Logo

A powerful, easily deployable network traffic analysis tool suite

Quick Start

Documentation

Components

Supported Protocols

Configuring

Arkime

Dashboards

Hedgehog Linux

Contribution Guide

Deploying Malcolm on Amazon Elastic Kubernetes Service (EKS)

This document outlines the process of setting up a cluster on Amazon Elastic Kubernetes Service (EKS) using Amazon Web Services in preparation for Deploying Malcolm with Kubernetes.

This is a work-in-progress document that is still a bit rough around the edges. You’ll need to replace things like cluster-name and us-east-1 with the values that are appliable to your cluster. Any feedback is welcome in the relevant issue on GitHub.

Prerequisites

Procedure

  1. Create a VPC with subnets in 2 or more availability zones
  2. Create a security group for VPC
  3. Create an EKS cluster
  4. Generate a kubeconfig file to use with Malcolm’s control scripts (malcolmeks.yaml is used in this example)
     aws eks update-kubeconfig --region us-east-1 --name cluster-name --kubeconfig malcolmeks.yaml
    
  5. Create a node group
  6. Deploy metrics-server
     kubectl --kubeconfig=malcolmeks.yaml apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml
    
  7. Deploy ingress-nginx as described here. This script (deploy_ingress_nginx.sh) may be helpful in doing so. To provide external access to services in the EKS cluster, pass -a -e to deploy_ingress_nginx.sh
  8. Associate IAM OIDC provider with cluster
     eksctl utils associate-iam-oidc-provider --region=us-east-1 --cluster=cluster-name --approve
    
  9. deploy Amazon EFS CSI driver
    • review Prerequisites
    • follow steps for Create an IAM policy and role
    • follow steps for Install the Amazon EFS driver
    • follow steps for Create an Amazon EFS file system
  10. Create and launch an EC2 instance for initializing the directory structure on the EFS filesystem (this can be a very small instance, e.g., t2.micro). Make sure when configuring this instance you give configure to the EFS file system in the storage configuration.
  11. SSH to instance and initialize NFS subdirectories
    • set up malcolm subdirectory
      sudo touch /mnt/efs/fs1/test-file.txt
      sudo mkdir -p /mnt/efs/fs1/malcolm
      sudo chown 1000:1000 /mnt/efs/fs1/malcolm
      
    • /mnt/efs/fs1/malcolm/init_storage.sh
      #!/bin/bash
      
      if [ -z "$BASH_VERSION" ]; then
        echo "Wrong interpreter, please run \"$0\" with bash"
        exit 1
      fi
      
      ENCODING="utf-8"
      
      RUN_PATH="$(pwd)"
      [[ "$(uname -s)" = 'Darwin' ]] && REALPATH=grealpath || REALPATH=realpath
      [[ "$(uname -s)" = 'Darwin' ]] && DIRNAME=gdirname || DIRNAME=dirname
      if ! (type "$REALPATH" && type "$DIRNAME") > /dev/null; then
        echo "$(basename "${BASH_SOURCE[0]}") requires $REALPATH and $DIRNAME"
        exit 1
      fi
      SCRIPT_PATH="$($DIRNAME $($REALPATH -e "${BASH_SOURCE[0]}"))"
      pushd "$SCRIPT_PATH" >/dev/null 2>&1
      
      rm -rf ./opensearch/* ./opensearch-backup/* ./pcap/* ./suricata-logs/* ./zeek-logs/* ./config/netbox/* ./config/zeek/* ./runtime-logs/*
      mkdir -vp ./config/auth ./config/htadmin ./config/opensearch ./config/logstash ./config/netbox/media ./config/netbox/postgres ./config/netbox/redis ./config/zeek/intel/MISP ./config/zeek/intel/STIX ./opensearch ./opensearch-backup ./pcap/upload ./pcap/processed ./suricata-logs ./zeek-logs/current ./zeek-logs/upload ./zeek-logs/extract_files ./runtime-logs/arkime ./runtime-logs/nginx
      
      popd >/dev/null 2>&1
      
      /mnt/efs/fs1/malcolm/init_storage.sh
      mkdir: created directory './config/netbox/media'
      mkdir: created directory './config/netbox/postgres'
      mkdir: created directory './config/netbox/redis'
      mkdir: created directory './config/zeek/intel'
      mkdir: created directory './config/zeek/intel/MISP'
      mkdir: created directory './config/zeek/intel/STIX'
      mkdir: created directory './pcap/upload'
      mkdir: created directory './pcap/processed'
      mkdir: created directory './zeek-logs/current'
      mkdir: created directory './zeek-logs/upload'
      mkdir: created directory './zeek-logs/extract_files'
      mkdir: created directory './runtime-logs'
      
  12. Set up access points, and note the Access point IDs to put in your YAML in the next step

    name mountpoint access point ID
    config /malcolm/config fsap-config
    opensearch /malcolm/opensearch fsap-opensearch
    opensearch-backup /malcolm/opensearch-backup fsap-opensearch-backup
    pcap /malcolm/pcap fsap-pcap
    runtime-logs /malcolm/runtime-logs fsap-runtime-logs
    suricata-logs /malcolm/suricata-logs fsap-suricata-logs
    zeek-logs /malcolm/zeek-logs fsap-zeek-logs
  13. Create YAML for persistent volumes and volume claims from the EBS Volume ID. In this example, replace fs-FILESYSTEMID with your EFS filesystem ID and fsap-XXXXXXXX with the appropriate access point ID
     apiVersion: v1
     kind: PersistentVolume
     metadata:
       name: pcap-volume
       namespace: malcolm
       labels:
         namespace: malcolm
     spec:
       capacity:
         storage: 500Gi
       volumeMode: Filesystem
       accessModes:
         - ReadWriteMany
       persistentVolumeReclaimPolicy: Retain
       storageClassName: efs-sc
       csi:
         driver: efs.csi.aws.com
         volumeHandle: fs-FILESYSTEMID::fsap-pcap
    
     ---
     apiVersion: v1
     kind: PersistentVolumeClaim
     metadata:
       name: pcap-claim
       namespace: malcolm
     spec:
       storageClassName: efs-sc
       accessModes:
         - ReadWriteMany
       volumeMode: Filesystem
       resources:
         requests:
           storage: 500Gi
       volumeName: pcap-volume
    
     ---
     apiVersion: v1
     kind: PersistentVolume
     metadata:
       name: zeek-volume
       namespace: malcolm
       labels:
         namespace: malcolm
     spec:
       capacity:
         storage: 250Gi
       volumeMode: Filesystem
       accessModes:
         - ReadWriteMany
       persistentVolumeReclaimPolicy: Retain
       storageClassName: efs-sc
       csi:
         driver: efs.csi.aws.com
         volumeHandle: fs-FILESYSTEMID::fsap-zeek-logs
    
     ---
     apiVersion: v1
     kind: PersistentVolumeClaim
     metadata:
       name: zeek-claim
       namespace: malcolm
     spec:
       storageClassName: efs-sc
       accessModes:
         - ReadWriteMany
       volumeMode: Filesystem
       resources:
         requests:
           storage: 250Gi
       volumeName: zeek-volume
    
     ---
     apiVersion: v1
     kind: PersistentVolume
     metadata:
       name: suricata-volume
       namespace: malcolm
       labels:
         namespace: malcolm
     spec:
       capacity:
         storage: 100Gi
       volumeMode: Filesystem
       accessModes:
         - ReadWriteMany
       persistentVolumeReclaimPolicy: Retain
       storageClassName: efs-sc
       csi:
         driver: efs.csi.aws.com
         volumeHandle: fs-FILESYSTEMID::fsap-suricata-logs
    
     ---
     apiVersion: v1
     kind: PersistentVolumeClaim
     metadata:
       name: suricata-claim
       namespace: malcolm
     spec:
       storageClassName: efs-sc
       accessModes:
         - ReadWriteMany
       volumeMode: Filesystem
       resources:
         requests:
           storage: 100Gi
       volumeName: suricata-volume
    
     ---
     apiVersion: v1
     kind: PersistentVolume
     metadata:
       name: config-volume
       namespace: malcolm
       labels:
         namespace: malcolm
     spec:
       capacity:
         storage: 25Gi
       volumeMode: Filesystem
       accessModes:
         - ReadWriteMany
       persistentVolumeReclaimPolicy: Retain
       storageClassName: efs-sc
       csi:
         driver: efs.csi.aws.com
         volumeHandle: fs-FILESYSTEMID::fsap-config
    
     ---
     apiVersion: v1
     kind: PersistentVolumeClaim
     metadata:
       name: config-claim
       namespace: malcolm
     spec:
       storageClassName: efs-sc
       accessModes:
         - ReadWriteMany
       volumeMode: Filesystem
       resources:
         requests:
           storage: 25Gi
       volumeName: config-volume
    
     ---
     apiVersion: v1
     kind: PersistentVolume
     metadata:
       name: runtime-logs-volume
       namespace: malcolm
       labels:
         namespace: malcolm
     spec:
       capacity:
         storage: 25Gi
       volumeMode: Filesystem
       accessModes:
         - ReadWriteMany
       persistentVolumeReclaimPolicy: Retain
       storageClassName: efs-sc
       csi:
         driver: efs.csi.aws.com
         volumeHandle: fs-02997421cdc55b8e4::fsap-runtime-logs
    
     ---
     apiVersion: v1
     kind: PersistentVolumeClaim
     metadata:
       name: runtime-logs-claim
       namespace: malcolm
     spec:
       storageClassName: efs-sc
       accessModes:
         - ReadWriteMany
       volumeMode: Filesystem
       resources:
         requests:
           storage: 25Gi
       volumeName: runtime-logs-volume
    
     ---
     apiVersion: v1
     kind: PersistentVolume
     metadata:
       name: opensearch-volume
       namespace: malcolm
       labels:
         namespace: malcolm
     spec:
       capacity:
         storage: 500Gi
       volumeMode: Filesystem
       accessModes:
         - ReadWriteOnce
       persistentVolumeReclaimPolicy: Retain
       storageClassName: efs-sc
       csi:
         driver: efs.csi.aws.com
         volumeHandle: fs-FILESYSTEMID::fsap-opensearch
    
     ---
     apiVersion: v1
     kind: PersistentVolumeClaim
     metadata:
       name: opensearch-claim
       namespace: malcolm
     spec:
       storageClassName: efs-sc
       accessModes:
         - ReadWriteOnce
       volumeMode: Filesystem
       resources:
         requests:
           storage: 500Gi
       volumeName: opensearch-volume
    
     ---
     apiVersion: v1
     kind: PersistentVolume
     metadata:
       name: opensearch-backup-volume
       namespace: malcolm
       labels:
         namespace: malcolm
     spec:
       capacity:
         storage: 500Gi
       volumeMode: Filesystem
       accessModes:
         - ReadWriteOnce
       persistentVolumeReclaimPolicy: Retain
       storageClassName: efs-sc
       csi:
         driver: efs.csi.aws.com
         volumeHandle: fs-FILESYSTEMID::fsap-opensearch-backup
    
     ---
     apiVersion: v1
     kind: PersistentVolumeClaim
     metadata:
       name: opensearch-backup-claim
       namespace: malcolm
     spec:
       storageClassName: efs-sc
       accessModes:
         - ReadWriteOnce
       volumeMode: Filesystem
       resources:
         requests:
           storage: 500Gi
       volumeName: opensearch-backup-volume
    
  14. Finish configuring and configuring Malcolm as described in Deploying Malcolm with Kubernetes