Optical cybersecurity scenario

Carlos Natalinorequested to merge
feat/opt-cybersecurity into develop

The changes are mainly to four components:

  • DBSCANServing
  • Optical Attack Manager
  • Optical Attack Detector
  • Optical Attack Mitigator

The changes include:

  • Improvements in the names of the components, i.e., by removing the unnecessary "centralized" term
  • Improvements to the building of images, now using a standard teraflow user for all images
  • Inclusion of the .dockerignore file to prevent Docker to copy generated photo files
  • Inclusion of the generation of async proto files needed for the attack manager
  • Inclusion of the four components to the specification in my_deploy.sh
  • Inclusion of the four services to the common.Constants file
  • Update to specific Python 3.9 version
  • Updates to the gitlab-ci yaml files

Still to do:

  • Fix the tests of the optical attack manager
Edited by Carlos Natalino

Merge request reports

deploy/tfs.sh

+8 −0
Changes for deploy/tfs.sh: 8 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -175,6 +175,14 @@ echo "# Environment variables for TeraFlowSDN deployment" > $ENV_VARS_SCRIPT 
PYTHONPATH=$(pwd)/src

echo "export PYTHONPATH=${PYTHONPATH}" >> $ENV_VARS_SCRIPT



echo "Create Redis secret..."

# first try to delete an old one if exists

kubectl delete secret redis-secrets --namespace=$TFS_K8S_NAMESPACE

REDIS_PASSWORD=`uuidgen`

kubectl create secret generic redis-secrets --namespace=$TFS_K8S_NAMESPACE \

    --from-literal=REDIS_PASSWORD=$REDIS_PASSWORD

echo "export REDIS_PASSWORD=${REDIS_PASSWORD}" >> $ENV_VARS_SCRIPT



for COMPONENT in $TFS_COMPONENTS; do

    echo "Processing '$COMPONENT' component..."

manifests/cachingservice.yaml

0 → 100644
+64 −0
Changes for manifests/cachingservice.yaml: 64 added lines, 0 removed lines.
Original line number Diff line number Diff line 
# Copyright 2022-2023 ETSI TeraFlowSDN - TFS OSG (https://tfs.etsi.org/)

#

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

#

#     http://www.apache.org/licenses/LICENSE-2.0

#

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.



---

apiVersion: apps/v1

kind: Deployment

metadata:

  name: cachingservice

spec:

  selector:

    matchLabels:

      app: cachingservice

  template:

    metadata:

      labels:

        app: cachingservice

    spec:

      containers:

      - name: redis

        image: redis:7.0-alpine

        env:

        - name: REDIS_PASSWORD

          valueFrom:

            secretKeyRef:

              name: redis-secrets

              key: REDIS_PASSWORD

        ports:

        - containerPort: 6379

          name: client

        command: ["redis-server"]

        args:

        - --requirepass

        - $(REDIS_PASSWORD)

        resources:

          requests:

            cpu: 50m

            memory: 64Mi

          limits:

            cpu: 500m

            memory: 512Mi

---

apiVersion: v1

kind: Service

metadata:

  name: cachingservice

spec:

  type: ClusterIP

  selector:

    app: cachingservice

  ports:

  - name: redis

    port: 6379

    targetPort: 6379

manifests/dbscanservingservice.yaml

+36 −8
Changes for manifests/dbscanservingservice.yaml: 36 added lines, 8 removed lines.
Original line number Diff line number Diff line
@@ -31,33 +31,61 @@ spec: 
        image: labs.etsi.org:5050/tfs/controller/dbscanserving:latest

        imagePullPolicy: Always

        ports:

        - containerPort: 10006

        - containerPort: 10008

        - containerPort: 9192

        env:

        - name: LOG_LEVEL

          value: "DEBUG"

          value: "INFO"

        readinessProbe:

          exec:

            command: ["/bin/grpc_health_probe", "-addr=:10006"]

            command: ["/bin/grpc_health_probe", "-addr=:10008"]

        livenessProbe:

          exec:

            command: ["/bin/grpc_health_probe", "-addr=:10006"]

            command: ["/bin/grpc_health_probe", "-addr=:10008"]

        resources:

          requests:

            cpu: 250m

            memory: 512Mi

            memory: 128Mi

          limits:

            cpu: 700m

            cpu: 1000m

            memory: 1024Mi

---

apiVersion: v1

kind: Service

metadata:

  name: dbscanservingservice

  labels:

    app: dbscanservingservice

spec:

  type: ClusterIP

  selector:

    app: dbscanservingservice

  ports:

  - name: grpc

    port: 10006

    targetPort: 10006
 
    port: 10008

    targetPort: 10008

  - name: metrics

    port: 9192

    targetPort: 9192

---

apiVersion: autoscaling/v2

kind: HorizontalPodAutoscaler

metadata:

  name: dbscanservingservice-hpa

spec:

  scaleTargetRef:

    apiVersion: apps/v1

    kind: Deployment

    name: dbscanservingservice

  minReplicas: 1

  maxReplicas: 20

  metrics:

  - type: Resource

    resource:

      name: cpu

      target:

        type: Utilization

        averageUtilization: 80

  #behavior:

  #  scaleDown:

  #    stabilizationWindowSeconds: 30

manifests/opticalattackdetectorservice.yaml

0 → 100644
+96 −0
Changes for manifests/opticalattackdetectorservice.yaml: 96 added lines, 0 removed lines.
Original line number Diff line number Diff line 
# Copyright 2022-2023 ETSI TeraFlowSDN - TFS OSG (https://tfs.etsi.org/)

#

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

#

#      http://www.apache.org/licenses/LICENSE-2.0

#

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.



apiVersion: apps/v1

kind: Deployment

metadata:

  name: opticalattackdetectorservice

spec:

  selector:

    matchLabels:

      app: opticalattackdetectorservice

  template:

    metadata:

      labels:

        app: opticalattackdetectorservice

    spec:

      terminationGracePeriodSeconds: 5

      containers:

      - name: server

        image: labs.etsi.org:5050/tfs/controller/opticalattackdetector:latest

        imagePullPolicy: Always

        ports:

        - containerPort: 10006

        - containerPort: 9192

        env:

        - name: LOG_LEVEL

          value: "INFO"

        - name: REDIS_PASSWORD

          valueFrom:

            secretKeyRef:

              name: redis-secrets

              key: REDIS_PASSWORD

        readinessProbe:

          exec:

            command: ["/bin/grpc_health_probe", "-addr=:10006"]

        livenessProbe:

          exec:

            command: ["/bin/grpc_health_probe", "-addr=:10006"]

        resources:

          requests:

            cpu: 250m

            memory: 128Mi

          limits:

            cpu: 1000m

            memory: 1024Mi

---

apiVersion: v1

kind: Service

metadata:

  name: opticalattackdetectorservice

  labels:

    app: opticalattackdetectorservice

spec:

  type: ClusterIP

  selector:

    app: opticalattackdetectorservice

  ports:

  - name: grpc

    port: 10006

    targetPort: 10006

  - name: metrics

    port: 9192

    targetPort: 9192

---

apiVersion: autoscaling/v2

kind: HorizontalPodAutoscaler

metadata:

  name: opticalattackdetectorservice-hpa

spec:

  scaleTargetRef:

    apiVersion: apps/v1

    kind: Deployment

    name: opticalattackdetectorservice

  minReplicas: 1

  maxReplicas: 20

  metrics:

  - type: Resource

    resource:

      name: cpu

      target:

        type: Utilization

        averageUtilization: 80

  #behavior:

  #  scaleDown:

  #    stabilizationWindowSeconds: 30

manifests/opticalcentralizedattackdetectorservice.yaml→manifests/opticalattackmanagerservice.yaml

+30 −18
Changes for manifests/opticalattackmanagerservice.yaml: 30 added lines, 18 removed lines.
Original line number Diff line number Diff line
@@ -15,49 +15,61 @@ 
apiVersion: apps/v1

kind: Deployment

metadata:

  name: opticalcentralizedattackdetectorservice

  name: opticalattackmanagerservice

spec:

  selector:

    matchLabels:

      app: opticalcentralizedattackdetectorservice

      app: opticalattackmanagerservice

  replicas: 1

  template:

    metadata:

      labels:

        app: opticalcentralizedattackdetectorservice

        app: opticalattackmanagerservice

    spec:

      terminationGracePeriodSeconds: 5

      containers:

      - name: server

        image: labs.etsi.org:5050/tfs/controller/opticalcentralizedattackdetector:latest

        image: labs.etsi.org:5050/tfs/controller/opticalattackmanager:latest

        imagePullPolicy: Always

        ports:

        - containerPort: 10005

        envFrom:

          - secretRef:

              name: monitoring-secrets

        readinessProbe:

          exec:

            command: ["/bin/grpc_health_probe", "-addr=:10005"]

        livenessProbe:

          exec:

            command: ["/bin/grpc_health_probe", "-addr=:10005"]

        - containerPort: 9192

        env:

        - name: LOG_LEVEL

          value: "INFO"

        - name: MONITORING_INTERVAL

          value: "30"

        - name: OPTICALATTACKMANAGERSERVICE_LOOP_MIN_WORKERS

          value: "2"  # remember to align this with the resource limits

        - name: OPTICALATTACKMANAGERSERVICE_LOOP_MAX_WORKERS

          value: "10"  # remember to align this with the resource limits

        - name: REDIS_PASSWORD

          valueFrom:

            secretKeyRef:

              name: redis-secrets

              key: REDIS_PASSWORD

        resources:

          requests:

            cpu: 250m

            memory: 512Mi

            memory: 128Mi

          limits:

            cpu: 700m

            memory: 1024Mi

            cpu: 10000m

            memory: 10240Mi

---

apiVersion: v1

kind: Service

metadata:

  name: opticalcentralizedattackdetectorservice

  name: opticalattackmanagerservice

  labels:

    app: opticalattackmanagerservice

spec:

  type: ClusterIP

  selector:

    app: opticalcentralizedattackdetectorservice

    app: opticalattackmanagerservice

  ports:

  - name: grpc

    port: 10005

    targetPort: 10005

  - name: metrics

    port: 9192

    targetPort: 9192