Equip KubeArmor with Default Armors #602

daemon1024 · 2022-02-08T02:40:36Z

codecov-commenter · 2022-02-08T02:53:10Z

Codecov Report

Merging #602 (9a5952d) into main (1b4c3a9) will increase coverage by 0.73%.
The diff coverage is 82.43%.

@@            Coverage Diff             @@
##             main     #602      +/-   ##
==========================================
+ Coverage   43.55%   44.28%   +0.73%     
==========================================
  Files          24       24              
  Lines        8482     8536      +54     
==========================================
+ Hits         3694     3780      +86     
+ Misses       4336     4299      -37     
- Partials      452      457       +5

Impacted Files	Coverage Δ
KubeArmor/feeder/policyMatcher.go	`44.31% <75.60%> (+3.66%)`	⬆️
KubeArmor/enforcer/appArmorProfile.go	`40.55% <85.71%> (+2.20%)`	⬆️
KubeArmor/config/config.go	`85.85% <100.00%> (+1.95%)`	⬆️
KubeArmor/monitor/hostProcessTree.go	`69.23% <0.00%> (+7.69%)`	⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 1b4c3a9...9a5952d. Read the comment docs.

KubeArmor/config/config.go

KubeArmor/enforcer/appArmorEnforcer.go

KubeArmor/feeder/feeder.go

KubeArmor/feeder/policyMatcher.go

nyrahul

LGTM

KubeArmor/enforcer/appArmorProfile.go

KubeArmor/config/config.go

tests/test-scenarios-github.sh

nam-jaehyun

Let's update this PR on the latest code and merge it.
By the way, it would be better if we have a document that explains how the default posture works in specific cases.

KubeArmor didn't have a configurable default mode of operations. This commit introduces a configurable default posture as well changes in enforcement system to act accordingly. Ref kubearmor#595 Signed-off-by: daemon1024 <[email protected]>

When KubeArmor is equipped with default posture block/audit each of the telemetry events generated needs to be an alert. This commit introduces changes to the policy matcher to update our logs to implicit block/audit alerts based on the configured default posture. Ref kubearmor#595 Signed-off-by: daemon1024 <[email protected]>

daemon1024 · 2022-03-07T13:10:40Z

it would be better if we have a document that explains how the default posture works in specific cases.

Let's document it as part of #630 since will also need to document how to exactly to apply default postures... WDYT?

nyrahul

LGTM

nyrahul · 2022-03-12T13:22:29Z

@nam-jaehyun , can you please review/approve/merge? Thanks

KubeArmor/enforcer/appArmorProfile.go

tests/scenarios/github_test_12/cmd1

tests/scenarios/github_test_12/cmd2

tests/scenarios/github_test_12/cmd3

tests/scenarios/github_test_12/ksp-ubuntu-1-net-tcp-from-source-allow.yaml

KubeArmor/feeder/policyMatcher.go

nam-jaehyun

Added some comments. Please check them.

This commit also fixes the bug where default deny didn't work if we only had fromSource based Allow Policies Signed-off-by: daemon1024 <[email protected]>

Signed-off-by: daemon1024 <[email protected]>

… allow policy Signed-off-by: daemon1024 <[email protected]>

Modified test script to accomodate DefaultPosture logs Signed-off-by: daemon1024 <[email protected]>

nam-jaehyun

Let's merge it.

daemon1024 changed the title ~~[WIP] initial default posture implementation~~ Equip KubeArmor with Default Armors Feb 12, 2022

daemon1024 force-pushed the default-armor-opt branch from 28371f5 to 92abd1b Compare February 12, 2022 06:08

daemon1024 marked this pull request as ready for review February 12, 2022 06:10

daemon1024 requested review from nyrahul and nam-jaehyun and removed request for nyrahul February 12, 2022 06:10

nyrahul requested changes Feb 12, 2022

View reviewed changes

daemon1024 force-pushed the default-armor-opt branch 5 times, most recently from b609ff0 to 61280ab Compare February 14, 2022 15:16

daemon1024 requested a review from nyrahul February 15, 2022 16:12

daemon1024 marked this pull request as draft February 16, 2022 14:51

daemon1024 force-pushed the default-armor-opt branch 2 times, most recently from ef2ddce to be477f5 Compare February 17, 2022 13:52

daemon1024 marked this pull request as ready for review February 17, 2022 15:59

daemon1024 force-pushed the default-armor-opt branch from 295337b to 9a5952d Compare February 21, 2022 09:01

daemon1024 mentioned this pull request Feb 26, 2022

Handle per namespace default posture implementation #630

Merged

daemon1024 force-pushed the default-armor-opt branch 2 times, most recently from f30506c to e945d83 Compare March 1, 2022 16:31

nyrahul approved these changes Mar 2, 2022

View reviewed changes

daemon1024 force-pushed the default-armor-opt branch 2 times, most recently from a3ce1d4 to b61add4 Compare March 2, 2022 14:30

daemon1024 commented Mar 2, 2022

View reviewed changes

KubeArmor/enforcer/appArmorProfile.go Show resolved Hide resolved

daemon1024 requested a review from nyrahul March 2, 2022 14:32

nam-jaehyun reviewed Mar 7, 2022

View reviewed changes

KubeArmor/config/config.go Outdated Show resolved Hide resolved

nam-jaehyun reviewed Mar 7, 2022

View reviewed changes

tests/test-scenarios-github.sh Show resolved Hide resolved

nam-jaehyun reviewed Mar 7, 2022

View reviewed changes

daemon1024 added 2 commits March 7, 2022 18:35

introduce configurable default posture

57abac4

KubeArmor didn't have a configurable default mode of operations. This commit introduces a configurable default posture as well changes in enforcement system to act accordingly. Ref kubearmor#595 Signed-off-by: daemon1024 <[email protected]>

daemon1024 force-pushed the default-armor-opt branch 2 times, most recently from 3ebb49f to b699495 Compare March 7, 2022 13:09

daemon1024 requested a review from nam-jaehyun March 7, 2022 13:56

nyrahul approved these changes Mar 10, 2022

View reviewed changes