Deploying NeuVector via Helm on minikube
Tags: minikube, suse, tutorial, lab
Published: 2024-02-29 19:26:54


## Summary

The following will walk through the necessary steps to deploy NueVector via Helm. This can be done locally or on a virtual machine. I am using minikube to test on, but K3S/MicroK8s or any other distros will work. Since this is going to be scaled down, we will also limit the replicas. 

I'm going to leverage `multipass` during this to spin up the necessary resource, but any other solution should work. 

### Prerequisites

**Required:**
- A Virtual Machine
	- I will use `multipass`, which can launch an instance with minikube already installed.

That is really about it for this to get started. 

## Set up Virtual Machine

Since I have multipass installed, I will launch a new vm using the existing minikube image. 

`multipass launch -c 8 -m 16G -n demo minikube`

```
multipass launch -c 8 -m 16G -n demo minikube                                                
Waiting for initialization to complete \
```

Once completed, you should get a launched. 

```
multipass launch -c 8 -m 16G -n demo minikube                                    
Launched: demo
```

Running a `multipass list`, will output all the launched virtual machines. 

```
demo                    Running           192.168.64.20    Ubuntu 22.04 LTS
                                          172.17.0.1
                                          192.168.49.1
```

## NeuVector Setup

Connect to the virtual machine, in my case, it is  `multipass shell minikube`. 

```
Welcome to Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-92-generic aarch64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

  System information as of Thu Feb 29 09:16:40 EST 2024

  System load:                      1.5546875
  Usage of /:                       13.2% of 38.59GB
  Memory usage:                     6%
  Swap usage:                       0%
  Processes:                        199
  Users logged in:                  0
  IPv4 address for br-1746f5f95e03: 192.168.49.1
  IPv4 address for docker0:         172.17.0.1
  IPv4 address for enp0s1:          192.168.64.20
  IPv6 address for enp0s1:          fd3c:28b:5cc5:4064:5054:ff:fe87:5be
```

### NeuVector Setup - minikube

minikube is already started on the new instance; however, I am going to bump up CPUs and Memory for it. 

If needing to install minikube, check out the [documentation](https://minikube.sigs.k8s.io/docs/start/).

**First, stop minikube:** 

```console
ubuntu@demo:~$ minikube stop
✋  Stopping node "minikube"  ...
🛑  Powering off "minikube" via SSH ...
🛑  1 node stopped.
```

**Update CPUs:**

```
ubuntu@demo:~$ minikube config set cpus 4
❗  These changes will take effect upon a minikube delete and then a minikube start
```

**Update Memory:**

```console
ubuntu@demo:~$ minikube config set memory 8192
❗  These changes will take effect upon a minikube delete and then a minikube start
```

**Delete exiting minikube:**

```
ubuntu@demo:~$ minikube delete
🔥  Deleting "minikube" in docker ...
🔥  Deleting container "minikube" ...
🔥  Removing /home/ubuntu/.minikube/machines/minikube ...
💀  Removed all traces of the "minikube" cluster.
```

**Start up new minikube:**

```
ubuntu@demo:~$ minikube start
😄  minikube v1.32.0 on Ubuntu 22.04 (arm64)
✨  Automatically selected the docker driver. Other choices: ssh, none
📌  Using Docker driver with root privileges
👍  Starting control plane node minikube in cluster minikube
🚜  Pulling base image ...
🔥  Creating docker container (CPUs=4, Memory=8192MB) ...
🐳  Preparing Kubernetes v1.28.3 on Docker 24.0.7 ...
    ▪ Generating certificates and keys ...
    ▪ Booting up control plane ...
    ▪ Configuring RBAC rules ...
🔗  Configuring bridge CNI (Container Networking Interface) ...
    ▪ Using image gcr.io/k8s-minikube/storage-provisioner:v5
🔎  Verifying Kubernetes components...
🌟  Enabled addons: storage-provisioner, default-storageclass
🏄  Done! kubectl is now configured to use "minikube" cluster and "default" namespace by default
```

minikube should be up running, once connected. 

**You can check with the following command:**

`minikube status`

```console
ubuntu@demo:~$ minikube status
minikube
type: Control Plane
host: Running
kubelet: Running
apiserver: Running
kubeconfig: Configured
```

If looking to play with minikube more, there are additional add-ons which can be installed, in this case, we will leave the defaults, but metrics-server and dashboard are typical. 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/auwcipu2tu3t0s1983y2.png)

### NeuVector Setup - kubectl

This image also comes with kubectl setup: 

```console
ubuntu@demo:~$ kubectl version
Client Version: v1.28.7
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Server Version: v1.28.3
```

### NeuVector Setup - helm

Helm is not installed, but can be quickly set up: 

```console
ubuntu@demo:~$ helm version
Command 'helm' not found, but can be installed with:
sudo snap install helm
```

To install helm on this Ubuntu instance `sudo snap install helm --classic`. 

```console
ubuntu@demo:~$ sudo snap install helm --classic
Download snap "core22" (1125) from channel "stable"
```

Once install is complete, you can check the version: 

```console
ubuntu@demo:~$ helm version
version.BuildInfo{Version:"v3.14.2", GitCommit:"c309b6f0ff63856811846ce18f3bdc93d2b4d54b", GitTreeState:"clean", GoVersion:"go1.21.7"}
```

### NeuVector Setup - Helm Install

Add the helm repo: 

```console
helm repo add neuvector https://neuvector.github.io/neuvector-helm/
```

For this, I'm going to use the latest version, but other older versions and development version can be listed:

```console
helm search repo neuvector --devel -l
```

> This is the latest as of 29 February 2024 -- Leap Day!: 

```console
ubuntu@demo:~$ helm search repo neuvector
NAME             	CHART VERSION	APP VERSION	DESCRIPTION
neuvector/core   	2.7.3        	5.3.0      	Helm chart for NeuVector's core services
neuvector/crd    	2.7.3        	5.3.0      	Helm chart for NeuVector's CRD services
neuvector/monitor	2.7.3        	5.3.0      	Helm chart for NeuVector monitor services
```

Helm Install: 

For setting up NeuVector, it is simple enough that I will keep most of the default values. I am updating the controller and scanner replicas, if leaving the defaults it will nuke your system since minikube is running a single node. This is fine for local and development environments. 

```console
helm upgrade --install neuvector neuvector/core --version 2.7.3 \
--set tag=5.3.0 \
--set controller.replicas=1 \
--set cve.scanner.replicas=1 \
--create-namespace \
--namespace neuvector
```

The readme for the repository will provide additional configuration options:

[NeuVector Helm Chart](https://github.com/neuvector/neuvector-helm/blob/master/charts/core/README.md)

When running: 

```console
ubuntu@demo:~$ helm upgrade --install neuvector neuvector/core --version 2.7.3 \
--set tag=5.3.0 \
--set controller.replicas=1 \
--set cve.scanner.replicas=1 \
--create-namespace \
--namespace neuvector
Release "neuvector" does not exist. Installing it now.
NAME: neuvector
LAST DEPLOYED: Thu Feb 29 09:34:30 2024
NAMESPACE: neuvector
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
Get the NeuVector URL by running these commands:
  NODE_PORT=$(kubectl get --namespace neuvector -o jsonpath="{.spec.ports[0].nodePort}" services neuvector-service-webui)
  NODE_IP=$(kubectl get nodes --namespace neuvector -o jsonpath="{.items[0].status.addresses[0].address}")
  echo https://$NODE_IP:$NODE_PORT
```

## Accessing the NeuVector User Interface

I am going to port-forward this and access it from my local browser. On the virtual machine, run the following command. 

`kubectl port-forward --address 0.0.0.0 --namespace neuvector service/neuvector-service-webui 8443`

```console
ubuntu@demo:~$ kubectl port-forward --address 0.0.0.0 --namespace neuvector service/neuvector-service-webui 8443
Forwarding from 0.0.0.0:8443 -> 8443
```

This will listen on port 8443 on all addresses (0.0.0.0) and forward to the service : neuvector-service-webui. 

### Accessing Locally

**On my local browser: **

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/y1kul44b31zvpbeeytit.png)

> Note the IP Address I pulled is the virtual machine's private IP address. This can be checked again using `multipass list`.

Since this is a self-signed certificate, you can ignore the warnings and proceed. 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nc35bq7eyio51xrenzcd.png)

By default, username and password are admin:admin. 

Check off on the EULA and you can login. 

And voila, update admin password if you plan will continue to use this and you are done.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pnodbmy814a84qdvj7pm.png)

### Additional Steps - Set up mysql container

If looking to test NeuVector a bit more, we will add a MySQL service and run scans on containers and nodes with the NeuVector console.

Add the bitnami repo: 

```
helm repo add bitnami https://charts.bitnami.com/bitnami
```

Install: 

```
helm install bitnami/mysql --generate-name
```

#### In NeuVector Interface

Go to Assets in the navigation pane on the left and select the dropdown. From the dropdown, select containers. 

**Turn on Auto Scan or perform a manual scan:**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/k6pmdyxdcp9qqzmugevv.png)

**Auto Scanning:**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dd3h99861bx5swh4alqn.png)

Scans will schedule and return back results on completed. Depending on the amount of resources, both scanners and containers, it could take time. Since this is a new cluster, it is relatively quick. 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lmbkm5y69joemobixlil.png)

**You can filter and view the vulnerabilities which are found:**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/udltzuirih3efkmr6x58.png)

**Go to the Nodes page:**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/u387i62ighvetaadf2h8.png)

You can see the nodes are also scanned as well for vulnerabilities. 

## Conclusion

That is about it, a quick and easy way to test out NeuVector. This is really just scratching the surface when it comes to what features and solutions it offers.