Skip to content

Commit

Permalink
feat(install): wait for KubeArmor to create probe file before probing
Browse files Browse the repository at this point in the history
We keep trying to probe information from KubeArmor till we get info out or context times out

Signed-off-by: daemon1024 <[email protected]>
  • Loading branch information
daemon1024 committed Jun 22, 2023
1 parent a1cc343 commit 7acb4d1
Show file tree
Hide file tree
Showing 2 changed files with 37 additions and 21 deletions.
52 changes: 35 additions & 17 deletions install/install.go
Original file line number Diff line number Diff line change
Expand Up @@ -105,7 +105,7 @@ func printAnimation(msg string, flag bool) int {
if flag {
progress++
}
printBar(" KubeArmor Installing ", 16)
printBar(" KubeArmor Installing ", 17)
return 0
}

Expand Down Expand Up @@ -141,23 +141,41 @@ func checkPods(c *k8s.Client, o Options) {
break
}
}
probeData, err := probe.ProbeRunningKubeArmorNodes(c, probe.Options{
Namespace: o.Namespace,
})
if err != nil || len(probeData) == 0 {
return
}
enforcing := true
for _, k := range probeData {
if k.ActiveLSM == "" || !k.ContainerSecurity {
enforcing = false
break
fmt.Print("\n🔧 Verifying KubeArmor functionality (this may take upto a minute) ...")
ctx, cancel := context.WithTimeout(context.Background(), 40*time.Second)
defer cancel()

for {
select {
case <-time.After(1 * time.Second):
case <-ctx.Done():
fmt.Print("⚠️ Failed verifying KubeArmor functionality ...")
return
}
}
if enforcing {
fmt.Print(color.New(color.FgWhite, color.Bold).Sprint("\n\t🛡️ Your Cluster is Armored Up Now! \n"))
} else {
color.Yellow("\n\t⚠️ KubeArmor is running in Audit mode, only Observability will be available and Policy Enforcement won't work. \n")
probeData, err := probe.ProbeRunningKubeArmorNodes(c, probe.Options{
Namespace: o.Namespace,
})
if err != nil || len(probeData) == 0 {
fmt.Printf("\r🔧 Verifying KubeArmor functionality (this may take upto a minute) ... %s", cursor[cursorcount])
cursorcount++
if cursorcount == 4 {
cursorcount = 0
}
continue
}
enforcing := true
for _, k := range probeData {
if k.ActiveLSM == "" || !k.ContainerSecurity {
enforcing = false
break
}
}
if enforcing {
fmt.Print(color.New(color.FgWhite, color.Bold).Sprint("\n\n\t🛡️ Your Cluster is Armored Up! \n"))
} else {
color.Yellow("\n\n\t⚠️ KubeArmor is running in Audit mode, only Observability will be available and Policy Enforcement won't work. \n")
}
break
}

}
Expand Down
6 changes: 2 additions & 4 deletions probe/probe.go
Original file line number Diff line number Diff line change
Expand Up @@ -489,9 +489,9 @@ func readDataFromKubeArmor(c *k8s.Client, o Options, nodeName string) (KubeArmor
VersionedParams(&corev1.PodExecOptions{
Container: pods.Items[0].Spec.Containers[0].Name,
Command: cmdArr,
Stdin: true,
Stdin: false,
Stdout: true,
Stderr: true,
Stderr: false,
TTY: false,
}, scheme.ParameterCodec)
exec, err := remotecommand.NewSPDYExecutor(c.Config, "POST", req.URL())
Expand All @@ -501,9 +501,7 @@ func readDataFromKubeArmor(c *k8s.Client, o Options, nodeName string) (KubeArmor
go func() {
defer outStream.Close()
err = exec.StreamWithContext(context.TODO(), remotecommand.StreamOptions{
Stdin: os.Stdin,
Stdout: outStream,
Stderr: os.Stderr,
Tty: false,
})
}()
Expand Down

0 comments on commit 7acb4d1

Please sign in to comment.