Skip to content

Commit 53dd505

Browse files
committed
Merge branch 'main' into release-2.5
2 parents 57d5df5 + a2cacb8 commit 53dd505

23 files changed

Lines changed: 195 additions & 277 deletions

File tree

Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ export IMAGE_REPOSITORY?=quay.io/deepfenceio
1818
export DF_IMG_TAG?=latest
1919
export STEAMPIPE_IMG_TAG?=0.23.x
2020
export IS_DEV_BUILD?=false
21-
export VERSION?=v2.5.0
21+
export VERSION?=v2.5.1
2222
export AGENT_BINARY_BUILD=$(DEEPFENCE_FARGATE_DIR)/build
2323
export AGENT_BINARY_BUILD_RELATIVE=deepfence_agent/agent-binary/build
2424
export AGENT_BINARY_DIST=$(DEEPFENCE_FARGATE_DIR)/dist

README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -93,10 +93,10 @@ docker run -dit \
9393
-e http_proxy="" \
9494
-e https_proxy="" \
9595
-e no_proxy="" \
96-
quay.io/deepfenceio/deepfence_agent_ce:2.5.0
96+
quay.io/deepfenceio/deepfence_agent_ce:2.5.1
9797
```
9898

99-
Note: Image tag `quay.io/deepfenceio/deepfence_agent_ce:2.5.0-multiarch` is supported in amd64 and arm64/v8 architectures.
99+
Note: Image tag `quay.io/deepfenceio/deepfence_agent_ce:2.5.1-multiarch` is supported in amd64 and arm64/v8 architectures.
100100

101101
On a Kubernetes platform, the sensors are installed using [helm chart](https://community.deepfence.io/threatmapper/docs/v2.5/sensors/kubernetes/)
102102

deepfence_agent/agent-binary/Dockerfile.fargate

Lines changed: 0 additions & 111 deletions
Original file line numberDiff line numberDiff line change
@@ -1,113 +1,3 @@
1-
FROM alpine:3.19 as builder
2-
3-
# renovate: source=github-tags name=curl/curl versioning=regex:^(?:curl-)?(?<major>\d+)_(?<minor>\d+)_(?<patch>\d+)$ extractVersion=^(?:curl-)?(?<version>[\d_]+)$
4-
ENV CURL_VERSION="8_5_0"
5-
6-
# install system dependencies
7-
RUN apk add \
8-
build-base \
9-
clang \
10-
openssl-dev \
11-
nghttp2-dev \
12-
nghttp2-static \
13-
openssl-libs-static \
14-
zlib-static \
15-
autoconf \
16-
automake \
17-
libtool
18-
19-
WORKDIR /tmp
20-
21-
# download curl sources
22-
RUN set -x \
23-
&& CURL_VERSION=$(echo $CURL_VERSION | sed s/_/./g) \
24-
&& wget -O curl.tar.gz "https://curl.haxx.se/download/curl-$CURL_VERSION.tar.gz" \
25-
&& tar xzf curl.tar.gz \
26-
&& rm curl.tar.gz \
27-
&& mv ./curl-* ./src
28-
29-
# change working directory to the directory with curl sources
30-
WORKDIR /tmp/src
31-
32-
# apply patches to the source code
33-
# COPY ./patches ./patches
34-
RUN mkdir -p ./patches \
35-
&& wget https://raw.githubusercontent.com/tarampampam/curl-docker/master/patches/fail-exit-code.patch -O ./patches/fail-exit-code.patch
36-
RUN for f in ./patches/*.patch; do patch -p1 < "$f"; done
37-
38-
ENV CC="clang" \
39-
LDFLAGS="-static" \
40-
PKG_CONFIG="pkg-config --static"
41-
42-
RUN autoreconf -fi
43-
44-
#RUN ./configure --help=short && exit 1 # show the help
45-
46-
RUN ./configure \
47-
--disable-shared \
48-
--enable-static \
49-
\
50-
--enable-dnsshuffle \
51-
--enable-werror \
52-
\
53-
--disable-cookies \
54-
--disable-crypto-auth \
55-
--disable-dict \
56-
--disable-file \
57-
--disable-ftp \
58-
--disable-gopher \
59-
--disable-imap \
60-
--disable-ldap \
61-
--disable-pop3 \
62-
--disable-proxy \
63-
--disable-rtmp \
64-
--disable-rtsp \
65-
--disable-scp \
66-
--disable-sftp \
67-
--disable-smtp \
68-
--disable-telnet \
69-
--disable-tftp \
70-
--disable-versioned-symbols \
71-
--disable-doh \
72-
--disable-netrc \
73-
--disable-mqtt \
74-
--disable-largefile \
75-
--without-gssapi \
76-
--without-libidn2 \
77-
--without-libpsl \
78-
--without-librtmp \
79-
--without-libssh2 \
80-
--without-nghttp2 \
81-
--without-ntlm-auth \
82-
--without-brotli \
83-
--without-zlib \
84-
--with-ssl
85-
86-
# compile the curl
87-
RUN set -x \
88-
&& make -j$(nproc) V=1 LDFLAGS="-static -all-static" \
89-
&& strip ./src/curl
90-
91-
# exit with error code 1 if the executable is dynamic, not static
92-
RUN ldd ./src/curl && exit 1 || true
93-
94-
# print out some info about binary file
95-
RUN set -x \
96-
&& ls -lh ./src/curl \
97-
&& file ./src/curl \
98-
&& ./src/curl --version
99-
100-
WORKDIR /tmp/rootfs
101-
102-
# prepare the rootfs for scratch
103-
RUN set -x \
104-
&& mkdir -p ./bin ./etc/ssl \
105-
&& mv /tmp/src/src/curl ./bin/curl \
106-
&& echo 'curl:x:10001:10001::/nonexistent:/sbin/nologin' > ./etc/passwd \
107-
&& echo 'curl:x:10001:' > ./etc/group \
108-
&& cp -R /etc/ssl/certs ./etc/ssl/certs
109-
110-
1111
FROM scratch
1122

1133
ARG AGENT_BINARY_BUILD_RELATIVE
@@ -120,7 +10,6 @@ WORKDIR /
12010
COPY $AGENT_BINARY_BUILD_RELATIVE /deepfence
12111

12212
COPY deepfence_agent/agent-binary/deepfence-entry-point-scratch.sh deepfence/usr/local/bin/deepfence-entry-point-scratch.sh
123-
COPY --from=builder /tmp/rootfs/bin/curl /deepfence/bin/curl
12413
COPY deepfence_agent/agent-binary/start-df-services-fargate.sh deepfence/usr/local/bin/start-df-services-fargate.sh
12514

12615
VOLUME ["/deepfence"]

deepfence_agent/etc/fenced_logrotate.conf

Lines changed: 0 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,5 @@
11
su root root
22

3-
$DF_INSTALL_DIR/var/log/fenced/*.log {
4-
missingok
5-
notifempty
6-
compress
7-
size 4M
8-
copytruncate
9-
rotate 1
10-
}
11-
$DF_INSTALL_DIR/var/log/fenced/*.logfile {
12-
missingok
13-
notifempty
14-
compress
15-
size 1M
16-
copytruncate
17-
rotate 1
18-
}
193
$DF_INSTALL_DIR/var/log/supervisor/*.log {
204
missingok
215
notifempty
@@ -24,54 +8,6 @@ $DF_INSTALL_DIR/var/log/supervisor/*.log {
248
copytruncate
259
rotate 1
2610
}
27-
$DF_INSTALL_DIR/var/log/fenced/secret-scan/*.log {
28-
missingok
29-
notifempty
30-
compress
31-
size 20M
32-
copytruncate
33-
rotate 1
34-
}
35-
$DF_INSTALL_DIR/var/log/fenced/secret-scan-log/*.log {
36-
missingok
37-
notifempty
38-
compress
39-
size 20M
40-
copytruncate
41-
rotate 1
42-
}
43-
$DF_INSTALL_DIR/var/log/fenced/malware-scan/*.log {
44-
missingok
45-
notifempty
46-
compress
47-
size 20M
48-
copytruncate
49-
rotate 1
50-
}
51-
$DF_INSTALL_DIR/var/log/fenced/malware-scan-log/*.log {
52-
missingok
53-
notifempty
54-
compress
55-
size 20M
56-
copytruncate
57-
rotate 1
58-
}
59-
$DF_INSTALL_DIR/var/log/fenced/compliance/*.log {
60-
missingok
61-
notifempty
62-
compress
63-
size 20M
64-
copytruncate
65-
rotate 1
66-
}
67-
$DF_INSTALL_DIR/var/log/fenced/compliance-scan-logs/*.log {
68-
missingok
69-
notifempty
70-
compress
71-
size 20M
72-
copytruncate
73-
rotate 1
74-
}
7511
$DF_INSTALL_DIR/var/log/deepfenced/*.log {
7612
missingok
7713
notifempty

deepfence_agent/start_agent.sh

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ configure_cron() {
4747
#doesnt work smoothly inside docker!
4848
service cron start
4949
chmod 600 /etc/logrotate.d/fenced_logrotate.conf
50+
sed -i "s/\$DF_INSTALL_DIR/$DF_INSTALL_DIR/g" /etc/logrotate.d/fenced_logrotate.conf
5051
MARK="/etc/logrotate.d/fenced_logrotate.conf"
5152
crontab_output=$(crontab -l)
5253
if [ $(echo "$crontab_output" | grep -ic "$MARK") -eq 0 ]

deepfence_server/pkg/integration/elasticsearch/elasticsearch.go

Lines changed: 72 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -31,42 +31,88 @@ func (e ElasticSearch) SendNotification(ctx context.Context, message []map[strin
3131

3232
var err error
3333

34-
payloadMsg := ""
35-
meta := "{\"index\":{\"_index\":\"" + e.Config.Index + "\"}}\n"
36-
for _, payload := range message {
37-
pl, err := json.Marshal(payload)
34+
// send messages to bulk api
35+
sendBulkRequest := func() error {
36+
payloadMsg := ""
37+
meta := "{\"index\":{\"_index\":\"" + e.Config.Index + "\"}}\n"
38+
for _, payload := range message {
39+
pl, err := json.Marshal(payload)
40+
if err != nil {
41+
return err
42+
}
43+
payloadMsg += meta + string(pl) + "\n"
44+
}
45+
endpointURL := strings.TrimRight(e.Config.EndpointURL, "/")
46+
req, err := http.NewRequest(http.MethodPost, endpointURL+"/_bulk", bytes.NewBuffer([]byte(payloadMsg)))
3847
if err != nil {
48+
log.Error().Err(err).Msg("error on create http request")
3949
return err
4050
}
41-
payloadMsg += meta + string(pl) + "\n"
42-
}
4351

44-
// send message to this elasticsearch using http
45-
// Set up the HTTP request.
46-
endpointURL := strings.TrimRight(e.Config.EndpointURL, "/")
47-
req, err := http.NewRequest(http.MethodPost, endpointURL+"/_bulk", bytes.NewBuffer([]byte(payloadMsg)))
48-
if err != nil {
49-
log.Error().Err(err).Msg("error on create http request")
50-
span.EndWithErr(err)
51-
return err
52-
}
52+
req.Header.Set("Content-Type", "application/x-ndjson")
5353

54-
req.Header.Set("Content-Type", "application/x-ndjson")
54+
if e.Config.AuthHeader != "" {
55+
req.Header.Set("Authorization", e.Config.AuthHeader)
56+
}
5557

56-
if e.Config.AuthHeader != "" {
57-
req.Header.Set("Authorization", e.Config.AuthHeader)
58+
// Make the HTTP request.
59+
resp, err := utils.GetHTTPClient().Do(req)
60+
if err != nil {
61+
log.Error().Err(err).Msg("error on http request")
62+
return intgerr.CheckHTTPError(err)
63+
}
64+
defer resp.Body.Close()
65+
66+
return intgerr.CheckResponseCode(resp, http.StatusOK)
5867
}
68+
err = sendBulkRequest()
5969

60-
// Make the HTTP request.
61-
resp, err := utils.GetHTTPClient().Do(req)
6270
if err != nil {
63-
log.Error().Err(err).Msg("error on http request")
64-
span.EndWithErr(err)
65-
return intgerr.CheckHTTPError(err)
66-
}
67-
defer resp.Body.Close()
71+
log.Warn().Err(err).Msg("error sending to elasticsearch using bulk api, switching to individual requests")
72+
73+
// Try sending the messages individually
74+
endpointURL := strings.TrimRight(e.Config.EndpointURL, "/")
75+
postDocumentURL := fmt.Sprintf("%s/%s/_doc", endpointURL, e.Config.Index)
76+
77+
postDocumentRequest := func(message map[string]interface{}) error {
78+
payloadMsg, err := json.Marshal(message)
79+
if err != nil {
80+
return err
81+
}
82+
83+
req, err := http.NewRequest(http.MethodPost, postDocumentURL, bytes.NewBuffer(payloadMsg))
84+
if err != nil {
85+
log.Error().Err(err).Msg("error on create http request")
86+
return err
87+
}
88+
89+
req.Header.Set("Content-Type", "application/json")
90+
91+
if e.Config.AuthHeader != "" {
92+
req.Header.Set("Authorization", e.Config.AuthHeader)
93+
}
94+
95+
// Make the HTTP request.
96+
resp, err := utils.GetHTTPClient().Do(req)
97+
if err != nil {
98+
log.Error().Err(err).Msg("error on http request")
99+
return intgerr.CheckHTTPError(err)
100+
}
101+
defer resp.Body.Close()
102+
103+
return intgerr.CheckResponseCode(resp, http.StatusCreated)
104+
}
68105

69-
return intgerr.CheckResponseCode(resp, http.StatusOK)
106+
for _, msg := range message {
107+
err = postDocumentRequest(msg)
108+
if err != nil {
109+
log.Error().Err(err).Msg("error sending to elasticsearch")
110+
span.EndWithErr(err)
111+
return err
112+
}
113+
}
114+
}
115+
return nil
70116
}
71117

72118
func (e ElasticSearch) IsValidCredential(ctx context.Context) (bool, error) {

0 commit comments

Comments
 (0)