Skip to content

Commit cf30839

Browse files
fcracker79fcracker79
committed
feat(response actions) white list for host and cluster shield config map [SSPROD-58246]
1 parent 9577c0c commit cf30839

4 files changed

Lines changed: 149 additions & 4 deletions

File tree

‎charts/shield/templates/cluster/_config.tpl‎

Lines changed: 25 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@
1313
(dict "kubernetes_metadata" (dig "kubernetes_metadata" nil .Values.features ))
1414
(dict "monitor" (pick $monitorFeature "kube_state_metrics" "kubernetes_events"))
1515
(dict "investigations" (pick $investigationsFeature "investigations" "network_security"))
16-
(dict "respond" (pick $respondFeature "response_actions"))
1716
-}}
1817
{{- $featuresConfig := dict -}}
1918
{{- range $feature := $features }}
@@ -22,7 +21,8 @@
2221
{{- end -}}
2322
{{- end }}
2423
{{- $_ := set $featuresConfig.container_vulnerability_management "in_use" .Values.features.vulnerability_management.in_use -}}
25-
{{- $_ := set $featuresConfig.respond "response_actions" (pick $featuresConfig.respond.response_actions "enabled" "queue_length" "timeout" "cluster") -}}
24+
{{- $respond := (include "cluster.configmap.respond" .) | fromYaml }}
25+
{{- $_ := set $featuresConfig "respond" $respond -}}
2626
{{- $additionalFeaturesSettings := (dig "features" (dict) .Values.cluster.additional_settings) -}}
2727
{{- (mergeOverwrite $featuresConfig $additionalFeaturesSettings) | toYaml -}}
2828
{{- end }}
@@ -232,3 +232,26 @@ In the future we will have more complex logic to determine if the action is enab
232232
{{- define "cluster.response_actions.delete_volume_snapshot.enabled" }}
233233
{{- include "cluster.response_actions_enabled" . }}
234234
{{- end}}
235+
236+
237+
{{- define "cluster.configmap.respond" }}
238+
{{- $response_actions_feature := (dig "respond" "response_actions" nil .Values.features) }}
239+
{{- $base_fields := list "enabled" "queue_length" "timeout" "cluster" }}
240+
{{- $actions := list
241+
"rollout_restart"
242+
"delete_pod"
243+
"isolate_network"
244+
"delete_network_policy"
245+
"get_logs"
246+
"volume_snapshot"
247+
"delete_volume_snapshot"
248+
}}
249+
{{- $fields := (concat $base_fields $actions) }}
250+
{{- $response_actions := dict }}
251+
{{- range $field := $fields }}
252+
{{- if hasKey $response_actions_feature $field}}
253+
{{- $response_actions := set $response_actions $field (index $response_actions_feature $field) }}
254+
{{- end}}
255+
{{- end }}
256+
{{- dict "response_actions" $response_actions | toYaml -}}
257+
{{- end }}

‎charts/shield/templates/host/_configmap_helpers.tpl‎

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,28 @@
1313
{{- $featureRespond := get . (include "host.respond_key" .) }}
1414
{{- $rapid_response := dict "rapid_response" (pick $featureRespond.rapid_response "enabled") }}
1515
{{- $respond = merge $respond $rapid_response -}}
16-
{{- $respond = merge $respond (pick .respond "response_actions") -}}
17-
{{- dict "respond" $respond | toYaml }}
16+
{{- $response_actions := index $featureRespond "response_actions" }}
17+
{{- $host_response_actions := dict }}
18+
{{- $base_fields := list "enabled" "queue_length" "timeout" "host" }}
19+
{{- $actions := list
20+
"kill_process"
21+
"file_acquire"
22+
"file_quarantine"
23+
"file_unquarantine"
24+
"kill_container"
25+
"stop_container"
26+
"start_container"
27+
"pause_container"
28+
"unpause_container"
29+
}}
30+
{{- $fields := (concat $base_fields $actions) }}
31+
{{- range $field := $fields }}
32+
{{- if hasKey $response_actions $field}}
33+
{{- $host_response_actions := set $host_response_actions $field (index $response_actions $field) }}
34+
{{- end}}
35+
{{- end }}
36+
{{- $respond = merge $respond (dict "response_actions" $host_response_actions) }}
37+
{{ dict "respond" $respond | toYaml }}
1838
{{- end }}
1939

2040
{{- define "host.configmap.detections" }}

‎charts/shield/tests/cluster/configmap_test.yaml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -246,6 +246,38 @@ tests:
246246
timeout: 10
247247
cluster:
248248
volume_snapshot_class: "a-volume-snapshot-class"
249+
rollout_restart:
250+
trigger: all
251+
delete_pod:
252+
trigger: none
253+
isolate_network:
254+
trigger: all
255+
delete_network_policy:
256+
trigger: none
257+
get_logs:
258+
trigger: all
259+
volume_snapshot:
260+
trigger: none
261+
delete_volume_snapshot:
262+
trigger: all
263+
kill_process:
264+
trigger: none
265+
file_quarantine:
266+
trigger: all
267+
file_unquarantine:
268+
trigger: all
269+
file_acquire:
270+
trigger: none
271+
kill_container:
272+
trigger: all
273+
stop_container:
274+
trigger: none
275+
start_container:
276+
trigger: all
277+
pause_container:
278+
trigger: none
279+
unpause_container:
280+
trigger: all
249281
another_config_not_relevant: "not-relevant"
250282
asserts:
251283
- exists:
@@ -312,9 +344,23 @@ tests:
312344
response_actions:
313345
cluster:
314346
volume_snapshot_class: a-volume-snapshot-class
347+
delete_network_policy:
348+
trigger: none
349+
delete_pod:
350+
trigger: none
351+
delete_volume_snapshot:
352+
trigger: all
315353
enabled: true
354+
get_logs:
355+
trigger: all
356+
isolate_network:
357+
trigger: all
316358
queue_length: 1000
359+
rollout_restart:
360+
trigger: all
317361
timeout: 10
362+
volume_snapshot:
363+
trigger: none
318364
319365
- it: Sets NATS Url and Lock Name when Container Vulnerability Management is enabled
320366
set:

‎charts/shield/tests/host/configmap-host-shield-config_test.yaml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -294,6 +294,42 @@ tests:
294294
respond:
295295
response_actions:
296296
enabled: true
297+
queue_length: 1000
298+
timeout: 10
299+
cluster:
300+
volume_snapshot_class: "a-volume-snapshot-class"
301+
rollout_restart:
302+
trigger: all
303+
delete_pod:
304+
trigger: none
305+
isolate_network:
306+
trigger: all
307+
delete_network_policy:
308+
trigger: none
309+
get_logs:
310+
trigger: all
311+
volume_snapshot:
312+
trigger: none
313+
delete_volume_snapshot:
314+
trigger: all
315+
kill_process:
316+
trigger: none
317+
file_quarantine:
318+
trigger: all
319+
file_unquarantine:
320+
trigger: all
321+
file_acquire:
322+
trigger: none
323+
kill_container:
324+
trigger: all
325+
stop_container:
326+
trigger: none
327+
start_container:
328+
trigger: all
329+
pause_container:
330+
trigger: none
331+
unpause_container:
332+
trigger: all
297333
asserts:
298334
- matchRegex:
299335
path: data['host-shield.yaml']
@@ -310,6 +346,26 @@ tests:
310346
enabled: false
311347
response_actions:
312348
enabled: true
349+
file_acquire:
350+
trigger: none
351+
file_quarantine:
352+
trigger: all
353+
file_unquarantine:
354+
trigger: all
355+
kill_container:
356+
trigger: all
357+
kill_process:
358+
trigger: none
359+
pause_container:
360+
trigger: none
361+
queue_length: 1000
362+
start_container:
363+
trigger: all
364+
stop_container:
365+
trigger: none
366+
timeout: 10
367+
unpause_container:
368+
trigger: all
313369
vulnerability_management:
314370
host_vulnerability_management:
315371
enabled: false

0 commit comments

Comments
 (0)