Implement Kubernetes network policies with Calico CNI and OPA Gatekeeper for security enforcement

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# Global variables
CALICO_VERSION=${1:-"v3.27.0"}
KUBECONFIG_PATH=${KUBECONFIG:-"$HOME/.kube/config"}
TEMP_DIR="/tmp/k8s-security-install"

# Cleanup function
cleanup() {
    echo -e "${YELLOW}Cleaning up temporary files...${NC}"
    rm -rf "$TEMP_DIR"
}

# Error handler
error_handler() {
    echo -e "${RED}Error occurred in script at line: ${1}. Exiting...${NC}"
    cleanup
    exit 1
}

trap 'error_handler ${LINENO}' ERR
trap cleanup EXIT

usage() {
    echo "Usage: $0 [CALICO_VERSION]"
    echo "Example: $0 v3.27.0"
    echo "If no version specified, defaults to v3.27.0"
    exit 1
}

# Detect distribution
detect_distro() {
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        case "$ID" in
            ubuntu|debian) 
                PKG_MGR="apt"
                PKG_INSTALL="apt install -y"
                PKG_UPDATE="apt update"
                ;;
            almalinux|rocky|centos|rhel|ol|fedora) 
                PKG_MGR="dnf"
                PKG_INSTALL="dnf install -y"
                PKG_UPDATE="dnf check-update || true"
                ;;
            amzn) 
                PKG_MGR="yum"
                PKG_INSTALL="yum install -y"
                PKG_UPDATE="yum check-update || true"
                ;;
            *) 
                echo -e "${RED}Unsupported distro: $ID${NC}"
                exit 1 
                ;;
        esac
    else
        echo -e "${RED}/etc/os-release not found. Cannot detect distribution.${NC}"
        exit 1
    fi
}

# Check if running as root or with sudo
check_privileges() {
    if [[ $EUID -ne 0 ]] && ! sudo -n true 2>/dev/null; then
        echo -e "${RED}This script requires root privileges or passwordless sudo${NC}"
        exit 1
    fi
}

# Check prerequisites
check_prerequisites() {
    echo -e "${YELLOW}[1/10] Checking prerequisites...${NC}"
    
    # Check if kubectl is installed and configured
    if ! command -v kubectl &> /dev/null; then
        echo -e "${RED}kubectl is not installed or not in PATH${NC}"
        exit 1
    fi
    
    # Check if kubectl can connect to cluster
    if ! kubectl cluster-info &> /dev/null; then
        echo -e "${RED}kubectl cannot connect to Kubernetes cluster${NC}"
        exit 1
    fi
    
    # Check if user has admin access
    if ! kubectl auth can-i '*' '*' --all-namespaces &> /dev/null; then
        echo -e "${RED}Insufficient cluster permissions. Admin access required.${NC}"
        exit 1
    fi
    
    # Check if helm is installed
    if ! command -v helm &> /dev/null; then
        echo -e "${YELLOW}Helm not found. Installing...${NC}"
        install_helm
    fi
    
    echo -e "${GREEN}Prerequisites check passed${NC}"
}

# Install Helm
install_helm() {
    $PKG_UPDATE
    case "$PKG_MGR" in
        apt)
            curl https://baltocdn.com/helm/signing.asc | sudo apt-key add -
            echo "deb https://baltocdn.com/helm/stable/debian/ all main" | sudo tee /etc/apt/sources.list.d/helm-stable-debian.list
            apt update
            $PKG_INSTALL helm
            ;;
        dnf|yum)
            curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3
            chmod 755 get_helm.sh
            ./get_helm.sh
            rm -f get_helm.sh
            ;;
    esac
}

# Setup working directory
setup_working_dir() {
    echo -e "${YELLOW}[2/10] Setting up working directory...${NC}"
    mkdir -p "$TEMP_DIR"
    chmod 755 "$TEMP_DIR"
    echo -e "${GREEN}Working directory created: $TEMP_DIR${NC}"
}

# Install Calico CNI
install_calico() {
    echo -e "${YELLOW}[3/10] Installing Calico CNI...${NC}"
    
    kubectl create -f "https://raw.githubusercontent.com/projectcalico/calico/${CALICO_VERSION}/manifests/tigera-operator.yaml"
    
    # Wait for tigera-operator to be ready
    kubectl wait --for=condition=Ready pods --all -n tigera-operator --timeout=300s
    
    echo -e "${GREEN}Calico operator installed successfully${NC}"
}

# Configure Calico installation
configure_calico() {
    echo -e "${YELLOW}[4/10] Configuring Calico installation...${NC}"
    
    cat > "$TEMP_DIR/calico-custom-resources.yaml" << 'EOF'
apiVersion: operator.tigera.io/v1
kind: Installation
metadata:
  name: default
spec:
  calicoNetwork:
    ipPools:
    - blockSize: 26
      cidr: 10.244.0.0/16
      encapsulation: VXLANCrossSubnet
      natOutgoing: Enabled
      nodeSelector: all()
  nodeMetricsPort: 9091
---
apiVersion: operator.tigera.io/v1
kind: APIServer
metadata:
  name: default
spec: {}
EOF
    
    chmod 644 "$TEMP_DIR/calico-custom-resources.yaml"
    kubectl apply -f "$TEMP_DIR/calico-custom-resources.yaml"
    
    echo -e "${GREEN}Calico configuration applied${NC}"
}

# Wait for Calico to be ready
wait_for_calico() {
    echo -e "${YELLOW}[5/10] Waiting for Calico to be ready...${NC}"
    
    # Wait for calico-system namespace to exist
    until kubectl get namespace calico-system &> /dev/null; do
        echo "Waiting for calico-system namespace..."
        sleep 5
    done
    
    kubectl wait --for=condition=Ready pods --all -n calico-system --timeout=600s
    
    echo -e "${GREEN}Calico is ready${NC}"
}

# Verify Calico installation
verify_calico() {
    echo -e "${YELLOW}[6/10] Verifying Calico installation...${NC}"
    
    kubectl get pods -n calico-system
    kubectl get nodes -o wide
    
    echo -e "${GREEN}Calico verification completed${NC}"
}

# Install OPA Gatekeeper
install_gatekeeper() {
    echo -e "${YELLOW}[7/10] Installing OPA Gatekeeper...${NC}"
    
    helm repo add gatekeeper https://open-policy-agent.github.io/gatekeeper/charts
    helm repo update
    
    cat > "$TEMP_DIR/gatekeeper-values.yaml" << 'EOF'
replicas: 3
revisionHistoryLimit: 10
controllerManager:
  resources:
    limits:
      cpu: 1000m
      memory: 512Mi
    requests:
      cpu: 100m
      memory: 256Mi
audit:
  resources:
    limits:
      cpu: 1000m
      memory: 512Mi
    requests:
      cpu: 100m
      memory: 256Mi
postInstall:
  labelNamespace:
    enabled: true
EOF
    
    chmod 644 "$TEMP_DIR/gatekeeper-values.yaml"
    
    helm install gatekeeper gatekeeper/gatekeeper \
        --namespace gatekeeper-system \
        --create-namespace \
        --values "$TEMP_DIR/gatekeeper-values.yaml"
    
    echo -e "${GREEN}Gatekeeper installed successfully${NC}"
}

# Wait for Gatekeeper to be ready
wait_for_gatekeeper() {
    echo -e "${YELLOW}[8/10] Waiting for Gatekeeper to be ready...${NC}"
    
    kubectl wait --for=condition=Ready pods --all -n gatekeeper-system --timeout=300s
    
    echo -e "${GREEN}Gatekeeper is ready${NC}"
}

# Create test namespaces
create_test_namespaces() {
    echo -e "${YELLOW}[9/10] Creating test namespaces...${NC}"
    
    kubectl create namespace frontend --dry-run=client -o yaml | kubectl apply -f -
    kubectl create namespace backend --dry-run=client -o yaml | kubectl apply -f -
    kubectl create namespace database --dry-run=client -o yaml | kubectl apply -f -
    
    echo -e "${GREEN}Test namespaces created${NC}"
}

# Final verification
final_verification() {
    echo -e "${YELLOW}[10/10] Performing final verification...${NC}"
    
    echo "Calico system pods:"
    kubectl get pods -n calico-system
    
    echo -e "\nGatekeeper system pods:"
    kubectl get pods -n gatekeeper-system
    
    echo -e "\nTest namespaces:"
    kubectl get namespaces frontend backend database
    
    echo -e "\nNodes with Calico:"
    kubectl get nodes -o wide
    
    echo -e "${GREEN}Installation completed successfully!${NC}"
    echo -e "${GREEN}You can now configure network policies and admission control policies${NC}"
}

# Main function
main() {
    if [[ $# -gt 1 ]]; then
        usage
    fi
    
    echo -e "${GREEN}Starting Kubernetes Security Installation with Calico CNI and OPA Gatekeeper${NC}"
    
    detect_distro
    check_privileges
    check_prerequisites
    setup_working_dir
    install_calico
    configure_calico
    wait_for_calico
    verify_calico
    install_gatekeeper
    wait_for_gatekeeper
    create_test_namespaces
    final_verification
    
    echo -e "${GREEN}Installation completed successfully!${NC}"
}

main "$@"