kubearmor/kubearmor-relay-server

KubeArmor Relay Server

KubeArmor Relay Server

KubeArmor's relay server collects all messages, alerts, and system logs generated by KubeArmor in each node, and then it allows other logging systems to simply collect those through the service ('kubearmor.kube-system.svc') of the relay server.

By default, the relay server is deployed with KubeArmor.

Streaming Kubearmor Telemetry to external SIEM tools

KubeArmor emits following types of Telemetry events:

1. Alert: When policy is violated
2. Log: When a pod executes a syscall or any other action (such as file access, process creation, network socket create/connect/accept etc)
3. Message: Internal Kubearmor daemon messages

There are two approaches that one can take to stream the kubearmor events.

1. Using kubearmor-relay stdout: This is the easiest way i.e. if the SIEM tool connects to the k8s pod logging interface then all the kubearmor events (across all nodes) are available at the kubearmor-relay stdout. Fluentd/Microsoft Sentinel does support this mode wherein the stdout of the pod can be streamed to the SIEM tool. By default the stdout is turned off to not impact performance. To enable it update the environment variable in the deployment yaml ENABLE_STDOUT_LOGS, ENABLE_STDOUT_ALERTS , ENABLE_STDOUT_MSGS as true

example

        env:
          - name: ENABLE_STDOUT_LOGS
            value: "true"
          - name: ENABLE_STDOUT_ALERTS
            value: "true"
          - name: ENABLE_STDOUT_MSGS
            value: "true"

2. Creating an adapter for the SIEM tool. Kubearmor-relay events could be accessed using its GRPC server (ref code) and then the events could be streamed to the SIEM tool (splunk/elk/MS-sentinel ...). An example adaptor is OpenTemetery-Adapater for KubeArmor, The OpenTelemetry KubeArmor receiver connects to KubeArmor-Relay and converts KubeArmor telemetry data to the OpenTelemetry format which in turn can be configured to connect to SIEM Tools like Splunk,Grafana etc. Here's the tutorial for the same.

Microsoft Sentinel is used as an example in this figure

kubearmor-relay-server's Issues

versioned release for kubearmor-relay

At this point we are making release for kubearmor-relay with latest tag. we should have versioned release as well as stable release workflow in the CI.

Add GitHub action

Add GitHub action to test the code and push a new image to DockerHub.

optionally print alerts/messages/telemetry to stdout

Currently, the alerts, logs are mandatorily printed to the stdout. This can induce an overhead in some deployments since the telemetry events could be substantially high. It would be better to enable the print to stdout only on the basis of an env var (PRINT_TO_STDOUT=1).

grpc health check endpoint

Feature Request
Short Description

Rely server should implement a health check grpc function and provide the grpc healmth probe utility in the container

https://kubernetes.io/blog/2018/10/01/health-checking-grpc-servers-on-kubernetes/
https://github.com/grpc-ecosystem/grpc-health-probe/

Is your feature request related to a problem? Please describe the use case.

fixes point 13 in kubearmor/KubeArmor#733

problem with channel handling

PR #14 introduced a fix for race-condition handling. However, the handling might not be fool-proof i.e.,we are spawning a go routine for every client in the Watch*() APIs.

Need to understand the best way of handling the channels.