Skip to content

Commit bbcdd13

Browse files
aroberts87aroberts87
authored
fix(shield): host shield honor the ssl.verify flag (#2222)
1 parent 94417b8 commit bbcdd13

File tree

4 files changed

+180
-10
lines changed

4 files changed

+180
-10
lines changed

‎charts/shield/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,5 +13,5 @@ maintainers:
1313
- name: mavimo
1414
email: [email protected]
1515
type: application
16-
version: 1.4.1
16+
version: 1.4.2
1717
appVersion: "1.0.0"

‎charts/shield/templates/host/_configmap_helpers.tpl‎

Lines changed: 27 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -112,11 +112,36 @@ true
112112
{{- end }}
113113
{{- end }}
114114
115+
{{- define "host.dragent_yaml.host_scanner" }}
116+
{{- $config := dict }}
117+
{{- $config = merge $config (dict "host_fs_mount_path" "/host") }}
118+
{{- if and (include "shield.is_semver" .Values.host.image.tag) (semverCompare "< 13.10.0" .Values.host.image.tag) (not .Values.ssl.verify) }}
119+
{{- $config = merge $config (dict "verify_certificate" false) }}
120+
{{- end }}
121+
{{- if hasKey .Values.host.additional_settings "host_scanner" }}
122+
{{- $config = mergeOverwrite $config (dig "host_scanner" dict .Values.host.additional_settings) }}
123+
{{- end }}
124+
{{ $config | toJson }}
125+
{{- end }}
126+
127+
{{- define "host.dragent_yaml.rapid_response" }}
128+
{{- $config := dict }}
129+
{{- $respond := get .Values.features (include "host.respond_key" .Values.features) }}
130+
{{- $rapid_response := omit (get $respond "rapid_response") "password" }}
131+
{{- if and (include "shield.is_semver" .Values.host.image.tag) (semverCompare "< 13.10.0" .Values.host.image.tag) (not .Values.ssl.verify) }}
132+
{{- $rapid_response = merge $rapid_response (dict "tls_skip_check" true) }}
133+
{{- end }}
134+
{{ $rapid_response | toJson }}
135+
{{- end }}
136+
115137
{{- define "host.configmap" }}
116138
{{- $config := dict
117139
"k8s_cluster_name" .Values.cluster_config.name
118140
"collector" (include "common.collector_endpoint" .)
119141
}}
142+
{{- if not .Values.ssl.verify }}
143+
{{- $config = merge $config (dict "ssl_verify_certificate" false) }}
144+
{{- end }}
120145
{{- if .Values.features.kubernetes_metadata.enabled }}
121146
{{- $_ := set $config "k8s_delegated_nodes" (dig "k8s_delegated_nodes" 0 .Values.host.additional_settings) -}}
122147
{{- else if hasKey .Values.host.additional_settings "k8s_delegated_nodes" }}
@@ -130,21 +155,14 @@ true
130155
{{- $config := merge $config (dict "http_proxy" (include "host.dragent_proxy_config" . | fromYaml)) }}
131156
{{- end }}
132157
{{- if (include "host.rapid_response_enabled" .) }}
133-
{{- $respond := get .Values.features (include "host.respond_key" .Values.features) }}
134-
{{- $rapid_response := omit (get $respond "rapid_response") "password" }}
135-
{{- $config = merge $config (dict "rapid_response" $rapid_response) }}
158+
{{- $config = merge $config (dict "rapid_response" (include "host.dragent_yaml.rapid_response" .| fromJson)) }}
136159
{{- end }}
137160
{{- $config = merge $config (include "host.parse_features" . | fromYaml) }}
138161
{{/* Host Scanner requires setting the host fs mount path variable, but that
139162
parameter has not been mapped into the new schema yet. As a result,
140163
it still needs to be set in the dragent.yaml file. */}}
141164
{{- if .Values.features.vulnerability_management.host_vulnerability_management.enabled }}
142-
{{/* Currently this pins the path to /host, but that is only because the final location of the
143-
parameters has not been determined. */}}
144-
{{- if and .Values.features.vulnerability_management.host_vulnerability_management.enabled
145-
(not (dig "host_scanner" "host_fs_mount_path" nil .Values.host.additional_settings)) }}
146-
{{- $config = merge $config (dict "host_scanner" (dict "host_fs_mount_path" "/host")) }}
147-
{{- end }}
165+
{{- $config = merge $config (dict "host_scanner" (include "host.dragent_yaml.host_scanner" . | fromJson)) }}
148166
{{- end }}
149167
{{- if or .Values.features.posture.host_posture.enabled (dig "kspm_analyzer" "enabled" false .Values.host.additional_settings) }}
150168
{{- $config = merge $config (dict "kspm_analyzer" (dict "agent_app_name" (include "shield.name" .))) }}

‎charts/shield/templates/host/_helpers.tpl‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -239,6 +239,13 @@ true
239239
{{- end }}
240240
{{- end }}
241241

242+
{{- define "host.host_scanner_enabled" }}
243+
{{- if or .Values.features.vulnerability_management.host_vulnerability_management.enabled
244+
(dig "host_scanner" "enabled" false .Values.host.additional_settings) }}
245+
true
246+
{{- end }}
247+
{{- end }}
248+
242249
{{- define "host.monitor_key" }}
243250
{{- if hasKey . "monitoring" }}
244251
{{- print "monitoring" }}

‎charts/shield/tests/host/configmap-dragent-yaml_test.yaml‎

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1198,3 +1198,148 @@ tests:
11981198
asserts:
11991199
- notExists:
12001200
path: data["prometheus.yaml"]
1201+
1202+
- it: Disable SSL verification [Agent < 13.10.0]
1203+
set:
1204+
host:
1205+
image:
1206+
tag: 13.9.0
1207+
ssl:
1208+
verify: false
1209+
features:
1210+
respond:
1211+
rapid_response:
1212+
enabled: true
1213+
vulnerability_management:
1214+
host_vulnerability_management:
1215+
enabled: true
1216+
asserts:
1217+
- matchRegex:
1218+
path: data['dragent.yaml']
1219+
pattern: |
1220+
ssl_verify_certificate: false
1221+
- matchRegex:
1222+
path: data['dragent.yaml']
1223+
pattern: |
1224+
rapid_response:
1225+
enabled: true
1226+
tls_skip_check: true
1227+
- matchRegex:
1228+
path: data['dragent.yaml']
1229+
pattern: |-
1230+
host_scanner:
1231+
host_fs_mount_path: /host
1232+
verify_certificate: false
1233+
1234+
- it: Disable SSL verification [Agent >= 13.10.0]
1235+
set:
1236+
host:
1237+
image:
1238+
tag: 13.10.0
1239+
ssl:
1240+
verify: false
1241+
features:
1242+
respond:
1243+
rapid_response:
1244+
enabled: true
1245+
vulnerability_management:
1246+
host_vulnerability_management:
1247+
enabled: true
1248+
asserts:
1249+
- matchRegex:
1250+
path: data['dragent.yaml']
1251+
pattern: |
1252+
ssl_verify_certificate: false
1253+
- notMatchRegex:
1254+
path: data['dragent.yaml']
1255+
pattern: |
1256+
rapid_response:
1257+
enabled: true
1258+
tls_skip_check: true
1259+
- notMatchRegex:
1260+
path: data['dragent.yaml']
1261+
pattern: |
1262+
host_scanner:
1263+
host_fs_mount_path: /host
1264+
verify_certificate: false
1265+
1266+
- it: Ensure ssl verification is not disabled by default
1267+
set:
1268+
features:
1269+
respond:
1270+
rapid_response:
1271+
enabled: true
1272+
vulnerability_management:
1273+
host_vulnerability_management:
1274+
enabled: true
1275+
asserts:
1276+
- notMatchRegex:
1277+
path: data['dragent.yaml']
1278+
pattern: |
1279+
ssl_verify_certificate: false
1280+
- notMatchRegex:
1281+
path: data['dragent.yaml']
1282+
pattern: |
1283+
rapid_response:
1284+
enabled: true
1285+
tls_skip_check: true
1286+
- notMatchRegex:
1287+
path: data['dragent.yaml']
1288+
pattern: |
1289+
host_scanner:
1290+
host_fs_mount_path: /host
1291+
verify_certificate: false
1292+
1293+
- it: Validate rapid response cert verification can be overridden
1294+
set:
1295+
host:
1296+
additional_settings:
1297+
rapid_response:
1298+
tls_skip_check: false
1299+
ssl:
1300+
verify: false
1301+
features:
1302+
respond:
1303+
rapid_response:
1304+
enabled: true
1305+
vulnerability_management:
1306+
host_vulnerability_management:
1307+
enabled: true
1308+
asserts:
1309+
- matchRegex:
1310+
path: data['dragent.yaml']
1311+
pattern: |
1312+
ssl_verify_certificate: false
1313+
- matchRegex:
1314+
path: data['dragent.yaml']
1315+
pattern: |
1316+
rapid_response:
1317+
enabled: true
1318+
tls_skip_check: false
1319+
1320+
- it: Validate host scanner cert verification can be overridden
1321+
set:
1322+
host:
1323+
additional_settings:
1324+
host_scanner:
1325+
verify_certificate: true
1326+
ssl:
1327+
verify: false
1328+
features:
1329+
respond:
1330+
rapid_response:
1331+
enabled: true
1332+
vulnerability_management:
1333+
host_vulnerability_management:
1334+
enabled: true
1335+
asserts:
1336+
- matchRegex:
1337+
path: data['dragent.yaml']
1338+
pattern: |
1339+
ssl_verify_certificate: false
1340+
- matchRegex:
1341+
path: data['dragent.yaml']
1342+
pattern: |
1343+
host_scanner:
1344+
host_fs_mount_path: /host
1345+
verify_certificate: true

0 commit comments

Comments
 (0)