# Kubernetes Deployment — File Inspection Engine

> Deploy File Inspection Engine on Kubernetes with Helm. Covers GKE setup, chart configuration, persistent storage, and Spectra Core instance scaling.

## Introduction

A typical File Inspection Engine (FIE) installation is performed on Kubernetes using Helm. Throughout this document, we'll be using Google Kubernetes Engine (GKE) as an example. 

For managed Kubernetes solutions, you may also need to use vendor-specific tools to interact with the cluster. In our example, this will be `gcloud`. To install `gcloud`, follow [these steps](https://cloud.google.com/sdk/docs/install).

------

## Deploying FIE Helm Chart to GKE

Here is an overview of deploying the FIE Helm chart to a GKE cluster:

### Prerequisites

- A GKE cluster is available.
- `kubectl` is configured to work with your cluster.
- Helm is installed.

------

### Example: Configuring `kubectl` for a Specific Cluster

1. **List Available GKE Clusters:**

   ```bash
   gcloud container clusters list
   ```

   **Example Output:**

   ```bash
   NAME                   LOCATION  MASTER_VERSION      MASTER_IP      MACHINE_TYPE  NODE_VERSION        NUM_NODES  STATUS
   gke-autopilot-ado-dev  us-east4  1.28.8-gke.1095000  35.199.55.139  e2-small      1.28.8-gke.1095000  2          RUNNING
   ```

2. **Get Cluster Credentials:**

   Run the following command to fetch cluster endpoint and authentication data:

   ```
   gcloud container clusters get-credentials gke-autopilot-ado-dev --region us-east4
   ```

   **Output:**

   ```bash
   Fetching cluster endpoint and auth data.
   kubeconfig entry generated for gke-autopilot-ado-dev.
   ```

------

The FIE Helm chart requires valid Spectra Intelligence credentials, which will be provided by ReversingLabs.

## Install FIE Using Helm

The examples provided use a placeholder account (`u/example/fie`). Be sure to replace this with your actual credentials wherever applicable.

### Customize the Installation with a Values File

For the full list of available values, see the [example values.yaml](./Examples/values.md) file.

You can modify values such as ingress or storage class according to your needs. This example exposes the application internally using a load balancer service.

### Set the password and install the Helm Chart

1. Store the password in a variable:

   ```bash
   read -rs SPECTRA_INTELLIGENCE_PASSWORD
   ```

2. Log in to the ReversingLabs container registry:

   ```bash
   echo "${SPECTRA_INTELLIGENCE_PASSWORD}" | helm registry login -u "u/example/fie" --password-stdin registry.reversinglabs.com
   ```

3. Install the Helm chart:

   ```bash
   $ helm install fie oci://registry.reversinglabs.com/fie/charts/fie \
     --create-namespace --namespace fie \
     --set settings.cloudPassword="${SPECTRA_INTELLIGENCE_PASSWORD}" \
     --values values-deploy-example-gcp.yaml \
     --set-file licenseFileContent=rl-license.enc
   ```

   **Expected Output:**

   ```bash
   Pulled: registry.reversinglabs.com/fie/charts/fie:0.2.1
   Digest: sha256:61ed7f0761912cc5052ceac1d71654f3c1f89f543df0ab6ae3d199070ab02084
   NAME: fie
   LAST DEPLOYED: Tue May 28 11:20:34 2024
   NAMESPACE: fie
   STATUS: deployed
   REVISION: 1
   TEST SUITE: None
   ```

### CPU Requests

The `/status` endpoint shows both counts (`available_*`) and percentages (`percentage_*`) for Spectra Core instances.
The percentages are based on the value of the `RL_CPU_REQUEST` environment variable.

- **Helm deployments**: Helm automatically maps `resources.requests.cpu` into this variable. No extra configuration is needed.
- **Non-Helm deployments**: You must set `RL_CPU_REQUEST` yourself. This does not affect how many Spectra Core instances are created or how Kubernetes schedules the pod. It only affects how percentages are reported in `/status`.

You can provide this value in three ways:

1. **Command-line flag**
   ```yaml
   args: ["--cpu-request=8"]
   ```

2. **Environment variable**

    ```yaml
    env:
     - name: RL_CPU_REQUEST
       value: "8"
    ```

3. **Kubernetes Downward API**

    ```yaml
    resources:
      requests:
        cpu: "8"
    env:
     - name: RL_CPU_REQUEST
       valueFrom:
        resourceFieldRef:
          containerName: fie
          resource: requests.cpu
    ```

In this last example, the Pod requests 8 CPUs, and Kubernetes injects that value into the container as `RL_CPU_REQUEST`.
FIE then uses it only for calculating the `percentage_*` fields in `/status`.

------

### Get the application URL

After deployment, obtain the application URL and port by running one of the following commands:

1. **LoadBalancer IP:**

   > **Note:** It may take a few minutes for the LoadBalancer IP to be available. You can watch the status by running `kubectl get --namespace fie-ag svc -w fie`.

   ```bash
   export SERVICE_IP=$(kubectl get svc --namespace fie fie \
     --template "{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}")
   echo http://$SERVICE_IP:8000
   ```

2. **Verify the deployment**

   ```bash
   kubectl -n fie get svc/fie
   ```

   **Expected output**

   ```bash
   NAME   TYPE           CLUSTER-IP      EXTERNAL-IP   PORT(S)          AGE
   fie    LoadBalancer   34.118.234.76   10.128.0.24   8000:32132/TCP   32m
   ```

---

Once you have the service IP and port, you can send a test query to the liveness/readiness endpoints:

```bash
curl -v http://10.128.0.24:8000/livez
curl -v http://10.128.0.24:8000/readyz
```

**Note: Check the [Usage](/docs/FileInspectionEngine/usage.md#check-application-liveness) section for more information on these two endpoints.**


---

Alternatively, submit a file for analysis. This only works after the [threat data is fully downloaded](#monitoring-the-threat-data-download):

```bash
curl -sS -X POST --upload-file eicar.com http://10.128.0.24:8000/scan | jq
```

**Expected output**

```json
{
  "classification": "malicious",
  "message": ""
}
```

------

### Monitoring the Threat Data Download

After deployment, the FIE application will begin downloading threat data. This process can take between 30 and 90 minutes, depending on your network speed. You can monitor the download process by running:

```bash
kubectl -n fie logs -f deploy/fie
```

Look for the following message, which indicates that the download process completed successfully:

```json
{"level":"info","component":"threatdata.UpdateManager","time":"2024-09-18T22:32:58.346353125Z","message":"Cloud update run finished"}
```

## Appendix: FIE Helm Chart

### Download the Helm Chart

To download the Helm Chart, run the following commands:

```bash
helm registry login -u "$RL_CLOUD_USERNAME" -p "$RL_CLOUD_PASSWORD" registry.reversinglabs.com
helm pull oci://registry.reversinglabs.com/fie/charts/fie
```
