Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(core): add support for kata and confidential containers #1888

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat(core): add support for kata and confidential containers #1888

wants to merge 1 commit into from

Conversation

rootxrishabh
Copy link
Member

Purpose of PR?:
This PR introduces support for kata and confidential containers.

Fixes #1340

Does this PR introduce a breaking change?
No

If the changes in this PR are manually verified, list down the scenarios covered::

Additional information for reviewer? :
Mention if this PR is part of any design or a continuation of previous PRs

Checklist:

  • Bug fix. Fixes #
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update
  • PR Title follows the convention of <type>(<scope>): <subject>
  • Commit has unit tests
  • Commit has integration tests

@rootxrishabh rootxrishabh added the enhancement New feature or request label Nov 6, 2024
@rootxrishabh
Copy link
Member Author

#1793

@rootxrishabh
Copy link
Member Author

Enforcement confirmed on CoCo + Kubearmor VM setup
https://asciinema.org/a/RAAG15qLZMLBvdWPaifBAV71d

bpradipt
bpradipt reviewed Nov 6, 2024
View reviewed changes
KubeArmor/config/config.go Outdated Show resolved Hide resolved
daemon1024
daemon1024 requested changes Nov 7, 2024
View reviewed changes
Copy link
Member

@daemon1024 daemon1024 left a comment •
edited by rootxrishabh
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

More pending work

  • Use custom directory for backup of policies
  • Refactor and streamline endpoint creation for unorchestrated workloads.

KubeArmor/core/hookHandler.go Outdated Show resolved Hide resolved
KubeArmor/core/hookHandler.go Outdated Show resolved Hide resolved
@daemon1024
Copy link
Member

daemon1024 commented Nov 7, 2024 •
edited by rootxrishabh
Loading

  • support custom policy backup path, so we can adapt to using writeable path
  • support storing policies in YAML rather than JSON.

@rootxrishabh
Copy link
Member Author

@daemon1024 @DelusionalOptimist, need your thoughts on custom restore path -

  1. Kubearmor will panic if the user specifies a path which contains files other than json. Should we add a check here? If yes, we could fall back top /opt/kubearmor/policies
  2. Should we create the user specified path in case it does not exist? We can fall back to /opt/kubearmor/policies in case the path is privileged.

@rootxrishabh rootxrishabh force-pushed the addSupportForKataAndConfidentialContainers branch from 0449317 to 8a421fb Compare January 6, 2025 08:33
daemon1024
daemon1024 requested changes Jan 16, 2025
View reviewed changes
Copy link
Member

@daemon1024 daemon1024 left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will need to handle refactor in #1906 #1674
Let's handle conflicts as well.

I don't see CRIO code handled in here?

Please find review inline

KubeArmor/core/hookHandler.go Outdated
Comment on lines 96 to 99

func (dm *KubeArmorDaemon) handleContainerCreate(container tp.Container) {
endPoint := tp.EndPoint{}

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's keep this function in a independent file, this is unrelated to just hook and is being used in every handler

Copy link
Member Author

@rootxrishabh rootxrishabh Jan 21, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can't shift the entire function. Different handler functions have differences. We could create functions for same parts of the function. WDYT?

KubeArmor/core/kubeArmor.go Show resolved Hide resolved
KubeArmor/core/hookHandler.go Show resolved Hide resolved
KubeArmor/core/containerdHandler.go Show resolved Hide resolved
@rootxrishabh rootxrishabh force-pushed the addSupportForKataAndConfidentialContainers branch 3 times, most recently from c9fda2c to 64bde3f Compare January 21, 2025 16:54
@rootxrishabh
Copy link
Member Author

CRIO code refactored for populating pidNS and mntNS maps.

daemon1024
daemon1024 requested changes Jan 23, 2025
View reviewed changes
KubeArmor/core/hookHandler.go Outdated Show resolved Hide resolved
@rootxrishabh rootxrishabh force-pushed the addSupportForKataAndConfidentialContainers branch from 64bde3f to 8f5c2c1 Compare January 23, 2025 18:36
@rootxrishabh
feat(core): add support for kata and confidential containers
6ae831d 
Signed-off-by: rootxrishabh <[email protected]>

Check kind instead of namespace for restoring policies

Signed-off-by: Rishabh Soni <[email protected]>

Add support for custom policy backup path

Signed-off-by: Rishabh Soni <[email protected]>

Restore and Backup policies in YAML instead of JSON

Signed-off-by: Rishabh Soni <[email protected]>

Refactor: Endpoint and map creation

Signed-off-by: Rishabh Soni <[email protected]>
Signed-off-by: rootxrishabh <[email protected]>
@rootxrishabh rootxrishabh force-pushed the addSupportForKataAndConfidentialContainers branch from 8f5c2c1 to 6ae831d Compare January 23, 2025 18:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@bpradipt bpradipt bpradipt left review comments

@daemon1024 daemon1024 daemon1024 requested changes

@Aryan-sharma11 Aryan-sharma11 Awaiting requested review from Aryan-sharma11

@Prateeknandle Prateeknandle Awaiting requested review from Prateeknandle

@rksharma95 rksharma95 Awaiting requested review from rksharma95

Requested changes must be addressed to merge this pull request.

Assignees
No one assigned
Labels
enhancement New feature or request
Projects
Release v1.5
Status: P1- PR Ready for review
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

check support for Kata containers
3 participants
@rootxrishabh @daemon1024 @bpradipt