Deploy Satori Customer Hosted on AWS EKS

The following section describes the main components of the Satori Customer Hosted (CH) platform and how to deploy them on AWS EKS.

Introduction to Satori CH for AWS EKS

The Satori CH platform consists of two main components:

• The Satori Management service, maintained by Satori.
• The Satori Customer Hosted (CH) Data Access Controller (DAC), a Kubernetes container that is either consumed as a service or deployed on an AWS Elastic Kubernetes Service (EKS) inside the customer's VPC.

Deploying the Satori CH DAC

Deploy the Satori CH DAC in the same public cloud region as the data stores that the Satori CH DAC is meant to protect.

For example, customers using Redshift on AWS us-east-1 should deploy the Satori DAC on a VPC in the same region (AWS us-east-1).

Multi-Region Deployments

For customers who operate data stores in multiple regions, a Satori CH DAC should be deployed for each separate region.

Satori VPC Deployment Architecture on AWS EKS

The following two diagrams illustrate the Satori architecture when deployed in a customer's virtual private cloud (VPC) on AWS.

Illustration 1 - High Level Satori Deployment on AWS EKS Architecture
Illustration 2 - Kubernetes Cluster Architecture

High level Deployment Steps

Satori provides assistance for the following deployment steps for a Customer Hosted DAC, including:

1. Customer Task
   • Prepare the network for deployment.
2. Customer Task
   • Prepare the kubernetes cluster.
3. Customer Task
   • Deploy the Satori DAC.
4. Satori Task
   • Reference a new CNAME for the DAC.
5. Operational Task
   • Configure a self-hosted DNS and SSL for the DAC.

Satori CH DAC Network Configuration

The Satori CH DAC requires the following network path configurations:

1. User Connection to the Satori DAC
   • Users connect to data stores via the Satori DAC, therefore a network path from users to the Satori DAC is required.
2. Satori DAC Connection to the Data Store
   • the Satori DAC receives queries from users and then sends them to the data stores it protects, so a network path from the Satori DAC to the data stores is required. Typically, this is established by deploying the Satori DAC in the same VPC as the data stores it protects and ensuring that the AWS security groups allow access from the Satori DAC to the data stores.
3. Verify the egress traffic to the following host addresses: app.satoricyber.com, *.google.com, *.googleapis.com and us-docker.pkg.dev on port 443.
4. Verify the egress traffic to the following host addresses: cortex.satoricyber.net, alert1.satoricyber.net, alert2.satoricyber.net, alert3.satoricyber.net.

Private or Public Facing Data Access Controller

You can choose to deploy a private, VPC-only facing Satori CH DAC, or a public, internet-facing Satori CH DAC.

Prerequisites

To deploy an EKS cluster, ensure the following access privileges and third party products are installed and made available:

1. Administrator Level Access to the Following AWS Services - IAM, VPC, NAT gateway, Internet gateway, Network Load Balancer, CloudWatch, KMS, EKS, EFS (only for Fargate-based deployments).
2. Helm 3 is installed on the Command Line - To verify helm is installed run the following command: helm version. To download helm go Helm.
3. kubectl is installed on the Command Line - To verify kubectl is installed run the following command: kubectl version. To download kubectl go to Kubernetes Tool Installations.
4. AWS Command Line Tools are Installed - To verify that aws cli is installed and then run the following command: aws --version. To download aws cli go to the following AWS amazon CLI Installation.

Recommended Cluster Specification

• Creating Nodes - 3 m6i.large or similar EC2 nodes. Satori recommends that you create three node groups.
• Disk Space Allocation - 20Gb Ephemeral storage in every node. Satori recommends that you create nodes with 50 GB disk space.
• Load Balancer Controller - AWS Load Balancer Controller.
• EBS CSI Driver - AWS Elastic Block Storage (EBS) CSI Driver.
• Subnet Configuration - 3 public subnets in different availability zones with NAT gateway deployed.
• Cluster Scaling - 3 private subnets in different availability zones.
• CNI Plugin Version - The EKS cluster must have the CNI plugin version 1.8.0 or later.

Setting Up a Kubernetes Cluster on EKS

Satori recommends using the Satori eksctl tool to create the EKS cluster.

• Cloning the Git repo - Clone the eksctl_tool Github repository: git clone git@github.com:SatoriCyber/dac-tools.git.
• Authenticating the AWS Account - Ensure that the AWS CLI on the terminal is authenticated to the correct AWS account.
• Running the Script - Run the create-cluster.sh script.
• Generating Credentials - After the cluster has been created, generate credentials to access it from the command line.

aws eks update-kubeconfig --region <REGION> --name <CLUSTER_NAME>

• To test that you have access to the cluster run the following command:

kubectl get pods -A

Testing Installed EKS

• Satori provides a tool for verifying Kubernetes prerequisites.
• Satori provides a tool for verifying AWS infrastructure prerequisites.

Deploying the Satori Helm Chart on the Cluster

The Satori helm chart is available in a deployment package which you download from the Satori management console for first time installation of the DAC. Follow these steps:

1. Login to the Satori management console at Satori Management Console.
2. Go to Settings, Data Access Controllers and select the DAC to deploy to.
3. Select the Upgrade Settings tab and download the recommended deployment package.
4. Extract the deployment package and run the command:

kubectl apply -f ./runtime-prometheus-server.yaml

5. Run the main DAC install command:

helm upgrade --install --create-namespace -n satori-runtime --values version-values.yaml --values customer-values.yaml --values customer-override.yaml --set bootstrapOTP=<OneTimePassword> runtime .

Open required ports in the AWS security group

If your DAC uses a public load balancer, all of the required ports are opened automatically by the AWS load balancer controller installed previously.

Creating a DNS Zone for the Cluster

Satori generates a unique hostname for each data store that it protects in a DNS zone that is unique for each DAC.

For private-facing DACs, create a private DNS zone on the AWS Route53 or any other organizational DNS service.

For public-facing customer-hosted DACs, Satori hosts the DNS zone.

For more information see examples in the document regarding creating DNS records in AWS Route53 or similar DNS configurations.