Skip to content

Commit 84ee7e5

Browse files
brandondbrandond
committed
Move hardening profile mode stuff into pkg/hardening/profile
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
1 parent f1454c5 commit 84ee7e5

7 files changed

Lines changed: 57 additions & 56 deletions

File tree

‎pkg/cli/cmds/profile_linux.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ import (
1111
"strings"
1212

1313
pkgerrors "github.com/pkg/errors"
14-
"github.com/rancher/rke2/pkg/rke2"
14+
"github.com/rancher/rke2/pkg/hardening/profile"
1515
"github.com/sirupsen/logrus"
1616
"github.com/urfave/cli/v2"
1717
)
@@ -115,20 +115,20 @@ func setCISFlags(clx *cli.Context) error {
115115

116116
func validateProfile(clx *cli.Context, role CLIRole) {
117117
switch clx.String("profile") {
118-
case rke2.ProfileCIS:
118+
case profile.ProfileNameCIS:
119119
if err := validateKernelReqs(role); err != nil {
120120
logrus.Fatal(err)
121121
}
122122
if err := setCISFlags(clx); err != nil {
123123
logrus.Fatal(err)
124124
}
125125
fallthrough // cis profile also requires etcd validation
126-
case rke2.ProfileETCD:
126+
case profile.ProfileNameETCD:
127127
if err := validateETCDReqs(role); err != nil {
128128
logrus.Fatal(err)
129129
}
130-
case "":
131-
logrus.Warn("not running in CIS mode")
130+
case profile.ProfileNameNone:
131+
logrus.Warn("not running with any hardening profile")
132132
default:
133133
logrus.Fatal("invalid value provided for --profile flag")
134134
}

‎pkg/executor/hosted/hosted.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ import (
1919
"github.com/rancher/rke2/pkg/auth"
2020
"github.com/rancher/rke2/pkg/bootstrap"
2121
"github.com/rancher/rke2/pkg/controllers"
22-
"github.com/rancher/rke2/pkg/executor/staticpod"
22+
"github.com/rancher/rke2/pkg/hardening/profile"
2323
"github.com/rancher/rke2/pkg/podtemplate"
2424
"github.com/rancher/wrangler/v3/pkg/apply"
2525
"github.com/rancher/wrangler/v3/pkg/leader"
@@ -47,7 +47,7 @@ type HostedConfig struct {
4747
AuditPolicyFile string
4848
PSAConfigFile string
4949

50-
ProfileMode staticpod.ProfileMode
50+
ProfileMode profile.Mode
5151
KubeConfig string
5252
Name string
5353
Domain string
@@ -149,7 +149,7 @@ func (h *HostedConfig) APIServer(ctx context.Context, args []string) error {
149149
args = append([]string{"--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname"}, args...)
150150
}
151151

152-
if h.ProfileMode == staticpod.ProfileModeETCD && h.AuditPolicyFile == "" {
152+
if h.ProfileMode.IsCISMode() && h.AuditPolicyFile == "" {
153153
h.AuditPolicyFile = podtemplate.DefaultAuditPolicyFile
154154
}
155155

‎pkg/executor/staticpod/spw.go‎

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -25,22 +25,6 @@ const (
2525
ContainerdSock = "/run/k3s/containerd/containerd.sock"
2626
)
2727

28-
type ProfileMode int
29-
30-
const (
31-
ProfileModeNone ProfileMode = iota
32-
ProfileModeCIS
33-
ProfileModeETCD
34-
)
35-
36-
func (c ProfileMode) isAnyMode() bool {
37-
return c != ProfileModeNone
38-
}
39-
40-
func (c ProfileMode) isCISMode() bool {
41-
return c == ProfileModeCIS
42-
}
43-
4428
type containerInfo struct {
4529
Config *runtimeapi.ContainerConfig `json:"config,omitempty"`
4630
}

‎pkg/executor/staticpod/staticpod.go‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ import (
3232
pkgerrors "github.com/pkg/errors"
3333
"github.com/rancher/rke2/pkg/auth"
3434
"github.com/rancher/rke2/pkg/bootstrap"
35+
"github.com/rancher/rke2/pkg/hardening/profile"
3536
"github.com/rancher/rke2/pkg/images"
3637
"github.com/rancher/rke2/pkg/logging"
3738
"github.com/rancher/rke2/pkg/podtemplate"
@@ -56,7 +57,7 @@ type StaticPodConfig struct {
5657
AuditPolicyFile string
5758
PSAConfigFile string
5859
KubeletPath string
59-
ProfileMode ProfileMode
60+
ProfileMode profile.Mode
6061
DisableETCD bool
6162
ExternalDatabase bool
6263
IsServer bool
@@ -215,7 +216,7 @@ func (s *StaticPodConfig) APIServer(_ context.Context, args []string) error {
215216
args = append([]string{"--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname"}, args...)
216217
}
217218

218-
if s.ProfileMode.isCISMode() && s.AuditPolicyFile == "" {
219+
if s.ProfileMode.IsCISMode() && s.AuditPolicyFile == "" {
219220
s.AuditPolicyFile = podtemplate.DefaultAuditPolicyFile
220221
}
221222

@@ -420,7 +421,7 @@ func (s *StaticPodConfig) ETCD(ctx context.Context, args *executor.ETCDConfig, e
420421
}
421422
podSpec.HostNetwork = true
422423

423-
if s.ProfileMode.isAnyMode() {
424+
if s.ProfileMode.IsAnyMode() {
424425
etcdUser, err := user.Lookup("etcd")
425426
if err != nil {
426427
return err
@@ -609,7 +610,7 @@ func (s *StaticPodConfig) writeTemplate(spec *podtemplate.Spec) error {
609610
if err != nil {
610611
return err
611612
}
612-
if s.ProfileMode.isAnyMode() {
613+
if s.ProfileMode.IsAnyMode() {
613614
return writeFile(manifestPath, b, 0600)
614615
}
615616
return writeFile(manifestPath, b, 0644)

‎pkg/hardening/profile/profile.go‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
package profile
2+
3+
const (
4+
// Valid hardening profile names
5+
ProfileNameNone = ""
6+
ProfileNameCIS = "cis"
7+
ProfileNameETCD = "etcd"
8+
9+
ModeNone Mode = iota
10+
ModeCIS
11+
ModeETCD
12+
)
13+
14+
type Mode int
15+
16+
func (m Mode) IsAnyMode() bool {
17+
return m != ModeNone
18+
}
19+
20+
func (m Mode) IsCISMode() bool {
21+
return m == ModeCIS
22+
}
23+
24+
func FromString(profileName string) Mode {
25+
switch profileName {
26+
case ProfileNameCIS:
27+
return ModeCIS
28+
case ProfileNameETCD:
29+
return ModeETCD
30+
default:
31+
return ModeNone
32+
}
33+
}

‎pkg/rke2/rke2.go‎

Lines changed: 2 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -18,19 +18,13 @@ import (
1818
rke2cli "github.com/rancher/rke2/pkg/cli"
1919
"github.com/rancher/rke2/pkg/controllers"
2020
"github.com/rancher/rke2/pkg/controllers/cisnetworkpolicy"
21-
"github.com/rancher/rke2/pkg/executor/staticpod"
21+
"github.com/rancher/rke2/pkg/hardening/profile"
2222
"github.com/rancher/wrangler/v3/pkg/slice"
2323
"github.com/sirupsen/logrus"
2424
"github.com/urfave/cli/v2"
2525
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2626
)
2727

28-
// Valid CIS Profile versions
29-
const (
30-
ProfileCIS = "cis"
31-
ProfileETCD = "etcd"
32-
)
33-
3428
func Server(clx *cli.Context, cfg rke2cli.Config) error {
3529
serverControllers, err := setup(clx, cfg, true)
3630
if err != nil {
@@ -53,7 +47,7 @@ func Server(clx *cli.Context, cfg rke2cli.Config) error {
5347
return err
5448
}
5549
}
56-
cisMode := isCISMode(clx)
50+
cisMode := profile.FromString(clx.String("profile")).IsCISMode()
5751
defaultNamespaces := []string{
5852
metav1.NamespaceSystem,
5953
metav1.NamespaceDefault,
@@ -125,22 +119,6 @@ func etcdNameFile(dataDir string) string {
125119
return filepath.Join(dataDir, "server", "db", "etcd", "name")
126120
}
127121

128-
func isCISMode(clx *cli.Context) bool {
129-
profile := clx.String("profile")
130-
return profile == ProfileCIS
131-
}
132-
133-
func profileMode(clx *cli.Context) staticpod.ProfileMode {
134-
switch clx.String("profile") {
135-
case ProfileCIS:
136-
return staticpod.ProfileModeCIS
137-
case ProfileETCD:
138-
return staticpod.ProfileModeETCD
139-
default:
140-
return staticpod.ProfileModeNone
141-
}
142-
}
143-
144122
func hostnameFromMetadataEndpoint(ctx context.Context) string {
145123
var token string
146124

‎pkg/rke2/rke2_linux.go‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ import (
2727
"github.com/rancher/rke2/pkg/cli/defaults"
2828
"github.com/rancher/rke2/pkg/executor/hosted"
2929
"github.com/rancher/rke2/pkg/executor/staticpod"
30+
"github.com/rancher/rke2/pkg/hardening/profile"
3031
"github.com/rancher/rke2/pkg/podtemplate"
3132
"github.com/sirupsen/logrus"
3233
"github.com/urfave/cli/v2"
@@ -89,10 +90,12 @@ func initHostedExecutor(clx *cli.Context, cfg rke2cli.Config) (executor.Executor
8990
return nil, pkgerrors.WithMessage(err, "failed to parse pod template config")
9091
}
9192

93+
profileMode := profile.FromString(clx.String("profile"))
94+
9295
// Adding PSAs
9396
podSecurityConfigFile := clx.String("pod-security-admission-config-file")
9497
if podSecurityConfigFile == "" {
95-
if err := setPSAs(isCISMode(clx)); err != nil {
98+
if err := setPSAs(profileMode.IsCISMode()); err != nil {
9699
return nil, err
97100
}
98101
podSecurityConfigFile = defaultPSAConfigFile
@@ -112,7 +115,7 @@ func initHostedExecutor(clx *cli.Context, cfg rke2cli.Config) (executor.Executor
112115
Config: *templateConfig,
113116
Name: clusterName,
114117
Domain: domain,
115-
ProfileMode: profileMode(clx),
118+
ProfileMode: profileMode,
116119
KubeConfig: os.Getenv("KUBECONFIG"),
117120
AuditPolicyFile: clx.String("audit-policy-file"),
118121
PSAConfigFile: podSecurityConfigFile,
@@ -220,10 +223,12 @@ func initStaticPodExecutor(clx *cli.Context, cfg rke2cli.Config, isServer bool)
220223
return nil, pkgerrors.WithMessage(err, "failed to parse pod template config")
221224
}
222225

226+
profileMode := profile.FromString(clx.String("profile"))
227+
223228
// Adding PSAs
224229
podSecurityConfigFile := clx.String("pod-security-admission-config-file")
225230
if podSecurityConfigFile == "" {
226-
if err := setPSAs(isCISMode(clx)); err != nil {
231+
if err := setPSAs(profileMode.IsCISMode()); err != nil {
227232
return nil, err
228233
}
229234
podSecurityConfigFile = defaultPSAConfigFile
@@ -254,7 +259,7 @@ func initStaticPodExecutor(clx *cli.Context, cfg rke2cli.Config, isServer bool)
254259
return &staticpod.StaticPodConfig{
255260
Config: *templateConfig,
256261
ManifestsDir: agentManifestsDir,
257-
ProfileMode: profileMode(clx),
262+
ProfileMode: profileMode,
258263
CloudProvider: cpConfig,
259264
AuditPolicyFile: clx.String("audit-policy-file"),
260265
PSAConfigFile: podSecurityConfigFile,

0 commit comments

Comments
 (0)