1. F5 Distributed Cloud App Infrastructure Protection (AIP) Support
  2. User Guides
  3. Linux Agent

Distributed Cloud AIP Kubernetes Deployment

Overview

The F5 Distributed Cloud App Infrastructure Protection (AIP) Kubernetes DaemonSet orchestrates the Distributed Cloud AIP containerized Agent. The Kubernetes DaemonSet ensures all nodes run one copy of the Distributed Cloud AIP containerized Agent.

By default, the following rulesets are applied to the Kubernetes DaemonSet:

  • Base Rule Set
  • Docker Rule Set
  • Kubernetes Rule Set

    Note

    If the customer uses File Integrity Monitoring (FIM) rules to create exclusions with Agent 1.8.0C, then they must prepend /threatstackfs to the exclude path. For example, to exclude /tmp/bad, the exclusion becomes /threatstackfs/tmp/bad.

Prerequisites for Deploying Containerized Agent

From the Command Line, enter the following commands to stop and disable auditd:

sudo systemctl stop auditd
sudo systemctl disable auditd
System Consideration for the Containerized Agent

To optimize performance of your containerized Agent, we recommend configuring your host following these guidelines:

  • Allocate enough host memory to run a 256 mebibyte (MiB) application.
    • It can be increased to 384MiB or more for performance as necessary.

    Tip

    Specify limits for CPU and memory values the Agent can utilize. For more information about the minimum and maximum ranges for these values, see:

  • Ability to disable auditd on the host to ensure all Agent services run, including the Audit Collection Service.
  • Configure outbound network connectivity over port 443.
  • Allow the container to mount a file system on the host.
Deploy Containerized Agent Using Helm Chart

Helm is a package manager on top of Kubernetes. It facilitates installation, upgrades, and manages dependencies for the services you install in Kubernetes.

Important

  • The Distributed Cloud AIP Agent Helm chart installation repository version 2.0.0 only works with Linux Containerized Agents version 2.3.0 and newer. If you deploy an older version of the Linux Containerized Agent, then use the Distributed Cloud AIP Agent Helm chart installation repository version 1.x.
  • The Distributed Cloud AIP Agent Helm chart installation repository is provided as-is. Distributed Cloud AIP support is unable to assist you with changes you make to files in the repository, custom Helm charts or provide recommendations on modifications to your environment.
  • Linux Agents 2.2 and later include a reference script that by default deploys the Agent to all nodes in the target cluster.

Prerequisites

  • Helm v2 or Helm v3 installed
    • If using Helm v2, ensure the cluster component tiller is installed.

The Helm chart version is independent of the version of the Agent packaged/installed by the chart. The version of the application to be installed by the Helm chart is defined by Helm's appVersion field.

Install the Helm Chart

These instructions assume you already have Helm installed in your environment. It also assumes any Role-Based Access Control (RBAC) configuration has been completed for proper operation of Helm. Please see Installing Helm for instructions on installing Helm in your environment.

Local Installation

The instructions below assume the Helm chart has been released to a repository. Alternatively, you can clone Distributed Cloud AIP's Git repository and run helm package in the repository's root to get a .tgz file built locally.

Important

  • When performing a local installation, do not add the Helm repository as directed in step 1 of the installing using publicly released chart section below. Omit--repo https://pkg.threatstack.com/helmfrom any command. Replace the chart name from threatstack-agent to <PATH_TO_CHART>/threatstack-agent-<VERSION>.tgz</VERSION> in the Helm commands.
  • Creating a local Helm chart does not sign it. Any verification of the provenance of the chart will fail.

Install Using Publicly Released Chart

The Distributed Cloud AIP Agent Helm chart follows the standard installation process for charts:

  1. Add the Distributed Cloud AIP Agent Helm repository to your local Helm configuration using the following command: 
    helm repo add threatstack https://pkg.threatstack.com/helm
  2. Using the default values.yaml, create a local yaml that overrides the configuration as desired or needed for the target cluster.
  3. Install the Distributed Cloud AIP Agent with Helm.
    • Helm 2: 
      helm install --name <HELM_RELEASE_NAME> --values ./<values-override-filename>.yaml threatstack/threatstack-agent
    • Helm 3: 
      helm install <HELM_RELEASE_NAME> --values ./<values-override-filename>.yaml threatstack/threatstack-agent

Integrations

Once the Agent has been deployed, you can configure Distributed Cloud AIP to integrate with notification platforms such as PagerDuty, Slack, VictorOps, and Webhooks.

Update the Helm Chart

To update the Helm chart, run the following command:

helm upgrade <HELM_RELEASE_NAME> threatstack/threatstack-agent

Uninstall the Helm Chart

To uninstall the Helm chart, run the following command:

helm delete <HELM_RELEASE_NAME>

Configuration Settings

The following values/settings are important for the Helm chart. They can be modified for each target environment:

  • image.repository: Indicates the Docker repository for the container image to install. It defaults to Distributed Cloud AIP's official Docker hub repository for the Agent.

    Note

    Changing this could lead to pulling an unofficial or incorrect image, and is strongly discouraged.

  • image.version: Indicates the Docker tag for the container image to install. It defaults to Distributed Cloud AIP's latest official Docker image version for the Agent at the time the chart was released.

    Note

    Changing this could lead to pulling an unofficial or incorrect image, and is strongly discouraged.

  • gkeContainerOs: If true, the Daemonset definition will be modified to execute commands for the Agent to work correctly on Google Kubernetes Engine (GKE) with ContainerOS nodes. It defaults to false.
  • gkeUbuntu: If true, the Daemonset definition will be modified to execute commands for the Agent to work correctly on GKE with Ubuntu nodes. It defaults to false.
  • customDaemonsetCmd: Uncomment the command and args sub-attributes, and define them as desired to run custom commands in the Daemonset.
    • Example
      To turn off and disable auditd on the host and allow the container agent to monitor activity: 
      customDaemonsetCmd:
  command: ["bash"]
  args: ["-c", "chroot /threatstackfs /bin/bash -c 'service auditd stop >/dev/null || systemctl stop auditd; systemctl disable auditd'; eval tsagent setup $THREATSTACK_SETUP_ARGS; eval tsagent config --set $THREATSTACK_CONFIG_ARGS; sleep 5; /opt/threatstack/sbin/tsagentd -logstdout"]

    Important

    Setting customDaemonsetCmd improperly can result in the Distributed Cloud AIP Agent not running correctly.

  • rbac.create: If true, it will create the needed service account to run. If false, the chart will leverage the service account defined in rbac.serviceAccountName.
  • imagePullSecrets: If pulling the Agent from a private/internal Docker registry that requires credentials, you will need to add the name of your Docker credentials Secret to this array. This Secret needs to be defined outside of installing this Helm chart. It defaults to an empty array which will only work with public registries.
  • rulesets: The list of Distributed Cloud AIP rulesets that the Agent container should run with. The single-quotes in the double-quotes are intentional and not optional.
  • additionalSetupConfig: A list of command line arguments used when the Agent container registers itself with Distributed Cloud AIP.
  • additionalConfig: A list of command line arguments used when the Agent container starts running.
  • nodeSelector: The reference scripts for Linux Agents 2.2 and later default this value to empty. If you do not change this value, then Helm will deploy to all nodes in the cluster.
Deploy Containerized Agent 3.x Series Using Kubernetes DaemonSet
Agent 3.2.0
  1. Create the Kubernetes DaemonSet file.
    1. Download a sample Distributed Cloud AIP Kubernetes DaemonSet .yaml file.
    2. Make any changes to the sample file necessary for your environment.
    3. Include your unique deploy key or the name of a pre-created Secret.
    4. Save the file as “TSKubernetesDaemonSet.yaml”.
  2. Deploy the Distributed Cloud AIP containerized Agent using the Kubernetes DaemonSet.
    1. Go to the Command Line.
    2. Type or copy and paste the following command and press ENTER: 
      kubectl create -f TSKubernetesDaemonSet.yaml
  3. Confirm the containerized Agent deployed correctly.
    1. Log into Distributed Cloud AIP.
    2. Ensure events display as expected.
Agent 3.1.1
  1. Create the Kubernetes DaemonSet file.
    1. Download a sample Distributed Cloud AIP Kubernetes DaemonSet .yaml file.
    2. Make any changes to the sample file necessary for your environment.
    3. Include your unique deploy key or the name of a pre-created Secret.
    4. Save the file as “TSKubernetesDaemonSet.yaml”.
  2. Deploy the Distributed Cloud AIP containerized Agent using the Kubernetes DaemonSet.
    1. Go to the Command Line.
    2. Type or copy and paste the following command and press ENTER: 
      kubectl create -f TSKubernetesDaemonSet.yaml
  3. Confirm the containerized Agent deployed correctly.
    1. Log into Distributed Cloud AIP.
    2. Ensure events display as expected.
Agent 3.1.0
  1. Create the Kubernetes DaemonSet file.
    1. Download a sample Distributed Cloud AIP Kubernetes DaemonSet .yaml file.
    2. Make any changes to the sample file necessary for your environment.
    3. Include your unique deploy key or the name of a pre-created Secret.
    4. Save the file as “TSKubernetesDaemonSet.yaml”.
  2. Deploy the Distributed Cloud AIP containerized Agent using the Kubernetes DaemonSet.
    1. Go to the Command Line.
    2. Type or copy and paste the following command and press ENTER: 
      kubectl create -f TSKubernetesDaemonSet.yaml
  3. Confirm the containerized Agent deployed correctly.
    1. Log into Distributed Cloud AIP.
    2. Ensure events display as expected.
Agent 3.0.0
  1. Create the Kubernetes DaemonSet file.
    1. Download a sample Distributed Cloud AIP Kubernetes DaemonSet .yaml file.
    2. Make any changes to the sample file necessary for your environment.
    3. Include your unique deploy key or the name of a pre-created Secret.
    4. Save the file as “TSKubernetesDaemonSet.yaml”.
  2. Deploy the Distributed Cloud AIP containerized Agent using the Kubernetes DaemonSet.
    1. Go to the Command Line.
    2. Type or copy and paste the following command and press ENTER: 
      kubectl create -f TSKubernetesDaemonSet.yaml
  3. Confirm the containerized Agent deployed correctly.
    1. Log into Distributed Cloud AIP.
    2. Ensure events display as expected.
Deploy Containerized Agent 2.x Series Using Kubernetes DaemonSet
Agent 2.5.0
  1. Create the Kubernetes DaemonSet file.
    1. Download a sample Distributed Cloud AIP Kubernetes DaemonSet .yaml file.
    2. Make any changes to the sample file necessary for your environment.
    3. Include your unique deploy key or the name of a pre-created Secret.
    4. Save the file as “TSKubernetesDaemonSet.yaml”.
  2. Deploy the Distributed Cloud AIP containerized Agent using the Kubernetes DaemonSet.
    1. Go to the Command Line.
    2. Type or copy and paste the following command and press ENTER: 
      kubectl create -f TSKubernetesDaemonSet.yaml
  3. Confirm the containerized Agent deployed correctly.
    1. Log into Distributed Cloud AIP.
    2. Ensure events display as expected.
Agent 2.4.1
  1. Create the Kubernetes DaemonSet file.
    1. Download a sample Distributed Cloud AIP Kubernetes DaemonSet .yaml file.
    2. Make any changes to the sample file necessary for your environment.
    3. Include your unique deploy key or the name of a pre-created Secret.
    4. Save the file as “TSKubernetesDaemonSet.yaml”.
  2. Deploy the Distributed Cloud AIP containerized Agent using the Kubernetes DaemonSet.
    1. Go to the Command Line.
    2. Type or copy and paste the following command and press ENTER: 
      kubectl create -f TSKubernetesDaemonSet.yaml
  3. Confirm the containerized Agent deployed correctly.
    1. Log into Distributed Cloud AIP.
    2. Ensure events display as expected.
Agent 2.4.0
  1. Create the Kubernetes DaemonSet file.
    1. Download a sample Distributed Cloud AIP Kubernetes DaemonSet .yaml file.
    2. Make any changes to the sample file necessary for your environment.
    3. Include your unique deploy key or the name of a pre-created Secret.
    4. Save the file as “TSKubernetesDaemonSet.yaml”.
  2. Deploy the Distributed Cloud AIP containerized Agent using the Kubernetes DaemonSet.
    1. Go to the Command Line.
    2. Type or copy and paste the following command and press ENTER: 
      kubectl create -f TSKubernetesDaemonSet.yaml
  3. Confirm the containerized Agent deployed correctly.
    1. Log into Distributed Cloud AIP.
    2. Ensure events display as expected.
Agent 2.3.4
  1. Create the Kubernetes DaemonSet file.
    1. Download a sample Distributed Cloud AIP Kubernetes DaemonSet .yaml file.
    2. Make any changes to the sample file necessary for your environment.
    3. Include your unique deploy key or the name of a pre-created Secret.
    4. Save the file as “TSKubernetesDaemonSet.yaml”.
  2. Deploy the Distributed Cloud AIP containerized Agent using the Kubernetes DaemonSet.
    1. Go to the Command Line.
    2. Type or copy and paste the following command and press ENTER: 
      kubectl create -f TSKubernetesDaemonSet.yaml
  3. Confirm the containerized Agent deployed correctly.
    1. Log into Distributed Cloud AIP.
    2. Ensure events display as expected.
Agent 2.3.3
  1. Create the Kubernetes DaemonSet file.
    1. Download a sample Distributed Cloud AIP Kubernetes DaemonSet .yaml file.
    2. Make any changes to the sample file necessary for your environment.
    3. Include your unique deploy key or the name of a pre-created Secret.
    4. Save the file as “TSKubernetesDaemonSet.yaml”.
  2. Deploy the Distributed Cloud AIP containerized Agent using the Kubernetes DaemonSet.
    1. Go to the Command Line.
    2. Type or copy and paste the following command and press ENTER: 
      kubectl create -f TSKubernetesDaemonSet.yaml
  3. Confirm the containerized Agent deployed correctly.
    1. Log into Distributed Cloud AIP.
    2. Ensure events display as expected.
Agent 2.3.2
  1. Create the Kubernetes DaemonSet file.
    1. Download a sample Distributed Cloud AIP Kubernetes DaemonSet .yaml file.
    2. Make any changes to the sample file necessary for your environment.
    3. Include your unique deploy key or the name of a pre-created Secret.
    4. Save the file as “TSKubernetesDaemonSet.yaml”.
  2. Deploy the Distributed Cloud AIP containerized Agent using the Kubernetes DaemonSet.
    1. Go to the Command Line.
    2. Type or copy and paste the following command and press ENTER: 
      kubectl create -f TSKubernetesDaemonSet.yaml
  3. Confirm the containerized Agent deployed correctly.
    1. Log into Distributed Cloud AIP.
    2. Ensure events display as expected.
Agent 2.3.1
  1. Create the Kubernetes DaemonSet file.
    1. Download a sample Distributed Cloud AIP Kubernetes DaemonSet .yaml file.
    2. Make any changes to the sample file necessary for your environment.
    3. Include your unique deploy key or the name of a pre-created Secret.
    4. Save the file as “TSKubernetesDaemonSet.yaml”.
  2. Deploy the Distributed Cloud AIP containerized Agent using the Kubernetes DaemonSet.
    1. Go to the Command Line.
    2. Type or copy and paste the following command and press ENTER: 
      kubectl create -f TSKubernetesDaemonSet.yaml
  3. Confirm the containerized Agent deployed correctly.
    1. Log into Distributed Cloud AIP.
    2. Ensure events display as expected.
Agent 2.3.0
  1. Create the Kubernetes DaemonSet file.
    1. Download a sample Distributed Cloud AIP Kubernetes DaemonSet .yaml file.
    2. Make any changes to the sample file necessary for your environment.
    3. Include your unique deploy key or the name of a pre-created Secret.
    4. Save the file as “TSKubernetesDaemonSet.yaml”.
  2. Deploy the Distributed Cloud AIP containerized Agent using the Kubernetes DaemonSet.
    1. Go to the Command Line.
    2. Type or copy and paste the following command and press ENTER: 
      kubectl create -f TSKubernetesDaemonSet.yaml
  3. Confirm the containerized Agent deployed correctly.
    1. Log into Distributed Cloud AIP.
    2. Ensure events display as expected.
Agent 2.2.x
  1. Create the Kubernetes DaemonSet file.
    1. Download a sample Distributed Cloud AIP Kubernetes DaemonSet .yaml file.
    2. Make any changes to the sample file necessary for your environment.
    3. Include your unique deploy key or the name of a pre-created Secret.
    4. Save the file as “TSKubernetesDaemonSet.yaml”.
  2. Deploy the Distributed Cloud AIP containerized Agent using the Kubernetes DaemonSet.
    1. Go to the Command Line.
    2. Type or copy and paste the following command and press ENTER: 
      kubectl create -f TSKubernetesDaemonSet.yaml
  3. Confirm the containerized Agent deployed correctly.
    1. Log into Distributed Cloud AIP.
    2. Ensure events display as expected.
Agent 2.2.0
  1. Create the Kubernetes DaemonSet file.
    1. Download a sample Distributed Cloud AIP Kubernetes DaemonSet.yaml file.
    2. Make any changes to the sample file necessary for your environment.
    3. Include your unique deploy key or the name of a pre-created Secret.
    4. Save the file as “TSKubernetesDaemonSet.yaml”.
  2. Deploy the Distributed Cloud AIP containerized Agent using the Kubernetes DaemonSet.
    1. Go to the Command Line.
    2. Type or copy and paste the following command and press ENTER: 
      kubectl create -f TSKubernetesDaemonSet.yaml
  3. Confirm the containerized Agent deployed correctly.
    1. Log into Distributed Cloud AIP.
    2. Ensure events display as expected.
Agent 2.1.x

Note

We have removed the requirement of labeling one of your nodes as threatstack-master. One node will automatically have two agents deployed to it, with one of the agents dedicated solely to Kubernetes events.

  1. Create the Kubernetes DaemonSet file.
    1. Download a sample Distributed Cloud AIP Kubernetes DaemonSet.yaml file.
      1. For Agent 2.1.3
      2. For Agent 2.1.2
      3. For Agent 2.1.1
    2. Make any changes to the sample file necessary for your environment
    3. Include your unique deploy key.
    4. Save the file as “TSKubernetesDaemonSet.yaml”.
  2. Deploy the Distributed Cloud AIP containerized Agent using the Kubernetes DaemonSet.
    1. Go to the Command Line.
    2. Type or copy and paste the following command and press ENTER: 
      kubectl create -f TSKubernetesDaemonSet.yaml
  3. Confirm the containerized Agent deployed correctly.
    1. Log into Distributed Cloud AIP.
    2. Ensure events display as expected.
Agent 2.1
  1. Create the Kubernetes DaemonSet file.
    1. Download a sample Distributed Cloud AIP Kubernetes DaemonSet .yaml file.
    2. Make any changes to the sample file necessary for your environment.
    3. Include your unique deploy key.
    4. Save the file as “TSKubernetesDaemonSet.yaml”.
  2. If you want to use Distributed Cloud AIP's enhanced visibility into Kubernetes, then designate one of your nodes as the master node. The master node communicates with the Kubernetes API.
    1. Go to the Command Line.
    2. Type or copy and paste the following command and press ENTER. 
      kubectl label nodes <Node_Name> threatstack-master="true"

      Replace <Node Name> with the name of the node you want to designate as the master.

      Important

      If you designate more than one node as the master, then you will receive duplicate events.

  3. Deploy the Distributed Cloud AIP containerized Agent using the Kubernetes DaemonSet.
    1. Go to the Command Line.
    2. Type or copy and paste the following command and press ENTER: 
      kubectl create -f TSKubernetesDaemonSet.yaml
  4. Confirm the containerized Agent deployed correctly.
    1. Log into Distributed Cloud AIP.
    2. Ensure events display as expected.
Agent 2.0
  1. Create the Kubernetes DaemonSet file.
    1. Download a sample Distributed Cloud AIP Kubernetes DaemonSet .yaml file.
    2. Make any changes to the sample file necessary for your environment.
    3. Include your unique deploy key.
    4. Save the file as “TSKubernetesDaemonSet.yaml”.
  2. Deploy the Distributed Cloud AIP containerized Agent using the Kubernetes DaemonSet.
    1. Go to the Command Line.
    2. Type or copy and paste the following command and press ENTER: 
      kubectl create -f TSKubernetesDaemonSet.yaml
  3. Confirm the containerized Agent deployed correctly.
    1. Log into Distributed Cloud AIP.
    2. Ensure events display as expected.
Was this article helpful?
1 out of 1 found this helpful

Table of Contents

Related articles