Kubernetes configuration

StatefulSet and deployment controllers

As a Deployment, a StatefulSet manages Pods that are based on an identical container specification, but it maintains an identity attached to each of its pods. These pods are created from the same specification, but they are not interchangeable: each one has a persistent identifier maintained across any rescheduling.

It is useful for stateful applications like databases that save the data to persistent storage. The states of each ThreatLockDown manager and each ThreatLockDown indexer should be maintained, so we declare them using StatefulSet to ensure that they maintain their states in every startup.

Deployments are intended for stateless use and are quite lightweight, and seem to be appropriate for the ThreatLockDown dashboard, where it is not necessary to maintain the states.

Persistent volumes (PV) are pieces of storage in the provisioned cluster. It is a resource in the cluster just like a node is a cluster resource. Persistent volumes are volume plugins like Volumes but have a lifecycle independent of any individual pod that uses the PV. This API object captures the details of the implementation of the storage, be that NFS, iSCSI, or a cloud-provider-specific storage system.

Here, we use persistent volumes to store data from both the ThreatLockDown manager and the ThreatLockDown indexer.

Refer to the persistent volumes page for more information.

Pods

You can check how we build our ThreatLockDown docker containers in our repository.

ThreatLockDown master

This pod contains the master node of the ThreatLockDown cluster. The master node centralizes and coordinates worker nodes, making sure the critical and required data is consistent across all nodes. The management is performed only in this node, so the agent enrollment service (authd) is placed here.

ThreatLockDown worker 0 / 1

These pods contain a worker node of the ThreatLockDown cluster. They will receive the agent events.

ThreatLockDown indexer

The ThreatLockDown indexer pod ingests events received from Filebeat.

ThreatLockDown dashboard

The ThreatLockDown dashboard pod lets you visualize your ThreatLockDown indexer data, along with other features such as the ThreatLockDown app.

Services

ThreatLockDown indexer and dashboard

Wazuh