Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

database abstractor setup, segregate dashboard runtime #3

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions charts/akto-setup-database-abstractor/.helmignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
# Patterns to ignore when building packages.
# This supports shell glob matching, relative path matching, and
# negation (prefixed with !). Only one pattern per line.
.DS_Store
# Common VCS dirs
.git/
.gitignore
.bzr/
.bzrignore
.hg/
.hgignore
.svn/
# Common backup files
*.swp
*.bak
*.tmp
*.orig
*~
# Various IDEs
.project
.idea/
*.tmproj
.vscode/
18 changes: 18 additions & 0 deletions charts/akto-setup-database-abstractor/Chart.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
apiVersion: v2
name: akto
description: Helm chart for installing Akto
type: application
version: 0.1.4
appVersion: "0.1.4"
home: https://www.akto.io
icon: https://akto-setup.s3.amazonaws.com/templates/128x128.png
sources:
- https://github.com/akto-api-security/helm-charts/tree/master/charts/akto-setup
keywords:
- akto
- api
- api security
- dast
maintainers:
- name: Ankush Jain
email: [email protected]
63 changes: 63 additions & 0 deletions charts/akto-setup-database-abstractor/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,63 @@
# Akto setup

You can install Akto via Helm charts.

## Resources
Akto's Helm chart repo is on GitHub [here](https://github.com/akto-api-security/helm-charts).
You can also find Akto on Helm.sh [here](https://artifacthub.io/packages/helm/akto/akto).

## Prerequisites
Please ensure you have the following -
1. A Kubernetes cluster where you have deploy permissions
2. `helm` command installed. Check [here](https://helm.sh/docs/intro/install/)

## Steps
Here are the steps to install Akto via Helm charts -

1. Prepare Mongo Connection string
2. Install Akto via Helm
3. Verify Installation and harden security

### Create Mongo instance
Akto Helm setup needs a Mongo connection string as input. It can come from either of the following -
1. **Your own Mongo**
Ensure your machine where you setup Mongo is NOT exposed to public internet. It shouldn't have a public IP. You can setup Mongo by running the following commands.
```
sudo yum update -y
sudo yum install -y docker
sudo dockerd&
docker run --name mongo --restart always -v ./data:/data/db -p 27017:27017 mongo
sudo systemctl enable /usr/lib/systemd/system/docker.service
```
<img width="1161" alt="AWS EC2 Mongo" src="https://github.com/akto-api-security/Documentation/assets/91221068/0b6b87e8-9797-4729-ab01-fd48f99efbd3">

The connection string would then be `mongodb://<YOUR_INSTANCE_PRIVATE_IP>:27017/admini`
2. **Mongo Atlas**
You can use Mongo Atlas connection as well
1. Go to `Database Deployments` page for your project
2. Click on `Connect` button
3. Choose `Connect your application` option
4. Copy the connection string. It should look like `mongodb://....`
<img width="567" alt="Mongo Atlas" src="https://github.com/akto-api-security/Documentation/assets/91221068/1128e098-3618-4d19-b9c3-2c7482b4714e">

3. **AWS Document DB**
If you are on AWS, you can use AWS Document DB too. You can find the connection string on the Cluster page itself.
<img width="1399" alt="AWS DocDB" src="https://github.com/akto-api-security/Documentation/assets/91221068/4ce4d84d-6e8a-4d4d-bc0b-e5d03e3f824a">

Note: Please ensure your K8S cluster has connectivity to Mongo.

### Install Akto via Helm

1. Add Akto repo
```helm repo add akto https://akto-api-security.github.io/helm-charts```
2. Install Akto via helm
```helm install akto akto/akto -n dev --set mongo.aktoMongoConn="<AKTO_CONNECTION_STRING>"```
3. Run `kubectl get pods -n <NAMESPACE>` and verify you can see 4 pods
<img width="862" alt="Screenshot 2023-11-16 at 10 08 23 AM" src="https://github.com/akto-api-security/Documentation/assets/91221068/3a5a4d26-3305-4eb2-94f9-ae598817252d">

### Verify Installation and harden security

1. Run the following to get Akto dashboard url
```kubectl get services/akto-dashboard -n dev | awk -F " " '{print $4;}'```
2. Open Akto dashboard on port 8080. eg `http://a54b36c1f4asdaasdfbd06a259de2-acf687643f6fe4eb.elb.ap-south-1.amazonaws.com:8080/`
3. For good security measures, you should enable HTTPS by adding a certificate and put it behind a VPN. If you are on AWS, follow the guide [here](https://docs.akto.io/getting-started/aws-ssl).
8 changes: 8 additions & 0 deletions charts/akto-setup-database-abstractor/templates/NOTES.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
Thank you for installing {{ .Chart.Name }}.

Your release is named {{ .Release.Name }}.

To learn more about the release, try:

$ helm status {{ .Release.Name }}
$ helm get all {{ .Release.Name }}
61 changes: 61 additions & 0 deletions charts/akto-setup-database-abstractor/templates/_helpers.tpl
Original file line number Diff line number Diff line change
@@ -0,0 +1,61 @@
{{/*
Expand the name of the chart.
*/}}
{{- define "akto.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "akto.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- if contains $name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{- end }}

{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "akto.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
{{- end }}

{{/*
Common labels
*/}}
{{- define "akto.labels" -}}
helm.sh/chart: {{ include "akto.chart" . }}
{{ include "akto.selectorLabels" . }}
{{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- end }}

{{/*
Selector labels
*/}}
{{- define "akto.selectorLabels" -}}
app.kubernetes.io/name: {{ include "akto.name" . }}
{{- end }}

{{/*
Create the name of the service account to use
*/}}
{{- define "akto.serviceAccountName" -}}
{{- if .Values.serviceAccount.create }}
{{- default (include "akto.fullname" .) .Values.serviceAccount.name }}
{{- else }}
{{- default "default" .Values.serviceAccount.name }}
{{- end }}
{{- end }}
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
apiVersion: v1
kind: Service
metadata:
name: {{ include "akto.fullname" . }}-database-abstractor
labels:
{{- include "akto.labels" . | nindent 4 }}
annotations:
service.beta.kubernetes.io/aws-load-balancer-type: nlb
spec:
type: {{ .Values.database_abstractor.type }}
selector:
app: {{ include "akto.fullname" . }}-database-abstractor
{{- include "akto.selectorLabels" . | nindent 4 }}
ports:
{{- .Values.database_abstractor.ports | toYaml | nindent 2 -}}
Original file line number Diff line number Diff line change
@@ -0,0 +1,49 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "akto.fullname" . }}-database-abstractor
annotations:
keel.sh/policy: force
keel.sh/trigger: poll
keel.sh/pollSchedule: "@every 60m"
labels:
{{- include "akto.labels" . | nindent 4 }}
spec:
replicas: {{ .Values.database_abstractor.replicas }}
selector:
matchLabels:
app: {{ include "akto.fullname" . }}-database-abstractor
{{- include "akto.selectorLabels" . | nindent 6 }}
template:
metadata:
labels:
app: {{ include "akto.fullname" . }}-database-abstractor
{{- include "akto.selectorLabels" . | nindent 8 }}
spec:
containers:
- env:
- name: AKTO_ACCOUNT_NAME
value: {{ quote .Values.database_abstractor.aktoApiSecurityDatabaseAbstractor.env.aktoAccountName
}}
- name: IS_KUBERNETES
value: "true"
- name: AKTO_CONFIG_NAME
value: {{ quote .Values.database_abstractor.aktoApiSecurityDatabaseAbstractor.env.aktoConfigName
}}
- name: AKTO_INSTANCE_TYPE
value: {{ quote .Values.database_abstractor.aktoApiSecurityDatabaseAbstractor.env.aktoInstanceType
}}
- name: AKTO_MONGO_CONN
value: {{ quote .Values.mongo.aktoMongoConn
}}
- name: KUBERNETES_CLUSTER_DOMAIN
value: {{ quote .Values.kubernetesClusterDomain }}
image: {{ .Values.database_abstractor.aktoApiSecurityDatabaseAbstractor.image.repository }}:{{ .Values.database_abstractor.aktoApiSecurityDatabaseAbstractor.image.tag
| default .Chart.AppVersion }}
imagePullPolicy: {{ .Values.database_abstractor.aktoApiSecurityDatabaseAbstractor.imagePullPolicy
}}
name: akto-api-security-database-abstractor
ports:
- containerPort: 9000
resources: {{- toYaml .Values.database_abstractor.aktoApiSecurityDatabaseAbstractor.resources | nindent 10 }}
restartPolicy: Always
14 changes: 14 additions & 0 deletions charts/akto-setup-database-abstractor/templates/hpa.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
apiVersion: autoscaling/v1
kind: HorizontalPodAutoscaler
metadata:
name: {{ include "akto.fullname" . }}-runtime
labels:
{{- include "akto.labels" . | nindent 4 }}
spec:
maxReplicas: 2
minReplicas: 1
scaleTargetRef:
apiVersion: apps/v1
kind: Deployment
name: {{ include "akto.fullname" . }}-runtime
targetCPUUtilizationPercentage: 80
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "akto.fullname" . }}-keel
labels:
app: {{ include "akto.fullname" . }}-keel
{{- include "akto.labels" . | nindent 4 }}
annotations:
{{- toYaml .Values.keel.serviceAccount.annotations | nindent 4 }}
62 changes: 62 additions & 0 deletions charts/akto-setup-database-abstractor/values.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,62 @@
database_abstractor:
aktoApiSecurityDatabaseAbstractor:
env:
aktoAccountName: Helios
aktoConfigName: staging
aktoInstanceType: DASHBOARD
image:
repository: public.ecr.aws/aktosecurity/akto-api-security-database-abstractor
tag: testimm
imagePullPolicy: IfNotPresent
resources:
requests:
cpu: 1
memory: "4Gi"
limits:
cpu: 2
memory: "8Gi"
ports:
- port: 9000
targetPort: 8080
replicas: 1
type: LoadBalancer
kubernetesClusterDomain: cluster.local

keel:
keel:
env:
awsAccessKeyId: ""
awsRegion: ""
awsSecretAccessKey: ""
hipchatApprovalsBotName: ""
hipchatApprovalsChannel: ""
hipchatApprovalsPasswort: ""
hipchatApprovalsUserName: ""
hipchatChannels: ""
hipchatToken: ""
insecureRegistry: "true"
mattermostEndpoint: ""
notificationLevel: info
webhookEndpoint: ""
image:
repository: keelhq/keel
tag: latest
imagePullPolicy: Always
resources:
limits:
cpu: 100m
memory: 128Mi
requests:
cpu: 50m
memory: 64Mi
maxUnavailable: 1
ports:
- name: keel
port: 9300
protocol: TCP
targetPort: 9300
replicas: 1
serviceAccount:
annotations: {}
type: LoadBalancer
kubernetesClusterDomain: cluster.local
23 changes: 23 additions & 0 deletions charts/akto-setup-runtime/.helmignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
# Patterns to ignore when building packages.
# This supports shell glob matching, relative path matching, and
# negation (prefixed with !). Only one pattern per line.
.DS_Store
# Common VCS dirs
.git/
.gitignore
.bzr/
.bzrignore
.hg/
.hgignore
.svn/
# Common backup files
*.swp
*.bak
*.tmp
*.orig
*~
# Various IDEs
.project
.idea/
*.tmproj
.vscode/
18 changes: 18 additions & 0 deletions charts/akto-setup-runtime/Chart.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
apiVersion: v2
name: akto
description: Helm chart for installing Akto
type: application
version: 0.1.4
appVersion: "0.1.4"
home: https://www.akto.io
icon: https://akto-setup.s3.amazonaws.com/templates/128x128.png
sources:
- https://github.com/akto-api-security/helm-charts/tree/master/charts/akto-setup
keywords:
- akto
- api
- api security
- dast
maintainers:
- name: Ankush Jain
email: [email protected]
Loading