Merge pull request #14 from Ekene95/feat/k8s-infra-hardening

feat: add K8s infrastructure hardening module

Author: Commando-X

deploy/k8s-infra-hardening/README.md

@@ -0,0 +1,35 @@
+# Self-signed ClusterIssuer — bootstraps the internal lab CA.
+# cert-manager must be installed before applying this file.
+# Install: kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.14.0/cert-manager.yaml
+
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: selfsigned-issuer
+spec:
+  selfSigned: {}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: lab-ca
+  namespace: cert-manager
+spec:
+  isCA: true
+  commonName: lab-ca
+  secretName: lab-ca-secret
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  issuerRef:
+    name: selfsigned-issuer
+    kind: ClusterIssuer
+    group: cert-manager.io
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: lab-ca-issuer
+spec:
+  ca:
+    secretName: lab-ca-secret

deploy/k8s-infra-hardening/cert-manager/cluster-issuer.yaml

@@ -0,0 +1,51 @@
+_format_version: "3.0"
+
+services:
+  - name: vuln-bank-service
+    url: http://vuln-bank-svc.vuln-bank.svc.cluster.local:5000
+    connect_timeout: 10000
+    read_timeout: 30000
+    write_timeout: 30000
+
+    routes:
+      - name: allow-all-route
+        paths: ["/"]
+        strip_path: false
+        plugins:
+          - name: request-size-limiting
+            config:
+              allowed_payload_size: 1  
+
+      - name: api-public-route
+        paths: ["/api/v1/auth", "/api/v1/register", "/api/v3/forgot-password", "/api/v3/reset-password"]
+        strip_path: false
+        plugins:
+          - name: rate-limiting
+            config:
+              minute: 20
+              policy: local
+
+      - name: blocked-internal-route
+        paths: ["/internal", "/api/admin", "/api/docs", "/static/openapi.json"]
+        strip_path: false
+        plugins:
+          - name: request-termination
+            config:
+              status_code: 404
+              message: "Not found"
+
+plugins:
+  - name: response-transformer
+    config:
+      add:
+        headers:
+          - "X-Content-Type-Options:nosniff"
+          - "X-Frame-Options:DENY"
+          - "Referrer-Policy:no-referrer"
+          - "X-Kong-Upstream:vuln-bank"
+      remove:
+        headers:
+          - "Server"
+          - "X-Powered-By"
+          - "X-Kong-Version"
+          - "Via"

deploy/k8s-infra-hardening/kong/kong.yaml

@@ -0,0 +1,47 @@
+controller:
+  enabled: false
+
+gateway:
+  image:
+    repository: kong
+    tag: "3.6"
+
+  env:
+    database: "off"
+    declarative_config: /kong_dbless/kong.yaml
+    proxy_access_log: /dev/stdout
+    proxy_error_log: /dev/stderr
+    admin_access_log: /dev/stdout
+    admin_error_log: /dev/stderr
+    log_level: notice
+
+    headers: "off"
+    server_tokens: "off"
+
+  dblessConfig:
+    configMap: kong-config
+
+  ingressController:
+    enabled: false
+
+  proxy:
+    type: NodePort
+    externalTrafficPolicy: Local
+    http:
+      enabled: true
+      nodePort: 30080
+    tls:
+      enabled: true
+      nodePort: 30443
+
+  admin:
+    enabled: true
+    type: ClusterIP
+
+  resources:
+    limits:
+      memory: 256Mi
+      cpu: 500m
+    requests:
+      memory: 128Mi
+      cpu: 100m

deploy/k8s-infra-hardening/kong/values.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vuln-bank
+  labels:
+    name: vuln-bank
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vuln-bank-db
+  labels:
+    name: vuln-bank-db
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kong
+  labels:
+    name: kong
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager
+  labels:
+    name: cert-manager

deploy/k8s-infra-hardening/manifests/namespaces.yaml

@@ -0,0 +1,28 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: postgres-netpol
+  namespace: vuln-bank-db
+spec:
+  podSelector:
+    matchLabels:
+      app: postgres
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          name: vuln-bank
+      podSelector:
+        matchLabels:
+          app: vuln-bank
+    ports:
+    - port: 5432
+  egress:
+  - to:
+    - namespaceSelector: {}
+    ports:
+    - port: 53
+      protocol: UDP

deploy/k8s-infra-hardening/manifests/network-policies/postgres-netpol.yaml

@@ -0,0 +1,34 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: vuln-bank-netpol
+  namespace: vuln-bank
+spec:
+  podSelector:
+    matchLabels:
+      app: vuln-bank
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          name: kong
+    ports:
+    - port: 5000
+  egress:
+  - to:
+    - namespaceSelector: {}
+    ports:
+    - port: 53
+      protocol: UDP
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          name: vuln-bank-db
+      podSelector:
+        matchLabels:
+          app: postgres
+    ports:
+    - port: 5432

deploy/k8s-infra-hardening/manifests/network-policies/vuln-bank-netpol.yaml

@@ -0,0 +1,74 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: postgres-pvc
+  namespace: vuln-bank-db
+spec:
+  accessModes: [ReadWriteOnce]
+  resources:
+    requests:
+      storage: 5Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: postgres
+  namespace: vuln-bank-db
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: postgres
+  template:
+    metadata:
+      labels:
+        app: postgres
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - name: postgres
+        image: postgres:15-alpine
+        env:
+        - name: POSTGRES_DB
+          value: vulnerable_bank
+        - name: POSTGRES_USER
+          valueFrom:
+            secretKeyRef:
+              name: postgres-secret
+              key: username
+        - name: POSTGRES_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: postgres-secret
+              key: password
+        ports:
+        - containerPort: 5432
+        volumeMounts:
+        - name: postgres-storage
+          mountPath: /var/lib/postgresql/data
+        resources:
+          limits:
+            memory: 512Mi
+            cpu: 500m
+            ephemeral-storage: 1Gi
+          requests:
+            memory: 256Mi
+            cpu: 100m
+            ephemeral-storage: 256Mi
+      volumes:
+      - name: postgres-storage
+        persistentVolumeClaim:
+          claimName: postgres-pvc
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres-svc
+  namespace: vuln-bank-db
+spec:
+  selector:
+    app: postgres
+  ports:
+  - port: 5432
+    targetPort: 5432
+  clusterIP: None

deploy/k8s-infra-hardening/manifests/postgres/postgres.yaml

@@ -0,0 +1,18 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: kong-proxy-tls
+  namespace: kong
+spec:
+  secretName: kong-proxy-tls-secret
+  issuerRef:
+    name: lab-ca-issuer
+    kind: ClusterIssuer
+  dnsNames:
+  - vuln-bank.local
+  - "*.vuln-bank.local"
+  - localhost
+  ipAddresses:
+  - 127.0.0.1
+  # Uncomment and set your node IP if testing from an external machine:
+  # - 192.168.x.x

deploy/k8s-infra-hardening/manifests/tls/kong-tls-cert.yaml

@@ -0,0 +1,75 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: vuln-bank
+  namespace: vuln-bank
+  labels:
+    app: vuln-bank
+    tier: application
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: vuln-bank
+  template:
+    metadata:
+      labels:
+        app: vuln-bank
+        tier: application
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - name: vuln-bank
+        # Build the image locally and import it into your cluster:
+        #   docker build -t vuln-bank:v1.0 .
+        #   docker save vuln-bank:v1.0 | sudo ctr -n k8s.io images import -  # k3s/containerd
+        #   docker save vuln-bank:v1.0 | sudo crio import -                   # CRI-O
+        image: vuln-bank:v1.0
+        imagePullPolicy: Never 
+        ports:
+        - containerPort: 5000
+        env:
+        - name: DB_HOST
+          value: postgres-svc.vuln-bank-db.svc.cluster.local
+        - name: DB_PORT
+          value: "5432"
+        - name: DB_NAME
+          value: vulnerable_bank
+        - name: DB_USER
+          valueFrom:
+            secretKeyRef:
+              name: vuln-bank-db-secret
+              key: username
+        - name: DB_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: vuln-bank-db-secret
+              key: password
+        resources:
+          limits:
+            memory: 256Mi
+            cpu: 500m
+            ephemeral-storage: 512Mi
+          requests:
+            memory: 128Mi
+            cpu: 100m
+            ephemeral-storage: 128Mi
+        livenessProbe:
+          httpGet:
+            path: /login
+            port: 5000
+          initialDelaySeconds: 30
+          periodSeconds: 15
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: vuln-bank-svc
+  namespace: vuln-bank
+spec:
+  selector:
+    app: vuln-bank
+  ports:
+  - port: 5000
+    targetPort: 5000
+  type: ClusterIP