Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(agent): enable falcobaseline for agent version 12.9.x and above #1561

Merged
merged 5 commits into from
Jan 12, 2024
Merged

feat(agent): enable falcobaseline for agent version 12.9.x and above #1561

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
5ac4632
enable falcobaseline for agent version 12.9.x and above
maratsal Jan 11, 2024
76cf0db
add 2 more tests
maratsal Jan 11, 2024
c49da86
check if tag compliant with semantic versioning
maratsal Jan 11, 2024
79cecc3
added helper function instead
maratsal Jan 11, 2024
288dee1
remove duplicate test
maratsal Jan 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion charts/agent/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,4 +30,4 @@ sources:
- https://app.sysdigcloud.com/#/settings/user
- https://github.com/draios/sysdig
type: application
version: 1.19.0
version: 1.19.1
14 changes: 14 additions & 0 deletions charts/agent/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -411,6 +411,12 @@ agent config to prevent a backend push from enabling them after installation.
"secure_audit_streams") }}
{{- $_ := set $secureConfig $secureFeature (dict "enabled" false) }}
{{- end }}
{{ else if include "agent.enableFalcoBaselineSecureLight" . }}
{{- range $secureFeature := (list
"memdump"
"network_topology") }}
{{- $_ := set $secureConfig $secureFeature (dict "enabled" false) }}
{{- end }}
{{ else if $secureLightMode }}
{{- range $secureFeature := (list
"drift_control"
Expand Down Expand Up @@ -531,3 +537,11 @@ true
{{- end }}
{{- end }}
{{- end }}

{{- define "agent.enableFalcoBaselineSecureLight" }}
{{- if regexMatch "^v?([0-9]+)(\\.[0-9]+)?(\\.[0-9]+)?(-([0-9A-Za-z\\-]+(\\.[0-9A-Za-z\\-]+)*))?(\\+([0-9A-Za-z\\-]+(\\.[0-9A-Za-z\\-]+)*))?$" .Values.image.tag }}
{{- if semverCompare ">= 12.19.0-0" .Values.image.tag }}
{{- printf "true" -}}
{{- end }}
{{- end }}
{{- end }}
28 changes: 0 additions & 28 deletions charts/agent/tests/drift_prevention_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,20 +25,6 @@ tests:
enabled: false
template: templates/configmap.yaml

- it: Drift prevention must be false when is secure_light
set:
sysdig:
settings:
feature:
mode: secure_light
asserts:
- matchRegex:
path: data['dragent.yaml']
pattern: |-
drift_killer:
enabled: false
template: templates/configmap.yaml

- it: Drift prevention must be false when is running on GKE Autopilot
set:
gke:
Expand Down Expand Up @@ -115,20 +101,6 @@ tests:
enabled: false
template: templates/configmap.yaml

- it: Drift control must be false when is secure_light
set:
sysdig:
settings:
feature:
mode: secure_light
asserts:
- matchRegex:
path: data['dragent.yaml']
pattern: |-
drift_control:
enabled: false
template: templates/configmap.yaml

- it: Drift control must be false when is running on GKE Autopilot
set:
gke:
Expand Down
30 changes: 0 additions & 30 deletions charts/agent/tests/secure_enable_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,21 +42,6 @@ tests:
pattern: |-
commandlines_capture:
enabled: false
- matchRegex:
path: data['dragent.yaml']
pattern: |-
drift_control:
enabled: false
- matchRegex:
path: data['dragent.yaml']
pattern: |-
drift_killer:
enabled: false
- matchRegex:
path: data['dragent.yaml']
pattern: |-
falcobaseline:
enabled: false
- matchRegex:
path: data['dragent.yaml']
pattern: |-
Expand Down Expand Up @@ -141,21 +126,6 @@ tests:
pattern: |-
statsd:
enabled: false
- matchRegex:
path: data['dragent.yaml']
pattern: |-
drift_control:
enabled: false
- matchRegex:
path: data['dragent.yaml']
pattern: |-
drift_killer:
enabled: false
- matchRegex:
path: data['dragent.yaml']
pattern: |-
falcobaseline:
enabled: false
- matchRegex:
path: data['dragent.yaml']
pattern: |-
Expand Down
198 changes: 198 additions & 0 deletions charts/agent/tests/secure_light_config_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,198 @@
suite: Testing seetings for secure light mode
templates:
- configmap.yaml
tests:
- it: Testing if certain settings set to false for agent version =< 12.18.x
set:
image:
tag: 12.18.1
sysdig:
accessKey: AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE
settings:
feature:
mode: secure_light
secure:
enabled: true
asserts:
- matchRegex:
path: data['dragent.yaml']
pattern: |-
drift_control:
enabled: false
- matchRegex:
path: data['dragent.yaml']
pattern: |-
drift_killer:
enabled: false
- matchRegex:
path: data['dragent.yaml']
pattern: |-
falcobaseline:
enabled: false
- matchRegex:
path: data['dragent.yaml']
pattern: |-
memdump:
enabled: false
- matchRegex:
path: data['dragent.yaml']
pattern: |-
network_topology:
enabled: false
template: configmap.yaml

- it: Testing if certain settings set to false for agent version = 12.16.3
set:
image:
tag: 12.16.3
sysdig:
accessKey: AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE
settings:
feature:
mode: secure_light
secure:
enabled: true
asserts:
- matchRegex:
path: data['dragent.yaml']
pattern: |-
drift_control:
enabled: false
- matchRegex:
path: data['dragent.yaml']
pattern: |-
drift_killer:
enabled: false
- matchRegex:
path: data['dragent.yaml']
pattern: |-
falcobaseline:
enabled: false
- matchRegex:
path: data['dragent.yaml']
pattern: |-
memdump:
enabled: false
- matchRegex:
path: data['dragent.yaml']
pattern: |-
network_topology:
enabled: false
template: configmap.yaml

- it: Testing if certain settings set to false for agent version latest
set:
image:
tag: latest
sysdig:
accessKey: AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE
settings:
feature:
mode: secure_light
secure:
enabled: true
asserts:
- matchRegex:
path: data['dragent.yaml']
pattern: |-
drift_control:
enabled: false
- matchRegex:
path: data['dragent.yaml']
pattern: |-
drift_killer:
enabled: false
- matchRegex:
path: data['dragent.yaml']
pattern: |-
falcobaseline:
enabled: false
- matchRegex:
path: data['dragent.yaml']
pattern: |-
memdump:
enabled: false
- matchRegex:
path: data['dragent.yaml']
pattern: |-
network_topology:
enabled: false
template: configmap.yaml

- it: Testing if certain settings set to false for agent version > 12.18.x
set:
image:
tag: 12.19.0
sysdig:
accessKey: AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE
settings:
feature:
mode: secure_light
secure:
enabled: true
asserts:
- notMatchRegex:
path: data['dragent.yaml']
pattern: |-
drift_control:
enabled: false
- notMatchRegex:
path: data['dragent.yaml']
pattern: |-
drift_killer:
enabled: false
- notMatchRegex:
path: data['dragent.yaml']
pattern: |-
falcobaseline:
enabled: false
- matchRegex:
path: data['dragent.yaml']
pattern: |-
memdump:
enabled: false
- matchRegex:
path: data['dragent.yaml']
pattern: |-
network_topology:
enabled: false
template: configmap.yaml

- it: Testing if certain settings set to false for agent version 12.20.1
set:
image:
tag: 12.20.1
sysdig:
accessKey: AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE
settings:
feature:
mode: secure_light
secure:
enabled: true
asserts:
- notMatchRegex:
path: data['dragent.yaml']
pattern: |-
drift_control:
enabled: false
- notMatchRegex:
path: data['dragent.yaml']
pattern: |-
drift_killer:
enabled: false
- notMatchRegex:
path: data['dragent.yaml']
pattern: |-
falcobaseline:
enabled: false
- matchRegex:
path: data['dragent.yaml']
pattern: |-
memdump:
enabled: false
- matchRegex:
path: data['dragent.yaml']
pattern: |-
network_topology:
enabled: false
template: configmap.yaml
Loading