CNS-2791: Add a remote configurator that pulls changes from CB Console and applies them to the CR #184

ltsonov-cb · 2023-09-12T09:37:15Z

This MR adds a secondary "loop" within the operator, in addition to the main one that is responsible to maintain the agent.

Structure:

A new controller that is only responsible to run the "reconfiguration" code every X seconds/minutes. It will also do exponential backoff if that fails to avoid clusters swarming us with requests for pending changes.
A "configurator" that handles the main logic - getting the CR, reading and pending changes, changing the CR, etc
Two helpers that validate a change (i.e. is it even OK to do it? - this should also be done on the backend) and apply it. Makes testing easier
The feature is still incomplete. The API for changes is "mocked" and returns random changes instead. This is so a developer can try it out locally. It will basically reconfigure the CR every N seconds right now with random (valid) values.
Due to the above bullet, the feature is currently disabled by default (requires env var to run). But in the final version it will be enabled by default and controlled by the CR. The latter is implemented so we only have to remove the env var before release.

The major changes are under remote_configuration package so I'd recommend starting the review from there and going Controller->Configurator->Change_applier.

Other changes:

ApiGateway and AccessToken were required in both places so I extracted those from the controller's code
The cluster identifier is currently propagated to ApiGateway calls. But we should refactor this code a bit since other cluster ID values (group+name) are part of the apigateway itself and it's hard to follow.

Separate MR will handle:

Implementing the ConfigChanges API client
More docs

Release/6.0.1

Adding ccs to charts

…parate helper function to make testing easier

…cluster name

…tation.

… context in the UI

…d (so it is not ON by default when testing)

remote_configuration/change_applier.go

api/v1/cbcontainersagent_types.go

cbcontainers/communication/gateway/api_gateway.go

skaneti1 · 2023-09-19T16:41:55Z

remote_configuration/change_applier_test.go

+	"testing"
+)
+
+func TestFeatureTogglesAreAppliedCorrectly(t *testing.T) {


I think this test tried to save code by wrapping the tests with appliedChangeTest, iterating them and run them, but since the actual test is only:

remote_configuration.ApplyConfigChangeToCR(testCase.change, &testCase.initialCR) testCase.assertFinalCR(t, testCase.initialCR)

I think this wrapping and "code saving" didn't save a lot of code, but did made the test more messy and harder to read and understand.

I think simple 4 t.Run tests with the 4 test cases will be clearer and probably will resolve with close code lines

…e and applies them to the CR (#184) * Update README.md * Update README.md * Fix charts for main to be idetical to latest release v6.0.1 * Update README.md * Adding labels field to charts * Adding company code secret template to charts * Adding company code secret template to charts fix * Add documentation for secrets with helm * config applier skeleton * More work on the configuration applier loop. * Happy path test for config_applier * Pass context to API functions as they'll do IO * More tests * Send Failed status to backend when failing to list or update CR * Treat missing CR when a change is pending as error * Move "scheduling" logic to a separate struct for config applier * Use a DummyAPI implementation * Small refactoring * Add test for feature toggles * Add tests for the version field. Split the modification logic in a separate helper function to make testing easier * Sort the change slice in case there are multiple pending changes * Clearing TODOs, small fixes * Removing more TODOs * Turn off configurator by default and use env var to enable * Renaming things * Refactor tests a bit and remove more TODOs * Change the configurator to read the CR first , so it can extract the cluster name * Validate change against sensor capabilities * Validate operator and agent version compatibility * Tests for positive validation path * Bring the Validate and Apply change funcs under 1 struct and validate before applying * Adding change validation to the configuration * Change validator interface and add fetcher to download metadata from the API * Add auth_provider and adjust test to match * Create AccessTokenProvider in main.go * Extract the ApiGateway from processors.* and use it in configurator as well. * Go back to the previous version as it looked simpler * Fixing some tests and main.go * Change the agent_processor tests to match the new func. Remove a test that was not deterministic * Add clusterIdentifier parameter to GetConfigurationChanges * Add clusterID to the status update model call * Add secret detection to the changer * Add secret detection to the validation * Minor TODOs * Some missing test cases for validation * More minor changes * Add sensor metadata implementation. Add dummy config changes implementation. * Move data classes around * Removing TODOs * Change the feature toggle to be part of the CR * Change errors to have system info and user info for debugging vs user context in the UI * Small refactor * Change dummy struct to just a func * Bump timeout a bit * Remove controller_test.go * Add back the env var during development until the feature is completed (so it is not ON by default when testing) * Add remote_configuration to docker build * Fix not wrapped error * Fix missing generate run * Fix sensors path and response * Increase iteration sleep time * Fix helm indentation * Change the version reset to be more readable * Move the remote_configuration under cbcontainers and controllers * Added godoc --------- Co-authored-by: BenRub <[email protected]> Co-authored-by: benrub <[email protected]>

BenRub and others added 30 commits August 30, 2023 12:28

Merge pull request #180 from octarinesec/release/6.0.1

847d150

Release/6.0.1

Update README.md

2c2623a

Update README.md

6bb0ee3

Fix charts for main to be idetical to latest release v6.0.1

ee25a2a

Update README.md

2a85953

Adding labels field to charts

45b920b

Adding company code secret template to charts

9259740

Adding company code secret template to charts fix

f6a045c

Merge pull request #183 from octarinesec/adding-ccs-to-charts

74b9564

Adding ccs to charts

Add documentation for secrets with helm

84aa072

config applier skeleton

6109ee3

More work on the configuration applier loop.

cb2fb12

Happy path test for config_applier

6af7c0b

Pass context to API functions as they'll do IO

459c805

More tests

fa1eea0

Send Failed status to backend when failing to list or update CR

319826a

Treat missing CR when a change is pending as error

0917e02

Move "scheduling" logic to a separate struct for config applier

551e132

Use a DummyAPI implementation

a7f9f72

Small refactoring

9fe2033

Add test for feature toggles

aa5fd69

Add tests for the version field. Split the modification logic in a se…

43b671b

…parate helper function to make testing easier

Sort the change slice in case there are multiple pending changes

cfb3216

Clearing TODOs, small fixes

3586a4c

Removing more TODOs

e2bb24b

Turn off configurator by default and use env var to enable

cbbc1b8

Renaming things

17051ce

Refactor tests a bit and remove more TODOs

581d5fc

Change the configurator to read the CR first , so it can extract the …

c5a8022

…cluster name

Validate change against sensor capabilities

d1d1b05

ltsonov-cb added 18 commits September 11, 2023 15:51

More minor changes

61874de

Add sensor metadata implementation. Add dummy config changes implemen…

af5e9b0

…tation.

Move data classes around

5add191

Removing TODOs

c40ca39

Change the feature toggle to be part of the CR

ca55c8d

Merge branch 'develop' into CNS-2791-remote-configuration-applier

6945e02

Change errors to have system info and user info for debugging vs user…

4b891dd

… context in the UI

Small refactor

375cf99

Change dummy struct to just a func

d533eea

Bump timeout a bit

ef9ea8f

Remove controller_test.go

4ca10a7

Add back the env var during development until the feature is complete…

e4e1435

…d (so it is not ON by default when testing)

Add remote_configuration to docker build

061805d

Fix not wrapped error

2f90e09

Fix missing generate run

064570d

Fix sensors path and response

bffcf91

Increase iteration sleep time

4a52a71

Fix helm indentation

b9740fc

BenRub requested changes Sep 14, 2023

View reviewed changes

remote_configuration/change_applier.go Outdated Show resolved Hide resolved

Change the version reset to be more readable

ff1a33b

BenRub approved these changes Sep 19, 2023

View reviewed changes

skaneti1 reviewed Sep 19, 2023

View reviewed changes

ltsonov-cb added 2 commits September 20, 2023 11:04

Move the remote_configuration under cbcontainers and controllers

b07e326

Added godoc

8047722

skaneti1 approved these changes Sep 20, 2023

View reviewed changes

ltsonov-cb merged commit 82c2bff into develop Sep 20, 2023
2 checks passed

ltsonov-cb deleted the CNS-2791-remote-configuration-applier branch November 8, 2023 21:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CNS-2791: Add a remote configurator that pulls changes from CB Console and applies them to the CR #184

CNS-2791: Add a remote configurator that pulls changes from CB Console and applies them to the CR #184

ltsonov-cb commented Sep 12, 2023 •

edited

Loading

skaneti1 Sep 19, 2023

CNS-2791: Add a remote configurator that pulls changes from CB Console and applies them to the CR #184

CNS-2791: Add a remote configurator that pulls changes from CB Console and applies them to the CR #184

Conversation

ltsonov-cb commented Sep 12, 2023 • edited Loading

skaneti1 Sep 19, 2023

Choose a reason for hiding this comment

ltsonov-cb commented Sep 12, 2023 •

edited

Loading