fix(improvements): Improve the usability of karmor probe by detailing… #362
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
… error messages
The following error may occur when executing "karmor probe".
```
> karmor probe
probe.go:380: error when getting kubearmor daemonset Get "http://localhost:8080/apis/apps/v1/namespaces/kube-system/daemonsets/kubearmor": dial tcp 127.0.0.1:8080: connect: connection refused
Didn't find KubeArmor in systemd or Kubernetes, probing for support for KubeArmor
Host:
Observability/Audit: Supported (Kernel Version 5.15.0)
Enforcement: Full (Supported LSMs: lockdown,capability,landlock,yama,apparmor)
To get full probe, a daemonset will be deployed in your cluster - This daemonset will be deleted after probing
Use --full tag to get full probing
```
When "karmor probe" is executed, "systemctl status kubearmor" is executed
internally, but the systemctl command may require sudo. In this case,
without sudo, an error occurs.
In this commit, to make it easier to understand the root cause of such an
error, error messages have been modified to be more detailed.
Signed-off-by: Hayato Kiwata <haytok@amazon.co.jp>
|
@haytok 🤔I don't think we should handle it this way, as whenever someone will run karmor probe for k8s it will log this error. WDYT? |
daemon1024
reviewed
Nov 8, 2023
| if err != nil { | ||
| log.Println("systemctl status kubearmor cannot be executed:", string(out)) |
There was a problem hiding this comment.
We should refactor the function to return error, and use Cobra Error handler to capture the errors. That way we will not show the error incase we find KubeArmor in kubernetes
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
… error messages
When KubeArmor is running in
systemd mode, the following error may occur when executing "karmor probe".When "karmor probe" is executed, "systemctl status kubearmor" is executed internally, but the systemctl command may require sudo. In this case, without sudo, an error occurs.
In this commit, to make it easier to understand the root cause of such an error, error messages have been modified to be more detailed.