Skip to content

Commit c31d9e0

Browse files
pgcrooks-sysdigpgcrooks-sysdig
authored
feat(examples): Add Serverless Agent direct connection example (#583)
This is the new default.
1 parent d8546c4 commit c31d9e0

File tree

9 files changed

+284
-15
lines changed

9 files changed

+284
-15
lines changed

‎examples/serverless-agent/fargate/workload-legacy/README.md‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# Workload with Serverless Workload Agent
2+
3+
This example deploys a cluster with a workload and the Serverless Workload Agent as a sidecar to secure the workload.
4+
5+
The Workload Agent will use an Orchestrator Agent as a proxy to the Sysdig Collector.
6+
7+
## Prerequisites
8+
9+
The following prerequisites are required to deploy this cluster:
10+
- Orchestrator Agent deployed
11+
- VPC
12+
- 2 subnets
13+
14+
## Components
15+
16+
The cluster will be called `<prefix>-instrumented-workload` and will deploy the following:
17+
- 1 Service (called `<prefix-instrumented-service`)
18+
- 1 Task with 2 replicas, each running:
19+
- 1 container named `event-gen-1` running `falcosecurity/event-generator`
20+
- 1 container named `event-gen-2` also running `falcosecurity/event-generator`
21+
- 1 container named `SysdigInstrumentation` running the latest Workload Agent which will secure both workload containers
22+
23+
## Layout
24+
| **File** | **Purpose** |
25+
| --- | --- |
26+
| `instrumented_load.tf` | Workload definition. By default it instruments `falcosecurity/event-generator` |
27+
| `main.tf` | AWS provider configuration |
28+
| `output.tf` | Defines the output variables |
29+
| `variables.tf` | AWS and Agent configuration |
30+
| `versions.tf` | Defines TF provider versions |

‎examples/serverless-agent/fargate/workload-legacy/instrumented_load.tf‎

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
data "sysdig_fargate_workload_agent" "containers_instrumented" {
2+
container_definitions = jsonencode([
3+
{
4+
"name" : "event-gen-1",
5+
"image" : "falcosecurity/event-generator",
6+
"command" : ["run", "syscall", "--all", "--loop"],
7+
"logConfiguration" : {
8+
"logDriver" : "awslogs",
9+
"options" : {
10+
"awslogs-group" : aws_cloudwatch_log_group.instrumented_logs.name,
11+
"awslogs-region" : var.region,
12+
"awslogs-stream-prefix" : "task"
13+
},
14+
}
15+
},
16+
{
17+
"name" : "event-gen-2",
18+
"image" : "falcosecurity/event-generator",
19+
"command" : ["run", "syscall", "--all", "--loop"],
20+
"logConfiguration" : {
21+
"logDriver" : "awslogs",
22+
"options" : {
23+
"awslogs-group" : aws_cloudwatch_log_group.instrumented_logs.name,
24+
"awslogs-region" : var.region,
25+
"awslogs-stream-prefix" : "task"
26+
},
27+
}
28+
}
29+
])
30+
31+
workload_agent_image = var.agent_workload_image
32+
33+
sysdig_access_key = var.access_key
34+
orchestrator_host = var.orchestrator_host
35+
orchestrator_port = var.orchestrator_port
36+
37+
log_configuration {
38+
group = aws_cloudwatch_log_group.instrumented_logs.name
39+
stream_prefix = "instrumentation"
40+
region = var.region
41+
}
42+
}
43+
44+
resource "aws_ecs_task_definition" "task_definition" {
45+
family = "${var.prefix}-instrumented-task-definition"
46+
task_role_arn = aws_iam_role.task_role.arn
47+
execution_role_arn = aws_iam_role.execution_role.arn
48+
49+
cpu = "256"
50+
memory = "512"
51+
network_mode = "awsvpc"
52+
requires_compatibilities = ["FARGATE"]
53+
pid_mode = "task"
54+
55+
container_definitions = data.sysdig_fargate_workload_agent.containers_instrumented.output_container_definitions
56+
}
57+
58+
59+
resource "aws_ecs_cluster" "cluster" {
60+
name = "${var.prefix}-instrumented-workload"
61+
}
62+
63+
resource "aws_cloudwatch_log_group" "instrumented_logs" {
64+
}
65+
66+
data "aws_iam_policy_document" "assume_role_policy" {
67+
statement {
68+
actions = ["sts:AssumeRole"]
69+
70+
principals {
71+
type = "Service"
72+
identifiers = ["ecs-tasks.amazonaws.com"]
73+
}
74+
}
75+
}
76+
77+
resource "aws_iam_role" "execution_role" {
78+
assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
79+
80+
managed_policy_arns = ["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"]
81+
}
82+
83+
resource "aws_iam_role" "task_role" {
84+
assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
85+
86+
inline_policy {
87+
name = "root"
88+
policy = data.aws_iam_policy_document.task_policy.json
89+
}
90+
}
91+
92+
data "aws_iam_policy_document" "task_policy" {
93+
statement {
94+
actions = [
95+
"ecr:GetAuthorizationToken",
96+
"ecr:BatchCheckLayerAvailability",
97+
"ecr:GetDownloadUrlForLayer",
98+
"ecr:BatchGetImage",
99+
"logs:CreateLogGroup",
100+
"logs:CreateLogStream",
101+
"logs:PutLogEvents",
102+
]
103+
104+
resources = ["*"]
105+
}
106+
}
107+
108+
resource "aws_ecs_service" "service" {
109+
name = "${var.prefix}-instrumented-service"
110+
111+
cluster = aws_ecs_cluster.cluster.id
112+
task_definition = aws_ecs_task_definition.task_definition.arn
113+
desired_count = var.replicas
114+
launch_type = "FARGATE"
115+
platform_version = "1.4.0"
116+
117+
network_configuration {
118+
subnets = [var.subnet_1, var.subnet_2]
119+
security_groups = [aws_security_group.security_group.id]
120+
assign_public_ip = true
121+
}
122+
}
123+
124+
resource "aws_security_group" "security_group" {
125+
description = "${var.prefix}-security-group"
126+
vpc_id = var.vpc_id
127+
}
128+
129+
resource "aws_security_group_rule" "orchestrator_agent_ingress_rule" {
130+
type = "ingress"
131+
protocol = "tcp"
132+
from_port = 0
133+
to_port = 0
134+
cidr_blocks = ["0.0.0.0/0"]
135+
security_group_id = aws_security_group.security_group.id
136+
}
137+
138+
resource "aws_security_group_rule" "orchestrator_agent_egress_rule" {
139+
type = "egress"
140+
protocol = "all"
141+
from_port = 0
142+
to_port = 0
143+
cidr_blocks = ["0.0.0.0/0"]
144+
security_group_id = aws_security_group.security_group.id
145+
}

‎examples/serverless-agent/fargate/workload-legacy/output.tf‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
output "workload_cluster_name" {
2+
value = aws_ecs_cluster.cluster.name
3+
}
4+
5+
output "workload_cluster_arn" {
6+
value = aws_ecs_cluster.cluster.arn
7+
}
8+
9+
output "service_arn" {
10+
value = aws_ecs_service.service.id
11+
}
12+
13+
output "task_revision" {
14+
value = aws_ecs_task_definition.task_definition.revision
15+
}

‎examples/serverless-agent/fargate/workload-legacy/providers.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
provider "aws" {
2+
region = var.region
3+
profile = var.profile
4+
}

‎examples/serverless-agent/fargate/workload-legacy/variables.tf‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# AWS configuration
2+
variable "prefix" {
3+
description = "All resources created by Terraform have this prefix prepended to them"
4+
}
5+
6+
variable "profile" {
7+
description = "AWS profile name"
8+
type = string
9+
}
10+
11+
variable "region" {
12+
description = "AWS Region for deployment"
13+
default = "us-east-1"
14+
}
15+
16+
variable "subnet_1" {
17+
description = "Subnet-1 Id"
18+
}
19+
20+
variable "subnet_2" {
21+
description = "Subnet-2 Id"
22+
}
23+
24+
variable "vpc_id" {
25+
description = "VPC Id"
26+
}
27+
28+
variable "tags" {
29+
type = map(string)
30+
description = "Tags to assign to resources in module"
31+
default = {}
32+
}
33+
34+
variable "replicas" {
35+
description = "Number of workload replicas to run"
36+
default = 2
37+
}
38+
39+
# Serverless Agent Configuration
40+
variable "access_key" {
41+
description = "Sysdig Agent access key"
42+
}
43+
44+
variable "agent_workload_image" {
45+
description = "Workload agent container image"
46+
default = "quay.io/sysdig/workload-agent:latest"
47+
}
48+
49+
variable "orchestrator_host" {
50+
description = "Orchestrator Host"
51+
}
52+
53+
variable "orchestrator_port" {
54+
description = "Orchestrator Port"
55+
default = 6667
56+
}

‎examples/serverless-agent/fargate/workload-legacy/versions.tf‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
terraform {
2+
required_version = ">=1.7.2"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = "~> 5.35.0"
8+
}
9+
local = {
10+
source = "hashicorp/local"
11+
version = "~> 2.4.1"
12+
}
13+
sysdig = {
14+
source = "sysdiglabs/sysdig"
15+
version = "~> 1.24.5"
16+
}
17+
}
18+
}

‎examples/serverless-agent/fargate/workload/README.md‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,21 +2,22 @@
22

33
This example deploys a cluster with a workload and the Serverless Workload Agent as a sidecar to secure the workload.
44

5+
The Workload Agent will directly connect to the Sysdig Collector.
6+
57
## Prerequisites
68

79
The following prerequisites are required to deploy this cluster:
8-
- Orchestrator Agent deployed
910
- VPC
1011
- 2 subnets
1112

1213
## Components
1314

1415
The cluster will be called `<prefix>-instrumented-workload` and will deploy the following:
1516
- 1 Service (called `<prefix-instrumented-service`)
16-
- 1 Task (with the latest version of the Serverless Orchestrator Agent)
17+
- 1 Task with 2 replicas, each running:
1718
- 1 container named `event-gen-1` running `falcosecurity/event-generator`
1819
- 1 container named `event-gen-2` also running `falcosecurity/event-generator`
19-
- 1 container named `SysdigInstrumentation` running the Workload Agent which will secure both workload containers
20+
- 1 container named `SysdigInstrumentation` running the latest Workload Agent which will secure both workload containers
2021

2122
## Layout
2223
| **File** | **Purpose** |

‎examples/serverless-agent/fargate/workload/instrumented_load.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,8 @@ data "sysdig_fargate_workload_agent" "containers_instrumented" {
3131
workload_agent_image = var.agent_workload_image
3232

3333
sysdig_access_key = var.access_key
34-
orchestrator_host = var.orchestrator_host
35-
orchestrator_port = var.orchestrator_port
34+
collector_host = var.collector_host
35+
collector_port = var.collector_port
3636

3737
log_configuration {
3838
group = aws_cloudwatch_log_group.instrumented_logs.name

‎examples/serverless-agent/fargate/workload/variables.tf‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,11 @@ variable "tags" {
3131
default = {}
3232
}
3333

34+
variable "replicas" {
35+
description = "Number of workload replicas to run"
36+
default = 2
37+
}
38+
3439
# Serverless Agent Configuration
3540
variable "access_key" {
3641
description = "Sysdig Agent access key"
@@ -41,16 +46,11 @@ variable "agent_workload_image" {
4146
default = "quay.io/sysdig/workload-agent:latest"
4247
}
4348

44-
variable "orchestrator_host" {
45-
description = "Orchestrator Host"
49+
variable "collector_host" {
50+
description = "Collector Host"
4651
}
4752

48-
variable "orchestrator_port" {
49-
description = "Orchestrator Port"
50-
default = 6667
51-
}
52-
53-
variable "replicas" {
54-
description = "Number of workload replicas to run"
55-
default = 2
53+
variable "collector_port" {
54+
description = "Collector Port"
55+
default = 6443
5656
}

0 commit comments

Comments
 (0)