aquasecurity / deployments

All Aqua deployments options and aquactl configuration

Aqua Enterprise Product Deployment

Overview

Aqua Platform is a layered, full-lifecycle cloud native security platform that secures containerized, serverless, and VM-based applications, from application build, infrastructure through production runtime environments. Aqua Enterprise runs either in SaaS or Self-Hosted edition, at any scale.

This repository explains different methods to deploy each Aqua component. It also provides a quick_start deployment suited for proofs-of-concept (POCs), training, and test environemnts.

Aqua components can be deployed on multiple platforms such as Kubernetes, AWS ECS, OpenShift, no-orchestrator, and more, using different deployment methods such as manifests, Helm, Operator, proprietary CLI tools, RPM, and scripts. Deployment resources for each Aqua component is listed in the respective directory.

Aqua Enterprise SaaS edition deployment

Users working with Aqua Enterprise SaaS edition do not need to deploy Aqua server in their datacenter but only the relevant Enforcers to enable runtime protection. Following are the components that are available for Aqua SaaS users:

• Enforcers:
  • Aqua Enforcer: containers and host protection
  • KubeEnforcer: full stack Kubernetes cluster protection
  • VM Enforcer: VM workloads protection
  • MicroEnforcer: runtime security for containers running in Containers-as-a-Service (CaaS) environments
  • NanoEnforcer: runtime protection of serverless functions
• Scanner: Used to scan images, VMWare Tanzu applications, and serverless functions locally or stored in a registry
• Cloud Connector: the Aqua Cloud Connector establishes a secure connection to the Aqua Platform console, giving Aqua Platform remote access to resources on the local clusters.

Aqua Enterprise Self-Hosted edition deployment

Aqua Enterprise Self-Hosted edition requires deploying Aqua server and other components in your datacenter. Following are the server components available for deployment:

• Server: core server components – Console, Gateway, and Database. This deployment is mandatory for Aqua Self-Hosted edition.
• Tenant Manager (Optional): manage multiple segregated Aqua deployments from a single console
• CyberCenter: required for air-gap environments

After deploying Server components, you can deploy Enforcers and Scanners similar to SaaS users.

Quick-start deployment

A quick-start option is available for small non-production deployments and quick evaluations. It deploys Aqua Server and all Enforcers, in a single Kubernetes cluster.

Deployment methods

You can deploy the mentioned Aqua components using one of the following methods:

• Manifests
• Helm
• Operator
• AWS Cloudformation
• Aquactl (Aqua CLI)
• RPM (for no-orchestrator environments)
• Scripts

Each Aqua component can be deployed through a selection of the methods above, as listed in component's directory itself.

Before you start using the deployment methods in this repository, Aqua strongly recommends you to refer the Product documentation on Deployments.

deployments's Issues

PostgreSQL version in template is not supported

Hi,
I tried to create Aqua Console with template in deployments/server/ecs/cloudformation/aqua-ecs-fargate.
But, the following error occurred.
Cannot find version 11.9 for postgres (Service: AmazonRDS; Status Code: 400; Error Code: InvalidParameterCombination; Request ID: 1d0cf3c3-a21b-49b4-967a-fc71e9cbd5d3; Proxy: null)
I upgraded the version of PostgreSQL embedded in the lines 828 and 853 to 11.12 and it worked.
Would you please fix it if possible.

Incorrectly refers aqua-db instead of aqua-audit-db

deployments/orchestrators/kubernetes/manifests/aqua_csp_006_server_deployment/aqua_server_deployment_managed_db.yaml

Line 182 in f36093b

name: aqua-db

Incorrectly refers aqua-db instead of aqua-audit-db in aqua-gateway

quick_start yaml unable to create

kubernetes version 1.12
kubectl create -f https://github.com/aquasecurity/deployments/blob/6.5/quick_start/kubernetes_and_openshift/manifests/aqua-csp-quick-default-storage.yaml -n aqua
unable to recognize "aqua-csp-quick-default-storage.yaml": no matches for kind "ValidatingWebhookConfiguration" in version "admissionregistration.k8s.io/v1"
unable to recognize "aqua-csp-quick-default-storage.yaml": no matches for kind "MutatingWebhookConfiguration" in version "admissionregistration.k8s.io/v1"
unable to recognize "aqua-csp-quick-default-storage.yaml": no matches for kind "CustomResourceDefinition" in version "apiextensions.k8s.io/v1"
unable to recognize "aqua-csp-quick-default-storage.yaml": no matches for kind "CustomResourceDefinition" in version "apiextensions.k8s.io/v1"
Change apiversion to v1beta1
error validating "aqua-csp-quick-default-storage.yaml": error validating data: [ValidationError(ValidatingWebhookConfiguration.webhooks[0]): unknown field "admissionReviewVersions" in io.k8s.api.admissionregistration.v1beta1.Webhook, ValidationError(ValidatingWebhookConfiguration.webhooks[0]): unknown field "timeoutSeconds" in io.k8s.api.admissionregistration.v1beta1.Webhook]; if you choose to ignore these errors, turn validation off with --validate=false

K8s Quick-Start Host Path Guide audit-db service typo

Line 256 in the 6.0 and 6.2 yaml

https://github.com/aquasecurity/deployments/blob/6.0/orchestrators/kubernetes/quick_start/aqua-csp-quick-hostpath.yaml

and in the 6.2 yaml
https://github.com/aquasecurity/deployments/blob/6.2/orchestrators/kubernetes/quick_start/aqua-csp-quick-hostpath.yaml

needs modifying from

name: aqua-db

to
name: aqua-db-audit

otherwise the deployment of the service for aqua-db-audit fails.

Base64 aqua-enforcer-token secret

Noticed that Base64 doesn't work in this aqua-enforcer-token secret, but clear-text does, yet we say on #L3 the token needs to be b64.

Can we remove #L3 or fix to use b64 as we do with our Helm Enforcer deploy?

UserId required for pull

The user id and password is required for the pull of an image from registry.aquasec.com. Can you tell me how do I get my user id?

No Terraform Deploy for PAYG Model

For companies that prefer to manage their infrastructure deployments through Terraform, there needs to be a way for them to deploy via Terraform.

I'm working on a PR right now that will have a Terraform module for consumption. However, it's best practice to manage Terraform modules as separate repos. While I'll build this on a fork for now, it's probably best to look at building this as a separate module in a separate repo.

add LICENSE

Hi!
This repo needs a license file!
I would love to add one as part of hacktoberfest!
You could tell me which license I should add or I could add GNU Affero General Public License v3.0 as is the case with the Trivy repo

Add a CONTRIBUTING.md to the repository

• A suggestion to add a CONTRIBUTING.md file which provides instructions/guidelines on how to contribute to this project;
  • https://github.com/github/opensource.guide/blob/master/CONTRIBUTING.md

Aqua-agent Daemonset is broken since AKS uses containerd instead of Docker

Hi,

It seems since we have been updating the AKS version, this version is now using containerd instead of Docker.
The aqua-agent agent cannot start due to the following error:

Error:
Cannot connect to the Docker daemon at unix://

Aqua-agent is still expecting to use Docker, is there any fix for this ?

VM Enforcer tar file is not removed after the installation finishes when using the install_vme.sh script

Hi Aqua Team,

I noticed you are not removing the enforcer tar file after the installation finishes in the install_vme.sh script. My Elastic Beanstalk environment was running out of disk space when I had to debug why and realized that the enforce tar file was still there.

Please add the cleanup option to VM enforcer install script (enforcers/vm_enforcer/shell/install_vme.sh) which removes all unnecessary files. Thank you!