GKE Cluster

This guide explains how to use the provisioning script provided by OPSWAT to create an GCP GKE and generate all the Kubernetes components needed to run MetaDefender Core.

MetaDefenderK8S script details

• GitHub Project OPSWAT/metadefender-k8s --> Script path: ./metadefenderk8s.sh

• Programming Language: Bash

• Installation Pre-requisites for provisioning:

  • Terraform
  • Helm
  • gcloud cli
  • Kubectl
    • kubectl plugin "gke-gcloud-auth-plugin" (Since GKE 1.6)

• GCP Credentials

  • The Cloud SQL Admin API is enabled. (Optional, enabled when Cloud SQL database is going to be used)

  • Download the credentials for the service account, it should have the following permissions

    • Editor
    • Compute Network Admin

  • Set in your environment variable the path to the JSON key with the credentials for the service account to use

    • GCP_JSON_CREDENTIALS_PATH

• MetaDefender Core License Key (Required with --mdcore parameter)

  • Set it in your local environment credentials under MDCORE_LICENSE_KEY

How to run script

Script Parameters

Connection to Cloud SQL Database from GKE

MetaDefender Core Flowchart Provisioning in GCP

The following flowchart represents how the provisioning script will configure the environment based on the options selected for provisioning GCP GKE.

Summary options to be selected

1. Access to the K8S cluster. Generate Ingress or provide own access.

   1. An Ingress and an internal load balancer will be created per each product flag added as parameter to the script
   2. Own Access, you decide how to access to the cluster so it won't generate any ingress but will still create the internal load balancer for the product service deployed

2. Have your own database or create new database

   1. Own database, will be asked if you want the script to set up the credentials and database host url for you or the script will just indicate the secrets to edit, later on by you, for connecting the MetaDefender Core with your database.

   2. Create new DB in K8S or external DB that for GCP we will provision a Cloud SQL Server

      1. If external, indicate how to connect to it, by private connection or SQL Proxy pod