Skip to content

Commit cc5aada

Browse files
ombellareombellare
authored
Add support for policy capture fields (#440)
1 parent bf2eb19 commit cc5aada

11 files changed

+92
-7
lines changed

‎sysdig/data_source_sysdig_secure_policy.go‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,18 @@ func createPolicyDataSourceSchema() map[string]*schema.Schema {
9898
Type: schema.TypeString,
9999
Computed: true,
100100
},
101+
"filter": {
102+
Type: schema.TypeString,
103+
Computed: true,
104+
},
105+
"bucket_name": {
106+
Type: schema.TypeString,
107+
Computed: true,
108+
},
109+
"folder": {
110+
Type: schema.TypeString,
111+
Computed: true,
112+
},
101113
},
102114
},
103115
},
@@ -134,6 +146,9 @@ func policyDataSourceToResourceData(policy v2.Policy, d *schema.ResourceData) {
134146
"seconds_after_event": action.AfterEventNs / 1000000000,
135147
"seconds_before_event": action.BeforeEventNs / 1000000000,
136148
"name": action.Name,
149+
"filter": action.Filter,
150+
"bucket_name": action.BucketName,
151+
"folder": action.Folder,
137152
}}
138153
}
139154
}

‎sysdig/internal/client/v2/model.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -260,10 +260,15 @@ type PolicyRule struct {
260260
Enabled bool `json:"enabled"`
261261
}
262262

263+
// Did not add support storageId because FE does not support it yet
263264
type Action struct {
264265
AfterEventNs int `json:"afterEventNs,omitempty"`
265266
BeforeEventNs int `json:"beforeEventNs,omitempty"`
266267
Name string `json:"name,omitempty"`
268+
Filter string `json:"filter,omitempty"`
269+
StorageType string `json:"storageType,omitempty"`
270+
BucketName string `json:"bucketName,omitempty"`
271+
Folder string `json:"folder,omitempty"`
267272
IsLimitedToContainer bool `json:"isLimitedToContainer"`
268273
Type string `json:"type"`
269274
}

‎sysdig/resource_sysdig_secure_policy.go‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,21 @@ var policyActionBlockSchema = &schema.Schema{
9191
Type: schema.TypeString,
9292
Required: true,
9393
},
94+
"filter": {
95+
Type: schema.TypeString,
96+
Optional: true,
97+
Default: "",
98+
},
99+
"bucket_name": {
100+
Type: schema.TypeString,
101+
Optional: true,
102+
Default: "",
103+
},
104+
"folder": {
105+
Type: schema.TypeString,
106+
Optional: true,
107+
Default: "/",
108+
},
94109
},
95110
},
96111
},
@@ -194,6 +209,9 @@ func commonPolicyToResourceData(policy *v2.Policy, d *schema.ResourceData) {
194209
"seconds_after_event": action.AfterEventNs / 1000000000,
195210
"seconds_before_event": action.BeforeEventNs / 1000000000,
196211
"name": action.Name,
212+
"filter": action.Filter,
213+
"bucket_name": action.BucketName,
214+
"folder": action.Folder,
197215
}}
198216
}
199217
}
@@ -276,12 +294,19 @@ func addActionsToPolicy(d *schema.ResourceData, policy *v2.Policy) {
276294
afterEventNs := d.Get("actions.0.capture.0.seconds_after_event").(int) * 1000000000
277295
beforeEventNs := d.Get("actions.0.capture.0.seconds_before_event").(int) * 1000000000
278296
name := d.Get("actions.0.capture.0.name").(string)
297+
filter := d.Get("actions.0.capture.0.filter").(string)
298+
bucketName := d.Get("actions.0.capture.0.bucket_name").(string)
299+
folder := d.Get("actions.0.capture.0.folder").(string)
279300
policy.Actions = append(policy.Actions, v2.Action{
280301
Type: "POLICY_ACTION_CAPTURE",
281302
IsLimitedToContainer: false,
282303
AfterEventNs: afterEventNs,
283304
BeforeEventNs: beforeEventNs,
284305
Name: name,
306+
Filter: filter,
307+
StorageType: "S3",
308+
BucketName: bucketName,
309+
Folder: folder,
285310
})
286311
}
287312
}

‎sysdig/resource_sysdig_secure_policy_test.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,9 @@ resource "sysdig_secure_policy" "sample" {
7979
seconds_before_event = 5
8080
seconds_after_event = 10
8181
name = "testcapture"
82+
filter = "proc.name=cat"
83+
bucket_name = "testbucket"
84+
folder = "testfolder"
8285
}
8386
}
8487
@@ -147,6 +150,8 @@ resource "sysdig_secure_policy" "sample_%d" {
147150
seconds_before_event = 5
148151
seconds_after_event = 10
149152
name = "capture_name"
153+
filter = "proc.name=cat"
154+
bucket_name = "testbucket"
150155
}
151156
}
152157
}

‎website/docs/d/secure_custom_policy.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,4 +63,9 @@ The actions block is optional and supports:
6363
amount of seconds before the policy was triggered.
6464
* `seconds_after_event` - (Required) Captures the system calls for the amount
6565
of seconds after the policy was triggered.
66-
* `name` - (Optional) The name of the capture file
66+
* `name` - (Required) The name of the capture file
67+
* `filter` - (Optional) Additional filter to apply to the capture. For example: `proc.name=cat`
68+
* `bucket_name` - (Optional) Custom bucket to store capture in,
69+
bucket should be onboarded in Integrations > S3 Capture Storage. Default is to use Sysdig Secure Storage
70+
* `folder` - (Optional) Name of folder to store capture inside the bucket.
71+
By default we will store the capture file at the root of the bucket

‎website/docs/d/secure_managed_policy.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,4 +63,9 @@ The actions block is optional and supports:
6363
amount of seconds before the policy was triggered.
6464
* `seconds_after_event` - (Required) Captures the system calls for the amount
6565
of seconds after the policy was triggered.
66-
* `name` - (Optional) The name of the capture file
66+
* `name` - (Required) The name of the capture file
67+
* `filter` - (Optional) Additional filter to apply to the capture. For example: `proc.name=cat`
68+
* `bucket_name` - (Optional) Custom bucket to store capture in,
69+
bucket should be onboarded in Integrations > S3 Capture Storage. Default is to use Sysdig Secure Storage
70+
* `folder` - (Optional) Name of folder to store capture inside the bucket.
71+
By default we will store the capture file at the root of the bucket

‎website/docs/d/secure_managed_ruleset.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,4 +63,9 @@ The actions block is optional and supports:
6363
amount of seconds before the policy was triggered.
6464
* `seconds_after_event` - (Required) Captures the system calls for the amount
6565
of seconds after the policy was triggered.
66-
* `name` - (Optional) The name of the capture file
66+
* `name` - (Required) The name of the capture file
67+
* `filter` - (Optional) Additional filter to apply to the capture. For example: `proc.name=cat`
68+
* `bucket_name` - (Optional) Custom bucket to store capture in,
69+
bucket should be onboarded in Integrations > S3 Capture Storage. Default is to use Sysdig Secure Storage
70+
* `folder` - (Optional) Name of folder to store capture inside the bucket.
71+
By default we will store the capture file at the root of the bucket

‎website/docs/r/secure_custom_policy.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,12 @@ The actions block is optional and supports:
8686
amount of seconds before the policy was triggered.
8787
* `seconds_after_event` - (Required) Captures the system calls for the amount
8888
of seconds after the policy was triggered.
89-
* `name` - (Optional) The name of the capture file
89+
* `name` - (Required) The name of the capture file
90+
* `filter` - (Optional) Additional filter to apply to the capture. For example: `proc.name=cat`
91+
* `bucket_name` - (Optional) Custom bucket to store capture in,
92+
bucket should be onboarded in Integrations > S3 Capture Storage. Default is to use Sysdig Secure Storage
93+
* `folder` - (Optional) Name of folder to store capture inside the bucket.
94+
By default we will store the capture file at the root of the bucket
9095

9196
- - -
9297

‎website/docs/r/secure_managed_policy.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,12 @@ The actions block is optional and supports:
8080
amount of seconds before the policy was triggered.
8181
* `seconds_after_event` - (Required) Captures the system calls for the amount
8282
of seconds after the policy was triggered.
83-
* `name` - (Optional) The name of the capture file
83+
* `name` - (Required) The name of the capture file
84+
* `filter` - (Optional) Additional filter to apply to the capture. For example: `proc.name=cat`
85+
* `bucket_name` - (Optional) Custom bucket to store capture in,
86+
bucket should be onboarded in Integrations > S3 Capture Storage. Default is to use Sysdig Secure Storage
87+
* `folder` - (Optional) Name of folder to store capture inside the bucket.
88+
By default we will store the capture file at the root of the bucket
8489

8590
- - -
8691

‎website/docs/r/secure_managed_ruleset.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,12 @@ The actions block is optional and supports:
9595
amount of seconds before the policy was triggered.
9696
* `seconds_after_event` - (Required) Captures the system calls for the amount
9797
of seconds after the policy was triggered.
98-
* `name` - (Optional) The name of the capture file
98+
* `name` - (Required) The name of the capture file
99+
* `filter` - (Optional) Additional filter to apply to the capture. For example: `proc.name=cat`
100+
* `bucket_name` - (Optional) Custom bucket to store capture in,
101+
bucket should be onboarded in Integrations > S3 Capture Storage. Default is to use Sysdig Secure Storage
102+
* `folder` - (Optional) Name of folder to store capture inside the bucket.
103+
By default we will store the capture file at the root of the bucket
99104

100105
- - -
101106

0 commit comments

Comments
 (0)