KubeArmor icon indicating copy to clipboard operation
KubeArmor copied to clipboard

feat: add support for audit alerts from bpflsm enforcer

Open Aryan-sharma11 opened this issue 1 year ago • 1 comments

Purpose of PR?:

Fixes #1477

Until now we depended upon System monitor to receive Audit Policy alerts, this PR contains the changes that will allow the enforcer to send Audit alerts as well thus reducing the dependency of the BPFLSM enforcer on the System monitor .

In addition, this PR also contains handling of some edge cases which were not handled earlier

  • owner only + allow policy with an audit default posture
  • owner id missing for owner only logs in BPFLSM

Does this PR introduce a breaking change?

If the changes in this PR are manually verified, list down the scenarios covered::

Additional information for reviewer? : Mention if this PR is part of any design or a continuation of previous PRs

Checklist:

  • [ ] Bug fix. Fixes #
  • [ ] New feature (non-breaking change which adds functionality)
  • [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • [ ] This change requires a documentation update
  • [ ] PR Title follows the convention of <type>(<scope>): <subject>
  • [ ] Commit has unit tests
  • [ ] Commit has integration tests

Aryan-sharma11 avatar Feb 20 '24 16:02 Aryan-sharma11

Fixes #1477

daemon1024 avatar Feb 22 '24 06:02 daemon1024