Installing Nemesis on k3s

This guide covers setting up Nemesis on a k3s cluster and exposes the ingress-nginx ports to access Nemesis externally

Install Docker

Before installing k3s, you must have Docker installed on your system as it is a prerequisite for running containerized applications. Follow the Docker installation guide for your specific operating system at the official Docker documentation: Install Docker Engine.

Install k3s

k3s is a lightweight Kubernetes distribution that simplifies the deployment and management of Kubernetes clusters. To install k3s without the Traefik ingress controller (as we will be using ingress-nginx), run the following command:

curl -sfL https://get.k3s.io | sh -

After installing k3s, modify your kubeconfig to use the k3s Kubernetes configuration with the following commands:

export KUBECONFIG=~/.kube/config
mkdir ~/.kube 2> /dev/null
sudo k3s kubectl config view --raw > "$KUBECONFIG"
chmod 600 "$KUBECONFIG"

Install Helm

Follow the Helm installation guide for your specific operating system: Installing Helm.

Install Nemesis Prerequisites

Quickstart

The quickstart Helm chart sets up necessary secrets and configurations for Nemesis. To install the quickstart chart from the SpecterOps repository, use the following command:

helm install --repo https://specterops.github.io/Nemesis/ nemesis-quickstart quickstart

If you need to configure custom values for the quickstart chart, first download the default values:

helm show values nemesis/quickstart > values.yaml

After modifying values.yaml as needed, install the quickstart chart using your customized values:

helm install nemesis-quickstart nemesis/quickstart -f values.yaml

Dependencies

Nemesis requires ingress-nginx for routing HTTP requests and the Elastic operator for managing Elasticsearch instances. Follow these steps to install these dependencies:

Elastic Operator

Install the Elastic operator with the following Helm command to manage Elasticsearch in the default namespace:

helm install elastic-operator eck-operator --repo https://helm.elastic.co --namespace elastic-system --create-namespace --set managedNamespaces='{default}'

Install Nemesis

With the prerequisites in place, you can now install Nemesis. Use the following command to install Nemesis using the SpecterOps Helm repository. This command includes a timeout parameter to ensure the installation process allows enough time to complete:

helm install --repo https://specterops.github.io/Nemesis/ nemesis nemesis --timeout '45m'

Verify Installation

Use the following bash oneliner to get the basic auth secrets and ensure the Nemesis home page is reachable:

$ curl -u $(kubectl get secret basic-auth -o jsonpath='{.data.username}' | base64 -d):$(kubectl get secret basic-auth -o jsonpath='{.data.password}' | base64 -d) http://127.0.0.1

<html>
    <head>
        <title>Nemesis Services</title>
    </head>
    <body>
        <h1>Nemesis Services</h1>

        <h2>Main Services</h2>
        <a href="/dashboard/" target="_blank"">Dashboard</a><br>
...

3.2 KiB Raw Blame History