From ac3f90a91b69054b9e99d5f595bc699e57e91407 Mon Sep 17 00:00:00 2001
From: Gopi A <70835792+webdevgopi@users.noreply.github.com>
Date: Fri, 21 Jul 2023 14:06:15 +0530
Subject: [PATCH] Add kubearmor addon (#147)

---
 addons.yaml              |  9 +++++++
 addons/kubearmor/disable | 14 ++++++++++
 addons/kubearmor/enable  | 13 ++++++++++
 addons/kubearmor/karmor  | 10 ++++++++
 tests/test_kubearmor.py  | 55 ++++++++++++++++++++++++++++++++++++++++
 5 files changed, 101 insertions(+)
 create mode 100755 addons/kubearmor/disable
 create mode 100755 addons/kubearmor/enable
 create mode 100644 addons/kubearmor/karmor
 create mode 100644 tests/test_kubearmor.py

diff --git a/addons.yaml b/addons.yaml
index c8aa6283..6f7deeab 100644
--- a/addons.yaml
+++ b/addons.yaml
@@ -206,3 +206,12 @@ microk8s-addons:
       supported_architectures:
         - amd64
         - arm64
+
+    - name: "kubearmor"
+      description: "Cloud-native runtime security enforcement system for k8s"
+      version: "0.10.2"
+      check_status: "daemonset.apps/kubearmor"
+      confinement: "classic"
+      supported_architectures:
+        - amd64
+        - arm64
diff --git a/addons/kubearmor/disable b/addons/kubearmor/disable
new file mode 100755
index 00000000..de7f3db2
--- /dev/null
+++ b/addons/kubearmor/disable
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+echo "Removing kubearmor from k8s cluster"
+
+sudo microk8s karmor uninstall
+
+if [[ -f "$SNAP_COMMON/plugins/karmor" ]]; then
+    sudo rm "$SNAP_COMMON/plugins/karmor"
+fi
+
+if [[ -f "$SNAP_COMMON/bin/karmor" ]]; then
+    sudo rm "$SNAP_COMMON/bin/karmor"
+fi
+
diff --git a/addons/kubearmor/enable b/addons/kubearmor/enable
new file mode 100755
index 00000000..e6190f83
--- /dev/null
+++ b/addons/kubearmor/enable
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+set -e
+
+CURRENT_DIR=$(cd $(dirname "${BASH_SOURCE[0]}") && pwd)
+
+curl -sfL http://get.kubearmor.io/ | sudo sh -s -- -b "$SNAP_COMMON/bin"
+
+cp "$CURRENT_DIR/karmor" "$SNAP_COMMON/plugins"
+
+chmod +x "$SNAP_COMMON/plugins/karmor"
+
+sudo microk8s karmor install --image=kubearmor/kubearmor:v0.10.2
\ No newline at end of file
diff --git a/addons/kubearmor/karmor b/addons/kubearmor/karmor
new file mode 100644
index 00000000..68159638
--- /dev/null
+++ b/addons/kubearmor/karmor
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+if [ "$EUID" -ne 0 ]
+then echo "Elevated permissions are needed for this command. Please use sudo."
+    exit 1
+fi
+
+export KUBECONFIG=$SNAP_DATA/credentials/client.config
+
+${SNAP_COMMON}/bin/karmor $*
\ No newline at end of file
diff --git a/tests/test_kubearmor.py b/tests/test_kubearmor.py
new file mode 100644
index 00000000..d3cb9f24
--- /dev/null
+++ b/tests/test_kubearmor.py
@@ -0,0 +1,55 @@
+import pytest
+import platform
+import os
+
+
+from utils import (
+    is_container,
+    microk8s_enable,
+    microk8s_disable,
+    microk8s_reset,
+    wait_for_installation,
+    wait_for_pod_state,
+)
+
+
+class TestKubearmor(object):
+    @pytest.mark.skipif(
+        os.environ.get("STRICT") == "yes",
+        reason=(
+            "Skipping kubearmor tests in strict confinement as they are expected to fail"
+        ),
+    )
+    @pytest.mark.skipif(
+        is_container(), reason="Kubearmor tests are skipped in containers"
+    )
+    @pytest.mark.skipif(platform.machine() == "s390x", reason="Not available on s390x")
+    def test_kubearmor(self):
+        """
+        Sets up and validates kubearmor.
+        """
+        print("Enabling Kubearmor")
+        microk8s_enable("kubearmor")
+        print("Validating Kubearmor")
+        self.validate_kubearmor()
+        print("Disabling Kubearmor")
+        microk8s_disable("kubearmor")
+        microk8s_reset()
+
+    def validate_kubearmor(self):
+        """
+        Validate kubearmor by applying policy to nginx container.
+        """
+
+        wait_for_installation()
+        kubearmor_pods = [
+            "kubearmor-controller",
+            "kubearmor",
+            "kubearmor-relay",
+        ]
+        for pod in kubearmor_pods:
+            wait_for_pod_state(
+                "", "kube-system", "running", label="kubearmor-app={}".format(pod)
+            )
+
+        print("Kubearmor testing passed.")