Skip to content

Commit 3dee887

Browse files
achrefbensaadachrefbensaad
authored
Merge pull request #1924 from kubearmor/fix-operator-bug-dec-24
Fix operator bug dec 24
2 parents 96b0ad7 + 13213a5 commit 3dee887

File tree

8 files changed

+357
-4
lines changed

8 files changed

+357
-4
lines changed

‎deployments/helm/KubeArmorOperator/crds/operator.kubearmor.com_kubearmorconfigs.yaml

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
33
kind: CustomResourceDefinition
44
metadata:
55
annotations:
6-
controller-gen.kubebuilder.io/version: v0.14.0
6+
controller-gen.kubebuilder.io/version: v0.16.5
77
name: kubearmorconfigs.operator.kubearmor.com
88
spec:
99
group: operator.kubearmor.com
@@ -43,6 +43,33 @@ spec:
4343
spec:
4444
description: KubeArmorConfigSpec defines the desired state of KubeArmorConfig
4545
properties:
46+
adapters:
47+
properties:
48+
elasticsearch:
49+
properties:
50+
alertsIndex:
51+
type: string
52+
auth:
53+
properties:
54+
allowInsecureTLS:
55+
type: boolean
56+
caCertKey:
57+
type: string
58+
caCertSecretName:
59+
type: string
60+
passwordKey:
61+
type: string
62+
secretName:
63+
type: string
64+
usernameKey:
65+
type: string
66+
type: object
67+
enabled:
68+
type: boolean
69+
url:
70+
type: string
71+
type: object
72+
type: object
4673
alertThrottling:
4774
type: boolean
4875
defaultCapabilitiesPosture:

‎deployments/operator/operator.yaml

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
22
kind: CustomResourceDefinition
33
metadata:
44
annotations:
5-
controller-gen.kubebuilder.io/version: v0.14.0
5+
controller-gen.kubebuilder.io/version: v0.16.5
66
name: kubearmorconfigs.operator.kubearmor.com
77
spec:
88
group: operator.kubearmor.com
@@ -42,6 +42,33 @@ spec:
4242
spec:
4343
description: KubeArmorConfigSpec defines the desired state of KubeArmorConfig
4444
properties:
45+
adapters:
46+
properties:
47+
elasticsearch:
48+
properties:
49+
alertsIndex:
50+
type: string
51+
auth:
52+
properties:
53+
allowInsecureTLS:
54+
type: boolean
55+
caCertKey:
56+
type: string
57+
caCertSecretName:
58+
type: string
59+
passwordKey:
60+
type: string
61+
secretName:
62+
type: string
63+
usernameKey:
64+
type: string
65+
type: object
66+
enabled:
67+
type: boolean
68+
url:
69+
type: string
70+
type: object
71+
type: object
4572
alertThrottling:
4673
type: boolean
4774
defaultCapabilitiesPosture:

‎pkg/KubeArmorOperator/api/operator.kubearmor.com/v1/kubearmorconfig_types.go

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,26 @@ type RecommendedPolicies struct {
3939
ExcludePolicy []string `json:"excludePolicy,omitempty"`
4040
}
4141

42+
type ElasticSearchAuth struct {
43+
SecretName string `json:"secretName,omitempty"`
44+
UserNameKey string `json:"usernameKey,omitempty"`
45+
PasswordKey string `json:"passwordKey,omitempty"`
46+
AllowTlsInsecure bool `json:"allowInsecureTLS,omitempty"`
47+
CAcertSecretName string `json:"caCertSecretName,omitempty"`
48+
CaCertKey string `json:"caCertKey,omitempty"`
49+
}
50+
51+
type ElasticSearchAdapter struct {
52+
Enabled bool `json:"enabled,omitempty"`
53+
Url string `json:"url,omitempty"`
54+
AlertsIndexName string `json:"alertsIndex,omitempty"`
55+
Auth ElasticSearchAuth `json:"auth,omitempty"`
56+
}
57+
58+
type Adapters struct {
59+
ElasticSearch ElasticSearchAdapter `json:"elasticsearch,omitempty"`
60+
}
61+
4262
// KubeArmorConfigSpec defines the desired state of KubeArmorConfig
4363
type KubeArmorConfigSpec struct {
4464
// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
@@ -80,6 +100,8 @@ type KubeArmorConfigSpec struct {
80100
MaxAlertPerSec int `json:"maxAlertPerSec,omitempty"`
81101
// +kubebuilder:validation:Optional
82102
ThrottleSec int `json:"throttleSec,omitempty"`
103+
// +kubebuilder:validation:Optional
104+
Adapters Adapters `json:"adapters,omitempty"`
83105
}
84106

85107
// KubeArmorConfigStatus defines the observed state of KubeArmorConfig

‎pkg/KubeArmorOperator/api/operator.kubearmor.com/v1/zz_generated.deepcopy.go

Lines changed: 48 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/KubeArmorOperator/common/defaults.go

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,7 +139,26 @@ var (
139139
},
140140
},
141141
}
142+
143+
Adapter opv1.Adapters = opv1.Adapters{
144+
ElasticSearch: opv1.ElasticSearchAdapter{
145+
Enabled: false,
146+
Url: "",
147+
AlertsIndexName: "kubearmor-alerts",
148+
Auth: opv1.ElasticSearchAuth{
149+
SecretName: "elastic-secret",
150+
UserNameKey: "username",
151+
PasswordKey: "password",
152+
AllowTlsInsecure: false,
153+
CAcertSecretName: "",
154+
CaCertKey: "ca.crt",
155+
},
156+
},
157+
}
158+
159+
ElasticSearchAdapterCaCertPath = "/cert"
142160
)
161+
var Pointer2True bool = true
143162

144163
var ConfigMapData = map[string]string{
145164
ConfigGRPC: "32767",

‎pkg/KubeArmorOperator/config/crd/bases/operator.kubearmor.com_kubearmorconfigs.yaml

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
33
kind: CustomResourceDefinition
44
metadata:
55
annotations:
6-
controller-gen.kubebuilder.io/version: v0.14.0
6+
controller-gen.kubebuilder.io/version: v0.16.5
77
name: kubearmorconfigs.operator.kubearmor.com
88
spec:
99
group: operator.kubearmor.com
@@ -43,6 +43,33 @@ spec:
4343
spec:
4444
description: KubeArmorConfigSpec defines the desired state of KubeArmorConfig
4545
properties:
46+
adapters:
47+
properties:
48+
elasticsearch:
49+
properties:
50+
alertsIndex:
51+
type: string
52+
auth:
53+
properties:
54+
allowInsecureTLS:
55+
type: boolean
56+
caCertKey:
57+
type: string
58+
caCertSecretName:
59+
type: string
60+
passwordKey:
61+
type: string
62+
secretName:
63+
type: string
64+
usernameKey:
65+
type: string
66+
type: object
67+
enabled:
68+
type: boolean
69+
url:
70+
type: string
71+
type: object
72+
type: object
4673
alertThrottling:
4774
type: boolean
4875
defaultCapabilitiesPosture:

‎pkg/KubeArmorOperator/internal/controller/cluster.go

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -472,7 +472,81 @@ func (clusterWatcher *ClusterWatcher) UpdateKubearmorRelayEnv(cfg *opv1.KubeArmo
472472
Name: "ENABLE_STDOUT_MSGS",
473473
Value: common.KubearmorRelayEnvMap[common.EnableStdOutMsgs],
474474
},
475+
{
476+
Name: "ENABLE_DASHBOARDS",
477+
Value: strconv.FormatBool(common.Adapter.ElasticSearch.Enabled),
478+
},
479+
{
480+
Name: "ES_URL",
481+
Value: common.Adapter.ElasticSearch.Url,
482+
},
483+
{
484+
Name: "ES_ALERTS_INDEX",
485+
Value: common.Adapter.ElasticSearch.AlertsIndexName,
486+
},
487+
{
488+
Name: "ES_USERNAME",
489+
ValueFrom: &corev1.EnvVarSource{
490+
SecretKeyRef: &corev1.SecretKeySelector{
491+
LocalObjectReference: corev1.LocalObjectReference{
492+
Name: common.Adapter.ElasticSearch.Auth.SecretName,
493+
},
494+
Key: common.Adapter.ElasticSearch.Auth.UserNameKey,
495+
Optional: &common.Pointer2True,
496+
},
497+
},
498+
},
499+
{
500+
Name: "ES_PASSWORD",
501+
ValueFrom: &corev1.EnvVarSource{
502+
SecretKeyRef: &corev1.SecretKeySelector{
503+
LocalObjectReference: corev1.LocalObjectReference{
504+
Name: common.Adapter.ElasticSearch.Auth.SecretName,
505+
},
506+
Key: common.Adapter.ElasticSearch.Auth.PasswordKey,
507+
Optional: &common.Pointer2True,
508+
},
509+
},
510+
},
511+
}
512+
513+
ElasticSearchAdapterCaVolume := []corev1.Volume{
514+
{
515+
Name: "elastic-ca",
516+
VolumeSource: corev1.VolumeSource{
517+
Secret: &corev1.SecretVolumeSource{
518+
SecretName: common.Adapter.ElasticSearch.Auth.CAcertSecretName,
519+
},
520+
},
521+
},
522+
}
523+
524+
ElasticSearchAdapterCaVolumeMount := []corev1.VolumeMount{
525+
{
526+
Name: "elastic-ca",
527+
MountPath: common.ElasticSearchAdapterCaCertPath,
528+
},
529+
}
530+
if common.Adapter.ElasticSearch.Auth.CAcertSecretName != "" {
531+
relay.Spec.Template.Spec.Containers[0].Env = append(relay.Spec.Template.Spec.Containers[0].Env, corev1.EnvVar{
532+
Name: "ES_CA_CERT_PATH",
533+
Value: common.ElasticSearchAdapterCaCertPath + "/" + common.Adapter.ElasticSearch.Auth.CaCertKey,
534+
})
535+
536+
common.AddOrRemoveVolume(&ElasticSearchAdapterCaVolume, &relay.Spec.Template.Spec.Volumes, common.AddAction)
537+
common.AddOrRemoveVolumeMount(&ElasticSearchAdapterCaVolumeMount, &relay.Spec.Template.Spec.Containers[0].VolumeMounts, common.AddAction)
538+
} else {
539+
common.AddOrRemoveVolume(&ElasticSearchAdapterCaVolume, &relay.Spec.Template.Spec.Volumes, common.DeleteAction)
540+
common.AddOrRemoveVolumeMount(&ElasticSearchAdapterCaVolumeMount, &relay.Spec.Template.Spec.Containers[0].VolumeMounts, common.DeleteAction)
475541
}
542+
543+
if common.Adapter.ElasticSearch.Auth.AllowTlsInsecure {
544+
relay.Spec.Template.Spec.Containers[0].Env = append(relay.Spec.Template.Spec.Containers[0].Env, corev1.EnvVar{
545+
Name: "ES_ALLOW_INSECURE_TLS",
546+
Value: "true",
547+
})
548+
}
549+
476550
_, err = clusterWatcher.Client.AppsV1().Deployments(common.Namespace).Update(context.Background(), relay, v1.UpdateOptions{})
477551
if err != nil {
478552
clusterWatcher.Log.Warnf("Cannot update deployment=%s error=%s", deployments.RelayDeploymentName, err.Error())
@@ -955,6 +1029,42 @@ func UpdatedKubearmorRelayEnv(config *opv1.KubeArmorConfigSpec) bool {
9551029
updated = true
9561030
}
9571031
}
1032+
1033+
stringEnableElasticAdapter := strconv.FormatBool(config.Adapters.ElasticSearch.Enabled)
1034+
if stringEnableElasticAdapter != "" {
1035+
if common.Adapter.ElasticSearch.Enabled != config.Adapters.ElasticSearch.Enabled {
1036+
updated = true
1037+
common.Adapter.ElasticSearch.Enabled = config.Adapters.ElasticSearch.Enabled
1038+
}
1039+
if common.Adapter.ElasticSearch.Auth.AllowTlsInsecure != config.Adapters.ElasticSearch.Auth.AllowTlsInsecure {
1040+
updated = true
1041+
common.Adapter.ElasticSearch.Auth.AllowTlsInsecure = config.Adapters.ElasticSearch.Auth.AllowTlsInsecure
1042+
}
1043+
if common.Adapter.ElasticSearch.AlertsIndexName != config.Adapters.ElasticSearch.AlertsIndexName {
1044+
updated = true
1045+
common.Adapter.ElasticSearch.AlertsIndexName = config.Adapters.ElasticSearch.AlertsIndexName
1046+
}
1047+
if common.Adapter.ElasticSearch.Url != config.Adapters.ElasticSearch.Url {
1048+
updated = true
1049+
common.Adapter.ElasticSearch.Url = config.Adapters.ElasticSearch.Url
1050+
}
1051+
if config.Adapters.ElasticSearch.Auth.SecretName != "" && common.Adapter.ElasticSearch.Auth.SecretName != config.Adapters.ElasticSearch.Auth.SecretName {
1052+
updated = true
1053+
common.Adapter.ElasticSearch.Auth.SecretName = config.Adapters.ElasticSearch.Auth.SecretName
1054+
}
1055+
if config.Adapters.ElasticSearch.Auth.UserNameKey != "" && common.Adapter.ElasticSearch.Auth.UserNameKey != config.Adapters.ElasticSearch.Auth.UserNameKey {
1056+
updated = true
1057+
common.Adapter.ElasticSearch.Auth.UserNameKey = config.Adapters.ElasticSearch.Auth.UserNameKey
1058+
}
1059+
if config.Adapters.ElasticSearch.Auth.PasswordKey != "" && common.Adapter.ElasticSearch.Auth.PasswordKey != config.Adapters.ElasticSearch.Auth.PasswordKey {
1060+
updated = true
1061+
common.Adapter.ElasticSearch.Auth.PasswordKey = config.Adapters.ElasticSearch.Auth.PasswordKey
1062+
}
1063+
if config.Adapters.ElasticSearch.Auth.CAcertSecretName != "" && common.Adapter.ElasticSearch.Auth.CAcertSecretName != config.Adapters.ElasticSearch.Auth.CAcertSecretName {
1064+
updated = true
1065+
common.Adapter.ElasticSearch.Auth.CAcertSecretName = config.Adapters.ElasticSearch.Auth.CAcertSecretName
1066+
}
1067+
}
9581068
return updated
9591069
}
9601070

0 commit comments

Comments
 (0)