Skip to content

Commit ff02625

Browse files
aroberts87mavimo
aroberts87
and
mavimo
authored
fix(shield): Sanitize version label on shield objects (#2346)
Co-authored-by: Marco Vito Moscaritolo <[email protected]>
1 parent 243f03e commit ff02625

File tree

9 files changed

+152
-7
lines changed

9 files changed

+152
-7
lines changed

‎charts/shield/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,5 +13,5 @@ maintainers:
1313
- name: mavimo
1414
email: [email protected]
1515
type: application
16-
version: 1.15.3
16+
version: 1.15.4
1717
appVersion: "1.0.0"

‎charts/shield/templates/_helpers.tpl‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,8 +55,13 @@ Component labels
5555
*/}}
5656
{{- define "shield.component_labels" -}}
5757
{{ include "shield.component_name_label" .}}: {{ required "A valid component name must be provided" .name }}
58-
{{- if .version }}
59-
{{ include "shield.component_version_label" .}}: {{ .version }}
58+
59+
{{ if .version }}
60+
{{- $version := .version -}}
61+
{{- if (hasPrefix "sha256:" .version) -}}
62+
{{- $version = printf "sha256_%s" (trimPrefix "sha256:" .version) -}}
63+
{{- end -}}
64+
{{ include "shield.component_version_label" .}}: {{ $version | regexFind "^[^@]+" | trunc 63 }}
6065
{{- end }}
6166
{{- end }}
6267

‎charts/shield/templates/cluster/_helpers.tpl‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,14 @@ If release name contains chart name it will be used as a full name.
5757
{{- end -}}
5858
{{- end }}
5959

60+
{{- define "cluster.tag_separator" -}}
61+
{{- if (hasPrefix "sha256:" .Values.cluster.image.tag) -}}
62+
@
63+
{{- else -}}
64+
:
65+
{{- end -}}
66+
{{- end }}
67+
6068
{{- define "cluster.has_priority_class" -}}
6169
{{- if or .Values.cluster.priority_class.create .Values.cluster.priority_class.name }}
6270
{{- true -}}

‎charts/shield/templates/cluster/deployment.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ spec:
6767
containers:
6868
- name: "cluster-shield"
6969
imagePullPolicy: {{ .Values.cluster.image.pull_policy }}
70-
image: "{{ .Values.cluster.image.registry }}/{{ .Values.cluster.image.repository }}:{{ .Values.cluster.image.tag }}"
70+
image: "{{ .Values.cluster.image.registry }}/{{ .Values.cluster.image.repository }}{{ include "cluster.tag_separator" . }}{{ .Values.cluster.image.tag }}"
7171
args: [ {{ (include "cluster.run_command" .) | quote }} ]
7272
{{- if not (include "cluster.is_single_process_mode" .) }}
7373
securityContext:

‎charts/shield/templates/host/_helpers.tpl‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,14 @@ If release name contains chart name it will be used as a full name.
5555
{{- end -}}
5656
{{- end -}}
5757

58+
{{- define "host.tag_separator" -}}
59+
{{- if (hasPrefix "sha256:" .Values.host.image.tag) -}}
60+
@
61+
{{- else -}}
62+
:
63+
{{- end -}}
64+
{{- end }}
65+
5866
{{- define "host.service_account_name" -}}
5967
{{- default (include "host.fullname" .) .Values.host.rbac.service_account_name }}
6068
{{- end }}
@@ -128,11 +136,14 @@ true
128136
{{- end }}
129137

130138
{{- define "host.shield_image" }}
131-
{{- .Values.host.image.registry -}} / {{- .Values.host.image.repository -}} / {{- .Values.host.image.shield_name -}} : {{- .Values.host.image.tag }}
139+
{{- .Values.host.image.registry -}} / {{- .Values.host.image.repository -}} / {{- .Values.host.image.shield_name -}} {{- include "host.tag_separator" . -}} {{- .Values.host.image.tag }}
132140
{{- end }}
133141

134142
{{- define "host.kmodule_image" }}
135-
{{- .Values.host.image.registry -}} / {{- .Values.host.image.repository -}} / {{- .Values.host.image.kmodule_name -}} : {{- .Values.host.image.tag }}
143+
{{- if hasPrefix "sha256" .Values.host.image.tag -}}
144+
{{- fail (printf "Image tag %s can't be speficied when not using universal_ebpf driver" .Values.host.image.tag ) }}
145+
{{- end -}}
146+
{{- .Values.host.image.registry -}} / {{- .Values.host.image.repository -}} / {{- .Values.host.image.kmodule_name -}} : {{- .Values.host.image.tag | regexFind "^[^@]+" }}
136147
{{- end }}
137148

138149
{{- define "host.need_host_root" }}

‎charts/shield/templates/host/_windows_helpers.tpl‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,15 @@
2727
{{- end }}
2828

2929
{{- define "host.windows.shield_image" }}
30-
{{- .Values.host_windows.image.registry -}} / {{- .Values.host_windows.image.repository -}} / {{- .Values.host_windows.image.name -}} : {{- .Values.host_windows.image.tag }}
30+
{{- .Values.host_windows.image.registry -}} / {{- .Values.host_windows.image.repository -}} / {{- .Values.host_windows.image.name -}} {{- include "host.windows.tag_separator" . -}} {{- .Values.host_windows.image.tag }}
31+
{{- end }}
32+
33+
{{- define "host.windows.tag_separator" -}}
34+
{{- if (hasPrefix "sha256:" .Values.host_windows.image.tag) -}}
35+
@
36+
{{- else -}}
37+
:
38+
{{- end -}}
3139
{{- end }}
3240

3341
{{- define "host.windows.env" -}}

‎charts/shield/tests/cluster/deployment_test.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,35 @@ tests:
3232
value: myregistry.io/ext/sysdig/cluster-shield:1.4.0
3333
template: templates/cluster/deployment.yaml
3434

35+
- it: Specify digest in tag
36+
set:
37+
cluster:
38+
image:
39+
tag: 1.4.0@sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
40+
asserts:
41+
- equal:
42+
path: spec.template.spec.containers[?(@.name == "cluster-shield")].image
43+
value: quay.io/sysdig/cluster-shield:1.4.0@sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
44+
- isSubset:
45+
path: metadata.labels
46+
content:
47+
sysdig/component-version: 1.4.0
48+
template: templates/cluster/deployment.yaml
49+
50+
- it: Specify digest only
51+
set:
52+
cluster:
53+
image:
54+
tag: sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
55+
asserts:
56+
- equal:
57+
path: spec.template.spec.containers[?(@.name == "cluster-shield")].image
58+
value: quay.io/sysdig/cluster-shield@sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
59+
- equal:
60+
path: metadata.labels["sysdig/component-version"]
61+
value: sha256_e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b
62+
template: templates/cluster/deployment.yaml
63+
3564
- it: Does not contain proxy environment variables
3665
asserts:
3766
- containsDocument:

‎charts/shield/tests/host/daemonset-windows_test.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -436,3 +436,30 @@ tests:
436436
asserts:
437437
- isNullOrEmpty:
438438
path: spec.template.spec.imagePullSecrets
439+
440+
- it: Digest in image tag
441+
set:
442+
host_windows:
443+
image:
444+
tag: 0.10.0@sha256:61fdf83f6ec198919d595ea1e6dc093258dfcdc3d75db81fe060b65cd6d7aba0
445+
asserts:
446+
- equal:
447+
path: spec.template.spec.containers[?(@.name == "sysdig-host-shield")].image
448+
value: quay.io/sysdig/host-shield:0.10.0@sha256:61fdf83f6ec198919d595ea1e6dc093258dfcdc3d75db81fe060b65cd6d7aba0
449+
- isSubset:
450+
path: metadata.labels
451+
content:
452+
sysdig/component-version: 0.10.0
453+
454+
- it: Specify digest only
455+
set:
456+
host_windows:
457+
image:
458+
tag: sha256:61fdf83f6ec198919d595ea1e6dc093258dfcdc3d75db81fe060b65cd6d7aba0
459+
asserts:
460+
- equal:
461+
path: spec.template.spec.containers[?(@.name == "sysdig-host-shield")].image
462+
value: quay.io/sysdig/host-shield@sha256:61fdf83f6ec198919d595ea1e6dc093258dfcdc3d75db81fe060b65cd6d7aba0
463+
- equal:
464+
path: metadata.labels["sysdig/component-version"]
465+
value: sha256_61fdf83f6ec198919d595ea1e6dc093258dfcdc3d75db81fe060b65c

‎charts/shield/tests/host/daemonset_test.yaml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -179,6 +179,63 @@ tests:
179179
path: spec.template.spec.containers[?(@.name == "sysdig-host-shield")].image
180180
value: quay.io/sysdig/agent-slim:latest
181181

182+
- it: Digest in image tag
183+
set:
184+
host:
185+
image:
186+
tag: 14.1.0@sha256:2c6401018cfe3f5fcbd0713b64b096c38d47de1b5cd6c11de4691912752263fc
187+
asserts:
188+
- equal:
189+
path: spec.template.spec.containers[?(@.name == "sysdig-host-shield")].image
190+
value: quay.io/sysdig/agent-slim:14.1.0@sha256:2c6401018cfe3f5fcbd0713b64b096c38d47de1b5cd6c11de4691912752263fc
191+
- isSubset:
192+
path: metadata.labels
193+
content:
194+
sysdig/component-version: 14.1.0
195+
196+
- it: Specify digest only
197+
set:
198+
host:
199+
image:
200+
tag: sha256:2c6401018cfe3f5fcbd0713b64b096c38d47de1b5cd6c11de4691912752263fc
201+
driver: universal_ebpf
202+
asserts:
203+
- equal:
204+
path: spec.template.spec.containers[?(@.name == "sysdig-host-shield")].image
205+
value: quay.io/sysdig/agent-slim@sha256:2c6401018cfe3f5fcbd0713b64b096c38d47de1b5cd6c11de4691912752263fc
206+
- equal:
207+
path: metadata.labels["sysdig/component-version"]
208+
value: sha256_2c6401018cfe3f5fcbd0713b64b096c38d47de1b5cd6c11de4691912
209+
210+
- it: Digest is not used when tag is specified in kmodule image
211+
set:
212+
host:
213+
image:
214+
tag: 14.1.0@sha256:2c6401018cfe3f5fcbd0713b64b096c38d47de1b5cd6c11de4691912752263fc
215+
asserts:
216+
- equal:
217+
path: spec.template.spec.initContainers[?(@.name == "sysdig-host-shield-kmodule")].image
218+
value: quay.io/sysdig/agent-kmodule:14.1.0
219+
220+
- it: Digest only can't be used when tag is not specified and kmodule image is required
221+
set:
222+
host:
223+
image:
224+
tag: sha256:2c6401018cfe3f5fcbd0713b64b096c38d47de1b5cd6c11de4691912752263fc
225+
asserts:
226+
- failedTemplate:
227+
errorMessage: Image tag sha256:2c6401018cfe3f5fcbd0713b64b096c38d47de1b5cd6c11de4691912752263fc can't be speficied when not using universal_ebpf driver
228+
229+
- it: Digest only can't be used when tag is not specified and kmodule image is required
230+
set:
231+
host:
232+
driver: universal_ebpf
233+
image:
234+
tag: sha256:2c6401018cfe3f5fcbd0713b64b096c38d47de1b5cd6c11de4691912752263fc
235+
asserts:
236+
- notExists:
237+
path: spec.template.spec.initContainers[?(@.name == "sysdig-host-shield-kmodule")]
238+
182239
- it: Default workload labels
183240
set:
184241
host:

0 commit comments

Comments
 (0)