Skip to content

kapparmor-0.2.1

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Nov 15:19
kapparmor-0.2.1
3b90b06
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Changelog

All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog,
and this project adheres to Semantic Versioning.

[Unreleased]

  • 🚀 go 1.25
  • Integration tests
    • ✅ Create a new profile
    • ❌ Update an existing profile
    • ✅ Remove an existing profile
    • ✅ Check current confinement state of the app
  • test_on_microk8s.sh - Main test script with:
    ✅ Use helm chart approach
    ✅ Fixed MicroK8s status check
    ✅ Added apparmor to required addons
    ✅ Rebuilds image with --no-cache if missing
    ✅ Adds build-time and gitCommit annotations
    ❌ Skips RBAC
    ✅ Implements two test cases
    ✅ Shows logs and events in readable format
  • Switched to structured logging
  • Added different logging levels
  • Increased test coverage
  • Moved global vars to config struct
  • Removed shared signal channel. Moved to timeout based shutdown through context passing.
  • Removed panics to ensure cleanup and graceful shutdown
  • Liveness and Readiness server
  • Filesystem writing operations protected by a mutex
  • Extensive integration testing bash automation

TODO:

0.2.0 -

CI:

  • Fixed Codecov plugin issues
  • Refresh container image every Sunday night
  • Git auto CRLF set to false git config --global core.autocrlf false
  • Bumped multiple actions
  • Bash CI to automate go version bump from one source of truth (config/config)

Code:

  • golang:1.22 as builder containerfile image
  • The k8s service resource is now settable from the values.yaml
  • Introduced Fuzz testing for profile filenames
  • If POLL_TIME is set less than 1 it will default to 1 second

Project Security Fixes

  • Signed commits: git config commit.gpgsign true
  • Added repository Security policy
  • Added OpenSSF scorecard workflow
  • Least Privileged GitHub Actions Token Permissions: setting minimum token permissions for the GITHUB_TOKEN
  • Pinning actions to full length commit
  • Intergated Harden-Runner in the CI: it prevents exfiltration of credentials, detects tampering of source code during build, and enables running jobs without sudo access.
  • Pinned image tags to digests in Dockerfiles.
  • Closed 44 (!) security issues coming from Scorecard security scanner. Also with the help of stepsecurity.io

0.1.5 - 2023-05-16

0.1.2 - 2023-02-22

Fixed

  • Support for profile names coming after comments and include lines

Added

  • Tested on multiple nodes cluster
  • Base images switched to go 1.20

0.1.1 - 2023-02-13

Fixed

  • Moved shared testing functions to a dedicated module
  • Minor documentation and readme fixes

Added

  • Enforce profiles filenames to be the same as the profile names
  • Changelog automatically read by chart-releaser

0.1.0 - 2023-02-01

Fixed

  1. "Unable to replace profiles. Permission denied, app seems still confined." - Switched to ubuntu image
  2. No need for SYS_ADMIN capabilities
  3. Ignore hidden and system folders while scanning for profiles

Added

  1. Instructions to test the app in a virtual machine directly running the go app or in microk8s pushing the built container to the local registry

0.0.6 - 2023-01-26

Added

Helm:

  • Added SYS_ADMIN capabilities to the daemonset
  • Mounted needed folders in the Dockerfile and in the daemonset
  • Added POLL_TIME and profiles files as configurable options through configmaps

Go:

  • Added first testing function
  • Moved file operations functions to dedicated module
    • Fixed POLL_TIME value passing from configmap

CI/CD:

  • Explicit changelog to help users understanding the project features
    • Automatic generation of release notes based on changelog file
  • Configurable poll time and profiles directory in the helm values file

0.0.5 - 2023-01-23

Added

Helm:

  • Helm Chart based mainly on a DaemonSet and a configmap. No operator needed.
  • Load all AppArmor profiles in the configmap template

Go:

  • Possibility to load continuously the security profiles from a configmap with a configurable poll time

CI/CD:

  • Helm chart linting and testing before releasing
  • Security vulnerability tests on Go dependencies and container file.
  • Auto generation of GitHub pages
  • Container image tag is set to current commit SHA for every release.

Fixed

  • Being still an alpha release I will add everything in the "Added" section

What's Changed

New Contributors

Full Changelog: https://github.com/tuxerrante/kapparmor/commits/kapparmor-0.2.1

Contributors

tuxerrante and step-security-bot
Assets 3
Loading