Skip to content

Commit

Permalink
Fix management of seccomp ConfigMap when not used (#311)
Browse files Browse the repository at this point in the history
  • Loading branch information
@vboulineau
vboulineau committed May 27, 2021
1 parent 1fe1e8d commit 8b4b796
Show file tree
Hide file tree
Showing 15 changed files with 460 additions and 239 deletions.
1 change: 1 addition & 0 deletions LICENSE-3rdparty.csv
View file
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,7 @@ core,"github.com/golang/protobuf/ptypes/timestamp",NewBSD
core,"github.com/golang/snappy",NewBSD
core,"github.com/google/btree",Apache-2.0
core,"github.com/google/go-cmp/cmp",NewBSD
core,"github.com/google/go-cmp/cmp/cmpopts",NewBSD
core,"github.com/google/go-cmp/cmp/internal/diff",NewBSD
core,"github.com/google/go-cmp/cmp/internal/flags",NewBSD
core,"github.com/google/go-cmp/cmp/internal/function",NewBSD
Expand Down
1 change: 1 addition & 0 deletions api/v1alpha1/datadogagent_types.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -528,6 +528,7 @@ type SystemProbeSpec struct {
SecCompRootPath string `json:"secCompRootPath,omitempty"`

// SecCompCustomProfileConfigMap specify a pre-existing ConfigMap containing a custom SecComp profile.
// This ConfigMap must contain a file named system-probe-seccomp.json.
// +optional
SecCompCustomProfileConfigMap string `json:"secCompCustomProfileConfigMap,omitempty"`

Expand Down
2 changes: 1 addition & 1 deletion api/v1alpha1/zz_generated.openapi.go
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 2 additions & 1 deletion config/crd/bases/v1/datadoghq.com_datadogagents.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3630,7 +3630,8 @@ spec:
type: object
secCompCustomProfileConfigMap:
description: SecCompCustomProfileConfigMap specify a pre-existing
ConfigMap containing a custom SecComp profile.
ConfigMap containing a custom SecComp profile. This ConfigMap
must contain a file named system-probe-seccomp.json.
type: string
secCompProfileName:
description: SecCompProfileName specify a seccomp profile.
Expand Down
3 changes: 2 additions & 1 deletion config/crd/bases/v1beta1/datadoghq.com_datadogagents.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3492,7 +3492,8 @@ spec:
type: object
secCompCustomProfileConfigMap:
description: SecCompCustomProfileConfigMap specify a pre-existing
ConfigMap containing a custom SecComp profile.
ConfigMap containing a custom SecComp profile. This ConfigMap
must contain a file named system-probe-seccomp.json.
type: string
secCompProfileName:
description: SecCompProfileName specify a seccomp profile.
Expand Down
122 changes: 118 additions & 4 deletions controllers/datadogagent/agent_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,11 +15,10 @@ import (
datadoghqv1alpha1 "github.com/DataDog/datadog-operator/api/v1alpha1"
test "github.com/DataDog/datadog-operator/api/v1alpha1/test"
"github.com/DataDog/datadog-operator/controllers/datadogagent/orchestrator"
"github.com/DataDog/datadog-operator/pkg/testutils"
edsdatadoghqv1alpha1 "github.com/DataDog/extendeddaemonset/api/v1alpha1"
"github.com/google/go-cmp/cmp"
assert "github.com/stretchr/testify/require"
corev1 "k8s.io/api/core/v1"
apiequality "k8s.io/apimachinery/pkg/api/equality"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/util/intstr"
logf "sigs.k8s.io/controller-runtime/pkg/log"
Expand Down Expand Up @@ -1140,6 +1139,103 @@ func defaultSystemProbePodSpec(dda *datadoghqv1alpha1.DatadogAgent) corev1.PodSp
}
}

func noSeccompInstallSystemProbeSpec(dda *datadoghqv1alpha1.DatadogAgent) corev1.PodSpec {
agentWithSystemProbeVolumeMounts := []corev1.VolumeMount{}
agentWithSystemProbeVolumeMounts = append(agentWithSystemProbeVolumeMounts, defaultMountVolume()...)
agentWithSystemProbeVolumeMounts = append(agentWithSystemProbeVolumeMounts, []corev1.VolumeMount{
{
Name: "sysprobe-socket-dir",
ReadOnly: true,
MountPath: "/var/run/sysprobe",
},
{
Name: "system-probe-config",
MountPath: "/etc/datadog-agent/system-probe.yaml",
SubPath: "system-probe.yaml",
},
}...)

// Remove volumes for seccomp profile install
var volumes []corev1.Volume
for _, vol := range defaultSystemProbeVolumes() {
if vol.Name == datadoghqv1alpha1.SystemProbeSecCompRootVolumeName || vol.Name == datadoghqv1alpha1.SystemProbeAgentSecurityVolumeName {
continue
}
volumes = append(volumes, vol)
}

return corev1.PodSpec{
ServiceAccountName: "foo-agent",
InitContainers: []corev1.Container{
{
Name: "init-volume",
Image: "gcr.io/datadoghq/agent:latest",
ImagePullPolicy: corev1.PullIfNotPresent,
Resources: corev1.ResourceRequirements{},
Command: []string{"bash", "-c"},
Args: []string{"cp -r /etc/datadog-agent /opt"},
VolumeMounts: []corev1.VolumeMount{
{
Name: datadoghqv1alpha1.ConfigVolumeName,
MountPath: "/opt/datadog-agent",
},
},
},
{
Name: "init-config",
Image: "gcr.io/datadoghq/agent:latest",
ImagePullPolicy: corev1.PullIfNotPresent,
Resources: corev1.ResourceRequirements{},
Command: []string{"bash", "-c"},
Args: []string{"for script in $(find /etc/cont-init.d/ -type f -name '*.sh' | sort) ; do bash $script ; done"},
Env: defaultEnvVars(nil),
VolumeMounts: agentWithSystemProbeVolumeMounts,
},
},
Containers: []corev1.Container{
{
Name: "agent",
Image: "gcr.io/datadoghq/agent:latest",
ImagePullPolicy: corev1.PullIfNotPresent,
Command: []string{
"agent",
"run",
},
Resources: corev1.ResourceRequirements{},
Ports: []corev1.ContainerPort{
{
ContainerPort: 8125,
Name: "dogstatsdport",
Protocol: "UDP",
},
},
Env: defaultEnvVars(nil),
VolumeMounts: agentWithSystemProbeVolumeMounts,
LivenessProbe: defaultLivenessProbe(),
ReadinessProbe: defaultReadinessProbe(),
},
{
Name: "system-probe",
Image: "gcr.io/datadoghq/agent:latest",
ImagePullPolicy: corev1.PullIfNotPresent,
Command: []string{
"system-probe",
"--config=/etc/datadog-agent/system-probe.yaml",
},
SecurityContext: &corev1.SecurityContext{
Capabilities: &corev1.Capabilities{
Add: []corev1.Capability{"SYS_ADMIN", "SYS_RESOURCE", "SYS_PTRACE", "NET_ADMIN", "NET_BROADCAST", "NET_RAW", "IPC_LOCK"},
},
},
Resources: corev1.ResourceRequirements{},
Env: defaultSystemProbeEnvVars(),
VolumeMounts: defaultSystemProbeMountVolume(),
},
},
Volumes: volumes,
}
}

func defaultPodSpec(dda *datadoghqv1alpha1.DatadogAgent) corev1.PodSpec {
return corev1.PodSpec{
ServiceAccountName: "foo-agent",
Expand Down Expand Up @@ -1790,8 +1886,8 @@ func (test extendedDaemonSetFromInstanceTest) Run(t *testing.T) {
// Remove the generated hash before comparison because it is not easy generate it in the test definition.
delete(got.Annotations, datadoghqv1alpha1.MD5AgentDeploymentAnnotationKey)

assert.True(t, apiequality.Semantic.DeepEqual(got, test.want), "newExtendedDaemonSetFromInstance() = %#v\n\nwant %#v\ndiff: %s",
got, test.want, cmp.Diff(got, test.want))
diff := testutils.CompareKubeResource(got, test.want)
assert.True(t, len(diff) == 0, diff)
}

type extendedDaemonSetFromInstanceTestSuite []extendedDaemonSetFromInstanceTest
Expand Down Expand Up @@ -2507,6 +2603,7 @@ func Test_newExtendedDaemonSetFromInstance_CustomVolumes(t *testing.T) {
"app.kubernetes.io/part-of": "foo",
"app.kubernetes.io/version": "",
},
Annotations: map[string]string{},
},
Spec: userMountsPodSpec,
},
Expand Down Expand Up @@ -2569,6 +2666,7 @@ func Test_newExtendedDaemonSetFromInstance_DaemonSetNameAndSelector(t *testing.T
"app.kubernetes.io/version": "",
"app": "datadog-monitoring",
},
Annotations: map[string]string{},
},
Spec: defaultPodSpec(daemonsetNameAgentDeployment),
},
Expand Down Expand Up @@ -2943,6 +3041,16 @@ func Test_newExtendedDaemonSetFromInstance_SystemProbe(t *testing.T) {
OrchestratorExplorerDisabled: true,
})

ddaSeccomp := test.NewDefaultedDatadogAgent("bar", "foo", &test.NewDatadogAgentOptions{
UseEDS: true,
ClusterAgentEnabled: true,
SystemProbeEnabled: true,
OrchestratorExplorerDisabled: true,
SystemProbeSeccompProfileName: "host-profile",
})
edsSeccomp := extendedDaemonSetWithSystemProbe(noSeccompInstallSystemProbeSpec(ddaSeccomp))
edsSeccomp.Spec.Template.Annotations["container.seccomp.security.alpha.kubernetes.io/system-probe"] = "host-profile"

tests := []extendedDaemonSetFromInstanceTest{
{
name: "with default settings",
Expand All @@ -2962,6 +3070,12 @@ func Test_newExtendedDaemonSetFromInstance_SystemProbe(t *testing.T) {
wantErr: false,
want: extendedDaemonSetWithSystemProbe(*systemProbeExtraMountsSpec),
},
{
name: "with on-host seccomp profile",
agentdeployment: ddaSeccomp,
wantErr: false,
want: edsSeccomp,
},
}

for _, test := range tests {
Expand Down
13 changes: 8 additions & 5 deletions controllers/datadogagent/clusteragent_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9,14 +9,13 @@ import (
"github.com/DataDog/datadog-operator/api/v1alpha1/test"
"github.com/DataDog/datadog-operator/controllers/datadogagent/orchestrator"
"github.com/DataDog/datadog-operator/pkg/controller/utils/comparison"
"github.com/DataDog/datadog-operator/pkg/testutils"

"github.com/go-logr/logr"
"github.com/google/go-cmp/cmp"
assert "github.com/stretchr/testify/require"
appsv1 "k8s.io/api/apps/v1"
corev1 "k8s.io/api/core/v1"
v1 "k8s.io/api/core/v1"
apiequality "k8s.io/apimachinery/pkg/api/equality"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/client-go/kubernetes/scheme"
Expand Down Expand Up @@ -200,7 +199,9 @@ func (test clusterAgentDeploymentFromInstanceTest) Run(t *testing.T) {
}
test.want.Annotations["agent.datadoghq.com/agentspechash"] = deploymentSpecHash
}
assert.True(t, apiequality.Semantic.DeepEqual(got, test.want), "newClusterAgentDeploymentFromInstance()\ndiff = %s", cmp.Diff(got, test.want))

diff := testutils.CompareKubeResource(got, test.want)
assert.True(t, len(diff) == 0, diff)
}

type clusterAgentDeploymentFromInstanceTestSuite []clusterAgentDeploymentFromInstanceTest
Expand Down Expand Up @@ -1041,7 +1042,8 @@ func Test_newClusterAgentDeploymentFromInstance_AdmissionController(t *testing.T
Spec: appsv1.DeploymentSpec{
Template: corev1.PodTemplateSpec{
ObjectMeta: metav1.ObjectMeta{
Labels: commonLabels,
Labels: commonLabels,
Annotations: map[string]string{},
},
Spec: admissionControllerPodSpec,
},
Expand Down Expand Up @@ -1073,7 +1075,8 @@ func Test_newClusterAgentDeploymentFromInstance_AdmissionController(t *testing.T
Spec: appsv1.DeploymentSpec{
Template: corev1.PodTemplateSpec{
ObjectMeta: metav1.ObjectMeta{
Labels: commonLabels,
Labels: commonLabels,
Annotations: map[string]string{},
},
Spec: admissionControllerPodSpecCustom,
},
Expand Down
8 changes: 4 additions & 4 deletions controllers/datadogagent/clusterchecksrunner_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,12 +8,11 @@ import (
datadoghqv1alpha1 "github.com/DataDog/datadog-operator/api/v1alpha1"
test "github.com/DataDog/datadog-operator/api/v1alpha1/test"
"github.com/DataDog/datadog-operator/pkg/controller/utils/comparison"
"github.com/DataDog/datadog-operator/pkg/testutils"

"github.com/google/go-cmp/cmp"
assert "github.com/stretchr/testify/require"
appsv1 "k8s.io/api/apps/v1"
corev1 "k8s.io/api/core/v1"
apiequality "k8s.io/apimachinery/pkg/api/equality"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
logf "sigs.k8s.io/controller-runtime/pkg/log"
"sigs.k8s.io/controller-runtime/pkg/log/zap"
Expand Down Expand Up @@ -216,8 +215,9 @@ func (test clusterChecksRunnerDeploymentFromInstanceTest) Run(t *testing.T) {
} else {
assert.NoError(t, err, "newClusterChecksRunnerDeploymentFromInstance() unexpected error: %v", err)
}
assert.True(t, apiequality.Semantic.DeepEqual(got, test.want), "newClusterChecksRunnerDeploymentFromInstance() = %#v, want %#v\ndiff = %s", got, test.want,
cmp.Diff(got, test.want))

diff := testutils.CompareKubeResource(got, test.want)
assert.True(t, len(diff) == 0, diff)
}

func Test_newClusterChecksRunnerDeploymentFromInstance_UserVolumes(t *testing.T) {
Expand Down

0 comments on commit 8b4b796

Please sign in to comment.