Tetragon oci hook setup

.gitignore

@@ -5,6 +5,8 @@ lib/*
 /tetragon-bench
 /tetragon-operator
 /tetra
+/tetragon-oci-hook
+/tetragon-oci-hook-setup
 /parsertest
 /checkerpc
 observer.test

Dockerfile

@@ -22,7 +22,7 @@ FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.21.5@sha256:58e14a9334
 WORKDIR /go/src/github.com/cilium/tetragon
 ARG TETRAGON_VERSION TARGETARCH
 COPY . .
-RUN make VERSION=$TETRAGON_VERSION TARGET_ARCH=$TARGETARCH tetragon tetra
+RUN make VERSION=$TETRAGON_VERSION TARGET_ARCH=$TARGETARCH tetragon tetra tetragon-oci-hook tetragon-oci-hook-setup
 
 # Third builder (cross-)compile a stripped gops
 FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.21.5-alpine@sha256:5c1cabd9a3c6851a3e18735a2c133fbd8f67fe37eb3203318b7af2ffd2547095 as gops
@@ -76,6 +76,8 @@ RUN mkdir /var/lib/tetragon/ && \
     apk add --no-cache --update bash
 COPY --from=tetragon-builder /go/src/github.com/cilium/tetragon/tetragon /usr/bin/
 COPY --from=tetragon-builder /go/src/github.com/cilium/tetragon/tetra /usr/bin/
+COPY --from=tetragon-builder /go/src/github.com/cilium/tetragon/contrib/rthooks/tetragon-oci-hook/tetragon-oci-hook /usr/bin/
+COPY --from=tetragon-builder /go/src/github.com/cilium/tetragon/contrib/rthooks/tetragon-oci-hook/tetragon-oci-hook-setup /usr/bin/
 COPY --from=gops /gops/gops /usr/bin/
 COPY --from=bpf-builder /go/src/github.com/cilium/tetragon/bpf/objs/*.o /var/lib/tetragon/
 ENTRYPOINT ["/usr/bin/tetragon"]

Makefile

@@ -85,6 +85,7 @@ ifdef EXTRA_GO_BUILD_FLAGS
 endif
 
 GO_BUILD = CGO_ENABLED=0 GOARCH=$(GOARCH) $(GO) build $(GO_BUILD_FLAGS)
+GO_BUILD_HOOK = CGO_ENABLED=0 GOARCH=$(GOARCH) $(GO) -C contrib/rthooks/tetragon-oci-hook build $(GO_BUILD_FLAGS)
 
 .PHONY: all
 all: tetragon-bpf tetragon tetra generate-flags test-compile tester-progs protoc-gen-go-tetragon tetragon-bench
@@ -179,6 +180,12 @@ tetragon-bench:
 tetragon-operator:
 	$(GO_BUILD) -o $@ ./operator
 
+tetragon-oci-hook:
+	$(GO_BUILD_HOOK) -o $@ ./cmd/hook
+
+tetragon-oci-hook-setup:
+	$(GO_BUILD_HOOK) -o $@ ./cmd/setup
+
 .PHONY: alignchecker
 alignchecker:
 	$(GO) test -c ./pkg/alignchecker -o alignchecker

contrib/rthooks/tetragon-oci-hook/.gitignore

@@ -1 +1,2 @@
 tetragon-oci-hook
+tetragon-oci-hook-setup

contrib/rthooks/tetragon-oci-hook/Makefile

@@ -3,8 +3,28 @@
 
 GO ?= go
 
+all: tetragon-oci-hook tetragon-oci-hook-setup
+
+images: setup-image setup-image-debug
+
+.PHONY: setup-image
+setup-image:
+	docker build . -f dockerfiles/setup -t quay.io/isovalent/tetragon-oci-hook-setup:latest
+
+.PHONY: setup-image-debug
+setup-image-debug:
+	docker build . -f dockerfiles/setup --build-arg BASE_IMAGE=ubuntu -t quay.io/isovalent/tetragon-oci-hook-setup:debug-latest
+
+tetragon-oci-hook-setup: FORCE
+	$(GO) build -o $@ ./cmd/setup
+
+tetragon-oci-hook: FORCE
+	$(GO) build -o $@ ./cmd/hook
+
 .PHONY: vendor
 vendor:
 	$(GO) mod tidy
 	$(GO) mod vendor
 	$(GO) mod verify
+
+FORCE:

contrib/rthooks/tetragon-oci-hook/cmd/setup/main.go

@@ -0,0 +1,170 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright Authors of Tetragon
+
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path"
+	"path/filepath"
+	"time"
+
+	"github.com/alecthomas/kong"
+	ociHooks "github.com/containers/common/pkg/hooks/1.0.0"
+	rspec "github.com/opencontainers/runtime-spec/specs-go"
+	"github.com/sirupsen/logrus"
+)
+
+const (
+	logBaseName = "tetragon-oci-hook.log"
+)
+
+type Install struct {
+	Interface       string `default:"oci-hooks" enum:"oci-hooks" help:"Hooks interface (${enum})"`
+	LocalBinary     string `default:"/usr/bin/tetragon-oci-hook" help:"Source binary path (in the container)"`
+	LocalInstallDir string `required help:"Installation dir (in the container)."`
+	HostInstallDir  string `required help:"Installation dir (in the host). Used for the binary and the hook logfile."`
+
+	OciHooks struct {
+		LocalDir string `default:"/hostHooks" help:"oci-hooks drop-in directory (inside the container)"`
+	} `embed:"" prefix:"oci-hooks."`
+}
+
+func (i *Install) ociHooksInstall(log *logrus.Logger) {
+
+	_, binBaseName := path.Split(i.LocalBinary)
+	binFname := filepath.Join(i.HostInstallDir, binBaseName)
+
+	logFname := filepath.Join(i.HostInstallDir, logBaseName)
+	yes := true
+	hook := ociHooks.Hook{
+		Version: "1.0.0",
+		Hook: rspec.Hook{
+			Path: binFname,
+			Args: []string{
+				binFname,
+				"createContainer",
+				"--log-fname", logFname,
+			},
+			Env:     []string{},
+			Timeout: nil,
+		},
+		When: ociHooks.When{
+			Always:        &yes,
+			Annotations:   map[string]string{},
+			Commands:      []string{},
+			HasBindMounts: nil,
+		},
+		Stages: []string{"createRuntime"},
+	}
+
+	data, err := json.MarshalIndent(&hook, "", "   ")
+	if err != nil {
+		log.WithError(err).Fatal("failed to unmarshall hook info")
+	}
+
+	confDst := filepath.Join(i.OciHooks.LocalDir, fmt.Sprintf("%s.json", binBaseName))
+	if err := os.WriteFile(confDst, data, 0755); err != nil {
+		log.WithField("conf-dst", confDst).WithError(err).Fatal("writing file failed")
+	}
+
+	log.WithFields(logrus.Fields{
+		"conf-dst-path": confDst,
+	}).Info("written conf")
+}
+
+func (i *Install) Run(log *logrus.Logger) error {
+	i.copyBinary(log)
+	switch i.Interface {
+	case "oci-hooks":
+		i.ociHooksInstall(log)
+	default:
+		log.WithField("interface", i.Interface).Fatal("unknown interface")
+	}
+	return nil
+}
+
+func (i *Install) copyBinary(log *logrus.Logger) {
+
+	data, err := os.ReadFile(i.LocalBinary)
+	if err != nil {
+		log.WithField("bin-src-path", i.LocalBinary).WithError(err).Fatal("reading hook source failed")
+	}
+	_, base := path.Split(i.LocalBinary)
+
+	// write to a temp file first, and then do a rename to avoid issues with an existing binary
+	tmpBase := fmt.Sprintf("%s-%s", base, time.Now().Format("20060102.150405000000"))
+	tmpFname := filepath.Join(i.LocalInstallDir, tmpBase)
+	if err = os.WriteFile(tmpFname, data, 0755); err != nil {
+		log.WithField("bin-tmp-path", tmpFname).WithError(err).Fatal("failed to write binary")
+	}
+
+	binDst := filepath.Join(i.LocalInstallDir, base)
+	if err := os.Rename(tmpFname, binDst); err != nil {
+		log.WithFields(logrus.Fields{
+			"bin-tmp-path": tmpFname,
+			"bin-dst-path": binDst,
+		}).WithError(err).Fatal("failed to rename tmp binary to dst")
+	}
+
+	log.WithFields(logrus.Fields{
+		"hook-dst-path": binDst,
+	}).Info("written binary")
+}
+
+type Uninstall struct {
+	Interface       string `default:"oci-hooks" enum:"oci-hooks" help:"Hooks interface (${enum})"`
+	BinaryName      string `default:"tetragon-oci-hook" help:"Binary name"`
+	LocalInstallDir string `required help:"Installation dir (in the container)"`
+
+	OciHooks struct {
+		LocalDir string `default:"/hostHooks" help:"oci-hooks drop-in directory (inside the container)"`
+	} `embed:"" prefix:"oci-hooks."`
+}
+
+func (u *Uninstall) removeBinary(log *logrus.Logger) {
+	binDst := filepath.Join(u.LocalInstallDir, u.BinaryName)
+	if err := os.Remove(binDst); err != nil {
+		log.WithField("bin-dst-path", binDst).WithError(err).Warn("failed to remove binary")
+	} else {
+		log.WithField("bin-dst-path", binDst).WithError(err).Info("binary removed")
+	}
+}
+
+func (u *Uninstall) ociHooksUninstall(log *logrus.Logger) {
+	confDst := filepath.Join(u.OciHooks.LocalDir, fmt.Sprintf("%s.json", u.BinaryName))
+	if err := os.Remove(confDst); err != nil {
+		log.WithField("conf-dst-path", confDst).WithError(err).Warn("failed to remove conf")
+	} else {
+		log.WithField("conf-dst-path", confDst).WithError(err).Info("conf removed")
+	}
+}
+
+func (u *Uninstall) Run(log *logrus.Logger) error {
+	switch u.Interface {
+	case "oci-hooks":
+		u.ociHooksUninstall(log)
+	default:
+		log.WithField("interface", u.Interface).Fatal("unknown interface")
+	}
+	u.removeBinary(log)
+	return nil
+}
+
+type CLI struct {
+	Install   Install   `cmd:"" help:"Install hook"`
+	Uninstall Uninstall `cmd:"" help:"Uninstall hook"`
+}
+
+func main() {
+
+	log := logrus.New()
+
+	var conf CLI
+	ctx := kong.Parse(&conf)
+
+	err := ctx.Run(log)
+	ctx.FatalIfErrorf(err)
+}

contrib/rthooks/tetragon-oci-hook/docs/demo.md

@@ -0,0 +1,63 @@
+This is a dev demo of how to install the teragon OCI hook on a CRI-O runtime.
+
+Note: we should move this to the documentation once the PR is merged and `tetragon-oci-hook` and
+`tetragon-oci-hook-setup` are part of the tetragon development image.
+
+
+Start minikube:
+
+```shell-session
+minikube start --driver=kvm2 --container-runtime=cri-o
+```
+
+Build images and load them to minikube:
+
+```shell-session
+make image image-operator
+minikube image load cilium/tetragon:latest
+minikube image load cilium/tetragon-operator:latest
+minikube image list | grep tetragon
+localhost/cilium/tetragon:latest
+localhost/cilium/tetragon-operator:latest
+```
+
+Install the image enabling the init container:
+
+```
+helm install --namespace kube-system \
+        --set tetragonOperator.image.override=localhost/cilium/tetragon-operator:latest \
+        --set tetragon.image.override=localhost/cilium/tetragon:latest  \
+        --set tetragon.grpc.address="unix:///var/run/cilium/tetragon/tetragon.sock" \
+        --set tetragon.ociHookSetup.enabled=true \
+        tetragon ./install/kubernetes
+...
+kubectl logs -n kube-system tetragon-289tf  -c oci-hook-setup
+time="2023-12-05T09:28:50Z" level=info msg="written binary" hook-dst-path=/hostInstall/tetragon-oci-hook
+time="2023-12-05T09:28:50Z" level=info msg="written conf" conf-dst-path=/hostHooks/tetragon-oci-hook.json
+```
+
+Check the hook looks:
+```
+minikube ssh -- tail -f /opt/tetragon/tetragon-oci-hook.log 
+...
+time="2023-12-05T09:31:08Z" level=info msg="hook request to agent succeeded" hook=create-container ...
+```
+
+You can now uninstall tetragon:
+```
+helm uninstall -n kube-system tetragon
+```
+
+In many situations, you would want the hook to keep running even if tetragon is
+not. Doing so, will allow you to configure a class of pods that can only run if tetragon is availble.
+
+
+To uninstall the hook, you can install the following daemonset:
+```
+kubectl -n  kube-system  apply -f contrib/rthooks/tetragon-oci-hook/k8s/ds-uninstall.yaml
+kubectl -n kube-system logs tetragon-oci-hook-uninstall-8t4bl -c setup
+time="2023-12-05T09:37:37Z" level=info msg="conf removed" conf-dst-path=/hostHooks/tetragon-oci-hook.json error="<nil>"
+time="2023-12-05T09:37:37Z" level=info msg="binary removed" bin-dst-path=/hostInstall/tetragon-oci-hook error="<nil>"
+```
+
+(NB: above is not ideal, we should find a better way to do this)

contrib/rthooks/tetragon-oci-hook/go.mod

@@ -4,8 +4,10 @@ module github.com/cilium/tetragon/contrib/rthooks/tetragon-oci-hook
 go 1.21.0
 
 require (
+	github.com/alecthomas/kong v0.8.1
 	github.com/cilium/lumberjack/v2 v2.3.0
 	github.com/cilium/tetragon/api v0.0.0-00010101000000-000000000000
+	github.com/containers/common v0.57.0
 	github.com/google/cel-go v0.18.2
 	github.com/opencontainers/runc v1.1.10
 	github.com/opencontainers/runtime-spec v1.1.0
@@ -18,15 +20,15 @@ require (
 require (
 	github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
 	github.com/cilium/ebpf v0.7.0 // indirect
-	github.com/coreos/go-systemd/v22 v22.3.2 // indirect
+	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
 	github.com/cyphar/filepath-securejoin v0.2.4 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/godbus/dbus/v5 v5.0.6 // indirect
+	github.com/godbus/dbus/v5 v5.1.0 // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
-	github.com/moby/sys/mountinfo v0.5.0 // indirect
+	github.com/moby/sys/mountinfo v0.7.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/stoewer/go-strcase v1.2.0 // indirect
-	golang.org/x/exp v0.0.0-20230515195305-f3d0a9c9a5cc // indirect
+	golang.org/x/exp v0.0.0-20231006140011-7918f672742d // indirect
 	golang.org/x/net v0.19.0 // indirect
 	golang.org/x/sys v0.15.0 // indirect
 	golang.org/x/text v0.14.0 // indirect