lacework / helm-charts

Official Lacework Helm Charts
Apache License 2.0
12 stars 29 forks source link

fix(lacework-agent): fix codeaware.enable equality check #243

Closed feng-terry closed 6 months ago

feng-terry commented 6 months ago

Revert a change from https://github.com/lacework/helm-charts/commit/05d9635366513eb81b710a3bff0fcb0d256ecfcc which changed codeaware.enable in lacework-agent/configmap.yaml from using toString to using quote. This caused an issue where eq (quote .enable) would not return true given the correct match string.

Example (before change):

configmap.yaml [with test logging]:

     {{- with (.Values.laceworkConfig).codeaware }}
      {{(quote .enable)}}
      {{ eq (quote .enable) "all" }}
      {{ eq (toString .enable) "all" }}
       {{- if or (eq (quote .enable) "true") (eq (quote .enable) "all") }}
        "codeaware": {
          "enable": "all"
        },
       {{- else if (eq (quote .enable) "experimental") }}
        "codeaware": {
          "enable": "experimental"
        },
       {{- else if (eq (quote .enable) "false") }}
        "codeaware": {
          "enable": "false"
        },
       {{- end }}
     {{- end }}

command run:

helm template --set laceworkConfig.accessToken=C00FFE --set laceworkConfig.codeaware.enable=all --set laceworkConfig.fim.enable=true lacework-agent ./lacework-agent --debug

template output:

data:
  config.json: |
    {"autoupgrade": "enable",
      "all"
      false
      true
     "fim": {
             "mode": "enable"
     },
     "serverurl": "https://api.lacework.net",
    "tags": {
      "Env": ""
    }
    }
  syscall_config.yaml: ""

Notice how {{ eq (quote .enable) "all" }} returns false, even though we pass in all. And that {{ eq (toString .enable) "all" }} returns true.

After change

command:

helm template --set laceworkConfig.accessToken=C00FFE --set laceworkConfig.codeaware.enable=experimental lacework-agent ./lacework-agent --debug

template output:


  config.json: |
    {"autoupgrade": "enable",
        "codeaware": {
          "enable": "experimental"
        },
     "serverurl": "https://api.lacework.net",
    "tags": {
      "Env": ""
    }
    }
  syscall_config.yaml: ""```
CLAassistant commented 6 months ago

CLA assistant check
All committers have signed the CLA.

feng-terry commented 6 months ago

Ah I didn't realize that this was already fixed for 6.14. I'll close this out.