From 75bac867d68623e19be90a9230c1f169d5d395d5 Mon Sep 17 00:00:00 2001 From: David Wertenteil Date: Sun, 24 Dec 2023 18:11:57 +0200 Subject: [PATCH 1/2] Add TemplateHash label Signed-off-by: David Wertenteil --- go.mod | 2 +- go.sum | 4 +-- .../v1/applicationprofile_manager.go | 4 +++ pkg/utils/utils.go | 31 +++++++++++-------- 4 files changed, 25 insertions(+), 16 deletions(-) diff --git a/go.mod b/go.mod index 902de341..96d80e89 100644 --- a/go.mod +++ b/go.mod @@ -15,7 +15,7 @@ require ( github.com/kinbiko/jsonassert v1.1.1 github.com/kubescape/backend v0.0.16 github.com/kubescape/go-logger v0.0.22 - github.com/kubescape/k8s-interface v0.0.152 + github.com/kubescape/k8s-interface v0.0.154 github.com/kubescape/storage v0.0.39 github.com/panjf2000/ants/v2 v2.9.0 github.com/spf13/viper v1.17.0 diff --git a/go.sum b/go.sum index 5de34ac8..9769c2b4 100644 --- a/go.sum +++ b/go.sum @@ -315,8 +315,8 @@ github.com/kubescape/backend v0.0.16 h1:bkQGY39GSoNIeFfnAJ2zlcrGEyXk6LGYv1/MgS51 github.com/kubescape/backend v0.0.16/go.mod h1:ug9NFmmxT4DcQx3sgdLRzlLPWMKGHE/fpbcYUm5G5Qo= github.com/kubescape/go-logger v0.0.22 h1:gle7wH6emOiGv9ljdpVi82pWLQ3jGucrUucvil6JXHE= github.com/kubescape/go-logger v0.0.22/go.mod h1:x3HBpZo3cMT/WIdy18BxvVVd5D0e/PWFVk/HiwBNu3g= -github.com/kubescape/k8s-interface v0.0.152 h1:1tm2zPYVK7+1fewpca0/MCoK3TgUNButpM3F3uZz6yo= -github.com/kubescape/k8s-interface v0.0.152/go.mod h1:5sz+5Cjvo98lTbTVDiDA4MmlXxeHSVMW/wR0V3hV4K8= +github.com/kubescape/k8s-interface v0.0.154 h1:D6TRgSBjbD/eTf2FKswSB9rdd9dsW2AQJL0RUm3NPH8= +github.com/kubescape/k8s-interface v0.0.154/go.mod h1:5sz+5Cjvo98lTbTVDiDA4MmlXxeHSVMW/wR0V3hV4K8= github.com/kubescape/storage v0.0.39 h1:zxdu6pQ/8Fdzp0Er0yX+KWApMYvNZh9y7ONWyJcbb08= github.com/kubescape/storage v0.0.39/go.mod h1:ObCIVOnVyWwRwU0iuKTzOnrJQScqPgkw0FgvSINwosY= github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de h1:9TO3cAIGXtEhnIaL+V+BEER86oLrvS+kWobKpbJuye0= diff --git a/pkg/applicationprofilemanager/v1/applicationprofile_manager.go b/pkg/applicationprofilemanager/v1/applicationprofile_manager.go index a7a1a3c8..a5ee9fac 100644 --- a/pkg/applicationprofilemanager/v1/applicationprofile_manager.go +++ b/pkg/applicationprofilemanager/v1/applicationprofile_manager.go @@ -61,6 +61,10 @@ func (am *ApplicationProfileManager) ensureInstanceID(ctx context.Context, conta return } pod := wl.(*workloadinterface.Workload) + + // get pod template hash + watchedContainer.TemplateHash, _ = pod.GetLabel("pod-template-hash") + // find parentWlid kind, name, err := am.k8sClient.CalculateWorkloadParentRecursive(pod) if err != nil { diff --git a/pkg/utils/utils.go b/pkg/utils/utils.go index 9129c032..b2e50c56 100644 --- a/pkg/utils/utils.go +++ b/pkg/utils/utils.go @@ -2,7 +2,6 @@ package utils import ( "errors" - "github.com/goradd/maps" "math/rand" "path/filepath" "runtime" @@ -10,6 +9,8 @@ import ( "strings" "time" + "github.com/goradd/maps" + "github.com/armosec/utils-k8s-go/wlid" "github.com/kubescape/go-logger" "github.com/kubescape/go-logger/helpers" @@ -39,23 +40,24 @@ const ( ) type WatchedContainerData struct { - ContainerID string - ContainerIndex int - ContainerType ContainerType - FilteredSpdxData *v1beta1.SBOMSPDXv2p3Filtered - ImageID string - ImageTag string - InitialDelayExpired bool InstanceID instanceidhandler.IInstanceID + UpdateDataTicker *time.Ticker + SyncChannel chan error + FilteredSpdxData *v1beta1.SBOMSPDXv2p3Filtered + RelevantRealtimeFilesBySPDXIdentifier map[v1beta1.ElementID]bool + RelevantRealtimeFilesByPackageSourceInfo map[string]*PackageSourceInfoData K8sContainerID string + ContainerID string ParentResourceVersion string - RelevantRealtimeFilesByPackageSourceInfo map[string]*PackageSourceInfoData - RelevantRealtimeFilesBySPDXIdentifier map[v1beta1.ElementID]bool - SBOMResourceVersion int - SyncChannel chan error - UpdateDataTicker *time.Ticker + ImageTag string + ImageID string Wlid string + TemplateHash string + SBOMResourceVersion int + ContainerType ContainerType + ContainerIndex int NsMntId uint64 + InitialDelayExpired bool } func Between(value string, a string, b string) string { @@ -140,6 +142,9 @@ func GetLabels(watchedContainer *WatchedContainerData, stripContainer bool) map[ if watchedContainer.ParentResourceVersion != "" { labels[instanceidhandler2.ResourceVersionMetadataKey] = watchedContainer.ParentResourceVersion } + if watchedContainer.TemplateHash != "" { + labels[instanceidhandler2.TemplateHashKey] = watchedContainer.TemplateHash + } return labels } From 44b8903e176fb2ebe06d4a6634419f236a529585 Mon Sep 17 00:00:00 2001 From: David Wertenteil Date: Sun, 24 Dec 2023 19:18:43 +0200 Subject: [PATCH 2/2] fixed test Signed-off-by: David Wertenteil --- pkg/relevancymanager/v1/testdata/nginx-spdx-filtered.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/relevancymanager/v1/testdata/nginx-spdx-filtered.json b/pkg/relevancymanager/v1/testdata/nginx-spdx-filtered.json index 8ff9f2c8..def54b08 100644 --- a/pkg/relevancymanager/v1/testdata/nginx-spdx-filtered.json +++ b/pkg/relevancymanager/v1/testdata/nginx-spdx-filtered.json @@ -1,6 +1,6 @@ { "metadata": { - "name": "ns-pod-pod-cb3a-a929", + "name": "pod-pod", "creationTimestamp": null, "labels": { "kubescape.io/workload-api-version": "v1",