feat(adapter): Add k8tls adapter

Signed-off-by: Anurag Rajawat <[email protected]>

deployments/nimbus-k8tls/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

deployments/nimbus-k8tls/Chart.yaml

@@ -0,0 +1,9 @@
+apiVersion: v2
+type: application
+name: nimbus-k8tls
+version: 0.1.0
+appVersion: "0.1.0"
+description: Nimbus adapter for k8tls
+sources:
+  - https://github.com/5GSEC/nimbus
+kubeVersion: ">=1.25.0-0"

deployments/nimbus-k8tls/Readme.md

@@ -0,0 +1,45 @@
+# Install [k8tls](https://github.com/kubearmor/k8tls) adapter
+
+Install `nimbus-k8tls` adapter using the official 5GSEC Helm charts.
+
+```shell
+helm repo add 5gsec https://5gsec.github.io/charts
+helm repo update 5gsec
+helm upgrade --install nimbus-k8tls 5gsec/nimbus-k8tls -n nimbus
+```
+
+Install `nimbus-k8tls` adapter using Helm charts locally (for testing)
+
+```bash
+cd deployments/nimbus-k8tls/
+helm upgrade --install nimbus-k8tls . -n nimbus
+```
+
+## Values
+
+| Key              | Type   | Default            | Description                                                            |
+|------------------|--------|--------------------|------------------------------------------------------------------------|
+| image.repository | string | 5gsec/nimbus-k8tls | Image repository from which to pull the `nimbus-k8tls` adapter's image |
+| image.pullPolicy | string | Always             | `nimbus-k8tls` adapter image pull policy                               |
+| image.tag        | string | latest             | `nimbus-k8tls` adapter image tag                                       |
+
+## Verify if all the resources are up and running
+
+Once done, the following resources will exist in your cluster:
+
+```shell
+$ kubectl get all -n nimbus -l app.kubernetes.io/instance=nimbus-k8tls
+NAME                     READY   STATUS    RESTARTS   AGE
+pod/nimbus-k8tls-q2tt7   1/1     Running   0          3m8s
+
+NAME                          DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE
+daemonset.apps/nimbus-k8tls   1         1         1       1            1           <none>          3m8s
+```
+
+## Uninstall the k8tls adapter
+
+To uninstall:
+
+```bash
+helm uninstall nimbus-k8tls -n nimbus
+```

deployments/nimbus-k8tls/templates/_helpers.tpl

@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "nimbus-k8tls.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "nimbus-k8tls.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "nimbus-k8tls.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "nimbus-k8tls.labels" -}}
+helm.sh/chart: {{ include "nimbus-k8tls.chart" . }}
+{{ include "nimbus-k8tls.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "nimbus-k8tls.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "nimbus-k8tls.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "nimbus-k8tls.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "nimbus-k8tls.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

deployments/nimbus-k8tls/templates/daemonset.yaml

@@ -0,0 +1,24 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ include "nimbus-k8tls.fullname" . }}
+  labels:
+    {{- include "nimbus-k8tls.labels" . | nindent 4 }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  selector:
+    matchLabels:
+      {{- include "nimbus-k8tls.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "nimbus-k8tls.labels" . | nindent 8 }}
+    spec:
+      serviceAccountName: {{ include "nimbus-k8tls.serviceAccountName" . }}
+      containers:
+        - name: {{ .Values.fullnameOverride }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+      terminationGracePeriodSeconds: 10

deployments/nimbus-k8tls/templates/role.yaml

@@ -0,0 +1,61 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: nimbus-k8tls-clusterrole
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - namespaces
+  - serviceaccounts
+  verbs:
+  - create
+  - delete
+  - get
+  - update
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - get
+  - list
+- apiGroups:
+  - batch
+  resources:
+  - cronjobs
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - update
+  - watch
+- apiGroups:
+  - intent.security.nimbus.com
+  resources:
+  - clusternimbuspolicies
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - intent.security.nimbus.com
+  resources:
+  - clusternimbuspolicies/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - clusterrolebindings
+  - clusterroles
+  verbs:
+  - create
+  - delete
+  - get
+  - update

deployments/nimbus-k8tls/templates/rolebinding.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "nimbus-k8tls.fullname" . }}-clusterrole-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: nimbus-k8tls-clusterrole
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "nimbus-k8tls.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}

deployments/nimbus-k8tls/templates/serviceaccount.yaml

@@ -0,0 +1,10 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "nimbus-k8tls.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "nimbus-k8tls.labels" . | nindent 4 }}
+automountServiceAccountToken: {{ .Values.serviceAccount.automount }}
+{{- end }}

deployments/nimbus-k8tls/values.yaml

@@ -0,0 +1,18 @@
+# Default values for nimbus-k8tls.
+
+image:
+  repository: 5gsec/nimbus-k8tls
+  pullPolicy: Always
+  tag: "latest"
+
+nameOverride: ""
+fullnameOverride: "nimbus-k8tls"
+
+serviceAccount:
+  create: true
+  automount: true
+  name: "nimbus-k8tls"
+
+securityContext:
+  runAsNonRoot: true
+  runAsUser: 65533

examples/clusterscoped/ensuretls-default.yaml

@@ -0,0 +1,27 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2023 Authors of Nimbus
+
+apiVersion: intent.security.nimbus.com/v1alpha1
+kind: SecurityIntent
+metadata:
+  name: ensure-tls-default
+spec:
+  intent:
+    id: ensureTLS
+    action: Audit
+    description: |
+      Assess the TLS configuration to ensure compliance with the security standards. This includes verifying TLS protocol version,
+      certificate validity and FIPS-140-3 approved cipher suites.
+      Reference: MITRE ATT&CK Technique: FGT5011 https://fight.mitre.org/techniques/FGT5011
+---
+apiVersion: intent.security.nimbus.com/v1alpha1
+kind: ClusterSecurityIntentBinding
+metadata:
+  name: ensure-tls-default
+spec:
+  intents:
+    - name: ensure-tls-default
+  selector:
+    nsSelector:
+      matchNames:
+        - '*'

examples/clusterscoped/ensuretls-with-external-addresses.yaml

@@ -0,0 +1,31 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2023 Authors of Nimbus
+
+apiVersion: intent.security.nimbus.com/v1alpha1
+kind: SecurityIntent
+metadata:
+  name: ensure-tls-external-addresses
+spec:
+  intent:
+    id: ensureTLS
+    action: Audit
+    severity: "medium"
+    description: |
+      Assess the TLS configuration to ensure compliance with the security standards. This includes verifying TLS protocol version,
+      certificate validity and FIPS-140-3 approved cipher suites.
+      Reference: MITRE ATT&CK Technique: FGT5011 https://fight.mitre.org/techniques/FGT5011
+    params:
+      # Specify domain name with its port
+      external_addresses: [ "google.com:443", "accuknox.com:443", "apigateway-fips.us-east-1.amazonaws.com:443", "dh480.badssl.com:443" ]
+---
+apiVersion: intent.security.nimbus.com/v1alpha1
+kind: ClusterSecurityIntentBinding
+metadata:
+  name: ensure-tls-external-addresses
+spec:
+  intents:
+    - name: ensure-tls-external-addresses
+  selector:
+    nsSelector:
+      matchNames:
+        - '*'

examples/clusterscoped/ensuretls-with-schedule.yaml

@@ -0,0 +1,30 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2023 Authors of Nimbus
+
+apiVersion: intent.security.nimbus.com/v1alpha1
+kind: SecurityIntent
+metadata:
+  name: ensure-tls-scheduled
+spec:
+  intent:
+    id: ensureTLS
+    action: Audit
+    severity: "medium"
+    description: |
+      Assess the TLS configuration to ensure compliance with the security standards. This includes verifying TLS protocol version,
+      certificate validity and FIPS-140-3 approved cipher suites.
+      Reference: MITRE ATT&CK Technique: FGT5011 https://fight.mitre.org/techniques/FGT5011
+    params:
+      schedule: [ "@monthly" ]
+---
+apiVersion: intent.security.nimbus.com/v1alpha1
+kind: ClusterSecurityIntentBinding
+metadata:
+  name: ensure-tls-scheduled
+spec:
+  intents:
+    - name: ensure-tls-scheduled
+  selector:
+    nsSelector:
+      matchNames:
+        - '*'