add patching for applicationprofiles

go.mod

@@ -16,7 +16,7 @@ require (
 	github.com/kubescape/backend v0.0.16
 	github.com/kubescape/go-logger v0.0.22
 	github.com/kubescape/k8s-interface v0.0.158-0.20240123155300-c2a152fdc0d8
-	github.com/kubescape/storage v0.0.59
+	github.com/kubescape/storage v0.0.61
 	github.com/panjf2000/ants/v2 v2.9.0
 	github.com/spf13/viper v1.18.2
 	github.com/stretchr/testify v1.8.4

go.sum

@@ -494,8 +494,8 @@ github.com/kubescape/go-logger v0.0.22 h1:gle7wH6emOiGv9ljdpVi82pWLQ3jGucrUucvil
 github.com/kubescape/go-logger v0.0.22/go.mod h1:x3HBpZo3cMT/WIdy18BxvVVd5D0e/PWFVk/HiwBNu3g=
 github.com/kubescape/k8s-interface v0.0.158-0.20240123155300-c2a152fdc0d8 h1:1B73UU9XFPn0HtVwDHFIUg+Hw1RwTSsbKvwqhweoqtI=
 github.com/kubescape/k8s-interface v0.0.158-0.20240123155300-c2a152fdc0d8/go.mod h1:5sz+5Cjvo98lTbTVDiDA4MmlXxeHSVMW/wR0V3hV4K8=
-github.com/kubescape/storage v0.0.59 h1:Su7Rn0JxMCzo2DkMD/yRniivvYP1p3fbNhhUtuUKZdE=
-github.com/kubescape/storage v0.0.59/go.mod h1:I7LUpFfRwVeVphrB83cw4Hz+48sy3Qe6l5H2RDpD43A=
+github.com/kubescape/storage v0.0.61 h1:T6NIZP+80ILKLVOV9KFU/0OuH4unoLGXo4mO0zwv6/Q=
+github.com/kubescape/storage v0.0.61/go.mod h1:uMwudLhZCPgjf4JEbRSUZ20JmQJitLVrexZb7S1N4b0=
 github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de h1:9TO3cAIGXtEhnIaL+V+BEER86oLrvS+kWobKpbJuye0=
 github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de/go.mod h1:zAbeS9B/r2mtpb6U+EI2rYA5OAXxsYw6wTamcNW+zcE=
 github.com/logrusorgru/aurora v0.0.0-20200102142835-e9ef32dff381 h1:bqDmpDG49ZRnB5PcgP0RXtQvnMSgIF14M7CBd2shtXs=

pkg/applicationprofilemanager/v1/applicationprofile_manager.go

@@ -26,6 +26,7 @@ import (
 	"go.opentelemetry.io/otel"
 	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/trace"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
@@ -37,6 +38,8 @@ type ApplicationProfileManager struct {
 	execMaps                 maps.SafeMap[string, *maps.SafeMap[string, mapset.Set[string]]] // key is k8sContainerID
 	openMaps                 maps.SafeMap[string, *maps.SafeMap[string, mapset.Set[string]]] // key is k8sContainerID
 	watchedContainerChannels maps.SafeMap[string, chan error]                                // key is ContainerID
+	savedCapabilities        maps.SafeMap[string, int]
+	savedSyscalls            maps.SafeMap[string, int]
 	k8sClient                k8sclient.K8sClientInterface
 	storageClient            storage.StorageClient
 	syscallPeekFunc          func(nsMountId uint64) ([]string, error)
@@ -153,22 +156,13 @@ func (am *ApplicationProfileManager) saveProfile(ctx context.Context, watchedCon
 		return
 	}
 
-	// check if we have new activities to save
-	var addedActivities int
-	syscalls := mapset.NewSet[string]()
-	// existing activity
-	existingActivity, _ := am.storageClient.GetApplicationActivity(namespace, slug)
-	if existingActivity != nil && existingActivity.Spec.Syscalls != nil {
-		syscalls.Append(existingActivity.Spec.Syscalls...)
-	}
 	// get syscalls from IG
 	observedSyscalls, err := am.syscallPeekFunc(watchedContainer.NsMntId)
 	if err != nil {
 		logger.L().Ctx(ctx).Error("ApplicationProfileManager - failed to get syscalls", helpers.Error(err))
 	}
-	addedActivities += syscalls.Append(observedSyscalls...)
-	// new activity
-	if addedActivities > 0 {
+	// check if we have new activities to save
+	if len(observedSyscalls) > am.savedSyscalls.Get(watchedContainer.K8sContainerID) {
 		newActivity := &v1beta1.ApplicationActivity{
 			ObjectMeta: metav1.ObjectMeta{
 				Name: slug,
@@ -180,42 +174,31 @@ func (am *ApplicationProfileManager) saveProfile(ctx context.Context, watchedCon
 			},
 		}
 		// add syscalls
-		newActivity.Spec.Syscalls = syscalls.ToSlice()
+		newActivity.Spec.Syscalls = observedSyscalls
 		// save application activity
 		if err := am.storageClient.CreateApplicationActivity(newActivity, namespace); err != nil {
 			logger.L().Ctx(ctx).Error("ApplicationProfileManager - failed to save application activity", helpers.Error(err))
+		} else {
+			am.savedSyscalls.Set(watchedContainer.K8sContainerID, len(observedSyscalls))
+			logger.L().Debug("ApplicationProfileManager - saved application activity", helpers.String("slug", slug), helpers.String("container ID", watchedContainer.ContainerID), helpers.String("k8s workload", watchedContainer.K8sContainerID))
 		}
-		logger.L().Debug("ApplicationProfileManager - saved application activity", helpers.String("slug", slug), helpers.String("container ID", watchedContainer.ContainerID), helpers.String("k8s workload", watchedContainer.K8sContainerID))
 	}
 
 	// profile sets
 	var addedProfiles int
-	capabilities := mapset.NewSet[string]()
 	execs := make(map[string]mapset.Set[string])
 	opens := make(map[string]mapset.Set[string])
-	// existing profile
-	existingProfile, _ := am.storageClient.GetApplicationProfile(namespace, slug)
-	existingProfileContainer := utils.GetApplicationProfileContainer(existingProfile, watchedContainer.ContainerType, watchedContainer.ContainerIndex)
-	if existingProfileContainer != nil {
-		capabilities.Append(existingProfileContainer.Capabilities...)
-		for _, exec := range existingProfileContainer.Execs {
-			if _, exist := execs[exec.Path]; !exist {
-				execs[exec.Path] = mapset.NewSet[string]()
-			}
-			execs[exec.Path].Append(exec.Args...)
-		}
-		for _, open := range existingProfileContainer.Opens {
-			if _, exist := opens[open.Path]; !exist {
-				opens[open.Path] = mapset.NewSet[string]()
-			}
-			opens[open.Path].Append(open.Flags...)
-		}
-	}
 	// get capabilities, execs and opens from IG
+	var observedCapabilities []string
 	if capabilitiesSet, ok := am.capabilitiesSets.Load(watchedContainer.K8sContainerID); ok {
-		addedProfiles += capabilities.Append(capabilitiesSet.ToSlice()...)
+		observedCapabilities = capabilitiesSet.ToSlice()
 	}
-	if execMap, ok := am.execMaps.Load(watchedContainer.K8sContainerID); ok {
+	newExecMap := new(maps.SafeMap[string, mapset.Set[string]])
+	execMap, ok := am.execMaps.Load(watchedContainer.K8sContainerID)
+	if ok {
+		// replace the exec map with a new one
+		am.execMaps.Set(watchedContainer.K8sContainerID, newExecMap)
+		// if we fail to save the profile we will restore execMap entries
 		execMap.Range(func(path string, exec mapset.Set[string]) bool {
 			if _, exist := execs[path]; !exist {
 				execs[path] = mapset.NewSet[string]()
@@ -224,7 +207,12 @@ func (am *ApplicationProfileManager) saveProfile(ctx context.Context, watchedCon
 			return true
 		})
 	}
-	if openMap, ok := am.openMaps.Load(watchedContainer.K8sContainerID); ok {
+	newOpenMap := new(maps.SafeMap[string, mapset.Set[string]])
+	openMap, ok := am.openMaps.Load(watchedContainer.K8sContainerID)
+	if ok {
+		// replace the open map with a new one
+		am.openMaps.Set(watchedContainer.K8sContainerID, newOpenMap)
+		// if we fail to save the profile we will restore openMap entries
 		openMap.Range(func(path string, open mapset.Set[string]) bool {
 			if _, exist := opens[path]; !exist {
 				opens[path] = mapset.NewSet[string]()
@@ -234,7 +222,7 @@ func (am *ApplicationProfileManager) saveProfile(ctx context.Context, watchedCon
 		})
 	}
 	// new profile
-	if addedProfiles > 0 {
+	if addedProfiles > 0 || len(observedCapabilities) > am.savedCapabilities.Get(watchedContainer.K8sContainerID) {
 		newProfile := &v1beta1.ApplicationProfile{
 			ObjectMeta: metav1.ObjectMeta{
 				Name: slug,
@@ -249,7 +237,7 @@ func (am *ApplicationProfileManager) saveProfile(ctx context.Context, watchedCon
 			Name: watchedContainer.InstanceID.GetContainerName(),
 		}
 		// add capabilities
-		newProfileContainer.Capabilities = capabilities.ToSlice()
+		newProfileContainer.Capabilities = observedCapabilities
 		sort.Strings(newProfileContainer.Capabilities)
 		// add execs
 		newProfileContainer.Execs = make([]v1beta1.ExecCalls, 0)
@@ -274,16 +262,47 @@ func (am *ApplicationProfileManager) saveProfile(ctx context.Context, watchedCon
 		// insert application profile container
 		utils.InsertApplicationProfileContainer(newProfile, watchedContainer.ContainerType, watchedContainer.ContainerIndex, newProfileContainer)
 		// save application profile
-		if err := am.storageClient.CreateApplicationProfile(newProfile, namespace); err != nil {
-			logger.L().Ctx(ctx).Error("ApplicationProfileManager - failed to save application profile", helpers.Error(err))
-		}
-		logger.L().Debug("ApplicationProfileManager - saved application profile", helpers.String("slug", slug), helpers.String("container ID", watchedContainer.ContainerID), helpers.String("k8s workload", watchedContainer.K8sContainerID))
-		// profile summary
-		summary := &v1beta1.ApplicationProfileSummary{
-			ObjectMeta: newProfile.ObjectMeta,
+		var gotErr error
+		if err := am.storageClient.PatchApplicationProfile(slug, namespace, newProfile); err != nil {
+			if apierrors.IsNotFound(err) {
+				if err := am.storageClient.CreateApplicationProfile(newProfile, namespace); err != nil {
+					gotErr = err
+					logger.L().Ctx(ctx).Error("ApplicationProfileManager - failed to create application profile", helpers.Error(err))
+				}
+			} else {
+				gotErr = err
+				logger.L().Ctx(ctx).Error("ApplicationProfileManager - failed to patch application profile", helpers.Error(err))
+			}
 		}
-		if err := am.storageClient.CreateApplicationProfileSummary(summary, namespace); err != nil {
-			logger.L().Ctx(ctx).Error("ApplicationProfileManager - failed to save application profile summary", helpers.Error(err))
+		if gotErr != nil {
+			// restore execMap entries
+			execMap.Range(func(k string, v mapset.Set[string]) bool {
+				if newExecMap.Has(k) {
+					newExecMap.Get(k).Append(v.ToSlice()...)
+				} else {
+					newExecMap.Set(k, v)
+				}
+				return true
+			})
+			// restore openMap entries
+			openMap.Range(func(k string, v mapset.Set[string]) bool {
+				if newOpenMap.Has(k) {
+					newOpenMap.Get(k).Append(v.ToSlice()...)
+				} else {
+					newOpenMap.Set(k, v)
+				}
+				return true
+			})
+		} else {
+			am.savedCapabilities.Set(watchedContainer.K8sContainerID, len(observedCapabilities))
+			logger.L().Debug("ApplicationProfileManager - saved application profile", helpers.String("slug", slug), helpers.String("container ID", watchedContainer.ContainerID), helpers.String("k8s workload", watchedContainer.K8sContainerID))
+			// profile summary
+			summary := &v1beta1.ApplicationProfileSummary{
+				ObjectMeta: newProfile.ObjectMeta,
+			}
+			if err := am.storageClient.CreateApplicationProfileSummary(summary, namespace); err != nil {
+				logger.L().Ctx(ctx).Error("ApplicationProfileManager - failed to save application profile summary", helpers.Error(err))
+			}
 		}
 	}
 }

pkg/applicationprofilemanager/v1/applicationprofile_manager_test.go

@@ -19,7 +19,7 @@ func TestApplicationProfileManager(t *testing.T) {
 	cfg := config.Config{
 		InitialDelay:     1 * time.Second,
 		MaxSniffingTime:  5 * time.Minute,
-		UpdateDataPeriod: 20 * time.Second,
+		UpdateDataPeriod: 1 * time.Second,
 	}
 	ctx := context.TODO()
 	k8sClient := &k8sclient.K8sClientMock{}
@@ -59,6 +59,10 @@ func TestApplicationProfileManager(t *testing.T) {
 	})
 	// let it run for a while
 	time.Sleep(12 * time.Second) // need to sleep longer because of AddRandomDuration in startApplicationProfiling
+	// report another file open
+	go am.ReportFileOpen("ns/pod/cont", "/etc/hosts", []string{"O_RDONLY"})
+	// sleep more
+	time.Sleep(1 * time.Second)
 	// report container stopped
 	am.ContainerCallback(containercollection.PubSubEvent{
 		Type:      containercollection.EventTypeRemoveContainer,
@@ -67,13 +71,19 @@ func TestApplicationProfileManager(t *testing.T) {
 	// let it stop
 	time.Sleep(1 * time.Second)
 	// verify generated CRDs
-	assert.Equal(t, 2, len(storageClient.ApplicationActivities))
+	assert.Equal(t, 1, len(storageClient.ApplicationActivities))
 	sort.Strings(storageClient.ApplicationActivities[0].Spec.Syscalls)
-	assert.Equal(t, []string{"dup", "listen", "open"}, storageClient.ApplicationActivities[0].Spec.Syscalls)
+	assert.Equal(t, []string{"dup", "listen"}, storageClient.ApplicationActivities[0].Spec.Syscalls)
 	assert.Equal(t, 2, len(storageClient.ApplicationProfiles))
+	assert.Equal(t, 2, len(storageClient.ApplicationProfileSummaries))
+	// check the first profile
 	sort.Strings(storageClient.ApplicationProfiles[0].Spec.Containers[0].Capabilities)
-	assert.Equal(t, []string{"NET_BIND_SERVICE", "NET_BROADCAST"}, storageClient.ApplicationProfiles[0].Spec.Containers[1].Capabilities)
+	assert.Equal(t, []string{"NET_BIND_SERVICE"}, storageClient.ApplicationProfiles[0].Spec.Containers[1].Capabilities)
 	assert.Equal(t, []v1beta1.ExecCalls{{Path: "/bin/bash", Args: []string{"-c", "ls"}, Envs: []string(nil)}}, storageClient.ApplicationProfiles[0].Spec.Containers[1].Execs)
 	assert.Equal(t, []v1beta1.OpenCalls{{Path: "/etc/passwd", Flags: []string{"O_RDONLY"}}}, storageClient.ApplicationProfiles[0].Spec.Containers[1].Opens)
-	assert.Equal(t, 2, len(storageClient.ApplicationProfileSummaries))
+	// check the second profile - this is a patch for execs and opens
+	sort.Strings(storageClient.ApplicationProfiles[1].Spec.Containers[0].Capabilities)
+	assert.Equal(t, []string{"NET_BIND_SERVICE"}, storageClient.ApplicationProfiles[1].Spec.Containers[1].Capabilities)
+	assert.Equal(t, []v1beta1.ExecCalls{}, storageClient.ApplicationProfiles[1].Spec.Containers[1].Execs)
+	assert.Equal(t, []v1beta1.OpenCalls{{Path: "/etc/hosts", Flags: []string{"O_RDONLY"}}}, storageClient.ApplicationProfiles[1].Spec.Containers[1].Opens)
 }

pkg/storage/storage_interface.go

@@ -8,6 +8,7 @@ type StorageClient interface {
 	CreateApplicationActivity(activity *v1beta1.ApplicationActivity, namespace string) error
 	GetApplicationActivity(namespace, name string) (*v1beta1.ApplicationActivity, error)
 	CreateApplicationProfile(profile *v1beta1.ApplicationProfile, namespace string) error
+	PatchApplicationProfile(name, namespace string, profile *v1beta1.ApplicationProfile) error
 	GetApplicationProfile(namespace, name string) (*v1beta1.ApplicationProfile, error)
 	CreateApplicationProfileSummary(profile *v1beta1.ApplicationProfileSummary, namespace string) error
 	CreateFilteredSBOM(SBOM *v1beta1.SBOMSyftFiltered) error

pkg/storage/storage_mock.go

@@ -3,6 +3,7 @@ package storage
 import (
 	"encoding/json"
 	"errors"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"node-agent/pkg/utils"
 	"os"
 	"path"
@@ -26,6 +27,7 @@ type StorageHttpClientMock struct {
 	ImageCounters               map[string]int
 	nginxSBOMSpdxBytes          *spdxv1beta1.SBOMSPDXv2p3
 	mockSBOM                    *v1beta1.SBOMSyft
+	failedOnce                  bool
 }
 
 func (sc *StorageHttpClientMock) GetApplicationActivity(_, _ string) (*spdxv1beta1.ApplicationActivity, error) {
@@ -80,6 +82,18 @@ func (sc *StorageHttpClientMock) CreateApplicationActivity(activity *spdxv1beta1
 }
 
 func (sc *StorageHttpClientMock) CreateApplicationProfile(profile *spdxv1beta1.ApplicationProfile, _ string) error {
+	if !sc.failedOnce {
+		sc.failedOnce = true
+		return errors.New("first time fail")
+	}
+	sc.ApplicationProfiles = append(sc.ApplicationProfiles, profile)
+	return nil
+}
+
+func (sc *StorageHttpClientMock) PatchApplicationProfile(name, namespace string, profile *spdxv1beta1.ApplicationProfile) error {
+	if len(sc.ApplicationProfiles) == 0 {
+		return apierrors.NewNotFound(v1beta1.Resource("applicationprofile"), name)
+	}
 	sc.ApplicationProfiles = append(sc.ApplicationProfiles, profile)
 	return nil
 }

pkg/storage/v1/storage_nocache.go

@@ -110,6 +110,18 @@ func (sc StorageNoCache) CreateApplicationProfile(profile *v1beta1.ApplicationPr
 	return nil
 }
 
+func (sc StorageNoCache) PatchApplicationProfile(name, namespace string, profile *v1beta1.ApplicationProfile) error {
+	bytes, err := json.Marshal(profile)
+	if err != nil {
+		return fmt.Errorf("marshal neighbors: %w", err)
+	}
+	_, err = sc.StorageClient.ApplicationProfiles(namespace).Patch(context.Background(), name, types.StrategicMergePatchType, bytes, metav1.PatchOptions{})
+	if err != nil {
+		return fmt.Errorf("patch neighbors: %w", err)
+	}
+	return nil
+}
+
 func (sc StorageNoCache) GetApplicationProfile(namespace, name string) (*v1beta1.ApplicationProfile, error) {
 	return sc.StorageClient.ApplicationProfiles(namespace).Get(context.Background(), name, metav1.GetOptions{})
 }