support observability for containerized workloads

Signed-off-by: Ankur Kothiwal <ankur.kothiwal@accuknox.com>
accuknox · Aug 16, 2022 · a8c46f0 · a8c46f0
1 parent 7d33584
commit a8c46f0
Show file tree

Hide file tree

Showing 8 changed files with 27 additions and 12 deletions.
diff --git a/src/accuknox.db-journal b/src/accuknox.db-journal
diff --git a/src/cluster/clusterResourceHandler.go b/src/cluster/clusterResourceHandler.go
@@ -27,6 +27,11 @@ func GetPods(clusterName string) []types.Pod {
 		PodName:   types.PolicyDiscoveryVMPodName,
 	})
 
+	pods = append(pods, types.Pod{
+		Namespace: types.PolicyDiscoveryContainerNamespace,
+		PodName:   types.PolicyDiscoveryContainerPodName,
+	})
+
 	return pods
 }
 

diff --git a/src/conf/local-file.yaml b/src/conf/local-file.yaml
@@ -1,7 +1,7 @@
 application:
   name: knoxautopolicy
   network:
-    operation-mode: 1                             # 1: cronjob | 2: one-time-job
+    operation-mode: 0                             # 1: cronjob | 2: one-time-job
     operation-trigger: 100
     cron-job-time-interval: "0h0m10s"             # format: XhYmZs 
     network-log-limit: 10000

diff --git a/src/libs/common.go b/src/libs/common.go
@@ -404,10 +404,6 @@ func writeYamlByte(f *os.File, b []byte) {
 		log.Error().Msg(err.Error())
 	}
 
-	if _, err := f.WriteString("---\n"); err != nil {
-		log.Error().Msg(err.Error())
-	}
-
 	if err := f.Sync(); err != nil {
 		log.Error().Msg(err.Error())
 	}

diff --git a/src/plugin/kubearmor.go b/src/plugin/kubearmor.go
@@ -293,6 +293,12 @@ func ConvertKubeArmorLogToKnoxSystemLog(relayLog *pb.Log) (types.KnoxSystemLog,
 		knoxSystemLog.PodName = types.PolicyDiscoveryVMPodName
 	}
 
+	if relayLog.Type == "ContainerLog" {
+		knoxSystemLog.ContainerName = relayLog.ContainerName
+		knoxSystemLog.Namespace = types.PolicyDiscoveryContainerNamespace
+		knoxSystemLog.PodName = types.PolicyDiscoveryContainerPodName
+	}
+
 	return knoxSystemLog, nil
 }
 

diff --git a/src/systempolicy/helperFunctions.go b/src/systempolicy/helperFunctions.go
@@ -115,7 +115,7 @@ func FilterSystemLogsByConfig(logs []types.KnoxSystemLog, pods []types.Pod) []ty
 			}
 
 			// 2. check pod labels
-			if (checkItems&2 > 0) && (log.Namespace == types.PolicyDiscoveryVMNamespace || containLabelByConfiguration(filter.Labels, getLabelsFromPod(log.PodName, pods))) {
+			if (checkItems&2 > 0) && (log.Namespace == types.PolicyDiscoveryVMNamespace || log.Namespace == types.PolicyDiscoveryContainerNamespace || containLabelByConfiguration(filter.Labels, getLabelsFromPod(log.PodName, pods))) {
 				checkedItems = checkedItems | 1<<1
 			}
 
@@ -156,7 +156,7 @@ func FilterSystemLogsByConfig(logs []types.KnoxSystemLog, pods []types.Pod) []ty
 func GetWPFSSources() []string {
 	res, _, err := libs.GetWorkloadProcessFileSet(CfgDB, types.WorkloadProcessFileSet{})
 	if err != nil {
-		log.Error().Msgf("cudnot fetch WPFS err=%s", err.Error())
+		log.Error().Msgf("could not fetch WPFS err=%s", err.Error())
 		return nil
 	}
 

diff --git a/src/systempolicy/systemPolicy.go b/src/systempolicy/systemPolicy.go
@@ -265,7 +265,7 @@ func populateKnoxSysPolicyFromWPFSDb(namespace, clustername, labels, fromsource
 	}
 	res, pnMap, err := libs.GetWorkloadProcessFileSet(CfgDB, wpfs)
 	if err != nil {
-		log.Error().Msgf("cudnot fetch WPFS err=%s", err.Error())
+		log.Error().Msgf("could not fetch WPFS err=%s", err.Error())
 		return nil
 	}
 	log.Info().Msgf("found %d WPFS records", len(res))
@@ -1261,9 +1261,14 @@ func GenFileSetForAllPodsInCluster(clusterName string, pods []types.Pod, settype
 		wpfs.SetType = settype
 		labels, err := GetPodLabels(slog.ClusterName, slog.PodName, slog.Namespace, pods)
 		if err != nil {
-			log.Error().Msgf("cudnot get pod labels for podname=%s ns=%s", slog.PodName, slog.Namespace)
+			log.Error().Msgf("could not get pod labels for podname=%s ns=%s", slog.PodName, slog.Namespace)
 			continue
 		}
+
+		if slog.Namespace == types.PolicyDiscoveryContainerNamespace {
+			labels = append(labels, "kubearmor.io/container.name="+slog.ContainerName)
+		}
+
 		wpfs.Labels = strings.Join(labels[:], ",")
 
 		if isNetworkOp {
@@ -1339,7 +1344,6 @@ func DiscoverSystemPolicyMain() {
 	}
 
 	PopulateSystemPoliciesFromSystemLogs(allSystemkLogs)
-
 }
 
 // ==================================== //

diff --git a/src/types/constants.go b/src/types/constants.go
@@ -1,11 +1,15 @@
 package types
 
 const (
-	// Kubearmor VM
+	// KubeArmor VM
 	PolicyDiscoveryVMNamespace = "accuknox-vm-namespace"
 	PolicyDiscoveryVMPodName   = "accuknox-vm-podname"
 
-	// Kubearmor k8s
+	// KubeArmor container
+	PolicyDiscoveryContainerNamespace = "container_namespace"
+	PolicyDiscoveryContainerPodName   = "container_podname"
+
+	// KubeArmor k8s
 	PreConfiguredKubearmorRule = "/lib/x86_64-linux-gnu/"
 
 	// RecordSeparator - DB separator flag