Virus scan MinIO buckets using ClamAV, Fission and Kafka
Tags: minio, fissio, clamav, virus
Published: 2022-06-07 08:35:58

All organizations want to protect their systems and have a good strategy in order to stay away from malware or other potential threats. Before introducing files and binaries into your system organization is very important to scan them  and respond immediately based on a predefined strategy.

## **Short introduction of Fission**

Fission is an open-source and Kubernetes-native serverless framework that lets developers to run code functions easily. Kubernetes has  powerful orchestration capabilities to manage and schedule containers while Fission takes advantage of them, being flexible. In other words, Fission can focus on developing the function-as-a-service (FaaS) features. Fission supports many programming languages such as Pyhton, NodeJs, PHP, Go and C#. Also, this tool allows you to create a message queue trigger like Apache Kafka, AWS SQS, AWS Kinesis, GCP Pub Sub, Nats Streaming. In this way, the product becomes an open-source version of AWS Lambda.

Fission has three core concepts: Function, Environment , and Trigger. Their relationships are presented in the following figure:


![Trigger, Function, Environment](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/69izxtaf7fe1p74cfg6a.png)

1. **Function**: the code that is written by using a specific language for execution. In our case
we have Python code.
2. **Environment**: the special language environment that is used to run user function
3. **Trigger**: used to associate functions and event sources

##**Implementation in Action**
 
This walkthrough will show you how to build a pipeline in order to scan your MiniIO files using asynchronous triggers. When a new file will be pushed in our MinIO buckets **(1)**a new notification will be send to the Kafka **(2)** and the trigger will start the function **(3)**, scanning the file for viruses **(4)**.


![Process of scanning files](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/md7rto7mlt7oa0di0mz4.png)
 
For this walkthrough, you should have the following prerequisites:

• MinIO Server and 2 buckets: **test-bucket**, **infected-objects**
• Apache Kafka and 3 topics: **bucketevents**, **bucketevents-response**, **bucketeventserror**
• Fission in Kubernetes environment, install Fission client CLI.(please use this link: [https://fission.io/docs/installation/](https://fission.io/docs/installation/)

In order to implement what was described you have to follow the steps:

**Step 1- Enable MinIO to send notification using Kafka when we put new objects in the bucket**

MinIO supports updating Kafka endpoints on a running MiniIO server process using the MinIO client (mc) and `mc admin config set` command and the `notify_kafka` configuration key.
```
mc admin config set ALIAS/ notify_kafka:IDENTIFIER brokers="<ENDPOINT>"
topic=”<string>”
```
Replace `IDENTIFIER` with a unique descriptive string for the Kafka service endpoint. Replace `ENDPOINT` with a comma separated list of Kafka brokers (e.g: 192.168.10.10:9092,192.168.10.11:9092,192.168.10.12:9092). The topic name in our case is **bucketevents**. You must restart the MinIO server process to apply any new or updated configuration settings.

Use the `mc event add` command to add a new bucket notification (when you put new objects) with the configured Kafka service as a target:

```
mc event add ALIAS/BUCKET arn:minio:sqs::IDENTIFIER:kafka --event put
```
**Step 2 - Create Python code which uses ClamAV**

Here I’ve created a Python code which is available in [Github](https://github.com/raklev20/fission-clamav-scan-objects/blob/main/minio-scan.py).You have to change MinIO credentials in order to connect to it. Your objects will be copied inside the container and scanned using clamdscan from ClamAV. If the file is infected will be moved to “/tmp/infected-files/” and placed in a special bucket (infected-objects) for deep investigations.

In a default scenario Fission use image based on language environments (in our case Python), but you can create your own image using Dockerfile. After that, you can upload new image in your Docker registry and when you create a new environment you will mention your custom image and secret if it’s necessary. Our custom image install ClamAV and what is necessary for scanning files.

Now, let’s create a function with Python as environment:

```
fission environment create --name python --image --image=YOUR_DOCKER_IMAGE
--imagepullsecret="regcred"
```
Let’s assumed that Python code is saved in minio-scan.py file. Using this file you have to create your Fission function like so:

```
fission function create --name=minio-scan --env python --code minio-scan.py
```

You can use the following command to create a Kafka-based message queue trigger mqttest.This trigger subscribes to messages of the input topic **(bucketevents)**, and it immediately triggers function execution when it receives any message.The function execution result is written to the output topic **(bucketevents-response)** if a function execution succeeds, or to the error topic **(bucketevents-error)** if it fails.

```
fission mqt create --name mqt-test --function minio-scan --mqtype kafka --
mqtkind keda --topic bucketevents --resptopic bucketevents-response --
errortopic bucketevents-error --metadata bootstrapServers=ENDPOINT:PORT --
metadata consumerGroup=fission-test --metadata topic=bucketevents
```
Replace `ENDPOINT:PORT` with a comma separated list of Kafka brokers.

**Step 4 - Check the logs and Fission behaviour**
Your function will be deployed as a pod in fission-function namespace into Kuberentes cluster. Using `kubectl logs -f -c python $POD_NAME` you can check the logs in real time to see what happens there. Also you have to take a look at Kafka topics (response or error) in order to know the output of your function.

##**Conclusion**
Fission is a versatile framework that can be used with many different programming languages and help us to build FaaS in Kubernetes. In this scenario, I used some basic feature of Fission for scanning new S3 object but I totally recommend you to read more regarding Fission technologies on [Fission](https://fission.io/blog/) blog which are very interesting.