Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: updates, restructuring #3

Merged
merged 1 commit into from
Nov 22, 2023
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Empty file modified Makefile
100755 → 100644
Empty file.
36 changes: 34 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,4 +1,36 @@
# Nimbus: Intent Driven Security Operator

* [Getting Started](Getting-Started.md)
* [Quick Tutorials](Quick-tutorials.md)
> The aim for any organization should be to state its security
> goal/intents and the underlying tooling/operator should be able to convert
> these goals/intents into actionable elements such as policies/rules.

Nimbus aims to decouple security intents from its actual implementation i.e.,
use of policy engines and corresponding policies and rules. This pattern exists
commonly in Kubernetes world and the best example is a storage operator,
wherein the user specifies the persistent volume claims with appropriate SLA
(disk space, R/W, speed) and the operator figures out the appropriate volume to
bind. Nimbus intends to bring in similar abstraction for security intents
wherein the user specifies the security intent and the operator figures out the
best implementation method available given the deployment.

* An Intent might get translated into a set of policies and not necessarily a
single policy thus providing multi-layer defense. For example, an intent such
as "Do not allow privilege escalation" could get translated in to admission
controller policy and system policy as handled by runtime security engines
such as [KubeArmor](www.kubearmor.io).
* An intent could take into consideration runtime behavior and then handle
intent implementation. For e.g., an intent could be "Do not allow privilege
flags for pods that are publicly reachable".
* An intent might get fully or partially satisfied and the bindings clearly
shows that status.
* An organization can provide a blueprint of intents given a deployment and the
operator could go an try to satisfy those intents in best-effort or strict mode.

![](docs/nimbus.png)

* [Getting Started](docs/Getting-Started.md)
* [Quick Tutorials](docs/Quick-tutorials.md)

# Credits

This project is funded by NSF grant ...
29 changes: 4 additions & 25 deletions Getting-Started.md → docs/Getting-Started.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,11 +12,12 @@ Before you begin, you'll need to set up the following preferences :
- docker version 17.03+.
- kubectl version v1.11.3+.
- Access to a Kubernetes v1.11.3+ cluster.
- make

## Installation
### 1. Clone Nimbus source code:
```
$ git clone https://git.cclab-inu.com/b0m313/nimbus.git
$ git clone https://github.com/5GSEC/nimbus.git
```

### 2. Install Kubearmor:
Expand All @@ -32,30 +33,15 @@ $ curl -o discovery-engine.yaml https://raw.githubusercontent.com/kubearmor/disc
$ kubectl apply -f discovery-engine.yaml
```

### 3. Install Make
```
$ sudo apt-get update
$ sudo apt-get install -y make
```

### 4. Install Golang
```
$ wget https://golang.org/dl/go1.21.3.linux-amd64.tar.gz
$ sudo tar -C /usr/bin -xzf go1.21.3.linux-amd64.tar.gz
$ export PATH=$PATH:/usr/bin/go/bin
$ source ~/.profile
$ go version
```

### 5. Install KubeBuilder
### 3. Install KubeBuilder
```
$ curl -L -o kubebuilder https://go.kubebuilder.io/dl/latest/$(go env GOOS)/$(go env GOARCH)
$ chmod +x kubebuilder
$ sudo mv ./kubebuilder /usr/local/bin/
$ kubebuilder version
```

### 6. Install Kustomize
### 4. Install Kustomize

```
$ curl -s "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh" | bash
Expand All @@ -69,13 +55,6 @@ $ kustomize version
Commands to run Nimbus operators:

### 1. Generate code
```
$ cd nimbus
$ ~/nimbus$ pwd
/home/cclab/nimbus
$ ~/nimbus$ ls
api bin config Dockerfile Getting-Started.md go.mod go.sum hack internal main.go Makefile PROJECT Quick-tutorials.md README.md test-yaml
```
Generate the necessary code based on the API definition

```
Expand Down
File renamed without changes.
Binary file added docs/nimbus.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file removed go1.21.3.linux-amd64.tar.gz
Binary file not shown.