From a44823c3edccb3d1782773830e969a9c88bc31bd Mon Sep 17 00:00:00 2001 From: Ben Hirschberg Date: Mon, 17 Jan 2022 13:55:43 +0200 Subject: [PATCH 1/2] example cloud integration scripts --- examples/cloud-vendor-integration/aws.sh | 68 ++++++++++++++++++++++++ examples/cloud-vendor-integration/gcp.sh | 48 +++++++++++++++++ 2 files changed, 116 insertions(+) create mode 100755 examples/cloud-vendor-integration/aws.sh create mode 100755 examples/cloud-vendor-integration/gcp.sh diff --git a/examples/cloud-vendor-integration/aws.sh b/examples/cloud-vendor-integration/aws.sh new file mode 100755 index 00000000..67f36bfe --- /dev/null +++ b/examples/cloud-vendor-integration/aws.sh @@ -0,0 +1,68 @@ +#!/bin/bash + +# AWS +# Attach the Kubescape service account to an AWS IAM role with the described cluster permission + +# Prerequisites: +# eksctl, awscli v2 + +# Set environment variables +echo 'Set environment variables' +export kubescape_namespace=armo-system +export kubescape_serviceaccount=armo-kubescape-service-account + +# Get current context +echo 'Get current context' +export context=$(kubectl config current-context) + +# Get cluster arn +echo 'Get cluster arn' +export cluster_arn=$(kubectl config view -o jsonpath="{.contexts[?(@.name == \"$context\")].context.cluster}") + +# Get cluster name +echo 'Get cluster name' +export cluster_name=$(echo "$cluster_arn" | awk -F'/' '{print $NF}') + +# Get cluster region +echo 'Get cluster region' +export cluster_region=$(echo "$cluster_arn" | awk -F':' '{print $4}') + +# First step, Create IAM OIDC provider for the cluster (Not required if the third step runs as is): +echo 'Create IAM OIDC provider for the cluster' +eksctl utils associate-iam-oidc-provider --cluster $cluster_name --approve + +# Second step, Create a policy and service account role: +# Create a kubescape policy +echo 'Create a kubescape policy' +export kubescape_policy_arn=$(aws iam create-policy \ + --output yaml \ + --query 'Policy.Arn' \ + --policy-name kubescape \ + --policy-document \ +"$(cat <&2 echo "Please set the CLUSTER_NAME environment variable" && exit 1 +[ -z $CLUSTER_REGION ] && >&2 echo "Please set the CLUSTER_REGION environment variable" && exit 1 + +# Create GCP service account +gcloud iam service-accounts create kubescape --display-name=kubescape + +# Set environment variables +echo 'Set environment variables' +export kubescape_namespace=armo-system +export kubescape_serviceaccount=armo-kubescape-service-account + +# Get current GCP project +echo 'Get current GCP project' +export gcp_project=$(gcloud config get-value project) + +sleep 5 +# Get service account email +echo 'Get service account email' +export gcp_service_account=$(gcloud iam service-accounts list --filter="email ~ kubescape@" --format="value(email)") + +# Create custome cluster.get role +echo 'Create custome cluster.get role' +export custom_role_name=$(gcloud iam roles create kubescape --project=$gcp_project --title='Armo kubernetes' --description='Allow clusters.get to Kubernetes armo service account' --permissions=container.clusters.get --stage=GA --format='value(name)') + +# Attach policies to the service account +echo 'Attach policies to the service account' +gcloud --quiet projects add-iam-policy-binding $gcp_project --member serviceAccount:$gcp_service_account --role $custom_role_name >/dev/null + +# If there are missing permissions, use this role instead +# gcloud --quiet projects add-iam-policy-binding $gcp_project --member serviceAccount:$gcp_service_account --role roles/container.clusterViewer + +# Bind the GCP kubescape service account to kubescape kubernetes service account +gcloud iam service-accounts add-iam-policy-binding $gcp_service_account --role roles/iam.workloadIdentityUser --member "serviceAccount:${gcp_project}.svc.id.goog[${kubescape_namespace}/${kubescape_serviceaccount}]" + +# Install/Upgrade Kubescape chart +echo 'Install/Upgrade Kubescape chart' +helm upgrade --install armo armo-components/ -n armo-system --create-namespace --set cloud_provider_engine=gke --set gke_service_account=$gcp_service_account --set cloudRegion=$CLUSTER_REGION --set clusterName=$CLUSTER_NAME --set gkeProject=$gcp_project From cfc69f5a0fb153d1a50e807b96653afc2eb3e33e Mon Sep 17 00:00:00 2001 From: Ben Hirschberg Date: Tue, 18 Jan 2022 14:41:07 +0200 Subject: [PATCH 2/2] adding access to container registry --- examples/cloud-vendor-integration/gcp.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/examples/cloud-vendor-integration/gcp.sh b/examples/cloud-vendor-integration/gcp.sh index 2edd7414..0f33cb15 100755 --- a/examples/cloud-vendor-integration/gcp.sh +++ b/examples/cloud-vendor-integration/gcp.sh @@ -36,6 +36,7 @@ export custom_role_name=$(gcloud iam roles create kubescape --project=$gcp_proje # Attach policies to the service account echo 'Attach policies to the service account' gcloud --quiet projects add-iam-policy-binding $gcp_project --member serviceAccount:$gcp_service_account --role $custom_role_name >/dev/null +gcloud --quiet projects add-iam-policy-binding $gcp_project --member serviceAccount:$gcp_service_account --role roles/storage.objectViewer >/dev/null # If there are missing permissions, use this role instead # gcloud --quiet projects add-iam-policy-binding $gcp_project --member serviceAccount:$gcp_service_account --role roles/container.clusterViewer