}
12+
helm = {
13+
source = "hashicorp/helm"
14+
version = ">=2.3.0"
15+
}
16+
}
17+
}

‎modules/infrastructure/project_sink/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ No modules.
3838
| Name | Description |
3939
|------|-------------|
4040
| <a name="output_pubsub_topic_id"></a> [pubsub\_topic\_id](#output\_pubsub\_topic\_id) | Cloud Connector PubSub single account topic id |
41+
| <a name="output_pubsub_topic_name"></a> [pubsub\_topic\_name](#output\_pubsub\_topic\_name) | Cloud Connector PubSub single account topic name |
4142
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
4243

4344
## Authors

‎modules/infrastructure/project_sink/outputs.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,8 @@ output "pubsub_topic_id" {
22
value = google_pubsub_topic.topic.id
33
description = "Cloud Connector PubSub single account topic id"
44
}
5+
6+
output "pubsub_topic_name" {
7+
value = google_pubsub_topic.topic.name
8+
description = "Cloud Connector PubSub single account topic name"
9+
}

0 commit comments

Comments
 (0)