Skip to content

Commit

Permalink
Merge branch 'main' into muci
Browse files Browse the repository at this point in the history
  • Loading branch information
@Manik2708
Manik2708 authored Feb 3, 2025
2 parents a51b10c + cb34127 commit 7cfaa3a
Show file tree
Hide file tree
Showing 15 changed files with 259 additions and 144 deletions.
5 changes: 5 additions & 0 deletions KubeArmor/config/config.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@ type KubearmorConfig struct {
CRISocket string // Container runtime to use
NRISocket string // NRI socket to use
NRIIndex string // NRI socket to use
NRIEnabled bool // enable NRI

Visibility string // Container visibility to use
HostVisibility string // Host visibility to use
Expand Down Expand Up @@ -86,6 +87,7 @@ const (
ConfigCRISocket string = "criSocket"
ConfigNRISocket string = "nriSocket"
ConfigNRIIndex string = "nriIndex"
ConfigNRI string = "enableNRI"
ConfigVisibility string = "visibility"
ConfigHostVisibility string = "hostVisibility"
ConfigKubearmorPolicy string = "enableKubeArmorPolicy"
Expand Down Expand Up @@ -128,6 +130,7 @@ func readCmdLineParams() {
criSocket := flag.String(ConfigCRISocket, "", "path to CRI socket (format: unix:///path/to/file.sock)")
nriSocket := flag.String(ConfigNRISocket, "", "path to NRI socket (format: /path/to/file.sock)")
nriIndex := flag.String(ConfigNRIIndex, "99", "NRI plugin index")
nriEnabled := flag.Bool(ConfigNRI, false, "enable NRI to get events from it")

visStr := flag.String(ConfigVisibility, "process,file,network,capabilities", "Container Visibility to use [process,file,network,capabilities,none]")
hostVisStr := flag.String(ConfigHostVisibility, "default", "Host Visibility to use [process,file,network,capabilities,none] (default \"none\" for k8s, \"process,file,network,capabilities\" for VM)")
Expand Down Expand Up @@ -193,6 +196,7 @@ func readCmdLineParams() {
viper.SetDefault(ConfigCRISocket, *criSocket)
viper.SetDefault(ConfigNRISocket, *nriSocket)
viper.SetDefault(ConfigNRIIndex, *nriIndex)
viper.SetDefault(ConfigNRI, *nriEnabled)

viper.SetDefault(ConfigVisibility, *visStr)
viper.SetDefault(ConfigHostVisibility, *hostVisStr)
Expand Down Expand Up @@ -291,6 +295,7 @@ func LoadConfig() error {
GlobalCfg.NRISocket = viper.GetString(ConfigNRISocket)
}
GlobalCfg.NRIIndex = viper.GetString(ConfigNRIIndex)
GlobalCfg.NRIEnabled = viper.GetBool(ConfigNRI)

GlobalCfg.Policy = viper.GetBool(ConfigKubearmorPolicy)
GlobalCfg.HostPolicy = viper.GetBool(ConfigKubearmorHostPolicy)
Expand Down
2 changes: 1 addition & 1 deletion KubeArmor/core/containerdHandler.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -308,7 +308,7 @@ func (dm *KubeArmorDaemon) UpdateContainerdContainer(ctx context.Context, contai
// get container information from containerd client
container, err := Containerd.GetContainerInfo(ctx, containerID, containerPid, dm.OwnerInfo)
if err != nil {
if strings.Contains(string(err.Error()), "pause container") {
if strings.Contains(string(err.Error()), "pause container") || strings.Contains(string(err.Error()), "moby") {
kg.Debug(err.Error())
return false
}
Expand Down
2 changes: 1 addition & 1 deletion KubeArmor/core/kubeArmor.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -626,7 +626,7 @@ func KubeArmor() {
go dm.MonitorDockerEvents()
} else if strings.Contains(cfg.GlobalCfg.CRISocket, "containerd") {
// insuring NRI monitoring only in case containerd is present
if dm.checkNRIAvailability() {
if cfg.GlobalCfg.NRIEnabled && dm.checkNRIAvailability() {
// monitor NRI events
go dm.MonitorNRIEvents()
} else {
Expand Down
4 changes: 4 additions & 0 deletions KubeArmor/core/nriHandler.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,10 @@ func (dm *KubeArmorDaemon) NewNRIHandler(
opts := []stub.Option{
stub.WithSocketPath(cfg.GlobalCfg.NRISocket),
stub.WithPluginIdx(cfg.GlobalCfg.NRIIndex),
stub.WithOnClose(func() {
kg.Printf("restarting NRI")
nri.Start()
}),
}

stub, err := stub.New(nri, opts...)
Expand Down
2 changes: 1 addition & 1 deletion STABLE-RELEASE
View file
Original file line number Diff line number Diff line change
@@ -1 +1 @@
v1.4.6
v1.5.1
6 changes: 6 additions & 0 deletions deployments/helm/KubeArmorOperator/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,12 @@ spec:
# default visibility configuration
defaultVisibility: [comma separated: process|file|network] # DEFAULT - process,network

# enabling NRI
# Naming convention for kubearmor daemonset in case of NRI will be effective only when initally NRI is available & enabled.
# In case snitch service account token is already present before its deployment, the naming convention won't show NRI,
# it will be based on the runtime present. This happens because operator won't get KubearmorConfig event(initially).
enableNRI: [true|false] # DEFAULT - false

# KubeArmor image and pull policy
kubearmorImage:
image: [image-repo:tag] # DEFAULT - kubearmor/kubearmor:stable
Expand Down
35 changes: 26 additions & 9 deletions deployments/helm/KubeArmorOperator/crds/operator.kubearmor.com_kubearmorconfigs.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,8 @@ spec:
type: string
defaultVisibility:
type: string
enableNRI:
type: boolean
enableStdOutAlerts:
type: boolean
enableStdOutLogs:
Expand All @@ -102,10 +104,13 @@ spec:
referenced object inside the same namespace.
properties:
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
TODO: Add other useful fields. apiVersion, kind, uid?
type: string
type: object
x-kubernetes-map-type: atomic
Expand Down Expand Up @@ -172,10 +177,13 @@ spec:
referenced object inside the same namespace.
properties:
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
TODO: Add other useful fields. apiVersion, kind, uid?
type: string
type: object
x-kubernetes-map-type: atomic
Expand Down Expand Up @@ -242,10 +250,13 @@ spec:
referenced object inside the same namespace.
properties:
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
TODO: Add other useful fields. apiVersion, kind, uid?
type: string
type: object
x-kubernetes-map-type: atomic
Expand Down Expand Up @@ -312,10 +323,13 @@ spec:
referenced object inside the same namespace.
properties:
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
TODO: Add other useful fields. apiVersion, kind, uid?
type: string
type: object
x-kubernetes-map-type: atomic
Expand Down Expand Up @@ -382,10 +396,13 @@ spec:
referenced object inside the same namespace.
properties:
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
TODO: Add other useful fields. apiVersion, kind, uid?
type: string
type: object
x-kubernetes-map-type: atomic
Expand Down Expand Up @@ -452,10 +469,13 @@ spec:
referenced object inside the same namespace.
properties:
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
TODO: Add other useful fields. apiVersion, kind, uid?
type: string
type: object
x-kubernetes-map-type: atomic
Expand Down Expand Up @@ -553,9 +573,6 @@ spec:
message:
type: string
phase:
description: |-
INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
Important: Run "make" to regenerate code after modifying this file
type: string
type: object
type: object
Expand Down
Loading

0 comments on commit 7cfaa3a

Please sign in to comment.