diff --git a/eks-anywhere-common/Addons/Partner/KubeArmor/kubearmor-source.yaml b/eks-anywhere-common/Addons/Partner/KubeArmor/kubearmor-source.yaml index 1be645a2..ff841660 100644 --- a/eks-anywhere-common/Addons/Partner/KubeArmor/kubearmor-source.yaml +++ b/eks-anywhere-common/Addons/Partner/KubeArmor/kubearmor-source.yaml @@ -2,7 +2,7 @@ apiVersion: source.toolkit.fluxcd.io/v1beta2 kind: HelmRepository metadata: - name: kubearmor + name: kubearmor-operator namespace: flux-system spec: interval: 30s diff --git a/eks-anywhere-common/Addons/Partner/KubeArmor/kubearmor.yaml b/eks-anywhere-common/Addons/Partner/KubeArmor/kubearmor.yaml index 53b51285..e4b9be3d 100644 --- a/eks-anywhere-common/Addons/Partner/KubeArmor/kubearmor.yaml +++ b/eks-anywhere-common/Addons/Partner/KubeArmor/kubearmor.yaml @@ -2,18 +2,35 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1 kind: HelmRelease metadata: - name: kubearmor + name: kubearmor-operator namespace: kubearmor spec: chart: spec: - chart: kubearmor + chart: kubearmor-operator reconcileStrategy: ChartVersion sourceRef: kind: HelmRepository - name: kubearmor + name: kubearmor-operator namespace: flux-system - version: "v0.10.2" + version: "v1.3.2" + values: + autoDeploy: true + kubearmorOperator: + name: kubearmor-operator + image: + repository: kubearmor/kubearmor-operator + tag: "v1.3.2" + imagePullPolicy: Always + kubearmorConfig: + defaultCapabilitiesPosture: audit + defaultFilePosture: audit + defaultNetworkPosture: audit + defaultVisibility: process,network + enableStdOutLogs: false + enableStdOutAlerts: false + enableStdOutMsgs: false + seccompEnabled: false interval: 1m0s - releaseName: kubearmor + releaseName: kubearmor-operator targetNamespace: kubearmor diff --git a/eks-anywhere-common/Addons/Partner/KubeArmor/namespace.yaml b/eks-anywhere-common/Addons/Partner/KubeArmor/namespace.yaml index eaed10e7..1b272fdf 100644 --- a/eks-anywhere-common/Addons/Partner/KubeArmor/namespace.yaml +++ b/eks-anywhere-common/Addons/Partner/KubeArmor/namespace.yaml @@ -6,4 +6,4 @@ metadata: labels: aws.conformance.vendor: accuknox aws.conformance.vendor-solution: kubearmor - aws.conformance.vendor-solution-version: "v0.10.2" + aws.conformance.vendor-solution-version: "v1.3.2" diff --git a/eks-anywhere-common/Testers/KubeArmor/kubearmor-testjob.yaml b/eks-anywhere-common/Testers/KubeArmor/kubearmor-testjob.yaml index 18a93889..65a7e4bc 100644 --- a/eks-anywhere-common/Testers/KubeArmor/kubearmor-testjob.yaml +++ b/eks-anywhere-common/Testers/KubeArmor/kubearmor-testjob.yaml @@ -1,28 +1,148 @@ apiVersion: batch/v1 -kind: Job +kind: CronJob metadata: - name: kubearmor-tester + name: kubearmor-tester-cron namespace: kubearmor spec: - template: + schedule: "10 10 * * *" + jobTemplate: spec: - containers: - - name: job - image: 'alpine/k8s:1.26.2' - imagePullPolicy: Always - command: - - /bin/sh - args: - - -c - - >- - echo 1. Checking readiness probe - kubectl wait --for=condition=ready --timeout=5m -n kubearmor pod -l kubearmor-app - echo 2. Checking audit port - kubearmor_audit="..."; - while [[ "$kubearmor_audit" != *"Connected"* ]]; - do kubearmor_audit=`curl -ksv --connect-timeout 4 telnet://kubearmor.kubearmor.svc.cluster.local:32767 2>&1` && echo Connecting; - sleep 2; - done; - echo Success; - restartPolicy: Never - backoffLimit: 1 + template: + spec: + containers: + - name: job + image: 'alpine/k8s:1.26.2' + imagePullPolicy: Always + command: ["/bin/bash", "-c"] + args: + - | + #!/bin/bash + echo 1. Checking if kubearmor pods are running + kubectl wait -n kubearmor --timeout=5m --for=jsonpath='{.status.phase}'=Running kubearmorconfigs/kubearmor-default + + timeout 7m bash -c -- ' + while true; do + all_running=true + echo "Checking pod status..." + for pod_status in $(kubectl get pod -n kubearmor -l kubearmor-app,kubearmor-app!=kubearmor-snitch --output=jsonpath="{.items[*].status.phase}" 2>/dev/null); do + if [ "$pod_status" != "Running" ]; then + all_running=false + echo "Waiting for pods to be Running..." + break + fi + done + + if $all_running; then + echo "All pods are Running." + break + fi + + if kubectl get pod -n kubearmor -l kubearmor-app,kubearmor-app!=kubearmor-snitch | grep CrashLoopBackOff; then + echo "Error: Pod in CrashLoopBackOff state" + exit 1 + fi + + done + ' + + echo 2. Checking readiness probe for kubearmor + kubearmor_audit="..."; + while [[ "$kubearmor_audit" != *"Connected"* ]]; + do kubearmor_audit=`curl -ksv --connect-timeout 4 telnet://kubearmor.kubearmor.svc.cluster.local:32767 2>&1` && echo Connecting; + sleep 2; + echo Connected + done; + + echo 3. Creating nginx deployment + cat <