Skip to content

Commit 3e80727

Browse files
claudexclaudex
authored
Kubernetes ingress and other improvement (#395)
* Add an ingress for the kubernetes manifests This changes the configuration for the nginx deployment to run with root privileges and use a configmap for the settings. TLS is disabled as it can cause issue with ingress and untrusted certificates * Use an env var for cronjob endpoint * Split misp-module in dedicated deployment
1 parent ea921e6 commit 3e80727

16 files changed

Lines changed: 311 additions & 143 deletions

‎core/files/kubernetes/entrypoint_nginx.sh‎

Lines changed: 0 additions & 20 deletions
This file was deleted.

‎kubernetes/instance-secrets.env‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ REDIS_PASSWORD=replacemewithsomethingelse
22
ADMIN_KEY=REPLACEMEWITHANACTUALKEYTHATWILLWORKFORU
33
ADMIN_PASSWORD=sometimespasswordsarelongsometimespasswordsareshort
44
BASE_URL=https://localhost:9002
5+
MISP_SERVICE=nginx:8080
56
S3_BUCKET=files-storage-bucket
67
S3_ENDPOINT=https://s3-service-endpoint
78
S3_ACCESS_KEY=s3-access-key

‎kubernetes/kustomization.yaml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ resources:
77
- ./manifests/redis.yaml
88
- ./manifests/mysql.yaml
99
- ./manifests/services.yaml
10+
- ./manifests/ingress.yaml
11+
- ./manifests/nginx-cm.yaml
1012
- ./manifests/cronjobs/cache-all-feeds.yaml
1113
- ./manifests/cronjobs/fetch-all-feeds.yaml
1214
- ./manifests/cronjobs/pull-all-servers.yaml
@@ -25,4 +27,4 @@ secretGenerator:
2527
- ./mysql-credentials.env
2628
literals:
2729
- MYSQL_DATABASE=misp
28-
- MYSQL_USER=misp
30+
- MYSQL_USER=misp

‎kubernetes/manifests/cronjobs/cache-all-feeds.yaml‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -14,16 +14,17 @@ spec:
1414
app.kubernetes.io/name: misp-cron
1515
spec:
1616
containers:
17-
- name: curl
18-
image: registry.gitlab.com/gitlab-ci-utils/curl-jq:3.2.1
19-
imagePullPolicy: IfNotPresent
20-
command: ["/bin/sh", "-c"]
21-
args:
22-
- 'curl -s -k -X POST -H "Authorization: ${ADMIN_KEY}" -H "Accept: application/json" -H "Content-Type: application/json" https://nginx/feeds/cacheFeeds/all'
23-
envFrom:
24-
- secretRef:
25-
name: instance-secrets
17+
- name: curl
18+
image: registry.gitlab.com/gitlab-ci-utils/curl-jq:3.2.1
19+
imagePullPolicy: IfNotPresent
20+
command: ["/bin/sh", "-c"]
21+
args:
22+
- 'curl -s -X POST -H "Authorization: ${ADMIN_KEY}" -H "Accept: application/json" -H "Content-Type: application/json" "http://$MISP_SERVICE/feeds/cacheFeeds/all"'
23+
envFrom:
24+
- secretRef:
25+
name: instance-secrets
2626
restartPolicy: Never
2727
backoffLimit: 2
2828
activeDeadlineSeconds: 1200
29-
concurrencyPolicy: Forbid
29+
concurrencyPolicy: Forbid
30+

‎kubernetes/manifests/cronjobs/fetch-all-feeds.yaml‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -14,16 +14,17 @@ spec:
1414
app.kubernetes.io/name: misp-cron
1515
spec:
1616
containers:
17-
- name: curl
18-
image: registry.gitlab.com/gitlab-ci-utils/curl-jq:3.2.1
19-
imagePullPolicy: IfNotPresent
20-
command: ["/bin/sh", "-c"]
21-
args:
22-
- 'curl -s -X POST -k -H "Authorization: ${ADMIN_KEY}" -H "Accept: application/json" -H "Content-Type: application/json" https://nginx/feeds/fetchFromAllFeeds'
23-
envFrom:
24-
- secretRef:
25-
name: instance-secrets
17+
- name: curl
18+
image: registry.gitlab.com/gitlab-ci-utils/curl-jq:3.2.1
19+
imagePullPolicy: IfNotPresent
20+
command: ["/bin/sh", "-c"]
21+
args:
22+
- 'curl -s -X POST -H "Authorization: ${ADMIN_KEY}" -H "Accept: application/json" -H "Content-Type: application/json" "http://$MISP_SERVICE/feeds/fetchFromAllFeeds"'
23+
envFrom:
24+
- secretRef:
25+
name: instance-secrets
2626
restartPolicy: Never
2727
backoffLimit: 2
2828
activeDeadlineSeconds: 1200
29-
concurrencyPolicy: Forbid
29+
concurrencyPolicy: Forbid
30+

‎kubernetes/manifests/cronjobs/pull-all-servers.yaml‎

Lines changed: 22 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -14,27 +14,28 @@ spec:
1414
app.kubernetes.io/name: misp-cron
1515
spec:
1616
containers:
17-
- name: curl
18-
image: registry.gitlab.com/gitlab-ci-utils/curl-jq:3.2.1
19-
imagePullPolicy: IfNotPresent
20-
command: ["/bin/sh", "-c"]
21-
args:
22-
- |
23-
echo "Fetching server list"
24-
json_data=$(curl -s -k -H "Authorization: ${ADMIN_KEY}" -H "Accept: application/json" -H "Content-Type: application/json" https://nginx/servers)
25-
echo "Fetched server list"
26-
id_list=$(echo "$json_data" | jq -r '.[]? | select(.Server.pull == true) | .Server.id')
27-
echo "Pulling all servers with pull enabled"
28-
for id in $id_list
29-
do
30-
echo "Creating job to pull from server with id $id"
31-
result=$(curl -s -k -H "Authorization: ${ADMIN_KEY}" -H "Accept: application/json" -H "Content-Type: application/json" https://nginx/servers/pull/$id)
32-
echo " - $(echo $result | jq -r '.message')"
33-
done
34-
envFrom:
35-
- secretRef:
36-
name: instance-secrets
17+
- name: curl
18+
image: registry.gitlab.com/gitlab-ci-utils/curl-jq:3.2.1
19+
imagePullPolicy: IfNotPresent
20+
command: ["/bin/sh", "-c"]
21+
args:
22+
- |
23+
echo "Fetching server list"
24+
json_data=$(curl -s -H "Authorization: ${ADMIN_KEY}" -H "Accept: application/json" -H "Content-Type: application/json" "http://$MISP_SERVICE/servers")
25+
echo "Fetched server list"
26+
id_list=$(echo "$json_data" | jq -r '.[]? | select(.Server.pull == true) | .Server.id')
27+
echo "Pulling all servers with pull enabled"
28+
for id in $id_list
29+
do
30+
echo "Creating job to pull from server with id $id"
31+
result=$(curl -s -H "Authorization: ${ADMIN_KEY}" -H "Accept: application/json" -H "Content-Type: application/json" "http://$MISP_SERVICE/servers/pull/$id")
32+
echo " - $(echo $result | jq -r '.message')"
33+
done
34+
envFrom:
35+
- secretRef:
36+
name: instance-secrets
3737
restartPolicy: Never
3838
backoffLimit: 2
3939
activeDeadlineSeconds: 1200
40-
concurrencyPolicy: Forbid
40+
concurrencyPolicy: Forbid
41+

‎kubernetes/manifests/cronjobs/push-all-servers.yaml‎

Lines changed: 22 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -14,27 +14,28 @@ spec:
1414
app.kubernetes.io/name: misp-cron
1515
spec:
1616
containers:
17-
- name: curl
18-
image: registry.gitlab.com/gitlab-ci-utils/curl-jq:3.2.1
19-
imagePullPolicy: IfNotPresent
20-
command: ["/bin/sh", "-c"]
21-
args:
22-
- |
23-
echo "Fetching server list"
24-
json_data=$(curl -s -k -H "Authorization: ${ADMIN_KEY}" -H "Accept: application/json" -H "Content-Type: application/json" https://nginx/servers)
25-
echo "Fetched server list"
26-
id_list=$(echo "$json_data" | jq -r '.[]? | select(.Server.push == true) | .Server.id')
27-
echo "Pulling all servers with push enabled"
28-
for id in $id_list
29-
do
30-
echo "Creating job to push from server with id $id"
31-
result=$(curl -s -k -H "Authorization: ${ADMIN_KEY}" -H "Accept: application/json" -H "Content-Type: application/json" https://nginx/servers/push/$id)
32-
echo " - $(echo $result | jq -r '.message')"
33-
done
34-
envFrom:
35-
- secretRef:
36-
name: instance-secrets
17+
- name: curl
18+
image: registry.gitlab.com/gitlab-ci-utils/curl-jq:3.2.1
19+
imagePullPolicy: IfNotPresent
20+
command: ["/bin/sh", "-c"]
21+
args:
22+
- |
23+
echo "Fetching server list"
24+
json_data=$(curl -s -H "Authorization: ${ADMIN_KEY}" -H "Accept: application/json" -H "Content-Type: application/json" "http://$MISP_SERVICE/servers")
25+
echo "Fetched server list"
26+
id_list=$(echo "$json_data" | jq -r '.[]? | select(.Server.push == true) | .Server.id')
27+
echo "Pulling all servers with push enabled"
28+
for id in $id_list
29+
do
30+
echo "Creating job to push from server with id $id"
31+
result=$(curl -s -H "Authorization: ${ADMIN_KEY}" -H "Accept: application/json" -H "Content-Type: application/json" "http://$MISP_SERVICE/servers/push/$id")
32+
echo " - $(echo $result | jq -r '.message')"
33+
done
34+
envFrom:
35+
- secretRef:
36+
name: instance-secrets
3737
restartPolicy: Never
3838
backoffLimit: 2
3939
activeDeadlineSeconds: 1200
40-
concurrencyPolicy: Forbid
40+
concurrencyPolicy: Forbid
41+

‎kubernetes/manifests/cronjobs/update-galaxies.yaml‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -14,16 +14,17 @@ spec:
1414
app.kubernetes.io/name: misp-cron
1515
spec:
1616
containers:
17-
- name: curl
18-
image: registry.gitlab.com/gitlab-ci-utils/curl-jq:3.2.1
19-
imagePullPolicy: IfNotPresent
20-
command: ["/bin/sh", "-c"]
21-
args:
22-
- 'curl -s -k -X POST -H "Authorization: ${ADMIN_KEY}" -H "Accept: application/json" -H "Content-Type: application/json" https://nginx/galaxies/update'
23-
envFrom:
24-
- secretRef:
25-
name: instance-secrets
17+
- name: curl
18+
image: registry.gitlab.com/gitlab-ci-utils/curl-jq:3.2.1
19+
imagePullPolicy: IfNotPresent
20+
command: ["/bin/sh", "-c"]
21+
args:
22+
- 'curl -s -X POST -H "Authorization: ${ADMIN_KEY}" -H "Accept: application/json" -H "Content-Type: application/json" "http://$MISP_SERVICE/galaxies/update"'
23+
envFrom:
24+
- secretRef:
25+
name: instance-secrets
2626
restartPolicy: Never
2727
backoffLimit: 2
2828
activeDeadlineSeconds: 1200
29-
concurrencyPolicy: Forbid
29+
concurrencyPolicy: Forbid
30+

‎kubernetes/manifests/cronjobs/update-noticelists.yaml‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -14,16 +14,17 @@ spec:
1414
app.kubernetes.io/name: misp-cron
1515
spec:
1616
containers:
17-
- name: curl
18-
image: registry.gitlab.com/gitlab-ci-utils/curl-jq:3.2.1
19-
imagePullPolicy: IfNotPresent
20-
command: ["/bin/sh", "-c"]
21-
args:
22-
- 'curl -s -X POST -k -H "Authorization: ${ADMIN_KEY}" -H "Accept: application/json" -H "Content-Type: application/json" https://nginx/noticelists/update'
23-
envFrom:
24-
- secretRef:
25-
name: instance-secrets
17+
- name: curl
18+
image: registry.gitlab.com/gitlab-ci-utils/curl-jq:3.2.1
19+
imagePullPolicy: IfNotPresent
20+
command: ["/bin/sh", "-c"]
21+
args:
22+
- 'curl -s -X POST -H "Authorization: ${ADMIN_KEY}" -H "Accept: application/json" -H "Content-Type: application/json" "http://$MISP_SERVICE/noticelists/update"'
23+
envFrom:
24+
- secretRef:
25+
name: instance-secrets
2626
restartPolicy: Never
2727
backoffLimit: 2
2828
activeDeadlineSeconds: 1200
29-
concurrencyPolicy: Forbid
29+
concurrencyPolicy: Forbid
30+

‎kubernetes/manifests/cronjobs/update-taxonomies.yaml‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -14,16 +14,17 @@ spec:
1414
app.kubernetes.io/name: misp-cron
1515
spec:
1616
containers:
17-
- name: curl
18-
image: registry.gitlab.com/gitlab-ci-utils/curl-jq:3.2.1
19-
imagePullPolicy: IfNotPresent
20-
command: ["/bin/sh", "-c"]
21-
args:
22-
- 'curl -s -X POST -k -H "Authorization: ${ADMIN_KEY}" -H "Accept: application/json" -H "Content-Type: application/json" https://nginx/taxonomies/update'
23-
envFrom:
24-
- secretRef:
25-
name: instance-secrets
17+
- name: curl
18+
image: registry.gitlab.com/gitlab-ci-utils/curl-jq:3.2.1
19+
imagePullPolicy: IfNotPresent
20+
command: ["/bin/sh", "-c"]
21+
args:
22+
- 'curl -s -X POST -H "Authorization: ${ADMIN_KEY}" -H "Accept: application/json" -H "Content-Type: application/json" http://$MISP_SERVICE/taxonomies/update'
23+
envFrom:
24+
- secretRef:
25+
name: instance-secrets
2626
restartPolicy: Never
2727
backoffLimit: 2
2828
activeDeadlineSeconds: 1200
29-
concurrencyPolicy: Forbid
29+
concurrencyPolicy: Forbid
30+

0 commit comments

Comments
 (0)