feat(serverless-agent): add parameter to use bare pdig to instrument certain containers (#380)

Signed-off-by: francesco-racciatti <[email protected]>

Author: francesco-racciatti

sysdig/data_source_sysdig_fargate_ECS_test.go

@@ -5,37 +5,17 @@ package sysdig
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"os"
+	"reflect"
 	"sort"
 	"testing"
 
 	"github.com/Jeffail/gabs/v2"
 	"github.com/falcosecurity/kilt/runtimes/cloudformation/cfnpatcher"
 	"github.com/stretchr/testify/assert"
-)
-
-var (
-	testKiltDefinition = KiltRecipeConfig{
-		SysdigAccessKey:  "sysdig_access_key",
-		AgentImage:       "workload_agent_image",
-		OrchestratorHost: "orchestrator_host",
-		OrchestratorPort: "orchestrator_port",
-		CollectorHost:    "collector_host",
-		CollectorPort:    "collector_port",
-		SysdigLogging:    "sysdig_logging",
-	}
-
-	testIgnoreContainers = []string{}
 
-	testContainerDefinitionFiles = []string{
-		"fargate_entrypoint_test",
-		"fargate_env_test",
-		"fargate_cmd_test",
-		"fargate_linuxparameters_test",
-		"fargate_combined_test",
-		"fargate_volumesfrom_test",
-		"fargate_field_case_test",
-	}
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 )
 
 // sortContainerEnv goes into a container definition and sorts the environment variables
@@ -59,12 +39,8 @@ func sortAndCompare(t *testing.T, expected []byte, actual []byte) {
 	assert.JSONEq(t, expectedJSON, actualJSON)
 }
 
-func TestECStransformation(t *testing.T) {
-	inputfile, err := os.ReadFile("testfiles/ECSinput.json")
-	if err != nil {
-		t.Fatalf("Cannot find testfiles/ECSinput.json")
-	}
-
+// getKiltRecipe returns the default json Kilt recipe
+func getKiltRecipe(t *testing.T) string {
 	recipeConfig := KiltRecipeConfig{
 		SysdigAccessKey:  "sysdig_access_key",
 		AgentImage:       "workload_agent_image",
@@ -75,20 +51,144 @@ func TestECStransformation(t *testing.T) {
 		SysdigLogging:    "sysdig_logging",
 	}
 
-	jsonConf, err := json.Marshal(&recipeConfig)
+	jsonRecipeConfig, err := json.Marshal(&recipeConfig)
 	if err != nil {
 		t.Fatalf("Failed to serialize configuration: %v", err.Error())
 	}
 
+	return string(jsonRecipeConfig)
+}
+
+func TestContains(t *testing.T) {
+	tests := []struct {
+		slice  []string
+		target string
+		result bool
+	}{
+		{
+			slice:  []string{"gimme", "fried", "chicken"},
+			target: "chicken",
+			result: true,
+		},
+		{
+			slice:  []string{"the", "answer", "is"},
+			target: "42",
+			result: false,
+		},
+		{
+			slice:  []string{""},
+			target: "empty",
+			result: false,
+		},
+	}
+	for idx, tc := range tests {
+		t.Run(fmt.Sprintf("%d", idx), func(t *testing.T) {
+			result := contains(tc.slice, tc.target)
+			assert.Equal(t, tc.result, result, "Error, expected: %t, got: %t", tc.result, result)
+		})
+	}
+}
+
+func TestNewPatchOptions(t *testing.T) {
+	newMockResource := func() *schema.Resource {
+		return &schema.Resource{
+			Schema: map[string]*schema.Schema{
+				"ignore_containers": {
+					Type: schema.TypeList,
+					Elem: &schema.Schema{Type: schema.TypeString},
+				},
+				"bare_pdig_on_containers": {
+					Type: schema.TypeList,
+					Elem: &schema.Schema{Type: schema.TypeString},
+				},
+				"log_configuration": {
+					Type:     schema.TypeSet,
+					MaxItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"group": {
+								Type:     schema.TypeString,
+								Required: true,
+							},
+							"stream_prefix": {
+								Type:     schema.TypeString,
+								Required: true,
+							},
+							"region": {
+								Type:     schema.TypeString,
+								Required: true,
+							},
+						},
+					},
+				},
+			},
+		}
+	}
+
+	// Create a mock resource
+	resource := newMockResource()
+	data := resource.Data(nil)
+
+	var err error
+	err = data.Set("bare_pdig_on_containers", []interface{}{
+		"gimme", "fried", "chicken",
+	})
+	if err != nil {
+		assert.FailNow(t, fmt.Sprintf("Could not set bare_pdig_on_containers, got error: %v", err))
+	}
+
+	err = data.Set("ignore_containers", []interface{}{
+		"gimme", "fried", "chicken",
+	})
+	if err != nil {
+		assert.FailNow(t, fmt.Sprintf("Could not set ignore_containers, got error: %v", err))
+	}
+
+	err = data.Set("log_configuration", []interface{}{
+		map[string]interface{}{
+			"group":         "gimme",
+			"stream_prefix": "fried",
+			"region":        "chicken",
+		},
+	})
+	if err != nil {
+		assert.FailNow(t, fmt.Sprintf("Could not set log_configuration, got error: %v", err))
+	}
+
+	// Expected vs actual
+	expectedPatchOptions := &patchOptions{
+		BarePdigOnContainers: []string{"gimme", "fried", "chicken"},
+		IgnoreContainers:     []string{"gimme", "fried", "chicken"},
+		LogConfiguration: map[string]interface{}{
+			"group":         "gimme",
+			"stream_prefix": "fried",
+			"region":        "chicken",
+		},
+	}
+	actualPatchOptions := newPatchOptions(data)
+
+	if !reflect.DeepEqual(expectedPatchOptions, actualPatchOptions) {
+		t.Errorf("patcConfigurations are not equal. Expected: %v, Actual: %v", expectedPatchOptions, actualPatchOptions)
+	}
+}
+
+func TestECStransformation(t *testing.T) {
+	inputfile, err := os.ReadFile("testfiles/ECSinput.json")
+	if err != nil {
+		t.Fatalf("Cannot find testfiles/ECSinput.json")
+	}
+
 	kiltConfig := &cfnpatcher.Configuration{
 		Kilt:               agentinoKiltDefinition,
 		ImageAuthSecret:    "image_auth_secret",
 		OptIn:              false,
 		UseRepositoryHints: true,
-		RecipeConfig:       string(jsonConf),
+		RecipeConfig:       getKiltRecipe(t),
 	}
 
-	patchedOutput, err := patchFargateTaskDefinition(context.Background(), string(inputfile), kiltConfig, nil, &testIgnoreContainers)
+	patchOpts := &patchOptions{}
+
+	patchedOutput, err := patchFargateTaskDefinition(context.Background(), string(inputfile), kiltConfig, patchOpts)
 	if err != nil {
 		t.Fatalf("Cannot execute PatchFargateTaskDefinition : %v", err.Error())
 	}
@@ -140,66 +240,97 @@ func TestECStransformation(t *testing.T) {
 	assert.Equal(t, patchedContainerDefinitions[0].EntryPoint2, "")
 }
 
-func TestTransform(t *testing.T) {
-	for _, testName := range testContainerDefinitionFiles {
-		t.Run(testName, func(t *testing.T) {
-			jsonConfig, _ := json.Marshal(testKiltDefinition)
-			kiltConfig := &cfnpatcher.Configuration{
-				Kilt:               agentinoKiltDefinition,
-				ImageAuthSecret:    "image_auth_secret",
-				OptIn:              false,
-				UseRepositoryHints: true,
-				RecipeConfig:       string(jsonConfig),
-			}
-
-			inputContainerDefinition, _ := os.ReadFile("testfiles/" + testName + ".json")
-			patched, _ := patchFargateTaskDefinition(context.Background(), string(inputContainerDefinition), kiltConfig, nil, &testIgnoreContainers)
-			expectedContainerDefinition, _ := os.ReadFile("testfiles/" + testName + "_expected.json")
-
-			sortAndCompare(t, expectedContainerDefinition, []byte(*patched))
-		})
-	}
-}
-
-func TestLogGroup(t *testing.T) {
-	jsonConfig, _ := json.Marshal(testKiltDefinition)
+func TestPatchFargateTaskDefinition(t *testing.T) {
+	// Kilt Configuration, test invariant
 	kiltConfig := &cfnpatcher.Configuration{
 		Kilt:               agentinoKiltDefinition,
 		ImageAuthSecret:    "image_auth_secret",
 		OptIn:              false,
 		UseRepositoryHints: true,
-		RecipeConfig:       string(jsonConfig),
+		RecipeConfig:       getKiltRecipe(t),
 	}
 
-	logConfig := map[string]interface{}{
-		"group":         "test_log_group",
-		"stream_prefix": "test_prefix",
-		"region":        "test_region",
+	// File readers
+	readFile := func(fileName string) string {
+		content, _ := os.ReadFile("testfiles/" + fileName + ".json")
+		return string(content)
 	}
 
-	inputContainerDefinition, _ := os.ReadFile("testfiles/fargate_log_group.json")
-	patched, _ := patchFargateTaskDefinition(context.Background(), string(inputContainerDefinition), kiltConfig, logConfig, &testIgnoreContainers)
-	expectedContainerDefinition, _ := os.ReadFile("testfiles/fargate_log_group_expected.json")
-
-	sortAndCompare(t, expectedContainerDefinition, []byte(*patched))
-}
-
-func TestIgnoreContainers(t *testing.T) {
-	jsonConfig, _ := json.Marshal(testKiltDefinition)
-	kiltConfig := &cfnpatcher.Configuration{
-		Kilt:               agentinoKiltDefinition,
-		ImageAuthSecret:    "image_auth_secret",
-		OptIn:              false,
-		UseRepositoryHints: true,
-		RecipeConfig:       string(jsonConfig),
+	getContainerDefinitionOriginal := func(fileName string) string {
+		return readFile(fileName)
 	}
 
-	fileTemplate := "fargate_ignore_container_test"
-	ignoreContainers := []string{"other", "another"}
-
-	inputContainerDefinition, _ := os.ReadFile("testfiles/" + fileTemplate + ".json")
-	patched, _ := patchFargateTaskDefinition(context.Background(), string(inputContainerDefinition), kiltConfig, nil, &ignoreContainers)
-	expectedContainerDefinition, _ := os.ReadFile("testfiles/" + fileTemplate + "_expected.json")
+	getContainerDefinitionPatched := func(fileName string) string {
+		return readFile(fileName + "_expected")
+	}
 
-	sortAndCompare(t, expectedContainerDefinition, []byte(*patched))
+	tests := []struct {
+		testName  string
+		patchOpts *patchOptions
+	}{
+		{
+			testName:  `fargate_entrypoint_test`,
+			patchOpts: &patchOptions{},
+		},
+		{
+			testName:  `fargate_env_test`,
+			patchOpts: &patchOptions{},
+		},
+		{
+			testName:  `fargate_cmd_test`,
+			patchOpts: &patchOptions{},
+		},
+		{
+			testName:  `fargate_linuxparameters_test`,
+			patchOpts: &patchOptions{},
+		},
+		{
+			testName:  `fargate_combined_test`,
+			patchOpts: &patchOptions{},
+		},
+		{
+			testName:  `fargate_volumesfrom_test`,
+			patchOpts: &patchOptions{},
+		},
+		{
+			testName:  `fargate_field_case_test`,
+			patchOpts: &patchOptions{},
+		},
+		{
+			testName: `fargate_log_group`,
+			patchOpts: &patchOptions{
+				LogConfiguration: map[string]interface{}{
+					"group":         "test_log_group",
+					"stream_prefix": "test_prefix",
+					"region":        "test_region",
+				},
+			},
+		},
+		{
+			testName: `fargate_ignore_container_test`,
+			patchOpts: &patchOptions{
+				IgnoreContainers: []string{"other", "another"},
+			},
+		},
+		{
+			testName: `fargate_bare_pdig`,
+			patchOpts: &patchOptions{
+				BarePdigOnContainers: []string{"barePdig"},
+				IgnoreContainers:     []string{"skipped"},
+			},
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.testName, func(t *testing.T) {
+			patched, err := patchFargateTaskDefinition(
+				context.Background(),
+				getContainerDefinitionOriginal(tc.testName),
+				kiltConfig,
+				tc.patchOpts)
+			if err != nil {
+				assert.FailNow(t, fmt.Sprintf("Could not patch task definition, got error: %v", err))
+			}
+			sortAndCompare(t, []byte(getContainerDefinitionPatched(tc.testName)), []byte(*patched))
+		})
+	}
 }