kubearmor / KubeArmor

Runtime Security Enforcement System. Workload hardening/sandboxing and implementing least-permissive policies made easy leveraging LSMs (BPF-LSM, AppArmor).
https://kubearmor.io/
Apache License 2.0
1.49k stars 342 forks source link

Extract cluster-name from client go APIs #859

Open seswarrajan opened 2 years ago

seswarrajan commented 2 years ago

Extract cluster-name in kubearmor using client go API

General Information

To Reproduce

  1. Deploy KubeArmor in any k8s cluster
  2. Now run karmor log --logFilter all in a new terninal.
  3. Observe the logs

In output of karmor logs, the cluterName for each log is set to default

Expected behavior The log/alerts to have a valid cluster-name. For ex: in the attached screenshot, the cluster name is prod-cluster-onboarding. But it is set as default.

Screenshots

image

s1ntaxe770r commented 2 years ago

This might a bit tricky and it's related to this issue https://github.com/kubernetes/kubernetes/issues/44954

HariVamsiK commented 2 years ago

Hi I want to work on this issue. Could you please assign it to me, it would be beneficial for my academics too. Thanks

@Ankurk99 I can work on this

Ankurk99 commented 2 years ago

Feel free to ask for any help here or on our slack

HariVamsiK commented 2 years ago

I was able to reproduce the bug. May i know where i can get the necessary files that i can modify to resolve the issue, i checked the whole repository. BTW i reproduced it on docker driver. Default

nyrahul commented 2 years ago

This discussion thread on k8s group makes it sufficiently clear that there is no way to get a cluster name using k8s client go APIs.

Our option is to allow the ability to pass the cluster-name as an option during installation and as part of config and the telemetry generator uses the name from there.

This should be applicable in the context of systemd mode of installation as well where cluster name could be used to refer to "instance groups" for example.

The point is, we simply pick the cluster name from the config entry and set it.

Tasks involved: