Configmap sidecar

src/confcom/HISTORY.rst

@@ -7,6 +7,7 @@ Release History
 * making diff mode more robust
 * bugfix for arm template regex
 * updating genpolicy version up through 3.2.0.azl0.genpolicy1
+* adding configmap sidecar
 
 0.3.4
 ++++++

src/confcom/azext_confcom/config.py

@@ -37,6 +37,8 @@
 ACI_FIELD_CONTAINERS_REGO_FRAGMENTS_MINIMUM_SVN = "minimumSvn"
 ACI_FIELD_CONTAINERS_REGO_FRAGMENTS_INCLUDES = "includes"
 ACI_FIELD_CONTAINERS_ID = "id"
+ACI_FIELD_CONTAINERS_CONFIGMAP = "configMap"
+ACI_FIELD_CONTAINERS_CONFIGMAP_KEYVALUE = "keyValuePairs"
 
 ACI_FIELD_CONTAINERS_ARCHITECTURE_KEY = "Architecture"
 ACI_FIELD_CONTAINERS_ARCHITECTURE_VALUE = "amd64"
@@ -118,6 +120,8 @@
 POLICY_FIELD_CONTAINERS_ELEMENTS_REGO_FRAGMENTS_ISS = "iss"
 POLICY_FIELD_CONTAINERS_ELEMENTS_REGO_FRAGMENTS_MINIMUM_SVN = "minimum_svn"
 POLICY_FIELD_CONTAINERS_ELEMENTS_REGO_FRAGMENTS_INCLUDES = "includes"
+POLICY_FIELD_CONTAINERS_ELEMENTS_MOUNTS_CONFIGMAP_LOCATION = "/mnt/configmap"
+POLICY_FIELD_CONTAINERS_ELEMENTS_MOUNTS_CONFIGMAP_TYPE = "emptyDir"
 
 CONFIG_FILE = "./data/internal_config.json"
 

src/confcom/azext_confcom/data/internal_config.json

@@ -169,7 +169,8 @@
         "mcr.microsoft.com/aci/atlas-mount-gitrepo-volume",
         "k8s.gcr.io/pause",
         "mcr.microsoft.com/aci/sc-proxy",
-        "mcr.microsoft.com/aci/vk-metrics-sidecar"
+        "mcr.microsoft.com/aci/vk-metrics-sidecar",
+        "mcr.microsoft.com/aci/configmaps-adapter-linux"
     ],
     "default_rego_fragments": [
         {

src/confcom/azext_confcom/security_policy.py

@@ -28,6 +28,7 @@
     compare_containers,
     get_values_for_params,
     process_mounts,
+    process_configmap,
     extract_probe,
     process_env_vars_from_template,
     get_image_info,
@@ -648,7 +649,8 @@ def load_policy_from_arm_template_str(
                         image_properties, config.ACI_FIELD_TEMPLATE_COMMAND
                     )
                     or [],
-                    config.ACI_FIELD_CONTAINERS_MOUNTS: process_mounts(image_properties, volumes),
+                    config.ACI_FIELD_CONTAINERS_MOUNTS: process_mounts(image_properties, volumes)
+                    + process_configmap(image_properties),
                     config.ACI_FIELD_CONTAINERS_EXEC_PROCESSES: exec_processes
                     + config.DEBUG_MODE_SETTINGS.get("execProcesses")
                     if debug_mode

src/confcom/azext_confcom/template_util.py

@@ -275,6 +275,21 @@ def process_mounts(image_properties: dict, volumes: List[dict]) -> List[Dict[str
     return mounts
 
 
+def process_configmap(image_properties: dict) -> List[Dict[str, str]]:
+    # return empty list if we don't have a configmap
+    if not case_insensitive_dict_get(
+        image_properties, config.ACI_FIELD_CONTAINERS_CONFIGMAP
+    ):
+        return []
+
+    return [{
+                config.ACI_FIELD_CONTAINERS_MOUNTS_TYPE:
+                    config.POLICY_FIELD_CONTAINERS_ELEMENTS_MOUNTS_CONFIGMAP_TYPE,
+                config.ACI_FIELD_CONTAINERS_MOUNTS_PATH:
+                    config.POLICY_FIELD_CONTAINERS_ELEMENTS_MOUNTS_CONFIGMAP_LOCATION,
+                config.ACI_FIELD_CONTAINERS_MOUNTS_READONLY: False,
+            }]
+
 def get_values_for_params(input_parameter_json: dict, all_params: dict) -> Dict[str, Any]:
     # combine the parameter file into a single dictionary with the template
     # parameters

src/confcom/azext_confcom/tests/latest/test_confcom_arm.py

@@ -3627,6 +3627,11 @@ class PolicyGeneratingEdgeCases(unittest.TestCase):
                         "port": "[parameters('port')]"
                         }
                     ],
+                    "configMap": {
+                        "keyValuePairs": {
+                            "key1": "value1"
+                        }
+                    },
                     "command": [
                         "/bin/bash",
                         "-c",
@@ -3688,6 +3693,17 @@ def test_arm_template_with_env_var(self):
         self.assertEqual(env_var, "PORT=parameters('abc')")
         self.assertEqual(regular_image_json[0][config.POLICY_FIELD_CONTAINERS_ID], "alpine:3.16")
 
+    def test_arm_template_config_map_sidecar(self):
+        regular_image_json = json.loads(
+            self.aci_arm_policy.get_serialized_output(
+                output_type=OutputType.RAW, rego_boilerplate=False
+            )
+        )
+
+        mount_locations = list(map(lambda x: x[config.POLICY_FIELD_CONTAINERS_ELEMENTS_MOUNTS_DESTINATION] ,regular_image_json[0][config.POLICY_FIELD_CONTAINERS_ELEMENTS_MOUNTS]))
+
+        self.assertTrue(config.POLICY_FIELD_CONTAINERS_ELEMENTS_MOUNTS_CONFIGMAP_LOCATION in mount_locations)
+
 
 class PolicyGeneratingSecurityContext(unittest.TestCase):
     custom_arm_json = """

src/confcom/samples/sample-template-input.json

@@ -31,6 +31,11 @@
                   "port": 80
                 }
               ],
+              "configMap": {
+                "keyValuePairs": {
+                  "key1": "value1"
+                }
+              },
               "volumeMounts": [
                 {
                   "name": "azurefile",