Skip to content

antony@notes:~/security$ cat "Helm-Install-Neuvector-on-community-Kubernetes.md"

Helm Install Neuvector on community Kubernetes

2024-07-06· security ·NeuVector 5.2.0

Helm Install Neuvector on community Kubernetes

Preface

本篇文章會介紹以下內容

  • 如何透過 Helm 安裝 Neuvector 5.2.0

可以透過點擊展開以下目錄，選擇想看的內容，跳轉至特定章節

:::warning

:::spoiler 文章目錄

[TOC]

:::

測試環境

  • master node resource:
    • os: Alpine Linux 3.18.2
    • memory: 4 G
    • CPU: 2 Core
    • cri-o: 1.27
  • w1 node resource:
    • os: Alpine Linux 3.18.2
    • memory: 8 G
    • CPU: 2 Core
    • cri-o: 1.27
  • w2 node resource:
    • os: Alpine Linux 3.18.2
    • memory: 8 G
    • CPU: 2 Core
    • cri-o: 1.27

確認 K8S Node 狀態 

kubectl get nodes -o wide
NAME   STATUS   ROLES           AGE   VERSION   INTERNAL-IP      EXTERNAL-IP   OS-IMAGE             KERNEL-VERSION   CONTAINER-RUNTIME
c1m1   Ready    control-plane   45m   v1.27.4   120.96.143.212   <none>        Alpine Linux v3.18   6.1.39-0-virt    cri-o://1.27.0
c1w1   Ready    worker          45m   v1.27.4   120.96.143.219   <none>        Alpine Linux v3.18   6.1.39-0-virt    cri-o://1.27.0
c1w2   Ready    worker          45m   v1.27.4   120.96.143.220   <none>        Alpine Linux v3.18   6.1.39-0-virt    cri-o://1.27.0

Install Neuvector

準備 Neuvector 5.2.0 的 Image 壓縮檔 

$ kubectl apply -f https://raw.githubusercontent.com/braveantony/k8s-yaml/main/prepare-neuvector-image.yaml

Install Helm3 

$ curl https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | bash

check helm version 

$ helm version

螢幕輸出 :

version.BuildInfo{Version:"v3.12.2", GitCommit:"1e210a2c8cc5117d1055bfaa5d40f51bbc2e345e", GitTreeState:"clean", GoVersion:"go1.20.5"}

Adding chart repo 

$ helm repo add neuvector https://neuvector.github.io/neuvector-helm/

螢幕輸出 :

"neuvector" has been added to your repositories

透過 Helm 安裝 Neuvector 5.2.0 

$ helm install neuvector --namespace neuvector --create-namespace neuvector/core \
--set crio.enabled=true \
--set tag=5.2.0 \
--set controller.replicas=1

螢幕輸出 :

NAME: neuvector
LAST DEPLOYED: Mon Jul 24 11:18:20 2023
NAMESPACE: neuvector
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
Get the NeuVector URL by running these commands:
  NODE_PORT=$(kubectl get --namespace neuvector -o jsonpath="{.spec.ports[0].nodePort}" services neuvector-service-webui)
  NODE_IP=$(kubectl get nodes --namespace neuvector -o jsonpath="{.items[0].status.addresses[0].address}")
  echo https://$NODE_IP:$NODE_PORT

可以透過 Helm 給的資訊，取得 NeuVector URL

檢查 Neuvector Pod 運作狀態 

$ kubectl -n neuvector get pod

螢幕輸出 :

NAME                                       READY   STATUS    RESTARTS   AGE
neuvector-controller-pod-85bd66d98-g2jwx   1/1     Running   0          10m
neuvector-enforcer-pod-bfnht               1/1     Running   0          10m
neuvector-enforcer-pod-f6xvb               1/1     Running   0          10m
neuvector-enforcer-pod-zpb5p               1/1     Running   0          10m
neuvector-manager-pod-5894fd44b9-hdq6n     1/1     Running   0          10m
neuvector-scanner-pod-6c68cc78d6-6rg55     1/1     Running   0          3m10s
neuvector-scanner-pod-6c68cc78d6-k96hk     1/1     Running   0          3m9s

將 neuvector-scanner-pod 這個 Deployment 的 ImagePullPolicy 改為 IfNotPresent 

$ kubectl patch deployment neuvector-scanner-pod -n neuvector -p '{"spec": {"template": {"spec":
{"containers": [{"name": "neuvector-scanner-pod", "imagePullPolicy": "IfNotPresent"}]}}}}'

讓 scanner deplotment 的 Pod 不要被指派到 master Node 上 

$ kubectl patch deployment neuvector-scanner-pod -n neuvector --type='json' -p='[{"op": "add", "path": "/spec/template/spec/affinity", "value": {"nodeAffinity": {"requiredDuringSchedulingIgnoredDuringExecution": {"nodeSelectorTerms": [{"matchExpressions": [{"key": "node-role.kubernetes.io/worker", "operator": "In", "values": [""]}]}]}}}}]'

將 scanner pod 數量縮減為 2 

$ kubectl -n neuvector scale deploy neuvector-scanner-pod --replicas=2

檢查修改後 Neuvector Pod 運作狀態 

$ kubectl -n neuvector get pod -o wide

螢幕輸出 :

NAME                                       READY   STATUS    RESTARTS   AGE   IP               NODE   NOMINATED NODE   READINESS GATES
neuvector-controller-pod-85bd66d98-qwbb4   1/1     Running   0          54s   10.244.161.134   c1w1   <none>           <none>
neuvector-enforcer-pod-6jp5p               1/1     Running   0          54s   10.244.54.135    c1w2   <none>           <none>
neuvector-enforcer-pod-9pp2f               1/1     Running   0          54s   10.244.161.133   c1w1   <none>           <none>
neuvector-enforcer-pod-fk6k9               1/1     Running   0          54s   10.244.74.9      c1m1   <none>           <none>
neuvector-manager-pod-5894fd44b9-kwtgv     1/1     Running   0          54s   10.244.54.134    c1w2   <none>           <none>
neuvector-scanner-pod-7cd7d597df-755bv     1/1     Running   0          13s   10.244.161.137   c1w1   <none>           <none>
neuvector-scanner-pod-7cd7d597df-9w55b     1/1     Running   0          11s   10.244.54.137    c1w2   <none>           <none>

檢查 Neuvector Service 

$ kubectl -n neuvector get svc

螢幕輸出 :

NAME                              TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)                         AGE
neuvector-service-webui           NodePort    10.98.0.202   <none>        8443:30039/TCP                  8m33s
neuvector-svc-admission-webhook   ClusterIP   10.98.0.62    <none>        443/TCP                         8m33s
neuvector-svc-controller          ClusterIP   None          <none>        18300/TCP,18301/TCP,18301/UDP   8m33s
neuvector-svc-crd-webhook         ClusterIP   10.98.0.88    <none>        443/TCP                         8m33s

預設會有一個 Service 開 NodePort 

$ NODE_PORT=$(kubectl get --namespace neuvector -o jsonpath="{.spec.ports[0].nodePort}" services neuvector-service-webui)

$ NODE_IP=$(kubectl get nodes --namespace neuvector -o jsonpath="{.items[0].status.addresses[0].address}")

$ echo https://$NODE_IP:$NODE_PORT

螢幕輸出 :

https://120.96.143.212:30039

打開瀏覽器輸入 NeuVector 的 URL 

https://120.96.143.212:30039

帳號密碼預設都是 : admin 勾選同意 License 後，按 login 登入

Neuvector Dashboard 畫面

解除安裝 Neuvector 

$ helm uninstall neuvector --namespace neuvector

螢幕輸出 :

release "neuvector" uninstalled

參考資料 

helm install neuvector --namespace neuvector --create-namespace neuvector/core \
--set containerd.enabled=true \
--set runtimePath=/run/containerd/containerd.sock \
--set containerd.path=/run/containerd/containerd.sock \
--set tag=5.3.3 \
--set controller.replicas=1 \
--set manager.ingress.enabled=true \
--set manager.ingress.host=neuvector.example.com \
--set manager.ingress.ingressClassName=nginx \
--set manager.ingress.path=/
Persistent Data for NeuVector Policy and ConfigurationNeuvector Project Plan