CybercentreCanada / assemblyline

AssemblyLine 4: File triage and malware analysis
https://cybercentrecanada.github.io/assemblyline4_docs/
MIT License
243 stars 15 forks source link

Feature Request: Scaler should allow windows nodes to be orchestrated #38

Open C-Oliver opened 1 year ago

C-Oliver commented 1 year ago

We have an ever increasing usecase to run windows services, as it stands we are communicating with external environments to run windows binaries.

Describe the solution you'd like Assemblyline, should allow us to orchestrate windows containers as well as Linux containers, this will centralise the management of resources to just the k8s cluster instead of setting up and managing auxiliary infrastructure, which does not necessarily scale as well.

Describe alternatives you've considered Created VMs with an API server to receive process and respond to Assemblyline

Additional context n/a

cccs-rs commented 1 year ago

At least in the case of Kubernetes, we are able to specify the operating system for the service pods (which hopefully translates to coordination of pod deployment to the right/compatible node): https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#podos-v1-core

Error from Scaler when trying to run a Windows Server Core image on my cluster (all Linux nodes): "Container Event :: alsvc-ancestry-windows-5f6bfff885-pfvw2: Failed to admit pod as the OS field doesn't match node OS" So it's a good sign that field is more than just a label/descriptor!

We could probably determine the OS automatically for the main service images since most container registries have an API that allows to get the manifest information. We'll still include the ability to set the OS compatibility manually in the UI, just in case 😀