Curiefense

Curiefense includes a command-line tool called curieconf_cli.

If you wanted to get the detailed list of existing configurations you would run:

$ curieconf_cli conf list

You can also just use cURL to accomplish the same task:

$ curl -XGET $api_url/configs/

Traffic filtering is performed by the Curiefense proxy, as shown in the first diagram above. In other words, this is where the security policies defined in the Configurations are enforced.

Some activities (such as rate-limiting) require local data storage. Internally, Curiefense uses Redis for this.

The docker-compose deployment process will create Grafana visualizations for Curiefense's traffic data. Curiefense comes with two dashboards out of the box: Traffic Overview and Top Activities. They are available at http://curie.demo:30300/.

curiefense_db_hostname defines the hostname of the PostgreSQL server that will be used to store logs. Defaults to the provided logdb StatefulSet (via Kubernetes workload API). Override this to replace the postgres instance with one you supply, or an Amazon Aurora instance.

Curiefense includes an API with the following namespaces:

• configs (for manipulating Configurations)
• tools (for publishing, etc.)
• db (for accessing persistent key value storage)

These can be explored and seen visually by using Swagger UI via the Curiefense SwaggerHub

curieproxy-istio acts as a reverse proxy and filters traffic according to the active configuration. Sends access logs over gRPC to curielogserver. It uses a custom-built Envoy binary, compiled with symbols needed by Lua.

curieproxy-envoy acts as a reverse proxy. It filters traffic according to the active configuration. Sends access logs over gRPC to curielogserver.

A Vue.js app developed as a single page app with Node.js and serves the management console UI. The UI displays access logs to the user and displays Curiefense's configuration for editing. API calls for configuration and access logs are routed to confserver and curielogserver by the NGINX inside the Docker container.

Redis is accessed by curieproxy, and is used to synchronize Curiefense's advanced rate limiting and session control mechanisms.