Brizo

Brizo is a lightweight developer tool built from scratch to help developers monitor their Kubernetes (K8) clusters. Prometheus and ChartJS work together to monitor and display important cluster health metrics for a K8s cluster. Brizo also runs your cluster through CIS security testing standards to ensure proper cluster security.

Table of Contents

1. Brizo
2. Features
3. Benefits
4. Privacy Statement
5. Installation
6. Scripts
7. File Structure
8. Our Team
9. License

Features

Brizo offers several key features that make it a valuable tool for kubernetes cluster management:

1. K8s Cluster Structure Display: Brizo automatically generates a visual display of your K8s cluster structure, saving you the effort of tracking your cluster manually in the terminal. Navigate between namespaces with ease to see your deployed Nodes and PODs.

2. Compatibility with Multiple Environments: Brizo is compatible with multiple developer environments, including macOS, Windows, and Linux. Instructions based on your dev environment can be found in the Installation section.

3. Security Testing: Brizo compares your cluster configuration to the CIS security standards, ensuring proper setup for developers. Brizo also offers remediations to address any of the test warnings/failures.

4. Autoscale Testing: Brizo works with Grafana Cloud k6 services to artificially create traffic spikes and monitor your cluster's responsiveness, which helps developers identify potential bottlenecks in their cluster configuration during the development phase.

Benefits

By using Brizo, developers can enjoy numerous benefits, such as:

1. Streamlined Cluster Testing: Brizo automates the security benchmarking of your cluster.

2. Improved Cluster Structure for Autoscaling: Brizo helps developers identify potential bottlenecks in their K8s cluster, which helps improve autoscaling capabilities.

3. Intuitive Dashboards: Brizo offers easy to read, live data charts to visually represent important cluster metrics scraped by Prometheus.

Privacy Statement

Brizo scrapes your K8s cluster for the purpose of displaying metrics and running CIS security protocol benchmark tests. The application does not extract or store any personal data from users. However, as a precaution, developers should avoid using sensitive information when generating clusters. This ensures that no sensitive data is inadvertently recorded or stored in the database.

Installation

1. Ensure you have the required prerequisites installed:

   • npm
   • kubectl
   • EKS Cluster or Minikube Cluster
   • Docker Desktop
   • Grafana Cloud

2. Fork the Brizo repository to your own GitHub account.

3. Clone your forked repository to your local machine.

git clone https://github.com/<YOUR-GITHUB-USERNAME>/brizo.git

4. Navigate to the root project directory and install dependencies.

cd brizo
npm install

EKS-Setup

1. Create an EKS Cluster

• Make sure your instance matches cpu architecture

2. Set up AWS CLI
3. Connect Prometheus
4. Expose the Prometheus service:

• kubectl --namespace=prometheus port-forward deploy/prometheus-server 9090

5. Connect Grafana
6. Expose the Grafana service:

• kubectl port-forward -n grafana svc/grafana 30381:80

7. Build the Kube-Bench Job

Minikube Setup

1. Create a Minkube Cluster
2. Install Helm
3. Create a Prometheus service with Helm

• helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
• helm repo update
• helm install prometheus prometheus-community/prometheus
• kubectl expose service prometheus-server --type=NodePort --target-port=9090 --name=prometheus-server-ext
• minikube service prometheus-server-ext

4. Create a Grafana service with Helm

• helm repo add grafana https://grafana.github.io/helm-charts
• helm repo update
• helm install grafana grafana/grafana
• kubectl expose service grafana --type=NodePort --target-port=3000 --name=grafana-ext
• minikube service grafana-ext

5. Get username and password for Grafana login

• kubectl get secret --namespace default grafana -o jsonpath="{.data.admin-password}" | base64 --decode ; echo

Kube-Bench-EKS

1. aws ecr create-repository --repository-name k8s/kube-bench --image-tag-mutability MUTABLE

• git clone https://github.com/aquasecurity/kube-bench.git
• cd kube-bench
• aws ecr get-login-password --region <YOUR_AWS_REGION> | docker login --username AWS --password-stdin <YOUR_AWS_ACCOUNT_ID>.dkr.ecr.<YOUR_AWS_REGION>.amazonaws.com
• docker build -t kube-bench kube-bench
• docker tag kube-bench:latest <YOUR_AWS_ACCOUNT_ID>.dkr.ecr.<YOUR_AWS_REGION>.amazonaws.com/k8s/kube-bench:latest
• docker push <YOUR_AWS_ACCOUNT_ID>.dkr.ecr.<YOUR_AWS_REGION>.amazonaws.com/k8s/kube-bench:latest
• eksctl create iamidentitymapping --cluster <YOUR_EKS_CLUSTER_NAME> --region=<YOUR_AWS_REGION> --arn arn:aws:iam::<YOUR_AWS_ACCOUNT_ID>:user/<YOUR_IAM_USERNAME> --group system:masters --username admin

Scripts

Below are descriptions of each npm script:

• npm run dev: Starts the development server using Nodemon

File Structure

|____assets
| |____brizo-high-resolution-color-logo.png
| |____Team
| | |____Anna.png
| | |____Cortland.png
| | |____DAWG.png
| | |____Owen.png
| | |____Weston.png
|____kbcommands.md
|____output.txt
|____.eslintrc.json
|____functions.ts
|____src
| |____server
| | |____routers
| | | |____apiRouter.ts
| | | |____securityRouter.ts
| | | |____clusterRouter.ts
| | | |____prometheusRouter.ts
| | | |____k6Router.ts
| | |____controllers
| | | |____k6Controller.ts
| | | |____securityController.ts
| | | |____clusterController.ts
| | | |____prometheusController.ts
| | |____server.ts
| |____client
| | |____index.tsx
| | |____App.tsx
| | |____index.html
| | |____css
| | | |____main.scss
| | | |____skeleton.css
| | | |____normalize.css
| | |____components
| | | |____MemoryUsageChart.tsx
| | | |____ViewNamespace.tsx
| | | |____GrandCISResults.tsx
| | | |____ViewStructure.tsx
| | | |____PodCard.tsx
| | | |____NavbarComponent.tsx
| | | |____NodeCard.tsx
| | | |____MainContainer.tsx
| | | |____StaticPromComponent.tsx
| | | |____CpuUsageChart.tsx
| | | |____ViewCluster.tsx
| | | |____DynamicPromComponent.tsx
| | | |____Loading.tsx
| | | |____CISConfigResult.tsx

Our Team

	Cortland Young GitHub LinkedIn
	Owen Hill GitHub LinkedIn
	Jimmy Tran GitHub LinkedIn
	Weston Schott GitHub LinkedIn
	Anna Yu GitHub LinkedIn

License

This project is licensed under the terms of the MIT LICENSE.