{"id":21145332,"url":"https://github.com/jsa2/sessions","last_synced_at":"2025-03-14T13:42:31.646Z","repository":{"id":103264617,"uuid":"532757976","full_name":"jsa2/sessions","owner":"jsa2","description":"Presentation dump ","archived":false,"fork":false,"pushed_at":"2024-03-01T16:10:57.000Z","size":5162,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-01-21T07:27:13.551Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jsa2.png","metadata":{"files":{"readme":"readme.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-09-05T05:37:27.000Z","updated_at":"2022-09-05T05:38:47.000Z","dependencies_parsed_at":null,"dependency_job_id":"f7be576d-2b3e-4dfd-89e1-218cb7417e8c","html_url":"https://github.com/jsa2/sessions","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jsa2%2Fsessions","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jsa2%2Fsessions/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jsa2%2Fsessions/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jsa2%2Fsessions/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jsa2","download_url":"https://codeload.github.com/jsa2/sessions/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243589255,"owners_count":20315467,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-20T08:39:34.699Z","updated_at":"2025-03-14T13:42:31.620Z","avatar_url":"https://github.com/jsa2.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"\n\n\n# Open Service Mesh Demo for CNCF (notes dump)\n\nYou can use the following setup snippets to replicate the demo environment used in the demo at *CNCF - Helsinki in September: Kubernetes and cloud native security*\n\n- Provides also a way to setup Grafana and Prometheus for AKS-add-on, as these are not installed by default when using the add-on\n\n--- \n**References** [ from MS Docs](https://docs.microsoft.com/en-us/azure/aks/open-service-mesh-about#capabilities-and-features) \n\n*Open Service Mesh (OSM) is a lightweight, extensible, cloud native service mesh that allows users to uniformly manage, secure, and get out-of-the-box observability features for highly dynamic microservice environments.*\n\n*OSM runs an Envoy-based control plane on Kubernetes and can be configured with SMI APIs. OSM works by injecting an Envoy proxy as a sidecar container with each instance of your application. The Envoy proxy contains and executes rules around access control policies, implements routing configuration, and captures metrics. The control plane continually configures the Envoy proxies to ensure policies and routing rules are up to date and ensures proxies are healthy.*\n\n*The OSM project was originated by Microsoft and has since been donated and is governed by the Cloud Native Computing Foundation [(CNCF)](https://www.cncf.io/).*\n\n\u003e**While not used in this demo, the bookstore demo is good if you want to test SMI policies**\n\u003ehttps://release-v0-11.docs.openservicemesh.io/docs/getting_started/quickstart/manual_demo/\n\n---\n\n- [Open Service Mesh Demo for CNCF (notes dump)](#open-service-mesh-demo-for-cncf-notes-dump)\n- [Deploy MESH enabled cluster with Azure CLI to non-hardened setup](#deploy-mesh-enabled-cluster-with-azure-cli-to-non-hardened-setup)\n  - [Enable OSM monitoring](#enable-osm-monitoring)\n    - [Prometheus](#prometheus)\n    - [Grafana](#grafana)\n  - [Deploy namespaces and meshes](#deploy-namespaces-and-meshes)\n- [labs](#labs)\n  - [Setup IP tracing on multiple windows window](#setup-ip-tracing-on-multiple-windows-window)\n  - [unmeshed to unmeshed - back to labs](#unmeshed-to-unmeshed---back-to-labs)\n  - [unmeshed to meshed- back to labs](#unmeshed-to-meshed--back-to-labs)\n  - [meshed to meshed- back to labs](#meshed-to-meshed--back-to-labs)\n  - [unmeshed to meshed UDP service- back to labs](#unmeshed-to-meshed-udp-service--back-to-labs)\n  - [IMDS and APIserver from meshed - back to labs](#imds-and-apiserver-from-meshed---back-to-labs)\n  - [KALI(HostNetwork)](#kalihostnetwork)\n  - [Clean-up](#clean-up)\n\n![image](https://user-images.githubusercontent.com/58001986/187682699-45a16061-b977-4e8d-9a00-87144c3292bc.png)\n\n\n# Deploy MESH enabled cluster with Azure CLI to non-hardened setup\n\n\n\n```sh\n\nNAME=aksf-$RANDOM\nNAMER=RG-aks-$NAME\nLOCATION=westeurope\nNET=\"AKS-VNET_SR2\"\nTAGS=\"svc=aksdev\"\nACR=honeypot\n\naz group create -n $NAMER \\\n-l $LOCATION \\\n--tags $TAGS\n\n\naz aks create \\\n-n ${NAME} -g ${NAMER} \\\n--enable-managed-identity \\\n--enable-aad \\\n-l $LOCATION  \\\n--enable-azure-rbac \\\n--network-plugin azure \\\n--network-policy azure \\\n--tags $TAGS \\\n--node-vm-size Standard_D4_v5 \\\n--enable-addons \"open-service-mesh\" \\\n\naz aks get-credentials --resource-group $NAMER --name $NAME --admin\n\nkubectl get pod -o=custom-columns=NODE:.spec.nodeName,NAME:.metadata.name --all-namespaces | grep \"osm\"\n\nkubectl describe meshconfig osm-mesh-config -n kube-system  \n\n```\n\n\n## Enable OSM monitoring\n\nhttps://release-v1-0.docs.openservicemesh.io/docs/demos/prometheus_grafana/ \n\nhttps://release-v1-1.docs.openservicemesh.io/docs/guides/observability/metrics/\n\n\n**In new window**\n\n### Prometheus\n\n```sh\n\nhelm repo add prometheus-community https://prometheus-community.github.io/helm-charts\nhelm repo update\nhelm install stable prometheus-community/prometheus\n\nkubectl apply -f templates/monitoring/prometheus.yaml \n# Wait till all the pods are started up\nsleep 30\n\nkubectl get pods --all-namespaces | grep \"prome\"\n\n\n```\n\n### Grafana\n\n```sh\nhelm repo add grafana https://grafana.github.io/helm-charts\nhelm repo update\nhelm install grafana grafana/grafana \n\n   kubectl get secret --namespace default grafana -o jsonpath=\"{.data.admin-password}\" | base64 --decode ; echo\n\n  export POD_NAME=$(kubectl get pods --namespace default -l \"app.kubernetes.io/name=grafana,app.kubernetes.io/instance=grafana\" -o jsonpath=\"{.items[0].metadata.name}\")\n     kubectl --namespace default port-forward $POD_NAME 3000\n\n```\n\n\u003etake note of the output (below is only example, the previous step prints the correct values for output)\n\n\n\n**Setup prometheus as data source**\n\naccess http://localhost:3000 \n\n- If you have followed this tutorial the URL will be http://stable-prometheus-server.default.svc.cluster.local\n\n![](20220831110015.png)  \n\n\u003e You should see following \n\n![](20220831110207.png)  \n\n**Add dashboards**\n\n\u003e Dashboards are from OSM repo\n\nImport following dashboards by copying their JSON contents\n\n![](20220831110748.png)  \n\n- [templates/monitoring/dashboards/osm-mesh-envoy-details.json](templates/monitoring/dashboards/osm-mesh-envoy-details.json)\n- [templates/monitoring/dashboards/osm-control-plane.json](templates/monitoring/dashboards/osm-control-plane.json)\n- [templates/monitoring/dashboards/osm-data-plane-performance.json](templates/monitoring/dashboards/osm-data-plane-performance.json)\n- [templates/monitoring/dashboards/osm-pod-to-service.json](templates/monitoring/dashboards/osm-pod-to-service.json)\n\n\nCheck grafana\n\nexport POD_NAME=$(kubectl get pods -l \"app.kubernetes.io/name=grafana\" -n \"kube-system\" -o jsonpath=\"{.items[0].metadata.name}\")\nkubectl port-forward $POD_NAME 3000\n\n--- \n\n\n## Deploy namespaces and meshes\n\n```sh\n\n#Meshed NGINIX\nkubectl create namespace ngi\nsleep 10\nosm namespace add ngi\nsleep 10\nkubectl apply -f templates/runtime/nginx.yaml \nkubectl apply -f templates/runtime/svcNgi.yaml\nkubectl describe -f templates/runtime/svcNgi.yaml  \nkubectl rollout restart -f templates/runtime/nginx.yaml \nkubectl describe -f templates/runtime/nginx.yaml \nosm metrics enable --namespace ngi\n\n#unmeshed KALI\nkubectl create namespace kali\nkubectl apply -f templates/runtime/kali.yaml \nsleep 10\nkubectl exec --stdin --tty kali -n kali -- /bin/bash -c \"apt update; apt install curl -y; apt install netcat-traditional -y\"\n\n#Meshed KALI\nkubectl create namespace kali2\nosm namespace add kali2\nsleep 10\nosm metrics enable --namespace kali2\nsleep 10\nkubectl apply  -f templates/runtime/kali2.yaml \nsleep 10\nkubectl exec --stdin --tty kali2 -n kali2 -- /bin/bash -c \"apt update; apt install curl -y; apt install netcat-traditional -y\"\n#\n\n#unmeshed NGINX\nkubectl create namespace ngi2\nkubectl apply -f templates/non-meshed/NoMeshnginx.yaml\nkubectl apply -f templates/non-meshed/NoMeshsvcNgi.yaml\nkubectl describe -f templates/non-meshed/NoMeshnginx.yaml\nkubectl describe -f templates/non-meshed/NoMeshsvcNgi.yaml\n\n#UDP SRV in meshed namespace\nkubectl apply -f templates/udpDemo/udpserver.yaml\nkubectl apply -f templates/udpDemo/udpSvc.yaml\n\n## KaliHost\n\nkubectl apply -f templates/attack/kalihost.yaml\nsleep 10\nkubectl exec --stdin --tty kalihost -- /bin/bash -c \"apt update; apt install curl -y\"\n\n#\n\n```\n# labs\n\n![](20220901165551.png)  \n\nScenario | caller | destination | lab\n-|-|-|-\n1| unmeshed KALI | unmeshed NGINX | [LAB](#unmeshed-to-meshed)\n2| unmeshed KALI | meshed NGINX | [LAB](#unmeshed-to-meshed)\n3| meshed KALI | Meshed NGINX | [LAB](#meshed-to-meshed)\n4| unmeshed KALI  | Meshed UDP service (with logs) | [LAB](#unmeshed-to-meshed-udp-service)\n6| Meshed KALI( no HostNetwork) | IMDS | [\"Pods that are onboarded to the mesh that need access to IMDS, Azure DNS, or the Kubernetes API server must have their IP addresses to the global list of excluded outbound IP ranges using\"](https://docs.microsoft.com/en-us/azure/aks/open-service-mesh-about#add-on-limitations) - ❌ not true by default requires that permissive mode is disabled  \u003cbr\u003e -\u003e access [LAB](#imds-and-apiserver-from-meshed---back-to-labs)\n7| Meshed KALI( no HostNetwork) | API server | [\"Pods that are onboarded to the mesh that need access to IMDS, Azure DNS, or the Kubernetes API server must have their IP addresses to the global list of excluded outbound IP ranges using\"](https://docs.microsoft.com/en-us/azure/aks/open-service-mesh-about#add-on-limitations) - ❌ not true by default requires that permissive mode is disabled \u003cbr\u003e -\u003e access [LAB](#imds-and-apiserver-from-meshed---back-to-labs)\n\n\n\n## Setup IP tracing on multiple windows window \n\n[ipTracing](ipTracing.sh)\n\n![](20220901143514.png)  \n\n\n## unmeshed to unmeshed - [back to labs](#labs)\n```sh\nkubectl exec --stdin --tty kali -n kali -- /bin/bash\n# Curl non-meshed service\ncurl nginx2.ngi2.svc.cluster.local:8888 \nexit\n\n```\n\n## unmeshed to meshed- [back to labs](#labs)\n\n```sh\nkubectl exec --stdin --tty kali -n kali -- /bin/bash\n# Curl meshed service\ncurl nginx2.ngi.svc.cluster.local:8888 \nexit\n\n```\n\n## meshed to meshed- [back to labs](#labs)\n```sh\nkubectl exec --stdin --tty kali2 -n kali2 -- /bin/bash\ncurl nginx2.ngi.svc.cluster.local:8888 \nexit\n\n```\n\n## unmeshed to meshed UDP service- [back to labs](#labs)\n```sh\n# on another window open the UDP logs\n kubectl logs -l app=udpsrv -n ngi -f\nkubectl exec --stdin --tty kali2 -n kali2 -- /bin/bash\n# Setup multiple windows as per IP tracing\n# Curl UDP service\necho \"New Message from client\" | nc -u udpsrv.ngi.svc.cluster.local 6000 \nexit\n```\n\n## IMDS and APIserver from meshed - [back to labs](#labs)\n\n\n```sh\nkubectl exec --stdin --tty kali2 -n kali2 -- /bin/bash\n# Curl UDP service\n# This dependes on set=osm.enablePermissiveTrafficPolicy=true\nTOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)\ncurl --header \"Authorization: Bearer ${TOKEN}\" -X GET https://kubernetes.default.svc/api/v1/ --insecure\ncurl -s -H Metadata:true --noproxy \"*\" \"http://169.254.169.254/metadata/instance?api-version=2017-08-01\u0026format=text\"\nexit\n# repeat with \nkubectl delete  -f templates/runtime/kali2.yaml\nkubectl apply  -f templates/runtime/kali2.yaml \nkubectl exec --stdin --tty kali2 -n kali2 -- /bin/bash -c \"apt update; apt install curl -y; apt install netcat-traditional -y\"\nkubectl exec --stdin --tty kali2 -n kali2 -- /bin/bash\nkubectl patch meshconfig osm-mesh-config -n kube-system -p '{\"spec\":{\"traffic\":{\"enablePermissiveTrafficPolicyMode\":false}}}'  --type=merge\n\n\n```\n\n\n\n##  KALI(HostNetwork)\n```sh\nkubectl exec --stdin --tty kalihost -- /bin/bash\n# Run https://github.com/jsa2/AKSdump/tree/main/containerToNode \n \n```\n\n\n\n## Clean-up\n\n```sh\n\nkubectl delete namespace kali\nkubectl delete namespace kali2\nkubectl delete namespace ngi\nkubectl delete namespace ngi2\n\nrm ~/.kube/ -rf\naz group delete -g $NAMER -y --no-wait\n\nG=$(az group list --tag 'svc=aksdev' --query \"[].{name:name}\" -o tsv) \n\nfor res in $G\ndo\n echo \"az group delete --id $res\"\n az group delete --name $res --no-wait -y\ndone\n\n```\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjsa2%2Fsessions","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjsa2%2Fsessions","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjsa2%2Fsessions/lists"}