Version: 2.10.0

Install CDR Components

Finally, install the CDR application services. For these charts, ensure you set the image tag to the corresponding tag found in the release notes.

The examples below are pre-populated with the tags for v2.10.0:

Engine

To integrate Halo with Reversing Labs, set the enable_reversing_labs variable to true below. Make sure to create Reversing Labs secrets in the AWS Secrets Manager as mentioned in the Step 3.

enable_reversing_labs=""
helm upgrade --install cdrplatform-engine cdrplatform-engine \
  --set image.tag=141890 \
  --set image.repository=glasswallhub.azurecr.io/cdrplatform-engine \
  --set configuration.ENABLE_REVERSING_LABS="${enable_reversing_labs}" \
  --set cloud_provider=aws \
  --timeout 10m \
  --atomic

Sync API

helm upgrade --install cdrplatform-sync-api cdrplatform-sync-api \
  --set image.tag=140931 \
  --set image.repository=glasswallhub.azurecr.io/cdrplatform-sync-api \
  --set cloud_provider=aws

API Access service

The API Access service acts as a gateway service to access CDR Platform Sync API and Policy API. It exposes the CDR functionality via HTTP - in your environment you may require this to be done with TLS/SSL via HTTPS, if this is the case follow the instructions to install with TLS/SSL. Otherwise follow the instructions to install without.

For deployments without TLS/SSL

helm upgrade --install cdrplatform-api-access -n cdrplatform cdrplatform-api-access \
 --set image.repository=glasswallhub.azurecr.io/cdrplatform-api-access \
 --set image.tag=141985 \
 --atomic

To use SSL certificates on CDR API, create a private key and certificate for the domain to be used.

Create a Kubernetes secret using the key and crt files using the command below. With this command we create a secret with the name "tls-secret" from the files server.key (private key) and server.crt (certificate). The key should not be passphrase protected in this example.

kubectl create secret tls tls-secret --key server.key --cert server.crt

This secret can then be used to enable TLS on the ingress ensuring that the domain name is set on the command below:

helm upgrade --install cdrplatform-api-access -n cdrplatform cdrplatform-api-access \
 --set image.repository=glasswallhub.azurecr.io/cdrplatform-api-access \
 --set image.tag=141985 \
 --set cloud_provider=aws \
 --set ingress.tls.enabled=true \
 --set ingress.tls.domain=<domain name> \
 --set ingress.tls.secretName=tls-secret \
 --atomic

To enable API authentication

The Authentication in the CDR Platform API is disabled by default. If authentication needs to be enabled -

Create secrets in AWS Secrets manager, one for the organisation ID and another for Orgnization tokens. When passing multiple tokens seperate them by comma(","), hence make sure the token itself cannot have a comma(",").
The secrets in AWS Secrets manager should follow below naming convention
- The secret for organisation ID should start with organisation and end with -id with a number in between. For example organisation0-id, organisation1-id, organisation2-id etc.
- The secret for organisation tokens should start with organisation and end with -tokens with a number in between. For example organisation0-tokens, organisation2-tokens, organisation3-tokens etc.
Set configuration.AuthenticationScheme=Basic while deploying the helm chart. For example,

helm upgrade --install cdrplatform-api-access -n cdrplatform cdrplatform-api-access \
  --set image.repository=glasswallhub.azurecr.io/cdrplatform-api-access \
  --set image.tag=141985 \
  --set configuration.AuthenticationScheme=Basic \
  --atomic 

MongoDB

Note: If you have previously configured and setup MongoDB within AWS and if you do not wish to manage and install MongoDB within your cluster, you can skip this step, and proceed to installing the Portal Services below.

MongoDB operator

helm install community-operator mongodb/community-operator --namespace cdrplatform \
  --set operator.version=0.9.0 \
  --set agent.version=107.0.0.8465-1 \
  --atomic

MongoDB

helm upgrade -i cdrplatform-mongodb cdrplatform-mongodb -n cdrplatform --atomic \
  --set cloud_provider=aws

After the MongoDB is deployed, get the connection string of the MongoDB and add it to the AWS Secrets manager.

Retreive the connection string from the k8s secret

kubectl get secret mongodb-cdrplatform-cdrp-user -o jsonpath='{.data.connectionString\.standard}' | base64 -d

Create a new secret in the AWS Secrets Manager with the MongoDB connection string.

aws secretsmanager create-secret --name "mongodb-connectionstring" --secret-string "<output-from-previous-step>" --region "${region}"

Portal

To deploy Portal service, run below commands.

For deployments without TLS/SSL

Note that the <IP-address> mentioned in this command refers to the Load Balancer's public IP address. This can be retrieved through the "Portal & API Access" steps below

helm upgrade --install cdrplatform-portal cdrplatform-portal \
  --set image.repository=glasswallhub.azurecr.io/cdrplatform-portal \
  --set configuration.OIDC=null \
  --set image.tag=141353 \
  --set configuration.BackendUrl=http://<IP-address> \
  --set configuration.HaloVersion=2.10.0 \
  --atomic

For deployments with TLS/SSL

If TLS needs to be enabled, add the --set ingress.tls.enable_tls=true and --set ingress.tls.domain=<domain name> parameters - in the below example, it will use the same Kubernetes secret that was created for the API Access to retrieve the certificates.

helm upgrade --install cdrplatform-portal cdrplatform-portal \
  --set image.tag=141353 \
  --set image.repository=glasswallhub.azurecr.io/cdrplatform-portal \
  --set ingress.tls.enabled=true \
  --set ingress.tls.domain=<domain name> \
  --set ingress.tls.secretName=tls-secret \
  --set configuration.BackendUrl=https://<domain name> \
  --set configuration.OIDC=null \
  --set configuration.HaloVersion=2.10.0 \
  --atomic

To configure Halo Portal to authenticate APIs

If API authentication is enabled, replace <organisation1-id> and <organisation1-tokens> with the appropriate secret names created in the AWS Secrets manager.

helm upgrade --install cdrplatform-portal cdrplatform-portal \
  --set image.tag=141353 --set image.repository=glasswallhub.azurecr.io/cdrplatform-portal \
  --set configuration.EnableAuth=true \
  --set AuthSecrets.orgIdKey=<organisation1-id> \
  --set AuthSecrets.orgTokenKey=<organisation1-tokens> \
  --atomic

Policy API

The policy API is to manage policies for CDR Platform content management flags. This is an optional service, install this if you would like to create and use custom polices.

helm upgrade --install cdrplatform-policy-api  cdrplatform-policy-api \
  --set image.repository=glasswallhub.azurecr.io/cdrplatform-policy-api \
  --set image.tag=141461 --set cloud_provider=aws \
  --atomic

Policy API swagger page can be accessed using

http://<ip>/swagger/index.html

Portal Access

Portal Access acts as a backend for Portal. It enables Portal to access Policy API and Sync API

For deployments with TLS/SSL

helm upgrade --install cdrplatform-portal-access cdrplatform-portal-access \
  --set image.repository=glasswallhub.azurecr.io/cdrplatform-portal-access \
  --set image.tag=140258 \
  --set ingress.tls.enabled=true \
  --set ingress.tls.domain=<domain-name> \
  --set ingress.tls.secretName=tls-secret \
  --set configuration.AuthenticationScheme=None \
  --atomic

For deployments without TLS/SSL

helm upgrade --install cdrplatform-portal-access cdrplatform-portal-access \
  --set image.repository=glasswallhub.azurecr.io/cdrplatform-portal-access \
  --set configuration.AuthenticationScheme=None \
  --set image.tag=140258 \
  --atomic

License management

License management service is used to manage the license in the CDR Platform

helm upgrade --install cdrplatform-license-management cdrplatform-license-management -n license-management \
  --set image.repository=glasswallhub.azurecr.io/cdrplatform-license-management \
  --set image.tag=137274 \
  --set cloud_provider=aws \
  --atomic

Clean up service

Clean up service deletes the original and rebuilt files from the persistent storage after the files are processed

helm upgrade --install cdrplatform-cleanup cdrplatform-cleanup \
  --set image.repository=glasswallhub.azurecr.io/cdrplatform-cleanup \
  --set image.tag=137267 \
  --set cloud_provider=aws \
  --atomic

Async API

The Asynchronous API can be deployed using the command below. A MongoDB database is a pre-requisite for the Async API.

helm upgrade --install cdrplatform-async-api cdrplatform-async-api \
  --set image.tag=140934 \
  --set image.repository=glasswallhub.azurecr.io/cdrplatform-async-api \
  --set cloud_provider=aws \
  --atomic

## Metrics collation (Removed from version 2.6.2)

Deploy only when using Halo version 2.6.1 and below.

Create collection and enable Change Streams

MongoDB (AWS DocumentDB) doesn't enabled Change Streams for collections by default. See AWS documentation for more details. To enable Change Streams, run

mongosh <mongodb-connection-string>
use cdrplatform
db.createCollection('CDRMetricsCollection')
db.adminCommand({
    modifyChangeStreams: 1,
    database: "cdrplatform",
    collection: "CDRMetricsCollection", 
    enable: true
});

Metrics collation service captures events from the CDRPlatform and stores in MongoDB.

helm upgrade --install cdrplatform-metrics-collation cdrplatform-metrics-collation \
  --set image.tag=120018 \
  --set image.repository=glasswallhub.azurecr.io/cdrplatform-metrics-collation \
  --set cloud_provider=aws \
  --atomic

Metrics projection

Metrics projection service is used to pull reporting data from MongoDB to display in the Portal UI.

helm upgrade --install cdrplatform-metrics-projection cdrplatform-metrics-projection \
  --set image.tag=141124 \
  --set image.repository=glasswallhub.azurecr.io/cdrplatform-metrics-projection \
  --set cloud_provider=aws \
  --atomic

Report extractor

Report extractor service extracts analysis reports and publish them for reporting.

helm upgrade --install cdrplatform-report-extractor cdrplatform-report-extractor \
  --set image.tag=138596 \
  --set image.repository=glasswallhub.azurecr.io/cdrplatform-report-extractor \
  --set cloud_provider=aws \
  --atomic

Tally Accumulator

The Tally accumulator service tracks and maintains a tally of usage statistics.

helm upgrade --install cdrplatform-tally-accumulator cdrplatform-tally-accumulator \
  --set image.tag=139233 \
  --set image.repository=glasswallhub.azurecr.io/cdrplatform-tally-accumulator
  --set cloud_provider=aws \
  --atomic

Portal & API Access

Use the below command to determine the External-IP associated with your cluster:

External-IP will be the same as Public IP address attached to the AWS load balancer.

kubectl get services --namespace cdrplatform nginx-ingress-ingress-nginx-controller --output jsonpath='{.status.loadBalancer.ingress[0].hostname}'

You can now use the IP returned above to navigate to the Portal and API documentation (use https if TLS enabled):

Portal: http://<ip>
API Documentation: http://<ip>/swagger

Engine​

Sync API​

API Access service​

For deployments without TLS/SSL​

To use SSL certificates on CDR API, create a private key and certificate for the domain to be used.​

To enable API authentication​

MongoDB​

MongoDB operator​

MongoDB​

Portal​

For deployments without TLS/SSL​

For deployments with TLS/SSL​

To configure Halo Portal to authenticate APIs​

Policy API​

Portal Access​

For deployments with TLS/SSL​

For deployments without TLS/SSL​

License management​

Clean up service​

Async API​

Create collection and enable Change Streams​

Metrics projection​

Report extractor​

Tally Accumulator​

Portal & API Access​

Engine

Sync API

API Access service

For deployments without TLS/SSL

To use SSL certificates on CDR API, create a private key and certificate for the domain to be used.

To enable API authentication

MongoDB

MongoDB operator

MongoDB

Portal

For deployments without TLS/SSL

For deployments with TLS/SSL

To configure Halo Portal to authenticate APIs

Policy API

Portal Access

For deployments with TLS/SSL

For deployments without TLS/SSL

License management

Clean up service

Async API

Create collection and enable Change Streams

Metrics projection

Report extractor

Tally Accumulator

Portal & API Access