Skip to content

Commit 5cb924f

Browse files
JaydipGabaniritazh
JaydipGabani
and
ritazh
authored
feat: adding driver to export to disk (#3832)
Signed-off-by: Jaydip Gabani <gabanijaydip@gmail.com> Co-authored-by: Rita Zhang <rita.z.zhang@gmail.com>
1 parent 1484d9c commit 5cb924f

26 files changed

+1899
-101
lines changed

‎.github/dependabot.yml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,3 +63,17 @@ updates:
6363
interval: "weekly"
6464
commit-message:
6565
prefix: "chore"
66+
67+
- package-ecosystem: "docker"
68+
directory: "/test/export/fake-subscriber"
69+
schedule:
70+
interval: "weekly"
71+
commit-message:
72+
prefix: "chore"
73+
74+
- package-ecosystem: "docker"
75+
directory: "/test/export/fake-reader"
76+
schedule:
77+
interval: "weekly"
78+
commit-message:
79+
prefix: "chore"

‎.github/workflows/dapr-export.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,8 +50,8 @@ jobs:
5050
kind load docker-image --name kind gatekeeper-e2e:latest gatekeeper-crds:latest
5151
kubectl create ns gatekeeper-system
5252
make e2e-publisher-deploy
53-
make e2e-helm-deploy HELM_REPO=gatekeeper-e2e HELM_CRD_REPO=gatekeeper-crds HELM_RELEASE=latest ENABLE_EXPORT=true LOG_LEVEL=DEBUG
54-
make test-e2e ENABLE_EXPORT_TESTS=1
53+
make e2e-helm-deploy HELM_REPO=gatekeeper-e2e HELM_CRD_REPO=gatekeeper-crds HELM_RELEASE=latest ENABLE_EXPORT=true LOG_LEVEL=DEBUG AUDIT_CHANNEL=audit-channel EXPORT_BACKEND=dapr
54+
make test-e2e ENABLE_EXPORT_TESTS=1 EXPORT_BACKEND=dapr
5555
5656
- name: Save logs
5757
if: ${{ always() }}

‎.github/workflows/disk-export.yaml

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
name: disk-export
2+
on:
3+
push:
4+
paths:
5+
- "pkg/export/dapr"
6+
- "pkg/export/disk"
7+
- "test/export/**"
8+
pull_request:
9+
paths:
10+
- "pkg/export/dapr"
11+
- "pkg/export/disk"
12+
- "test/export/**"
13+
permissions: read-all
14+
15+
jobs:
16+
disk_test:
17+
name: "Disk export test"
18+
runs-on: ubuntu-22.04
19+
timeout-minutes: 15
20+
steps:
21+
- name: Harden Runner
22+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
23+
with:
24+
egress-policy: audit
25+
26+
- name: Check out code into the Go module directory
27+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
28+
29+
- name: Bootstrap e2e
30+
run: |
31+
mkdir -p $GITHUB_WORKSPACE/bin
32+
echo "$GITHUB_WORKSPACE/bin" >> $GITHUB_PATH
33+
make e2e-bootstrap
34+
35+
- name: Run e2e
36+
run: |
37+
make docker-buildx IMG=gatekeeper-e2e:latest
38+
make e2e-build-load-externaldata-image
39+
make e2e-reader-build-image
40+
make docker-buildx-crds CRD_IMG=gatekeeper-crds:latest
41+
kind load docker-image --name kind gatekeeper-e2e:latest fake-reader:latest gatekeeper-crds:latest
42+
kubectl create ns gatekeeper-system
43+
44+
make e2e-helm-deploy HELM_REPO=gatekeeper-e2e HELM_CRD_REPO=gatekeeper-crds HELM_RELEASE=latest ENABLE_EXPORT=true LOG_LEVEL=DEBUG EXPORT_BACKEND=disk FAKE_READER_IMAGE_PULL_POLICY=Never AUDIT_CONNECTION=audit-connection AUDIT_CHANNEL=audit-channel EXPORT_DISK_PATH=/tmp/violations MAX_AUDIT_RESULTS=3 FAKE_READER_IMAGE=fake-reader:latest
45+
46+
make test-e2e ENABLE_EXPORT_TESTS=1 EXPORT_BACKEND=disk
47+
48+
- name: Save logs
49+
if: ${{ always() }}
50+
run: |
51+
kubectl logs -n gatekeeper-system -l control-plane=audit-controller -c manager --tail=-1 > logs-audit-manager.json
52+
kubectl logs -n gatekeeper-system -l control-plane=audit-controller -c reader --tail=-1 > logs-audit-export.json
53+
54+
- name: Upload artifacts
55+
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
56+
if: ${{ always() }}
57+
with:
58+
name: export-logs
59+
path: |
60+
logs-*.json
61+

‎Makefile

Lines changed: 68 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,38 @@ NODE_VERSION ?= 16-bullseye-slim
3737
YQ_VERSION ?= 4.30.6
3838

3939
HELM_ARGS ?=
40+
HELM_DAPR_EXPORT_ARGS := --set-string auditPodAnnotations.dapr\\.io/enabled=true \
41+
--set-string auditPodAnnotations.dapr\\.io/app-id=audit \
42+
--set-string auditPodAnnotations.dapr\\.io/metrics-port=9999 \
43+
44+
HELM_DISK_EXPORT_ARGS := --set audit.exportVolumeMount.path=${EXPORT_DISK_PATH} \
45+
--set audit.exportConfig.maxAuditResults=${MAX_AUDIT_RESULTS} \
46+
--set audit.exportSidecar.image=${FAKE_READER_IMAGE} \
47+
--set audit.exportSidecar.imagePullPolicy=${FAKE_READER_IMAGE_PULL_POLICY} \
48+
49+
HELM_EXPORT_ARGS := --set enableViolationExport=${ENABLE_EXPORT} \
50+
--set audit.connection=${AUDIT_CONNECTION} \
51+
--set audit.channel=${AUDIT_CHANNEL} \
52+
--set exportBackend=${EXPORT_BACKEND} \
53+
54+
HELM_EXTRA_ARGS := --set image.repository=${HELM_REPO} \
55+
--set image.crdRepository=${HELM_CRD_REPO} \
56+
--set image.release=${HELM_RELEASE} \
57+
--set postInstall.labelNamespace.image.repository=${HELM_CRD_REPO} \
58+
--set postInstall.labelNamespace.image.tag=${HELM_RELEASE} \
59+
--set postInstall.labelNamespace.enabled=true \
60+
--set postInstall.probeWebhook.enabled=true \
61+
--set emitAdmissionEvents=true \
62+
--set emitAuditEvents=true \
63+
--set admissionEventsInvolvedNamespace=true \
64+
--set auditEventsInvolvedNamespace=true \
65+
--set disabledBuiltins={http.send} \
66+
--set logMutations=true \
67+
--set logLevel=${LOG_LEVEL} \
68+
--set defaultCreateVAPForTemplates=${GENERATE_VAP} \
69+
--set defaultCreateVAPBindingForConstraints=${GENERATE_VAPBINDING} \
70+
--set mutationAnnotations=true;\
71+
4072
GATEKEEPER_NAMESPACE ?= gatekeeper-system
4173

4274
# When updating this, make sure to update the corresponding action in
@@ -48,6 +80,8 @@ GOLANGCI_LINT_CACHE := $(shell pwd)/.tmp/golangci-lint
4880

4981
BENCHMARK_FILE_NAME ?= benchmarks.txt
5082
FAKE_SUBSCRIBER_IMAGE ?= fake-subscriber:latest
83+
FAKE_READER_IMAGE ?= fake-reader:latest
84+
FAKE_READER_IMAGE_PULL_POLICY ?= IfNotPresent
5185

5286
ROOT_DIR := $(shell dirname $(realpath $(firstword $(MAKEFILE_LIST))))
5387
BIN_DIR := $(abspath $(ROOT_DIR)/bin)
@@ -106,6 +140,29 @@ MANAGER_IMAGE_PATCH := "apiVersion: apps/v1\
106140
\n - --log-level=${LOG_LEVEL}\
107141
\n"
108142

143+
HELM_EXPORT_VARIABLES := "audit:\
144+
\n exportVolume:\
145+
\n name: tmp-violations\
146+
\n emptyDir: {}\
147+
\n exportSidecar:\
148+
\n name: go-sub\
149+
\n image: ${FAKE_READER_IMAGE}\
150+
\n imagePullPolicy: ${FAKE_READER_IMAGE_PULL_POLICY}\
151+
\n securityContext:\
152+
\n allowPrivilegeEscalation: false\
153+
\n capabilities:\
154+
\n drop:\
155+
\n - ALL\
156+
\n readOnlyRootFilesystem: true\
157+
\n runAsGroup: 999\
158+
\n runAsNonRoot: true\
159+
\n runAsUser: 1000\
160+
\n seccompProfile:\
161+
\n type: RuntimeDefault\
162+
\n volumeMounts:\
163+
\n - mountPath: /tmp/violations\
164+
\n name: tmp-violations"
165+
109166
# Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
110167
ifeq (,$(shell go env GOBIN))
111168
GOBIN=$(shell go env GOPATH)/bin
@@ -202,53 +259,20 @@ e2e-helm-install:
202259
cd .staging/helm && tar -xvf helmbin.tar.gz
203260
./.staging/helm/linux-amd64/helm version --client
204261

205-
e2e-helm-deploy: e2e-helm-install
262+
e2e-helm-deploy: e2e-helm-install $(LOCALBIN)
206263
ifeq ($(ENABLE_EXPORT),true)
207264
./.staging/helm/linux-amd64/helm install manifest_staging/charts/gatekeeper --name-template=gatekeeper \
208265
--namespace ${GATEKEEPER_NAMESPACE} \
209266
--debug --wait \
210-
--set image.repository=${HELM_REPO} \
211-
--set image.crdRepository=${HELM_CRD_REPO} \
212-
--set image.release=${HELM_RELEASE} \
213-
--set postInstall.labelNamespace.image.repository=${HELM_CRD_REPO} \
214-
--set postInstall.labelNamespace.image.tag=${HELM_RELEASE} \
215-
--set postInstall.labelNamespace.enabled=true \
216-
--set postInstall.probeWebhook.enabled=true \
217-
--set emitAdmissionEvents=true \
218-
--set emitAuditEvents=true \
219-
--set admissionEventsInvolvedNamespace=true \
220-
--set auditEventsInvolvedNamespace=true \
221-
--set disabledBuiltins={http.send} \
222-
--set logMutations=true \
223-
--set enableViolationExport=${ENABLE_EXPORT} \
224-
--set audit.connection=${AUDIT_CONNECTION} \
225-
--set audit.channel=${AUDIT_CHANNEL} \
226-
--set-string auditPodAnnotations.dapr\\.io/enabled=true \
227-
--set-string auditPodAnnotations.dapr\\.io/app-id=audit \
228-
--set-string auditPodAnnotations.dapr\\.io/metrics-port=9999 \
229-
--set logLevel=${LOG_LEVEL} \
230-
--set mutationAnnotations=true;
267+
$(HELM_EXPORT_ARGS) \
268+
$(if $(filter disk,$(EXPORT_BACKEND)),$(HELM_DISK_EXPORT_ARGS)) \
269+
$(if $(filter dapr,$(EXPORT_BACKEND)),$(HELM_DAPR_EXPORT_ARGS)) \
270+
$(HELM_EXTRA_ARGS)
231271
else
232272
./.staging/helm/linux-amd64/helm install manifest_staging/charts/gatekeeper --name-template=gatekeeper \
233273
--namespace ${GATEKEEPER_NAMESPACE} --create-namespace \
234274
--debug --wait \
235-
--set image.repository=${HELM_REPO} \
236-
--set image.crdRepository=${HELM_CRD_REPO} \
237-
--set image.release=${HELM_RELEASE} \
238-
--set postInstall.labelNamespace.image.repository=${HELM_CRD_REPO} \
239-
--set postInstall.labelNamespace.image.tag=${HELM_RELEASE} \
240-
--set postInstall.labelNamespace.enabled=true \
241-
--set postInstall.probeWebhook.enabled=true \
242-
--set emitAdmissionEvents=true \
243-
--set emitAuditEvents=true \
244-
--set admissionEventsInvolvedNamespace=true \
245-
--set auditEventsInvolvedNamespace=true \
246-
--set disabledBuiltins={http.send} \
247-
--set logMutations=true \
248-
--set logLevel=${LOG_LEVEL} \
249-
--set defaultCreateVAPForTemplates=${GENERATE_VAP} \
250-
--set defaultCreateVAPBindingForConstraints=${GENERATE_VAPBINDING} \
251-
--set mutationAnnotations=true;
275+
$(HELM_EXTRA_ARGS)
252276
endif
253277

254278
e2e-helm-upgrade-init: e2e-helm-install
@@ -273,23 +297,7 @@ e2e-helm-upgrade:
273297
./.staging/helm/linux-amd64/helm upgrade gatekeeper manifest_staging/charts/gatekeeper \
274298
--namespace ${GATEKEEPER_NAMESPACE} \
275299
--debug --wait \
276-
--set image.repository=${HELM_REPO} \
277-
--set image.crdRepository=${HELM_CRD_REPO} \
278-
--set image.release=${HELM_RELEASE} \
279-
--set postInstall.labelNamespace.image.repository=${HELM_CRD_REPO} \
280-
--set postInstall.labelNamespace.image.tag=${HELM_RELEASE} \
281-
--set postInstall.labelNamespace.enabled=true \
282-
--set postInstall.probeWebhook.enabled=true \
283-
--set emitAdmissionEvents=true \
284-
--set emitAuditEvents=true \
285-
--set admissionEventsInvolvedNamespace=true \
286-
--set auditEventsInvolvedNamespace=true \
287-
--set disabledBuiltins={http.send} \
288-
--set logMutations=true \
289-
--set logLevel=${LOG_LEVEL} \
290-
--set defaultCreateVAPForTemplates=${GENERATE_VAP} \
291-
--set defaultCreateVAPBindingForConstraints=${GENERATE_VAPBINDING} \
292-
--set mutationAnnotations=true;\
300+
$(HELM_EXTRA_ARGS)
293301

294302
e2e-subscriber-build-load-image:
295303
docker buildx build --platform="linux/amd64" -t ${FAKE_SUBSCRIBER_IMAGE} --load -f test/export/fake-subscriber/Dockerfile test/export/fake-subscriber
@@ -302,7 +310,10 @@ e2e-subscriber-deploy:
302310

303311
e2e-publisher-deploy:
304312
kubectl get secret redis --namespace=default -o yaml | sed 's/namespace: .*/namespace: gatekeeper-system/' | kubectl apply -f -
305-
kubectl apply -f test/export/publish-components.yaml
313+
kubectl apply -f test/export/fake-subscriber/manifest/publish-components.yaml
314+
315+
e2e-reader-build-image:
316+
docker buildx build --platform="$(PLATFORM)" -t ${FAKE_READER_IMAGE} --load -f test/export/fake-reader/Dockerfile test/export/fake-reader
306317

307318
# Build manager binary
308319
manager: generate

‎cmd/build/helmify/main.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -141,7 +141,8 @@ func (ks *kindSet) Write() error {
141141
obj = "{{- if not .Values.disableAudit }}\n" + obj + "{{- end }}\n"
142142
obj = strings.Replace(obj, " labels:", " labels:\n {{- include \"gatekeeper.podLabels\" . | nindent 8 }}\n {{- include \"audit.podLabels\" . | nindent 8 }}\n {{- include \"gatekeeper.commonLabels\" . | nindent 8 }}", 1)
143143
obj = strings.Replace(obj, " priorityClassName: system-cluster-critical", " {{- if .Values.audit.priorityClassName }}\n priorityClassName: {{ .Values.audit.priorityClassName }}\n {{- end }}", 1)
144-
obj = strings.Replace(obj, " - emptyDir: {}", " {{- if .Values.audit.writeToRAMDisk }}\n - emptyDir:\n medium: Memory\n {{ else }}\n - emptyDir: {}\n {{- end }}", 1)
144+
obj = strings.Replace(obj, " name: tmp-volume", " name: tmp-volume\n {{- if and (.Values.enableViolationExport) (eq (.Values.exportBackend | default \"\" | lower) \"disk\") }}\n - mountPath: {{ .Values.audit.exportVolumeMount.path }}\n name: {{ .Values.audit.exportVolume.name }}\n {{- end }}\n {{ if and (.Values.enableViolationExport) (eq (.Values.exportBackend | default \"\" | lower) \"disk\") }}\n - {{ toYaml .Values.audit.exportSidecar | nindent 8 }}\n {{- end }}", 1)
145+
obj = strings.Replace(obj, " - emptyDir: {}", " {{- if and (.Values.enableViolationExport) (eq (.Values.exportBackend | default \"\" | lower) \"disk\") }}\n - {{- toYaml .Values.audit.exportVolume | nindent 8 }}\n {{- end }}\n {{- if .Values.audit.writeToRAMDisk }}\n - emptyDir:\n medium: Memory\n {{ else }}\n - emptyDir: {}\n {{- end }}", 1)
145146
}
146147

147148
if name == "gatekeeper-manager-role" && kind == "Role" {

0 commit comments

Comments
 (0)