[agent-smith] account for egress traffic

chart/templates/agent-smith-configmap.yaml

@@ -22,12 +22,29 @@ data:
       "blacklists": {
         "very": {
           "signatures": [
-            {"name":"testtarget","domain":"process","kind":"elf","pattern":"YWdlbnRTbWl0aFRlc3RUYXJnZXQ=","regexp":false}
+            {
+              "name": "testtarget",
+              "domain": "process",
+              "kind": "elf",
+              "pattern": "YWdlbnRTbWl0aFRlc3RUYXJnZXQ=",
+              "regexp": false
+            }
           ]
         }
       },
       "pprofAddr": "localhost:6060",
       "prometheusAddr": "localhost:9500",
-      "hostURL": "https://{{ $.Values.hostname }}"
+      "hostURL": "https://{{ $.Values.hostname }}",
+      "egressTraffic": {
+        "dt": "2m",
+        "excessive": {
+          "baseBudget": "300Mi",
+          "perDtThreshold": "100Mi"
+        },
+        "veryExcessive": {
+          "baseBudget": "2Gi",
+          "perDtThreshold": "250Mi"
+        }
+      }
     }
-{{- end -}}
+{{- end -}}

components/ee/agent-smith/BUILD.yaml

@@ -4,6 +4,7 @@ packages:
   - name: app
     type: go
     srcs:
+      - "pkg/agent/testdata/**"
       - "**/*.go"
       - "go.mod"
       - "go.sum"
@@ -59,5 +60,5 @@ scripts:
       - components/ee/agent-smith/cmd/testbed:app
       - components/ee/agent-smith/cmd/testtarget:app
     script: |
-      scp vm ./components-ee-agent-smith--falco-bpf-probe/probe.o ./components-ee-agent-smith--app/agent-smith ./components-ee-agent-smith--example-config/example-config.json ./components-ee-agent-smith-cmd-testbed--app/testbed ./components-ee-agent-smith-cmd-testtarget--app/testtarget root@localhost:/
+      scp -P 2222 -i ~/.ssh/id_rsa_vm -o StrictHostKeyChecking=no vm ./components-ee-agent-smith--falco-bpf-probe/probe.o ./components-ee-agent-smith--app/agent-smith ./components-ee-agent-smith--example-config/example-config.json ./components-ee-agent-smith-cmd-testbed--app/testbed ./components-ee-agent-smith-cmd-testtarget--app/testtarget root@localhost:/
       echo "copied agent-smith to /"

components/ee/agent-smith/README.md

@@ -43,6 +43,12 @@ ssh vm
 
 If you now go under the `/workspace` folder in the VM, you will find all your workspace stuff.
 
+If you want to compile with leeway and have the compiled artifacts in the VM you can do
+
+```
+leeway run components/ee/agent-smith:copy-to-qemu
+```
+
 ## Falco libs BPF probe development
 
 In case you need to do development of new features or fix bugs against the

components/ee/agent-smith/cmd/run.go

@@ -5,6 +5,7 @@
 package cmd
 
 import (
+	"context"
 	"fmt"
 	"net/http"
 	"os"
@@ -61,7 +62,11 @@ var runCmd = &cobra.Command{
 			log.WithError(err).Fatal("cannot register metrics")
 		}
 
-		go smith.Start(func(violation agent.InfringingWorkspace, penalties []agent.PenaltyKind) {
+		ctx := context.Background()
+		ctx, cancel := context.WithCancel(ctx)
+		defer cancel()
+
+		go smith.Start(ctx, func(violation agent.InfringingWorkspace, penalties []agent.PenaltyKind) {
 			log.WithField("violation", violation).WithField("penalties", penalties).Info("Found violation")
 
 			if cfg.SlackWebhooks != nil {
@@ -94,7 +99,13 @@ var runCmd = &cobra.Command{
 
 		sigChan := make(chan os.Signal, 1)
 		signal.Notify(sigChan, os.Interrupt, syscall.SIGTERM)
-		<-sigChan
+
+		select {
+		case <-ctx.Done():
+			return
+		case <-sigChan:
+			return
+		}
 	},
 }
 

components/ee/agent-smith/example-config.json

@@ -3,10 +3,26 @@
     "probePath": "./probe.o",
     "blacklists": {
         "very": {
-            "binaries": ["find"],
             "signatures": [
-                {"name":"testtarget","domain":"process","kind":"elf","pattern":"YWdlbnRTbWl0aFRlc3RUYXJnZXQ=","regexp":false}
+                {
+                    "name": "testtarget",
+                    "domain": "process",
+                    "kind": "elf",
+                    "pattern": "YWdlbnRTbWl0aFRlc3RUYXJnZXQ=",
+                    "regexp": false
+                }
             ]
         }
+    },
+    "egressTraffic": {
+        "dt": "2m",
+        "excessive": {
+            "baseBudget": "300Mi",
+            "perDtThreshold": "100Mi"
+        },
+        "veryExcessive": {
+            "baseBudget": "2Gi",
+            "perDtThreshold": "250Mi"
+        }
     }
-}
+}