Skip to content

Commit 7019a94

Browse files
ProvoKmavimo
ProvoK
and
mavimo
authored
fix(nodeAnalyzer): deamonset not being rollout after configuration changes (#1533)
Extended Changelog: * Fix node-analyzer daemonset rollout not triggered by a change in configuration Co-authored-by: Marco Vito Moscaritolo <[email protected]>
1 parent 9e4a5ca commit 7019a94

18 files changed

+357
-29
lines changed

‎charts/node-analyzer/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v2
22
name: node-analyzer
33
description: Sysdig Node Analyzer
44
# currently matching Sysdig's appVersion 1.14.34
5-
version: 1.20.2
5+
version: 1.20.3
66
appVersion: 12.9.0
77
keywords:
88
- monitoring

‎charts/node-analyzer/templates/daemonset-node-analyzer.yaml‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,24 @@ spec:
2828
app.kubernetes.io/name: {{ include "nodeAnalyzer.name" . }}
2929
{{ include "daemonset.labels" . | indent 8 }}
3030
{{ include "nodeAnalyzer.labels" . | indent 8 }}
31-
{{- if .Values.daemonset.annotations }}
3231
annotations:
32+
checksum/config-benchmark: {{ include (print $.Template.BasePath "/configmap-benchmark-runner.yaml") . | sha256sum | quote }}
33+
checksum/config-host-analyzer: {{ include (print $.Template.BasePath "/configmap-host-analyzer.yaml") . | sha256sum | quote }}
34+
checksum/config-image-analyzer: {{ include (print $.Template.BasePath "/configmap-image-analyzer.yaml") . | sha256sum | quote }}
35+
{{- if and .Values.nodeAnalyzer.deploy (not .Values.gke.autopilot) (include "nodeAnalyzer.deployHostScanner" .) }}
36+
checksum/config-host-scanner: {{ include (print $.Template.BasePath "/configmap-host-scanner.yaml") . | sha256sum | quote }}
37+
{{- end }}
38+
{{- if .Values.global.kspm.deploy }}
39+
checksum/config-kspm-analyzer: {{ include (print $.Template.BasePath "/configmap-kspm-analyzer.yaml") . | sha256sum | quote }}
40+
{{- end }}
41+
{{- if include "nodeAnalyzer.deployRuntimeScanner" . }}
42+
checksum/config-runtime-scanner: {{ include (print $.Template.BasePath "/runtimeScanner/runtime-scanner-configmap.yaml") . | sha256sum | quote }}
43+
{{- end }}
44+
checksum/secret: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum | quote }}
45+
checksum/clusterrole: {{ include (print $.Template.BasePath "/clusterrole-node-analyzer.yaml") . | sha256sum | quote }}
46+
checksum/clusterrolebinding: {{ include (print $.Template.BasePath "/clusterrolebinding-node-analyzer.yaml") . | sha256sum | quote }}
47+
checksum/serviceaccount: {{ include (print $.Template.BasePath "/serviceaccount-node-analyzer.yaml") . | sha256sum | quote }}
48+
{{- if .Values.daemonset.annotations }}
3349
{{ toYaml .Values.daemonset.annotations | nindent 8 }}
3450
{{- end }}
3551
spec:

‎charts/node-analyzer/tests/agent_tags_test.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,19 @@
11
suite: Test node-analyzer Agent Tags
22
templates:
33
- daemonset-node-analyzer.yaml
4+
# For checksums
5+
- clusterrole-node-analyzer.yaml
6+
- clusterrolebinding-node-analyzer.yaml
7+
- configmap-benchmark-runner.yaml
8+
- configmap-host-analyzer.yaml
9+
- configmap-host-scanner.yaml
10+
- configmap-image-analyzer.yaml
11+
- configmap-kspm-analyzer.yaml
12+
- secrets.yaml
13+
- serviceaccount-node-analyzer.yaml
14+
values:
15+
- ./default_required_values.yaml
16+
417
tests:
518
- it: Check agent tags are set from global.settings.tags
619
set:
@@ -10,6 +23,7 @@ tests:
1023
tag: value
1124
kspm:
1225
deploy: true
26+
clusterName: "test"
1327
asserts:
1428
- contains:
1529
path: spec.template.spec.containers[0].env
@@ -23,6 +37,7 @@ tests:
2337
global:
2438
kspm:
2539
deploy: true
40+
clusterName: "test"
2641
asserts:
2742
- notContains:
2843
path: spec.template.spec.containers[0].env

‎charts/node-analyzer/tests/annotations_test.yaml‎

Lines changed: 64 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,24 @@
11
suite: Test specifying annotations to the Node Analyzer DaemonSet
22
templates:
3-
- templates/daemonset-node-analyzer.yaml
4-
tests:
5-
- it: Test no annotations by default
6-
asserts:
7-
- isNull:
8-
path: template.metadata.annotations
3+
- daemonset-node-analyzer.yaml
4+
# For checksums
5+
- clusterrole-node-analyzer.yaml
6+
- clusterrolebinding-node-analyzer.yaml
7+
- configmap-benchmark-runner.yaml
8+
- configmap-host-analyzer.yaml
9+
- configmap-host-scanner.yaml
10+
- configmap-image-analyzer.yaml
11+
- configmap-kspm-analyzer.yaml
12+
- secrets.yaml
13+
- serviceaccount-node-analyzer.yaml
14+
- runtimeScanner/runtime-scanner-configmap.yaml
15+
values:
16+
- ./default_required_values.yaml
917

10-
- it: Test annotations are added as expected
18+
tests:
19+
- it: Test additional annotations are added as expected
20+
templates:
21+
- daemonset-node-analyzer.yaml
1122
set:
1223
daemonset:
1324
annotations:
@@ -16,3 +27,49 @@ tests:
1627
- equal:
1728
path: spec.template.metadata.annotations['super']
1829
value: annotation
30+
- it: Test checksum annotations
31+
templates:
32+
- daemonset-node-analyzer.yaml
33+
asserts:
34+
- isNotEmpty:
35+
path: spec.template.metadata.annotations['checksum/config-benchmark']
36+
- isNotEmpty:
37+
path: spec.template.metadata.annotations['checksum/config-host-analyzer']
38+
- isNotEmpty:
39+
path: spec.template.metadata.annotations['checksum/config-image-analyzer']
40+
- isNotEmpty:
41+
path: spec.template.metadata.annotations['checksum/secret']
42+
- isNotEmpty:
43+
path: spec.template.metadata.annotations['checksum/clusterrole']
44+
- isNotEmpty:
45+
path: spec.template.metadata.annotations['checksum/clusterrolebinding']
46+
- isNotEmpty:
47+
path: spec.template.metadata.annotations['checksum/serviceaccount']
48+
# NOTE: not enabled with default config
49+
- notExists:
50+
path: spec.template.metadata.annotations['checksum/config-host-scanner']
51+
- notExists:
52+
path: spec.template.metadata.annotations['checksum/config-runtime-scanner']
53+
- notExists:
54+
path: spec.template.metadata.annotations['checksum/config-kspm-analyzer']
55+
- it: Test checksum annotations for new scanning engine
56+
templates:
57+
- daemonset-node-analyzer.yaml
58+
set:
59+
secure:
60+
vulnerabilityManagement:
61+
newEngineOnly: true
62+
global:
63+
clusterConfig:
64+
name: "test"
65+
sysdig:
66+
accessKey: "AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE"
67+
asserts:
68+
- hasDocuments:
69+
count: 1
70+
- isNotEmpty:
71+
path: spec.template.metadata.annotations['checksum/clusterrole']
72+
- isNotEmpty:
73+
path: spec.template.metadata.annotations['checksum/config-host-scanner']
74+
- isNotEmpty:
75+
path: spec.template.metadata.annotations['checksum/config-runtime-scanner']

‎charts/node-analyzer/tests/ca_cert_test.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,19 @@ templates:
55
- runtimeScanner/eveconnector-api-deployment.yaml
66
- runtimeScanner/sysdig-eve-secret.yaml
77
- runtimeScanner/eveconnector-api-configmap.yaml
8+
# For checksums
9+
- clusterrole-node-analyzer.yaml
10+
- clusterrolebinding-node-analyzer.yaml
11+
- configmap-benchmark-runner.yaml
12+
- configmap-host-analyzer.yaml
13+
- configmap-host-scanner.yaml
14+
- configmap-image-analyzer.yaml
15+
- configmap-kspm-analyzer.yaml
16+
- serviceaccount-node-analyzer.yaml
17+
- runtimeScanner/runtime-scanner-configmap.yaml
18+
values:
19+
- ./default_required_values.yaml
20+
821
tests:
922
- it: Checking node-analyzer CA Cert Secret
1023
set:
@@ -13,6 +26,9 @@ tests:
1326
secure:
1427
vulnerabilityManagement:
1528
newEngineOnly: true
29+
global:
30+
clusterConfig:
31+
name: "test"
1632
sysdig:
1733
accessKey: AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE
1834
nodeAnalyzer:
@@ -40,6 +56,9 @@ tests:
4056
secure:
4157
vulnerabilityManagement:
4258
newEngineOnly: true
59+
global:
60+
clusterConfig:
61+
name: "test"
4362
sysdig:
4463
accessKey: AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE
4564
nodeAnalyzer:
@@ -108,6 +127,8 @@ tests:
108127
vulnerabilityManagement:
109128
newEngineOnly: true
110129
global:
130+
clusterConfig:
131+
name: "test"
111132
kspm:
112133
deploy: false
113134
ssl:

‎charts/node-analyzer/tests/conditional_flag_test.yaml‎

Lines changed: 54 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,23 @@ templates:
66
- runtimeScanner/eveconnector-api-service.yaml
77
- runtimeScanner/eveconnector-api-deployment.yaml
88
- runtimeScanner/sysdig-eve-secret.yaml
9+
# For checksums
10+
- clusterrole-node-analyzer.yaml
11+
- clusterrolebinding-node-analyzer.yaml
12+
- configmap-benchmark-runner.yaml
13+
- configmap-host-analyzer.yaml
14+
- configmap-host-scanner.yaml
15+
- configmap-image-analyzer.yaml
16+
- secrets.yaml
17+
- serviceaccount-node-analyzer.yaml
18+
- runtimeScanner/runtime-scanner-configmap.yaml
19+
920
tests:
1021
- it: Check global kspm deploy
1122
set:
1223
global:
24+
sysdig:
25+
accessKey: "AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE"
1326
kspm:
1427
deploy: true
1528
clusterName: test-cluster
@@ -23,6 +36,8 @@ tests:
2336
- it: Check hostPID is true if global.kspm.deploy is true
2437
set:
2538
global:
39+
sysdig:
40+
accessKey: "AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE"
2641
kspm:
2742
deploy: true
2843
clusterName: test-cluster
@@ -34,6 +49,9 @@ tests:
3449

3550
- it: Check hostPID is true if nodeAnalyzer.benchmarkRunner.deploy is true
3651
set:
52+
global:
53+
sysdig:
54+
accessKey: "AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE"
3755
nodeAnalyzer:
3856
benchmarkRunner:
3957
deploy: true
@@ -45,17 +63,23 @@ tests:
4563
value: true
4664

4765
- it: Check global kspm deploy without clusterName
66+
templates:
67+
- daemonset-node-analyzer.yaml
4868
set:
4969
global:
5070
kspm:
5171
deploy: true
52-
template: configmap-kspm-analyzer.yaml
72+
sysdig:
73+
accessKey: "AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE"
5374
asserts:
5475
- failedTemplate:
5576
errorMessage: "A valid clusterName is required"
5677

5778
- it: Check nodeAnalyzer imageAnalyzer deploy
5879
set:
80+
global:
81+
sysdig:
82+
accessKey: "AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE"
5983
nodeAnalyzer:
6084
imageAnalyzer:
6185
deploy: true
@@ -70,6 +94,9 @@ tests:
7094

7195
- it: Check nodeAnalyzer hostAnalyzer deploy
7296
set:
97+
global:
98+
sysdig:
99+
accessKey: "AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE"
73100
nodeAnalyzer:
74101
hostAnalyzer:
75102
deploy: true
@@ -84,6 +111,9 @@ tests:
84111

85112
- it: Check nodeAnalyzer benchmarkRunner deploy
86113
set:
114+
global:
115+
sysdig:
116+
accessKey: "AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE"
87117
nodeAnalyzer:
88118
benchmarkRunner:
89119
deploy: true
@@ -98,6 +128,11 @@ tests:
98128

99129
- it: Check nodeAnalyzer runtimeScanner deploy
100130
set:
131+
global:
132+
clusterConfig:
133+
name: "test"
134+
sysdig:
135+
accessKey: "AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE"
101136
nodeAnalyzer:
102137
runtimeScanner:
103138
deploy: true
@@ -112,6 +147,9 @@ tests:
112147

113148
- it: Check nodeAnalyzer runtimeScanner eveConnector deploy
114149
set:
150+
global:
151+
sysdig:
152+
accessKey: "AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE"
115153
nodeAnalyzer:
116154
runtimeScanner:
117155
deploy: true
@@ -141,6 +179,9 @@ tests:
141179

142180
- it: Check nodeAnalyzer imageAnalyzer deploy set to false
143181
set:
182+
global:
183+
sysdig:
184+
accessKey: "AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE"
144185
nodeAnalyzer:
145186
imageAnalyzer:
146187
deploy: false
@@ -155,6 +196,9 @@ tests:
155196

156197
- it: Check nodeAnalyzer hostAnalyzer deploy set to false
157198
set:
199+
global:
200+
sysdig:
201+
accessKey: "AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE"
158202
nodeAnalyzer:
159203
hostAnalyzer:
160204
deploy: false
@@ -169,6 +213,9 @@ tests:
169213

170214
- it: Check nodeAnalyzer benchmarkRunner deploy set to false
171215
set:
216+
global:
217+
sysdig:
218+
accessKey: "AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE"
172219
nodeAnalyzer:
173220
benchmarkRunner:
174221
deploy: false
@@ -183,6 +230,9 @@ tests:
183230

184231
- it: Check nodeAnalyzer runtimeScanner deploy set to false
185232
set:
233+
global:
234+
sysdig:
235+
accessKey: "AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE"
186236
nodeAnalyzer:
187237
runtimeScanner:
188238
deploy: false
@@ -197,6 +247,9 @@ tests:
197247

198248
- it: Check nodeAnalyzer runtimeScanner EVE_INTEGRATION_ENABLED is true even if eveConnector deploy set to false
199249
set:
250+
global:
251+
sysdig:
252+
accessKey: "AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE"
200253
nodeAnalyzer:
201254
runtimeScanner:
202255
deploy: true

0 commit comments

Comments
 (0)