assemblyline-core 4.4.1.dev399__tar.gz → 4.4.2.dev5__tar.gz

{assemblyline-core-4.4.1.dev399 → assemblyline-core-4.4.2.dev5}/PKG-INFO

@@ -1,13 +1,12 @@
 Metadata-Version: 2.1
 Name: assemblyline-core
-Version: 4.4.1.dev399
+Version: 4.4.2.dev5
 Summary: Assemblyline 4 - Core components
 Home-page: https://github.com/CybercentreCanada/assemblyline-core/
 Author: CCCS Assemblyline development team
 Author-email: assemblyline@cyber.gc.ca
 License: MIT
 Keywords: assemblyline automated malware analysis gc canada cse-cst cse cst cyber cccs
-Platform: UNKNOWN
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers
 Classifier: Topic :: Software Development :: Libraries
@@ -15,6 +14,9 @@ Classifier: License :: OSI Approved :: MIT License
 Classifier: Programming Language :: Python :: 3.7
 Classifier: Programming Language :: Python :: 3.8
 Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
 Description-Content-Type: text/markdown
 Provides-Extra: test
 License-File: LICENCE.md
@@ -56,5 +58,3 @@ Make sure the different services get their latest update files.
 ##### Workflow
 
 Run the different workflows in the system and apply their labels, priority and status.
-
-

assemblyline-core-4.4.2.dev5/assemblyline_core/VERSION

@@ -0,0 +1 @@
+4.4.2.dev5

{assemblyline-core-4.4.1.dev399 → assemblyline-core-4.4.2.dev5}/assemblyline_core/scaler/controllers/kubernetes_ctl.py

@@ -8,12 +8,16 @@ import threading
 import weakref
 import urllib3
 
+from base64 import b64encode
+from cryptography import x509
+from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.hazmat.primitives import serialization, hashes
 from collections import OrderedDict, defaultdict
+from datetime import datetime, timedelta
 from typing import List, Optional, Tuple
 from time import sleep
 from assemblyline.odm.models.config import Selector
 
-
 from kubernetes import client, config, watch
 from kubernetes.client import V1Deployment, V1DeploymentSpec, V1PodTemplateSpec, V1DeploymentStrategy, \
     V1PodSpec, V1PodOS, V1ObjectMeta, V1Volume, V1Container, V1VolumeMount, V1EnvVar, V1ConfigMapVolumeSource, \
@@ -41,6 +45,7 @@ UNPRIVILEGED_SERVICE_ACCOUNT_NAME = os.environ.get('UNPRIVILEGED_SERVICE_ACCOUNT
 PRIVILEGED_SERVICE_ACCOUNT_NAME = os.environ.get('PRIVILEGED_SERVICE_ACCOUNT_NAME', None)
 
 AL_ROOT_CA = os.environ.get('AL_ROOT_CA', '/etc/assemblyline/ssl/al_root-ca.crt')
+AL_ROOT_CA_PK = os.environ.get('AL_ROOT_CA_PK', '/etc/assemblyline/ssl/al_root-ca.key')
 
 _exponents = {
     'ki': 2**10,
@@ -1071,19 +1076,71 @@ class KubernetesController(ControllerInterface):
             List[V1VolumeMount]]:
         volumes, mounts = [], []
         deployment_strategy = V1DeploymentStrategy()  # Default strategy should be RollingUpdate
-        if container_name == 'updates':
-            # Since we reserved containers named 'updates' to be service updaters, they will always 'Recreate'
-            deployment_strategy = V1DeploymentStrategy(type='Recreate')
-
-            if os.path.exists(AL_ROOT_CA):
-                # Specifically for service updaters when internal encryption is enabled on the cluster
-                update_cert_dir = "/etc/assemblyline/ssl/al_updates"
-                volumes.append(V1Volume(name='updates-cert', secret=V1SecretVolumeSource(secret_name='updates-cert')))
-                mounts.append(V1VolumeMount(name="updates-cert", mount_path=update_cert_dir, read_only=True))
-
-                # Pass gunicorn settings via env
-                spec.container.environment.append({'name': 'CERTFILE', 'value': os.path.join(update_cert_dir, 'tls.crt')})
-                spec.container.environment.append({'name': 'KEYFILE', 'value': os.path.join(update_cert_dir, 'tls.key')})
+
+        # Since we reserved containers named 'updates' to be service updaters, they will always 'Recreate'
+        deployment_strategy = V1DeploymentStrategy(type='Recreate')
+
+        if os.path.exists(AL_ROOT_CA):
+            # Specifically for service updaters when internal encryption is enabled on the cluster
+            dep_cert_dir = f"/etc/assemblyline/ssl/al_{container_name}"
+
+            cert_secret_name = f"{deployment_name}-cert"
+            try:
+                self.api.read_namespaced_secret(
+                    name=cert_secret_name, namespace=self.namespace, _request_timeout=API_TIMEOUT)
+            except ApiException as error:
+                if error.status != 404:
+                    raise
+
+                # Certificate pair doesn't exist for this dependency, create it
+                with open(AL_ROOT_CA, 'rb') as root_ca:
+                    rootca_cert = x509.load_pem_x509_certificate(root_ca.read())
+                with open(AL_ROOT_CA_PK, 'rb') as root_ca_pk:
+                    rootca_pk = serialization.load_pem_private_key(root_ca_pk.read(), None)
+
+                cert_key = rsa.generate_private_key(65537, 2048)
+                cert = x509.CertificateBuilder(issuer_name=rootca_cert.issuer,
+                                               subject_name=x509.Name([
+                                                   x509.NameAttribute(x509.OID_COMMON_NAME, deployment_name)
+                                               ]),
+                                               not_valid_before=(datetime.utcnow() - timedelta(days=1)),
+                                               not_valid_after=(datetime.utcnow() + timedelta(days=36500)),
+                                               public_key=cert_key.public_key(),
+                                               serial_number=x509.random_serial_number(),
+                                               ).add_extension(
+                                                   x509.SubjectAlternativeName([x509.DNSName(deployment_name)]),
+                                                   critical=False
+                ).sign(rootca_pk, hashes.SHA256())
+
+                # Push the key pair into namespace as a secret
+                self.api.create_namespaced_secret(namespace=self.namespace,
+                                                  _request_timeout=API_TIMEOUT,
+                                                  body=V1Secret(
+                                                      metadata=V1ObjectMeta(name=cert_secret_name,
+                                                                            namespace=self.namespace),
+                                                      type='kubernetes.io/tls',
+                                                      data={
+                                                          'tls.crt': b64encode(
+                                                              cert.public_bytes(serialization.Encoding.PEM)
+                                                          ).decode(),
+                                                          'tls.key': b64encode(
+                                                              cert_key.private_bytes(
+                                                                  encoding=serialization.Encoding.PEM,
+                                                                  format=serialization.PrivateFormat.PKCS8,
+                                                                  encryption_algorithm=serialization.NoEncryption()
+                                                              )
+                                                          ).decode()
+                                                      }
+                                                  ))
+
+            finally:
+                volumes.append(V1Volume(name=cert_secret_name,
+                                        secret=V1SecretVolumeSource(secret_name=cert_secret_name)))
+                mounts.append(V1VolumeMount(name=cert_secret_name, mount_path=dep_cert_dir, read_only=True))
+
+            # Pass gunicorn settings via env
+            spec.container.environment.append({'name': 'CERTFILE', 'value': os.path.join(dep_cert_dir, 'tls.crt')})
+            spec.container.environment.append({'name': 'KEYFILE', 'value': os.path.join(dep_cert_dir, 'tls.key')})
 
         for volume_name, volume_spec in spec.volumes.items():
             mount_name = f'{deployment_name}-{volume_name}'

{assemblyline-core-4.4.1.dev399 → assemblyline-core-4.4.2.dev5}/assemblyline_core.egg-info/PKG-INFO

@@ -1,13 +1,12 @@
 Metadata-Version: 2.1
 Name: assemblyline-core
-Version: 4.4.1.dev399
+Version: 4.4.2.dev5
 Summary: Assemblyline 4 - Core components
 Home-page: https://github.com/CybercentreCanada/assemblyline-core/
 Author: CCCS Assemblyline development team
 Author-email: assemblyline@cyber.gc.ca
 License: MIT
 Keywords: assemblyline automated malware analysis gc canada cse-cst cse cst cyber cccs
-Platform: UNKNOWN
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers
 Classifier: Topic :: Software Development :: Libraries
@@ -15,6 +14,9 @@ Classifier: License :: OSI Approved :: MIT License
 Classifier: Programming Language :: Python :: 3.7
 Classifier: Programming Language :: Python :: 3.8
 Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
 Description-Content-Type: text/markdown
 Provides-Extra: test
 License-File: LICENCE.md
@@ -56,5 +58,3 @@ Make sure the different services get their latest update files.
 ##### Workflow
 
 Run the different workflows in the system and apply their labels, priority and status.
-
-

{assemblyline-core-4.4.1.dev399 → assemblyline-core-4.4.2.dev5}/setup.py

@@ -33,6 +33,9 @@ setup(
         'Programming Language :: Python :: 3.7',
         'Programming Language :: Python :: 3.8',
         'Programming Language :: Python :: 3.9',
+        'Programming Language :: Python :: 3.10',
+        'Programming Language :: Python :: 3.11',
+        'Programming Language :: Python :: 3.12',
     ],
     keywords="assemblyline automated malware analysis gc canada cse-cst cse cst cyber cccs",
     packages=find_packages(exclude=['deployment/*', 'test/*']),

assemblyline-core-4.4.1.dev399/assemblyline_core/VERSION

@@ -1 +0,0 @@
-4.4.1.dev399