From fe9bebaa8d30d04f60a6c797a4cebe6acf0b9520 Mon Sep 17 00:00:00 2001 From: aohoyd Date: Wed, 10 Jan 2024 15:26:04 +0300 Subject: [PATCH] Add flags for operator to make it possible using k8s api without TP CRDs Fixes: cilium#1880 Signed-off-by: Alexey Olshanskiy --- docs/content/en/docs/reference/helm-chart.md | 3 ++- install/kubernetes/tetragon/README.md | 3 ++- .../tetragon/templates/operator_configmap.yaml | 1 + .../tetragon/templates/tetragon_configmap.yaml | 1 + install/kubernetes/tetragon/values.yaml | 3 +++ operator/cmd/common/common.go | 1 + operator/crd/crd.go | 7 ++++++- operator/option/config.go | 9 +++++++++ 8 files changed, 25 insertions(+), 3 deletions(-) diff --git a/docs/content/en/docs/reference/helm-chart.md b/docs/content/en/docs/reference/helm-chart.md index 093fd61a5eb..c382e1514cd 100644 --- a/docs/content/en/docs/reference/helm-chart.md +++ b/docs/content/en/docs/reference/helm-chart.md @@ -97,7 +97,7 @@ To use [the values available](#values), with `helm install` or `helm upgrade`, u | tetragon.prometheus.serviceMonitor.scrapeInterval | string | `"10s"` | Interval at which metrics should be scraped. If not specified, Prometheus' global scrape interval is used. | | tetragon.resources | object | `{}` | | | tetragon.securityContext.privileged | bool | `true` | | -| tetragonOperator | object | `{"affinity":{},"annotations":{},"extraLabels":{},"extraPodLabels":{},"extraVolumeMounts":[],"extraVolumes":[],"image":{"override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/tetragon-operator","tag":"v1.0.1"},"nodeSelector":{},"podAnnotations":{},"podInfo":{"enabled":false},"podSecurityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]}},"priorityClassName":"","prometheus":{"address":"","enabled":true,"port":2113,"serviceMonitor":{"enabled":false,"labelsOverride":{},"scrapeInterval":"10s"}},"resources":{"limits":{"cpu":"500m","memory":"128Mi"},"requests":{"cpu":"10m","memory":"64Mi"}},"securityContext":{},"serviceAccount":{"annotations":{},"create":true,"name":""},"skipCRDCreation":false,"strategy":{},"tolerations":[{"operator":"Exists"}]}` | Tetragon Operator settings | +| tetragonOperator | object | `{"affinity":{},"annotations":{},"extraLabels":{},"extraPodLabels":{},"extraVolumeMounts":[],"extraVolumes":[],"image":{"override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/tetragon-operator","tag":"v1.0.1"},"nodeSelector":{},"podAnnotations":{},"podInfo":{"enabled":false},"podSecurityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]}},"priorityClassName":"","prometheus":{"address":"","enabled":true,"port":2113,"serviceMonitor":{"enabled":false,"labelsOverride":{},"scrapeInterval":"10s"}},"resources":{"limits":{"cpu":"500m","memory":"128Mi"},"requests":{"cpu":"10m","memory":"64Mi"}},"securityContext":{},"serviceAccount":{"annotations":{},"create":true,"name":""},"skipCRDCreation":false,"strategy":{},"tolerations":[{"operator":"Exists"}],"tracingPolicy":{"enabled":true}}` | Tetragon Operator settings | | tetragonOperator.annotations | object | `{}` | Annotations for the Tetragon Operator Deployment. | | tetragonOperator.extraLabels | object | `{}` | Extra labels to be added on the Tetragon Operator Deployment. | | tetragonOperator.extraPodLabels | object | `{}` | Extra labels to be added on the Tetragon Operator Deployment Pods. | @@ -119,6 +119,7 @@ To use [the values available](#values), with `helm install` or `helm upgrade`, u | tetragonOperator.securityContext | object | `{}` | securityContext for the Tetragon Operator Deployment Pods. | | tetragonOperator.serviceAccount | object | `{"annotations":{},"create":true,"name":""}` | tetragon-operator service account. | | tetragonOperator.strategy | object | `{}` | resources for the Tetragon Operator Deployment update strategy | +| tetragonOperator.tracingPolicy.enabled | bool | `true` | Enables the TracingPolicy and TracingPolicyNamespaced CRD creation. | | tolerations[0].operator | string | `"Exists"` | | | updateStrategy | object | `{}` | | diff --git a/install/kubernetes/tetragon/README.md b/install/kubernetes/tetragon/README.md index 913d50d7ba1..7cd02f8434b 100644 --- a/install/kubernetes/tetragon/README.md +++ b/install/kubernetes/tetragon/README.md @@ -79,7 +79,7 @@ Helm chart for Tetragon | tetragon.prometheus.serviceMonitor.scrapeInterval | string | `"10s"` | Interval at which metrics should be scraped. If not specified, Prometheus' global scrape interval is used. | | tetragon.resources | object | `{}` | | | tetragon.securityContext.privileged | bool | `true` | | -| tetragonOperator | object | `{"affinity":{},"annotations":{},"extraLabels":{},"extraPodLabels":{},"extraVolumeMounts":[],"extraVolumes":[],"image":{"override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/tetragon-operator","tag":"v1.0.1"},"nodeSelector":{},"podAnnotations":{},"podInfo":{"enabled":false},"podSecurityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]}},"priorityClassName":"","prometheus":{"address":"","enabled":true,"port":2113,"serviceMonitor":{"enabled":false,"labelsOverride":{},"scrapeInterval":"10s"}},"resources":{"limits":{"cpu":"500m","memory":"128Mi"},"requests":{"cpu":"10m","memory":"64Mi"}},"securityContext":{},"serviceAccount":{"annotations":{},"create":true,"name":""},"skipCRDCreation":false,"strategy":{},"tolerations":[{"operator":"Exists"}]}` | Tetragon Operator settings | +| tetragonOperator | object | `{"affinity":{},"annotations":{},"extraLabels":{},"extraPodLabels":{},"extraVolumeMounts":[],"extraVolumes":[],"image":{"override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/tetragon-operator","tag":"v1.0.1"},"nodeSelector":{},"podAnnotations":{},"podInfo":{"enabled":false},"podSecurityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]}},"priorityClassName":"","prometheus":{"address":"","enabled":true,"port":2113,"serviceMonitor":{"enabled":false,"labelsOverride":{},"scrapeInterval":"10s"}},"resources":{"limits":{"cpu":"500m","memory":"128Mi"},"requests":{"cpu":"10m","memory":"64Mi"}},"securityContext":{},"serviceAccount":{"annotations":{},"create":true,"name":""},"skipCRDCreation":false,"strategy":{},"tolerations":[{"operator":"Exists"}],"tracingPolicy":{"enabled":true}}` | Tetragon Operator settings | | tetragonOperator.annotations | object | `{}` | Annotations for the Tetragon Operator Deployment. | | tetragonOperator.extraLabels | object | `{}` | Extra labels to be added on the Tetragon Operator Deployment. | | tetragonOperator.extraPodLabels | object | `{}` | Extra labels to be added on the Tetragon Operator Deployment Pods. | @@ -101,6 +101,7 @@ Helm chart for Tetragon | tetragonOperator.securityContext | object | `{}` | securityContext for the Tetragon Operator Deployment Pods. | | tetragonOperator.serviceAccount | object | `{"annotations":{},"create":true,"name":""}` | tetragon-operator service account. | | tetragonOperator.strategy | object | `{}` | resources for the Tetragon Operator Deployment update strategy | +| tetragonOperator.tracingPolicy.enabled | bool | `true` | Enables the TracingPolicy and TracingPolicyNamespaced CRD creation. | | tolerations[0].operator | string | `"Exists"` | | | updateStrategy | object | `{}` | | diff --git a/install/kubernetes/tetragon/templates/operator_configmap.yaml b/install/kubernetes/tetragon/templates/operator_configmap.yaml index 296506d3353..8cd40a7a6f4 100644 --- a/install/kubernetes/tetragon/templates/operator_configmap.yaml +++ b/install/kubernetes/tetragon/templates/operator_configmap.yaml @@ -8,3 +8,4 @@ metadata: data: skip-crd-creation: {{ .Values.tetragonOperator.skipCRDCreation | quote }} skip-pod-info-crd: {{ not .Values.tetragonOperator.podInfo.enabled | quote }} + skip-tracing-policy-crd: {{ not .Values.tetragonOperator.tracingPolicy.enabled | quote }} diff --git a/install/kubernetes/tetragon/templates/tetragon_configmap.yaml b/install/kubernetes/tetragon/templates/tetragon_configmap.yaml index 46f6354eb46..b0dbecf0e69 100644 --- a/install/kubernetes/tetragon/templates/tetragon_configmap.yaml +++ b/install/kubernetes/tetragon/templates/tetragon_configmap.yaml @@ -56,4 +56,5 @@ data: enable-msg-handling-latency: "true" {{- end }} enable-pod-info: {{ .Values.tetragonOperator.podInfo.enabled | quote }} + enable-tracing-policy-crd: {{ .Values.tetragonOperator.tracingPolicy.enabled | quote }} {{- include "configmap.extra" . | nindent 2 }} diff --git a/install/kubernetes/tetragon/values.yaml b/install/kubernetes/tetragon/values.yaml index c14eb8ba540..d888094dd4a 100644 --- a/install/kubernetes/tetragon/values.yaml +++ b/install/kubernetes/tetragon/values.yaml @@ -232,6 +232,9 @@ tetragonOperator: # -- Enables the PodInfo CRD and the controller that reconciles PodInfo # custom resources. enabled: false + tracingPolicy: + # -- Enables the TracingPolicy and TracingPolicyNamespaced CRD creation. + enabled: true # -- Enables the Tetragon Operator metrics. prometheus: enabled: true diff --git a/operator/cmd/common/common.go b/operator/cmd/common/common.go index 8cf5a775b18..c2258dc6b44 100644 --- a/operator/cmd/common/common.go +++ b/operator/cmd/common/common.go @@ -21,6 +21,7 @@ func AddCommonFlags(cmd *cobra.Command) { flags.String(operatorOption.KubeCfgPath, "", "Kubeconfig filepath to connect to k8s") flags.String(operatorOption.ConfigDir, "", "Directory in which tetragon-operator-config configmap is mounted") flags.Bool(operatorOption.SkipPodInfoCRD, false, "When true, PodInfo Custom Resource Definition (CRD) will not be created") + flags.Bool(operatorOption.SkipTracingPolicyCRD, false, "When true, TracingPolicy and TracingPolicyNamespaced Custom Resource Definition (CRD) will not be created") } func Initialize(cmd *cobra.Command) { diff --git a/operator/crd/crd.go b/operator/crd/crd.go index 9b614309c5b..db7ea74990f 100644 --- a/operator/crd/crd.go +++ b/operator/crd/crd.go @@ -58,7 +58,12 @@ func RegisterCRDs() { crds := []crdutils.CRD{} for _, crd := range client.AllCRDs { - if option.Config.SkipPodInfoCRD && crd.CRDName == client.PodInfoCRD.CRDName { + switch { + case option.Config.SkipPodInfoCRD && crd.CRDName == client.PodInfoCRD.CRDName: + continue + case option.Config.SkipTracingPolicyCRD && crd.CRDName == client.TracingPolicyCRD.CRDName: + continue + case option.Config.SkipTracingPolicyCRD && crd.CRDName == client.TracingPolicyNamespacedCRD.CRDName: continue } crds = append(crds, crd) diff --git a/operator/option/config.go b/operator/option/config.go index 79050e9460a..231a43976df 100644 --- a/operator/option/config.go +++ b/operator/option/config.go @@ -26,6 +26,10 @@ const ( // SkipPodInfoCRD specifies whether the tetragonPod CustomResourceDefinition will be // disabled SkipPodInfoCRD = "skip-pod-info-crd" + + // SkipTracingPolicyCRD specifies whether the tracing-policies CustomResourceDefinition will be + // disabled + SkipTracingPolicyCRD = "skip-tracing-policy-crd" ) // OperatorConfig is the configuration used by the operator. @@ -42,6 +46,10 @@ type OperatorConfig struct { // SkipPodInfoCRD disables creation of the TetragonPod CustomResourceDefinition only. SkipPodInfoCRD bool + + // SkipTracingPolicyCRD disables creation of the TracingPolicy and + // TracingPolicyNamespaced CustomResourceDefinition only. + SkipTracingPolicyCRD bool } // Config represents the operator configuration. @@ -53,4 +61,5 @@ func ConfigPopulate() { Config.KubeCfgPath = viper.GetString(KubeCfgPath) Config.ConfigDir = viper.GetString(ConfigDir) Config.SkipPodInfoCRD = viper.GetBool(SkipPodInfoCRD) + Config.SkipTracingPolicyCRD = viper.GetBool(SkipTracingPolicyCRD) }