Skip to content

Commit 563dd11

Browse files
AlbertoBarbaAlbertoBarba
authored
chore(shield): handle respond mapping on cluster-shield (#2299)
1 parent 3d92652 commit 563dd11

File tree

4 files changed

+124
-35
lines changed

4 files changed

+124
-35
lines changed

‎charts/shield/Chart.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,5 +13,5 @@ maintainers:
1313
- name: mavimo
1414
email: [email protected]
1515
type: application
16-
version: 1.12.0
16+
version: 1.12.1
1717
appVersion: "1.0.0"

‎charts/shield/templates/cluster/_config.tpl

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
{{- define "cluster.features_config" -}}
22
{{- $monitorFeature := (dig "monitor" nil .Values.features) -}}
33
{{- $investigationsFeature := (dig "investigations" nil .Values.features) -}}
4+
{{- $respondFeature := (dig "respond" nil .Values.features) -}}
45
{{- $features := list
56
(dict "posture" (dig "posture" "cluster_posture" nil .Values.features ))
67
(dict "container_vulnerability_management" (dig "vulnerability_management" "container_vulnerability_management" nil .Values.features ))
@@ -9,6 +10,7 @@
910
(dict "kubernetes_metadata" (dig "kubernetes_metadata" nil .Values.features ))
1011
(dict "monitor" (pick $monitorFeature "kube_state_metrics" "kubernetes_events"))
1112
(dict "investigations" (pick $investigationsFeature "investigations" "network_security"))
13+
(dict "respond" (pick $respondFeature "response_actions"))
1214
-}}
1315
{{- $featuresConfig := dict -}}
1416
{{- range $feature := $features }}
@@ -17,6 +19,7 @@
1719
{{- end -}}
1820
{{- end }}
1921
{{- $_ := set $featuresConfig.container_vulnerability_management "in_use" .Values.features.vulnerability_management.in_use -}}
22+
{{- $_ := set $featuresConfig.respond "response_actions" (pick $featuresConfig.respond.response_actions "enabled" "queue_length" "timeout" "cluster") -}}
2023
{{- $additionalFeaturesSettings := (dig "features" (dict) .Values.cluster.additional_settings) -}}
2124
{{- (mergeOverwrite $featuresConfig $additionalFeaturesSettings) | toYaml -}}
2225
{{- end }}
@@ -189,3 +192,40 @@
189192
{{- true -}}
190193
{{- end -}}
191194
{{- end }}
195+
196+
{{/*
197+
Checks if the cluster has the response actions feature enabled.
198+
(either by the feature config or additional settings)
199+
*/}}
200+
{{- define "cluster.response_actions_enabled" -}}
201+
{{- $featureConfig := (include "cluster.features_config" . | fromYaml) -}}
202+
{{- if dig "respond" "response_actions" "enabled" false $featureConfig -}}
203+
{{- true -}}
204+
{{- end -}}
205+
{{- end }}
206+
207+
{{/*
208+
Response Actions: Cluster actions
209+
In the future we will have more complex logic to determine if the action is enabled or not.
210+
*/}}
211+
{{- define "cluster.response_actions.rollout_restart.enabled" }}
212+
{{- include "cluster.response_actions_enabled" . }}
213+
{{- end}}
214+
{{- define "cluster.response_actions.delete_pod.enabled" }}
215+
{{- include "cluster.response_actions_enabled" . }}
216+
{{- end}}
217+
{{- define "cluster.response_actions.isolate_network.enabled" }}
218+
{{- include "cluster.response_actions_enabled" . }}
219+
{{- end}}
220+
{{- define "cluster.response_actions.delete_network_policy.enabled" }}
221+
{{- include "cluster.response_actions_enabled" . }}
222+
{{- end}}
223+
{{- define "cluster.response_actions.get_logs.enabled" }}
224+
{{- include "cluster.response_actions_enabled" . }}
225+
{{- end}}
226+
{{- define "cluster.response_actions.volume_snapshot.enabled" }}
227+
{{- include "cluster.response_actions_enabled" . }}
228+
{{- end}}
229+
{{- define "cluster.response_actions.delete_volume_snapshot.enabled" }}
230+
{{- include "cluster.response_actions_enabled" . }}
231+
{{- end}}

‎charts/shield/templates/cluster/_helpers.tpl

Lines changed: 0 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -126,37 +126,3 @@ If release name contains chart name it will be used as a full name.
126126
{{- . | toYaml -}}
127127
{{- end -}}
128128
{{- end -}}
129-
130-
{{- define "cluster.response_actions_enabled" -}}
131-
{{- with .Values.features.respond.response_actions.enabled }}
132-
{{- . }}
133-
{{- else }}
134-
false
135-
{{- end }}
136-
{{- end }}
137-
138-
{{/*
139-
Response Actions: Cluster actions
140-
In the future we will have more complex logic to determine if the action is enabled or not.
141-
*/}}
142-
{{- define "cluster.response_actions.rollout_restart.enabled" }}
143-
{{- include "cluster.response_actions_enabled" . }}
144-
{{- end}}
145-
{{- define "cluster.response_actions.delete_pod.enabled" }}
146-
{{- include "cluster.response_actions_enabled" . }}
147-
{{- end}}
148-
{{- define "cluster.response_actions.isolate_network.enabled" }}
149-
{{- include "cluster.response_actions_enabled" . }}
150-
{{- end}}
151-
{{- define "cluster.response_actions.delete_network_policy.enabled" }}
152-
{{- include "cluster.response_actions_enabled" . }}
153-
{{- end}}
154-
{{- define "cluster.response_actions.get_logs.enabled" }}
155-
{{- include "cluster.response_actions_enabled" . }}
156-
{{- end}}
157-
{{- define "cluster.response_actions.volume_snapshot.enabled" }}
158-
{{- include "cluster.response_actions_enabled" . }}
159-
{{- end}}
160-
{{- define "cluster.response_actions.delete_volume_snapshot.enabled" }}
161-
{{- include "cluster.response_actions_enabled" . }}
162-
{{- end}}

‎charts/shield/tests/cluster/configmap_test.yaml

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,9 @@ tests:
9090
enabled: false
9191
posture:
9292
enabled: false
93+
respond:
94+
response_actions:
95+
enabled: false
9396
kubernetes:
9497
ca_cert_file: /etc/sysdig/tls-certificates/ca.crt
9598
root_namespace: kube-system
@@ -231,6 +234,86 @@ tests:
231234
network_security:
232235
enabled: true
233236
237+
- it: Enable respond.response_actions
238+
set:
239+
features:
240+
respond:
241+
response_actions:
242+
enabled: true
243+
queue_length: 1000
244+
timeout: 10
245+
cluster:
246+
volume_snapshot_class: "a-volume-snapshot-class"
247+
another_config_not_relevant: "not-relevant"
248+
asserts:
249+
- exists:
250+
path: data["cluster-shield.yaml"]
251+
- matchRegex:
252+
path: data['cluster-shield.yaml']
253+
pattern: |
254+
features:
255+
admission_control:
256+
container_vulnerability_management:
257+
enabled: false
258+
dry_run: true
259+
enabled: false
260+
excluded_namespaces: \[\]
261+
failure_policy: Ignore
262+
http_port: 8443
263+
posture:
264+
enabled: true
265+
timeout: 10
266+
audit:
267+
enabled: false
268+
excluded_namespaces: \[\]
269+
http_port: 6443
270+
timeout: 10
271+
webhook_rules:
272+
- apiGroups:
273+
- ""
274+
- apps
275+
- autoscaling
276+
- batch
277+
- networking.k8s.io
278+
- rbac.authorization.k8s.io
279+
- extensions
280+
apiVersions:
281+
- '\*'
282+
operations:
283+
- '\*'
284+
resources:
285+
- '\*/\*'
286+
scope: '\*'
287+
container_vulnerability_management:
288+
enabled: false
289+
in_use:
290+
enabled: false
291+
integration_enabled: false
292+
local_cluster:
293+
registry_secrets: \[\]
294+
platform_services_enabled: true
295+
registry_ssl:
296+
verify: true
297+
investigations:
298+
network_security:
299+
enabled: false
300+
kubernetes_metadata:
301+
enabled: true
302+
monitor:
303+
kube_state_metrics:
304+
enabled: false
305+
kubernetes_events:
306+
enabled: false
307+
posture:
308+
enabled: false
309+
respond:
310+
response_actions:
311+
cluster:
312+
volume_snapshot_class: a-volume-snapshot-class
313+
enabled: true
314+
queue_length: 1000
315+
timeout: 10
316+
234317
- it: Sets NATS Url and Lock Name when Container Vulnerability Management is enabled
235318
set:
236319
cluster_config:

0 commit comments

Comments
 (0)