From 116febf6738f4a29e58be70f0c3391c71f3e4555 Mon Sep 17 00:00:00 2001 From: Massimo Zerbini Date: Mon, 9 Mar 2020 16:08:48 +0100 Subject: [PATCH 01/15] new image analyzer k8s scripts added --- .../sysdig-image-analyzer-configmap.yaml | 7 + .../sysdig-image-analyzer-daemonset-v1.yaml | 135 ++++++++++++++++++ 2 files changed, 142 insertions(+) create mode 100644 agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml create mode 100644 agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml diff --git a/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml b/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml new file mode 100644 index 00000000..d2c19643 --- /dev/null +++ b/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: sysdig-image-analyzer +data: + debug: "true" + collector_endpoint: "https://collector-staging3.sysdigcloud.com/internal/scanning/scanning-analysis-collector" \ No newline at end of file diff --git a/agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml b/agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml new file mode 100644 index 00000000..df50db66 --- /dev/null +++ b/agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml @@ -0,0 +1,135 @@ +# apiVersion: extensions/v1beta1 # If you are in Kubernetes version 1.8 or less please use this line instead of the following one +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: sysdig-image-analyzer + labels: + app: sysdig-image-analyzer +spec: + selector: + matchLabels: + app: sysdig-image-analyzer + updateStrategy: + type: RollingUpdate + template: + metadata: + labels: + app: sysdig-image-analyzer + spec: + volumes: + # Needed for cri-o image inspection + - name: etccontainers-vol + hostPath: + path: /etc/containers + # Needed for cri-o image inspection + - name: varlibcontainers-vol + hostPath: + path: /var/lib/containers + # Needed for socket access + - name: varrun-vol + hostPath: + path: /var/run + - name: sysdig-image-analyzer-config + configMap: + name: sysdig-image-analyzer + optional: true + tolerations: + - effect: NoSchedule + key: node-role.kubernetes.io/master + # The following line is necessary for RBAC + serviceAccount: sysdig-agent + terminationGracePeriodSeconds: 5 + imagePullSecrets: + - name: artifactory + containers: + - name: sysdig-image-analyzer + # TODO change image repo with Docker Hub + image: docker.internal.sysdig.com/image-analyzer:dev + securityContext: + # needed for the CRI socket + privileged: true + imagePullPolicy: Always + resources: + limits: + cpu: 0.5 + memory: 1024Mi + volumeMounts: + - mountPath: /var/run + name: varrun-vol + - mountPath: /etc/containers + name: etccontainers-vol + readOnly: true + - mountPath: /var/lib/containers + name: varlibcontainers-vol + env: + - name: ACCESS_KEY + valueFrom: + secretKeyRef: + name: sysdig-agent + key: access-key + - name: IA_IMAGE_PERIOD + valueFrom: + configMapKeyRef: + name: sysdig-image-analyzer + key: image_period + optional: true + - name: IA_IMAGE_CACHE_TTL + valueFrom: + configMapKeyRef: + name: sysdig-image-analyzer + key: image_cache_ttl + optional: true + - name: IA_REPORT_PERIOD + valueFrom: + configMapKeyRef: + name: sysdig-image-analyzer + key: report_period + optional: true + - name: DOCKER_SOCKET_PATH + valueFrom: + configMapKeyRef: + name: sysdig-image-analyzer + key: docker_socket_path + optional: true + - name: CRI_SOCKET_PATH + valueFrom: + configMapKeyRef: + name: sysdig-image-analyzer + key: cri_socket_path + optional: true + - name: AM_COLLECTOR_ENDPOINT + valueFrom: + configMapKeyRef: + name: sysdig-image-analyzer + key: collector_endpoint + optional: true + - name: AM_COLLECTOR_TIMEOUT + valueFrom: + configMapKeyRef: + name: sysdig-image-analyzer + key: collector_timeout + optional: true + - name: CHECK_CERTIFICATE + valueFrom: + configMapKeyRef: + name: sysdig-image-analyzer + key: check_certificate + optional: true + - name: K8S_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + - name: K8S_POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: K8S_POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: DEBUG + valueFrom: + configMapKeyRef: + name: sysdig-image-analyzer + key: debug + optional: true From d7937c2bb9667b31afc6cc88c439b35ec2bf195c Mon Sep 17 00:00:00 2001 From: Massimo Zerbini Date: Tue, 10 Mar 2020 11:04:02 +0100 Subject: [PATCH 02/15] Image Analyzer config map updated --- agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml b/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml index d2c19643..2536c31f 100644 --- a/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml +++ b/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml @@ -3,5 +3,4 @@ kind: ConfigMap metadata: name: sysdig-image-analyzer data: - debug: "true" - collector_endpoint: "https://collector-staging3.sysdigcloud.com/internal/scanning/scanning-analysis-collector" \ No newline at end of file + debug: "true" \ No newline at end of file From 77e2765b4ef5252c2a5f82bf65c88b6d14e20670 Mon Sep 17 00:00:00 2001 From: Massimo Zerbini Date: Tue, 10 Mar 2020 12:14:41 +0100 Subject: [PATCH 03/15] Image Analyzer daemonset updated --- .../sysdig-image-analyzer-daemonset-v1.yaml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml b/agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml index df50db66..01e2b82c 100644 --- a/agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml +++ b/agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml @@ -53,14 +53,6 @@ spec: limits: cpu: 0.5 memory: 1024Mi - volumeMounts: - - mountPath: /var/run - name: varrun-vol - - mountPath: /etc/containers - name: etccontainers-vol - readOnly: true - - mountPath: /var/lib/containers - name: varlibcontainers-vol env: - name: ACCESS_KEY valueFrom: @@ -133,3 +125,11 @@ spec: name: sysdig-image-analyzer key: debug optional: true + volumeMounts: + - mountPath: /var/run + name: varrun-vol + - mountPath: /etc/containers + name: etccontainers-vol + readOnly: true + - mountPath: /var/lib/containers + name: varlibcontainers-vol From 949dbab6dd38e84cf64c997b0e4f53d623961da1 Mon Sep 17 00:00:00 2001 From: Massimo Zerbini Date: Tue, 10 Mar 2020 16:50:29 +0100 Subject: [PATCH 04/15] Image Analyzer daemonset: comments added --- agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml b/agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml index 01e2b82c..a9feb224 100644 --- a/agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml +++ b/agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml @@ -29,6 +29,7 @@ spec: - name: varrun-vol hostPath: path: /var/run + # Add custom volume here - name: sysdig-image-analyzer-config configMap: name: sysdig-image-analyzer @@ -133,3 +134,4 @@ spec: readOnly: true - mountPath: /var/lib/containers name: varlibcontainers-vol + # Add custom volume mount here From f121a79f9858755e4e2e8b48351329a6fc4d2ded Mon Sep 17 00:00:00 2001 From: Massimo Zerbini Date: Thu, 12 Mar 2020 15:55:53 +0100 Subject: [PATCH 05/15] new line added --- agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml b/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml index 2536c31f..3b0e9349 100644 --- a/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml +++ b/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml @@ -3,4 +3,5 @@ kind: ConfigMap metadata: name: sysdig-image-analyzer data: - debug: "true" \ No newline at end of file + debug: "true" + \ No newline at end of file From 3aa8df979780a4cdabec4455f7e239a1ff732dc2 Mon Sep 17 00:00:00 2001 From: Massimo Zerbini Date: Thu, 12 Mar 2020 15:59:11 +0100 Subject: [PATCH 06/15] new line added --- agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml b/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml index 3b0e9349..5626fb8b 100644 --- a/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml +++ b/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml @@ -4,4 +4,3 @@ metadata: name: sysdig-image-analyzer data: debug: "true" - \ No newline at end of file From 16ca9d099bbf4fe762125f9301763034df050d26 Mon Sep 17 00:00:00 2001 From: Massimo Zerbini Date: Thu, 12 Mar 2020 16:01:30 +0100 Subject: [PATCH 07/15] comment added --- agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml b/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml index 5626fb8b..45e3201b 100644 --- a/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml +++ b/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml @@ -4,3 +4,4 @@ metadata: name: sysdig-image-analyzer data: debug: "true" + # Add data here From 01d75129c8a54d0d4cfda4f22b5a240849f3b008 Mon Sep 17 00:00:00 2001 From: Massimo Zerbini Date: Thu, 12 Mar 2020 16:06:00 +0100 Subject: [PATCH 08/15] raw refresh --- agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml b/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml index 45e3201b..69270720 100644 --- a/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml +++ b/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml @@ -4,4 +4,4 @@ metadata: name: sysdig-image-analyzer data: debug: "true" - # Add data here + # Add data parametrs here From 01915719784ebe9a1f0b6f725d7df23855129420 Mon Sep 17 00:00:00 2001 From: Massimo Zerbini Date: Tue, 17 Mar 2020 10:49:09 +0100 Subject: [PATCH 09/15] image analyzer daemonset updated --- .../sysdig-image-analyzer-configmap.yaml | 2 +- .../sysdig-image-analyzer-daemonset-v1.yaml | 43 +++++++++++-------- 2 files changed, 26 insertions(+), 19 deletions(-) diff --git a/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml b/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml index 69270720..e5f84a13 100644 --- a/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml +++ b/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml @@ -3,5 +3,5 @@ kind: ConfigMap metadata: name: sysdig-image-analyzer data: - debug: "true" + debug: "false" # Add data parametrs here diff --git a/agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml b/agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml index a9feb224..94cc87f6 100644 --- a/agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml +++ b/agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml @@ -17,11 +17,16 @@ spec: app: sysdig-image-analyzer spec: volumes: - # Needed for cri-o image inspection - - name: etccontainers-vol + # Needed for cri-o image inspection. + # cri-o and especially OCP 4.x by default use containers/storage to handle images, and this makes sure that the + # analyzer has access to the configuration. This file is mounted read-only. + - name: etccontainersstorage-vol hostPath: - path: /etc/containers - # Needed for cri-o image inspection + path: /etc/containers/storage.conf + # Needed for cri-o image inspection. + # This is the directory where image data is stored by default when using cri-o and OCP 4.x and the analyzer + # uses it to get the data to scan. This directory must be mounted r/w because proper access to its files through + # the containers/storage library is always regulated with a lockfile. - name: varlibcontainers-vol hostPath: path: /var/lib/containers @@ -44,7 +49,6 @@ spec: - name: artifactory containers: - name: sysdig-image-analyzer - # TODO change image repo with Docker Hub image: docker.internal.sysdig.com/image-analyzer:dev securityContext: # needed for the CRI socket @@ -52,27 +56,39 @@ spec: imagePullPolicy: Always resources: limits: - cpu: 0.5 + cpu: 500m memory: 1024Mi + requests: + cpu: 250m + memory: 512Mi + volumeMounts: + - mountPath: /var/run + name: varrun-vol + - mountPath: /etc/containers/storage.conf + name: etccontainersstorage-vol + readOnly: true + - mountPath: /var/lib/containers + name: varlibcontainers-vol + # Add custom volume mount here env: - name: ACCESS_KEY valueFrom: secretKeyRef: name: sysdig-agent key: access-key - - name: IA_IMAGE_PERIOD + - name: IMAGE_PERIOD valueFrom: configMapKeyRef: name: sysdig-image-analyzer key: image_period optional: true - - name: IA_IMAGE_CACHE_TTL + - name: IMAGE_CACHE_TTL valueFrom: configMapKeyRef: name: sysdig-image-analyzer key: image_cache_ttl optional: true - - name: IA_REPORT_PERIOD + - name: REPORT_PERIOD valueFrom: configMapKeyRef: name: sysdig-image-analyzer @@ -126,12 +142,3 @@ spec: name: sysdig-image-analyzer key: debug optional: true - volumeMounts: - - mountPath: /var/run - name: varrun-vol - - mountPath: /etc/containers - name: etccontainers-vol - readOnly: true - - mountPath: /var/lib/containers - name: varlibcontainers-vol - # Add custom volume mount here From cd46f3b7f7aaf25bbdca4bb8f50532562c65ee60 Mon Sep 17 00:00:00 2001 From: Massimo Zerbini Date: Tue, 17 Mar 2020 16:36:56 +0100 Subject: [PATCH 10/15] image repo changed --- agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml b/agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml index 94cc87f6..107bf556 100644 --- a/agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml +++ b/agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml @@ -49,7 +49,7 @@ spec: - name: artifactory containers: - name: sysdig-image-analyzer - image: docker.internal.sysdig.com/image-analyzer:dev + image: docker.io/sysdig/node-image-analyzer:latest securityContext: # needed for the CRI socket privileged: true From 7038881e61e4c9c4ab3ea0cd60d159809b2f7fc5 Mon Sep 17 00:00:00 2001 From: Massimo Zerbini Date: Wed, 18 Mar 2020 16:16:31 +0100 Subject: [PATCH 11/15] imagePullSecrets removed --- agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml b/agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml index 107bf556..b20903dd 100644 --- a/agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml +++ b/agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml @@ -45,8 +45,6 @@ spec: # The following line is necessary for RBAC serviceAccount: sysdig-agent terminationGracePeriodSeconds: 5 - imagePullSecrets: - - name: artifactory containers: - name: sysdig-image-analyzer image: docker.io/sysdig/node-image-analyzer:latest From 96e8e4838cd96ae1530126bcfce42e6779616477 Mon Sep 17 00:00:00 2001 From: Massimo Zerbini Date: Wed, 18 Mar 2020 16:48:02 +0100 Subject: [PATCH 12/15] fix spelling --- agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml b/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml index e5f84a13..a5f5aa38 100644 --- a/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml +++ b/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml @@ -4,4 +4,4 @@ metadata: name: sysdig-image-analyzer data: debug: "false" - # Add data parametrs here + # Add data parameters here From c7604e173e6be4ff2b7b6ac446057ac2adfdf04a Mon Sep 17 00:00:00 2001 From: Luca Guerra Date: Thu, 19 Mar 2020 10:55:26 +0100 Subject: [PATCH 13/15] image analyzer: improve volume and comments readability --- .../sysdig-image-analyzer-daemonset-v1.yaml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml b/agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml index b20903dd..6d151bb5 100644 --- a/agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml +++ b/agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml @@ -20,14 +20,14 @@ spec: # Needed for cri-o image inspection. # cri-o and especially OCP 4.x by default use containers/storage to handle images, and this makes sure that the # analyzer has access to the configuration. This file is mounted read-only. - - name: etccontainersstorage-vol + - name: etc-containers-storage-vol hostPath: path: /etc/containers/storage.conf # Needed for cri-o image inspection. # This is the directory where image data is stored by default when using cri-o and OCP 4.x and the analyzer # uses it to get the data to scan. This directory must be mounted r/w because proper access to its files through # the containers/storage library is always regulated with a lockfile. - - name: varlibcontainers-vol + - name: var-lib-containers-vol hostPath: path: /var/lib/containers # Needed for socket access @@ -49,7 +49,8 @@ spec: - name: sysdig-image-analyzer image: docker.io/sysdig/node-image-analyzer:latest securityContext: - # needed for the CRI socket + # The privileged flag is necessary for OCP 4.x and other Kubernetes setups that deny host filesystem access to + # running containers by default regardless of volume mounts. In those cases, access to the CRI socket would fail. privileged: true imagePullPolicy: Always resources: @@ -63,10 +64,10 @@ spec: - mountPath: /var/run name: varrun-vol - mountPath: /etc/containers/storage.conf - name: etccontainersstorage-vol + name: etc-containers-storage-vol readOnly: true - mountPath: /var/lib/containers - name: varlibcontainers-vol + name: var-lib-containers-vol # Add custom volume mount here env: - name: ACCESS_KEY From b50c32cb9e591ccf950a324b988258ad75dfd8bb Mon Sep 17 00:00:00 2001 From: Luca Guerra Date: Thu, 19 Mar 2020 10:56:19 +0100 Subject: [PATCH 14/15] image analyzer: rename daemonset-v1 -> daemonset --- ...zer-daemonset-v1.yaml => sysdig-image-analyzer-daemonset.yaml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename agent_deploy/kubernetes/{sysdig-image-analyzer-daemonset-v1.yaml => sysdig-image-analyzer-daemonset.yaml} (100%) diff --git a/agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml b/agent_deploy/kubernetes/sysdig-image-analyzer-daemonset.yaml similarity index 100% rename from agent_deploy/kubernetes/sysdig-image-analyzer-daemonset-v1.yaml rename to agent_deploy/kubernetes/sysdig-image-analyzer-daemonset.yaml From 63595f2b54fb1c5cebd6b73c7f076e678b59a1e2 Mon Sep 17 00:00:00 2001 From: Massimo Zerbini Date: Thu, 19 Mar 2020 19:30:30 +0100 Subject: [PATCH 15/15] comment removed --- agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml b/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml index a5f5aa38..a8ae68bf 100644 --- a/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml +++ b/agent_deploy/kubernetes/sysdig-image-analyzer-configmap.yaml @@ -4,4 +4,3 @@ metadata: name: sysdig-image-analyzer data: debug: "false" - # Add data parameters here