Skip to content

Commit dc0bb33

Browse files
daemon1024daemon1024
authored
Merge pull request #1916 from rksharma95/feat-recommend-csp
feat(operator): add recommended policies feature to operator
2 parents 410ea7a + 863a0be commit dc0bb33

26 files changed

+825
-66
lines changed

‎deployments/helm/KubeArmorOperator/crds/operator.kubearmor.com_kubearmorconfigs.yaml

+46-21
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
33
kind: CustomResourceDefinition
44
metadata:
55
annotations:
6-
controller-gen.kubebuilder.io/version: v0.4.1
7-
creationTimestamp: null
6+
controller-gen.kubebuilder.io/version: v0.14.0
87
name: kubearmorconfigs.operator.kubearmor.com
98
spec:
109
group: operator.kubearmor.com
@@ -25,20 +24,27 @@ spec:
2524
description: KubeArmorConfig is the Schema for the KubeArmorConfigs API
2625
properties:
2726
apiVersion:
28-
description: 'APIVersion defines the versioned schema of this representation
29-
of an object. Servers should convert recognized schemas to the latest
30-
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
27+
description: |-
28+
APIVersion defines the versioned schema of this representation of an object.
29+
Servers should convert recognized schemas to the latest internal value, and
30+
may reject unrecognized values.
31+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
3132
type: string
3233
kind:
33-
description: 'Kind is a string value representing the REST resource this
34-
object represents. Servers may infer this from the endpoint the client
35-
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
34+
description: |-
35+
Kind is a string value representing the REST resource this object represents.
36+
Servers may infer this from the endpoint the client submits requests to.
37+
Cannot be updated.
38+
In CamelCase.
39+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
3640
type: string
3741
metadata:
3842
type: object
3943
spec:
4044
description: KubeArmorConfigSpec defines the desired state of KubeArmorConfig
4145
properties:
46+
alertThrottling:
47+
type: boolean
4248
defaultCapabilitiesPosture:
4349
enum:
4450
- audit
@@ -127,12 +133,37 @@ spec:
127133
- Never
128134
type: string
129135
type: object
130-
seccompEnabled:
131-
type: boolean
132-
alertThrottling:
133-
type: boolean
134136
maxAlertPerSec:
135137
type: integer
138+
recommendedPolicies:
139+
properties:
140+
enable:
141+
type: boolean
142+
excludePolicy:
143+
items:
144+
type: string
145+
type: array
146+
matchExpressions:
147+
items:
148+
properties:
149+
key:
150+
enum:
151+
- namespace
152+
type: string
153+
operator:
154+
enum:
155+
- In
156+
- NotIn
157+
type: string
158+
values:
159+
items:
160+
type: string
161+
type: array
162+
type: object
163+
type: array
164+
type: object
165+
seccompEnabled:
166+
type: boolean
136167
throttleSec:
137168
type: integer
138169
tls:
@@ -156,19 +187,13 @@ spec:
156187
message:
157188
type: string
158189
phase:
159-
description: 'INSERT ADDITIONAL STATUS FIELD - define observed state
160-
of cluster Important: Run "make" to regenerate code after modifying
161-
this file'
190+
description: |-
191+
INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
192+
Important: Run "make" to regenerate code after modifying this file
162193
type: string
163194
type: object
164195
type: object
165196
served: true
166197
storage: true
167198
subresources:
168199
status: {}
169-
status:
170-
acceptedNames:
171-
kind: ""
172-
plural: ""
173-
conditions: []
174-
storedVersions: []

‎deployments/operator/operator.yaml

+58-21
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
22
kind: CustomResourceDefinition
33
metadata:
44
annotations:
5-
controller-gen.kubebuilder.io/version: v0.4.1
6-
creationTimestamp: null
5+
controller-gen.kubebuilder.io/version: v0.14.0
76
name: kubearmorconfigs.operator.kubearmor.com
87
spec:
98
group: operator.kubearmor.com
@@ -24,20 +23,27 @@ spec:
2423
description: KubeArmorConfig is the Schema for the KubeArmorConfigs API
2524
properties:
2625
apiVersion:
27-
description: 'APIVersion defines the versioned schema of this representation
28-
of an object. Servers should convert recognized schemas to the latest
29-
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
26+
description: |-
27+
APIVersion defines the versioned schema of this representation of an object.
28+
Servers should convert recognized schemas to the latest internal value, and
29+
may reject unrecognized values.
30+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
3031
type: string
3132
kind:
32-
description: 'Kind is a string value representing the REST resource this
33-
object represents. Servers may infer this from the endpoint the client
34-
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
33+
description: |-
34+
Kind is a string value representing the REST resource this object represents.
35+
Servers may infer this from the endpoint the client submits requests to.
36+
Cannot be updated.
37+
In CamelCase.
38+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
3539
type: string
3640
metadata:
3741
type: object
3842
spec:
3943
description: KubeArmorConfigSpec defines the desired state of KubeArmorConfig
4044
properties:
45+
alertThrottling:
46+
type: boolean
4147
defaultCapabilitiesPosture:
4248
enum:
4349
- audit
@@ -126,12 +132,37 @@ spec:
126132
- Never
127133
type: string
128134
type: object
129-
seccompEnabled:
130-
type: boolean
131-
alertThrottling:
132-
type: boolean
133135
maxAlertPerSec:
134136
type: integer
137+
recommendedPolicies:
138+
properties:
139+
enable:
140+
type: boolean
141+
excludePolicy:
142+
items:
143+
type: string
144+
type: array
145+
matchExpressions:
146+
items:
147+
properties:
148+
key:
149+
enum:
150+
- namespace
151+
type: string
152+
operator:
153+
enum:
154+
- In
155+
- NotIn
156+
type: string
157+
values:
158+
items:
159+
type: string
160+
type: array
161+
type: object
162+
type: array
163+
type: object
164+
seccompEnabled:
165+
type: boolean
135166
throttleSec:
136167
type: integer
137168
tls:
@@ -155,22 +186,16 @@ spec:
155186
message:
156187
type: string
157188
phase:
158-
description: 'INSERT ADDITIONAL STATUS FIELD - define observed state
159-
of cluster Important: Run "make" to regenerate code after modifying
160-
this file'
189+
description: |-
190+
INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
191+
Important: Run "make" to regenerate code after modifying this file
161192
type: string
162193
type: object
163194
type: object
164195
served: true
165196
storage: true
166197
subresources:
167198
status: {}
168-
status:
169-
acceptedNames:
170-
kind: ""
171-
plural: ""
172-
conditions: []
173-
storedVersions: []
174199
---
175200
apiVersion: v1
176201
kind: ServiceAccount
@@ -290,6 +315,14 @@ rules:
290315
- list
291316
- watch
292317
- update
318+
- apiGroups:
319+
- ""
320+
resources:
321+
- nodes
322+
verbs:
323+
- get
324+
- list
325+
- watch
293326
- apiGroups:
294327
- security.kubearmor.com
295328
resources:
@@ -388,6 +421,10 @@ rules:
388421
- cronjobs
389422
verbs:
390423
- get
424+
- patch
425+
- list
426+
- watch
427+
- update
391428
- apiGroups:
392429
- security.kubearmor.com
393430
resources:

‎pkg/KubeArmorOperator/Dockerfile

+1
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ COPY $OPERATOR_DIR/enforcer enforcer
3535
COPY $OPERATOR_DIR/k8s k8s
3636
COPY $OPERATOR_DIR/runtime runtime
3737
COPY $OPERATOR_DIR/seccomp seccomp
38+
COPY $OPERATOR_DIR/recommend recommend
3839

3940
# Build
4041
RUN CGO_ENABLED=0 GOOS=${GOOS} GOARCH=${GOARCH} GO111MODULE=on go build -a -o operator cmd/operator/main.go

‎pkg/KubeArmorOperator/api/operator.kubearmor.com/v1/kubearmorconfig_types.go

+11
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
package v1
55

66
import (
7+
securityv1 "github.com/kubearmor/KubeArmor/pkg/KubeArmorController/api/security.kubearmor.com/v1"
78
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
89
)
910

@@ -30,11 +31,21 @@ type Tls struct {
3031
RelayExtraIpAddresses []string `json:"extraIpAddresses,omitempty"`
3132
}
3233

34+
type RecommendedPolicies struct {
35+
Enable bool `json:"enable,omitempty"`
36+
37+
MatchExpressions []securityv1.MatchExpressionsType `json:"matchExpressions,omitempty"`
38+
39+
ExcludePolicy []string `json:"excludePolicy,omitempty"`
40+
}
41+
3342
// KubeArmorConfigSpec defines the desired state of KubeArmorConfig
3443
type KubeArmorConfigSpec struct {
3544
// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
3645
// Important: Run "make" to regenerate code after modifying this file
3746

47+
// +kubebuilder:validation:optional
48+
RecommendedPolicies RecommendedPolicies `json:"recommendedPolicies,omitempty"`
3849
// +kubebuilder:validation:optional
3950
DefaultFilePosture PostureType `json:"defaultFilePosture,omitempty"`
4051
// +kubebuilder:validation:optional

‎pkg/KubeArmorOperator/api/operator.kubearmor.com/v1/zz_generated.deepcopy.go

+29
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/KubeArmorOperator/cmd/operator/main.go

+4-1
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import (
88
"errors"
99
"path/filepath"
1010

11+
secv1client "github.com/kubearmor/KubeArmor/pkg/KubeArmorController/client/clientset/versioned"
1112
opv1client "github.com/kubearmor/KubeArmor/pkg/KubeArmorOperator/client/clientset/versioned"
1213
controllers "github.com/kubearmor/KubeArmor/pkg/KubeArmorOperator/internal/controller"
1314
"github.com/kubearmor/KubeArmor/pkg/KubeArmorOperator/k8s"
@@ -28,6 +29,7 @@ var PathPrefix string
2829
var DeploymentName string
2930
var ExtClient *apiextensionsclientset.Clientset
3031
var Opv1Client *opv1client.Clientset
32+
var Secv1Client *secv1client.Clientset
3133
var InitDeploy bool
3234
var LogLevel string
3335

@@ -45,14 +47,15 @@ var Cmd = &cobra.Command{
4547
K8sClient = k8s.NewClient(*Logger, KubeConfig)
4648
ExtClient = k8s.NewExtClient(*Logger, KubeConfig)
4749
Opv1Client = k8s.NewOpv1Client(*Logger, KubeConfig)
50+
Secv1Client = k8s.NewSecv1Client(*Logger, KubeConfig)
4851
//Initialise k8sClient for all child commands to inherit
4952
if K8sClient == nil {
5053
return errors.New("couldn't create k8s client")
5154
}
5255
return nil
5356
},
5457
Run: func(cmd *cobra.Command, args []string) {
55-
nodeWatcher := controllers.NewClusterWatcher(K8sClient, Logger, ExtClient, Opv1Client, PathPrefix, DeploymentName, InitDeploy)
58+
nodeWatcher := controllers.NewClusterWatcher(K8sClient, Logger, ExtClient, Opv1Client, Secv1Client, PathPrefix, DeploymentName, InitDeploy)
5659
go nodeWatcher.WatchConfigCrd()
5760
nodeWatcher.WatchNodes()
5861

‎pkg/KubeArmorOperator/common/defaults.go

+15
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import (
1111
"strings"
1212

1313
deployments "github.com/kubearmor/KubeArmor/deployments/get"
14+
securityv1 "github.com/kubearmor/KubeArmor/pkg/KubeArmorController/api/security.kubearmor.com/v1"
1415
opv1 "github.com/kubearmor/KubeArmor/pkg/KubeArmorOperator/api/operator.kubearmor.com/v1"
1516
corev1 "k8s.io/api/core/v1"
1617
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -124,6 +125,20 @@ var (
124125
AlertThrottling bool = true
125126
DefaultMaxAlertPerSec string = "10"
126127
DefaultThrottleSec string = "30"
128+
129+
// recommend policies
130+
RecommendedPolicies opv1.RecommendedPolicies = opv1.RecommendedPolicies{
131+
MatchExpressions: []securityv1.MatchExpressionsType{
132+
{
133+
Key: "namespace",
134+
Operator: "NotIn",
135+
Values: []string{
136+
"kube-system",
137+
"kubearmor",
138+
},
139+
},
140+
},
141+
}
127142
)
128143

129144
var ConfigMapData = map[string]string{

0 commit comments

Comments
 (0)