[MRG] Merge pull request #327 from BrianMer/develop

Fixing bug in source/app/post_init.py + improved the K8S deployment.
dfir-iris · Jan 15, 2024 · 0616eb6 · 0616eb6
2 parents 1c1bc20 + a109ef1
commit 0616eb6
Show file tree

Hide file tree

Showing 9 changed files with 169 additions and 104 deletions.
diff --git a/certificates/ldap/.gitkeep b/certificates/ldap/.gitkeep
diff --git a/deploy/kubernetes/charts/certificates b/deploy/kubernetes/charts/certificates
@@ -0,0 +1 @@
+../../../certificates/
diff --git a/deploy/kubernetes/charts/templates/iris_app.yaml b/deploy/kubernetes/charts/templates/iris_app.yaml
@@ -1,3 +1,42 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: iris-root-ca-cert-secret-app
+  labels:
+    app: {{ .Values.irisworker.app }}
+type: Opaque
+data:
+{{ (.Files.Glob "certificates/rootCA/irisRootCACert.pem").AsSecrets | indent 2 }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: iris-ldap-certs-secret-app
+  labels:
+    app: {{ .Values.irisworker.app }}
+type: Opaque
+data:
+{{ (.Files.Glob "certificates/ldap/*").AsSecrets | indent 2 }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: iris-certs-dir-rootca-secrets-app
+  labels:
+    app: {{ .Values.irisworker.app }}
+type: Opaque
+data:
+{{ (.Files.Glob "certificates/rootCA/*").AsSecrets | indent 2 }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: iris-certs-dir-webcerts-secrets-app
+  labels:
+    app: {{ .Values.irisworker.app }}
+type: Opaque
+data:
+{{ (.Files.Glob "certificates/web_certificates/*").AsSecrets | indent 2 }}
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -47,7 +86,21 @@ spec:
 
           - name:  IRIS_SECURITY_PASSWORD_SALT 
             value: {{ .Values.irisapp.IRIS_SECURITY_PASSWORD_SALT | quote }}         
-
+
+          - name:  DB_RETRY_COUNT
+            value: {{ .Values.irisapp.DB_RETRY_COUNT | quote }}
+
+          - name:  DB_RETRY_DELAY
+            value: {{ .Values.irisapp.DB_RETRY_DELAY | quote }}
+
+          - name:  INTERFACE_HTTPS_PORT
+            value: {{ .Values.irisapp.INTERFACE_HTTPS_PORT | quote }}
+
+          - name:  IRIS_ADM_USERNAME
+            value: {{ .Values.irisapp.IRIS_ADM_USERNAME | quote }}
+
+          - name:  IRIS_ADM_PASSWORD
+            value: {{ .Values.irisapp.IRIS_ADM_PASSWORD | quote }}
 
           ports:
             - containerPort: 8000
@@ -59,16 +112,39 @@ spec:
               name: user-templates
             - mountPath: /home/iris/server_data
               name: server-data
+            - mountPath: /etc/irisRootCACert.pem
+              name: iris-root-ca-cert
+              subPath: irisRootCACert.pem
+              readOnly: true
+            - mountPath: /home/iris/certificates/rootCA
+              name: iris-certs-dir-rootca
+              readOnly: true
+            - mountPath: /home/iris/certificates/web_certificates
+              name: iris-certs-dir-webcerts
+              readOnly: true
+            - mountPath: /iriswebapp/certificates/ldap/
+              name: iris-ldap-certs
+              readOnly: true
       volumes:
         - name: iris-downloads
           emptyDir: {}  
         - name: user-templates
           emptyDir: {}
         - name: server-data 
           emptyDir: {}
-
+        - name: iris-root-ca-cert
+          secret:
+            secretName: iris-root-ca-cert-secret-app
+        - name: iris-ldap-certs
+          secret:
+            secretName: iris-ldap-certs-secret-app
+        - name: iris-certs-dir-rootca
+          secret:
+            secretName: iris-certs-dir-rootca-secrets-app
+        - name: iris-certs-dir-webcerts
+          secret:
+            secretName: iris-certs-dir-webcerts-secrets-app
 ---
-
 apiVersion: v1
 kind: Service
 metadata:
@@ -82,4 +158,4 @@ spec:
      targetPort: {{ .Values.irisapp.service.targetPort }}
   selector:
    app: {{ .Values.irisapp.app }}
----  
+---
diff --git a/deploy/kubernetes/charts/templates/iris_worker.yaml b/deploy/kubernetes/charts/templates/iris_worker.yaml
@@ -1,3 +1,42 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: iris-root-ca-cert-secret-worker
+  labels:
+    app: {{ .Values.irisworker.app }}
+type: Opaque
+data:
+{{ (.Files.Glob "certificates/rootCA/irisRootCACert.pem").AsSecrets | indent 2 }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: iris-ldap-certs-secret-worker
+  labels:
+    app: {{ .Values.irisworker.app }}
+type: Opaque
+data:
+{{ (.Files.Glob "certificates/ldap/*").AsSecrets | indent 2 }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: iris-certs-dir-rootca-secrets-worker
+  labels:
+    app: {{ .Values.irisworker.app }}
+type: Opaque
+data:
+{{ (.Files.Glob "certificates/rootCA/*").AsSecrets | indent 2 }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: iris-certs-dir-webcerts-secrets-worker
+  labels:
+    app: {{ .Values.irisworker.app }}
+type: Opaque
+data:
+{{ (.Files.Glob "certificates/web_certificates/*").AsSecrets | indent 2 }}
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -17,7 +56,7 @@ spec:
         - name: {{ .Values.irisworker.name }}
           image: "{{ .Values.irisworker.image}}:{{ .Values.irisworker.tag }}"
           imagePullPolicy: "{{ .Values.irisworker.imagePullPolicy }}"
-          command: ['./wait-for-iriswebapp.sh', 'iriswebapp-app.test.svc.cluster.local:8000', './iris-entrypoint.sh', 'iris-worker']
+          command: ['./wait-for-iriswebapp.sh', "{{ .Values.irisapp.name }}:{{ .Values.irisapp.service.port }}", './iris-entrypoint.sh', 'iris-worker']
 
           env:
 
@@ -49,21 +88,43 @@ spec:
             value: {{ .Values.irisworker.IRIS_SECURITY_PASSWORD_SALT | quote }}          
 
 
-          ports:
-            - containerPort: 80
-
           volumeMounts:
             - mountPath: /home/iris/downloads
-              name: iris-downloads  
+              name: iris-downloads
             - mountPath: /home/iris/user_templates
               name: user-templates
             - mountPath: /home/iris/server_data
               name: server-data
+            - mountPath: /etc/irisRootCACert.pem
+              name: iris-root-ca-cert
+              subPath: irisRootCACert.pem
+              readOnly: true
+            - mountPath: /home/iris/certificates/rootCA
+              name: iris-certs-dir-rootca
+              readOnly: true
+            - mountPath: /home/iris/certificates/web_certificates
+              name: iris-certs-dir-webcerts
+              readOnly: true
+            - mountPath: /iriswebapp/certificates/ldap/
+              name: iris-ldap-certs
+              readOnly: true
       volumes:
         - name: iris-downloads
           emptyDir: {}  
         - name: user-templates
           emptyDir: {}
         - name: server-data 
           emptyDir: {}
----
+        - name: iris-root-ca-cert
+          secret:
+            secretName: iris-root-ca-cert-secret-worker
+        - name: iris-certs-dir-rootca
+          secret:
+            secretName: iris-certs-dir-rootca-secrets-worker
+        - name: iris-ldap-certs
+          secret:
+            secretName: iris-ldap-certs-secret-worker
+        - name: iris-certs-dir-webcerts
+          secret:
+            secretName: iris-certs-dir-webcerts-secrets-worker
+---
diff --git a/deploy/kubernetes/charts/templates/nginx_ingress.yaml b/deploy/kubernetes/charts/templates/nginx_ingress.yaml
@@ -5,6 +5,7 @@ metadata:
   annotations:
     {{- toYaml .Values.ingress.annotations | nindent 4 }}
 spec:
+  ingressClassName: {{ .Values.ingress.className }}
   rules:
     {{- range $host := .Values.ingress.hosts }}
     - host: {{ $host.host }}

diff --git a/deploy/kubernetes/charts/values.yaml b/deploy/kubernetes/charts/values.yaml
@@ -82,12 +82,11 @@ irisapp:
    ## @param irisapp.service Iris Frontend Service
    ##
    service:
-     port: 80 
-     targetPort: 8000
+     port: 8000
 
    ## @param irisapp.type Iris Frontend Service type
    ##
-   type: ClusterIP  
+   type: NodePort
 
    ## @param  Iris Frontend Environments
    ##
@@ -100,6 +99,12 @@ irisapp:
    DOCKERIZED: 1
    IRIS_SECRET_KEY: AVerySuperSecretKey-SoNotThisOne
    IRIS_SECURITY_PASSWORD_SALT: ARandomSalt-NotThisOneEither
+   IRIS_ADM_USERNAME: administrator
+   # Must be 12 characters minimum and contains a capital letter and a number. 
+   IRIS_ADM_PASSWORD: Hello12345!
+   DB_RETRY_COUNT: 5
+   DB_RETRY_DELAY: 5
+   INTERFACE_HTTPS_PORT: 443
 
 ## @section Iris Backend Configuration
 ##
@@ -144,16 +149,16 @@ ingress:
   annotations:
     # Add any annotations specific to your Ingress controller
     kubernetes.io/ingress.class: nginx
-    nginx.ingress.kubernetes.io/rewrite-target: /
-    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/rewrite-target: /$1
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
   hosts:
     - host: <host_name>
       paths:
-        - path: /
-          pathType: Prefix
+        - path: /(.*)
+          pathType: ImplementationSpecific
           serviceName: iriswebapp-app
-          servicePort: 80
+          servicePort: 8000
   tls:
     - secretName: iris-ingress-tls-secret
       hosts:
-        - <host_name>        
+        - <host_name>        
diff --git a/docker/webApp/Dockerfile b/docker/webApp/Dockerfile
@@ -51,7 +51,7 @@ RUN apt update
 RUN apt install -y p7zip-full pgp rsync postgresql-client
 
 RUN mkdir /iriswebapp/
-RUN mkdir -p /home/iris/certificates
+RUN mkdir -p /home/iris/certificates/{rootCA,web_certificates}
 RUN mkdir -p /home/iris/user_templates
 RUN mkdir -p /home/iris/server_data
 RUN mkdir -p /home/iris/server_data/backup
@@ -71,4 +71,4 @@ RUN chmod +x /iriswebapp/dependencies/evtxdump_binaries/linux/x64/evtx_dump
 
 RUN chmod +x iris-entrypoint.sh
 RUN chmod +x wait-for-iriswebapp.sh
-#ENTRYPOINT [ "./iris-entrypoint.sh" ]
+#ENTRYPOINT [ "./iris-entrypoint.sh" ]
diff --git a/docker/webApp/Dockerfile.k8s b/docker/webApp/Dockerfile.k8s
diff --git a/source/app/post_init.py b/source/app/post_init.py
@@ -121,20 +121,18 @@ def run_post_init(development=False):
     log.info(f'IRIS {app.config.get("IRIS_VERSION")}')
     log.info("Running post initiation steps")
 
-    conn = None
-
     if os.getenv("IRIS_WORKER") is None:
         # Attempt to connect to the database with retries
         log.info("Attempting to connect to the database...")
         for i in range(retry_count):
-            log.info("Connecting to database, attempt " + str(i + 1) + "/" + str(retry_count))
-            conn = connect_to_database(db_host, db_port)
-            if conn is not None:
+            log.info("Connecting to database, attempt " + str(i+1) + "/" + str(retry_count))
+            conn = connect_to_database(db_host,db_port)
+            if conn:
                 break
             log.info("Retrying in " + str(retry_delay) + "seconds...")
             time.sleep(retry_delay)
         # If the connection is still not established, exit the script
-        if conn is None:
+        if not conn:
             log.info("Failed to connect to database after " + str(retry_count) + " attempts.")
             exit(1)