firewall-controller

README

Firewall Controller

Initial Setup

1. download kubebuilder
2. download kustomize from kustomize
3. init project and run kubebuilder

kubebuilder init --domain metal-stack.io
kubebuilder create api --group firewall --version v1 --kind Network

1. run test

export KUBEBUILDER_ASSETS=~/dev/kubebuilder_2.3.1_linux_amd64/bin
make test

Testing locally

# start kind cluster
kind create cluster

# deploy manifests
k apply -f deploy

# start the controller
bin/firewall-controller --hosts-file ./hosts

# watch results
k describe -n firewall firewall
cat nftables.v4
cat hosts

Suricata

By default only basic statistics are reported via the firewall crd, but if ids is enabled all events can be forwarded to a specified destination.

• The basic statistics a gathered via the unix-command socket of suricata and the iface-stat <vrf10409> command sent to the controlling socket. There is a go library available to make calls to the unix-command socket of suricata: go-suricata
• Forwarding of all events is controlled by the fever daemon Fever which is configured by this controller if IDS is set to enabled.