Skip to content

Commit 32e7a66

Browse files
chen-keinanchen-keinan
authored
fix: kubelet checks via config resource (#88)
* fix: kubelet checks via config resource Signed-off-by: chenk <hen.keinan@gmail.com> * fix: kubelet checks via config resource Signed-off-by: chenk <hen.keinan@gmail.com> * fix: kubelet checks via config resource Signed-off-by: chenk <hen.keinan@gmail.com> * fix: kubelet checks via config resource Signed-off-by: chenk <hen.keinan@gmail.com> * fix: kubelet checks via config resource Signed-off-by: chenk <hen.keinan@gmail.com> * fix: kubelet checks via config resource Signed-off-by: chenk <hen.keinan@gmail.com> * fix: kubelet checks via config resource Signed-off-by: chenk <hen.keinan@gmail.com> --------- Signed-off-by: chenk <hen.keinan@gmail.com>
1 parent 9bde47f commit 32e7a66

File tree

5 files changed

+98
-37
lines changed

5 files changed

+98
-37
lines changed

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/aquasecurity/k8s-node-collector
22

3-
go 1.19
3+
go 1.21
44

55
require (
66
github.com/olekukonko/tablewriter v0.0.5

‎go.sum‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDk
1010
github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
1111
github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
1212
github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
13+
github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
1314
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
1415
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
1516
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -30,6 +31,7 @@ github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En
3031
github.com/go-openapi/swag v0.22.3 h1:yMBqmnQ0gyZvEb/+KzuWZOXgllrXT4SADYbvDaXHv/g=
3132
github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
3233
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
34+
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
3335
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
3436
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
3537
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
@@ -59,10 +61,12 @@ github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
5961
github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
6062
github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
6163
github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
64+
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
6265
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
6366
github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
6467
github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
6568
github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 h1:K6RDEckDVWvDI9JAJYCmNdQXq6neHJOYx3V6jnqNEec=
69+
github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
6670
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
6771
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
6872
github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
@@ -81,6 +85,7 @@ github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI
8185
github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
8286
github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
8387
github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
88+
github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
8489
github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
8590
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
8691
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -105,7 +110,9 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8m
105110
github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
106111
github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
107112
github.com/onsi/ginkgo/v2 v2.13.0 h1:0jY9lJquiL8fcf3M4LAXN5aMlS/b2BV86HFFPCPMgE4=
113+
github.com/onsi/ginkgo/v2 v2.13.0/go.mod h1:TE309ZR8s5FsKKpuB1YAQYBzCaAfUgatB/xlT/ETL/o=
108114
github.com/onsi/gomega v1.29.0 h1:KIA/t2t5UBzoirT4H9tsML45GEbo3ouUnBHsCfD2tVg=
115+
github.com/onsi/gomega v1.29.0/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ=
109116
github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI=
110117
github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
111118
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@@ -114,8 +121,10 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
114121
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
115122
github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
116123
github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
124+
github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
117125
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
118126
github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0=
127+
github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
119128
github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0=
120129
github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
121130
github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
@@ -195,6 +204,7 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn
195204
golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
196205
golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
197206
golang.org/x/tools v0.12.0 h1:YW6HUoUmYBpwSgyaGaZq1fHjrBjX1rlpZ54T6mu2kss=
207+
golang.org/x/tools v0.12.0/go.mod h1:Sc0INKfu04TlqNoRA1hgpFZbhYXHPr4V5DzpSBTPqQM=
198208
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
199209
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
200210
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

‎job.yaml‎

Lines changed: 73 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,41 @@
1+
---
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRole
4+
metadata:
5+
name: node-collector
6+
rules:
7+
- apiGroups:
8+
- ""
9+
resources:
10+
- nodes/proxy
11+
verbs:
12+
- get
13+
14+
---
15+
apiVersion: v1
16+
kind: ServiceAccount
17+
metadata:
18+
name: node-collector
19+
labels:
20+
app.kubernetes.io/managed-by: kubectl
21+
22+
---
23+
apiVersion: rbac.authorization.k8s.io/v1
24+
kind: ClusterRoleBinding
25+
metadata:
26+
name: node-collector
27+
labels:
28+
app.kubernetes.io/version: 0.17.1
29+
app.kubernetes.io/managed-by: kubectl
30+
roleRef:
31+
apiGroup: rbac.authorization.k8s.io
32+
kind: ClusterRole
33+
name: node-collector
34+
subjects:
35+
- kind: ServiceAccount
36+
name: node-collector
37+
namespace: default
38+
139
---
240
apiVersion: batch/v1
341
kind: Job
@@ -9,12 +47,31 @@ spec:
947
labels:
1048
app: node-collector
1149
spec:
50+
dnsPolicy: ClusterFirst
1251
hostPID: true
52+
automountServiceAccountToken: true
53+
serviceAccountName: node-collector
1354
containers:
1455
- name: node-collector
15-
image: ghcr.io/aquasecurity/node-collector:0.0.9
16-
command: ["node-collector"]
17-
args: ["k8s", "--node", "minikube"]
56+
image: ghcr.io/aquasecurity/node-collector:0.1.1
57+
command:
58+
- node-collector
59+
args:
60+
- k8s
61+
resources:
62+
limits:
63+
cpu: 100m
64+
memory: 100M
65+
requests:
66+
cpu: 50m
67+
memory: 50M
68+
securityContext:
69+
allowPrivilegeEscalation: false
70+
capabilities:
71+
drop:
72+
- all
73+
privileged: false
74+
readOnlyRootFilesystem: true
1875
volumeMounts:
1976
- name: var-lib-etcd
2077
mountPath: /var/lib/etcd
@@ -34,55 +91,40 @@ spec:
3491
- name: lib-systemd
3592
mountPath: /lib/systemd/
3693
readOnly: true
37-
- name: srv-kubernetes
38-
mountPath: /srv/kubernetes/
39-
readOnly: true
4094
- name: etc-kubernetes
4195
mountPath: /etc/kubernetes
4296
readOnly: true
43-
# /usr/local/mount-from-host/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version.
44-
# You can omit this mount if you specify --version as part of the command.
45-
- name: usr-bin
46-
mountPath: /usr/local/mount-from-host/bin
47-
readOnly: true
4897
- name: etc-cni-netd
4998
mountPath: /etc/cni/net.d/
5099
readOnly: true
51-
- name: opt-cni-bin
52-
mountPath: /opt/cni/bin/
53-
readOnly: true
54100
restartPolicy: Never
101+
securityContext:
102+
runAsGroup: 0
103+
runAsUser: 0
104+
seccompProfile:
105+
type: RuntimeDefault
55106
volumes:
56107
- name: var-lib-etcd
57108
hostPath:
58-
path: "/var/lib/etcd"
109+
path: /var/lib/etcd
59110
- name: var-lib-kubelet
60111
hostPath:
61-
path: "/var/lib/kubelet"
112+
path: /var/lib/kubelet
62113
- name: var-lib-kube-scheduler
63114
hostPath:
64-
path: "/var/lib/kube-scheduler"
115+
path: /var/lib/kube-scheduler
65116
- name: var-lib-kube-controller-manager
66117
hostPath:
67-
path: "/var/lib/kube-controller-manager"
118+
path: /var/lib/kube-controller-manager
68119
- name: etc-systemd
69120
hostPath:
70-
path: "/etc/systemd"
121+
path: /etc/systemd
71122
- name: lib-systemd
72123
hostPath:
73-
path: "/lib/systemd"
74-
- name: srv-kubernetes
75-
hostPath:
76-
path: "/srv/kubernetes"
124+
path: /lib/systemd
77125
- name: etc-kubernetes
78126
hostPath:
79-
path: "/etc/kubernetes"
80-
- name: usr-bin
81-
hostPath:
82-
path: "/usr/bin"
127+
path: /etc/kubernetes
83128
- name: etc-cni-netd
84129
hostPath:
85-
path: "/etc/cni/net.d/"
86-
- name: opt-cni-bin
87-
hostPath:
88-
path: "/opt/cni/bin/"
130+
path: /etc/cni/net.d/

‎pkg/collector/cluster.go‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -37,19 +37,22 @@ func GetCluster() (*Cluster, error) {
3737
cf := genericclioptions.NewConfigFlags(true)
3838
rest.SetDefaultWarningHandler(rest.NoWarnings{})
3939
clientConfig := cf.ToRawKubeConfigLoader()
40-
rc, err := clientConfig.ClientConfig()
40+
restMapper, err := cf.ToRESTMapper()
4141
if err != nil {
4242
return nil, err
4343
}
44-
restMapper, err := cf.ToRESTMapper()
44+
// creates the in-cluster config
45+
config, err := rest.InClusterConfig()
4546
if err != nil {
4647
return nil, err
4748
}
48-
clientset, err := kubernetes.NewForConfig(rc)
49+
// creates the clientset
50+
clientset, err := kubernetes.NewForConfig(config)
4951
if err != nil {
5052
return nil, err
5153
}
52-
k8sDynamicClient, err := dynamic.NewForConfig(rc)
54+
55+
k8sDynamicClient, err := dynamic.NewForConfig(config)
5356
if err != nil {
5457
return nil, err
5558
}

‎pkg/collector/collect.go‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -126,14 +126,20 @@ func getValuesFromkubeletConfig(ctx context.Context, nodeName string, cluster Cl
126126
values := nodeConfig["kubeletconfig"]
127127
for k, v := range configMapper {
128128
p := values
129+
var found bool
129130
splittedValues := StringToArray(v, ".")
130131
for _, sv := range splittedValues {
131132
next := p.(map[string]interface{})
132133
if k, ok := next[sv.(string)]; ok {
134+
found = true
133135
p = k
136+
} else {
137+
found = false
134138
}
135139
}
136-
overrideConfig[k] = &Info{Values: []interface{}{p}}
140+
if found {
141+
overrideConfig[k] = &Info{Values: []interface{}{p}}
142+
}
137143
}
138144
return overrideConfig, nil
139145
}

0 commit comments

Comments
 (0)