Add container image in Kubernetes metadata (elastic#13356)

adriansr · Aug 28, 2019 · aa3f38d · aa3f38d
1 parent 65db71c
commit aa3f38d
Show file tree

Hide file tree

Showing 6 changed files with 26 additions and 13 deletions.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -282,6 +282,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Update Suricata module to populate ECS DNS fields and handle EVE DNS version 2. {issue}13320[13320] {pull}13329[13329]
 - Update PAN-OS fileset to use the ECS NAT fields. {issue}13320[13320] {pull}13330[13330]
 - Add fields to the Zeek DNS fileset for ECS DNS. {issue}13320[13320] {pull}13324[13324]
+- Add container image in Kubernetes metadata {pull}13356[13356] {issue}12688[12688]
 
 *Heartbeat*
 

diff --git a/libbeat/autodiscover/providers/kubernetes/kubernetes.go b/libbeat/autodiscover/providers/kubernetes/kubernetes.go
@@ -184,7 +184,7 @@ func (p *Provider) emitEvents(pod *kubernetes.Pod, flag string, containers []kub
 			"image":   c.Image,
 			"runtime": runtimes[c.Name],
 		}
-		meta := p.metagen.ContainerMetadata(pod, c.Name)
+		meta := p.metagen.ContainerMetadata(pod, c.Name, c.Image)
 
 		// Information that can be used in discovering a workload
 		kubemeta := meta.Clone()

diff --git a/libbeat/autodiscover/providers/kubernetes/kubernetes_test.go b/libbeat/autodiscover/providers/kubernetes/kubernetes_test.go
@@ -231,7 +231,8 @@ func TestEmitEvent(t *testing.T) {
 					"kubernetes": common.MapStr{
 						"namespace": "default",
 						"container": common.MapStr{
-							"name": "filebeat",
+							"name":  "filebeat",
+							"image": "elastic/filebeat:6.3.0",
 						}, "pod": common.MapStr{
 							"name": "filebeat",
 							"uid":  "005f3b90-4b9d-12f8-acf0-31020a840133",
@@ -359,7 +360,8 @@ func TestEmitEvent(t *testing.T) {
 					"kubernetes": common.MapStr{
 						"namespace": "default",
 						"container": common.MapStr{
-							"name": "filebeat",
+							"name":  "filebeat",
+							"image": "elastic/filebeat:6.3.0",
 						}, "pod": common.MapStr{
 							"name": "filebeat",
 							"uid":  "005f3b90-4b9d-12f8-acf0-31020a840133",
@@ -426,7 +428,8 @@ func TestEmitEvent(t *testing.T) {
 					"kubernetes": common.MapStr{
 						"namespace": "default",
 						"container": common.MapStr{
-							"name": "filebeat",
+							"name":  "filebeat",
+							"image": "elastic/filebeat:6.3.0",
 						}, "pod": common.MapStr{
 							"name": "filebeat",
 							"uid":  "005f3b90-4b9d-12f8-acf0-31020a840133",

diff --git a/libbeat/common/kubernetes/metadata.go b/libbeat/common/kubernetes/metadata.go
@@ -35,7 +35,7 @@ type MetaGenerator interface {
 	PodMetadata(pod *Pod) common.MapStr
 
 	// Containermetadata generates metadata for the given container of a pod
-	ContainerMetadata(pod *Pod, container string) common.MapStr
+	ContainerMetadata(pod *Pod, container string, image string) common.MapStr
 }
 
 // MetaGeneratorConfig settings
@@ -140,12 +140,13 @@ func (g *metaGenerator) PodMetadata(pod *Pod) common.MapStr {
 }
 
 // Containermetadata generates metadata for the given container of a pod
-func (g *metaGenerator) ContainerMetadata(pod *Pod, container string) common.MapStr {
+func (g *metaGenerator) ContainerMetadata(pod *Pod, container string, image string) common.MapStr {
 	podMeta := g.PodMetadata(pod)
 
 	// Add container details
 	podMeta["container"] = common.MapStr{
-		"name": container,
+		"name":  container,
+		"image": image,
 	}
 
 	return podMeta

diff --git a/libbeat/processors/add_kubernetes_metadata/indexers.go b/libbeat/processors/add_kubernetes_metadata/indexers.go
@@ -195,7 +195,7 @@ func (c *ContainerIndexer) GetMetadata(pod *kubernetes.Pod) []MetadataIndex {
 		}
 		metadata = append(metadata, MetadataIndex{
 			Index: cID,
-			Data:  c.metaGen.ContainerMetadata(pod, status.Name),
+			Data:  c.metaGen.ContainerMetadata(pod, status.Name, status.Image),
 		})
 	}
 
@@ -245,7 +245,7 @@ func (h *IPPortIndexer) GetMetadata(pod *kubernetes.Pod) []MetadataIndex {
 
 				metadata = append(metadata, MetadataIndex{
 					Index: fmt.Sprintf("%s:%d", pod.Status.PodIP, port.ContainerPort),
-					Data:  h.metaGen.ContainerMetadata(pod, container.Name),
+					Data:  h.metaGen.ContainerMetadata(pod, container.Name, container.Image),
 				})
 			}
 		}

diff --git a/libbeat/processors/add_kubernetes_metadata/indexers_test.go b/libbeat/processors/add_kubernetes_metadata/indexers_test.go
@@ -143,6 +143,8 @@ func TestContainerIndexer(t *testing.T) {
 	ns := "testns"
 	uid := "005f3b90-4b9d-12f8-acf0-31020a840133"
 	container := "container"
+	containerImage := "containerimage"
+	initContainerImage := "initcontainerimage"
 	initContainer := "initcontainer"
 	nodeName := "testnode"
 
@@ -184,13 +186,15 @@ func TestContainerIndexer(t *testing.T) {
 	pod.Status.ContainerStatuses = []kubernetes.PodContainerStatus{
 		{
 			Name:        container,
+			Image:       containerImage,
 			ContainerID: container1,
 		},
 	}
 	container2 := "docker://fghij"
 	pod.Status.InitContainerStatuses = []kubernetes.PodContainerStatus{
 		{
 			Name:        initContainer,
+			Image:       initContainerImage,
 			ContainerID: container2,
 		},
 	}
@@ -206,12 +210,14 @@ func TestContainerIndexer(t *testing.T) {
 	assert.Equal(t, indices[1], "fghij")
 
 	expected["container"] = common.MapStr{
-		"name": container,
+		"name":  container,
+		"image": containerImage,
 	}
 	assert.Equal(t, expected.String(), indexers[0].Data.String())
 
 	expected["container"] = common.MapStr{
-		"name": initContainer,
+		"name":  initContainer,
+		"image": initContainerImage,
 	}
 	assert.Equal(t, expected.String(), indexers[1].Data.String())
 }
@@ -350,6 +356,7 @@ func TestIpPortIndexer(t *testing.T) {
 	ns := "testns"
 	uid := "005f3b90-4b9d-12f8-acf0-31020a840133"
 	container := "container"
+	containerImage := "containerimage"
 	ip := "1.2.3.4"
 	port := int32(80)
 	pod := kubernetes.Pod{
@@ -398,7 +405,8 @@ func TestIpPortIndexer(t *testing.T) {
 
 	pod.Spec.Containers = []v1.Container{
 		{
-			Name: container,
+			Name:  container,
+			Image: containerImage,
 			Ports: []v1.ContainerPort{
 				{
 					Name:          container,
@@ -422,6 +430,6 @@ func TestIpPortIndexer(t *testing.T) {
 	assert.Equal(t, fmt.Sprintf("%s:%d", ip, port), indices[1])
 
 	assert.Equal(t, expected.String(), indexers[0].Data.String())
-	expected["container"] = common.MapStr{"name": container}
+	expected["container"] = common.MapStr{"name": container, "image": containerImage}
 	assert.Equal(t, expected.String(), indexers[1].Data.String())
 }