Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(core): Add support for Kata Containers #1793

Closed
wants to merge 72 commits into from
Closed

feat(core): Add support for Kata Containers #1793

wants to merge 72 commits into from

Conversation

rootxrishabh
Copy link
Member

Purpose of PR?:
This PR adds support for kata containers on Kubearmor side
Fixes #1340

Does this PR introduce a breaking change?
No
If the changes in this PR are manually verified, list down the scenarios covered::

Additional information for reviewer? :
Mention if this PR is part of any design or a continuation of previous PRs

Checklist:

  • Bug fix. Fixes #
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update
  • PR Title follows the convention of <type>(<scope>): <subject>
  • Commit has unit tests
  • Commit has integration tests

@rootxrishabh
feat: Add support for Kata Containers
624b287 
Signed-off-by: rootxrishabh <risrock02@gmail.com>
@rootxrishabh
Copy link
Member Author

rootxrishabh commented Jul 2, 2024 •
edited by daemon1024
Loading

Deployment : https://gist.github.com/rootxrishabh/0a9142004d538fe2724459664814816d

Image side hook : https://gist.github.com/rootxrishabh/37bd8ce823e06c87005807c9b3f11f0a

Hook path - /opt/kata/share/defaults/kata-containers/configuration.toml

Hook flag - guest_hook_path = "/usr/share/oci/hooks"

Docs for hooks: https://github.com/kata-containers/kata-containers/blob/main/docs/design/hooks-handling.md#kata-hooks

@daemon1024
Copy link
Member

daemon1024 commented Jul 3, 2024 •
edited
Loading

Challenges:

  1. Enabling BPFLSM in Guest Image for CVM
  2. Enforcing on individual container
    • Usage of OCI Hooks
      • Load OCI Hook into Guest Image
      • Modify Kata to enable Guest OCI Hooks in CVM

Task:

  • Verify the PR code
  • Configure Relay to Interact with KubeArmor sidecar containers for telemetry aggregation
  • Admission Controller to auto add KubeArmor as sidecar

@daemon1024
Copy link
Member

image

Prateeknandle and others added 23 commits November 6, 2024 14:03
@Prateeknandle @rootxrishabh
feat:Adding support for KubeArmorClusterPolicy
f3731e9 
Signed-off-by: Prateek Nandle <prateeknandle@gmail.com>
@Prateeknandle @rootxrishabh
fix(ci): replace podman pull to podman load to avoid deprecated docke…
77a8ba6 
…r api version

Signed-off-by: Prateek <prateeknandle@gmail.com>
@Prateeknandle @rootxrishabh
fix(ci):updating dependency to fix vuln issues
8354cac 
Signed-off-by: Prateek <prateeknandle@gmail.com>
@Prateeknandle @rootxrishabh
fix(enforcer):handling empty ProcessName for Process logs
6755325 
Signed-off-by: Prateek <prateeknandle@gmail.com>
@daemon1024 @rootxrishabh
fix(controller): don't exit controller on reconciler failure for hsp …
9c4fc3c 
…and csp

Signed-off-by: daemon1024 <barun1024@gmail.com>
@DelusionalOptimist @rootxrishabh
chore: use GH_ACCESS_TOKEN
b52055d 
Signed-off-by: Rudraksh Pareek <rudraksh@accuknox.com>
@tesla59 @rootxrishabh
helm: quote configmap values
2308faa 
Signed-off-by: tesla59 <nishant@heim.id>
@DelusionalOptimist @rootxrishabh
fix: use custom action
504bd5d 
Signed-off-by: Rudraksh Pareek <rudraksh@accuknox.com>
@navin772 @rootxrishabh
fix(logs): reset eventChan everytime KarmorLogStart() is called
ee0fdad 
This will reduce flakiness in the tests

Signed-off-by: Navin Chandra <navinchandra772@gmail.com>
@DelusionalOptimist @rootxrishabh
fix: pass PAT as env var for gh-cli
691d894 
Signed-off-by: Rudraksh Pareek <rudraksh@accuknox.com>
@nyrahul @rootxrishabh
updated the main diagram
0f90520 
Signed-off-by: Rahul Jadhav <nyrahul@gmail.com>
@nyrahul @rootxrishabh
added the updater script
3f135ea 
Signed-off-by: Rahul Jadhav <nyrahul@gmail.com>
@nyrahul @rootxrishabh
added an FAQ for WSL2
98a059d 
Signed-off-by: Rahul Jadhav <nyrahul@gmail.com>
@Prateeknandle @rootxrishabh
fix(core):timeout when host & cluster security policies crds are not …
1a2675b 
…found

Signed-off-by: Prateek <prateeknandle@gmail.com>
@daemon1024 @rootxrishabh
fix(apparmor): reenable profile after parsing to make whitelist polic…
6898591 
…ies work

idk why we need to do this, but this fixes things for now

Signed-off-by: daemon1024 <barun1024@gmail.com>
@Aryan-sharma11 @rootxrishabh
fix: default posture logs for system generated permission denied events
3be4533 
Signed-off-by: Aryan-sharma11 <aryan1126.sharma@gmail.com>
@rksharma95 @rootxrishabh
fix controller image updation issue
13a8ad1 
Signed-off-by: rksharma95 <ramakant@accuknox.com>
@kranurag7 @rootxrishabh
remove kustomize binary from the repo
52a95a6 
I think this was in there by mistake so removing the same via this
patch.

Signed-off-by: kranurag7 <81210977+kranurag7@users.noreply.github.com>
@Aryan-sharma11 @rootxrishabh
fix CI
5bb93ad 
Signed-off-by: Aryan-sharma11 <aryan1126.sharma@gmail.com>
@Aryan-sharma11 @rootxrishabh
update go.mod
ee569ff 
Signed-off-by: Aryan-sharma11 <aryan1126.sharma@gmail.com>
@SD-13 @rootxrishabh
fix hyperlink in hardening guide
1171c46 
Signed-off-by: Sujay <sujaydey641@gmail.com>
@rksharma95 @rootxrishabh
add multienforcer controller
0170292 
Signed-off-by: rksharma95 <ramakant@accuknox.com>
@Aryan-sharma11 @rootxrishabh
feat : add annotate resources flag
1e6a4ec 
Signed-off-by: Aryan-sharma11 <aryan1126.sharma@gmail.com>
navin772 and others added 28 commits November 6, 2024 14:03
@navin772 @rootxrishabh
build UBI based coverage image
322531c 
Signed-off-by: Navin Chandra <navinchandra772@gmail.com>
@navin772 @rootxrishabh
Remove retry logic and check for completed workflows
1d19957 
Signed-off-by: Navin Chandra <navinchandra772@gmail.com>
@Aryan-sharma11 @rootxrishabh
no policy enforcement on untacked namespaces
9c5af18 
Signed-off-by: Aryan-sharma11 <aryan1126.sharma@gmail.com>
@anurag-rajawat @rootxrishabh
fix: Update relay clusterrole to watch pods
33253cc 
Signed-off-by: Anurag Rajawat <anuragsinghrajawat22@gmail.com>
@Prateeknandle @rootxrishabh
enabling alert throttling by default
b5e1368 
Signed-off-by: Prateek <prateeknandle@gmail.com>
@Prateeknandle @rootxrishabh
fix(Alert Throttling): making throttling dynamic
f3263fe 
Signed-off-by: Prateek <prateeknandle@gmail.com>
@Prateeknandle @rootxrishabh
fix(ci): set working directory in order to install correct dependencies
ea60056 
Signed-off-by: Prateek <prateeknandle@gmail.com>
@daemon1024 @rootxrishabh
fix(policymatcher): skip future matching in case block/audit matches
7ca8260 
Signed-off-by: daemon1024 <barun1024@gmail.com>
@Aryan-sharma11 @rootxrishabh
fix: bpf object files not loading on kernel>=6.8
a1a3175 
Signed-off-by: Aryan-sharma11 <aryan1126.sharma@gmail.com>
@DelusionalOptimist @rootxrishabh
chore: compile object files on Linux 5.15.0-76-generic
ca0d485 
Signed-off-by: Rudraksh Pareek <rudraksh@accuknox.com>
@DelusionalOptimist @rootxrishabh
chore: udpate slack link
3164097 
Signed-off-by: Rudraksh Pareek <rudraksh@accuknox.com>
@Prateeknandle @rootxrishabh
fix(policyMatcher): handling relative path resource by joining it wit…
aeba059 
…h cwd

Signed-off-by: Prateek <prateeknandle@gmail.com>
@Prateeknandle @rootxrishabh
fix(ci):ignoring G115 rule from gosec
c06e223 
Signed-off-by: Prateek <prateeknandle@gmail.com>
@daemon1024 @rootxrishabh
fix(apparmor/host): streamline host profile generation with container…
35aa5bd 
… template generation

- deprecating special handling of host profiles
- making reload of apparmor profiles only in k8s env

Signed-off-by: daemon1024 <barun1024@gmail.com>
@carlosrodfern @rootxrishabh
refactor(operator): remove config empty check
36d1fcc 
The config elements, though optional, are not ptr, so they are
initialized with the respective type default values. As result,
strconv.Format... will never return an empty string, so the check is
unnecessary.

Signed-off-by: Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com>
@Prateeknandle @rootxrishabh
fix(operator): set default value in configmap when throttling configu…
eb6e9c1 
…ration are empty

Signed-off-by: Prateek <prateeknandle@gmail.com>
@daemon1024 @rootxrishabh
Update STABLE-RELEASE to v1.4.3
60911cb 
Signed-off-by: daemon1024 <barun1024@gmail.com>
@daemon1024 @rootxrishabh
update ossf scorecard action for repository ruleset
51b5b88 
Signed-off-by: daemon1024 <barun1024@gmail.com>
@rksharma95 @rootxrishabh
add filelessexec script, build binaries at build-time
ef92587 
Signed-off-by: rksharma95 <ramakant@accuknox.com>
@prady0t @rootxrishabh
Fuzzer for ContainerPolicy
8f047c3 
Signed-off-by: prady0t <rickprimeranjan@gmail.com>
@prady0t @rootxrishabh
Adding fuzzer for hostPolicy
9d4d507 
Signed-off-by: prady0t <rickprimeranjan@gmail.com>

Updating branch

Signed-off-by: prady0t <rickprimeranjan@gmail.com>

Delete KubeArmor/core/testdata/fuzz/FuzzContainerPolicy/bb2a6f290a615f3e

Signed-off-by: prady0t <rickprimeranjan@gmail.com>
@daemon1024 @rootxrishabh
revert(multiubuntu): hotpatch back to 18:04 till tests are migrated
e3f009e 
Signed-off-by: daemon1024 <barun1024@gmail.com>
@daemon1024 @rootxrishabh
chore(ci): trigger test on multiubuntu image updates
591e639 
Signed-off-by: daemon1024 <barun1024@gmail.com>
@prady0t @rootxrishabh
Config file for oss-fuzz integration
90a820c 
Signed-off-by: prady0t <rickprimeranjan@gmail.com>
@prady0t @rootxrishabh
Adding lisence info
5d51baa 
Signed-off-by: prady0t <rickprimeranjan@gmail.com>
@Prateeknandle @rootxrishabh
fix(ebpf): set min kernel version that handle 1 million instructions …
0bb9922 
…to support cwd and throttling

Signed-off-by: Prateek <prateeknandle@gmail.com>
@daemon1024 @rootxrishabh
fix(apparmor/host): sanitise profile name for from-source policy
ee14001 
Signed-off-by: daemon1024 <barun1024@gmail.com>
@rootxrishabh
feat: Add support for Kata Containers
5e24853 
Signed-off-by: rootxrishabh <risrock02@gmail.com>
@rootxrishabh rootxrishabh mentioned this pull request Nov 6, 2024
Open
7 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@daemon1024 daemon1024 Awaiting requested review from daemon1024

@DelusionalOptimist DelusionalOptimist Awaiting requested review from DelusionalOptimist

@Prateeknandle Prateeknandle Awaiting requested review from Prateeknandle

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

check support for Kata containers