Skip to content

Commit 67b1b83

Browse files
minsiyangminsiyang
committed
fix: return pod image metadata for unsupported workload
1 parent 27e446b commit 67b1b83

File tree

3 files changed

+392
-7
lines changed

3 files changed

+392
-7
lines changed

‎src/supervisor/metadata-extractor.ts‎

Lines changed: 31 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -26,12 +26,14 @@ export function buildImageMetadata(
2626
const { name, namespace, labels, annotations, uid } = objectMeta;
2727

2828
const containerNameToSpec: { [key: string]: V1Container } = {};
29-
for (const container of podSpec.containers) {
30-
delete container.args;
31-
delete container.env;
32-
delete container.command;
33-
//! would container.envFrom also include sensitive data?
34-
containerNameToSpec[container.name] = container;
29+
if (podSpec.containers) {
30+
for (const container of podSpec.containers) {
31+
delete container.args;
32+
delete container.env;
33+
delete container.command;
34+
//! would container.envFrom also include sensitive data?
35+
containerNameToSpec[container.name] = container;
36+
}
3537
}
3638

3739
const containerNameToStatus: { [key: string]: V1ContainerStatus } = {};
@@ -212,6 +214,29 @@ export async function buildMetadataForWorkload(
212214
pod.metadata.namespace,
213215
);
214216

217+
const hasNodeOwnerRef = pod.metadata?.ownerReferences?.find(
218+
(owner) => owner.kind === 'Node',
219+
);
220+
221+
if (hasNodeOwnerRef && podOwner === undefined) {
222+
logger.info(
223+
{ podMetadata: pod.metadata },
224+
'pod associated with owner, but owner not found. returning pod metadata.',
225+
);
226+
return buildImageMetadata(
227+
{
228+
kind: 'Pod', // Reading pod.kind may be undefined, so use this
229+
objectMeta: pod.metadata,
230+
// Notice the pod.metadata repeats; this is because pods
231+
// do not have the "template" property.
232+
specMeta: pod.metadata,
233+
ownerRefs: [],
234+
podSpec: pod.spec,
235+
},
236+
pod.status.containerStatuses,
237+
);
238+
}
239+
215240
if (podOwner === undefined) {
216241
logger.info(
217242
{ podMetadata: pod.metadata },

‎test/fixtures/sidecar-containers/node-pod.yaml‎

Lines changed: 322 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,322 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
annotations:
5+
json_logs: "true"
6+
prometheus.io/scrape: "false"
7+
sidecar.istio.io/status: '{"version":"8e87d1a416a399be3d9fcf1451585bc0f8cc55e28ea8dc3367a0a104473561ef","initContainers":["istio-init"],"containers":["istio-proxy"],"volumes":["istio-envoy","istio-certs"],"imagePullSecrets":null}'
8+
creationTimestamp: "2019-11-25T13:23:51Z"
9+
finalizers:
10+
- finalizers.gatekeeper.sh/sync
11+
generateName: hello-world-69df7cfb84-
12+
labels:
13+
app: hello-world
14+
pod-template-hash: 69df7cfb84
15+
name: hello-world-69df7cfb84-whpp5
16+
namespace: security-tools
17+
ownerReferences:
18+
- apiVersion: apps/v1
19+
blockOwnerDeletion: true
20+
controller: true
21+
kind: Node
22+
name: hello-world-69df7cfb84
23+
uid: d2022c91-0f86-11ea-86a6-4201c0a8801a
24+
resourceVersion: "55787962"
25+
selfLink: /api/v1/namespaces/security-tools/pods/hello-world-69df7cfb84-whpp5
26+
uid: d208d970-0f86-11ea-86a6-4201c0a8801a
27+
spec:
28+
containers:
29+
- image: eu.gcr.io/cookie/hello-world:1.20191125.132107-4664980
30+
imagePullPolicy: IfNotPresent
31+
livenessProbe:
32+
failureThreshold: 3
33+
httpGet:
34+
path: /hello
35+
port: 8080
36+
scheme: HTTP
37+
initialDelaySeconds: 5
38+
periodSeconds: 5
39+
successThreshold: 1
40+
timeoutSeconds: 5
41+
name: hello-world
42+
ports:
43+
- containerPort: 8080
44+
name: http
45+
protocol: TCP
46+
readinessProbe:
47+
failureThreshold: 3
48+
httpGet:
49+
path: /hello
50+
port: 8080
51+
scheme: HTTP
52+
initialDelaySeconds: 5
53+
periodSeconds: 5
54+
successThreshold: 1
55+
timeoutSeconds: 5
56+
resources:
57+
limits:
58+
cpu: "2"
59+
memory: 512Mi
60+
requests:
61+
cpu: "1"
62+
memory: 128Mi
63+
terminationMessagePath: /dev/termination-log
64+
terminationMessagePolicy: File
65+
volumeMounts:
66+
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
67+
name: hello-world-token-dltwl
68+
readOnly: true
69+
- args:
70+
- proxy
71+
- sidecar
72+
- --domain
73+
- $(POD_NAMESPACE).svc.cluster.local
74+
- --configPath
75+
- /etc/istio/proxy
76+
- --binaryPath
77+
- /usr/local/bin/envoy
78+
- --serviceCluster
79+
- hello-world.$(POD_NAMESPACE)
80+
- --drainDuration
81+
- 45s
82+
- --parentShutdownDuration
83+
- 1m0s
84+
- --discoveryAddress
85+
- istio-pilot.istio-system:15010
86+
- --zipkinAddress
87+
- zipkin.istio-system:9411
88+
- --dnsRefreshRate
89+
- 300s
90+
- --connectTimeout
91+
- 10s
92+
- --proxyAdminPort
93+
- "15000"
94+
- --concurrency
95+
- "2"
96+
- --controlPlaneAuthPolicy
97+
- NONE
98+
- --statusPort
99+
- "15020"
100+
- --applicationPorts
101+
- "8080"
102+
env:
103+
- name: POD_NAME
104+
valueFrom:
105+
fieldRef:
106+
apiVersion: v1
107+
fieldPath: metadata.name
108+
- name: ISTIO_META_POD_PORTS
109+
value: |-
110+
[
111+
{"name":"http","containerPort":8080,"protocol":"TCP"}
112+
]
113+
- name: ISTIO_META_CLUSTER_ID
114+
value: Kubernetes
115+
- name: POD_NAMESPACE
116+
valueFrom:
117+
fieldRef:
118+
apiVersion: v1
119+
fieldPath: metadata.namespace
120+
- name: INSTANCE_IP
121+
valueFrom:
122+
fieldRef:
123+
apiVersion: v1
124+
fieldPath: status.podIP
125+
- name: SERVICE_ACCOUNT
126+
valueFrom:
127+
fieldRef:
128+
apiVersion: v1
129+
fieldPath: spec.serviceAccountName
130+
- name: ISTIO_META_POD_NAME
131+
valueFrom:
132+
fieldRef:
133+
apiVersion: v1
134+
fieldPath: metadata.name
135+
- name: ISTIO_META_CONFIG_NAMESPACE
136+
valueFrom:
137+
fieldRef:
138+
apiVersion: v1
139+
fieldPath: metadata.namespace
140+
- name: SDS_ENABLED
141+
value: "false"
142+
- name: ISTIO_META_INTERCEPTION_MODE
143+
value: REDIRECT
144+
- name: ISTIO_META_INCLUDE_INBOUND_PORTS
145+
value: "8080"
146+
- name: ISTIO_METAJSON_ANNOTATIONS
147+
value: |
148+
{"json_logs":"true","prometheus.io/scrape":"false"}
149+
- name: ISTIO_METAJSON_LABELS
150+
value: |
151+
{"app":"hello-world","pod-template-hash":"69df7cfb84"}
152+
- name: ISTIO_META_WORKLOAD_NAME
153+
value: hello-world
154+
- name: ISTIO_META_OWNER
155+
value: kubernetes://api/apps/v1/namespaces/security-tools/deployments/hello-world
156+
image: docker.io/istio/proxyv2:1.3.4
157+
imagePullPolicy: IfNotPresent
158+
name: istio-proxy
159+
ports:
160+
- containerPort: 15090
161+
name: http-envoy-prom
162+
protocol: TCP
163+
readinessProbe:
164+
failureThreshold: 30
165+
httpGet:
166+
path: /healthz/ready
167+
port: 15020
168+
scheme: HTTP
169+
initialDelaySeconds: 1
170+
periodSeconds: 2
171+
successThreshold: 1
172+
timeoutSeconds: 1
173+
resources:
174+
limits:
175+
cpu: "2"
176+
memory: 1Gi
177+
requests:
178+
cpu: 100m
179+
memory: 128Mi
180+
securityContext:
181+
readOnlyRootFilesystem: true
182+
runAsUser: 1337
183+
terminationMessagePath: /dev/termination-log
184+
terminationMessagePolicy: File
185+
volumeMounts:
186+
- mountPath: /etc/istio/proxy
187+
name: istio-envoy
188+
- mountPath: /etc/certs/
189+
name: istio-certs
190+
readOnly: true
191+
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
192+
name: hello-world-token-dltwl
193+
readOnly: true
194+
dnsPolicy: ClusterFirst
195+
enableServiceLinks: true
196+
initContainers:
197+
- args:
198+
- -p
199+
- "15001"
200+
- -z
201+
- "15006"
202+
- -u
203+
- "1337"
204+
- -m
205+
- REDIRECT
206+
- -i
207+
- '*'
208+
- -x
209+
- ""
210+
- -b
211+
- '*'
212+
- -d
213+
- "15020"
214+
image: docker.io/istio/proxy_init:1.3.4
215+
imagePullPolicy: IfNotPresent
216+
name: istio-init
217+
resources:
218+
limits:
219+
cpu: 100m
220+
memory: 50Mi
221+
requests:
222+
cpu: 10m
223+
memory: 10Mi
224+
securityContext:
225+
capabilities:
226+
add:
227+
- NET_ADMIN
228+
runAsNonRoot: false
229+
runAsUser: 0
230+
terminationMessagePath: /dev/termination-log
231+
terminationMessagePolicy: File
232+
nodeName: gke-staging-1-n1-standard-32-93d1d8b9-6t57
233+
priority: 0
234+
restartPolicy: Always
235+
schedulerName: default-scheduler
236+
securityContext:
237+
fsGroup: 40500
238+
runAsUser: 40500
239+
serviceAccount: hello-world
240+
serviceAccountName: hello-world
241+
terminationGracePeriodSeconds: 30
242+
tolerations:
243+
- effect: NoExecute
244+
key: node.kubernetes.io/not-ready
245+
operator: Exists
246+
tolerationSeconds: 300
247+
- effect: NoExecute
248+
key: node.kubernetes.io/unreachable
249+
operator: Exists
250+
tolerationSeconds: 300
251+
volumes:
252+
- name: hello-world-token-dltwl
253+
secret:
254+
defaultMode: 420
255+
secretName: hello-world-token-dltwl
256+
- emptyDir:
257+
medium: Memory
258+
name: istio-envoy
259+
- name: istio-certs
260+
secret:
261+
defaultMode: 420
262+
optional: true
263+
secretName: istio.hello-world
264+
status:
265+
conditions:
266+
- lastProbeTime: null
267+
lastTransitionTime: "2019-11-25T13:23:54Z"
268+
status: "True"
269+
type: Initialized
270+
- lastProbeTime: null
271+
lastTransitionTime: "2019-11-25T13:24:10Z"
272+
status: "True"
273+
type: Ready
274+
- lastProbeTime: null
275+
lastTransitionTime: "2019-11-25T13:24:10Z"
276+
status: "True"
277+
type: ContainersReady
278+
- lastProbeTime: null
279+
lastTransitionTime: "2019-11-25T13:23:51Z"
280+
status: "True"
281+
type: PodScheduled
282+
containerStatuses:
283+
- containerID: docker://475bb2de6388165714fcfe0ee0c3c6270a9aafef39c035db56d9a854e7747671
284+
image: eu.gcr.io/cookie/hello-world:1.20191125.132107-4664980
285+
imageID: docker-pullable://eu.gcr.io/cookie/hello-world@sha256:1ac413b2756364b7b856c64d557fdedb97a4ba44ca16fc656e08881650848fe2
286+
lastState: {}
287+
name: hello-world
288+
ready: true
289+
restartCount: 0
290+
state:
291+
running:
292+
startedAt: "2019-11-25T13:24:02Z"
293+
- containerID: docker://818d8c0c4a4d88c1ce7865f5cbb1dddb237d1bf2392058f402956db33d1187f7
294+
image: istio/proxyv2:1.3.4
295+
imageID: docker-pullable://istio/proxyv2@sha256:54a563895566adc0ad5ac5be90f666cae204e3bb09a97d14616eedaf3154d9b6
296+
lastState: {}
297+
name: istio-proxy
298+
ready: true
299+
restartCount: 0
300+
state:
301+
running:
302+
startedAt: "2019-11-25T13:24:02Z"
303+
hostIP: 10.64.128.234
304+
initContainerStatuses:
305+
- containerID: docker://28e26004a22f227b5c66123da3ff76160f886dd4114f8d05f912970883ce094c
306+
image: istio/proxy_init:1.3.4
307+
imageID: docker-pullable://istio/proxy_init@sha256:181215c809b0d294e456cf390990045efbda05fcfdc910bacdc3847f96a7e3b6
308+
lastState: {}
309+
name: istio-init
310+
ready: true
311+
restartCount: 0
312+
state:
313+
terminated:
314+
containerID: docker://28e26004a22f227b5c66123da3ff76160f886dd4114f8d05f912970883ce094c
315+
exitCode: 0
316+
finishedAt: "2019-11-25T13:23:53Z"
317+
reason: Completed
318+
startedAt: "2019-11-25T13:23:52Z"
319+
phase: Running
320+
podIP: 10.64.2.7
321+
qosClass: Burstable
322+
startTime: "2019-11-25T13:23:51Z"

0 commit comments

Comments
 (0)