Securing Java microservice workloads with AccuKnox Open-Source
Microservices are small, self-contained, ready to run applications. Each will have a specific well-defined task. All of them are grouped together to deliver all the functionalities of the big application.
Java microservice is a software application written in the Java programming language and typically makes use of Java tools and frameworks.
With Accuknox you can protect your Java microservices running on the cloud environment within a few clicks. You can also make use of open-source AccuKnox tools.
Install open-source AccuKnox tools to your cloud environment.
Run the following script to install Daemonsets and Services
curl -s https://raw.githubusercontent.com/accuknox/tools/main/install.sh | bash
script to install Daemonsets and Services
For more details, see Quick Start - AccuKnox
Use Enterprise tier of the Accuknox product. For more details, see Agent Installation - AccuKnox
Deploy Sample Java/MySQL Web application in Kubernetes
Here we are using a Java-MySQL demo application; Online Book Store as a workload. Online Book store consists of 2-tier microservices. The application is for selling books online, maintaining books selling history, adding and managing books, etc.
This application uses Java for Back-End and the database used is MySQL.
For more information see, the Deployment of the Sample OnlineBookStore application in GKE
Check the status of the pod and service.
Pod and service template
Working with open-source AccuKnox tools
Auto-discovered policies are only available for K8s environments right now. For VM workloads it will be available soon. Accuknox policy auto-discovery engine leverages the pod visibility provided by KubeArmor and Cilium to auto-generate network and system policies.
Run the below script in the Kubernetes cluster to get Auto-Discovered Policies
curl -s https://raw.githubusercontent.com/accuknox/tools/main/get_discovered_yamls.sh | bash
cilium_policies.yaml contains all the auto-discovered cilium policies. cilium_policies.yaml
kubearmor_policies_ext.yaml contains all the auto-discovered kubearmor policies. kubearmor_policies_ext.yaml kubearmor_policies.yaml
Let's see all of the auto-discovered cilium policies we got related to the
Auto-discovered policies are generated based on the network flow of the application. By applying auto-discovered policies you can allow only minimum traffic that is necessary for its legitimate purpose. In that way, applications work with minimum attack surface.
Apply Auto-discovered Cilium Policies in Kubernetes:
kubectl apply -f cilium_policies.yaml
Apply Policies from Policy-templates Repo
Accuknox's policy templates is an open-source repo that also contains a wide range of attack prevention techniques as well as hardening techniques for your workloads.
The Policy-templates provides policies based on KubeArmor and Cilium policies for known CVEs and attack vectors, compliance frameworks such as PCI-DSS, MITRE, STIG, etc,
GitHub - kubearmor/policy-templates: Community curated list of System and Network policy templates for the KubeArmor and Cilium
Within a few clicks, you can secure cloud workloads with policies.
Go to Policy templates Github repository and selects any policy. Then copy policy raw contents and change namespace and matchLabels to the application pods
Policy templates Github
After changing namespace and matchLabels.
kubectl get po -n bookstore --show-labels in the terminal to get the labels of the pods.
Using AccuKnox open-source tools, an organization can achieve cloud run-time security. With Accuknox policy enforcement engines, you can enforce policies to your cloud workloads while they are running.
Now you can protect your workloads in minutes using AccuKnox, it is available to protect your Kubernetes and other cloud workloads using Kernel Native Primitives such as AppArmor, SELinux, and eBPF.
Let us know if you are seeking additional guidance in planning your cloud security program.