Merge pull request #1658 from daemon1024/remove-init-container-dep-wi…

…th-btf-core

Remove init container dep with BTF CORE

.github/workflows/ci-test-ubi-image.yml

@@ -78,7 +78,11 @@ jobs:
           kubectl wait --timeout=7m --for=condition=ready pod -l kubearmor-app,kubearmor-app!=kubearmor-snitch,kubearmor-app!=kubearmor-controller -n kubearmor
           kubectl wait --timeout=1m --for=condition=ready pod -l kubearmor-app=kubearmor-controller -n kubearmor
           kubectl get pods -A
-
+      
+      - name: Operator may take upto 10 sec to enable TLS, Sleep for 15Sec
+        run: |
+          sleep 15
+      
       - name: Test KubeArmor using Ginkgo
         run: |
           go install -mod=mod github.com/onsi/ginkgo/v2/ginkgo

.github/workflows/cleanup.sh

@@ -6,12 +6,14 @@
 cleanup() {
   echo "Performing cleanup..."
 
-  ./usr/local/bin/k3s-killall.sh
+  /usr/local/bin/k3s-killall.sh
 
   /usr/local/bin/k3s-uninstall.sh
 
   docker system prune -a -f
 
+  sudo podman system prune -a -f
+
   # rm -rf /home/vagrant/actions-runner/_work/KubeArmor
 
   echo "Cleanup complete."

Dockerfile

@@ -3,7 +3,7 @@
 
 ### Builder
 
-FROM golang:1.22-alpine3.19 as builder
+FROM golang:1.22-alpine3.20 as builder
 
 RUN apk --no-cache update
 RUN apk add --no-cache git clang llvm make gcc protobuf
@@ -18,16 +18,37 @@ RUN go install github.com/golang/protobuf/protoc-gen-go@latest
 RUN go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
 RUN make
 
+
+WORKDIR /usr/src/KubeArmor/BPF
+
+RUN apk add curl
+# install bpftool  
+RUN arch=$(uname -m) bpftool_version=v7.3.0 && \
+    if [[ "$arch" == "aarch64" ]]; then \
+        arch=arm64; \
+    elif [[ "$arch" == "x86_64" ]]; then \
+        arch=amd64; \   
+    fi && \
+    curl -LO https://github.com/libbpf/bpftool/releases/download/$bpftool_version/bpftool-$bpftool_version-$arch.tar.gz && \
+    tar -xzf bpftool-$bpftool_version-$arch.tar.gz -C /usr/local/bin && \
+    chmod +x /usr/local/bin/bpftool
+
+
+COPY ./KubeArmor/BPF .
+
+RUN make
+
 ### Make executable image
 
-FROM alpine:3.18 as kubearmor
+FROM alpine:3.20 as kubearmor
 
 RUN echo "@community http://dl-cdn.alpinelinux.org/alpine/edge/community" | tee -a /etc/apk/repositories
 
 RUN apk --no-cache update
 RUN apk add apparmor@community apparmor-utils@community bash
 
 COPY --from=builder /usr/src/KubeArmor/KubeArmor/kubearmor /KubeArmor/kubearmor
+COPY --from=builder /usr/src/KubeArmor/BPF/*.o /opt/kubearmor/BPF/
 COPY --from=builder /usr/src/KubeArmor/KubeArmor/templates/* /KubeArmor/templates/
 
 ENTRYPOINT ["/KubeArmor/kubearmor"]
@@ -67,6 +88,7 @@ RUN groupadd --gid 1000 default \
 
 COPY LICENSE /licenses/license.txt
 COPY --from=builder --chown=default:default /usr/src/KubeArmor/KubeArmor/kubearmor /KubeArmor/kubearmor
+COPY --from=builder --chown=default:default /usr/src/KubeArmor/BPF/*.o /opt/kubearmor/BPF/
 COPY --from=builder --chown=default:default /usr/src/KubeArmor/KubeArmor/templates/* /KubeArmor/templates/
 
 # TODO

KubeArmor/go.mod

@@ -2,7 +2,7 @@ module github.com/kubearmor/KubeArmor/KubeArmor
 
 go 1.21.0
 
-toolchain go1.21.9
+toolchain go1.21.11
 
 replace (
 	github.com/kubearmor/KubeArmor => ../../

deployments/get/objects.go

@@ -270,10 +270,6 @@ func GenerateDaemonSet(env, namespace string) *appsv1.DaemonSet {
 			MountPath: "/lib/modules",
 			ReadOnly:  true,
 		},
-		{
-			Name:      "sys-fs-bpf-path", //BPF (read-write)
-			MountPath: "/sys/fs/bpf",
-		},
 		{
 			Name:      "sys-kernel-security-path", //LSM (read-only)
 			MountPath: "/sys/kernel/security",
@@ -305,15 +301,6 @@ func GenerateDaemonSet(env, namespace string) *appsv1.DaemonSet {
 				},
 			},
 		},
-		{
-			Name: "sys-fs-bpf-path",
-			VolumeSource: corev1.VolumeSource{
-				HostPath: &corev1.HostPathVolumeSource{
-					Path: "/sys/fs/bpf",
-					Type: &hostPathDirectory,
-				},
-			},
-		},
 		{
 			Name: "sys-kernel-security-path",
 			VolumeSource: corev1.VolumeSource{

deployments/go.mod

@@ -2,7 +2,7 @@ module github.com/kubearmor/KubeArmor/deployments
 
 go 1.21.0
 
-toolchain go1.21.9
+toolchain go1.21.11
 
 replace (
 	github.com/kubearmor/KubeArmor => ../

deployments/helm/KubeArmor/values.yaml

@@ -163,8 +163,6 @@ kubearmor:
   - mountPath: /lib/modules
     name: lib-modules-path
     readOnly: true
-  - mountPath: /sys/fs/bpf
-    name: sys-fs-bpf-path
   - mountPath: /sys/kernel/security
     name: sys-kernel-security-path
   - mountPath: /sys/kernel/debug
@@ -183,8 +181,6 @@ kubearmor:
     - mountPath: /lib/modules
       name: lib-modules-path
       readOnly: true
-    - mountPath: /sys/fs/bpf
-      name: sys-fs-bpf-path
     - mountPath: /sys/kernel/security
       name: sys-kernel-security-path
     - mountPath: /sys/kernel/debug
@@ -205,8 +201,6 @@ kubearmor:
     - mountPath: /lib/modules
       name: lib-modules-path
       readOnly: true
-    - mountPath: /sys/fs/bpf
-      name: sys-fs-bpf-path
     - mountPath: /sys/kernel/security
       name: sys-kernel-security-path
     - mountPath: /sys/kernel/debug
@@ -227,8 +221,6 @@ kubearmor:
     - mountPath: /lib/modules
       name: lib-modules-path
       readOnly: true
-    - mountPath: /sys/fs/bpf
-      name: sys-fs-bpf-path
     - mountPath: /sys/kernel/security
       name: sys-kernel-security-path
     - mountPath: /sys/kernel/debug
@@ -249,8 +241,6 @@ kubearmor:
     - mountPath: /lib/modules
       name: lib-modules-path
       readOnly: true
-    - mountPath: /sys/fs/bpf
-      name: sys-fs-bpf-path
     - mountPath: /sys/kernel/security
       name: sys-kernel-security-path
     - mountPath: /sys/kernel/debug
@@ -271,8 +261,6 @@ kubearmor:
     - mountPath: /lib/modules
       name: lib-modules-path
       readOnly: true
-    - mountPath: /sys/fs/bpf
-      name: sys-fs-bpf-path
     - mountPath: /sys/kernel/security
       name: sys-kernel-security-path
     - mountPath: /sys/kernel/debug
@@ -293,8 +281,6 @@ kubearmor:
     - mountPath: /lib/modules
       name: lib-modules-path
       readOnly: true
-    - mountPath: /sys/fs/bpf
-      name: sys-fs-bpf-path
     - mountPath: /sys/kernel/security
       name: sys-kernel-security-path
     - mountPath: /sys/kernel/debug
@@ -315,8 +301,6 @@ kubearmor:
     - mountPath: /lib/modules
       name: lib-modules-path
       readOnly: true
-    - mountPath: /sys/fs/bpf
-      name: sys-fs-bpf-path
     - mountPath: /sys/kernel/security
       name: sys-kernel-security-path
     - mountPath: /sys/kernel/debug
@@ -333,8 +317,6 @@ kubearmor:
     - mountPath: /lib/modules
       name: lib-modules-path
       readOnly: true
-    - mountPath: /sys/fs/bpf
-      name: sys-fs-bpf-path
     - mountPath: /sys/kernel/security
       name: sys-kernel-security-path
     - mountPath: /sys/kernel/debug
@@ -355,8 +337,6 @@ kubearmor:
     - mountPath: /lib/modules
       name: lib-modules-path
       readOnly: true
-    - mountPath: /sys/fs/bpf
-      name: sys-fs-bpf-path
     - mountPath: /sys/kernel/security
       name: sys-kernel-security-path
     - mountPath: /sys/kernel/debug
@@ -377,8 +357,6 @@ kubearmor:
     - mountPath: /lib/modules
       name: lib-modules-path
       readOnly: true
-    - mountPath: /sys/fs/bpf
-      name: sys-fs-bpf-path
     - mountPath: /sys/kernel/security
       name: sys-kernel-security-path
     - mountPath: /sys/kernel/debug
@@ -404,10 +382,6 @@ kubearmor:
         path: /lib/modules
         type: DirectoryOrCreate
       name: lib-modules-path
-    - hostPath:
-        path: /sys/fs/bpf
-        type: Directory
-      name: sys-fs-bpf-path
     - hostPath:
         path: /sys/kernel/security
         type: Directory
@@ -438,10 +412,6 @@ kubearmor:
         path: /lib/modules
         type: DirectoryOrCreate
       name: lib-modules-path
-    - hostPath:
-        path: /sys/fs/bpf
-        type: Directory
-      name: sys-fs-bpf-path
     - hostPath:
         path: /sys/kernel/security
         type: Directory
@@ -472,10 +442,6 @@ kubearmor:
         path: /lib/modules
         type: DirectoryOrCreate
       name: lib-modules-path
-    - hostPath:
-        path: /sys/fs/bpf
-        type: Directory
-      name: sys-fs-bpf-path
     - hostPath:
         path: /sys/kernel/security
         type: Directory
@@ -506,10 +472,6 @@ kubearmor:
         path: /lib/modules
         type: DirectoryOrCreate
       name: lib-modules-path
-    - hostPath:
-        path: /sys/fs/bpf
-        type: Directory
-      name: sys-fs-bpf-path
     - hostPath:
         path: /sys/kernel/security
         type: Directory
@@ -540,10 +502,6 @@ kubearmor:
         path: /lib/modules
         type: DirectoryOrCreate
       name: lib-modules-path
-    - hostPath:
-        path: /sys/fs/bpf
-        type: Directory
-      name: sys-fs-bpf-path
     - hostPath:
         path: /sys/kernel/security
         type: Directory
@@ -574,10 +532,6 @@ kubearmor:
         path: /lib/modules
         type: Directory
       name: lib-modules-path
-    - hostPath:
-        path: /sys/fs/bpf
-        type: Directory
-      name: sys-fs-bpf-path
     - hostPath:
         path: /sys/kernel/security
         type: Directory
@@ -608,10 +562,6 @@ kubearmor:
         path: /lib/modules
         type: DirectoryOrCreate
       name: lib-modules-path
-    - hostPath:
-        path: /sys/fs/bpf
-        type: Directory
-      name: sys-fs-bpf-path
     - hostPath:
         path: /sys/kernel/security
         type: Directory
@@ -642,10 +592,6 @@ kubearmor:
         path: /lib/modules
         type: DirectoryOrCreate
       name: lib-modules-path
-    - hostPath:
-        path: /sys/fs/bpf
-        type: Directory
-      name: sys-fs-bpf-path
     - hostPath:
         path: /sys/kernel/security
         type: Directory
@@ -672,10 +618,6 @@ kubearmor:
         path: /lib/modules
         type: DirectoryOrCreate
       name: lib-modules-path
-    - hostPath:
-        path: /sys/fs/bpf
-        type: Directory
-      name: sys-fs-bpf-path
     - hostPath:
         path: /sys/kernel/security
         type: Directory
@@ -706,10 +648,6 @@ kubearmor:
         path: /lib/modules
         type: DirectoryOrCreate
       name: lib-modules-path
-    - hostPath:
-        path: /sys/fs/bpf
-        type: Directory
-      name: sys-fs-bpf-path
     - hostPath:
         path: /sys/kernel/security
         type: Directory

deployments/helm/KubeArmorOperator/templates/clusterrole-rbac.yaml

@@ -90,6 +90,13 @@ rules:
   - customresourcedefinitions
   verbs:
   - create
+- apiGroups:
+  - batch
+  resources:
+  - jobs
+  - cronjobs
+  verbs:
+  - get
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole

deployments/helm/KubeArmorOperator/templates/deployment.yaml

@@ -26,4 +26,13 @@ spec:
         {{- end }}
         image: {{ include "operatorImage" . }}
         imagePullPolicy: {{ .Values.kubearmorOperator.imagePullPolicy }}
+
+        {{- $tag := (split ":" (include "operatorImage" .))._1 -}}
+        {{- if or (eq $tag "latest") (and (hasPrefix "v" $tag) (semverCompare "^1.4.0" $tag)) }}
+        # initDeploy flag is only supported from v1.4.0
+        args:
+          - --initDeploy={{.Values.kubearmorOperator.initDeploy }}
+        {{- end }}
+
       serviceAccountName: {{ .Values.kubearmorOperator.name }}
+

deployments/helm/KubeArmorOperator/values.yaml

@@ -36,6 +36,7 @@ kubearmorOperator:
     repository: kubearmor/kubearmor-operator
     tag: ""
   imagePullPolicy: IfNotPresent
+  initDeploy: true
 
 kubearmorConfig:
   defaultCapabilitiesPosture: audit

pkg/KubeArmorController/go.mod

@@ -2,7 +2,7 @@ module github.com/kubearmor/KubeArmor/pkg/KubeArmorController
 
 go 1.21.0
 
-toolchain go1.21.9
+toolchain go1.21.11
 
 require (
 	github.com/go-logr/logr v1.4.1