Skip to content

Commit 7cf86a6

Browse files
maratsalmaratsal
authored
feat(agent): enable falcobaseline for agent version 12.9.x and above (#1561)
1 parent e3e29c1 commit 7cf86a6

File tree

5 files changed

+213
-59
lines changed

5 files changed

+213
-59
lines changed

‎charts/agent/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,4 +30,4 @@ sources:
3030
- https://app.sysdigcloud.com/#/settings/user
3131
- https://github.com/draios/sysdig
3232
type: application
33-
version: 1.19.0
33+
version: 1.19.1

‎charts/agent/templates/_helpers.tpl‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -411,6 +411,12 @@ agent config to prevent a backend push from enabling them after installation.
411411
"secure_audit_streams") }}
412412
{{- $_ := set $secureConfig $secureFeature (dict "enabled" false) }}
413413
{{- end }}
414+
{{ else if include "agent.enableFalcoBaselineSecureLight" . }}
415+
{{- range $secureFeature := (list
416+
"memdump"
417+
"network_topology") }}
418+
{{- $_ := set $secureConfig $secureFeature (dict "enabled" false) }}
419+
{{- end }}
414420
{{ else if $secureLightMode }}
415421
{{- range $secureFeature := (list
416422
"drift_control"
@@ -531,3 +537,11 @@ true
531537
{{- end }}
532538
{{- end }}
533539
{{- end }}
540+
541+
{{- define "agent.enableFalcoBaselineSecureLight" }}
542+
{{- if regexMatch "^v?([0-9]+)(\\.[0-9]+)?(\\.[0-9]+)?(-([0-9A-Za-z\\-]+(\\.[0-9A-Za-z\\-]+)*))?(\\+([0-9A-Za-z\\-]+(\\.[0-9A-Za-z\\-]+)*))?$" .Values.image.tag }}
543+
{{- if semverCompare ">= 12.19.0-0" .Values.image.tag }}
544+
{{- printf "true" -}}
545+
{{- end }}
546+
{{- end }}
547+
{{- end }}

‎charts/agent/tests/drift_prevention_test.yaml‎

Lines changed: 0 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -25,20 +25,6 @@ tests:
2525
enabled: false
2626
template: templates/configmap.yaml
2727

28-
- it: Drift prevention must be false when is secure_light
29-
set:
30-
sysdig:
31-
settings:
32-
feature:
33-
mode: secure_light
34-
asserts:
35-
- matchRegex:
36-
path: data['dragent.yaml']
37-
pattern: |-
38-
drift_killer:
39-
enabled: false
40-
template: templates/configmap.yaml
41-
4228
- it: Drift prevention must be false when is running on GKE Autopilot
4329
set:
4430
gke:
@@ -115,20 +101,6 @@ tests:
115101
enabled: false
116102
template: templates/configmap.yaml
117103

118-
- it: Drift control must be false when is secure_light
119-
set:
120-
sysdig:
121-
settings:
122-
feature:
123-
mode: secure_light
124-
asserts:
125-
- matchRegex:
126-
path: data['dragent.yaml']
127-
pattern: |-
128-
drift_control:
129-
enabled: false
130-
template: templates/configmap.yaml
131-
132104
- it: Drift control must be false when is running on GKE Autopilot
133105
set:
134106
gke:

‎charts/agent/tests/secure_enable_test.yaml‎

Lines changed: 0 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -42,21 +42,6 @@ tests:
4242
pattern: |-
4343
commandlines_capture:
4444
enabled: false
45-
- matchRegex:
46-
path: data['dragent.yaml']
47-
pattern: |-
48-
drift_control:
49-
enabled: false
50-
- matchRegex:
51-
path: data['dragent.yaml']
52-
pattern: |-
53-
drift_killer:
54-
enabled: false
55-
- matchRegex:
56-
path: data['dragent.yaml']
57-
pattern: |-
58-
falcobaseline:
59-
enabled: false
6045
- matchRegex:
6146
path: data['dragent.yaml']
6247
pattern: |-
@@ -141,21 +126,6 @@ tests:
141126
pattern: |-
142127
statsd:
143128
enabled: false
144-
- matchRegex:
145-
path: data['dragent.yaml']
146-
pattern: |-
147-
drift_control:
148-
enabled: false
149-
- matchRegex:
150-
path: data['dragent.yaml']
151-
pattern: |-
152-
drift_killer:
153-
enabled: false
154-
- matchRegex:
155-
path: data['dragent.yaml']
156-
pattern: |-
157-
falcobaseline:
158-
enabled: false
159129
- matchRegex:
160130
path: data['dragent.yaml']
161131
pattern: |-

‎charts/agent/tests/secure_light_config_test.yaml‎

Lines changed: 198 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,198 @@
1+
suite: Testing seetings for secure light mode
2+
templates:
3+
- configmap.yaml
4+
tests:
5+
- it: Testing if certain settings set to false for agent version =< 12.18.x
6+
set:
7+
image:
8+
tag: 12.18.1
9+
sysdig:
10+
accessKey: AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE
11+
settings:
12+
feature:
13+
mode: secure_light
14+
secure:
15+
enabled: true
16+
asserts:
17+
- matchRegex:
18+
path: data['dragent.yaml']
19+
pattern: |-
20+
drift_control:
21+
enabled: false
22+
- matchRegex:
23+
path: data['dragent.yaml']
24+
pattern: |-
25+
drift_killer:
26+
enabled: false
27+
- matchRegex:
28+
path: data['dragent.yaml']
29+
pattern: |-
30+
falcobaseline:
31+
enabled: false
32+
- matchRegex:
33+
path: data['dragent.yaml']
34+
pattern: |-
35+
memdump:
36+
enabled: false
37+
- matchRegex:
38+
path: data['dragent.yaml']
39+
pattern: |-
40+
network_topology:
41+
enabled: false
42+
template: configmap.yaml
43+
44+
- it: Testing if certain settings set to false for agent version = 12.16.3
45+
set:
46+
image:
47+
tag: 12.16.3
48+
sysdig:
49+
accessKey: AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE
50+
settings:
51+
feature:
52+
mode: secure_light
53+
secure:
54+
enabled: true
55+
asserts:
56+
- matchRegex:
57+
path: data['dragent.yaml']
58+
pattern: |-
59+
drift_control:
60+
enabled: false
61+
- matchRegex:
62+
path: data['dragent.yaml']
63+
pattern: |-
64+
drift_killer:
65+
enabled: false
66+
- matchRegex:
67+
path: data['dragent.yaml']
68+
pattern: |-
69+
falcobaseline:
70+
enabled: false
71+
- matchRegex:
72+
path: data['dragent.yaml']
73+
pattern: |-
74+
memdump:
75+
enabled: false
76+
- matchRegex:
77+
path: data['dragent.yaml']
78+
pattern: |-
79+
network_topology:
80+
enabled: false
81+
template: configmap.yaml
82+
83+
- it: Testing if certain settings set to false for agent version latest
84+
set:
85+
image:
86+
tag: latest
87+
sysdig:
88+
accessKey: AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE
89+
settings:
90+
feature:
91+
mode: secure_light
92+
secure:
93+
enabled: true
94+
asserts:
95+
- matchRegex:
96+
path: data['dragent.yaml']
97+
pattern: |-
98+
drift_control:
99+
enabled: false
100+
- matchRegex:
101+
path: data['dragent.yaml']
102+
pattern: |-
103+
drift_killer:
104+
enabled: false
105+
- matchRegex:
106+
path: data['dragent.yaml']
107+
pattern: |-
108+
falcobaseline:
109+
enabled: false
110+
- matchRegex:
111+
path: data['dragent.yaml']
112+
pattern: |-
113+
memdump:
114+
enabled: false
115+
- matchRegex:
116+
path: data['dragent.yaml']
117+
pattern: |-
118+
network_topology:
119+
enabled: false
120+
template: configmap.yaml
121+
122+
- it: Testing if certain settings set to false for agent version > 12.18.x
123+
set:
124+
image:
125+
tag: 12.19.0
126+
sysdig:
127+
accessKey: AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE
128+
settings:
129+
feature:
130+
mode: secure_light
131+
secure:
132+
enabled: true
133+
asserts:
134+
- notMatchRegex:
135+
path: data['dragent.yaml']
136+
pattern: |-
137+
drift_control:
138+
enabled: false
139+
- notMatchRegex:
140+
path: data['dragent.yaml']
141+
pattern: |-
142+
drift_killer:
143+
enabled: false
144+
- notMatchRegex:
145+
path: data['dragent.yaml']
146+
pattern: |-
147+
falcobaseline:
148+
enabled: false
149+
- matchRegex:
150+
path: data['dragent.yaml']
151+
pattern: |-
152+
memdump:
153+
enabled: false
154+
- matchRegex:
155+
path: data['dragent.yaml']
156+
pattern: |-
157+
network_topology:
158+
enabled: false
159+
template: configmap.yaml
160+
161+
- it: Testing if certain settings set to false for agent version 12.20.1
162+
set:
163+
image:
164+
tag: 12.20.1
165+
sysdig:
166+
accessKey: AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE
167+
settings:
168+
feature:
169+
mode: secure_light
170+
secure:
171+
enabled: true
172+
asserts:
173+
- notMatchRegex:
174+
path: data['dragent.yaml']
175+
pattern: |-
176+
drift_control:
177+
enabled: false
178+
- notMatchRegex:
179+
path: data['dragent.yaml']
180+
pattern: |-
181+
drift_killer:
182+
enabled: false
183+
- notMatchRegex:
184+
path: data['dragent.yaml']
185+
pattern: |-
186+
falcobaseline:
187+
enabled: false
188+
- matchRegex:
189+
path: data['dragent.yaml']
190+
pattern: |-
191+
memdump:
192+
enabled: false
193+
- matchRegex:
194+
path: data['dragent.yaml']
195+
pattern: |-
196+
network_topology:
197+
enabled: false
198+
template: configmap.yaml

0 commit comments

Comments
 (0)