Skip to content

Commit 650eb89

Browse files
matthyxmatthyx
authored
Merge pull request #419 from kubescape/image
fill ImageID and ImageTag in applicationprofiles
2 parents d489fe4 + 03c74dc commit 650eb89

File tree

6 files changed

+19
-7
lines changed

6 files changed

+19
-7
lines changed

‎pkg/applicationprofilemanager/v1/applicationprofile_manager.go

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -406,7 +406,7 @@ func (am *ApplicationProfileManager) saveProfile(ctx context.Context, watchedCon
406406
newObject.Spec.EphemeralContainers = addContainers(newObject.Spec.EphemeralContainers, watchedContainer.ContainerNames[utils.EphemeralContainer])
407407
// enrich container
408408
newContainer := utils.GetApplicationProfileContainer(newObject, watchedContainer.ContainerType, watchedContainer.ContainerIndex)
409-
utils.EnrichApplicationProfileContainer(newContainer, capabilities, observedSyscalls, execs, opens, endpoints, rulePolicies)
409+
utils.EnrichApplicationProfileContainer(newContainer, capabilities, observedSyscalls, execs, opens, endpoints, rulePolicies, watchedContainer.ImageID, watchedContainer.ImageTag)
410410
// try to create object
411411
if err := am.storageClient.CreateApplicationProfile(newObject, namespace); err != nil {
412412
gotErr = err
@@ -459,7 +459,7 @@ func (am *ApplicationProfileManager) saveProfile(ctx context.Context, watchedCon
459459
}
460460
}
461461
// update it
462-
utils.EnrichApplicationProfileContainer(existingContainer, capabilities, observedSyscalls, execs, opens, endpoints, rulePolicies)
462+
utils.EnrichApplicationProfileContainer(existingContainer, capabilities, observedSyscalls, execs, opens, endpoints, rulePolicies, watchedContainer.ImageID, watchedContainer.ImageTag)
463463
// get existing containers
464464
var existingContainers []v1beta1.ApplicationProfileContainer
465465
if watchedContainer.ContainerType == utils.Container {
@@ -622,6 +622,8 @@ func (am *ApplicationProfileManager) startApplicationProfiling(ctx context.Conte
622622

623623
watchedContainer := &utils.WatchedContainerData{
624624
ContainerID: container.Runtime.ContainerID,
625+
ImageID: container.Runtime.ContainerImageDigest,
626+
ImageTag: container.Runtime.ContainerImageName,
625627
UpdateDataTicker: time.NewTicker(utils.AddJitter(am.cfg.InitialDelay, am.cfg.MaxJitterPercentage)),
626628
SyncChannel: syncChannel,
627629
K8sContainerID: k8sContainerID,

‎pkg/networkmanager/v2/network_manager.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -436,6 +436,8 @@ func (nm *NetworkManager) startNetworkMonitoring(ctx context.Context, container
436436

437437
watchedContainer := &utils.WatchedContainerData{
438438
ContainerID: container.Runtime.ContainerID,
439+
ImageID: container.Runtime.ContainerImageDigest,
440+
ImageTag: container.Runtime.ContainerImageName,
439441
UpdateDataTicker: time.NewTicker(utils.AddJitter(nm.cfg.InitialDelay, nm.cfg.MaxJitterPercentage)),
440442
SyncChannel: syncChannel,
441443
K8sContainerID: k8sContainerID,

‎pkg/relevancymanager/v1/relevancy_manager.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -284,6 +284,8 @@ func (rm *RelevancyManager) startRelevancyProcess(ctx context.Context, container
284284

285285
watchedContainer := &utils.WatchedContainerData{
286286
ContainerID: container.Runtime.ContainerID,
287+
ImageID: container.Runtime.ContainerImageDigest,
288+
ImageTag: container.Runtime.ContainerImageName,
287289
UpdateDataTicker: time.NewTicker(utils.AddJitter(rm.cfg.InitialDelay, rm.cfg.MaxJitterPercentage)),
288290
SyncChannel: make(chan error, 10),
289291
K8sContainerID: k8sContainerID,

‎pkg/rulemanager/v1/rule_manager.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -213,6 +213,8 @@ func (rm *RuleManager) startRuleManager(ctx context.Context, container *containe
213213

214214
watchedContainer := &utils.WatchedContainerData{
215215
ContainerID: container.Runtime.ContainerID,
216+
ImageID: container.Runtime.ContainerImageDigest,
217+
ImageTag: container.Runtime.ContainerImageName,
216218
SyncChannel: syncChannel,
217219
K8sContainerID: k8sContainerID,
218220
NsMntId: container.Mntns,

‎pkg/utils/applicationprofile.go

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,11 @@ func CreateCapabilitiesPatchOperations(capabilities, syscalls []string, execs ma
8484
return profileOperations
8585
}
8686

87-
func EnrichApplicationProfileContainer(container *v1beta1.ApplicationProfileContainer, observedCapabilities, observedSyscalls []string, execs map[string][]string, opens map[string]mapset.Set[string], endpoints map[string]*v1beta1.HTTPEndpoint, rulePolicies map[string]v1beta1.RulePolicy) {
87+
func EnrichApplicationProfileContainer(container *v1beta1.ApplicationProfileContainer, observedCapabilities, observedSyscalls []string, execs map[string][]string, opens map[string]mapset.Set[string], endpoints map[string]*v1beta1.HTTPEndpoint, rulePolicies map[string]v1beta1.RulePolicy, imageID, imageTag string) {
88+
// add image metadata
89+
container.ImageID = imageID
90+
container.ImageTag = imageTag
91+
8892
// add capabilities
8993
caps := mapset.NewSet(observedCapabilities...)
9094
caps.Append(container.Capabilities...)

‎pkg/utils/applicationprofile_test.go

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -43,21 +43,21 @@ func Test_EnrichApplicationProfileContainer(t *testing.T) {
4343
var test map[string]*v1beta1.HTTPEndpoint
4444

4545
// empty enrich
46-
EnrichApplicationProfileContainer(existingContainer, []string{}, []string{}, map[string][]string{}, map[string]mapset.Set[string]{}, test, map[string]v1beta1.RulePolicy{})
46+
EnrichApplicationProfileContainer(existingContainer, []string{}, []string{}, map[string][]string{}, map[string]mapset.Set[string]{}, test, map[string]v1beta1.RulePolicy{}, "", "")
4747
assert.Equal(t, 5, len(existingContainer.Capabilities))
4848
assert.Equal(t, 2, len(existingContainer.Execs))
4949
assert.Equal(t, 5, len(existingContainer.Syscalls))
5050
assert.Equal(t, 0, len(existingContainer.Opens))
5151

5252
// enrich with existing capabilities, syscalls - no change
53-
EnrichApplicationProfileContainer(existingContainer, []string{"SETGID"}, []string{"listen"}, map[string][]string{}, map[string]mapset.Set[string]{}, test, map[string]v1beta1.RulePolicy{})
53+
EnrichApplicationProfileContainer(existingContainer, []string{"SETGID"}, []string{"listen"}, map[string][]string{}, map[string]mapset.Set[string]{}, test, map[string]v1beta1.RulePolicy{}, "", "")
5454
assert.Equal(t, 5, len(existingContainer.Capabilities))
5555
assert.Equal(t, 2, len(existingContainer.Execs))
5656
assert.Equal(t, 5, len(existingContainer.Syscalls))
5757
assert.Equal(t, 0, len(existingContainer.Opens))
5858

5959
// enrich with new capabilities, syscalls - add
60-
EnrichApplicationProfileContainer(existingContainer, []string{"NEW"}, []string{"xxx", "yyy"}, map[string][]string{}, map[string]mapset.Set[string]{}, test, map[string]v1beta1.RulePolicy{})
60+
EnrichApplicationProfileContainer(existingContainer, []string{"NEW"}, []string{"xxx", "yyy"}, map[string][]string{}, map[string]mapset.Set[string]{}, test, map[string]v1beta1.RulePolicy{}, "", "")
6161
assert.Equal(t, 6, len(existingContainer.Capabilities))
6262
assert.Equal(t, 2, len(existingContainer.Execs))
6363
assert.Equal(t, 7, len(existingContainer.Syscalls))
@@ -67,7 +67,7 @@ func Test_EnrichApplicationProfileContainer(t *testing.T) {
6767
opens := map[string]mapset.Set[string]{
6868
"/checkoutservice": mapset.NewSet("O_RDONLY", "O_WRONLY"),
6969
}
70-
EnrichApplicationProfileContainer(existingContainer, []string{"NEW"}, []string{"xxx", "yyy"}, map[string][]string{}, opens, test, map[string]v1beta1.RulePolicy{})
70+
EnrichApplicationProfileContainer(existingContainer, []string{"NEW"}, []string{"xxx", "yyy"}, map[string][]string{}, opens, test, map[string]v1beta1.RulePolicy{}, "", "")
7171
assert.Equal(t, 6, len(existingContainer.Capabilities))
7272
assert.Equal(t, 2, len(existingContainer.Execs))
7373
assert.Equal(t, 7, len(existingContainer.Syscalls))

0 commit comments

Comments
 (0)