Skip to content

Commit 5ea8986

Browse files
Daniele De Lorenzimavimo
Daniele De Lorenzi
and
mavimo
authored
fix(node-analyzer,sysdig-deploy): Ability to disable sslVerifyCertificate per container on node-analyzer (#1445)
Signed-off-by: Daniele De Lorenzi <[email protected]> Co-authored-by: Marco Vito Moscaritolo <[email protected]>
1 parent c55f740 commit 5ea8986

16 files changed

+1093
-21
lines changed

‎charts/node-analyzer/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ name: node-analyzer
33
description: Sysdig Node Analyzer
44

55
# currently matching Sysdig's appVersion 1.14.34
6-
version: 1.18.2
6+
version: 1.18.3
77
appVersion: 12.8.0
88
keywords:
99
- monitoring

‎charts/node-analyzer/README.md‎

Lines changed: 6 additions & 0 deletions
Large diffs are not rendered by default.

‎charts/node-analyzer/templates/_helpers.tpl‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,46 @@ Return the proper image name for the CSPM Analyzer
113113
{{- include "nodeAnalyzer.imageRegistry" . -}} / {{- .Values.nodeAnalyzer.kspmAnalyzer.image.repository -}} {{- if .Values.nodeAnalyzer.kspmAnalyzer.image.digest -}} @ {{- .Values.nodeAnalyzer.kspmAnalyzer.image.digest -}} {{- else -}} : {{- .Values.nodeAnalyzer.kspmAnalyzer.image.tag -}} {{- end -}}
114114
{{- end -}}
115115

116+
{{/*
117+
Helper to define skip of SSL Certificate for Runtime Scanner and Eve Connector
118+
*/}}
119+
{{- define "runtimeScanner.sslVerifyCertificate" -}}
120+
{{- $sslVerifyCertificate := coalesce (.Values.nodeAnalyzer.runtimeScanner.sslVerifyCertificate | quote) (.Values.nodeAnalyzer.sslVerifyCertificate | quote) (.Values.global.sslVerifyCertificate | quote) ("true" | quote) -}}
121+
{{ $sslVerifyCertificate }}
122+
{{- end -}}
123+
124+
{{/*
125+
Helper to define skip of SSL Certificate for Host Scanner
126+
*/}}
127+
{{- define "hostScanner.sslVerifyCertificate" -}}
128+
{{- $sslVerifyCertificate := coalesce (.Values.nodeAnalyzer.hostScanner.sslVerifyCertificate | quote) (.Values.nodeAnalyzer.sslVerifyCertificate | quote) (.Values.global.sslVerifyCertificate | quote) ("true" | quote) -}}
129+
{{ $sslVerifyCertificate }}
130+
{{- end -}}
131+
132+
{{/*
133+
Helper to define skip of SSL Certificate for Host Analyzer
134+
*/}}
135+
{{- define "hostAnalyzer.sslVerifyCertificate" -}}
136+
{{- $sslVerifyCertificate := coalesce (.Values.nodeAnalyzer.hostAnalyzer.sslVerifyCertificate | quote) (.Values.nodeAnalyzer.sslVerifyCertificate | quote) (.Values.global.sslVerifyCertificate | quote) ("true" | quote) -}}
137+
{{ $sslVerifyCertificate }}
138+
{{- end -}}
139+
140+
{{/*
141+
Helper to define skip of SSL Certificate for Image Analyzer
142+
*/}}
143+
{{- define "imageAnalyzer.sslVerifyCertificate" -}}
144+
{{- $sslVerifyCertificate := coalesce (.Values.nodeAnalyzer.imageAnalyzer.sslVerifyCertificate | quote) (.Values.nodeAnalyzer.sslVerifyCertificate | quote) (.Values.global.sslVerifyCertificate | quote) ("true" | quote) -}}
145+
{{ $sslVerifyCertificate }}
146+
{{- end -}}
147+
148+
{{/*
149+
Helper to define skip of SSL Certificate for Benchmark Runner
150+
*/}}
151+
{{- define "benchmarkRunner.sslVerifyCertificate" -}}
152+
{{- $sslVerifyCertificate := coalesce (.Values.nodeAnalyzer.benchmarkRunner.sslVerifyCertificate | quote) (.Values.nodeAnalyzer.sslVerifyCertificate | quote) (.Values.global.sslVerifyCertificate | quote) ("true" | quote) -}}
153+
{{ $sslVerifyCertificate }}
154+
{{- end -}}
155+
116156
{{/*
117157
Helper to define if to enable nats_insecure
118158
*/}}

‎charts/node-analyzer/templates/configmap-benchmark-runner.yaml‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,7 @@ metadata:
99
{{ include "nodeAnalyzer.labels" . | indent 4 }}
1010
data:
1111
collector_endpoint: "https://{{ include "nodeAnalyzer.apiEndpoint" . }}"
12-
{{- if hasKey .Values.nodeAnalyzer "sslVerifyCertificate" }}
13-
ssl_verify_certificate: "{{ .Values.nodeAnalyzer.sslVerifyCertificate }}"
14-
{{- end }}
12+
ssl_verify_certificate: {{ include "benchmarkRunner.sslVerifyCertificate" . }}
1513
debug: "{{ .Values.nodeAnalyzer.debug | default false }}"
1614
{{- if (.Values.nodeAnalyzer.benchmarkRunner.httpProxy | default .Values.nodeAnalyzer.httpProxy | default .Values.global.proxy.httpProxy) }}
1715
http_proxy: {{ .Values.nodeAnalyzer.benchmarkRunner.httpProxy | default .Values.nodeAnalyzer.httpProxy | default .Values.global.proxy.httpProxy }}

‎charts/node-analyzer/templates/configmap-host-analyzer.yaml‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,7 @@ data:
1313
{{- if .Values.nodeAnalyzer.collectorTimeout }}
1414
collector_timeout: {{ .Values.nodeAnalyzer.collectorTimeout }}
1515
{{- end }}
16-
{{- if hasKey .Values.nodeAnalyzer "sslVerifyCertificate" }}
17-
ssl_verify_certificate: "{{ .Values.nodeAnalyzer.sslVerifyCertificate }}"
18-
{{- end }}
16+
ssl_verify_certificate: {{ include "hostAnalyzer.sslVerifyCertificate" . }}
1917
debug: "{{ .Values.nodeAnalyzer.debug | default false }}"
2018
{{- if .Values.nodeAnalyzer.hostAnalyzer.schedule }}
2119
schedule: {{ .Values.nodeAnalyzer.hostAnalyzer.schedule | quote }}

‎charts/node-analyzer/templates/configmap-host-scanner.yaml‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,9 +23,7 @@ data:
2323
{{- if .Values.nodeAnalyzer.hostScanner.additionalDirsToScan }}
2424
additional_dirs_to_scan: {{ .Values.nodeAnalyzer.hostScanner.additionalDirsToScan }}
2525
{{- end }}
26-
{{- if hasKey .Values.nodeAnalyzer "sslVerifyCertificate" }}
27-
ssl_verify_certificate: "{{ .Values.nodeAnalyzer.sslVerifyCertificate }}"
28-
{{- end }}
26+
ssl_verify_certificate: {{ include "hostScanner.sslVerifyCertificate" . }}
2927
{{- if (.Values.nodeAnalyzer.hostScanner.debug | default .Values.nodeAnalyzer.debug) }}
3028
debug: "{{ .Values.nodeAnalyzer.hostScanner.debug | default .Values.nodeAnalyzer.debug }}"
3129
{{- end }}

‎charts/node-analyzer/templates/configmap-image-analyzer.yaml‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,7 @@ metadata:
88
{{ include "nodeAnalyzer.labels" . | indent 4 }}
99
data:
1010
collector_endpoint: "https://{{ include "nodeAnalyzer.apiEndpoint" . }}/internal/scanning/scanning-analysis-collector"
11-
{{- if hasKey .Values.nodeAnalyzer "sslVerifyCertificate" }}
12-
ssl_verify_certificate: "{{ .Values.nodeAnalyzer.sslVerifyCertificate }}"
13-
{{- end }}
11+
ssl_verify_certificate: {{ include "imageAnalyzer.sslVerifyCertificate" . }}
1412
debug: "{{ .Values.nodeAnalyzer.debug | default false }}"
1513
{{- if .Values.nodeAnalyzer.imageAnalyzer.dockerSocketPath }}
1614
docker_socket_path: {{ .Values.nodeAnalyzer.imageAnalyzer.dockerSocketPath }}

‎charts/node-analyzer/templates/runtimeScanner/eveconnector-api-configmap.yaml‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,7 @@ metadata:
88
data:
99
api_endpoint: https://{{ include "nodeAnalyzer.apiEndpoint" . }}
1010
cluster_name: {{ required "A valid clusterName is required" (include "nodeAnalyzer.clusterName" . ) }}
11-
{{- if hasKey .Values.nodeAnalyzer "sslVerifyCertificate" }}
12-
ssl_verify_certificate: "{{ .Values.nodeAnalyzer.sslVerifyCertificate }}"
13-
{{- end }}
11+
ssl_verify_certificate: {{ include "runtimeScanner.sslVerifyCertificate" . }}
1412
{{- if hasKey .Values.nodeAnalyzer.runtimeScanner "eveConnector" }}
1513
cert_dns_name: {{ include "eveconnector.host" . | quote }}
1614
{{- end }}

‎charts/node-analyzer/templates/runtimeScanner/runtime-scanner-configmap.yaml‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,7 @@ metadata:
88
data:
99
api_endpoint: https://{{ include "nodeAnalyzer.apiEndpoint" . }}
1010
cluster_name: {{ required "A valid clusterName is required" (include "nodeAnalyzer.clusterName" . ) }}
11-
{{- if hasKey .Values.nodeAnalyzer "sslVerifyCertificate" }}
12-
ssl_verify_certificate: "{{ .Values.nodeAnalyzer.sslVerifyCertificate }}"
13-
{{- end }}
11+
ssl_verify_certificate: {{ include "runtimeScanner.sslVerifyCertificate" . }}
1412
{{- if (.Values.nodeAnalyzer.runtimeScanner.debug | default .Values.nodeAnalyzer.debug) }}
1513
debug: "{{ .Values.nodeAnalyzer.runtimeScanner.debug | default .Values.nodeAnalyzer.debug }}"
1614
{{- end }}

‎charts/node-analyzer/tests/cert_validation_benchmarkrunner_test.yaml‎

Lines changed: 182 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,182 @@
1+
suite: Benchmark Runner Skip certificate tests
2+
templates:
3+
- templates/configmap-benchmark-runner.yaml
4+
tests:
5+
- it: "Global SSL certificate validation enabled (default value)"
6+
set:
7+
clusterName: "test"
8+
nodeAnalyzer:
9+
deploy: true
10+
templates:
11+
- templates/configmap-benchmark-runner.yaml
12+
asserts:
13+
- equal:
14+
path: data.ssl_verify_certificate
15+
value: "true"
16+
17+
- it: "Global SSL certificate validation enabled (sslVerifyCertificate: true explicitly set)"
18+
set:
19+
clusterName: "test"
20+
global:
21+
sslVerifyCertificate: true
22+
nodeAnalyzer:
23+
deploy: true
24+
templates:
25+
- templates/configmap-benchmark-runner.yaml
26+
asserts:
27+
- equal:
28+
path: data.ssl_verify_certificate
29+
value: "true"
30+
31+
- it: "Global SSL certificate validation disabled"
32+
set:
33+
clusterName: "test"
34+
global:
35+
sslVerifyCertificate: false
36+
nodeAnalyzer:
37+
deploy: true
38+
templates:
39+
- templates/configmap-benchmark-runner.yaml
40+
asserts:
41+
- equal:
42+
path: data.ssl_verify_certificate
43+
value: "false"
44+
45+
- it: "SSL certificate validation enabled (sslVerifyCertificate: true explicitly set) [Node Analyzer POD]"
46+
set:
47+
clusterName: "test"
48+
nodeAnalyzer:
49+
deploy: true
50+
sslVerifyCertificate: true
51+
templates:
52+
- templates/configmap-benchmark-runner.yaml
53+
asserts:
54+
- equal:
55+
path: data.ssl_verify_certificate
56+
value: "true"
57+
58+
- it: "SSL certificate validation disabled [Node Analyzer POD]"
59+
set:
60+
clusterName: "test"
61+
nodeAnalyzer:
62+
deploy: true
63+
sslVerifyCertificate: false
64+
templates:
65+
- templates/configmap-benchmark-runner.yaml
66+
asserts:
67+
- equal:
68+
path: data.ssl_verify_certificate
69+
value: "false"
70+
71+
- it: "SSL certificate validation enabled (sslVerifyCertificate: true explicitly set) [benchmarkRunner container]"
72+
set:
73+
clusterName: "test"
74+
nodeAnalyzer:
75+
deploy: true
76+
benchmarkRunner:
77+
sslVerifyCertificate: true
78+
templates:
79+
- templates/configmap-benchmark-runner.yaml
80+
asserts:
81+
- equal:
82+
path: data.ssl_verify_certificate
83+
value: "true"
84+
85+
- it: "SSL certificate validation disabled [benchmarkRunner container]"
86+
set:
87+
clusterName: "test"
88+
nodeAnalyzer:
89+
deploy: true
90+
benchmarkRunner:
91+
sslVerifyCertificate: false
92+
templates:
93+
- templates/configmap-benchmark-runner.yaml
94+
asserts:
95+
- equal:
96+
path: data.ssl_verify_certificate
97+
value: "false"
98+
99+
- it: "SSL certificate validation disabled [Global + Node Analyzer POD]"
100+
set:
101+
global:
102+
sslVerifyCertificate: true
103+
clusterName: "test"
104+
nodeAnalyzer:
105+
deploy: true
106+
sslVerifyCertificate: false
107+
benchmarkRunner:
108+
deploy: true
109+
templates:
110+
- templates/configmap-benchmark-runner.yaml
111+
asserts:
112+
- equal:
113+
path: data.ssl_verify_certificate
114+
value: "false"
115+
116+
- it: "SSL certificate validation disabled [Node Analyzer POD + Container]"
117+
set:
118+
clusterName: "test"
119+
nodeAnalyzer:
120+
deploy: true
121+
sslVerifyCertificate: true
122+
benchmarkRunner:
123+
deploy: true
124+
sslVerifyCertificate: false
125+
templates:
126+
- templates/configmap-benchmark-runner.yaml
127+
asserts:
128+
- equal:
129+
path: data.ssl_verify_certificate
130+
value: "false"
131+
132+
- it: "SSL certificate validation enabled [Node Analyzer POD + Container]"
133+
set:
134+
clusterName: "test"
135+
nodeAnalyzer:
136+
deploy: true
137+
sslVerifyCertificate: false
138+
benchmarkRunner:
139+
deploy: true
140+
sslVerifyCertificate: true
141+
templates:
142+
- templates/configmap-benchmark-runner.yaml
143+
asserts:
144+
- equal:
145+
path: data.ssl_verify_certificate
146+
value: "true"
147+
148+
- it: "SSL certificate validation disabled [Global + Node Analyzer POD + Container]"
149+
set:
150+
global:
151+
sslVerifyCertificate: true
152+
clusterName: "test"
153+
nodeAnalyzer:
154+
deploy: true
155+
sslVerifyCertificate: true
156+
benchmarkRunner:
157+
deploy: true
158+
sslVerifyCertificate: false
159+
templates:
160+
- templates/configmap-benchmark-runner.yaml
161+
asserts:
162+
- equal:
163+
path: data.ssl_verify_certificate
164+
value: "false"
165+
166+
- it: "SSL certificate validation enabled [Global + Node Analyzer POD + Container]"
167+
set:
168+
global:
169+
sslVerifyCertificate: false
170+
clusterName: "test"
171+
nodeAnalyzer:
172+
deploy: true
173+
sslVerifyCertificate: false
174+
benchmarkRunner:
175+
deploy: true
176+
sslVerifyCertificate: true
177+
templates:
178+
- templates/configmap-benchmark-runner.yaml
179+
asserts:
180+
- equal:
181+
path: data.ssl_verify_certificate
182+
value: "true"

0 commit comments

Comments
 (0)