Merge pull request #1640 from DelusionalOptimist/unorchestrated-fixes

fix(core): Issues with host policy application
kubearmor · Feb 19, 2024 · c0b8d3d · c0b8d3d
2 parents 1e31e1a + 783c95c
commit c0b8d3d
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 5 deletions.
diff --git a/KubeArmor/core/kubeArmor.go b/KubeArmor/core/kubeArmor.go
@@ -397,6 +397,9 @@ func KubeArmor() {
 		dm.Node.KernelVersion = kl.GetCommandOutputWithoutErr("uname", []string{"-r"})
 		dm.Node.KernelVersion = strings.TrimSuffix(dm.Node.KernelVersion, "\n")
 
+		// add identity for matching node selector
+		dm.Node.Identities = append(dm.Node.Identities, "kubearmor.io/hostname"+"="+dm.Node.NodeName)
+
 		dm.NodeLock.Unlock()
 
 	} else if cfg.GlobalCfg.K8sEnv {

diff --git a/KubeArmor/core/kubeUpdate.go b/KubeArmor/core/kubeUpdate.go
@@ -1461,11 +1461,7 @@ func (dm *KubeArmorDaemon) UpdateHostSecurityPolicies() {
 	secPolicies := []tp.HostSecurityPolicy{}
 
 	for _, policy := range dm.HostSecurityPolicies {
-		if kl.IsK8sEnv() {
-			if kl.MatchIdentities(policy.Spec.NodeSelector.Identities, dm.Node.Identities) {
-				secPolicies = append(secPolicies, policy)
-			}
-		} else { // KubeArmorVM and KVMAgent
+		if kl.MatchIdentities(policy.Spec.NodeSelector.Identities, dm.Node.Identities) {
 			secPolicies = append(secPolicies, policy)
 		}
 	}
@@ -1907,6 +1903,7 @@ func (dm *KubeArmorDaemon) ParseAndUpdateHostSecurityPolicy(event tp.K8sKubeArmo
 		}
 		if !policymatch {
 			dm.Logger.Warnf("Failed to delete security policy. Policy doesn't exist")
+			dm.HostSecurityPoliciesLock.Unlock()
 			return pb.PolicyStatus_NotExist
 		}
 	}