diff --git a/README.md b/README.md index f3718a1..d2eac8e 100644 --- a/README.md +++ b/README.md @@ -50,21 +50,22 @@ There are a myriad of cameras out there (USB, IP and other cameras), and it migh ### Running and automation 5. [How to run and deploy a Kerberos Agent](#how-to-run-and-deploy-a-kerberos-agent) -6. [Configure and persist with volume mounts](#configure-and-persist-with-volume-mounts) -7. [Override with environment variables](#override-with-environment-variables) +6. [Access the Kerberos Agent](#access-the-kerberos-agent) +7. [Configure and persist with volume mounts](#configure-and-persist-with-volume-mounts) +8. [Override with environment variables](#override-with-environment-variables) ### Contributing -8. [Contribute with Codespaces](#contribute-with-codespaces) -9. [Develop and build](#develop-and-build) -10. [Building from source](#building-from-source) -11. [Building for Docker](#building-for-docker) +9. [Contribute with Codespaces](#contribute-with-codespaces) +10. [Develop and build](#develop-and-build) +11. [Building from source](#building-from-source) +12. [Building for Docker](#building-for-docker) ### Varia -12. [Support our project](#support-our-project) -13. [What is new?](#what-is-new) -14. [Contributors](#contributors) +13. [Support our project](#support-our-project) +14. [What is new?](#what-is-new) +15. [Contributors](#contributors) ## Quickstart - Docker @@ -119,6 +120,17 @@ We have documented the different deployment models [in the `deployments` directo By default your Kerberos Agents will store all its configuration and recordings inside the container. To help you automate and have a more consistent data governance, you can attach volumes to configure and persist data of your Kerberos Agents, and/or configure each Kerberos Agent through environment variables. +## Access the Kerberos Agent + +Once you have deployed the Kerberos Agent, using one of the deployment models described above, you will be able to access the Kerberos Agent user interface. A login page is presented asking for some credentials. + +The default username and password for the Kerberos Agent is: + +- Username: `root` +- Password: `root` + +**_Please note that you change the username and password for a final installation, see [Configure with environment variables](#configure-with-environment-variables) below._** + ## Configure and persist with volume mounts An example of how to mount a host directory is shown below using `docker`, but is applicable for [all the deployment models and tools described above](#running-and-automating-a-kerberos-agent). @@ -145,6 +157,8 @@ Next to attaching the configuration file, it is also possible to override the co | Name | Description | Default Value | | --------------------------------------- | ----------------------------------------------------------------------------------------------- | ------------------------------- | +| `AGENT_USERNAME` | The username used to authenticate against the Kerberos Agent login page. | "root" | +| `AGENT_PASSWORD` | The password used to authenticate against the Kerberos Agent login page. | "root" | | `AGENT_KEY` | A unique identifier for your Kerberos Agent, this is auto-generated but can be overriden. | "" | | `AGENT_NAME` | The agent friendly-name. | "agent" | | `AGENT_TIMEZONE` | Timezone which is used for converting time. | "Africa/Ceuta" | diff --git a/deployments/README.md b/deployments/README.md index 69d76e5..1ec636a 100644 --- a/deployments/README.md +++ b/deployments/README.md @@ -28,7 +28,9 @@ If you consider `docker` as "your way to go", but require to run a bigger (singl ## 3. Kubernetes -To be written +As described above, `docker` is a great tool for smaller deployments, where you are just running on a single machine and want to ramp up quickly. As you might expect, this is a not an ideal situation for production deployments. Kubernetes can help you to build a scalable, flexible and resilient deployment. + +> Learn more [about Kerberos Agent in a Kubernetes cluster here](https://github.com/kerberos-io/agent/tree/master/deployments/kubernetes). ## 4. RedHat Ansible and OpenShift diff --git a/deployments/docker/README.md b/deployments/docker/README.md index 6ebbbde..778de01 100644 --- a/deployments/docker/README.md +++ b/deployments/docker/README.md @@ -1,11 +1,11 @@ -# Docker +# Deployment with Docker The easiest, and let's say most natural, deployment is done [by utilising `docker`](#1-running-a-single-container). Docker can run a stand-alone, single, Kerberos Agent (or container) and a bigger set of Kerberos Agents (or containers) [through `docker compose`](#2-running-multiple-containers-with-docker-compose). ## 1. Running a single container -We are creating Docker images as part of our CI/CD process. You'll find our Docker images on [Docker hub](https://hub.docker.com/r/kerberos/agent). Pick a specific tag of choice, or use latest. Once done run below command, this will open the web interface of your Kerberos agent on port 80. - +We are creating Docker images as part of our CI/CD process. You'll find our Docker images on [Docker hub](https://hub.docker.com/r/kerberos/agent). Pick a specific tag of choice, or use latest. Once done run below command, this will open the web interface of your Kerberos agent on port 80. + docker run -p 80:80 --name mycamera -d kerberos/agent:latest Or for a develop build: @@ -22,17 +22,17 @@ By default your Kerberos agent will store all its configuration and recordings i You attach a volume to your container by leveraging the `-v` option. To mount your own configuration file, execute as following: -1. Decide where you would like to store your configuration and recordings; create a new directory for the config file and recordings folder accordingly. +1. Decide where you would like to store your configuration and recordings; create a new directory for the config file and recordings folder accordingly. mkdir agent mkdir agent/config mkdir agent/recordings -2. Once you have located your desired directory, copy the latest [`config.json`](https://github.com/kerberos-io/agent/blob/master/machinery/data/config/config.json) file into your config directory. +2. Once you have located your desired directory, copy the latest [`config.json`](https://github.com/kerberos-io/agent/blob/master/machinery/data/config/config.json) file into your config directory. wget https://raw.githubusercontent.com/kerberos-io/agent/master/machinery/data/config/config.json -O agent/config/config.json -3. Run the docker command as following to attach your config directory and recording directory. +3. Run the docker command as following to attach your config directory and recording directory. docker run -p 80:80 --name mycamera -v $(pwd)/agent/config:/home/agent/data/config -v $(pwd)/agent/recordings:/home/agent/data/recordings -d kerberos/agent:latest @@ -42,7 +42,7 @@ Next to attaching the configuration file, it is also possible to override the co ### 2. Running multiple containers with Docker compose -When running multiple containers, you could execute the above process multiple times, or a better way is to run a `docker compose` with predefined configuration file, a `docker-compose.yaml`. +When running multiple containers, you could execute the above process multiple times, or a better way is to run a `docker compose` with predefined configuration file, a `docker-compose.yaml`. You'll find [an example `docker-compose.yaml` file here](https://github.com/kerberos-io/agent/blob/master/deployments/docker/docker-compose.yaml). This configuration file includes a definition for running 3 Kerberos Agents (or containers). By specifying environment variables you can override the internal configuration. To add more Kerberos Agents to your deployment, just `copy-paste` a `service` block and modify the name, exposed port, and settings accordingly. @@ -80,10 +80,10 @@ Next we'll add a `volumes:` section to each Kerberos Agent (service) in the `doc - ./agent1/config:/home/agent/data/config - ./agent1/recordings:/home/agent/data/recordings -We'll repeat that for the other Kerberos Agents as well. You can review [the final result over here](https://github.com/kerberos-io/agent/blob/master/deployments/docker/docker-compose-with-volumes.yam). +We'll repeat that for the other Kerberos Agents as well. You can review [the final result over here](https://github.com/kerberos-io/agent/blob/master/deployments/docker/docker-compose-with-volumes.yam). Run the `docker compose` command by providing a different configuration file name. docker compose -f docker-compose-with-volumes.yaml up -Please note that you can use a combination of using a configuration file and environment variables at the same time. However environment variables will always override the setting in your configuration file. \ No newline at end of file +Please note that you can use a combination of using a configuration file and environment variables at the same time. However environment variables will always override the setting in your configuration file. diff --git a/deployments/kubernetes/README.md b/deployments/kubernetes/README.md new file mode 100644 index 0000000..36503af --- /dev/null +++ b/deployments/kubernetes/README.md @@ -0,0 +1,41 @@ +# Deployment with Kubernetes + +As described in the [Deployment with Docker](https://github.com/kerberos-io/agent/tree/master/deployments/docker), `docker` is a great tool for smaller deployments, where you are just running on a single machine and want to ramp up quickly. As you might expect, this is a not an ideal situation for production deployments. + +Kubernetes can help you to build a scalable, flexible and resilient deployment. By introducing the concept of multi-nodes and deployments, you can make sure your Kerberos Agents are evenly distributed across your different machines, and you can add more nodes when you need to scale out. + +We've provided an example deployment `deployment-agent.yml` in this directory, which show case you have to create a deployment (and under the hood a pod), to run a Kerberos Agent workload. + +## Create a Kerberos Agent deployment + +It's always a best practices to isolate and structure your workloads in Kubernetes. To achieve this we are utilising the concept of namespaces. For this example we will create a new namespace `demo`. + + kubectl create namespace demo + +Now we have a namespace, have a look at `deployment-agent.yml` in this folder. This configuration file describes the Kubernetes resources we would like to create, and how the Kerberos Agent needs to behave: environment variables, container ports, etc. At the bottom of the file, we find a `service` part, this tells Kubernetes to expose the Kerberos Agent user interface on a publicly accessible IP address. **_Please note that you don't need to expose this, as you can configure the Kerberos Agent with a volume and/or environment variables._** + +Let's move on, and apply the Kerberos Agent deployment and service. + + kubectl apply -f deployment-agent.yml -n demo + +Watch deployment and service to be ready. + + watch kubectl get all -n demo + +When the deployment and service is created successfully, you should see something like this. + + Every 2.0s: kubectl get all -n demo Fri Dec 9 16:33:17 2022 + + NAME READY STATUS RESTARTS AGE + pod/agent-7c75c4dbcf-zxrb5 1/1 Running 0 19s + + NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE + service/agent-svc LoadBalancer 10.x.x.x 108.x.x.x 80:32664/TCP 20s + + NAME READY UP-TO-DATE AVAILABLE AGE + deployment.apps/agent 1/1 1 1 20s + + NAME DESIRED CURRENT READY AGE + replicaset.apps/agent-7c75c4dbcf 1 1 1 20s + +When copying the `EXTERNAL-IP` and pasting it in your browser, you should see the Kerberos Agent user interface. You can use [the default username and password to sign-in](https://github.com/kerberos-io/agent#access-the-kerberos-agent), or if changed to your own (which is recommended). diff --git a/deployments/kubernetes/deployment-agent-with-ingress.yml b/deployments/kubernetes/deployment-agent-with-ingress.yml new file mode 100644 index 0000000..adfe6cb --- /dev/null +++ b/deployments/kubernetes/deployment-agent-with-ingress.yml @@ -0,0 +1,82 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: agent + labels: + name: agent +spec: + selector: + matchLabels: + app: agent + replicas: 1 + template: + metadata: + labels: + app: agent + spec: + containers: + - name: agent + image: kerberos/agent:latest + ports: + - containerPort: 80 + protocol: TCP + resources: + limits: + cpu: 100m + memory: 128Mi + requests: + cpu: 100m + memory: 128Mi + env: + - name: AGENT_NAME + value: demo-agent + - name: AGENT_CAPTURE_IPCAMERA_RTSP + value: rtsp://fake.kerberos.io/stream + - name: AGENT_HUB_KEY + value: yyy + - name: AGENT_HUB_PRIVATE_KEY + value: yyy + # find full list of environment variables here: https://github.com/kerberos-io/agent#override-with-environment-variables +--- +apiVersion: v1 +kind: Service +metadata: + name: agent-svc + labels: + name: agent-svc +spec: + #type: LoadBalancer + ports: + - port: 80 + targetPort: 80 + selector: + app: agent +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: agent-ingress + labels: + name: agent-ingress + annotations: + kubernetes.io/ingress.class: nginx + kubernetes.io/tls-acme: "true" + nginx.ingress.kubernetes.io/ssl-redirect: "true" + cert-manager.io/cluster-issuer: "letsencrypt-prod" +spec: + tls: + - hosts: + - "demo.kerberos.io" + secretName: agent-secret + rules: + - host: demo.kerberos.io + http: + paths: + - pathType: Prefix + path: "/" + backend: + service: + name: agent-svc + port: + number: 80 + \ No newline at end of file diff --git a/deployments/kubernetes/deployment-agent.yml b/deployments/kubernetes/deployment-agent.yml new file mode 100644 index 0000000..b5dc48f --- /dev/null +++ b/deployments/kubernetes/deployment-agent.yml @@ -0,0 +1,53 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: agent + labels: + name: agent +spec: + selector: + matchLabels: + app: agent + replicas: 1 + template: + metadata: + labels: + app: agent + spec: + containers: + - name: agent + image: kerberos/agent:latest + ports: + - containerPort: 80 + protocol: TCP + resources: + limits: + cpu: 100m + memory: 128Mi + requests: + cpu: 100m + memory: 128Mi + env: + - name: AGENT_NAME + value: demo-agent + - name: AGENT_CAPTURE_IPCAMERA_RTSP + value: rtsp://fake.kerberos.io/stream + - name: AGENT_HUB_KEY + value: yyy + - name: AGENT_HUB_PRIVATE_KEY + value: yyy + # find full list of environment variables here: https://github.com/kerberos-io/agent#override-with-environment-variables +--- +apiVersion: v1 +kind: Service +metadata: + name: agent-svc + labels: + name: agent-svc +spec: + type: LoadBalancer + ports: + - port: 80 + targetPort: 80 + selector: + app: agent \ No newline at end of file diff --git a/machinery/src/routers/http/JWTMiddleware.go b/machinery/src/routers/http/JWTMiddleware.go index 802c9a0..def9079 100644 --- a/machinery/src/routers/http/JWTMiddleware.go +++ b/machinery/src/routers/http/JWTMiddleware.go @@ -2,6 +2,7 @@ package http import ( "net/http" + "os" "time" jwt "github.com/appleboy/gin-jwt/v2" @@ -45,9 +46,18 @@ func JWTMiddleWare() jwt.GinJWTMiddleware { username := loginVals.Username password := loginVals.Password - usernameENV := "root" - passwordENV := "root" - if username == usernameENV && password == passwordENV { + // Get username from ENV + usernameFromConfig := os.Getenv("AGENT_USERNAME") + if usernameFromConfig == "" { + usernameFromConfig = "root" + } + // Get password from ENV + passwordFromConfig := os.Getenv("AGENT_PASSWORD") + if passwordFromConfig == "" { + passwordFromConfig = "root" + } + + if username == usernameFromConfig && password == passwordFromConfig { return &models.User{ Username: username, Role: "admin",