Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: set probe service health #1903

Merged
merged 2 commits into from
Dec 2, 2024
Merged

feat: set probe service health #1903

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
40e3a86
feat: set probe service health
DelusionalOptimist Nov 26, 2024
d889b73
bugfix: don't panic when set CRI socket is not found
DelusionalOptimist Nov 26, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 30 additions & 18 deletions KubeArmor/core/kubeArmor.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -567,8 +567,6 @@ func KubeArmor() {
// Un-orchestrated workloads
if !dm.K8sEnabled && cfg.GlobalCfg.Policy {

dm.SetContainerNSVisibility()

// Check if cri socket set, if not then auto detect
if cfg.GlobalCfg.CRISocket == "" {
if kl.GetCRISocket("") == "" {
Expand All @@ -577,26 +575,39 @@ func KubeArmor() {
} else {
cfg.GlobalCfg.CRISocket = "unix://" + kl.GetCRISocket("")
}
} else {
// CRI socket supplied by user, check for existence
criSocketPath := strings.TrimPrefix(cfg.GlobalCfg.CRISocket, "unix://")
_, err := os.Stat(criSocketPath)
if err != nil {
enableContainerPolicy = false
dm.Logger.Warnf("Error while looking for CRI socket file %s", err.Error())
}
}

// monitor containers
if strings.Contains(cfg.GlobalCfg.CRISocket, "docker") {
// update already deployed containers
dm.GetAlreadyDeployedDockerContainers()
// monitor docker events
go dm.MonitorDockerEvents()
} else if strings.Contains(cfg.GlobalCfg.CRISocket, "containerd") {
// monitor containerd events
go dm.MonitorContainerdEvents()
} else if strings.Contains(cfg.GlobalCfg.CRISocket, "cri-o") {
// monitor crio events
go dm.MonitorCrioEvents()
} else {
dm.Logger.Warnf("Failed to monitor containers: %s is not a supported CRI socket.", cfg.GlobalCfg.CRISocket)
enableContainerPolicy = false
if enableContainerPolicy {
dm.SetContainerNSVisibility()

// monitor containers
if strings.Contains(cfg.GlobalCfg.CRISocket, "docker") {
// update already deployed containers
dm.GetAlreadyDeployedDockerContainers()
// monitor docker events
go dm.MonitorDockerEvents()
} else if strings.Contains(cfg.GlobalCfg.CRISocket, "containerd") {
// monitor containerd events
go dm.MonitorContainerdEvents()
} else if strings.Contains(cfg.GlobalCfg.CRISocket, "cri-o") {
// monitor crio events
go dm.MonitorCrioEvents()
} else {
enableContainerPolicy = false
dm.Logger.Warnf("Failed to monitor containers: %s is not a supported CRI socket.", cfg.GlobalCfg.CRISocket)
}

dm.Logger.Printf("Using %s for monitoring containers", cfg.GlobalCfg.CRISocket)
}

dm.Logger.Printf("Using %s for monitoring containers", cfg.GlobalCfg.CRISocket)
}

if dm.K8sEnabled && cfg.GlobalCfg.Policy {
Expand Down Expand Up @@ -799,6 +810,7 @@ func KubeArmor() {
pb.RegisterProbeServiceServer(dm.Logger.LogServer, probe)

dm.SetHealthStatus(pb.PolicyService_ServiceDesc.ServiceName, grpc_health_v1.HealthCheckResponse_SERVING)
dm.SetHealthStatus(pb.ProbeService_ServiceDesc.ServiceName, grpc_health_v1.HealthCheckResponse_SERVING)
}

reflection.Register(dm.Logger.LogServer) // Helps grpc clients list out what all svc/endpoints available
Expand Down
Loading