GitLab Protect Stage, 8 Feb 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Enabling Gitlab Network Policy Alerts in your GitLab environment

Description

Cluster integration & Cluster management apps (aka. GMA v2) walkthrough:
- https://www.youtube.com/watch?v=mKm-jkranEk
Cilium and Ingress (through GMA v2) installation walkthrough:
- https://www.youtube.com/watch?v=pgUEdhdhoUI
Cilium&Ingress in your local dev environment:
- https://www.youtube.com/watch?v=R2O2Y8_MrQ8

Gitlab k8s agent docs:
- https://docs.gitlab.com/ee/user/clusters/agent/

A

Hello, everyone. So uh this time we are going to go through uh from having a ceiling installed in a cluster, and in this case we are going to use gke and uh also assuming that the cluster integration has been done already. For that. I'm gonna include uh three videos in the description. One video is how to have the cluster integration with celium on your local dev environment.

A

The other features how to do a cluster integration if you are using gitlab.com and the other videos how to specifically have c installed in your cluster by using gma v2. So just a quick recap, um let me show my terminal so here we have a g key.

A

uh I'm gonna show you that it just had just have um one node, that's enough for for having this test and then uh on the left side of the screen. Here we can see that, apart from the regular uh gke pods, we have celium pod and if you install celium with gma v2 you're going to get also the hubble relay pod.

A

uh In addition to that, we need nginx, that's also you can install using uh cluster applications. That's again, that's going! There is going to be a link on the description with information, how you can install cd and nginx using cluster management project, which is also known as a gma feature. So, let's get started, I haven't prepared much. Basically, I have an existing a project here in my environment and it has a it has already a deployment.

A

That's running here, open this. It's for the sake of clarity, yeah, that's a demo application that we have. um I can put a link in the description as well. I use that for testing. So basically, we have a project repository that was integrated with uh jmav2 and uh it has seen nginx deployed and also the this repository has been deployed as production, so that that's what you can see here under environment so from here what we're going to have from here.

A

We are going to go through the gtlab kubernetes agent documentation and we are going step by step in order to have the agent running for this specific project, and the final goal is that we we should have alerts associated to the network policies that are going to be associated with the project that we we are seeing here.

A

Let me just close this extra ui so that we are confusing okay, so the the documentation so far for uh kubernetes agent, it's around git ops. uh In this video, we are not going to talk about githubs. There are other videos talking about githubs this. This video is just going to talk about saving alerts.

A

Still we are going to go to step by step here in order to to kind of uh see uh how we can integrate this.

A

This video is mostly for uh for users that are having uh gitlab.com for other users, uh for if you have a self management instance, you need to go through a little bit other steps here for a couple of other steps here that we are not considering for this video, for example, you have to enable uh cass in this case here we are using uh one of the gitlab environments that already have accounts cast installed.

A

So let's go so with that said, we can skip this parts here, okay, so then the first step for us would be to. We need first to have a proper project.

A

What we mean by a proper project, it's the order here is not.

A

A

So, okay, so then uh I actually missed that so that that's exactly right, we have a define. uh The final configuration repository. That's going to be the configuration for the agent, so basically the format is to have folders nested folders in a way that it's dot, gitlab, slash agent, slash the agent name, slash config.ml.

A

In our case, we are just going to use asian test as the asian name. So let's go to this project here. Let me just copy this folder here, let's go here and let's start a web ide and for here we can create folder and we can just put this asian test as a folder. Here we can create a directory.

A

So now we have a gitlab agent asian test here inside asiantext. We need to create a new file and, let's just double check the name of the file. It's a config email file.

A

So, let's do it here and then inside this file here there is just, as I mentioned before, there's just information about the git ops that we are not mentioning.

A

We are going to be updating the documentation person, but for now uh bear with me. What we need here is that we need a serum and under seeding. We need.

A

Copy paste here so then I I don't make it. I don't have a taco, that's the hyperlay address and hubberley address is going to depend. It's going to depend on how you install hubble on your on your kubernetes. You can also have a um depends on how you follow celium configuration, you might have a different setup. So in this case here let's just go and grab the hubble that we have.

A

I just have the regular hubble as a as part of the gma installation, and that's let me just move sideways here. So it's we clear so we have here under the gitlab management, apps namespace. We can see hover relay and we can see that the port is 80..

A

So what we're going to do is that we are going to just use the regular syntax. That's the search name, dot.

A

Namespace.Svc.Cluster.Local and we need the port 80.

A

Okay, so that's what we need for a configuration for the for the agent for the city alert configuration in this project.

A

So, let's commit I'm gonna. Do that in master and.

A

You can deploy this.

A

It's the flying already.

A

So what happens now is that if we go back to the documentation, we already defined the name of the agent right, the name of the agent just for us to be uh on the same page, it's going to be a agent test. We keep both these, so that's the one we we need to rema. We need as a reminder.

A

So now, if we go down here, we need the next step would be the first one. We define the project for the agent next one. We need to create the agent record in gitlab. There is an option to do through rails console. If you are having like a gitlab self management instance, you might be able to do that or if you're using gdk. You also can do that. But in this case here we are going through.

A

We are going to use graphql, so I'm going to copy this. uh I haven't done that before I'm gonna copy this query. First, I have the graphql for this endpoint and then let's just follow the steps. So first we need the path to the configuration project. Let's go there and grab the path to the configuration project.

A

We grab from here.

A

To here, just following the documentation and next step, we need the agent name that we had before we defined that it's agent test and then we can. We can just run it okay. So now we have a new agent and we also have the id. So let me just grab this id here and save so then we don't forget it. I think we need that for the next step.

A

Let's go back again to the documentation, let's grab this query and let's move the other one. So that's the new query. We need the cluster agent id, that's the one we have here.

A

We didn't have actually to.

A

A

So that should be it.

A

Okay, let's run it okay, so now we have the token I'm gonna save it, but what we're going to need here. Is this token here? That's what the thing that we're going to use to give the agent permission inside kubernetes.

A

So, let's see the next step, we need to create a secret.

A

Let's first create a namespace, that's going to be used for all of them. The namespace I'm gonna use. Here it's going to be again just uh just asian test. So then we keep everything with the same name. Hopefully that's not confusing, and then, if we do kubernetes give cdl get name spaces.

A

We see it here and on this other window here you can see that the the new department has finished. So we should have the the new version of the code there. Okay, so we have namespace, let's go there, and uh so next step here is to create the the token inside the cluster and then.

A

We have the name space there. Let's first put the namespace, that's a git lab sorry asian test get laptop from the token, and then here we put the token that we got from the graph.

A

Cuba, we have the token created. um Let's go back to the documentation.

A

Sorry there's some there's something just pop up.

A

And so now uh it's talking about, we need to install the agent in the cluster right now, it's a manual step, uh there's a couple of things going on that that's going to make this step a little bit more uh streamlined so right now there is this uh resource ml here, and there is a couple of structures here on updating, uh namespace and a couple of other things, I'm going to open here just for making clear.

A

So it's a it's a resource ml with a couple of things. uh The service account related to the to the agent, and we have the deployment itself that um here you can see that's pointing to the agent itself image and there are. There are three things here that we need to be careful, so we don't forget. First, one is that we need to make sure that the namespace here- and here it's exactly the name space that we just created. So probably we are going to have to update this here.

A

Also, uh it's a new feature. So right now it's safer to use the version instead of using latest it's just easier to use a version that actually match the cast that you have in production.

A

In this case here it's a version 13.9.1 that we are going to use if you're using git lab this is. Can this can be created on the there is a part of the. If we go to the repository in gitlab.

A

Let me just show you here: we can see the version of cass here, so that's the one that was latest and that's the one that we're going to tie in our resource file. Let's go back again to the resource file. The third thing is that that's the host and you can use uh different setups in this case. Here we are not deploying on gitlab.com. We are deploying a different environment.

A

So then we we just have to update this one, and uh I have one I have one file locally already, so I'm just going to open this file here, so we can see together what I have so far, and we might need to update something that I didn't update before what uh recording this video.

A

So we see here that uh online 23 we already have the version instead of latest we have 13.9.1.

A

This is to make sure that we have an agent version that match casts cast is going to run besides git lab and agent k is running inside the cluster and then on line 27. Here we are pointing to the environment that we want to use uh if you're using gitlab.com you're going to use the one, that's specifying the documentation or if you have your self-managed instance you might you might uh using a different configuration here as well, and uh the third thing is the namespace that I mentioned before so here we have.

A

uh Oh, it's it's already the finances we have namespace here agent test, that's the namespace we're using and here is also asian test. So I can just close this file. So just close this file and- um and we can go back here and see- I think we just need to deploy it yeah. So basically, that's the structure that we need to deploy.

A

I should have this locally here: hit lab, apply resources and I just need to set up namespace with live. Sorry, patient test.

A

Apply, oh, the dash needs to be after namespace, my bad.

A

So then we can see on the on the right side. We can hear that that we have search account. We can have we net, we have the cluster role, that's going to define the permissions, and then we have closer uh two cluster roles, one for region and one for writing, and we have the two cluster row bindings. That's the same. It's going to be associating the service account with each cluster row and also we have the the deployment.

A

So if we look inside, uh if we're looking to the log of this pod, let's take a look and I can keep it as a follower.

A

Okay, so it's heavy here, so we should be good now and let me just check here if there was another instruction that I might be missing manifest: okay, the the manifest is going to be for git ops. We don't need that if you're just using the sitting, alerts- okay and that's it.

A

So let's go back to the project itself and let's, let's go to try the monitoring and let's create a policy for this environment. That's going to trigger alert, so I'm just going to say here trigger alerts and I'm gonna enable the policy. I'm just gonna. Add one rule: I'm gonna say that this um this pod can just receive. uh I can just having grass from uh another pod that has the label at none in this case in this cluster.

A

There's nothing like this, so I just want to force uh the drop and then I can come here and add alert because I want to see the alerts and then create policy reach network policy.

A

We should see the policy here now and if we spin up the environment for this project, the only one that we have deployed, we should get a timeout, because no pod is allowed to communicate with that part that we, the deployment that we had and after some time. uh Oh, if we take a look in the cluster, we should see the messages here.

A

So we see that on the agent blog, we can see that we are getting the alerts and if we go back here to the alert page and if we refresh, we should see the alerts coming up. Yeah and those are the alerts.

A

I think that's uh that's good. For this video um we are going to have a couple of more features coming up and uh watch out, keep an eye on this channel for more videos on that. Thanks for.

A