44package common
55
66import (
7+ "context"
78 "fmt"
89 "strings"
910
1011 corev1 "k8s.io/api/core/v1"
12+ metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
13+ "k8s.io/client-go/kubernetes"
1114)
1215
1316const k8sVisibility = "process,file,network,capabilities"
1417const appArmorAnnotation = "container.apparmor.security.beta.kubernetes.io/"
15- const KubeArmorRestartedAnnotation = "kubearmor.io/restarted"
16- const KubeArmorForceAppArmorAnnotation = "kubearmor.io/force-apparmor"
18+ const KubeArmorRestartedAnnotation = "kubearmor.kubernetes.io/restartedAt"
1719
1820// == Add AppArmor annotations == //
19- func AppArmorAnnotator (pod * corev1.Pod ) {
21+ func AppArmorAnnotator (pod * corev1.Pod , binding * corev1. Binding , isBinding bool ) {
2022 podAnnotations := map [string ]string {}
2123 var podOwnerName string
2224
@@ -64,52 +66,57 @@ func AppArmorAnnotator(pod *corev1.Pod) {
6466 if v == "unconfined" {
6567 continue
6668 }
67- pod .Annotations [appArmorAnnotation + k ] = "localhost/" + v
69+ if isBinding {
70+ binding .Annotations [appArmorAnnotation + k ] = "localhost/" + v
71+ } else {
72+ pod .Annotations [appArmorAnnotation + k ] = "localhost/" + v
73+ }
6874 }
6975}
70- func AddCommonAnnotations (pod * corev1.Pod ) {
71- if pod .Annotations == nil {
72- pod .Annotations = map [string ]string {}
76+ func AddCommonAnnotations (obj * metav1.ObjectMeta ) {
77+
78+ if obj .Annotations == nil {
79+ obj .Annotations = map [string ]string {}
7380 }
7481
7582 // == Policy == //
7683
77- if _ , ok := pod .Annotations ["kubearmor-policy" ]; ! ok {
84+ if _ , ok := obj .Annotations ["kubearmor-policy" ]; ! ok {
7885 // if no annotation is set enable kubearmor by default
79- pod .Annotations ["kubearmor-policy" ] = "enabled"
80- } else if pod .Annotations ["kubearmor-policy" ] != "enabled" && pod .Annotations ["kubearmor-policy" ] != "disabled" && pod .Annotations ["kubearmor-policy" ] != "audited" {
86+ obj .Annotations ["kubearmor-policy" ] = "enabled"
87+ } else if obj .Annotations ["kubearmor-policy" ] != "enabled" && obj .Annotations ["kubearmor-policy" ] != "disabled" && obj .Annotations ["kubearmor-policy" ] != "audited" {
8188 // if kubearmor policy is not set correctly, default it to enabled
82- pod .Annotations ["kubearmor-policy" ] = "enabled"
89+ obj .Annotations ["kubearmor-policy" ] = "enabled"
8390 }
8491 // == Exception == //
8592
8693 // exception: kubernetes app
87- if pod .Namespace == "kube-system" {
88- if _ , ok := pod .Labels ["k8s-app" ]; ok {
89- pod .Annotations ["kubearmor-policy" ] = "audited"
94+ if obj .Namespace == "kube-system" {
95+ if _ , ok := obj .Labels ["k8s-app" ]; ok {
96+ obj .Annotations ["kubearmor-policy" ] = "audited"
9097 }
9198
92- if value , ok := pod .Labels ["component" ]; ok {
99+ if value , ok := obj .Labels ["component" ]; ok {
93100 if value == "etcd" || value == "kube-apiserver" || value == "kube-controller-manager" || value == "kube-scheduler" || value == "kube-proxy" {
94- pod .Annotations ["kubearmor-policy" ] = "audited"
101+ obj .Annotations ["kubearmor-policy" ] = "audited"
95102 }
96103 }
97104 }
98105
99106 // exception: cilium-operator
100- if _ , ok := pod .Labels ["io.cilium/app" ]; ok {
101- pod .Annotations ["kubearmor-policy" ] = "audited"
107+ if _ , ok := obj .Labels ["io.cilium/app" ]; ok {
108+ obj .Annotations ["kubearmor-policy" ] = "audited"
102109 }
103110
104111 // exception: kubearmor
105- if _ , ok := pod .Labels ["kubearmor-app" ]; ok {
106- pod .Annotations ["kubearmor-policy" ] = "audited"
112+ if _ , ok := obj .Labels ["kubearmor-app" ]; ok {
113+ obj .Annotations ["kubearmor-policy" ] = "audited"
107114 }
108115
109116 // == Visibility == //
110117
111- if _ , ok := pod .Annotations ["kubearmor-visibility" ]; ! ok {
112- pod .Annotations ["kubearmor-visibility" ] = k8sVisibility
118+ if _ , ok := obj .Annotations ["kubearmor-visibility" ]; ! ok {
119+ obj .Annotations ["kubearmor-visibility" ] = k8sVisibility
113120 }
114121}
115122
@@ -125,3 +132,64 @@ func RemoveApparmorAnnotation(pod *corev1.Pod) {
125132 delete (pod .Annotations , key )
126133 }
127134}
135+
136+ func CheckKubearmorStatus (nodeName string , c * kubernetes.Clientset ) (bool , error ) {
137+ pods , err := c .CoreV1 ().Pods ("kubearmor" ).List (context .TODO (), metav1.ListOptions {
138+ LabelSelector : "kubearmor-app=kubearmor" ,
139+ })
140+ if err != nil {
141+ return false , fmt .Errorf ("failed to list pods: %v" , err )
142+ }
143+ // Filter Pods by nodeName and return their status.phase
144+ for _ , pod := range pods .Items {
145+ if pod .Spec .NodeName == nodeName {
146+ return true , nil
147+ }
148+ }
149+
150+ return false , nil
151+
152+ }
153+ func hasApparmorAnnotation (annotations map [string ]string ) bool {
154+ for key := range annotations {
155+ if strings .HasPrefix (key , "container.apparmor.security.beta.kubernetes.io/" ) {
156+ return true
157+ }
158+ }
159+ return false
160+ }
161+
162+ func HandleAppArmor (annotations map [string ]string ) bool {
163+ return ! hasApparmorAnnotation (annotations )
164+ }
165+
166+ func HandleBPF (annotations map [string ]string ) bool {
167+ return hasApparmorAnnotation (annotations )
168+ }
169+
170+ func IsAppArmorExempt (labels map [string ]string , namespace string ) bool {
171+
172+ // exception: kubernetes app
173+ if namespace == "kube-system" {
174+ if _ , ok := labels ["k8s-app" ]; ok {
175+ return true
176+ }
177+
178+ if value , ok := labels ["component" ]; ok {
179+ if value == "etcd" || value == "kube-apiserver" || value == "kube-controller-manager" || value == "kube-scheduler" || value == "kube-proxy" {
180+ return true
181+ }
182+ }
183+ }
184+
185+ // exception: cilium-operator
186+ if _ , ok := labels ["io.cilium/app" ]; ok {
187+ return true
188+ }
189+
190+ // exception: kubearmor
191+ if _ , ok := labels ["kubearmor-app" ]; ok {
192+ return true
193+ }
194+ return false
195+ }
0 commit comments