Skip to content

Commit bea914c

Browse files
mech-pigmech-pig
authored
feat(node-analyzer): grant lease permissions if kspm analyzer uses http transport [SSPROD-54356] (#2245)
1 parent e602c7f commit bea914c

File tree

8 files changed

+212
-2
lines changed

8 files changed

+212
-2
lines changed

‎charts/node-analyzer/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v2
22
name: node-analyzer
33
description: Sysdig Node Analyzer
44
# currently matching Sysdig's appVersion 1.14.34
5-
version: 1.35.2
5+
version: 1.35.3
66
appVersion: 12.9.2
77
keywords:
88
- monitoring

‎charts/node-analyzer/templates/configmap-kspm-analyzer.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,14 +11,15 @@ data:
1111
{{- $env := "PRODUCTION" -}}
1212
{{ if (.Values.nodeAnalyzer.kspmAnalyzer.debug | default .Values.nodeAnalyzer.debug) }}
1313
{{- $env = "DEVELOPMENT" -}}
14-
{{ end}}
14+
{{ end }}
1515
environment: {{ $env }}
1616
external_nats_url: {{ include "nodeAnalyzer.natsUrl" . }}
1717
nats_max_reconnect: {{ .Values.nodeAnalyzer.natsMaxReconnect | default 0 | quote }}
1818
nats_max_reconnect_failures: {{ .Values.nodeAnalyzer.natsMaxReconnectFailures | default 60 | quote }}
1919
cluster_name: {{ required "A valid clusterName is required" (include "nodeAnalyzer.clusterName" .) }}
2020
agent_app_name: {{ include "nodeAnalyzer.name" . }}
2121
nats_insecure: {{ include "kspmAnalyzer.natsInsecure" . }}
22+
transport_layer: {{ .Values.nodeAnalyzer.kspmAnalyzer.transportLayer | default "nats" }}
2223
{{- if (.Values.nodeAnalyzer.kspmAnalyzer.httpProxy | default .Values.nodeAnalyzer.httpProxy | default .Values.global.proxy.httpProxy) }}
2324
http_proxy: {{ .Values.nodeAnalyzer.kspmAnalyzer.httpProxy | default .Values.nodeAnalyzer.httpProxy | default .Values.global.proxy.httpProxy }}
2425
{{- end -}}

‎charts/node-analyzer/templates/daemonset-node-analyzer.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -248,6 +248,12 @@ spec:
248248
name: {{ .Release.Name }}-kspm-analyzer
249249
key: nats_insecure
250250
optional: true
251+
- name: TRANSPORT_LAYER
252+
valueFrom:
253+
configMapKeyRef:
254+
name: {{ .Release.Name }}-kspm-analyzer
255+
key: transport_layer
256+
optional: true
251257
- name: HTTP_PROXY
252258
valueFrom:
253259
configMapKeyRef:

‎charts/node-analyzer/templates/role-node-analyzer.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{{- if not (include "nodeAnalyzer.gke.autopilot" .) }}
2+
{{- if and (include "deploy-na" .) .Values.rbac.create }}
3+
apiVersion: rbac.authorization.k8s.io/v1
4+
kind: Role
5+
metadata:
6+
name: {{ .Release.Name }}-node-analyzer
7+
namespace: {{ include "nodeAnalyzer.namespace" . }}
8+
labels:
9+
{{ include "nodeAnalyzer.labels" . | indent 4 }}
10+
rules:
11+
{{- if and .Values.global.kspm.deploy (eq .Values.nodeAnalyzer.kspmAnalyzer.transportLayer "http") }}
12+
- apiGroups: ["", "coordination.k8s.io"]
13+
resources:
14+
- "leases"
15+
resourceNames:
16+
- "kspm-analyzer-leader-election"
17+
verbs: ["*"]
18+
- apiGroups: ["", "coordination.k8s.io"]
19+
resources:
20+
- "leases"
21+
verbs: ["create"]
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}

‎charts/node-analyzer/templates/rolebinding-node-analyzer.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{{- if not (include "nodeAnalyzer.gke.autopilot" .) }}
2+
{{- if and (include "deploy-na" .) .Values.rbac.create }}
3+
kind: RoleBinding
4+
apiVersion: rbac.authorization.k8s.io/v1
5+
metadata:
6+
name: {{ .Release.Name }}-node-analyzer
7+
labels:
8+
{{ include "nodeAnalyzer.labels" . | indent 4 }}
9+
subjects:
10+
- kind: ServiceAccount
11+
name: {{ template "nodeAnalyzer.serviceAccountName" .}}
12+
namespace: {{ .Release.Namespace }}
13+
roleRef:
14+
kind: Role
15+
name: {{ .Release.Name }}-node-analyzer
16+
apiGroup: rbac.authorization.k8s.io
17+
{{- end }}
18+
{{- end }}

‎charts/node-analyzer/tests/configmap_kspm_analyzer_test.yaml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
suite: Node Analyzer KSPM Analyzer ConfigigMap Tests
2+
templates:
3+
- templates/configmap-kspm-analyzer.yaml
4+
tests:
5+
- it: Should not create document if kspm.deploy is false
6+
set:
7+
global:
8+
kspm:
9+
deploy: false
10+
nodeAnalyzer:
11+
deploy: true
12+
asserts:
13+
- containsDocument:
14+
apiVersion: v1
15+
kind: ConfigMap
16+
not: true
17+
18+
- it: Should not create document if GKE Autopilot is active
19+
set:
20+
global:
21+
gke:
22+
autopilot:
23+
true
24+
kspm:
25+
deploy: true
26+
nodeAnalyzer:
27+
deploy: true
28+
gke:
29+
autopilot: true
30+
asserts:
31+
- containsDocument:
32+
apiVersion: v1
33+
kind: ConfigMap
34+
not: true
35+
36+
- it: Uses nats as default transport layer
37+
set:
38+
clusterName: "test"
39+
global:
40+
kspm:
41+
deploy: true
42+
nodeAnalyzer:
43+
deploy: true
44+
asserts:
45+
- equal:
46+
path: data.transport_layer
47+
value: nats
48+
49+
- it: Sets transport layer according to value
50+
set:
51+
clusterName: "test"
52+
global:
53+
kspm:
54+
deploy: true
55+
nodeAnalyzer:
56+
deploy: true
57+
kspmAnalyzer:
58+
transportLayer: http
59+
asserts:
60+
- equal:
61+
path: data.transport_layer
62+
value: http

‎charts/node-analyzer/tests/role_test.yaml‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
suite: Node Analyzer Role Tests
2+
templates:
3+
- templates/role-node-analyzer.yaml
4+
tests:
5+
- it: Should not create document if nodeAnalyzer.deploy is false
6+
set:
7+
nodeAnalyzer:
8+
deploy: false
9+
asserts:
10+
- containsDocument:
11+
apiVersion: rbac.authorization.k8s.io/v1
12+
kind: Role
13+
not: true
14+
15+
- it: Should not create document if GKE Autopilot is active
16+
set:
17+
global:
18+
gke:
19+
autopilot: true
20+
asserts:
21+
- containsDocument:
22+
apiVersion: rbac.authorization.k8s.io/v1
23+
kind: Role
24+
not: true
25+
26+
- it: Should not create document if rbac.create is false
27+
set:
28+
rbac:
29+
create: false
30+
asserts:
31+
- containsDocument:
32+
apiVersion: rbac.authorization.k8s.io/v1
33+
kind: Role
34+
not: true
35+
36+
- it: Should not create rules if kspm.deploy is false
37+
set:
38+
global:
39+
kspm:
40+
deploy: false
41+
nodeAnalyzer:
42+
deploy: true
43+
asserts:
44+
- isNullOrEmpty:
45+
path: rules
46+
47+
- it: Should not create rules if transportLayer is not http
48+
set:
49+
global:
50+
kspm:
51+
deploy: true
52+
nodeAnalyzer:
53+
deploy: true
54+
kspmAnalyzer:
55+
transportLayer: nats
56+
asserts:
57+
- isNullOrEmpty:
58+
path: rules
59+
60+
- it: Should grant permissions to create lease if transport is http
61+
set:
62+
global:
63+
kspm:
64+
deploy: true
65+
nodeAnalyzer:
66+
deploy: true
67+
kspmAnalyzer:
68+
transportLayer: http
69+
asserts:
70+
- contains:
71+
path: rules
72+
content:
73+
apiGroups: ["", "coordination.k8s.io"]
74+
resources:
75+
- "leases"
76+
verbs: ["create"]
77+
78+
- it: Should grant all permissions on kspm-analyzer lease if transport is http
79+
set:
80+
global:
81+
kspm:
82+
deploy: true
83+
nodeAnalyzer:
84+
deploy: true
85+
kspmAnalyzer:
86+
transportLayer: http
87+
asserts:
88+
- contains:
89+
path: rules
90+
content:
91+
apiGroups: ["", "coordination.k8s.io"]
92+
resources:
93+
- "leases"
94+
resourceNames:
95+
- "kspm-analyzer-leader-election"
96+
verbs: ["*"]

‎charts/node-analyzer/values.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -441,6 +441,9 @@ nodeAnalyzer:
441441
# Permissions for OCP4, previously only added for benchmarkrunner
442442
includeSensitivePermissions: false
443443

444+
# http or nats
445+
transportLayer: nats
446+
444447
# Proxy configuration variables
445448
httpProxy: null
446449
httpsProxy: null

0 commit comments

Comments
 (0)