Skip to content

Commit 54f8c85

Browse files
mech-pigmech-pig
authored
release(sysdig-deploy,kspm-collector): kspm-collector v1.39.12 (#2255)
1 parent 9224156 commit 54f8c85

File tree

14 files changed

+280
-11
lines changed

14 files changed

+280
-11
lines changed

‎charts/kspm-collector/Chart.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
apiVersion: v2
22
name: kspm-collector
33
description: Sysdig KSPM collector
4-
version: 0.17.9
5-
appVersion: 1.39.11
4+
version: 0.18.0
5+
appVersion: 1.39.12
66
keywords:
77
- monitoring
88
- security

‎charts/kspm-collector/README.md

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,11 +45,13 @@ The following table lists the configurable parameters of the Sysdig KSPM Collect
4545
| `clusterName` | Sets a unique cluster name. This name will be used to identify events using the `kubernetes.cluster.name` tag. | ` ` |
4646
| `image.registry` | Specifies the KSPM collector image registry. | `quay.io` |
4747
| `image.repository` | Specifies the image repository to pull from. | `sysdig/kspm-collector` |
48-
| `image.tag` | Specifies the image tag to pull from the image repository. | `1.39.11` |
48+
| `image.tag` | Specifies the image tag to pull from the image repository. | `1.39.12` |
4949
| `image.digest` | Specifies the image digest to pull from the image repository. | ` ` |
5050
| `image.pullPolicy` | Specifies theImage pull policy. | `""` |
5151
| `imagePullSecrets` | Specifies the Image pull secret. | `[]` |
5252
| `replicas` | Specifies the KSPM collector deployment replicas. | `1` |
53+
| `transportLayer` | Determine the transport used by the collector to receive tasks from the backend and send results back to it. Valid values are "nats" and "http". | `http` |
54+
| `leaderElection.lockName` | Name of the k8s leader election lease lock. Applicable only if the transport layer is `http`. | `kspm-collector-leader-election` |
5355
| `namespaces.included` | Specifies the namespaces to include in the KSPM collector scans. If left empty, all the namesapces will be scanned. | `` |
5456
| `namespaces.excluded` | Specifies the namespaces to exclude in the KSPM collector scans. | `` |
5557
| `nodeSelector` | Specifies the Node Selector. | `{}` |
@@ -70,6 +72,7 @@ The following table lists the configurable parameters of the Sysdig KSPM Collect
7072
| `sslVerifyCertificate` | Sets `NATS_INSECURE` env variable on the KSPM collector containers. | |
7173
| `arch` | Specifies the allowed architectures for scheduling. | `[ amd64, arm64 ]` |
7274
| `os` | Specifies the allowed operating systems for scheduling. | `[ linux ]` |
75+
| `env` | Specifies the Extra environment variables that will be passed onto pods. | `{}` |
7376
| `affinity` | Specifies the node affinities. Overrides `arch` and `os` values. | `{}` |
7477
| `labels` | Specifies the KSPM collector specific labels as a multi-line templated string map or as YAML. | `{}` |
7578
| `annotations` | Specifies the deployment annotations as a multi-line templated string map or as YAML. | `{}` |

‎charts/kspm-collector/templates/_helpers.tpl

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -141,6 +141,12 @@ Sysdig NATS service URL
141141
{{- end -}}
142142
{{- end -}}
143143

144+
{{/*
145+
Returns the transport layer
146+
*/}}
147+
{{- define "kspmCollector.transportLayer" -}}
148+
{{ .Values.transportLayer | default "http" }}
149+
{{- end -}}
144150

145151
{{/*
146152
Returns the namespace for installing components
@@ -149,6 +155,17 @@ Returns the namespace for installing components
149155
{{- coalesce .Values.namespace .Release.Namespace -}}
150156
{{- end -}}
151157

158+
{{/*
159+
Returns the name of the lock for the leader election lease
160+
*/}}
161+
{{- define "kspmCollector.leaderElectionLeaseLockName" -}}
162+
{{- if eq (.Values.transportLayer | default "") "http" -}}
163+
{{- required "A valid lock name for the leader election is required when transport is http" .Values.leaderElection.lockName -}}
164+
{{- else -}}
165+
{{- .Values.leaderElection.lockName -}}
166+
{{- end -}}
167+
{{- end -}}
168+
152169
{{/*
153170
KSPM Collector nodeSelector
154171
*/}}

‎charts/kspm-collector/templates/configmap.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ data:
1111
{{- $env = "DEVELOPMENT" -}}
1212
{{ end}}
1313
environment: {{ $env }}
14+
api_endpoint: {{ include "kspmCollector.apiEndpoint" . }}
1415
included_namespaces: {{ .Values.namespaces.included | quote}}
1516
excluded_namespaces: {{ .Values.namespaces.excluded | quote }}
1617
included_workloads: {{ .Values.workloads.included | quote }}
@@ -21,6 +22,9 @@ data:
2122
nats_max_reconnect_failures: {{ .Values.natsMaxReconnectFailures | default 60 | quote }}
2223
cluster_name: {{ required "A valid clusterName is required" (include "kspmCollector.clusterName" .) }}
2324
nats_insecure: {{ include "kspmCollector.natsInsecure" . }}
25+
transport_layer: {{ include "kspmCollector.transportLayer" . }}
26+
leader_election_lease_lock_name: {{ include "kspmCollector.leaderElectionLeaseLockName" . }}
27+
leader_election_lease_lock_namespace: {{ include "kspmCollector.namespace" . }}
2428
{{- if (.Values.httpProxy | default .Values.global.proxy.httpProxy) }}
2529
http_proxy: {{ .Values.httpProxy | default .Values.global.proxy.httpProxy }}
2630
{{- end -}}

‎charts/kspm-collector/templates/deployment.yaml

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,11 @@ spec:
9494
resources:
9595
{{ toYaml .Values.resources | indent 10 }}
9696
env:
97+
- name: API_ENDPOINT
98+
valueFrom:
99+
configMapKeyRef:
100+
name: {{ template "kspmCollector.fullname" . }}
101+
key: api_endpoint
97102
- name: ACCESS_KEY
98103
valueFrom:
99104
secretKeyRef:
@@ -103,11 +108,32 @@ spec:
103108
name: {{ ( include "kspmCollector.accessKeySecret" .) }}
104109
{{- end }}
105110
key: access-key
111+
- name: KUBE_POD_NAME
112+
valueFrom:
113+
fieldRef:
114+
fieldPath: metadata.name
106115
- name: CLUSTER_NAME
107116
valueFrom:
108117
configMapKeyRef:
109118
name: {{ template "kspmCollector.fullname" . }}
110119
key: cluster_name
120+
- name: TRANSPORT_LAYER
121+
valueFrom:
122+
configMapKeyRef:
123+
name: {{ template "kspmCollector.fullname" . }}
124+
key: transport_layer
125+
- name: KUBE_LEADER_ELECTION_LEASE_LOCK_NAME
126+
valueFrom:
127+
configMapKeyRef:
128+
name: {{ template "kspmCollector.fullname" . }}
129+
key: leader_election_lease_lock_name
130+
optional: true
131+
- name: KUBE_LEADER_ELECTION_LEASE_LOCK_NAMESPACE
132+
valueFrom:
133+
configMapKeyRef:
134+
name: {{ template "kspmCollector.fullname" . }}
135+
key: leader_election_lease_lock_namespace
136+
optional: true
111137
- name: INCLUDED_NAMESPACES
112138
valueFrom:
113139
configMapKeyRef:
@@ -203,12 +229,18 @@ spec:
203229
- name: TLS_CA_PATHS
204230
value: /ca-certs/{{- include "sysdig.custom_ca.keyName" (dict "global" .Values.global.ssl "component" .Values.ssl) -}}
205231
{{- end }}
232+
{{- range $key, $value := .Values.env }}
233+
- name: "{{ $key }}"
234+
value: "{{ $value }}"
235+
{{- end }}
206236
volumeMounts:
207237
{{- if eq (include "sysdig.custom_ca.enabled" (dict "global" .Values.global.ssl "component" .Values.ssl)) "true" }}
208238
- mountPath: /ca-certs
209239
name: ca-cert
210240
readOnly: true
211241
{{- end }}
242+
- mountPath: /tmp
243+
name: tmp-dir
212244
volumes:
213245
{{- if eq (include "sysdig.custom_ca.useValues" (dict "global" .Values.global.ssl "component" .Values.ssl)) "true" }}
214246
- name: ca-cert
@@ -223,3 +255,5 @@ spec:
223255
configMap:
224256
name: {{ include "sysdig.custom_ca.existingConfigMap" (dict "global" .Values.global.ssl "component" .Values.ssl) }}
225257
{{- end }}
258+
- name: tmp-dir
259+
emptyDir: {}

‎charts/kspm-collector/templates/role.yaml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
{{- if .Values.rbac.create }}
2+
kind: Role
3+
apiVersion: rbac.authorization.k8s.io/v1
4+
metadata:
5+
name: {{ template "kspmCollector.fullname" . }}
6+
namespace: {{ include "kspmCollector.namespace" . }}
7+
labels:
8+
{{ include "kspmCollector.labels" . | indent 4 }}
9+
rules:
10+
{{- if eq (include "kspmCollector.transportLayer" .) "http" }}
11+
- apiGroups: ["", "coordination.k8s.io"]
12+
resources:
13+
- "leases"
14+
resourceNames:
15+
- {{ include "kspmCollector.leaderElectionLeaseLockName" . }}
16+
verbs: ["*"]
17+
- apiGroups: ["", "coordination.k8s.io"]
18+
resources:
19+
- "leases"
20+
verbs: ["create"]
21+
{{- end }}
22+
{{- end }}

‎charts/kspm-collector/templates/rolebinding.yaml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{{- if and .Values.rbac.create }}
2+
kind: RoleBinding
3+
apiVersion: rbac.authorization.k8s.io/v1
4+
metadata:
5+
name: {{ template "kspmCollector.fullname" .}}
6+
labels:
7+
{{ include "kspmCollector.labels" . | indent 4 }}
8+
subjects:
9+
- kind: ServiceAccount
10+
name: {{ template "kspmCollector.serviceAccountName" .}}
11+
namespace: {{ .Release.Namespace }}
12+
roleRef:
13+
kind: Role
14+
name: {{ template "kspmCollector.fullname" .}}
15+
apiGroup: rbac.authorization.k8s.io
16+
{{- end }}

‎charts/kspm-collector/tests/ca_cert_test.yaml

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,19 @@ tests:
2121
name: SSL_CERT_FILE
2222
value: "/ca-certs/global_root_ca.crt"
2323
template: deployment.yaml
24-
- isEmpty:
24+
- notContains:
2525
path: spec.template.spec.volumes
26+
content:
27+
name: ca-cert
28+
secret:
29+
secretName: release-name-kspm-collector-ca
2630
template: deployment.yaml
27-
- isEmpty:
31+
- notContains:
2832
path: spec.template.spec.containers[0].volumeMounts
33+
content:
34+
name: ca-cert
35+
mountPath: /ca-certs
36+
readOnly: true
2937
template: deployment.yaml
3038

3139
- it: Check Custom CA Cert defined with Values

‎charts/kspm-collector/tests/configmap_test.yaml

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
suite: KSPM Collector ConfigMap Tests
2+
templates:
3+
- configmap.yaml
4+
tests:
5+
- it: check that transport_layer is set with default value
6+
set:
7+
sysdig:
8+
accessKey: AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE
9+
clusterName: test-cluster
10+
asserts:
11+
- equal:
12+
path: data.transport_layer
13+
value: http
14+
15+
- it: check that transport_layer is set with overridden value
16+
set:
17+
sysdig:
18+
accessKey: AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE
19+
clusterName: test-cluster
20+
transportLayer: nats
21+
asserts:
22+
- equal:
23+
path: data.transport_layer
24+
value: nats
25+
26+
- it: check that leader_election_lease_lock_name is set with default value
27+
set:
28+
sysdig:
29+
accessKey: AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE
30+
clusterName: test-cluster
31+
asserts:
32+
- equal:
33+
path: data.leader_election_lease_lock_name
34+
value: kspm-collector-leader-election
35+
36+
- it: check that leader_election_lease_lock_name is set with overridden value
37+
set:
38+
sysdig:
39+
accessKey: AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE
40+
clusterName: test-cluster
41+
leaderElection:
42+
lockName: test-lock
43+
asserts:
44+
- equal:
45+
path: data.leader_election_lease_lock_name
46+
value: test-lock
47+
48+
- it: check that leader_election_lease_lock_name is required when transport is http
49+
set:
50+
sysdig:
51+
accessKey: AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE
52+
clusterName: test-cluster
53+
transportLayer: http
54+
leaderElection:
55+
lockName: ""
56+
asserts:
57+
- failedTemplate:
58+
errorMessage: A valid lock name for the leader election is required when transport is http
59+
60+
- it: check that leader_election_lease_lock_namespace is equal to release namespace
61+
set:
62+
sysdig:
63+
accessKey: AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE
64+
clusterName: test-cluster
65+
transportLayer: http
66+
release:
67+
namespace: test-namespace-release
68+
asserts:
69+
- equal:
70+
path: data.leader_election_lease_lock_namespace
71+
value: test-namespace-release
72+
73+
- it: check that leader_election_lease_lock_namespace is equal to namespace value if set
74+
set:
75+
sysdig:
76+
accessKey: AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE
77+
clusterName: test-cluster
78+
transportLayer: http
79+
namespace: test-namespace-value
80+
release:
81+
namespace: test-namespace-release
82+
asserts:
83+
- equal:
84+
path: data.leader_election_lease_lock_namespace
85+
value: test-namespace-value

‎charts/kspm-collector/tests/deployment_envvars_test.yaml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
suite: KSPM Collector Deployment Env Var Tests
2+
templates:
3+
- deployment.yaml
4+
tests:
5+
- it: check that KUBE_POD_NAME is set with the name of the pod
6+
set:
7+
sysdig:
8+
accessKey: AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE
9+
asserts:
10+
- contains:
11+
path: spec.template.spec.containers[?(@.name=="kspm-collector")].env
12+
content:
13+
name: KUBE_POD_NAME
14+
valueFrom:
15+
fieldRef:
16+
fieldPath: metadata.name

‎charts/kspm-collector/tests/global_overrides_test.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ tests:
5454
existingAccessKeySecret: standard_key
5555
asserts:
5656
- equal:
57-
path: spec.template.spec.containers[0].env[0].valueFrom.secretKeyRef.name
57+
path: spec.template.spec.containers[0].env[?(@.name=="ACCESS_KEY")].valueFrom.secretKeyRef.name
5858
value: standard_key
5959
template: deployment.yaml
6060

@@ -67,7 +67,7 @@ tests:
6767
accessKeySecret: standard_key
6868
asserts:
6969
- equal:
70-
path: spec.template.spec.containers[0].env[0].valueFrom.secretKeyRef.name
70+
path: spec.template.spec.containers[0].env[?(@.name=="ACCESS_KEY")].valueFrom.secretKeyRef.name
7171
value: standard_key
7272
template: deployment.yaml
7373

@@ -82,7 +82,7 @@ tests:
8282
existingAccessKeySecret: override_key
8383
asserts:
8484
- equal:
85-
path: spec.template.spec.containers[0].env[0].valueFrom.secretKeyRef.name
85+
path: spec.template.spec.containers[0].env[?(@.name=="ACCESS_KEY")].valueFrom.secretKeyRef.name
8686
value: override_key
8787
template: deployment.yaml
8888

‎charts/kspm-collector/tests/role_test.yaml

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
suite: KSPM Collector Role Tests
2+
templates:
3+
- templates/role.yaml
4+
tests:
5+
- it: Should not create document if rbac.create is false
6+
set:
7+
rbac:
8+
create: false
9+
asserts:
10+
- containsDocument:
11+
apiVersion: rbac.authorization.k8s.io/v1
12+
kind: Role
13+
not: true
14+
15+
- it: Should not create rules if transportLayer is not http
16+
set:
17+
transportLayer: nats
18+
asserts:
19+
- isNullOrEmpty:
20+
path: rules
21+
22+
- it: Should grant permissions to create lease if transport is http
23+
set:
24+
transportLayer: http
25+
asserts:
26+
- contains:
27+
path: rules
28+
content:
29+
apiGroups: ["", "coordination.k8s.io"]
30+
resources:
31+
- "leases"
32+
verbs: ["create"]
33+
34+
- it: Should grant all permissions on specific lease if transport is http
35+
set:
36+
transportLayer: http
37+
leaderElection:
38+
lockName: test-lock-name
39+
asserts:
40+
- contains:
41+
path: rules
42+
content:
43+
apiGroups: ["", "coordination.k8s.io"]
44+
resources:
45+
- "leases"
46+
resourceNames:
47+
- "test-lock-name"
48+
verbs: ["*"]

0 commit comments

Comments
 (0)