Merge pull request #514 from Ankurk99/latest_observability

support observability for containerized workloads

.gitignore

@@ -12,4 +12,5 @@ src/report*.json
 kubearmor_policies*.yaml
 cilium_policies*.yaml
 knox_net_policies*.yaml
-src/accuknox.db
+src/accuknox*.db*
+

src/cluster/clusterResourceHandler.go

@@ -27,6 +27,11 @@ func GetPods(clusterName string) []types.Pod {
 		PodName:   types.PolicyDiscoveryVMPodName,
 	})
 
+	pods = append(pods, types.Pod{
+		Namespace: types.PolicyDiscoveryContainerNamespace,
+		PodName:   types.PolicyDiscoveryContainerPodName,
+	})
+
 	return pods
 }
 

src/libs/common.go

@@ -404,10 +404,6 @@ func writeYamlByte(f *os.File, b []byte) {
 		log.Error().Msg(err.Error())
 	}
 
-	if _, err := f.WriteString("---\n"); err != nil {
-		log.Error().Msg(err.Error())
-	}
-
 	if err := f.Sync(); err != nil {
 		log.Error().Msg(err.Error())
 	}

src/plugin/kubearmor.go

@@ -293,6 +293,12 @@ func ConvertKubeArmorLogToKnoxSystemLog(relayLog *pb.Log) (types.KnoxSystemLog,
 		knoxSystemLog.PodName = types.PolicyDiscoveryVMPodName
 	}
 
+	if relayLog.Type == "ContainerLog" {
+		knoxSystemLog.ContainerName = relayLog.ContainerName
+		knoxSystemLog.Namespace = types.PolicyDiscoveryContainerNamespace
+		knoxSystemLog.PodName = types.PolicyDiscoveryContainerPodName
+	}
+
 	return knoxSystemLog, nil
 }
 

src/systempolicy/helperFunctions.go

@@ -115,7 +115,7 @@ func FilterSystemLogsByConfig(logs []types.KnoxSystemLog, pods []types.Pod) []ty
 			}
 
 			// 2. check pod labels
-			if (checkItems&2 > 0) && (log.Namespace == types.PolicyDiscoveryVMNamespace || containLabelByConfiguration(filter.Labels, getLabelsFromPod(log.PodName, pods))) {
+			if (checkItems&2 > 0) && (log.Namespace == types.PolicyDiscoveryVMNamespace || log.Namespace == types.PolicyDiscoveryContainerNamespace || containLabelByConfiguration(filter.Labels, getLabelsFromPod(log.PodName, pods))) {
 				checkedItems = checkedItems | 1<<1
 			}
 
@@ -156,7 +156,7 @@ func FilterSystemLogsByConfig(logs []types.KnoxSystemLog, pods []types.Pod) []ty
 func GetWPFSSources() []string {
 	res, _, err := libs.GetWorkloadProcessFileSet(CfgDB, types.WorkloadProcessFileSet{})
 	if err != nil {
-		log.Error().Msgf("cudnot fetch WPFS err=%s", err.Error())
+		log.Error().Msgf("could not fetch WPFS err=%s", err.Error())
 		return nil
 	}
 

src/systempolicy/systemPolicy.go

@@ -265,7 +265,7 @@ func populateKnoxSysPolicyFromWPFSDb(namespace, clustername, labels, fromsource
 	}
 	res, pnMap, err := libs.GetWorkloadProcessFileSet(CfgDB, wpfs)
 	if err != nil {
-		log.Error().Msgf("cudnot fetch WPFS err=%s", err.Error())
+		log.Error().Msgf("could not fetch WPFS err=%s", err.Error())
 		return nil
 	}
 	log.Info().Msgf("found %d WPFS records", len(res))
@@ -1261,9 +1261,14 @@ func GenFileSetForAllPodsInCluster(clusterName string, pods []types.Pod, settype
 		wpfs.SetType = settype
 		labels, err := GetPodLabels(slog.ClusterName, slog.PodName, slog.Namespace, pods)
 		if err != nil {
-			log.Error().Msgf("cudnot get pod labels for podname=%s ns=%s", slog.PodName, slog.Namespace)
+			log.Error().Msgf("could not get pod labels for podname=%s ns=%s", slog.PodName, slog.Namespace)
 			continue
 		}
+
+		if slog.Namespace == types.PolicyDiscoveryContainerNamespace {
+			labels = append(labels, "kubearmor.io/container.name="+slog.ContainerName)
+		}
+
 		wpfs.Labels = strings.Join(labels[:], ",")
 
 		if isNetworkOp {
@@ -1339,7 +1344,6 @@ func DiscoverSystemPolicyMain() {
 	}
 
 	PopulateSystemPoliciesFromSystemLogs(allSystemkLogs)
-
 }
 
 // ==================================== //

src/types/constants.go

@@ -1,11 +1,15 @@
 package types
 
 const (
-	// Kubearmor VM
+	// KubeArmor VM
 	PolicyDiscoveryVMNamespace = "accuknox-vm-namespace"
 	PolicyDiscoveryVMPodName   = "accuknox-vm-podname"
 
-	// Kubearmor k8s
+	// KubeArmor container
+	PolicyDiscoveryContainerNamespace = "container_namespace"
+	PolicyDiscoveryContainerPodName   = "container_podname"
+
+	// KubeArmor k8s
 	PreConfiguredKubearmorRule = "/lib/x86_64-linux-gnu/"
 
 	// RecordSeparator - DB separator flag