Finally, install Glasswall Halo application services. For these charts, ensure you set the image tag to the corresponding tag found in the Release Notes.
The examples below are pre-populated with the tags for v2.13.0.
8.1 - Engine
enable_reversing_labs=""
helm upgrade --install cdrplatform-engine cdrplatform-engine \
--set image.tag=152404 \
--set image.repository=glasswallhub.azurecr.io/cdrplatform-engine \
--set configuration.ENABLE_REVERSING_LABS="${enable_reversing_labs}" \
--set cloud_provider=gcp \
--atomic8.2 - Sync API
helm upgrade --install cdrplatform-sync-api cdrplatform-sync-api \
--set image.tag=151409 \
--set image.repository=glasswallhub.azurecr.io/cdrplatform-sync-api \
--set cloud_provider=gcp8.3 - API Access Service
The API Access service acts as a gateway service to access Glasswall Halo's Synchronous API and Policy API.
It exposes the CDR functionality via HTTP - in your environment you may require this to be done with TLS/SSL via HTTPS, if this is the case follow the instructions to install with TLS/SSL. Otherwise follow the instructions to install without.
8.3A - For deployments without TLS/SSL
helm upgrade --install cdrplatform-api-access cdrplatform-api-access \
--set image.repository=glasswallhub.azurecr.io/cdrplatform-api-access \
--set image.tag=151370 \
--atomic8.3B - For deployments with TLS/SSL
To use SSL certificates on CDR API, create a private key and certificate for the domain to be used.
Create a Kubernetes secret using the key and crt files using the command below. With this command we create a secret with the name "tls-secret" from the files server.key (private key) and server.crt (certificate). The key should not be passphrase protected in this example.
kubectl create secret tls tls-secret --key server.key --cert server.crtThis secret can then be used to enable TLS on the ingress ensuring that the domain name is set on the command below:
helm upgrade --install cdrplatform-api-access cdrplatform-api-access \
--set image.tag=151370 \
--set image.repository=glasswallhub.azurecr.io/cdrplatform-api-access \
--set ingress.tls.enabled=true \
--set ingress.tls.domain=<domain name> \
--set ingress.tls.secretName=tls-secret \
--atomic8.3C - Enable admin access without authentication
When Single Sign-On (SSO) login is not enabled in the Portal, administrative features, such as license management and policy configuration are not accessible. To enable access to these admin features without setting up SSO, deploy the Helm chart with the following configuration.
helm upgrade --install cdrplatform-portal cdrplatform-portal \
--set image.tag=152415 \
--set image.repository=glasswallhub.azurecr.io/cdrplatform-portal \
--set ingress.tls.enabled=true \
--set ingress.tls.domain=${portal_domain} \
--set ingress.tls.secretName=tls-secret \
--set configuration.AutoAdmin="true" \
--atomic8.3D - To enable API Authentication
The Authentication in the CDR Platform is disabled by default, when enabled the authentication will be enabled for both CDR Platform Sync API and Policy API.
If authentication needs to be enabled:
Create 2 secret in Google Secrets Manager, one for the organisation ID and another for Organization tokens. When passing multiple tokens separate them by comma(","), hence make sure the token itself cannot have a comma(",").
The secrets in Google Secrets Manager should follow below naming convention:
The secret for Organisation ID should start with 'organisation' and end with '-id' with a number in between. For example 'organisation0-id', 'organisation1-id', 'organisation2-id' etc.
The secret for organisation tokens should start with 'organisation' and end with '-tokens' with a number in between. For example 'organisation0-tokens', 'organisation2-tokens', 'organisation3-tokens' etc.
Set
configuration.AuthenticationScheme=Basicwhile deploying the helm chart. For example:
helm upgrade --install cdrplatform-api-access cdrplatform-api-access \
--set image.repository=glasswallhub.azurecr.io/cdrplatform-api-access \
--set image.tag=151370 \
--set configuration.AuthenticationScheme=Basic \
--atomic8.4 - Portal
To deploy Portal service, run the commands below.
8.4A - For deployments without TLS/SSL
Note that the <IP-address> mentioned in this command refers to the Load Balancer's public IP address. This can be retrieved through the "Portal & API Access" steps below.
helm upgrade --install cdrplatform-portal cdrplatform-portal \
--set image.repository=glasswallhub.azurecr.io/cdrplatform-portal \
--set configuration.BackendUrl="<IP-address>" \
--set image.tag=152415 \
--set configuration.HaloVersion=2.13.0 \
--set configuration.OIDC=null8.4B - For deployments with TLS/SSL
If TLS needs to be enabled, add the --set ingress.tls.enable_tls=true and --set ingress.tls.domain=<domain name> parameters - in the below example, it will use the same Kubernetes secret that was created for the API Access to retrieve the certificates.
portal_domain=""
helm upgrade --install cdrplatform-portal cdrplatform-portal \
--set image.tag=152415 \
--set image.repository=glasswallhub.azurecr.io/cdrplatform-portal \
--set ingress.tls.enabled=true \
--set ingress.tls.domain=${portal_domain} \
--set ingress.tls.secretName=tls-secret \
--set configuration.BackendUrl="https://${portal_domain}" \
--atomic8.5 - Portal Access
Portal Access acts a backend for Portal. It enables Portal to access Policy API and Sync API.
8.5A - For deployments with TLS/SSL
If TLS needs to be enabled, add the --set ingress.tls.enable_tls=true and --set ingress.tls.domain=<domain name> parameters - in the below example, it will use the same Kubernetes secret that was created for the API Access to retrieve the certificates.
helm upgrade --install cdrplatform-portal-access cdrplatform-portal-access \
--set image.repository=glasswallhub.azurecr.io/cdrplatform-portal-access \
--set image.tag=151425 \
--set ingress.tls.enabled=true \
--set ingress.tls.domain=<domain-name> \
--set ingress.tls.secretName=tls-secret \
--set configuration.AuthenticationScheme=None \
--atomic8.5B - For deployments without TLS/SSL and authentication
helm upgrade --install cdrplatform-portal-access cdrplatform-portal-access \
--set image.repository=glasswallhub.azurecr.io/cdrplatform-portal-access \
--set configuration.AuthenticationScheme=None \
--set image.tag=151425 \
--atomic8.6 - MongoDB
MongoDB operator
helm install community-operator mongodb/community-operator --namespace cdrplatform \
--set operator.version=0.9.0 \
--set agent.version=107.0.0.8465-1MongoDB
helm upgrade -i cdrplatform-mongodb cdrplatform-mongodb -n cdrplatform --atomic \
--set cloud_provider=gcp Retrieve the connection string from the Kubernetes Secret:
kubectl get secret mongodb-cdrplatform-cdrp-user -o jsonpath='{.data.connectionString\.standard}' | base64 -dUpdate the Kubernetes Secrets with the MongoDB connection string (remove and recreate):
kubectl create secret generic cdrplatform-secrets -n cdrplatform --from-literal=mongodb-cdrp-password=<Add-Value> --from-literal=mongodb-admin-password=<Add-Value> --from-literal=mongodb-connectionstring=<Add-Value>8.7 - Policy API
The policy API is to manage policies for Glasswall Halo's content management flags. This is an optional service, install this if you would like to create and use custom polices.
helm upgrade --install cdrplatform-policy-api cdrplatform-policy-api \
--set image.repository=glasswallhub.azurecr.io/cdrplatform-policy-api \
--set image.tag=152379 \
--set cloud_provider=gcpPolicy API swagger page can be accessed using:
http://<ip>/swagger/index.html8.8 - License Management
The License Management service is used to manage licenses in Glasswall Halo.
helm upgrade --install cdrplatform-license-management cdrplatform-license-management -n license-management\
--set image.repository=glasswallhub.azurecr.io/cdrplatform-license-management \
--set image.tag=151509 \
-n license-management8.9 - Clean up Service
Clean up service deletes the original and rebuilt files from the persistent storage after the files are processed.
helm upgrade --install cdrplatform-cleanup cdrplatform-cleanup \
--set image.repository=glasswallhub.azurecr.io/cdrplatform-cleanup \
--set cloud_provider=gcp \
--set image.tag=1513738.10 - Async API
The Asynchronous API can be deployed using the command below. A MongoDB database is a pre-requisite for the Async API.
helm upgrade --install cdrplatform-async-api cdrplatform-async-api \
--set image.tag=151399 \
--set image.repository=glasswallhub.azurecr.io/cdrplatform-async-api \
--set cloud_provider=gcp8.11 - Metrics Collation (Removed from version 2.6.2)
The Metrics Collation service captures events from Glasswall Halo and stores them in MongoDB. Deploy only when using Halo version 2.6.1 and below.
helm upgrade --install cdrplatform-metrics-collation cdrplatform-metrics-collation \
--set image.tag=120018 \
--set image.repository=glasswallhub.azurecr.io/cdrplatform-metrics-collation \
--set cloud_provider=gcp8.12 - Metrics Projection
The Metrics Projection service is used to pull reporting data from MongoDB to display in the Portal UI.
helm upgrade --install cdrplatform-metrics-projection cdrplatform-metrics-projection \
--set image.tag=151712 \
--set image.repository=glasswallhub.azurecr.io/cdrplatform-metrics-projection \
--set cloud_provider=gcp8.13 - Report Extractor
The Report Extractor service extracts analysis reports and publishes them for reporting.
helm upgrade --install cdrplatform-report-extractor cdrplatform-report-extractor \
--set image.tag=151384 \
--set image.repository=glasswallhub.azurecr.io/cdrplatform-report-extractor \
--set cloud_provider=gcp8.14 - Tally Accumulator
The Tally accumulator service tracks and maintains a tally of usage statistics.
helm upgrade --install cdrplatform-tally-accumulator cdrplatform-tally-accumulator \
--set image.tag=151389 \
--set image.repository=glasswallhub.azurecr.io/cdrplatform-tally-accumulator \
--set cloud_provider=gcp8.15 - Storage Monitor Service
The Storage Monitor service provides an API to subscribe and track changes made to documents in a configured storage mechanism such as SharePoint.
TLS needs to be enabled for the Webhook, add the --set ingress.tls.enable_tls=true and --set ingress.tls.domain=<domain name> parameters - in the below example, it will use the same Kubernetes secret that was created for the API Access to retrieve the certificates.
helm upgrade --install cdrplatform-storage-monitor cdrplatform-storage-monitor --wait --atomic \
--set image.tag="152410" \
--set image.repository="glasswallhub.azurecr.io/cdrplatform-storage-monitor" \
--set configuration.DATABASE__Provider="${database_provider}" \
--set configuration.WEBHOOKS__CallbackBaseAddress="https://<domain-name>" \
--set ingress.tls.enabled=true \
--set ingress.tls.domain=<domain-name> \
--set ingress.tls.secretName=tls-secret \
--atomic8.16 - Portal & API Access
Use the command below to determine the External-IP associated with your cluster:
Note: External-IP will be the same as the Public IP address attached to the AWS load balancer.
kubectl get services --namespace cdrplatform nginx-ingress-ingress-nginx-controller --output jsonpath='{.status.loadBalancer.ingress[0].ip}'You can now use the returned IP above to navigate to the Portal and API Documentation.
Note: use HTTPS if TLS is enabled.
Portal: http://<ip>
API Documentation: http://<ip>/swagger/index.htmlCongratulations, you have successfully deployed Glasswall Halo! We would love to get your thoughts on the setup process and how we can improve it, using the feedback option below.