Skip to content

Commit 1c17978

Browse files
data-henrikdata-henrik
authored
Context-based restrictions to enhance security (#35)
* first CBR drop * restructure * restructure * restructure * move to module * move to module * smoothing * smoothing * smoothing * rule syntax * updated README * rename variable and add description
1 parent 96aa5ed commit 1c17978

File tree

15 files changed

+343
-5
lines changed

15 files changed

+343
-5
lines changed

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ local_yaml
1717
*.tfvars
1818
.terraform
1919
*.tfstate*
20+
.terraform.lock.hcl
2021

2122
#vim swap files
2223
[._]*.sw[a-p]

‎Architecture.png‎

-69.8 KB
Binary file not shown.

‎Architecture.svg‎

Lines changed: 3 additions & 0 deletions
Loading

‎Architecture_cbr.png‎

68.7 KB
Loading

‎README.md‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ The repository features a sample application that enables groups of users to upl
66

77
Refer to [this tutorial](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-cloud-e2e-security) for instructions.
88

9-
![Architecture](Architecture.png)
9+
![Architecture](Architecture.svg)
1010

1111
1. The user connects to the application.
1212
2. [App ID](https://cloud.ibm.com/catalog/services/AppID) secures the application and redirects the user to the authentication page. Users can sign up from there too.
@@ -36,12 +36,15 @@ Either create the Schematics workspace automatically by clicking this ["deploy l
3636
Configure all required variables:
3737
- **basename**: project basename which is used as prefix for names, e.g., secure-file-storage
3838
- **region** is where the resources will be deployed and the location of the existing Kubernetes cluster: us-south, eu-de, ...
39-
- **iks_cluster_name**: name of your existing (VPC-based) Kubernetes cluster
39+
- **iks_cluster_name**: name of your existing VPC-based Kubernetes cluster
4040
- **iks_namespace**: Kubernetes namespace into which to deploy the app. It will be created if it does not exist.
4141
- **resource_group** is the name of the IBM Cloud resource group where to deploy the services into.
4242
- **toolchain_registry_namespace**: The existing namespace in the Container Registry to use.
4343
- **toolchain_registry_region**: The Container Registry region
4444
- **toolchain_apikey**: An IBM Cloud API key to use for building the container image with the app, pushing it to the Container Registry, and deploying it to the Kubernetes cluster.
45+
- **deploy_cbr**: Indicates whether the CBR zones and rules should be deployed. `false` by default and can be set to `true`.
46+
- **cbr_enforcement_mode**: By default, the CBR rules are in `report` mode only. Change and set to `enforced` or `disabled`.
47+
- **cbr_homezone_iprange**: Can be set to the IP range of your home or bastion network.
4548

4649
Be sure to click "**Save**".
4750

@@ -57,7 +60,7 @@ Next, optionally click "**Generate plan**" to verify everything would be working
5760
Go to the [toolchains](https://cloud.ibm.com/devops/toolchains) page. Make sure to be in the correct region. Click on the toolchain **secure-file-storage-toolchain**, then on the delivery pipeline **secure-file-storage-pipeline**. Finally, **Run Pipeline** and choose the manual trigger **manual-trigger-builddeploy** to build and deploy the app. You can click on the details of the pipeline run to see and examine the diagnostic logs.
5861

5962
### Uninstall
60-
The toolchain includes a trigger to uninstall the app. Click **Run Pipeline**, select the trigger **manual-trigger-uninstall** and run the pipeline. When it has finished, switch to the [Schematics workspace](https://cloud.ibm.com/schematics/workspaces) and select the action to **Destroy resources**. As an alternative, you could also select **Delete workspace** which removes the resources and the workspace.
63+
The toolchain includes a trigger to uninstall the app. Click **Run Pipeline**, select the trigger **manual-trigger-uninstall** and run the pipeline. When it has finished, switch to the [Schematics workspace](https://cloud.ibm.com/schematics/workspaces) and select the action to **Destroy resources**. Thereafter, select **Delete workspace** which removes the workspace itself. Only deleting the workspace keeps the resources.
6164

6265
## Code Structure
6366
The file for the Infrastructure as Code, the Continuous Delivery pipeline, and the app itself are organized in several directories.

‎terraform/cbr.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# CBR objects are integrated as optional module
2+
module "cbr_objects" {
3+
count = var.deploy_cbr ? 1 : 0
4+
source = "./cbr"
5+
iks_cluster_name = var.iks_cluster_name
6+
cbr_enforcement_mode = var.cbr_enforcement_mode
7+
cos = ibm_resource_instance.cos
8+
keyprotect = ibm_resource_instance.keyprotect
9+
cbr_homezone_iprange = var.cbr_homezone_iprange
10+
}

‎terraform/cbr/cbr-rules.tf‎

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
# CBR rules
2+
# See https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/cbr_rule
3+
# for the syntax and the following link for supported services:
4+
# https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatis#cbr-adopters
5+
# The rules cover resources from the mentioned tutorial.
6+
7+
# COS access
8+
resource "ibm_cbr_rule" "cbr_rule_cos_k8s" {
9+
contexts {
10+
attributes {
11+
name = "networkZoneId"
12+
value = ibm_cbr_zone.cbr_zone_k8s.id
13+
}
14+
}
15+
contexts {
16+
attributes {
17+
name = "networkZoneId"
18+
value = ibm_cbr_zone.cbr_zone_homezone.id
19+
}
20+
}
21+
22+
description = "restrict COS access, limit to cluster"
23+
enforcement_mode = var.cbr_enforcement_mode
24+
resources {
25+
attributes {
26+
name = "accountId"
27+
value = data.ibm_iam_account_settings.team_iam_account_settings.account_id
28+
}
29+
attributes {
30+
name = "serviceInstance"
31+
operator = "stringEquals"
32+
value = var.cos.guid
33+
}
34+
attributes {
35+
name = "serviceName"
36+
operator = "stringEquals"
37+
value = "cloud-object-storage"
38+
}
39+
40+
}
41+
}
42+
43+
# Access to the Container Registry and a specific namespace
44+
resource "ibm_cbr_rule" "cbr_rule_registry" {
45+
contexts {
46+
attributes {
47+
name = "networkZoneId"
48+
value = ibm_cbr_zone.cbr_zone_k8s.id
49+
}
50+
}
51+
52+
description = "restrict access to registry, limit to cluster"
53+
enforcement_mode = var.cbr_enforcement_mode
54+
resources {
55+
attributes {
56+
name = "accountId"
57+
value = data.ibm_iam_account_settings.team_iam_account_settings.account_id
58+
}
59+
attributes {
60+
name = "resourceType"
61+
operator = "stringEquals"
62+
value = "namespace"
63+
}
64+
attributes {
65+
name = "resource"
66+
operator = "stringEquals"
67+
value = "e2esec"
68+
}
69+
attributes {
70+
name = "serviceName"
71+
operator = "stringEquals"
72+
value = "container-registry"
73+
}
74+
75+
}
76+
}
77+
78+
# access to Key Protect from
79+
# - IAM
80+
# - Kubernetes
81+
# - COS
82+
# - (App ID, not yet supported)
83+
resource "ibm_cbr_rule" "cbr_rule_kms" {
84+
contexts {
85+
attributes {
86+
name = "networkZoneId"
87+
value = ibm_cbr_zone.cbr_zone_k8s.id
88+
}
89+
}
90+
contexts {
91+
attributes {
92+
name = "networkZoneId"
93+
value = ibm_cbr_zone.cbr_zone_cos.id
94+
}
95+
}
96+
97+
description = "restrict access to Key Protect"
98+
enforcement_mode = var.cbr_enforcement_mode
99+
resources {
100+
attributes {
101+
name = "accountId"
102+
value = data.ibm_iam_account_settings.team_iam_account_settings.account_id
103+
}
104+
attributes {
105+
name = "serviceInstance"
106+
operator = "stringEquals"
107+
value = var.keyprotect.guid
108+
}
109+
attributes {
110+
name = "serviceName"
111+
operator = "stringEquals"
112+
value = "kms"
113+
}
114+
}
115+
}
116+
117+
118+
119+
# access to Kubernetes Cluster management API from
120+
# - IAM
121+
# - home / bastion zone
122+
resource "ibm_cbr_rule" "cbr_rule_k8s_mgmt" {
123+
contexts {
124+
attributes {
125+
name = "networkZoneId"
126+
value = ibm_cbr_zone.cbr_zone_homezone.id
127+
}
128+
}
129+
130+
description = "restrict access to Kubernetes management API"
131+
enforcement_mode = var.cbr_enforcement_mode
132+
operations {
133+
api_types {
134+
api_type_id = "crn:v1:bluemix:public:containers-kubernetes::::api-type:management"
135+
}
136+
}
137+
resources {
138+
attributes {
139+
name = "accountId"
140+
value = data.ibm_iam_account_settings.team_iam_account_settings.account_id
141+
}
142+
attributes {
143+
name = "serviceInstance"
144+
operator = "stringEquals"
145+
value = data.ibm_container_vpc_cluster.cluster.id
146+
}
147+
attributes {
148+
name = "serviceName"
149+
operator = "stringEquals"
150+
value = "containers-kubernetes"
151+
}
152+
153+
154+
}
155+
}

‎terraform/cbr/cbr-zones.tf‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
# CBR zones
2+
#
3+
# See https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/cbr_zone
4+
# The zones relate to general areas and services defined as part of the
5+
# IBM Cloud solution tutorial "Apply end to end security to a cloud application".
6+
# https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-cloud-e2e-security
7+
8+
9+
# Zone with the home network or for a bastion host
10+
resource "ibm_cbr_zone" "cbr_zone_homezone" {
11+
account_id = data.ibm_iam_account_settings.team_iam_account_settings.account_id
12+
addresses {
13+
type = "ipRange"
14+
value = var.cbr_homezone_iprange
15+
}
16+
description = "Zone for typical home network"
17+
name = "cbr_zone_homenetwork"
18+
}
19+
20+
# NOT NEEDED
21+
# Zone for the VPC that hosts the Kubernetes cluster
22+
#resource "ibm_cbr_zone" "cbr_zone_vpc" {
23+
# account_id = data.ibm_iam_account_settings.team_iam_account_settings.account_id
24+
# addresses {
25+
# type = "vpc"
26+
# value = data.ibm_is_vpc.vpc.crn
27+
# }
28+
# description = "Zone with VPC of Kubernetes cluster"
29+
# name = "cbr_zone_vpc"
30+
#}
31+
32+
# Zone with the Kubernetes cluster
33+
resource "ibm_cbr_zone" "cbr_zone_k8s" {
34+
account_id = data.ibm_iam_account_settings.team_iam_account_settings.account_id
35+
addresses {
36+
type = "serviceRef"
37+
ref {
38+
account_id = data.ibm_iam_account_settings.team_iam_account_settings.account_id
39+
service_instance = data.ibm_container_vpc_cluster.cluster.id
40+
service_name = "containers-kubernetes"
41+
}
42+
}
43+
description = "Zone with the Kubernetes cluster"
44+
name = "cbr_zone_k8s"
45+
}
46+
47+
# Zone with the COS service
48+
resource "ibm_cbr_zone" "cbr_zone_cos" {
49+
account_id = data.ibm_iam_account_settings.team_iam_account_settings.account_id
50+
addresses {
51+
type = "serviceRef"
52+
ref {
53+
account_id = data.ibm_iam_account_settings.team_iam_account_settings.account_id
54+
service_instance = var.cos.guid
55+
service_name = "cloud-object-storage"
56+
}
57+
}
58+
description = "Zone with COS"
59+
name = "cbr_zone_cos"
60+
}
61+
62+
# Key Protect service zone
63+
# not yet supported as zone
64+
/* resource "ibm_cbr_zone" "cbr_zone_kms" {
65+
account_id = data.ibm_iam_account_settings.team_iam_account_settings.account_id
66+
addresses {
67+
type = "serviceRef"
68+
ref {
69+
account_id = data.ibm_iam_account_settings.team_iam_account_settings.account_id
70+
service_instance = data.terraform_remote_state.e2e-resources.outputs.keyprotect.guid
71+
service_name = "kms"
72+
location = data.terraform_remote_state.e2e-resources.outputs.keyprotect.location
73+
}
74+
}
75+
description = "Zone with Key Protect"
76+
name = "cbr_zone_kms"
77+
} */
78+
79+
# Service zone for IAM group management
80+
resource "ibm_cbr_zone" "cbr_zone_iam_groups" {
81+
account_id = data.ibm_iam_account_settings.team_iam_account_settings.account_id
82+
addresses {
83+
type = "serviceRef"
84+
ref {
85+
account_id = data.ibm_iam_account_settings.team_iam_account_settings.account_id
86+
service_name = "iam-groups"
87+
}
88+
}
89+
description = "Zone for IAM groups"
90+
name = "cbr_zone_iam_groups"
91+
}
92+
93+
# Service zone for IAM user management
94+
resource "ibm_cbr_zone" "cbr_zone_iam_users" {
95+
account_id = data.ibm_iam_account_settings.team_iam_account_settings.account_id
96+
addresses {
97+
type = "serviceRef"
98+
ref {
99+
account_id = data.ibm_iam_account_settings.team_iam_account_settings.account_id
100+
service_name = "user-management"
101+
}
102+
}
103+
description = "Zone for IAM user management"
104+
name = "cbr_zone_users"
105+
}

‎terraform/cbr/main.tf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# Retrieve the account ID to be used in the CBR objects
2+
data "ibm_iam_account_settings" "team_iam_account_settings" {
3+
}
4+
5+
# Locate Kubernetes cluster in VPC
6+
data "ibm_container_vpc_cluster" "cluster" {
7+
name = var.iks_cluster_name
8+
}

‎terraform/cbr/variables.tf‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# configure the enforcement mode for CBR
2+
variable "cbr_enforcement_mode" {
3+
default = "report"
4+
}
5+
6+
# define a homezone or bastion zone
7+
# change the setting in tfvars
8+
variable "cbr_homezone_iprange" {
9+
default = "0.0.0.0-255.255.255.255"
10+
}
11+
12+
variable "iks_cluster_name" {
13+
description = "Name of the existing Kubernetes cluster to deploy into"
14+
default = "secure-file-storage-cluster"
15+
}
16+
17+
# Variables to hold information about resource instances
18+
variable "cos" {
19+
}
20+
21+
variable "keyprotect" {
22+
}

0 commit comments

Comments
 (0)