[Questions and Support]how to deploy in kubernetes？

[13567436138]

Question
Put your question on Maltrail's functionality.

Support
Put descrption of an issue you have with Maltrail settings up.
how to deploy in kubernetes？

[MikhailKasimov]

@ki9us @simonszu Can you give a hint here, please?

[ki9us]

Never used k8 myself.

[MikhailKasimov]

Never used k8 myself.

The same...

[simonszu]

Well, there are no actual deployment manifests for maltrail on k8s. However, the server should get deployed pretty easily, as a deployment. Define a PVC for persistence, have a look at the docker-compose.yml.

Create an ingress for the WebUI. For the connection between the server, i am not aware of the protocol. Is it some kind of HTTP? @MikhailKasimov if yes, create a second ingress for the sensor connection, if not, open a nodeport or something. Only do so if you need to connect external sensors.

If it comes to terms of how to deploy the sensor...no Idea, tbh. Maybe as a daemonset to keep an eye on each node, but you will need to use the host network. Connection between the server and sensor can be done via ServiceURL and Port.

[MikhailKasimov]

OK, thank you for hint

[13567436138]

---
apiVersion: v1
kind: Namespace
metadata:
  name: maltrail
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: maltrail-server-log-pvc
  namespace: maltrail
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi 
  storageClassName: longhorn
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: maltrail-server
  namespace: maltrail
spec:
  replicas: 1
  selector:
    matchLabels:
      app: maltrail
      component: server
  template:
    metadata:
      labels:
        app: maltrail
        component: server
    spec:
      containers:
        - name: server
          image: your-registry/maltrail:latest
          ports:
            - containerPort: 8337
              protocol: UDP 
            - containerPort: 8338
              protocol: TCP 
          volumeMounts:
            - mountPath: /var/log/maltrail
              name: log-volume
          resources:
            requests:
              memory: "512Mi"
              cpu: "500m"
            limits:
              memory: "1Gi"
              cpu: "1000m"
      volumes:
        - name: log-volume
          persistentVolumeClaim:
            claimName: maltrail-server-log-pvc
---
apiVersion: v1
kind: Service
metadata:
  name: maltrail-server-service
  namespace: maltrail
spec:
  selector:
    app: maltrail
    component: server
  ports:
    - name: sensor-udp
      port: 8337
      targetPort: 8337
      protocol: UDP 
    - name: webui-tcp
      port: 8338
      targetPort: 8338
      protocol: TCP
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  name: maltrail-sensor-external
  namespace: maltrail
spec:
  selector:
    app: maltrail
    component: server
  ports:
    - name: sensor-udp
      port: 8337
      targetPort: 8337
      nodePort: 30337 
      protocol: UDP 
  type: NodePort
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: maltrail-webui-ingress
  namespace: maltrail
spec:
  ingressClassName: traefik
  rules:
    - host: maltrail.mark.demo
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: maltrail-server-service
                port:
                  number: 8338
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: maltrail-sensor
  namespace: maltrail
spec:
  selector:
    matchLabels:
      app: maltrail
      component: sensor
  template:
    metadata:
      labels:
        app: maltrail
        component: sensor
    spec:
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      hostPID: true 
      containers:
        - name: sensor
          image: your-registry/maltrail-sensor:latest
          securityContext:
            privileged: true 
            capabilities:
              add: ["NET_RAW", "NET_ADMIN"]
          env:
            - name: MALTRAIL_SERVER
              value: "maltrail-server-service.maltrail.svc.cluster.local"
            - name: MALTRAIL_SERVER_PORT
              value: "8337"
          resources:
            requests:
              memory: "256Mi"
              cpu: "200m"
            limits:
              memory: "512Mi"
              cpu: "500m"

is this ok?