get hardening policies for `replicasets`, `statefulsets` & `daemonsets` #681

Prateeknandle · 2023-03-09T11:41:13Z

fixes #670

changes:

getting replicasets, daemonsets and statefulsets from k8s client and generating hardening policies respectively
updating clusterRole for the same
added test cases to test whether we get the hardening policy or not

vishnusomank · 2023-03-09T15:20:23Z

LGTM!

@Prateeknandle Can we update the helm chart as well to match the ClusterRole ?

Prateeknandle · 2023-03-09T16:18:39Z

@Prateeknandle Can we update the helm chart as well to match the ClusterRole ?

updated

seswarrajan

LGTM

Prateeknandle · 2023-03-10T07:39:45Z

can we merge the pr?

nyrahul · 2023-03-10T07:41:20Z

can we merge the pr?

The test is failing!

nyrahul · 2023-03-10T07:42:05Z

Can we add a testcase to test this?

Prateeknandle · 2023-03-10T14:05:18Z

Can we add a testcase to test this?

tests for recommend are defined in kubearmor-client

The test is failing!

it's because the tests are flaky

For testing whether changes are working or not we can see logs

vishnusomank

LGTM!

Tested by deploying via deployment.yaml and helm. The code changes are able to detect and generate policies for Statefulset and Replicaset.
Only issue is if a new replicaset or statefulset is deployed we'll have to wait for the cronjob to trigger (every 1 hour) to get hardening policies for those.

Prateeknandle · 2023-03-22T01:25:09Z

With the new changes I've checked locally, tests are passing and discovery-engine is able to get the hardening policies.

the ginkgo test which are failing are the flaky ones and not related to this pr.

src/recommendpolicy/recommendPolicy.go

tests/recommend/recommned_test.go

src/recommendpolicy/recommendPolicy.go

Ankurk99 · 2023-04-17T18:32:20Z

Hey @Prateeknandle, Can you please resolve the conflicts in the PR?

Signed-off-by: Prateeknandle <prateeknandle@gmail.com>

- add check for owner reference in case of deployment and statefulsets - show downloaded policy-template version Signed-off-by: Ankur Kothiwal <ankur.kothiwal99@gmail.com>

vishnusomank

I think we should handle daemonsets as well in this. @Ankurk99 what do you think?

seswarrajan

LGTM

nyrahul

Mostly good. Just one small fix.

src/recommendpolicy/recommendPolicy.go

Signed-off-by: Ankur Kothiwal <ankur.kothiwal99@gmail.com>

nyrahul · 2023-04-25T01:47:46Z

@vishnusomank , can you provide your approval?

Vyom-Yadav · 2023-04-25T19:57:38Z

src/recommendpolicy/recommendPolicy.go

+		for _, ns := range nsNotFilter {
 			if d.Namespace != ns {
 				generateHardenPolicy(d.Name, d.Namespace, d.Spec.Template.Labels)


We are already generating policies for Deployments here. Why are we generating them again at line 150? It should be in a single place only.

Vyom-Yadav · 2023-04-25T20:01:52Z

src/recommendpolicy/recommendPolicy.go

+	if !isLatest() {
+		version, err := DownloadAndUnzipRelease()
+		if err != nil {
+			log.Error().Msgf("Unable to download %v", err.Error())
+			return nil
+		}
+		log.Info().Msgf("Downloaded version: %v", version)
+	}


This should not be clubbed with GetHardenPolicy(...). Downloading and unzipping release is a separate process. Policy templates are required for both KubeArmor and Kyverno policies.

Prateeknandle requested a review from vishnusomank March 9, 2023 11:41

Prateeknandle changed the title ~~Get hardening pol~~ [Bug] get hardening policies for replicasets & statefulsets Mar 9, 2023

vishnusomank requested review from nyrahul and seswarrajan March 9, 2023 15:17

Prateeknandle force-pushed the get_hardening_pol branch from 8993438 to 8a73faf Compare March 9, 2023 16:01

seswarrajan approved these changes Mar 9, 2023

View reviewed changes

vishnusomank approved these changes Mar 20, 2023

View reviewed changes

Prateeknandle force-pushed the get_hardening_pol branch from ae1736f to a6a5df4 Compare March 22, 2023 01:04

Prateeknandle requested a review from vishnusomank March 22, 2023 01:23

vishnusomank reviewed Mar 22, 2023

View reviewed changes

src/recommendpolicy/recommendPolicy.go Outdated Show resolved Hide resolved

vishnusomank reviewed Mar 22, 2023

View reviewed changes

src/recommendpolicy/recommendPolicy.go Outdated Show resolved Hide resolved

vishnusomank reviewed Mar 22, 2023

View reviewed changes

src/recommendpolicy/recommendPolicy.go Outdated Show resolved Hide resolved

vishnusomank reviewed Mar 22, 2023

View reviewed changes

src/recommendpolicy/recommendPolicy.go Outdated Show resolved Hide resolved

vishnusomank reviewed Mar 22, 2023

View reviewed changes

src/recommendpolicy/recommendPolicy.go Show resolved Hide resolved

Prateeknandle requested review from vishnusomank and seswarrajan March 22, 2023 08:37

vishnusomank reviewed Mar 22, 2023

View reviewed changes

src/recommendpolicy/recommendPolicy.go Show resolved Hide resolved

vishnusomank reviewed Mar 22, 2023

View reviewed changes

tests/recommend/recommned_test.go Outdated Show resolved Hide resolved

Prateeknandle requested a review from vishnusomank March 22, 2023 18:16

Prateeknandle force-pushed the get_hardening_pol branch from c345399 to 919e647 Compare March 22, 2023 18:26

vishnusomank reviewed Mar 23, 2023

View reviewed changes

tests/recommend/recommned_test.go Show resolved Hide resolved

Prateeknandle force-pushed the get_hardening_pol branch from dbdac38 to 8a421ea Compare March 23, 2023 10:57

vishnusomank approved these changes Mar 23, 2023

View reviewed changes

Prateeknandle force-pushed the get_hardening_pol branch from fd79fbe to fd99cda Compare March 23, 2023 14:28

vishnusomank reviewed Mar 23, 2023

View reviewed changes

src/recommendpolicy/recommendPolicy.go Outdated Show resolved Hide resolved

Prateeknandle force-pushed the get_hardening_pol branch from 71990f3 to 01cecdb Compare March 23, 2023 16:42

Prateeknandle changed the title ~~[Bug] get hardening policies for replicasets & statefulsets~~ get hardening policies for replicasets & statefulsets Mar 23, 2023

nyrahul requested changes Mar 24, 2023

View reviewed changes

src/recommendpolicy/recommendPolicy.go Outdated Show resolved Hide resolved

Prateeknandle requested a review from nyrahul March 24, 2023 13:45

vishnusomank requested changes Mar 24, 2023

View reviewed changes

src/recommendpolicy/recommendPolicy.go Outdated Show resolved Hide resolved

nyrahul requested changes Mar 26, 2023

View reviewed changes

src/recommendpolicy/recommendPolicy.go Outdated Show resolved Hide resolved

src/recommendpolicy/recommendPolicy.go Show resolved Hide resolved

src/recommendpolicy/recommendPolicy.go Show resolved Hide resolved

Prateeknandle force-pushed the get_hardening_pol branch from c97d3c3 to 91d00cd Compare April 18, 2023 09:57

generating policy for replica-set & statefulset

1e57f0e

Signed-off-by: Prateeknandle <prateeknandle@gmail.com>

Prateeknandle force-pushed the get_hardening_pol branch from 28f53d6 to 1e57f0e Compare April 18, 2023 13:24

Prateeknandle and others added 2 commits April 18, 2023 18:58

resolving conflicts

86545c7

Signed-off-by: Prateeknandle <prateeknandle@gmail.com>

address review comments

e0a2154

- add check for owner reference in case of deployment and statefulsets - show downloaded policy-template version Signed-off-by: Ankur Kothiwal <ankur.kothiwal99@gmail.com>

Ankurk99 force-pushed the get_hardening_pol branch from c46d1f3 to e0a2154 Compare April 20, 2023 06:03

Ankurk99 requested review from vishnusomank and nyrahul April 20, 2023 06:03

vishnusomank reviewed Apr 20, 2023

View reviewed changes

Ankurk99 changed the title ~~get hardening policies for replicasets & statefulsets~~ get hardening policies for replicasets, statefulsets & daemonsets Apr 20, 2023

seswarrajan approved these changes Apr 24, 2023

View reviewed changes

nyrahul approved these changes Apr 24, 2023

View reviewed changes

src/recommendpolicy/recommendPolicy.go Outdated Show resolved Hide resolved

add support for daemonsets

70e362b

Signed-off-by: Ankur Kothiwal <ankur.kothiwal99@gmail.com>

Ankurk99 force-pushed the get_hardening_pol branch from 4996f12 to 70e362b Compare April 24, 2023 15:16

Ankurk99 requested a review from vishnusomank April 24, 2023 15:16

nyrahul approved these changes Apr 25, 2023

View reviewed changes

vishnusomank approved these changes Apr 25, 2023

View reviewed changes

nyrahul merged commit 4dfdcd1 into accuknox:dev Apr 25, 2023
5 of 6 checks passed

Vyom-Yadav reviewed Apr 25, 2023

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

get hardening policies for `replicasets`, `statefulsets` & `daemonsets` #681

get hardening policies for `replicasets`, `statefulsets` & `daemonsets` #681

Prateeknandle commented Mar 9, 2023 •

edited by Ankurk99

vishnusomank commented Mar 9, 2023

Prateeknandle commented Mar 9, 2023

seswarrajan left a comment

Prateeknandle commented Mar 10, 2023

nyrahul commented Mar 10, 2023

nyrahul commented Mar 10, 2023

Prateeknandle commented Mar 10, 2023 •

edited

vishnusomank left a comment

Prateeknandle commented Mar 22, 2023 •

edited

Ankurk99 commented Apr 17, 2023

vishnusomank left a comment

seswarrajan left a comment

nyrahul left a comment

nyrahul commented Apr 25, 2023

Vyom-Yadav Apr 25, 2023

Vyom-Yadav Apr 25, 2023

get hardening policies for replicasets, statefulsets & daemonsets #681

get hardening policies for replicasets, statefulsets & daemonsets #681

Conversation

Prateeknandle commented Mar 9, 2023 • edited by Ankurk99

vishnusomank commented Mar 9, 2023

Prateeknandle commented Mar 9, 2023

seswarrajan left a comment

Choose a reason for hiding this comment

Prateeknandle commented Mar 10, 2023

nyrahul commented Mar 10, 2023

nyrahul commented Mar 10, 2023

Prateeknandle commented Mar 10, 2023 • edited

vishnusomank left a comment

Choose a reason for hiding this comment

Prateeknandle commented Mar 22, 2023 • edited

Ankurk99 commented Apr 17, 2023

vishnusomank left a comment

Choose a reason for hiding this comment

seswarrajan left a comment

Choose a reason for hiding this comment

nyrahul left a comment

Choose a reason for hiding this comment

nyrahul commented Apr 25, 2023

Vyom-Yadav Apr 25, 2023

Choose a reason for hiding this comment

Vyom-Yadav Apr 25, 2023

Choose a reason for hiding this comment

get hardening policies for `replicasets`, `statefulsets` & `daemonsets` #681

get hardening policies for `replicasets`, `statefulsets` & `daemonsets` #681

Prateeknandle commented Mar 9, 2023 •

edited by Ankurk99

Prateeknandle commented Mar 10, 2023 •

edited

Prateeknandle commented Mar 22, 2023 •

edited