Skip to content

Commit b7a2072

Browse files
alegrey91alegrey91
authoredFeb 6, 2025··
ci: generate seccomp profile within pipeline (#1325)
Signed-off-by: Alessio Greggi <ale_grey_91@hotmail.it>
·
v0.7.4
1 parent fa06d8d commit b7a2072

13 files changed

+272
-73
lines changed
 

‎.github/workflows/e2e.yml

-12
Original file line numberDiff line numberDiff line change
@@ -2,18 +2,6 @@ name: e2e
22
permissions: {}
33

44
on:
5-
push:
6-
branches: [ "*" ]
7-
paths:
8-
- '.github/workflows/e2e.yml'
9-
- 'api/**'
10-
- 'controllers/**'
11-
- 'pkg/**'
12-
- 'e2e/*'
13-
- 'Dockerfile'
14-
- 'go.*'
15-
- 'main.go'
16-
- 'Makefile'
175
pull_request:
186
branches: [ "*" ]
197
paths:

‎.github/workflows/helm-test.yml

+2-1
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ jobs:
3131
fi
3232
- name: Run chart-testing (lint)
3333
run: ct lint --debug --config ./.github/configs/ct.yaml --lint-conf ./.github/configs/lintconf.yaml
34+
3435
- name: Run docs-testing (helm-docs)
3536
id: helm-docs
3637
run: |
@@ -44,5 +45,5 @@ jobs:
4445
fi
4546
4647
- name: Run chart-testing (install)
47-
run: make helm-test
48+
run: HELM_KIND_CONFIG="./hack/kind-cluster.yml" make helm-test
4849
if: steps.list-changed.outputs.changed == 'true'

‎.github/workflows/releaser.yml

+38
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,40 @@ concurrency:
1111
cancel-in-progress: true
1212

1313
jobs:
14+
seccomp-generation:
15+
name: Seccomp Generation
16+
strategy:
17+
fail-fast: false
18+
matrix:
19+
# differently from the e2e workflow
20+
# we don't need all the versions of kubernetes
21+
# to generate the seccomp profile.
22+
k8s-version: [ 'v1.30.0' ]
23+
runs-on: ubuntu-latest
24+
steps:
25+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
26+
with:
27+
fetch-depth: 0
28+
- uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
29+
with:
30+
go-version-file: 'go.mod'
31+
- uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4
32+
with:
33+
version: v3.14.2
34+
- name: unit tracing
35+
run: sudo make trace-unit
36+
- name: e2e tracing
37+
run: sudo KIND_K8S_VERSION=${{ matrix.k8s-version }} make trace-e2e
38+
- name: build seccomp profile
39+
run: make seccomp
40+
- name: upload artifact
41+
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
42+
with:
43+
name: capsule-seccomp
44+
path: capsule-seccomp.json
45+
1446
create-release:
47+
needs: seccomp-generation
1548
runs-on: ubuntu-latest
1649
permissions:
1750
contents: write
@@ -33,6 +66,11 @@ jobs:
3366
- uses: anchore/sbom-action/download-syft@79202aee38a39bd2039be442e58d731b63baf740
3467
- name: Install Cosign
3568
uses: sigstore/cosign-installer@c56c2d3e59e4281cc41dea2217323ba5694b171e # v3.8.0
69+
- name: download artifact
70+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
71+
with:
72+
name: capsule-seccomp
73+
path: ./capsule-seccomp.json
3674
- name: Run GoReleaser
3775
uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0
3876
with:

‎.github/workflows/seccomp.yaml

+54
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
name: seccomp
2+
permissions: {}
3+
4+
on:
5+
pull_request:
6+
branches: [ "*" ]
7+
paths:
8+
- '.github/workflows/e2e.yml'
9+
- 'api/**'
10+
- 'controllers/**'
11+
- 'pkg/**'
12+
- 'e2e/*'
13+
- 'Dockerfile'
14+
- 'go.*'
15+
- 'main.go'
16+
- 'Makefile'
17+
18+
concurrency:
19+
group: ${{ github.workflow }}-${{ github.ref }}
20+
cancel-in-progress: true
21+
22+
jobs:
23+
seccomp-generation:
24+
name: Seccomp Generation
25+
strategy:
26+
fail-fast: false
27+
matrix:
28+
# differently from the e2e workflow
29+
# we don't need all the versions of kubernetes
30+
# to generate the seccomp profile.
31+
k8s-version: [ 'v1.30.0' ]
32+
runs-on: ubuntu-latest
33+
steps:
34+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
35+
with:
36+
fetch-depth: 0
37+
- uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
38+
with:
39+
go-version-file: 'go.mod'
40+
- uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4
41+
with:
42+
version: v3.14.2
43+
- name: unit tracing
44+
run: sudo make trace-unit
45+
- name: e2e tracing
46+
run: sudo KIND_K8S_VERSION=${{ matrix.k8s-version }} make trace-e2e
47+
- name: build seccomp profile
48+
run: make seccomp
49+
- name: upload artifact
50+
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
51+
with:
52+
name: capsule-seccomp
53+
path: capsule-seccomp.json
54+

‎.goreleaser.yml

+2
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,8 @@ release:
4545
- `ghcr.io/projectcapsule/charts/{{ .ProjectName }}:{{ .Version }}`
4646
4747
[Review the Major Changes section first before upgrading to a new version](https://artifacthub.io/packages/helm/projectcapsule/capsule/{{ .Version }}#major-changes)
48+
extra_files:
49+
- glob: ./capsule-seccomp.json
4850
checksum:
4951
name_template: 'checksums.txt'
5052
changelog:

‎Dockerfile

-40
This file was deleted.

‎Dockerfile.tracing

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# Target Binary
2+
ARG TARGET_IMAGE
3+
FROM ${TARGET_IMAGE} AS target
4+
5+
# Inject Harpoon Image
6+
FROM alegrey91/harpoon:v0.9.4
7+
WORKDIR /
8+
COPY --from=target /ko-app/capsule ./manager
9+
10+
ENTRYPOINT ["/harpoon", \
11+
"capture", \
12+
"-f", "main.main", \
13+
"-E", "NAMESPACE=capsule-system", \
14+
"-i", "2", \
15+
"-c", "-e", \
16+
"-S", "-D", "/tmp/results/", \
17+
"--", "/manager"]

‎Makefile

+61-12
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ BUILD_DATE ?= $(shell git log -1 --format="%at" | xargs -I{} sh -c 'if [ "$
1616
IMG_BASE ?= $(REPOSITORY)
1717
IMG ?= $(IMG_BASE):$(VERSION)
1818
CAPSULE_IMG ?= $(REGISTRY)/$(IMG_BASE)
19+
CLUSTER_NAME ?= capsule
1920

2021
## Tool Binaries
2122
KUBECTL ?= kubectl
@@ -77,17 +78,21 @@ helm-lint: docker
7778
helm-schema: helm-plugin-schema
7879
cd charts/capsule && $(HELM) schema
7980

81+
helm-test: HELM_KIND_CONFIG ?= ""
8082
helm-test: kind ct ko-build-all
81-
@$(KIND) create cluster --wait=60s --name capsule-charts --image kindest/node:$${KIND_K8S_VERSION:-v1.27.0}
83+
@mkdir -p /tmp/results || true
84+
@$(KIND) create cluster --wait=60s --name capsule-charts --image kindest/node:$${KIND_K8S_VERSION:-v1.27.0} --config $(HELM_KIND_CONFIG)
8285
@make helm-test-exec
8386
@$(KIND) delete cluster --name capsule-charts
8487

8588
helm-test-exec: kind
86-
@$(KIND) load docker-image --name capsule-charts $(CAPSULE_IMG):$(VERSION)
89+
$(MAKE) docker-build-capsule-trace
90+
$(MAKE) e2e-load-image CLUSTER_NAME=capsule-charts IMAGE=$(CAPSULE_IMG) VERSION=latest
91+
$(MAKE) e2e-load-image CLUSTER_NAME=capsule-charts IMAGE=$(CAPSULE_IMG) VERSION=tracing
8792
@kubectl create ns capsule-system || true
8893
@kubectl apply --server-side=true -f https://github.com/cert-manager/cert-manager/releases/download/v1.9.1/cert-manager.crds.yaml
8994
@kubectl apply --server-side=true -f https://github.com/prometheus-operator/prometheus-operator/releases/download/v0.58.0/bundle.yaml
90-
@ct install --config $(SRC_ROOT)/.github/configs/ct.yaml --namespace=capsule-system --all --debug
95+
@$(CT) install --config $(SRC_ROOT)/.github/configs/ct.yaml --namespace=capsule-system --all --debug
9196

9297
docker:
9398
@hash docker 2>/dev/null || {\
@@ -178,6 +183,14 @@ ko-build-capsule: ko
178183
.PHONY: ko-build-all
179184
ko-build-all: ko-build-capsule
180185

186+
.PHONY: docker-build-capsule-trace
187+
docker-build-capsule-trace: ko-build-capsule
188+
@docker build \
189+
--no-cache \
190+
--build-arg TARGET_IMAGE=$(CAPSULE_IMG):$(VERSION) \
191+
-t $(CAPSULE_IMG):tracing \
192+
-f Dockerfile.tracing .
193+
181194
# Docker Image Publish
182195
# ------------------
183196

@@ -238,6 +251,13 @@ KO_VERSION = v0.14.1
238251
ko:
239252
$(call go-install-tool,$(KO),github.com/google/ko@$(KO_VERSION))
240253

254+
HARPOON := $(shell pwd)/bin/harpoon
255+
HARPOON_VERSION := v0.9.4
256+
harpoon: ## Download harpoon locally if necessary.
257+
@mkdir $(shell pwd)/bin
258+
@curl -s https://raw.githubusercontent.com/alegrey91/harpoon/main/install | \
259+
sudo bash -s -- --install-version $(HARPOON_VERSION) --install-dir $(shell pwd)/bin
260+
241261
####################
242262
# -- Helpers
243263
####################
@@ -264,12 +284,6 @@ GOBIN=$(PROJECT_DIR)/bin go install $(2) ;\
264284
}
265285
endef
266286

267-
# Generate bundle manifests and metadata, then validate generated files.
268-
bundle: manifests
269-
operator-sdk generate kustomize manifests -q
270-
kustomize build config/manifests | operator-sdk generate bundle -q --overwrite --version $(VERSION) $(BUNDLE_METADATA_OPTS)
271-
operator-sdk bundle validate ./bundle
272-
273287
# Sorting imports
274288
.PHONY: goimports
275289
goimports:
@@ -291,11 +305,12 @@ e2e: ginkgo
291305
$(MAKE) e2e-build && $(MAKE) e2e-exec && $(MAKE) e2e-destroy
292306

293307
e2e-build: kind
294-
$(KIND) create cluster --wait=60s --name capsule --image kindest/node:$${KIND_K8S_VERSION:-v1.27.0}
308+
$(KIND) create cluster --wait=60s --name $(CLUSTER_NAME) --image kindest/node:$${KIND_K8S_VERSION:-v1.27.0}
309+
$(MAKE) e2e-load-image CLUSTER_NAME=$(CLUSTER_NAME) IMAGE=$(CAPSULE_IMG) VERSION=$(VERSION)
295310
$(MAKE) e2e-install
296311

297312
.PHONY: e2e-install
298-
e2e-install: e2e-load-image
313+
e2e-install:
299314
helm upgrade \
300315
--dependency-update \
301316
--debug \
@@ -310,9 +325,43 @@ e2e-install: e2e-load-image
310325
capsule \
311326
./charts/capsule
312327

328+
.PHONY: trace-install
329+
trace-install:
330+
helm upgrade \
331+
--dependency-update \
332+
--debug \
333+
--install \
334+
--namespace capsule-system \
335+
--create-namespace \
336+
--set 'manager.resources=null'\
337+
--set 'manager.livenessProbe.failureThreshold=10' \
338+
--set 'manager.readinessProbe.failureThreshold=10' \
339+
--values charts/capsule/ci/tracing-values.yaml \
340+
capsule \
341+
./charts/capsule
342+
343+
.PHONY: trace-e2e
344+
trace-e2e: kind
345+
$(MAKE) docker-build-capsule-trace
346+
$(KIND) create cluster --wait=60s --image kindest/node:$${KIND_K8S_VERSION:-v1.27.0} --config hack/kind-cluster.yml
347+
$(MAKE) e2e-load-image CLUSTER_NAME=capsule-tracing IMAGE=$(CAPSULE_IMG) VERSION=tracing
348+
$(MAKE) trace-install
349+
$(MAKE) e2e-exec
350+
$(KIND) delete cluster --name capsule-tracing
351+
352+
.PHONY: trace-unit
353+
trace-unit: harpoon
354+
$(HARPOON) analyze -e .git/ -e assets/ -e charts/ -e config/ -e docs/ -e e2e/ -e hack/ --directory /tmp/artifacts/ --save
355+
$(HARPOON) hunt -D /tmp/results -F harpoon-report.yml --include-cmd-stdout --save
356+
357+
.PHONY: seccomp
358+
seccomp:
359+
$(HARPOON) build --add-syscall-sets=dynamic,docker -D /tmp/results --name capsule-seccomp.json --save
360+
313361
.PHONY: e2e-load-image
362+
e2e-load-image: LOAD_IMAGE ?= $(IMAGE):$(VERSION)
314363
e2e-load-image: kind ko-build-all
315-
$(KIND) load docker-image --nodes capsule-control-plane --name capsule $(CAPSULE_IMG):$(VERSION)
364+
$(KIND) load docker-image $(IMAGE):$(VERSION) --name $(CLUSTER_NAME)
316365

317366
.PHONY: e2e-exec
318367
e2e-exec: ginkgo

‎charts/capsule/README.md

+5
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,7 @@ Here the values you can override:
129129
| nodeSelector | object | `{}` | Set the node selector for the Capsule pod |
130130
| podAnnotations | object | `{}` | Annotations to add to the capsule pod. |
131131
| podSecurityContext | object | `{"runAsGroup":1002,"runAsNonRoot":true,"runAsUser":1002,"seccompProfile":{"type":"RuntimeDefault"}}` | Set the securityContext for the Capsule pod |
132+
| ports | list | `[]` | Set additional ports for the deployment |
132133
| priorityClassName | string | `""` | Set the priority class name of the Capsule pod |
133134
| proxy.enabled | bool | `false` | Enable Installation of Capsule Proxy |
134135
| replicaCount | int | `1` | Set the replica count for capsule pod |
@@ -147,6 +148,7 @@ Here the values you can override:
147148
| Key | Type | Default | Description |
148149
|-----|------|---------|-------------|
149150
| manager.hostNetwork | bool | `false` | Specifies if the container should be started in hostNetwork mode. Required for use in some managed kubernetes clusters (such as AWS EKS) with custom CNI (such as calico), because control-plane managed by AWS cannot communicate with pods' IP CIDR and admission webhooks are not working |
151+
| manager.hostPID | bool | `false` | Specifies if the container should be started in hostPID mode. |
150152
| manager.image.pullPolicy | string | `"IfNotPresent"` | Set the image pull policy. |
151153
| manager.image.registry | string | `"ghcr.io"` | Set the image registry of capsule. |
152154
| manager.image.repository | string | `"projectcapsule/capsule"` | Set the image repository of capsule. |
@@ -165,6 +167,9 @@ Here the values you can override:
165167
| manager.rbac.existingRoles | list | `[]` | Specifies further cluster roles to be added to the Capsule manager service account. |
166168
| manager.readinessProbe | object | `{"httpGet":{"path":"/readyz","port":10080}}` | Configure the readiness probe using Deployment probe spec |
167169
| manager.resources | object | `{}` | Set the resource requests/limits for the Capsule manager container |
170+
| manager.securityContext | object | `{}` | Set the securityContext for the Capsule container |
171+
| manager.volumeMounts | list | `[]` | Set the additional volumeMounts needed for the Capsule manager container |
172+
| manager.volumes | list | `[]` | Set the additional volumes needed for the Capsule manager container |
168173
| manager.webhookPort | int | `9443` | Set an alternative to the default container port. Useful for use in some kubernetes clusters (such as GKE Private) with aggregator routing turned on, because pod ports have to be opened manually on the firewall side |
169174

170175
### ServiceMonitor Parameters

0 commit comments

Comments
 (0)
Please sign in to comment.