Runecast Analyzer

This chart deploys Runecast Analyzer with nginx frontend proxy and PostgreSQL backend. For more information about Runecast Analyzer please visit the Runecast website.

• Requirements
• Installation and upgrade
  • OS analysis
  • Upgrade
• Examples
  • Using ingress with SSL termination
  • Running without persistent data
  • Exposing via LoadBalancer on a secure port
  • Installing with OS analysis enabled
• List of values
  • Global values and Runecast
  • Database backend (PostgreSQL)
  • Reverse proxy frontend (nginx)
  • OS analysis
  • Image Scanning
• Usage

Requirements

• Kubernetes cluster
• Helm 3 (Helm 2.2.0+ should work but is not validated)
• 4.7 CPU requests / 10.7 CPU limits
• 15.45 GB RAM requests / 21.2 GB RAM limits
• 61 GB persistent storage

Installation and upgrade

To install Runecast Analyzer with the default settings, follow these steps:

1. Add Runecast Helm repository to Helm repository list:

   helm repo add runecast https://helm.runecast.com/charts

2. Install Runecast Analyzer

   helm upgrade --install runecast-analyzer runecast/runecast-analyzer

To modify the deployment, please use values.yaml file with the required changes or set the individual values directly on the command line. The list of values can be found in the section List of values or displayed by running the following command:

helm show values runecast/runecast-analyzer

You can find several examples of deployment in the Examples paragraph.

OS analysis

OS analysis in Runecast Analyzer requires additional components to be installed. We don’t install them by default to prevent wasting of resources in case you don’t use this capability.

Therefore, in K8s deployment, additional steps are needed besides the standard OS analysis configuration process.

The OS analysis service is contacted by OS agents and needs to be accessible from outside of the cluster. There are multiple ways how to achieve this and it always depends on your infrastructure. The main thing that you need to keep in mind is that the endpoint, where the OS agents will connect, needs to be trusted by the agents. This can be achieved either:

• by providing the agent with the endpoint certificate, which is generated by helm when exposing via LoadBalancer or NodePort

• by the agent using the OS level trust (for example when using Ingress and certificate issued by a trusted CA)

To deploy the application with OS analysis enabled:

1. Prepare a hostname (FQDN or IP address) that will be used by the OS agents to reach the OS analysis service. The hostname should lead to the OS analysis service, which can be exposed on the nodes as a service type NodePort, LoadBalancer (if external loadbalancer is used), or via an Ingress.

2. Deploy the application using a Helm chart with value global.osanalysis.enabled set to true and hostname specified in global.osanalysis.hostname.

3. To configure the OS analysis, continue in the application. Use the hostname from the previous step in the Runecast Address field.

Please see the examples below for more information.

Upgrade

The upgrade can be performed with the same command like the installation described above. Please see any version-specific upgrade instructions below.

To 0.12.0

This version removes the PostgreSQL migration init container and introduces the default database management account. Before upgrading to this version please make sure you are currently on chart version 0.11.0 and above.

To 0.11.0

This version includes upgrade of the PostgreSQL database. Before upgrading to this version make sure you are currently on chart version 0.9 and above.

Examples

To find more information about changing deployment values, please see the Values Files section of the Helm User Guide.

Using ingress with SSL termination

The following example shows how to deploy the application and expose it via Nginx ingress with SSL termination. In production, you will surely use a certificate issued by a trusted certificate authority. Maybe you have a background process (like certmanager), that is issuing the certificates for you, in that case you might skip step 1.

1. Create the secret runecast-analyzer-ingress-tls from the key and the certificate:

   kubectl create secret tls runecast-analyzer-ingress-tls --key </path/to/key_file> --cert </path/to/cert_file>

   To create a self-signed certificate for testing, you can use the following command:

   openssl req -x509 -nodes -newkey rsa:4096 -days 365 -keyout </path/to/key_file> -out </path/to/cert_file> -subj "/CN=localhost"

2. Create the my-values.yaml file with the following content:

   global:
     hostname: rca.local.domain
   nginx:
     ingress:
       enabled: true
       tls:
         - secretName: runecast-analyzer-ingress-tls
           hosts:
             - rca.local.domain

3. Install the application providing the custom my-values.yaml file:

   helm upgrade --install runecast-analyzer runecast/runecast-analyzer -f my-values.yaml

Running without persistent data

By default, the application is installed with Persistent Volumes. If you would like to test the application without persisting data, you can simply disable the persistence storage by setting the respective values:

helm upgrade --install runecast-analyzer runecast/runecast-analyzer \
             --set persistence.enabled=false \
             --set postgresql.persistence.enabled=false \
             --set imagescanning.persistence.enabled=false

Exposing via LoadBalancer on a secure port

1. Create the secret runecast-analyzer-certificate from the key and the certificate:

   kubectl create secret tls runecast-analyzer-certificate --key </path/to/key_file> --cert </path/to/cert_file>

2. Install the application providing the custom values on the command line:

   helm upgrade --install runecast-analyzer runecast/runecast-analyzer \
                --set nginx.service.type="LoadBalancer" \
                --set nginx.service.tls.enabled=true \
                --set nginx.service.tls.existingSecretName="runecast-analyzer-certificate"

Installing with OS analysis enabled

Exposing the service via a Nodeport with self-signed certificate

The service endpoint certificate will be generated during installation and included when generating the OS installation package. The deployed OS agents will explicitly trust the certificate.

1. Set up a hostname that will point to the K8s nodes where the OS analysis service will be exposed.

2. Deploy the application with OS analysis enabled:

   helm upgrade --install runecast-analyzer runecast/runecast-analyzer \
                --set global.osanalysis.enabled=true \
                --set global.osanalysis.hostname="example.cluster.k8s" \
                --set fleet.service.type=NodePort \
                --set fleet.service.nodePort=31443

Exposing the service via Ingress with a custom certificate

The service will be accessed via ingress and the certificate on the ingress is issued from a CA. The ingress secret is either pre-created or automatically created with tools like certmanager.

1. Set up a hostname that will point to the K8s nodes where the ingress controller is running.

2. Deploy the application with OS analysis enabled:

   helm upgrade --install runecast-analyzer runecast/runecast-analyzer \
                --set global.osanalysis.enabled=true \
                --set global.osanalysis.hostname="example.cluster.k8s" \
                --set fleet.ingress.enabled=true \
                --set fleet.ingress.tlsSecretName=runecast-analyzer-fleet-ingress-tls

3. Enable the OS analysis in the application and download the OS installation packages.

4. Replace the osquery-ca.crt file in the installation packages with a CA chain of your CA.

List of values

Global values and Runecast

Database backend (PostgreSQL)

Reverse proxy frontend (nginx)

OS analysis

Image Scanning

Usage

To find out how to configure and use the product, including the required permissions for scanning a Kubernetes cluster, please follow the official documentation available at https://docs.runecast.com/.