DEV Community: Angel Onyebuchi

How to Secure Kubernetes Workloads with Network Policies using Civo and Cilium

Angel Onyebuchi — Mon, 18 Dec 2023 12:25:32 +0000

Deploying and managing containerized applications at scale requires a secure environment that is vital throughout the container lifecycle due to the runtime’s constant change, which affects both the apps and the APIs that connect them to other applications and services.

Want to tighten security for your Kubernetes cluster and applications? This article shows how Civo and Cilium work together to secure your workloads with network policies.

What is Civo?

Civo is a cloud computing company that provides a developer-focused platform for deploying, managing, and scaling Kubernetes clusters and other cloud-based services. It offers a simplified approach to Kubernetes deployment, aiming to streamline the process for developers and businesses.

What is Cilium?

Cilium is an open-source software project designed to provide networking, observability, and security solutions in modern containerized environments, specifically within Kubernetes clusters. It acts as a CNI (Container Network Interface) plugin, serving as a powerful networking and security middleware connecting the application layer and the underlying network infrastructure.

What are Kubernetes Network Policies?

Imagine your Kubernetes cluster as a bustling city. Pods are like buildings, and network policies are like traffic rules on the streets.

These rules control:

Who can go where: You can allow some pods to visit certain "buildings" (services or other pods) while restricting others.
What they can do there: You can define what kind of interactions pods can have, like reading data from a database or sending messages to another pod.
How they can travel: You can specify which "streets" they can use (protocols, ports).

Kubernetes network policies define how pods can communicate securely with each other and various network services and control incoming and outgoing network traffic to and from the cluster.

How would Civo and Cilium work?

Cilium and Civo work together to provide a comprehensive and efficient way to secure your Kubernetes workloads with network policies. Civo simplifies deployment and management, while Cilium offers powerful enforcement and advanced security features. With both working in in sync, you can ensure your Kubernetes clusters and applications are well-protected.

Prerequisites

A Civo account. You can create one here

A Civo CLI. You can install and set up using this guide.

How to deploy and configure a Kubernetes Network Policy Controller like Cilium using Civo

Step 1: Setting up a Civo Kubernetes cluster

To get started, ensure you have a running Civo Kubernetes cluster. You can create one using the Civo CLI or the Civo web interface. Ensure that your kubectl is configured properly to connect with your Civo Kubernetes cluster.

Step 2: Install Cilium on your Civo Kubernetes cluster

a. Authenticate the Civo CLI with your API token using the following command:

            civo apikey save

You will be asked to give a name to your API key and also input your API key to be saved.

b. Use the Civo CLI or web console to start creating a new Kubernetes cluster

c. Go to the "Advanced options" during cluster configuration

d. Under "Networking", select "Cilium" from the CNI dropdown menu

e. Complete the other cluster details as per your requirements

f. Launch the cluster

This will automatically deploy Cilium as the CNI for networking and NetworkPolicy enforcement in the new cluster.

The manual installation steps using Helm will only be required if you already have an existing cluster running a different CNI, and want to transition to Cilium subsequently.

But for new clusters, choosing the Cilium CNI during creation is simpler and avoids the need to manually install it afterwards.

Step 3: Verify Cilium Installation

Once the installation is completed, to make sure Cilium is running properly, run this:

kubectl get pods -n kube-system -l k8s-app=cilium

The output should be like this:

     NAME           READY   STATUS    RESTARTS   AGE
     cilium-   1/1     Running   0          3h
     cilium-mhdb2   1/1     Running   0          3h

This indicates two Cilium pods are running, named "cilium-fs8hx" and "cilium-mhdb2". Both have a ready status of 1/1 meaning they are healthy and have restarted 0 times.

Ensure that all Cilium pods are in their "Running" state. Check also to see if the Cilium nodes are running too:

            kubectl get nodes --selector='!node-role.kubernetes.io/master'
            \
            --output=jsonpath={.items[*].status.conditions[?\(@.type==
            \"Ready\"\)].status}

The expected output would be a list of "True" or "False" values, one for each node's Ready condition status.

     True False True True

This indicates there are 4 nodes, with the first, third and fourth nodes being Ready (True), and the second node not Ready (False).

Step 4: Configure Network Policies

To enforce network security regulations, Cilium uses the Kubernetes NetworkPolicy API. To manage traffic between pods, you can define your NetworkPolicies using the “labels” or “annotations” field in the metadata section.

Here is an example of a NetworkPolicy manifest that only permits communication between pods:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: frontend-to-backend
spec:
  podSelector:
    matchLabels:
      app: frontend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: backend

where the key parts are:

The podSelector to select pods with label app: frontend
The ingress rule allowing ingress traffic from pods with label app: backend This will match all pods with the label app: frontend and only allow them to receive traffic from pods labelled app: backend.

Apply the above manifest to the cluster by saving it to a file (such as civo-user-provider. yaml):

kubectl apply -f civo-user-provider. yaml

You can create additional NetworkPolicies to suit your requirements.

Step 5: Verify network policies

You can test the network connectivity across pods to make sure that NetworkPolicies are being enforced by Cilium.

For instance, you can attempt accessing a service running in the backend pod from the frontend pod, if you have a frontend and a backend pod. If the NetworkPolicy is set up properly, access ought to be permitted. if otherwise, the connection will be terminated.

Below are the frontend and backend of a simple web application created with Node.js and Express.js, implementing a simple frontend app on port 4000 that requests the backend API on port 3000.

Frontend(Client-side)
const express = require('express');
const axios = require('axios');

const app = express();

app.get('/', async (req, res) => {
  try {
    const response = await axios.get('http://localhost:3000/api');
    res.json(response.data);  
  } catch (error) {
    console.error(error);
    res.status(500).send('Error connecting to backend');
  }
});

app.listen(4000, () => {
  console.log('Frontend server listening on port 4000');
});

Backend (Server-side)

const express = require('express');

const app = express();

app.get('/api', (req, res) => {
  res.json({message: 'Hello from backend!'});
});

app.listen(3000, () => {
  console.log('Backend server listening on port 3000');  
});

Without a controller to use it, creating a NetworkPolicy resource has no impact. For comprehensive instructions on implementing and setting network policies in your specific environment, it is necessary to refer to the documentation and guidelines supplied by your network plugin provider.

Don't forget to modify these network policies to match your unique security needs and your Kubernetes cluster's design. Ensure your Kubernetes cluster can enforce network policies and is configured to do so.

Conclusion

Keep in mind that applying network policies to secure Kubernetes workloads is a continuous process. To respond to emerging threats and preserve the security of your cluster and applications, you must constantly evaluate and adjust your policies.

Aside from this, you can explore additional features on Cilium, like load balancing, observability, and network security, beyond what is covered in this basic guide. Refer to the Cilium documentation to learn more about these features and how to configure them. Check here

Maximizing Your Server's Potential: How to Deploy a LAMP Stack on Debian 11

Angel Onyebuchi — Sun, 17 Dec 2023 01:55:20 +0000

When building custom web apps, developers need an operating system, a web server, database management software and a programming language to create and deliver web apps and deploy and host existing applications.

Made of 4 different Open- source software technologies, The LAMP stack consists of Linux, as the operating system, Apache, as the web server, MySQL as the database management system, and PHP/Pearl as the programming language which is used for Server-side/Backend development

Because the LAMP stack possesses flexibility, scalability, security, and ease of use, it became a popular, reliable and affordable option for developers to host content and handle a large amount of traffic and Data.

Debian is renowned for its extensive testing processes and lengthy release cycles, which guarantee the stability and bug-free operation of the system. This is highly vital for server installations, which must operate continuously and without interruption.

It also has an efficient package management system that makes it simple to install, update, and manage software packages, including the LAMP stack's constituent parts. For developers and system administrators who must maintain the server, this saves time and effort.

In this tutorial, you will learn the following:

What is a LAMP stack is* Benefits of using LAMP stack
How to deploy a LAMP stack to a Debian

Prerequisites

Git, Apache, Wget, Curl
Php 8.0 and its dependencies
Mysql/MariaDB Database
Composer
Debian 11 Server aka (Bullseye). Install here

Installing LAMP

To install the LAMP stack, you must have root access to your server or create a user with root access with the su command. Next, you need a domain pointed to your server IP to install the SSL certificate.

Step 1 - Updating and Upgrading Package Installer

Before installing any new software on your system, ensure you start by updating and upgrading to the latest versions and security patches available with the following command:

sudo apt update sudo apt upgrade

Step 2 - Install the wget package

The wget command downloads and retries files and content from various web servers.

Download the wget command using this command:

sudo apt install wget

Step 3 - Install Apache and other packages

Install Apache and other dependencies using the following command:

sudo apt install -y apache2 apache2-utils

*Note: The -y is to answer yes to all the prompts.

Step 4 - Setup Firewall

Uncomplicated Firewall (UFW) is a tool that helps to protect your computer or server from unwanted network traffic by managing the firewall rules. You can install and enable your firewall settings here.

You can modify your firewall settings using the app profiles that UFW ships with on Debian 11. Here are some steps to set up and adjust your ufw for your Debian 11 server:

Run the following command to view all application profiles:

sudo ufw app list

You will see the list of available application profiles

Output
      Available applications:
      Apache
      Apache Full
      Apache Secure
      OpenSSH

By default, all incoming traffic is automatically blocked by UFW, but all outgoing traffic is permitted. Use the next command to verify the default policies.

sudo ufw default deny incoming

sudo ufw default allow outgoing
Configure the firewall rules
Add rules for specific ports, services, or IP addresses to configure the firewall rules. For example, to allow incoming traffic on port 80 (HTTP), use the following command:

sudo ufw allow 80/tcp

Step 5 - Check status to see if Apache is running

After installation, Apache starts up instantly and is running. Run the following command to verify the Apache service's status:

sudo systemctl status apache2

If Apache is running, the output would be like this:

     ● apache2.service - The Apache HTTP Server
    Loaded: loaded (/lib/systemd/system/apache2.service; enabled; vendor 
   preset: enabled)
   Drop-In: /lib/systemd/system/apache2.service.d
            └─apache2-systemd.conf
    Active: active (running) since Tue 2022-02-02 10:29:51 UTC; 5min ago
    Main PID: 10617 (apache2)
     Tasks: 55 (limit: 667)
    CGroup: /system.slice/apache2.service
            ├─10617 /usr/sbin/apache2 -k start
            ├─10619 /usr/sbin/apache2 -k start
            └─10620 /usr/sbin/apache2 -k start
 Feb 02 10:29:51 apache systemd[1]: Starting The Apache HTTP Server…
 Feb 02 10:29:51 apache systemd[1]: Started The Apache HTTP Server.

Step 6 - Install MySQL

The installation of the database system is necessary in order to store and manage data for your website. To install MySQL, run:

wget https://dev.mysql.com/get/mysql-apt-config_0.8.22-1_all.deb

Next, install the release package:

sudo apt install ./mysql-apt-config_0.8.22-1_all.deb

Then run:

      sudo apt update
      sudo apt install mysql-server

After the successful installation of MySQL, start the MySQL service:

sudo systemctl start mysql

Run mysql_secure_installation to set root password and secure the installation:

sudo mysql_secure_installation

sudo mysql -u root -p

Create a database and user, set permissions:

CREATE DATABASE mydb;
CREATE USER 'myuser'@'localhost' IDENTIFIED BY 'password';
GRANT ALL PRIVILEGES ON mydb.* TO 'myuser'@'localhost';

Restart MySQl to ensure its running:

sudo systemctl restart mysql

This should be your output:

mysql.service - MySQL Community Server
     Loaded: loaded (/lib/systemd/system/mysql.service; enabled; vendor preset: enabled)
     Active: active (running) since Wed 2022-02-02 06:12:30 UTC; 17s ago
       Docs: man:mysqld(8)
             http://dev.mysql.com/doc/refman/en/using-systemd.html
   Main PID: 101929 (mysqld)
     Status: "Server is operational"
      Tasks: 38 (limit: 1148)
     Memory: 369.3M
        CPU: 805ms
     CGroup: /system.slice/mysql.service
             └─101929 /usr/sbin/mysqld

Feb 02 06:12:29 demo systemd[1]: Starting MySQL Community Server...
Feb 02 06:12:30 demo systemd[1]: Started MySQL Community Server.

Step 7 - Install PHP

Update package index and install PHP packages:

sudo apt update
sudo apt install php libapache2-mod-php php-mysql

Verify the PHP version you installed:

php -v

Restart Apache web server to load PHP:

sudo systemctl restart apache2

Step 8 - Verify the PHP test page process on your web server :

Create a new file named "info.php" and add it under the custom web root folder, "/var/www/html" using nano:

nano info.php

Open the file and add the text below, inside the file:

?php
phpinfo();

Save the file and exit.

You can access the test page using your domain name or server-ip address, followed by the script name "info.php":

    http://your_domain/info.php

OR

      http://server_ip/info.php

Step 9 - Restart Apache after making changes.

sudo systemctl restart apache2

Your LAMP stack is now fully deployed on Debian 11.

Conclusion

The open-source nature, maturity, flexibility, performance and cost-efficiency of LAMP make it a reliable choice for hosting web applications.

This guide has equipped you to host PHP websites and apps by implementing a scalable Apache-MySQL platform. Apache serves as the web server while MySQL manages the database system. Together they provide a flexible LAMP stack foundation to build and serve dynamic PHP-powered applications that can deliver customized content to visitors.

How to Set Up a Linux OS (Ubuntu) on Windows using VirtualBox and Vagrant

Angel Onyebuchi — Tue, 21 Mar 2023 00:54:33 +0000

Ubuntu is a popular Linux distribution that offers users a wide range of features and applications. Ubuntu is a great choice for those new to Linux who want to explore its capabilities. However, it can be difficult to set up and configure on a Windows desktop.

Fortunately, there is a way to get Ubuntu up and running quickly and easily with VirtualBox and Vagrant. This tutorial will guide you through setting up Ubuntu with VirtualBox and Vagrant on a Windows desktop, creating a secure and isolated virtual environment for testing and experimenting.

What is Vagrant?

Vagrant is an open-source software for building and managing virtual machine environments in a single workflow. With Vagrant, you can define a configuration file that specifies the details of the virtual machine you want to create and then use a single command to create and configure the virtual machine. This makes it easy to set up and maintain a consistent development environment across multiple machines and to share that environment with others.

Vagrant works with various virtualization software, including VirtualBox, VMware, and Hyper-V, and can manage both Linux and Windows virtual machines.

What is VirtualBox?

VirtualBox is a free, open-source virtualization software platform developed by Oracle that allows you to run multiple operating systems on a single physical machine. With VirtualBox, you can create and run virtual machines (VMs) on your computer, each of which runs a separate operating system and can be configured with its virtual hardware.

VirtualBox is designed to be easy to use, with a simple graphical user interface (GUI) that allows you to create and manage virtual machines. It supports a wide range of operating systems, including Windows, Linux, macOS, and many others, and can be used for various purposes, such as testing software, running legacy applications, and more.

How would Vagrant and VirtualBox work?

When you use Vagrant with VirtualBox, Vagrant creates and manages virtual machines in the VirtualBox environment. You define the operating system type, the amount of memory, and other resources the virtual machine should have in the Vagrant configuration file. Vagrant then uses this configuration to create and configure the virtual machine in VirtualBox.

Once the virtual machine is up and running, you can use Vagrant to manage it by SSHing into it or running provisioning scripts to set up the environment.

Prerequisite

To follow along with this article, you need to have the following:

A computer with
- at least 8 GB RAM
- Windows 10 x64-bit operating system (OS)
- A modern multi-core Intel/AMD CPU
- Virtualization is enabled in its BIOS settings. Find out how to here.
Have a basic knowledge of Powershell or Gitbash.
Installing VirtualBox

To install VirtualBox, you will need to follow these steps:

Step 1: Visit the VirtualBox website using this link, and you will see a page similar to the one below.

Step 2: Click on “Download VirtualBox” and then on Windows hosts to download VirtualBox and its extension pack.

Step 3: After downloading it, click on the “New” icon in the top right-hand corner to create a new virtual machine.

You would see a prompt like this.

Step 4: Name the new machine you want to create and choose the type and version that suits your taste.

Step 5: Click next and assign the memory size you want to allocate to the virtual machine using the up and down arrow keys.

Step 6: Click Next, select “Create a virtual hard disk now”, and create.

Step 7: Choose the hard disk file type (using the default setting is recommended except there are other preferences).

Step 8: Next is to allocate storage space for your hard disk. Choose if you want a flexible or fixed space.

Step 9: Choose the file location and size and create.

Step 10: Click Create, and you’ve successfully set up your virtual machine…

Installing Vagrant

To install Vagrant using a graphical user interface (GUI), you will need to download the Vagrant installer from the Vagrant website and then run it. Here are the steps:

Step 1: Go to the Vagrant download page at https://www.vagrantup.com/downloads.html, and under the "Operating System" heading, click on the appropriate “Binary” for your computer. The installer will be downloaded to your computer.

Step 2: Locate the installer file on your computer and double-click it to start the installation process.

Step 3: Follow the prompts in the installer to complete the installation.
Step 2: Once the installation is complete, you can start using Vagrant by opening a terminal or command prompt and typing vagrant.

Setting up the machine

After downloading Vagrant, to confirm that it was successfully installed, open the terminal/cmd of your choice and head to the home directory using the $ cd ~ as in the image below.

Note: ~ is used to move into the home directory in the command line.

List out the files in that directory using the ls command to check if Vagrant was successfully installed.

$ ls

After confirming the installation, create a directory for the Ubuntu setup using the mkdir command below.

$ mkdir Ubuntu_20.04

Change into the directory that you created using the following command:

$ cd Ubuntu_20.04

Run vagrant init ubuntu/focal64 command. Running this command automatically places a Vagrantfile in the directory created above. A Vagrantfile is a file that instructs Vagrant to create new Vagrant machines or boxes. ubuntu/focal64 is an existing Vagrant box for the Linux Ubuntu distribution.

$ vagrant init ubuntu/focal64

Start the Virtual Machine using vagrant up and watch it spin up the Virtual machine.

$ vagrant up

Ensure your VirtualBox looks like this:

Connect to the VM using vagrant ssh

$ vagrant ssh

Conclusion

This tutorial has shown you how to set up your Linux OS (Ubuntu) on Windows using Vagrant and VirtualBox. Vagrant is a great tool and a very easy way of using Ubuntu on Windows rather than having to dual boot. To learn more about Vagrant and VirtualBox, Check out these resources :

DEV Community: Angel Onyebuchi

How to Secure Kubernetes Workloads with Network Policies using Civo and Cilium

What is Civo?

What is Cilium?

What are Kubernetes Network Policies?

How would Civo and Cilium work?

Prerequisites

How to deploy and configure a Kubernetes Network Policy Controller like Cilium using Civo

Step 1: Setting up a Civo Kubernetes cluster

Step 2: Install Cilium on your Civo Kubernetes cluster

Step 3: Verify Cilium Installation

Step 4: Configure Network Policies

Step 5: Verify network policies

Conclusion

Maximizing Your Server's Potential: How to Deploy a LAMP Stack on Debian 11

Prerequisites

Installing LAMP

Step 1 - Updating and Upgrading Package Installer

Step 2 - Install the wget package

Step 3 - Install Apache and other packages

Step 4 - Setup Firewall

Step 5 - Check status to see if Apache is running

Step 6 - Install MySQL

Step 7 - Install PHP

Step 8 - Verify the PHP test page process on your web server :

Step 9 - Restart Apache after making changes.

Conclusion

How to Set Up a Linux OS (Ubuntu) on Windows using VirtualBox and Vagrant

What is Vagrant?

What is VirtualBox?

How would Vagrant and VirtualBox work?

Prerequisite

Installing VirtualBox

Installing Vagrant

Setting up the machine

Conclusion