Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added security policy validator in custom controller by [VenkataReddy] #196

Merged
merged 1 commit into from
Jul 20, 2021

Conversation

CBVenkataReddy
Copy link
Contributor

Inside the controllers/kubearmorpolicy_controller.go and controllers/kubearmorhostpolicy_controller.go file we have the function ”Reconcile”, Here the function “Reconcile” act as a security policy validator at the Kubernetes side in order to check syntax and semantics errors. So business logic (below 1 & 2 points) for validating the syntax and semantics errors will be part of “Reconcile” function.
1.check policies already applied in kubernetes at the controller.
2. Update the policy status for valid(OK)/invalid(Not OK),
delete the invalid policy and return the fail code when a new policy is applied and there are some issues in the policy.

Fixes: #104

@nam-jaehyun
Copy link
Collaborator

  1. please update the code on the latest files.
    after we moved out from accuknox, KubeArmor uses security.kubearmor.com instead of security.accuknox.com.
  2. let's say we have controllers for KubeArmorPolicy and KubeArmorHostPolicy.
    how can we deploy those controllers into Kubernetes?
  3. It would be better if you have some screenshots that show how the controllers work.

@nam-jaehyun
Copy link
Collaborator

@CBVenkataReddy how did you generate the YAML files for controllers?

@CBVenkataReddy
Copy link
Contributor Author

@CBVenkataReddy how did you generate the YAML files for controllers?

I have used "kustomize" for customizing the manifests & generating YAML files "kustomize build config/default"

@@ -670,7 +672,7 @@ func (dm *KubeArmorDaemon) WatchSecurityPolicies() {
if policy.Metadata["policyName"] == secPolicy.Metadata["policyName"] &&
policy.Metadata["namespaceName"] == secPolicy.Metadata["namespaceName"] &&
policy.Metadata["generation"] == secPolicy.Metadata["generation"] {
exist = true
//exist = true
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why this line is disabled?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here the condition basically checks weather policy exists or not, if it exists then it continue without applying security policies to containers (UpdateSecurityPolicy).

Controller validates KubeArmrorPolicy schema based on the validation it updates the status,
After controller status updation KubeArmror gets event (MODIFIED) as policy exit condition becomes true and sets "exist = true" and continue back to check another events in infinite loop.

@nam-jaehyun nam-jaehyun marked this pull request as ready for review July 20, 2021 14:51
@nam-jaehyun nam-jaehyun merged commit 39af1b4 into kubearmor:master Jul 20, 2021
@nam-jaehyun nam-jaehyun mentioned this pull request Jul 20, 2021
nam-jaehyun added a commit that referenced this pull request Jul 20, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Need a security policy validator and supporting per-field/rule action/severity
2 participants