Carlos R.F.

icon location Tucson, AZ icon location Staff Software Engineer, Platform

Results 48 comments of Carlos R.F.

Kubearmor fetches wrong pod name/namespace to apply whitelist policy on long running GKE clusters (BPF-LSM enforcement)

I deleted all the pods in the kube armor namespace, and some hours later, it was already misapplying policies. A very simple policy: ``` apiVersion: security.kubearmor.com/v1 kind: KubeArmorPolicy metadata: name:...

Kubearmor fetches wrong pod name/namespace to apply whitelist policy on long running GKE clusters (BPF-LSM enforcement)

It looks like the bug is right here? https://github.com/kubearmor/KubeArmor/blob/7e7b1c390316970b42ddfc13b725187ef0c4b9f1/KubeArmor/core/kubeUpdate.go#L1016 It adds the policy to the return if this returns true `|| matchClusterSecurityPolicyRule(policy)` ...but that function doesn't check whether the passed...

Kubearmor fetches wrong pod name/namespace to apply whitelist policy on long running GKE clusters (BPF-LSM enforcement)

> It looks like the bug is right here? > > https://github.com/kubearmor/KubeArmor/blob/7e7b1c390316970b42ddfc13b725187ef0c4b9f1/KubeArmor/core/kubeUpdate.go#L1016 > > It adds the policy to the return if this returns true `|| matchClusterSecurityPolicyRule(policy)` > > ...but...

Kubearmor fetches wrong pod name/namespace to apply whitelist policy on long running GKE clusters (BPF-LSM enforcement)

> > It looks like the bug is right here? > > https://github.com/kubearmor/KubeArmor/blob/7e7b1c390316970b42ddfc13b725187ef0c4b9f1/KubeArmor/core/kubeUpdate.go#L1016 > > > > It adds the policy to the return if this returns true `|| matchClusterSecurityPolicyRule(policy)`...

Kubearmor fetches wrong pod name/namespace to apply whitelist policy on long running GKE clusters (BPF-LSM enforcement)

> > > It looks like the bug is right here? > > > https://github.com/kubearmor/KubeArmor/blob/7e7b1c390316970b42ddfc13b725187ef0c4b9f1/KubeArmor/core/kubeUpdate.go#L1016 > > > > > > It adds the policy to the return if this...

The reasoning behind preventing writes to `/dev/shm/` and a possible bug

This is somewhat related to this PR: https://github.com/kubearmor/policy-templates/pull/1050

Refactor KubeArmor Operator

The change to the operator CRD is also desirable to be able to set the log level in the `values.yaml` in the helm chart for the controller: https://github.com/kubearmor/KubeArmor/pull/1849

Refactor KubeArmor Operator

More details for the Proposal: ``` kubearmor: image: repository: ? tag: ? pullPolicy: ? args: [] resources: limits: cpu: ? memory: ? requests: cpu: ? memory: ? kubearmorRelay: image: repository:...