Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Added security posture and visibilty column in karmor probe #301

Closed
wants to merge 1 commit into from
Closed

Added security posture and visibilty column in karmor probe #301

wants to merge 1 commit into from

Conversation

Aryan-sharma11
Copy link
Member

@Aryan-sharma11 Aryan-sharma11 commented Mar 30, 2023 •
edited
Loading

Pupose of PR?

Fixes #298
This PR adds columns to show namespace level security posture setting and visibility in karmor probe data.


Daemonset :
 	kubearmor 	Desired: 1	Ready: 1	Available: 1	
Deployments : 
 	kubearmor-relay              	Desired: 1	Ready: 1	Available: 1	
 	kubearmor-annotation-manager 	Desired: 1	Ready: 1	Available: 1	
 	kubearmor-host-policy-manager	Desired: 1	Ready: 1	Available: 1	
 	kubearmor-policy-manager     	Desired: 1	Ready: 1	Available: 1	
Containers : 
 	kubearmor-relay-5656cc5bf7-qxqkm             	Running: 1	Image Version: kubearmor/kubearmor-relay-server:latest  	
 	kubearmor-annotation-manager-5b88fc49c-bxplh 	Running: 2	Image Version: gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0	
 	kubearmor-rj6l5                              	Running: 1	Image Version: kubearmor/kubearmor:stable               	
 	kubearmor-host-policy-manager-9cc9fff74-xtt2z	Running: 2	Image Version: gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0	
 	kubearmor-policy-manager-5c8978fc59-vjmgp    	Running: 2	Image Version: gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0	
Node 1 : 
 	OS Image:                 	Ubuntu 22.04.2 LTS	
 	Kernel Version:           	5.19.0-35-generic 	
 	Kubelet Version:          	v1.23.9+k3s1      	
 	Container Runtime:        	docker://23.0.1   	
 	Active LSM:               	AppArmor          	
 	Host Security:            	false             	
 	Container Security:       	true              	
 	Container Default Posture:	audit(File)       	audit(Capabilities)	audit(Network)	
 	Host Default Posture:     	audit(File)       	audit(Capabilities)	audit(Network)	
Armored Up pods : 
+-----------------+--------------------------------+-----------------------------------+--------------------------------------+-----------------------------+
|    NAMESPACE    |        SECURITY POSTURE        |            VISIBILITY             |                 NAME                 |           POLICY            |
+-----------------+--------------------------------+-----------------------------------+--------------------------------------+-----------------------------+
| accuknox-agents | file(audit),                   | process,file,network,capabilities | discovery-engine-5b6589755d-jxw7f    |                             |
|                 | capabilities(audit),           |                                   |                                      |                             |
|                 | network(audit)                 |                                   |                                      |                             |
+-----------------+--------------------------------+                                   +--------------------------------------+-----------------------------+
| multiubuntu     | file(audit),                   |                                   | ubuntu-5-deployment-6c6b5fccbb-p5jwf |                             |
|                 | capabilities(block),           |                                   |                                      |                             |
|                 | network(audit)                 |                                   |                                      |                             |
+                 +                                +                                   +--------------------------------------+-----------------------------+
|                 |                                |                                   | ubuntu-1-deployment-5bd4dff469-prz7s | ksp-group-1-proc-path-block |
|                 |                                |                                   |                                      |                             |
|                 |                                |                                   |                                      |                             |
+                 +                                +                                   +--------------------------------------+-----------------------------+
|                 |                                |                                   | ubuntu-4-deployment-868dd7ddb-w92tz  |                             |
|                 |                                |                                   |                                      |                             |
|                 |                                |                                   |                                      |                             |
+                 +                                +                                   +--------------------------------------+-----------------------------+
|                 |                                |                                   | ubuntu-3-deployment-59445d6fb7-nh9gg | ksp-group-1-proc-path-block |
|                 |                                |                                   |                                      |                             |
|                 |                                |                                   |                                      |                             |
+                 +                                +                                   +--------------------------------------+-----------------------------+
|                 |                                |                                   | ubuntu-2-deployment-55c894ddb5-ts8k6 | ksp-group-1-proc-path-block |
|                 |                                |                                   |                                      |                             |
|                 |                                |                                   |                                      |                             |
+-----------------+--------------------------------+                                   +--------------------------------------+-----------------------------+
| wordpress-mysql | file(audit),                   |                                   | mysql-5df4cd65d5-cms6j               |                             |
|                 | capabilities(audit),           |                                   |                                      |                             |
|                 | network(audit)                 |                                   |                                      |                             |
+                 +                                +                                   +--------------------------------------+-----------------------------+
|                 |                                |                                   | wordpress-c4bf5b44b-wsfkg            |                             |
|                 |                                |                                   |                                      |                             |
|                 |                                |                                   |                                      |                             |
+-----------------+--------------------------------+-----------------------------------+--------------------------------------+-----------------------------+```

@nyrahul nyrahul requested a review from daemon1024 March 31, 2023 06:13
daemon1024
daemon1024 requested changes Apr 3, 2023
View reviewed changes
probe/probe.go Outdated Show resolved Hide resolved
probe/probe.go Outdated Show resolved Hide resolved
probe/probe.go Outdated Show resolved Hide resolved
probe/probe.go Outdated Show resolved Hide resolved
daemon1024
daemon1024 reviewed Apr 6, 2023
View reviewed changes
probe/probe.go Outdated Show resolved Hide resolved
DelusionalOptimist
DelusionalOptimist requested changes Apr 13, 2023
View reviewed changes
Copy link
Member

@DelusionalOptimist DelusionalOptimist left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Some nits to address.

probe/probe.go Outdated Show resolved Hide resolved
probe/probe.go Outdated Show resolved Hide resolved
probe/probe.go Outdated Show resolved Hide resolved
@Aryan-sharma11
Added security posture and visibilty column in karmor probe
2136fdd 
Signed-off-by: Aryan-sharma11 <aryan1126.sharma@gmail.com>
DelusionalOptimist
DelusionalOptimist approved these changes May 2, 2023
View reviewed changes
Copy link
Member

@DelusionalOptimist DelusionalOptimist left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

@nyrahul
Copy link
Contributor

nyrahul commented Jun 25, 2023

@Aryan-sharma11 , can we get this merged? Since this doesn't depend on new kubearmor we can make the new release of karmor to get this feature rolled out.

CC: @DelusionalOptimist

@Aryan-sharma11
Copy link
Member Author

Aryan-sharma11 commented Jun 25, 2023 •
edited
Loading

@Aryan-sharma11 , can we get this merged? Since this doesn't depend on new kubearmor we can make the new release of karmor to get this feature rolled out.

CC: @DelusionalOptimist

Yes we can move ahead with this, also can we look into this too, as this PR will provide functionality for JSON output too

@nyrahul nyrahul mentioned this pull request Jun 27, 2023
Merged
@daemon1024 daemon1024 closed this Jun 28, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@DelusionalOptimist DelusionalOptimist DelusionalOptimist approved these changes

@daemon1024 daemon1024 Awaiting requested review from daemon1024

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

karmor probe should show namespace/host visibility and default posture setting
4 participants
@Aryan-sharma11 @nyrahul @daemon1024 @DelusionalOptimist