Skip to content

Commit bdb8a31

Browse files
ErmanShaniErmanShani
authored
Merge pull request #376 from aquasecurity/SLK-109259/fix-container-runtime-policy-tests
fix(SLK-109259): remove deprecated controls from container runtime po…
2 parents 40a18a5 + 54fbdf2 commit bdb8a31

8 files changed

Lines changed: 79 additions & 145 deletions

File tree

‎.github/workflows/nightly.yml‎

Lines changed: 58 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -174,83 +174,87 @@ jobs:
174174
if-no-files-found: error
175175

176176
notify:
177-
name: "Notify via Power Automate Webhook"
177+
name: "Notify via Teams Webhook"
178178
runs-on: ubuntu-latest
179179
needs:
180180
- drift
181181
- acceptance
182182
if: ${{ always() }}
183183
steps:
184-
- name: Download all drift artifacts
185-
uses: actions/download-artifact@v4
186-
with:
187-
path: drift-artifacts
188-
189184
- name: Download all artifacts
190185
uses: actions/download-artifact@v4
191186
with:
192187
path: artifacts
193188

194-
- name: Build summary payload
195-
id: build_payload
189+
- name: Build and send Teams notification
190+
env:
191+
TEAMS_WEBHOOK_URL: ${{ secrets.TEAMS_WEBHOOK_URL }}
192+
GITHUB_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
193+
WORKFLOW_NAME: ${{ github.workflow }}
194+
BRANCH_NAME: ${{ github.ref_name }}
196195
run: |
197-
echo "PWD: $(pwd)"
198-
ls -R artifacts
199-
200-
drift_summary="{"
201-
acc_summary="{"
202-
first=true
203-
204-
# Loop through drift artifacts
196+
# Build drift summary
197+
drift_text=""
205198
for file in artifacts/drift-results-*/result-drift-*.json; do
206199
version=$(jq -r .version < "$file")
207200
exitcode=$(jq -r .exitcode < "$file")
208-
status="unknown"
209201
if [ "$exitcode" -eq 0 ]; then
210-
status="no_drift"
202+
drift_text+="✅ TF $version: No drift\n"
211203
elif [ "$exitcode" -eq 2 ]; then
212-
status="drift_detected"
213-
elif [ "$exitcode" -eq 1 ]; then
214-
status="error"
204+
drift_text+="⚠️ TF $version: Drift detected\n"
205+
else
206+
drift_text+="❌ TF $version: Error\n"
215207
fi
216-
217-
if [ "$first" = false ]; then
218-
drift_summary+=", "
219-
fi
220-
drift_summary+="\"${version}\": \"${status}\""
221-
first=false
222208
done
223-
drift_summary+="}"
224209
225-
first=true
226-
# Loop through acceptance artifacts
210+
# Build acceptance summary
211+
acc_text=""
212+
all_passed=true
227213
for file in artifacts/acceptance-results-*/result-acceptance-*.json; do
228214
version=$(jq -r .version < "$file")
229215
result=$(jq -r .result < "$file")
230-
231-
if [ "$first" = false ]; then
232-
acc_summary+=", "
216+
if [ "$result" = "success" ]; then
217+
acc_text+="✅ TF $version: Passed\n"
218+
else
219+
acc_text+="❌ TF $version: Failed\n"
220+
all_passed=false
233221
fi
234-
acc_summary+="\"${version}\": \"${result}\""
235-
first=false
236222
done
237-
acc_summary+="}"
238223
239-
echo "payload="$(jq -n \
240-
--arg wf "${{ github.workflow }}" \
241-
--arg branch "${{ github.ref_name }}" \
242-
--arg runid "${{ github.run_id }}" \
243-
--arg url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
244-
--argjson tested_versions '["0.15.5","0.14.11","1.1.2","1.5.3"]' \
245-
--argjson drift_summary "$drift_summary" \
246-
--argjson acceptance_summary "$acc_summary" \
247-
'{workflow: $wf, branch: $branch, run_id: $runid, github_url: $url, tested_versions: $tested_versions, drift_summary: $drift_summary, acceptance_summary: $acceptance_summary }') \
248-
>> $GITHUB_OUTPUT
249-
- name: Trigger Power Automate Flow
250-
uses: fjogeleit/http-request-action@v1.16.3
251-
with:
252-
url: ${{ secrets.POWER_AUTOMATE_HOOK_URL }}
253-
method: 'POST'
254-
contentType: 'application/json'
255-
data: |
256-
${{ steps.build_payload.outputs.payload }}
224+
# Set title color based on results
225+
if [ "$all_passed" = true ]; then
226+
theme_color="00FF00"
227+
title="✅ Nightly Tests Passed"
228+
else
229+
theme_color="FF0000"
230+
title="❌ Nightly Tests Failed"
231+
fi
232+
233+
# Send to Teams
234+
curl -H "Content-Type: application/json" -d "{
235+
\"@type\": \"MessageCard\",
236+
\"@context\": \"http://schema.org/extensions\",
237+
\"themeColor\": \"${theme_color}\",
238+
\"summary\": \"${title}\",
239+
\"sections\": [{
240+
\"activityTitle\": \"${title}\",
241+
\"facts\": [
242+
{ \"name\": \"Workflow\", \"value\": \"${WORKFLOW_NAME}\" },
243+
{ \"name\": \"Branch\", \"value\": \"${BRANCH_NAME}\" }
244+
],
245+
\"markdown\": true
246+
},
247+
{
248+
\"activityTitle\": \"Drift Detection\",
249+
\"text\": \"${drift_text}\"
250+
},
251+
{
252+
\"activityTitle\": \"Acceptance Tests\",
253+
\"text\": \"${acc_text}\"
254+
}],
255+
\"potentialAction\": [{
256+
\"@type\": \"OpenUri\",
257+
\"name\": \"View in GitHub\",
258+
\"targets\": [{ \"os\": \"default\", \"uri\": \"${GITHUB_URL}\" }]
259+
}]
260+
}" "${TEAMS_WEBHOOK_URL}"

‎aquasec/data_container_runtime_policy_test.go‎

Lines changed: 6 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -46,11 +46,10 @@ func TestDataAquasecBasicContainerRuntimePolicy(t *testing.T) {
4646
func TestDataAquasecComplexContainerRuntimePolicy(t *testing.T) {
4747
t.Parallel()
4848
var complexRuntimePolicy = client.RuntimePolicy{
49-
Name: acctest.RandomWithPrefix("test-container-runtime-policy"),
50-
Description: "This is a test description of container runtime policy",
51-
Enabled: true,
52-
Enforce: true,
53-
ForkGuardProcessLimit: 13,
49+
Name: acctest.RandomWithPrefix("test-container-runtime-policy"),
50+
Description: "This is a test description of container runtime policy",
51+
Enabled: true,
52+
Enforce: true,
5453
}
5554

5655
rootRef := dataContainerRuntimePolicyRef("test")
@@ -108,10 +107,6 @@ func TestDataAquasecComplexContainerRuntimePolicy(t *testing.T) {
108107
resource.TestCheckResourceAttr(rootRef, "auditing.0.audit_process_cmdline", "true"),
109108
resource.TestCheckResourceAttr(rootRef, "auditing.0.audit_all_network", "true"),
110109

111-
// Fork guard
112-
resource.TestCheckResourceAttr(rootRef, "enable_fork_guard", "true"),
113-
resource.TestCheckResourceAttr(rootRef, "fork_guard_process_limit", fmt.Sprintf("%v", complexRuntimePolicy.ForkGuardProcessLimit)),
114-
115110
// Container privileges
116111
resource.TestCheckResourceAttr(rootRef, "limit_container_privileges.0.enabled", "true"),
117112
resource.TestCheckResourceAttr(rootRef, "limit_container_privileges.0.block_add_capabilities", "true"),
@@ -130,15 +125,6 @@ func TestDataAquasecComplexContainerRuntimePolicy(t *testing.T) {
130125
resource.TestCheckResourceAttr(rootRef, "port_block.0.block_inbound_ports.0", "1-11"),
131126
resource.TestCheckResourceAttr(rootRef, "port_block.0.block_outbound_ports.0", "1-11"),
132127

133-
// Readonly files
134-
resource.TestCheckResourceAttr(rootRef, "readonly_files.0.enabled", "true"),
135-
resource.TestCheckResourceAttr(rootRef, "readonly_files.0.readonly_files.#", "2"),
136-
resource.TestCheckResourceAttr(rootRef, "readonly_files.0.exceptional_readonly_files.#", "2"),
137-
resource.TestCheckResourceAttr(rootRef, "readonly_files.0.exceptional_readonly_files_processes.#", "1"),
138-
resource.TestCheckResourceAttr(rootRef, "readonly_files.0.exceptional_readonly_files_users.#", "1"),
139-
resource.TestCheckResourceAttr(rootRef, "readonly_files.0.readonly_files_processes.#", "1"),
140-
resource.TestCheckResourceAttr(rootRef, "readonly_files.0.readonly_files_users.#", "1"),
141-
142128
// Allowed registries
143129
resource.TestCheckResourceAttr(rootRef, "allowed_registries.0.enabled", "true"),
144130
resource.TestCheckResourceAttr(rootRef, "allowed_registries.0.allowed_registries.#", "2"),
@@ -221,9 +207,6 @@ func getComplexContainerRuntimePolicyData(policy client.RuntimePolicy) string {
221207
audit_all_network = true
222208
}
223209
224-
enable_fork_guard = true
225-
fork_guard_process_limit = %v
226-
227210
limit_container_privileges {
228211
enabled = true
229212
block_add_capabilities = true
@@ -242,15 +225,7 @@ func getComplexContainerRuntimePolicyData(policy client.RuntimePolicy) string {
242225
block_outbound_ports = ["1-11"]
243226
}
244227
245-
readonly_files {
246-
enabled = true
247-
readonly_files = ["readonly","/dir/"]
248-
exceptional_readonly_files = ["readonly2","/dir2/"]
249-
readonly_files_processes = ["test"]
250-
exceptional_readonly_files_processes = ["test"]
251-
readonly_files_users = ["test"]
252-
exceptional_readonly_files_users = ["test"]
253-
}
228+
# Note: readonly_files is deprecated for container runtime policies
254229
255230
allowed_registries {
256231
enabled = true
@@ -266,5 +241,5 @@ func getComplexContainerRuntimePolicyData(policy client.RuntimePolicy) string {
266241
data "aquasec_container_runtime_policy" "test" {
267242
name = aquasec_container_runtime_policy.test.id
268243
}
269-
`, policy.Name, policy.Description, policy.Enabled, policy.Enforce, policy.EnforceAfterDays, policy.ForkGuardProcessLimit)
244+
`, policy.Name, policy.Description, policy.Enabled, policy.Enforce, policy.EnforceAfterDays)
270245
}

‎aquasec/resource_container_runtime_policy_test.go‎

Lines changed: 8 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -72,11 +72,10 @@ func TestResourceAquasecBasicContainerRuntimePolicyCreate(t *testing.T) {
7272
func TestResourceAquasecComplexContainerRuntimePolicyCreate(t *testing.T) {
7373
t.Parallel()
7474
var complexRuntimePolicy = client.RuntimePolicy{
75-
Name: acctest.RandomWithPrefix("test-container-runtime-policy"),
76-
Description: "This is a test description of container runtime policy",
77-
Enabled: true,
78-
Enforce: true,
79-
ForkGuardProcessLimit: 13,
75+
Name: acctest.RandomWithPrefix("test-container-runtime-policy"),
76+
Description: "This is a test description of container runtime policy",
77+
Enabled: true,
78+
Enforce: true,
8079
}
8180

8281
rootRef := containerRuntimePolicyRef("test")
@@ -134,9 +133,6 @@ func TestResourceAquasecComplexContainerRuntimePolicyCreate(t *testing.T) {
134133
resource.TestCheckResourceAttr(rootRef, "auditing.0.audit_all_network", "true"),
135134
resource.TestCheckResourceAttr(rootRef, "auditing.0.enabled", "true"),
136135

137-
resource.TestCheckResourceAttr(rootRef, "enable_fork_guard", "true"),
138-
resource.TestCheckResourceAttr(rootRef, "fork_guard_process_limit", fmt.Sprintf("%v", complexRuntimePolicy.ForkGuardProcessLimit)),
139-
140136
resource.TestCheckResourceAttr(rootRef, "limit_container_privileges.0.enabled", "true"),
141137
resource.TestCheckResourceAttr(rootRef, "limit_container_privileges.0.block_add_capabilities", "true"),
142138
resource.TestCheckResourceAttr(rootRef, "limit_container_privileges.0.prevent_root_user", "true"),
@@ -154,13 +150,6 @@ func TestResourceAquasecComplexContainerRuntimePolicyCreate(t *testing.T) {
154150
resource.TestCheckResourceAttr(rootRef, "port_block.0.block_outbound_ports.#", "1"),
155151
resource.TestCheckResourceAttr(rootRef, "port_block.0.block_inbound_ports.0", "1-11"),
156152
resource.TestCheckResourceAttr(rootRef, "port_block.0.block_outbound_ports.0", "1-11"),
157-
resource.TestCheckResourceAttr(rootRef, "readonly_files.0.enabled", "true"),
158-
resource.TestCheckResourceAttr(rootRef, "readonly_files.0.readonly_files.#", "2"),
159-
resource.TestCheckResourceAttr(rootRef, "readonly_files.0.exceptional_readonly_files.#", "2"),
160-
resource.TestCheckResourceAttr(rootRef, "readonly_files.0.exceptional_readonly_files_processes.#", "1"),
161-
resource.TestCheckResourceAttr(rootRef, "readonly_files.0.exceptional_readonly_files_users.#", "1"),
162-
resource.TestCheckResourceAttr(rootRef, "readonly_files.0.readonly_files_processes.#", "1"),
163-
resource.TestCheckResourceAttr(rootRef, "readonly_files.0.readonly_files_users.#", "1"),
164153

165154
resource.TestCheckResourceAttr(rootRef, "allowed_registries.0.allowed_registries.#", "2"),
166155
resource.TestCheckResourceAttr(rootRef, "allowed_registries.0.enabled", "true"),
@@ -190,9 +179,7 @@ func TestResourceAquasecFullContainerRuntimePolicyCreate(t *testing.T) {
190179
BlockFilelessExec: true,
191180
BlockNonCompliantWorkloads: true,
192181
BlockNonK8sContainers: true,
193-
EnableForkGuard: true,
194-
ForkGuardProcessLimit: 0,
195-
EnableIPReputation: true,
182+
EnableIPReputation: true,
196183
EnableCryptoMiningDns: true,
197184
EnablePortScanProtection: true,
198185
OnlyRegisteredImages: true,
@@ -293,15 +280,6 @@ func TestResourceAquasecFullContainerRuntimePolicyCreate(t *testing.T) {
293280
resource.TestCheckResourceAttr(rootRef, "port_block.0.block_inbound_ports.0", "1-11"),
294281
resource.TestCheckResourceAttr(rootRef, "port_block.0.block_outbound_ports.0", "1-11"),
295282

296-
// Readonly Files
297-
resource.TestCheckResourceAttr(rootRef, "readonly_files.0.enabled", "true"),
298-
resource.TestCheckResourceAttr(rootRef, "readonly_files.0.readonly_files.#", "2"),
299-
resource.TestCheckResourceAttr(rootRef, "readonly_files.0.exceptional_readonly_files.#", "2"),
300-
resource.TestCheckResourceAttr(rootRef, "readonly_files.0.exceptional_readonly_files_processes.#", "1"),
301-
resource.TestCheckResourceAttr(rootRef, "readonly_files.0.exceptional_readonly_files_users.#", "1"),
302-
resource.TestCheckResourceAttr(rootRef, "readonly_files.0.readonly_files_processes.#", "1"),
303-
resource.TestCheckResourceAttr(rootRef, "readonly_files.0.readonly_files_users.#", "1"),
304-
305283
resource.TestCheckResourceAttr(rootRef, "allowed_registries.0.allowed_registries.#", "1"),
306284
resource.TestCheckResourceAttr(rootRef, "allowed_registries.0.allowed_registries.0", "Docker Hub"),
307285
resource.TestCheckResourceAttr(rootRef, "allowed_registries.0.enabled", "true"),
@@ -402,8 +380,6 @@ func getComplexContainerRuntimePolicyResource(policy client.RuntimePolicy) strin
402380
audit_process_cmdline = true
403381
audit_all_network = true
404382
}
405-
enable_fork_guard = true
406-
fork_guard_process_limit = %v
407383
limit_container_privileges{
408384
enabled = true
409385
block_add_capabilities = true
@@ -421,15 +397,7 @@ func getComplexContainerRuntimePolicyResource(policy client.RuntimePolicy) strin
421397
block_outbound_ports = ["1-11"]
422398
}
423399
# enable_port_scan_detection = true
424-
readonly_files{
425-
enabled = true
426-
readonly_files = ["readonly","/dir/"]
427-
exceptional_readonly_files = ["readonly2","/dir2/"]
428-
readonly_files_processes = ["test"]
429-
exceptional_readonly_files_processes = ["test"]
430-
readonly_files_users = ["test"]
431-
exceptional_readonly_files_users = ["test"]
432-
}
400+
# Note: readonly_files is deprecated for container runtime policies
433401
allowed_registries{
434402
enabled = true
435403
allowed_registries = ["registry1","registry2"]
@@ -447,8 +415,7 @@ func getComplexContainerRuntimePolicyResource(policy client.RuntimePolicy) strin
447415
policy.Description,
448416
policy.Enabled,
449417
policy.Enforce,
450-
policy.EnforceAfterDays,
451-
policy.ForkGuardProcessLimit)
418+
policy.EnforceAfterDays)
452419
}
453420

454421
func getFullContainerRuntimePolicyResource(policy client.RuntimePolicy) string {
@@ -592,15 +559,7 @@ func getFullContainerRuntimePolicyResource(policy client.RuntimePolicy) string {
592559
block_outbound_ports = ["1-11"]
593560
}
594561
595-
readonly_files {
596-
enabled = true
597-
readonly_files = ["readonly","/dir/"]
598-
exceptional_readonly_files = ["readonly2","/dir2/"]
599-
readonly_files_processes = ["test"]
600-
exceptional_readonly_files_processes = ["test"]
601-
readonly_files_users = ["test"]
602-
exceptional_readonly_files_users = ["test"]
603-
}
562+
# Note: readonly_files is deprecated for container runtime policies
604563
605564
malware_scan_options {
606565
enabled = true
@@ -623,7 +582,6 @@ func getFullContainerRuntimePolicyResource(policy client.RuntimePolicy) string {
623582
failed_checks = ["CVE-2021-25741", "CVE-2022-0185"]
624583
}
625584
626-
enable_fork_guard = true
627585
enable_ip_reputation = true
628586
enable_crypto_mining_dns = true
629587
enable_port_scan_protection = true

‎docs/data-sources/container_runtime_policy.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ output "container_runtime_policy_details" {
8282
- `drift_prevention` (List of Object) Drift prevention configuration. (see [below for nested schema](#nestedatt--drift_prevention))
8383
- `enable_crypto_mining_dns` (Boolean)
8484
- `enable_drift_prevention` (Boolean) If true, executables that are not in the original image is prevented from running.
85-
- `enable_fork_guard` (Boolean) If true, fork bombs are prevented in the containers.
85+
- `enable_fork_guard` (Boolean, **Deprecated**) Fork Guard is no longer supported for container runtime policies. This attribute will be removed in a future version.
8686
- `enable_ip_reputation` (Boolean)
8787
- `enable_ip_reputation_security` (Boolean) If true, detect and prevent communication from containers to IP addresses known to have a bad reputation.
8888
- `enable_port_scan_detection` (Boolean) If true, detects port scanning behavior in the container.
@@ -95,7 +95,7 @@ output "container_runtime_policy_details" {
9595
- `exclude_application_scopes` (List of String) List of excluded application scopes.
9696
- `exec_lockdown_white_list` (List of String) Specify processes that will be allowed
9797
- `failed_kubernetes_checks` (List of Object) Failed Kubernetes checks configuration. (see [below for nested schema](#nestedatt--failed_kubernetes_checks))
98-
- `fork_guard_process_limit` (Number) Process limit for the fork guard.
98+
- `fork_guard_process_limit` (Number, **Deprecated**) Fork Guard is no longer supported for container runtime policies. This attribute will be removed in a future version.
9999
- `id` (String) The ID of this resource.
100100
- `image_name` (String)
101101
- `is_audit_checked` (Boolean)

‎docs/resources/container_runtime_policy.md‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -250,7 +250,6 @@ resource "aquasec_container_runtime_policy" "container_runtime_policy" {
250250
}
251251
252252
# Additional security features
253-
enable_fork_guard = true
254253
enable_ip_reputation = true
255254
enable_crypto_mining_dns = true
256255
enable_port_scan_protection = true
@@ -308,7 +307,7 @@ resource "aquasec_container_runtime_policy" "container_runtime_policy" {
308307
- `digest` (String)
309308
- `drift_prevention` (Block List) Drift prevention configuration. (see [below for nested schema](#nestedblock--drift_prevention))
310309
- `enable_crypto_mining_dns` (Boolean)
311-
- `enable_fork_guard` (Boolean) If true, fork bombs are prevented in the containers.
310+
- `enable_fork_guard` (Boolean, **Deprecated**) Fork Guard is no longer supported for container runtime policies. This attribute is ignored and will be removed in a future version.
312311
- `enable_ip_reputation` (Boolean)
313312
- `enable_port_scan_protection` (Boolean)
314313
- `enabled` (Boolean) Indicates if the runtime policy is enabled or not.
@@ -320,7 +319,7 @@ resource "aquasec_container_runtime_policy" "container_runtime_policy" {
320319
- `failed_kubernetes_checks` (Block List, Max: 1) (see [below for nested schema](#nestedblock--failed_kubernetes_checks))
321320
- `file_block` (Block List, Max: 1) (see [below for nested schema](#nestedblock--file_block))
322321
- `file_integrity_monitoring` (Block List) Configuration for file integrity monitoring. (see [below for nested schema](#nestedblock--file_integrity_monitoring))
323-
- `fork_guard_process_limit` (Number) Process limit for the fork guard.
322+
- `fork_guard_process_limit` (Number, **Deprecated**) Fork Guard is no longer supported for container runtime policies. This attribute is ignored and will be removed in a future version.
324323
- `image_name` (String)
325324
- `is_audit_checked` (Boolean)
326325
- `is_auto_generated` (Boolean)

0 commit comments

Comments
 (0)