Implement Podman pod security with network policies and microsegmentation

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Global variables
SCRIPT_NAME="$(basename "$0")"
CLEANUP_FILES=()
CLEANUP_CHAINS=()

# Usage
usage() {
    echo "Usage: $SCRIPT_NAME [OPTIONS]"
    echo "Options:"
    echo "  -h, --help     Show this help message"
    echo "  --cleanup      Remove installed configurations"
    exit 1
}

# Logging functions
log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1" >&2; }

# Cleanup function
cleanup() {
    log_warn "Cleaning up due to error..."
    for file in "${CLEANUP_FILES[@]}"; do
        [[ -f "$file" ]] && rm -f "$file"
    done
    for chain in "${CLEANUP_CHAINS[@]}"; do
        iptables -t filter -F "$chain" 2>/dev/null || true
        iptables -t filter -X "$chain" 2>/dev/null || true
    done
}

# Trap for cleanup on error
trap cleanup ERR

# Parse arguments
CLEANUP_MODE=false
while [[ $# -gt 0 ]]; do
    case $1 in
        -h|--help) usage ;;
        --cleanup) CLEANUP_MODE=true; shift ;;
        *) log_error "Unknown option: $1"; usage ;;
    esac
done

# Check prerequisites
if [[ $EUID -eq 0 ]]; then
    log_error "Do not run this script as root. Use sudo when needed."
    exit 1
fi

if ! command -v sudo >/dev/null 2>&1; then
    log_error "sudo is required but not installed"
    exit 1
fi

# Auto-detect distro
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian) 
            PKG_MGR="apt"
            PKG_UPDATE="apt update && apt upgrade -y"
            PKG_INSTALL="apt install -y"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora) 
            PKG_MGR="dnf"
            PKG_UPDATE="dnf update -y"
            PKG_INSTALL="dnf install -y"
            ;;
        amzn) 
            PKG_MGR="yum"
            PKG_UPDATE="yum update -y"
            PKG_INSTALL="yum install -y"
            ;;
        *) 
            log_error "Unsupported distro: $ID"
            exit 1
            ;;
    esac
else
    log_error "Cannot detect Linux distribution"
    exit 1
fi

log_info "Detected distribution: $PRETTY_NAME"

# Cleanup mode
if [[ "$CLEANUP_MODE" == true ]]; then
    echo "[1/3] Removing custom iptables chains..."
    sudo iptables -t filter -F PODMAN_FRONTEND_POLICY 2>/dev/null || true
    sudo iptables -t filter -F PODMAN_BACKEND_POLICY 2>/dev/null || true
    sudo iptables -t filter -F PODMAN_MICROSEGMENT 2>/dev/null || true
    sudo iptables -t filter -X PODMAN_FRONTEND_POLICY 2>/dev/null || true
    sudo iptables -t filter -X PODMAN_BACKEND_POLICY 2>/dev/null || true
    sudo iptables -t filter -X PODMAN_MICROSEGMENT 2>/dev/null || true
    
    echo "[2/3] Removing network configurations..."
    sudo rm -f /etc/cni/net.d/89-secure-frontend.conflist
    sudo rm -f /etc/cni/net.d/90-secure-backend.conflist
    
    echo "[3/3] Cleanup completed"
    exit 0
fi

# Main installation
echo "[1/6] Updating system packages..."
sudo $PKG_UPDATE

echo "[2/6] Installing Podman and network tools..."
if [[ "$PKG_MGR" == "apt" ]]; then
    sudo $PKG_INSTALL podman cni-plugins iptables netavark aardvark-dns slirp4netns
else
    sudo $PKG_INSTALL podman cni-plugins iptables netavark aardvark-dns slirp4netns
fi

echo "[3/6] Configuring rootless operation..."
CURRENT_USER=$(whoami)
sudo usermod --add-subuids 100000-165535 --add-subgids 100000-165535 "$CURRENT_USER"

# Configure unprivileged ports
if ! grep -q "net.ipv4.ip_unprivileged_port_start" /etc/sysctl.conf 2>/dev/null; then
    echo "net.ipv4.ip_unprivileged_port_start=80" | sudo tee -a /etc/sysctl.conf
    sudo sysctl -p
fi

# Migrate podman system
podman system migrate 2>/dev/null || true

echo "[4/6] Creating secure network configurations..."
sudo mkdir -p /etc/cni/net.d

# Create secure frontend network
FRONTEND_CONFIG="/etc/cni/net.d/89-secure-frontend.conflist"
CLEANUP_FILES+=("$FRONTEND_CONFIG")

sudo tee "$FRONTEND_CONFIG" > /dev/null <<EOF
{
  "name": "secure-frontend",
  "cniVersion": "1.0.0",
  "plugins": [
    {
      "type": "bridge",
      "bridge": "secure-frontend0",
      "isDefaultGateway": true,
      "ipMasq": true,
      "hairpinMode": true,
      "ipam": {
        "type": "host-local",
        "subnet": "10.89.0.0/24",
        "routes": [
          {
            "dst": "0.0.0.0/0"
          }
        ]
      }
    },
    {
      "type": "firewall",
      "backend": "iptables"
    },
    {
      "type": "tuning"
    }
  ]
}
EOF

# Create secure backend network
BACKEND_CONFIG="/etc/cni/net.d/90-secure-backend.conflist"
CLEANUP_FILES+=("$BACKEND_CONFIG")

sudo tee "$BACKEND_CONFIG" > /dev/null <<EOF
{
  "name": "secure-backend",
  "cniVersion": "1.0.0",
  "plugins": [
    {
      "type": "bridge",
      "bridge": "secure-backend0",
      "isDefaultGateway": false,
      "ipMasq": false,
      "hairpinMode": false,
      "ipam": {
        "type": "host-local",
        "subnet": "10.90.0.0/24"
      }
    },
    {
      "type": "firewall",
      "backend": "iptables",
      "iptablesAdminChainName": "BACKEND_ADMIN"
    }
  ]
}
EOF

sudo chown root:root "$FRONTEND_CONFIG" "$BACKEND_CONFIG"
sudo chmod 644 "$FRONTEND_CONFIG" "$BACKEND_CONFIG"

echo "[5/6] Configuring network policies with iptables..."

# Create custom iptables chains
CHAINS=("PODMAN_FRONTEND_POLICY" "PODMAN_BACKEND_POLICY" "PODMAN_MICROSEGMENT")
for chain in "${CHAINS[@]}"; do
    CLEANUP_CHAINS+=("$chain")
    sudo iptables -t filter -N "$chain" 2>/dev/null || true
    sudo iptables -t filter -F "$chain"
done

# Frontend network policies (10.89.0.0/24)
sudo iptables -t filter -A PODMAN_FRONTEND_POLICY -s 10.89.0.0/24 -p tcp --dport 80 -j ACCEPT
sudo iptables -t filter -A PODMAN_FRONTEND_POLICY -s 10.89.0.0/24 -p tcp --dport 443 -j ACCEPT
sudo iptables -t filter -A PODMAN_FRONTEND_POLICY -s 10.89.0.0/24 -p udp --dport 53 -j ACCEPT
sudo iptables -t filter -A PODMAN_FRONTEND_POLICY -s 10.89.0.0/24 -p tcp --dport 53 -j ACCEPT
sudo iptables -t filter -A PODMAN_FRONTEND_POLICY -s 10.89.0.0/24 -d 10.90.0.0/24 -p tcp --dport 5432 -j ACCEPT
sudo iptables -t filter -A PODMAN_FRONTEND_POLICY -s 10.89.0.0/24 -d 10.90.0.0/24 -p tcp --dport 6379 -j ACCEPT

# Backend network policies (10.90.0.0/24)
sudo iptables -t filter -A PODMAN_BACKEND_POLICY -s 10.90.0.0/24 ! -d 10.0.0.0/8 -j DROP
sudo iptables -t filter -A PODMAN_BACKEND_POLICY -s 10.90.0.0/24 -d 10.89.0.0/24 -m state --state ESTABLISHED,RELATED -j ACCEPT

# Microsegmentation rules
sudo iptables -t filter -A PODMAN_MICROSEGMENT -s 10.89.0.0/24 -d 10.89.0.0/24 -j DROP
sudo iptables -t filter -A PODMAN_MICROSEGMENT -s 10.90.0.0/24 -d 10.90.0.0/24 -j DROP

echo "[6/6] Verifying installation..."

# Verify networks are available
if podman network ls | grep -q "secure-frontend" && podman network ls | grep -q "secure-backend"; then
    log_info "✓ Secure networks created successfully"
else
    log_warn "Networks may need to be recreated after reboot"
fi

# Verify iptables chains
CHAINS_OK=true
for chain in "${CHAINS[@]}"; do
    if ! sudo iptables -t filter -L "$chain" >/dev/null 2>&1; then
        CHAINS_OK=false
        break
    fi
done

if [[ "$CHAINS_OK" == true ]]; then
    log_info "✓ Network policy chains configured successfully"
else
    log_error "Some iptables chains failed to configure"
    exit 1
fi

log_info "✓ Podman security configuration completed successfully!"
echo ""
echo "Next steps:"
echo "1. Create pods with: podman pod create --network secure-frontend --name frontend-pod"
echo "2. Create backend pods with: podman pod create --network secure-backend --name backend-pod"
echo "3. Test network isolation between pods"
echo "4. Use --cleanup flag to remove all configurations"