Skip to content

Commit a772a15

Browse files
rksharma95rksharma95
authored
Merge pull request #1956 from Prateeknandle/nri-flag
adding NRI flag
2 parents a683113 + 9871c3f commit a772a15

File tree

16 files changed

+261
-146
lines changed

16 files changed

+261
-146
lines changed

‎KubeArmor/config/config.go

+5
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ type KubearmorConfig struct {
2929
CRISocket string // Container runtime to use
3030
NRISocket string // NRI socket to use
3131
NRIIndex string // NRI socket to use
32+
NRIEnabled bool // enable NRI
3233

3334
Visibility string // Container visibility to use
3435
HostVisibility string // Host visibility to use
@@ -86,6 +87,7 @@ const (
8687
ConfigCRISocket string = "criSocket"
8788
ConfigNRISocket string = "nriSocket"
8889
ConfigNRIIndex string = "nriIndex"
90+
ConfigNRI string = "enableNRI"
8991
ConfigVisibility string = "visibility"
9092
ConfigHostVisibility string = "hostVisibility"
9193
ConfigKubearmorPolicy string = "enableKubeArmorPolicy"
@@ -128,6 +130,7 @@ func readCmdLineParams() {
128130
criSocket := flag.String(ConfigCRISocket, "", "path to CRI socket (format: unix:///path/to/file.sock)")
129131
nriSocket := flag.String(ConfigNRISocket, "", "path to NRI socket (format: /path/to/file.sock)")
130132
nriIndex := flag.String(ConfigNRIIndex, "99", "NRI plugin index")
133+
nriEnabled := flag.Bool(ConfigNRI, false, "enable NRI to get events from it")
131134

132135
visStr := flag.String(ConfigVisibility, "process,file,network,capabilities", "Container Visibility to use [process,file,network,capabilities,none]")
133136
hostVisStr := flag.String(ConfigHostVisibility, "default", "Host Visibility to use [process,file,network,capabilities,none] (default \"none\" for k8s, \"process,file,network,capabilities\" for VM)")
@@ -193,6 +196,7 @@ func readCmdLineParams() {
193196
viper.SetDefault(ConfigCRISocket, *criSocket)
194197
viper.SetDefault(ConfigNRISocket, *nriSocket)
195198
viper.SetDefault(ConfigNRIIndex, *nriIndex)
199+
viper.SetDefault(ConfigNRI, *nriEnabled)
196200

197201
viper.SetDefault(ConfigVisibility, *visStr)
198202
viper.SetDefault(ConfigHostVisibility, *hostVisStr)
@@ -291,6 +295,7 @@ func LoadConfig() error {
291295
GlobalCfg.NRISocket = viper.GetString(ConfigNRISocket)
292296
}
293297
GlobalCfg.NRIIndex = viper.GetString(ConfigNRIIndex)
298+
GlobalCfg.NRIEnabled = viper.GetBool(ConfigNRI)
294299

295300
GlobalCfg.Policy = viper.GetBool(ConfigKubearmorPolicy)
296301
GlobalCfg.HostPolicy = viper.GetBool(ConfigKubearmorHostPolicy)

‎KubeArmor/core/containerdHandler.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -308,7 +308,7 @@ func (dm *KubeArmorDaemon) UpdateContainerdContainer(ctx context.Context, contai
308308
// get container information from containerd client
309309
container, err := Containerd.GetContainerInfo(ctx, containerID, containerPid, dm.OwnerInfo)
310310
if err != nil {
311-
if strings.Contains(string(err.Error()), "pause container") {
311+
if strings.Contains(string(err.Error()), "pause container") || strings.Contains(string(err.Error()), "moby") {
312312
kg.Debug(err.Error())
313313
return false
314314
}

‎KubeArmor/core/kubeArmor.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -626,7 +626,7 @@ func KubeArmor() {
626626
go dm.MonitorDockerEvents()
627627
} else if strings.Contains(cfg.GlobalCfg.CRISocket, "containerd") {
628628
// insuring NRI monitoring only in case containerd is present
629-
if dm.checkNRIAvailability() {
629+
if cfg.GlobalCfg.NRIEnabled && dm.checkNRIAvailability() {
630630
// monitor NRI events
631631
go dm.MonitorNRIEvents()
632632
} else {

‎KubeArmor/core/nriHandler.go

+4
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,10 @@ func (dm *KubeArmorDaemon) NewNRIHandler(
6464
opts := []stub.Option{
6565
stub.WithSocketPath(cfg.GlobalCfg.NRISocket),
6666
stub.WithPluginIdx(cfg.GlobalCfg.NRIIndex),
67+
stub.WithOnClose(func() {
68+
kg.Printf("restarting NRI")
69+
nri.Start()
70+
}),
6771
}
6872

6973
stub, err := stub.New(nri, opts...)

‎KubeArmor/go.mod

+1-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ replace (
2525

2626
require (
2727
github.com/Masterminds/sprig/v3 v3.3.0
28-
github.com/cilium/cilium v1.16.5
28+
github.com/cilium/cilium v1.16.6
2929
github.com/cilium/ebpf v0.17.1
3030
github.com/containerd/containerd/api v1.8.0
3131
github.com/containerd/containerd/v2 v2.0.2

‎KubeArmor/go.sum

+2-2
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,8 @@ github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyY
2929
github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
3030
github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
3131
github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
32-
github.com/cilium/cilium v1.16.5 h1:ecjhh98fl6Ki641+8Cdb0oynsy3toQ+oPLCSI3d+KLE=
33-
github.com/cilium/cilium v1.16.5/go.mod h1:EqOosPzJuv28Hz3Ulz6cCXfYKbll7vbIwMGZU5houOw=
32+
github.com/cilium/cilium v1.16.6 h1:KRQn5knO48ERxB6SusQo02nYmE0NO0qiLlvqhwBTXbI=
33+
github.com/cilium/cilium v1.16.6/go.mod h1:NnDWQiYmPef24+pX2U/V85uL8eUTJSFUUjMEy41lGPA=
3434
github.com/cilium/ebpf v0.17.1 h1:G8mzU81R2JA1nE5/8SRubzqvBMmAmri2VL8BIZPWvV0=
3535
github.com/cilium/ebpf v0.17.1/go.mod h1:vay2FaYSmIlv3r8dNACd4mW/OCaZLJKJOo+IHBvCIO8=
3636
github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=

‎deployments/helm/KubeArmorOperator/README.md

+6
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,12 @@ spec:
6262
# default visibility configuration
6363
defaultVisibility: [comma separated: process|file|network] # DEFAULT - process,network
6464

65+
# enabling NRI
66+
# Naming convention for kubearmor daemonset in case of NRI will be effective only when initally NRI is available & enabled.
67+
# In case snitch service account token is already present before its deployment, the naming convention won't show NRI,
68+
# it will be based on the runtime present. This happens because operator won't get KubearmorConfig event(initially).
69+
enableNRI: [true|false] # DEFAULT - false
70+
6571
# KubeArmor image and pull policy
6672
kubearmorImage:
6773
image: [image-repo:tag] # DEFAULT - kubearmor/kubearmor:stable

‎deployments/helm/KubeArmorOperator/crds/operator.kubearmor.com_kubearmorconfigs.yaml

+26-9
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,8 @@ spec:
8989
type: string
9090
defaultVisibility:
9191
type: string
92+
enableNRI:
93+
type: boolean
9294
enableStdOutAlerts:
9395
type: boolean
9496
enableStdOutLogs:
@@ -102,10 +104,13 @@ spec:
102104
referenced object inside the same namespace.
103105
properties:
104106
name:
107+
default: ""
105108
description: |-
106109
Name of the referent.
110+
This field is effectively required, but due to backwards compatibility is
111+
allowed to be empty. Instances of this type with an empty value here are
112+
almost certainly wrong.
107113
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
108-
TODO: Add other useful fields. apiVersion, kind, uid?
109114
type: string
110115
type: object
111116
x-kubernetes-map-type: atomic
@@ -172,10 +177,13 @@ spec:
172177
referenced object inside the same namespace.
173178
properties:
174179
name:
180+
default: ""
175181
description: |-
176182
Name of the referent.
183+
This field is effectively required, but due to backwards compatibility is
184+
allowed to be empty. Instances of this type with an empty value here are
185+
almost certainly wrong.
177186
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
178-
TODO: Add other useful fields. apiVersion, kind, uid?
179187
type: string
180188
type: object
181189
x-kubernetes-map-type: atomic
@@ -242,10 +250,13 @@ spec:
242250
referenced object inside the same namespace.
243251
properties:
244252
name:
253+
default: ""
245254
description: |-
246255
Name of the referent.
256+
This field is effectively required, but due to backwards compatibility is
257+
allowed to be empty. Instances of this type with an empty value here are
258+
almost certainly wrong.
247259
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
248-
TODO: Add other useful fields. apiVersion, kind, uid?
249260
type: string
250261
type: object
251262
x-kubernetes-map-type: atomic
@@ -312,10 +323,13 @@ spec:
312323
referenced object inside the same namespace.
313324
properties:
314325
name:
326+
default: ""
315327
description: |-
316328
Name of the referent.
329+
This field is effectively required, but due to backwards compatibility is
330+
allowed to be empty. Instances of this type with an empty value here are
331+
almost certainly wrong.
317332
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
318-
TODO: Add other useful fields. apiVersion, kind, uid?
319333
type: string
320334
type: object
321335
x-kubernetes-map-type: atomic
@@ -382,10 +396,13 @@ spec:
382396
referenced object inside the same namespace.
383397
properties:
384398
name:
399+
default: ""
385400
description: |-
386401
Name of the referent.
402+
This field is effectively required, but due to backwards compatibility is
403+
allowed to be empty. Instances of this type with an empty value here are
404+
almost certainly wrong.
387405
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
388-
TODO: Add other useful fields. apiVersion, kind, uid?
389406
type: string
390407
type: object
391408
x-kubernetes-map-type: atomic
@@ -452,10 +469,13 @@ spec:
452469
referenced object inside the same namespace.
453470
properties:
454471
name:
472+
default: ""
455473
description: |-
456474
Name of the referent.
475+
This field is effectively required, but due to backwards compatibility is
476+
allowed to be empty. Instances of this type with an empty value here are
477+
almost certainly wrong.
457478
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
458-
TODO: Add other useful fields. apiVersion, kind, uid?
459479
type: string
460480
type: object
461481
x-kubernetes-map-type: atomic
@@ -553,9 +573,6 @@ spec:
553573
message:
554574
type: string
555575
phase:
556-
description: |-
557-
INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
558-
Important: Run "make" to regenerate code after modifying this file
559576
type: string
560577
type: object
561578
type: object

0 commit comments

Comments
 (0)