We need to decide what to do in case of collisions between bindings.
For severity we can take the highest.
What should we do with the parameters? How to merge them?
@slashben

Skip path of service account in UnexpectedFileAccess rule

Update docs

we now able to use rule ID/rule tags in binding

Limit default binding to exclude Kubernetes system namespaces

Exclude the following namespaces in the default bindings the chart installs:

kube-system
kube-public
kube-node-lease
kubeconfig

Imporve system tests

Implement checksum mechanism on Profiles CRD

replace the current use of the annotation "kapprofiler.kubescape.io/final" with some checksum mechanism in order to prevent tampering of CRD's.

Develop performance tests

Create a cluster with a single node
Deploy prometheus with node exporter
Deploy kubecop
Run Nginx web application and create high load - then capture kubecop load
Run Elasticsearch and create high load - then capture kubecop load

Dev testing: slow memory leak notified on 24h test

Looks like we are leaking in the ARMO Dev environment.

~100Mb per node agent per 6h

Update severities of alerts

Replace existing language with inclusive language

The Rules readme.md consistently uses the term whitelist. This needs to be replaced with allowlist.
In the event the term blacklist is used, it should be replaced with denylist

Write CSV exporter

Add to binding the ability to select rules by tags / rule id

kaprofiler to use map instead of DB

After AppProfile finalization events are still streamed in the eventSink

Add alertmanager setup Helm with mailer function

Trigger ClamAV scan on new containers

Do not start recording of application profile at Pod level when owner has its own

#83

KubeCop recording to discard directories that are inflating application profiles

When recording application profiles, KubeCop needs to discard:

/proc
Mounted volumes

They cause inflated application profiles

Implement rule binding mechanism

Build the demo ping-app image and push to armo quay

Build the ping-app for multiple arch.
Push the image to quay.
Change the ping-app.yaml to take the quay image.

Make application profile learning period length configurable

Must be able to control it from Helm chart.

Control both:

Learning duration (same in started and attached containers)
Sampling interval

Make application profiles that exceed max entries as "failed" to prevent alerting based on them

Implement bus for exporters

Support multiple alertmanager

Check profile in k8s client rule

Add usable properties to the event and failed rule structs

Background

As a SecOps engineer, when I see an alret, I want to silent it or silent similar alerts by similar labels

Source code location of the rule (commit+file+line).
Application profile identifier (namespace+name)
rule binding identifier (namespace+name)
WL details (namespace + kind + name)
Internal alert properties like:

Process full path
PID
syscall
Full path of not white listed object
etc.

Details

Source field

Point to the README of the specific rule so when the user clicks he will see description of the rule

Patch proposal

We want to include the fix proposal in the AlertManager message:

Either add lines to application profile
RuleBinding
Silencing the alert

Implementing basic system test scenario: kubecop working with partial application profiles

Goal of the test is to make sure that

Partial application profiles are generated
Partial application profiles are enforced

Therefore the test scenario that is needed is:

Install an application
Install KubeCop
Wait for partial final application profile is generated
Test that rules are using the partial application profile

ClamAV image to be built for multiple architecture

Wrap pprof unable to pull data exception in system test

E1220 09:49:38.038858   89254 portforward.go:409] an error occurred forwarding 6060 -> 6060: error forwarding port 6060 to pod e52a0f5cfdbcc82342666c3d7292e7409646728b10a6497a8c4ca20e93fe3aea, uid : exit status 1: 2023/12/20 07:49:38 socat[57476] E connect(5, AF=2 127.0.0.1:6060, 16): Connection refused                                                                        error: lost connection to pod                                                                                                                                                               Exception in thread Thread-2 (record):                                                                                                                                                      Traceback (most recent call last):                                                                                                                                                            File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 700, in urlopen                                                                                                         httplib_response = self._make_request(                                                                                                                                                    File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 446, in _make_request                                                                                                   six.raise_from(e, None)                                                                                                                                                                   File "<string>", line 3, in raise_from                                                                                                                                                      File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 441, in _make_request                                                                                                   httplib_response = conn.getresponse()                                                                                                                                                     File "/usr/lib/python3.10/http/client.py", line 1375, in getresponse                                                                                                                          response.begin()                                                                                                                                                                          File "/usr/lib/python3.10/http/client.py", line 318, in begin                                                                                                                                 version, status, reason = self._read_status()                                                                                                                                             File "/usr/lib/python3.10/http/client.py", line 287, in _read_status                                                                                                                          raise RemoteDisconnected("Remote end closed connection without"                                                                                                                         http.client.RemoteDisconnected: Remote end closed connection without response                                                                                                                                                                                                                                                                                                           During handling of the above exception, another exception occurred:                                                                                                                                                                                                                                                                                                                     Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/requests/adapters.py", line 439, in send
    resp = conn.urlopen(
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 756, in urlopen
    retries = retries.increment(
  File "/usr/lib/python3/dist-packages/urllib3/util/retry.py", line 532, in increment
    raise six.reraise(type(error), error, _stacktrace)
  File "/usr/lib/python3/dist-packages/six.py", line 718, in reraise
    raise value.with_traceback(tb)
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 700, in urlopen
    httplib_response = self._make_request(
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 446, in _make_request
    six.raise_from(e, None)
  File "<string>", line 3, in raise_from
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 441, in _make_request
    httplib_response = conn.getresponse()
  File "/usr/lib/python3.10/http/client.py", line 1375, in getresponse
    response.begin()
  File "/usr/lib/python3.10/http/client.py", line 318, in begin
    version, status, reason = self._read_status()
  File "/usr/lib/python3.10/http/client.py", line 287, in _read_status
    raise RemoteDisconnected("Remote end closed connection without"
urllib3.exceptions.ProtocolError: ('Connection aborted.', RemoteDisconnected('Remote end closed connection without response'))

During handling of the above exception, another exception occurred:
Traceback (most recent call last):
  File "/usr/lib/python3.10/threading.py", line 1016, in _bootstrap_inner
    self.run()
  File "/usr/lib/python3.10/threading.py", line 953, in run
    self._target(*self._args, **self._kwargs)
  File "/home/amit/armo/kubecop/system-tests/pprof.py", line 29, in record
    response = requests.get(url)
  File "/usr/lib/python3/dist-packages/requests/api.py", line 76, in get
    return request('get', url, params=params, **kwargs)
  File "/usr/lib/python3/dist-packages/requests/api.py", line 61, in request
    return session.request(method=method, url=url, **kwargs)
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 544, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 657, in send
    r = adapter.send(request, **kwargs)
  File "/usr/lib/python3/dist-packages/requests/adapters.py", line 498, in send
    raise ConnectionError(err, request=request)
requests.exceptions.ConnectionError: ('Connection aborted.', RemoteDisconnected('Remote end closed connection without response'))
Created file 100 times
Created file 600 times
Created file 1100 times
Created file 1600 times
Created file 2100 times
Created file 2600 times
Created file 3100 times
Created file 3600 times
Created file 4100 times
Created file 4600 times
Created file 5100 times
Created file 5600 times
Created file 6100 times
Created file 6600 times
Created file 7100 times
Created file 7600 times
Created file 8100 times
Created file 8600 times
Created file 9100 times
Created file 9600 times
Waiting 300 seconds to GC to run

Start finalization timer when Pod becomes running state (kapprofiler)

#83

Add skippable prefixes from params in r0002

Validate node fs is not overlayfs on GKE,EKS

This is needed to validate the rule - R0006

unshare syscall - container escape rule

Alert message display in AlertManager Slack messages are missing key parts

AlertManager messages in Slack seem to be missing key parts:

Description
Fix

This means the user doesn't know why the alert was fired

Enrich ClamAV malware alerts with Pod/Container info

Implementing basic system test scenario: application install and testing rule enforcement

The goal of this test is to make sure both rules that need application profile and others that does not are enforced after a new application install:

Install a new workload
Generate an event that should trigger a rule that does not need application profile, make sure that an alert is fired
Wait for the final application profile to be generated
Generate an event that should trigger an application profile rule, make sure that an alert is fired

Open rule to skip alerting on mounted volumes

Open whitelisting rule should be configurable to skip validation on file open events that are happening in a path that is mounted from a volume.

This is an optional feature (by default on)

New Rule: detection exec from a mounted volume

Application profile missing data (except system calls) sometimes even when container starts

~50% of the time when container starts the application profile does not include exec or other data (except syscalls).

Steps to reproduce

Install kubecop
Install nginx deployment
Check application profile after 60s (it misses data half of the time)

Implement container build, test and release procedure

On every PRs

Run unit tests
Cannot build component level test without external data sink mechanism @Bezbran
Build image

On release
5. Run unit tests
6. Run component tests
7. Build image and push

Add documentation and example configuration

Implement event filtering using kernel side of filter

Current state is that we filter out unnecessary container events at the user space side. This not leads to good performance. Use IG to filter ebpf event streams based on the kernel side mechanisms

armosec / kubecop Goto Github PK

kubecop's People

Contributors

Stargazers

Watchers

Forkers

kubecop's Issues

Background

Details

Source field

Patch proposal

Recommend Projects

Recommend Topics

Recommend Org