Skip to content

Commit 8bcea2e

Browse files
snir911snir911
authored
Merge pull request #434 from snir911/agent_policyB
podvm: allow setting custom agent-policy
2 parents 6721043 + 63fa0f9 commit 8bcea2e

8 files changed

+155
-6
lines changed

‎config/peerpods/podvm/agent-policy/README.md

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# Kata Agent Policy
2+
3+
Agent Policy is a Kata Containers feature that enables the Guest VM to perform additional validation
4+
for each agent API request. A custom agent policy can be set either by a policy file provided at
5+
image creation time or through pod annotations.
6+
7+
## Set Policy At Image Creation
8+
9+
By default Openshift Sandboxed Container sets preconfigured policy, Peer-Pods images will be set with an
10+
allow-all policy while CoCo images will be set with an allow-all exept for the `ReadStreamRequest` and
11+
`ExecProcessRequest` calls.
12+
13+
To set custom policy at image creation time, make sure to encode the policy file (e.g.,
14+
[allow-all-except-exec-process.rego](allow-all-except-exec-process.rego)) in base64 format and set it as
15+
the value for the AGENT_POLICY key in your `<azure/aws-podvm>-image-cm` ConfigMap.
16+
17+
```sh
18+
ENCODED_POLICY=$(cat allow-all-except-exec-process.rego | base64 -w 0)
19+
kubectl patch cm aws-podvm-image-cm -p "{\"data\":{\"AGENT_POLICY\":\"${ENCODED_POLICY}\"}}" -n openshift-sandboxed-containers-operator
20+
```
21+
22+
## Set Policy Via Pod Annotation
23+
24+
As long as the `SetPolicyRequest` call was not disabled at image creation time, users set custom
25+
policy through annotation at pod creation time. To set policy through annotation, encode your policy
26+
file (e.g., [allow-all-except-exec-process.rego](allow-all-except-exec-process.rego)) in base64 format
27+
and set it to the `io.katacontainers.config.agent.policy` annotation.
28+
29+
**note:** annotation policy will override any previous policy (as long as `SetPolicyRequest` is allowed)
30+
31+
```sh
32+
ENCODED_POLICY=$(cat allow-all-except-exec-process.rego | base64 -w 0)
33+
cat <<-EOF | kubectl apply -f -
34+
apiVersion: v1
35+
kind: Pod
36+
metadata:
37+
name: sleep
38+
annotations:
39+
io.containerd.cri.runtime-handler: kata-remote
40+
io.katacontainers.config.agent.policy: ${ENCODED_POLICY}
41+
spec:
42+
runtimeClassName: kata-remote
43+
containers:
44+
- name: sleeping
45+
image: fedora
46+
command: ["sleep"]
47+
args: ["infinity"]
48+
EOF
49+
```
50+
51+
## Example Policies
52+
- [allow-all.rego](allow-all.rego)
53+
- [allow-all-except-exec-process.rego](allow-all-except-exec-process.rego)

‎config/peerpods/podvm/agent-policy/allow-all-except-exec-process.rego

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
package agent_policy
2+
3+
default AddARPNeighborsRequest := true
4+
default AddSwapRequest := true
5+
default CloseStdinRequest := true
6+
default CopyFileRequest := true
7+
default CreateContainerRequest := true
8+
default CreateSandboxRequest := true
9+
default DestroySandboxRequest := true
10+
default GetMetricsRequest := true
11+
default GetOOMEventRequest := true
12+
default GuestDetailsRequest := true
13+
default ListInterfacesRequest := true
14+
default ListRoutesRequest := true
15+
default MemHotplugByProbeRequest := true
16+
default OnlineCPUMemRequest := true
17+
default PauseContainerRequest := true
18+
default PullImageRequest := true
19+
default ReadStreamRequest := true
20+
default RemoveContainerRequest := true
21+
default RemoveStaleVirtiofsShareMountsRequest := true
22+
default ReseedRandomDevRequest := true
23+
default ResumeContainerRequest := true
24+
default SetGuestDateTimeRequest := true
25+
default SetPolicyRequest := true
26+
default SignalProcessRequest := true
27+
default StartContainerRequest := true
28+
default StartTracingRequest := true
29+
default StatsContainerRequest := true
30+
default StopTracingRequest := true
31+
default TtyWinResizeRequest := true
32+
default UpdateContainerRequest := true
33+
default UpdateEphemeralMountsRequest := true
34+
default UpdateInterfaceRequest := true
35+
default UpdateRoutesRequest := true
36+
default WaitProcessRequest := true
37+
default WriteStreamRequest := true
38+
39+
default ExecProcessRequest := false

‎config/peerpods/podvm/agent-policy/allow-all.rego

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
package agent_policy
2+
3+
default AddARPNeighborsRequest := true
4+
default AddSwapRequest := true
5+
default CloseStdinRequest := true
6+
default CopyFileRequest := true
7+
default CreateContainerRequest := true
8+
default CreateSandboxRequest := true
9+
default DestroySandboxRequest := true
10+
default ExecProcessRequest := true
11+
default GetMetricsRequest := true
12+
default GetOOMEventRequest := true
13+
default GuestDetailsRequest := true
14+
default ListInterfacesRequest := true
15+
default ListRoutesRequest := true
16+
default MemHotplugByProbeRequest := true
17+
default OnlineCPUMemRequest := true
18+
default PauseContainerRequest := true
19+
default PullImageRequest := true
20+
default ReadStreamRequest := true
21+
default RemoveContainerRequest := true
22+
default RemoveStaleVirtiofsShareMountsRequest := true
23+
default ReseedRandomDevRequest := true
24+
default ResumeContainerRequest := true
25+
default SetGuestDateTimeRequest := true
26+
default SetPolicyRequest := true
27+
default SignalProcessRequest := true
28+
default StartContainerRequest := true
29+
default StartTracingRequest := true
30+
default StatsContainerRequest := true
31+
default StopTracingRequest := true
32+
default TtyWinResizeRequest := true
33+
default UpdateContainerRequest := true
34+
default UpdateEphemeralMountsRequest := true
35+
default UpdateInterfaceRequest := true
36+
default UpdateRoutesRequest := true
37+
default WaitProcessRequest := true
38+
default WriteStreamRequest := true

‎config/peerpods/podvm/aws-podvm-image-cm.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,3 +33,6 @@ data:
3333
# NVIDIA GPU vars
3434
NVIDIA_DRIVER_VERSION: "535"
3535
NVIDIA_USERSPACE_VERSION: "1.13.5-1"
36+
37+
# Custom Agent Policy
38+
#AGENT_POLICY: "" # set to base64 encoded agent policy

‎config/peerpods/podvm/aws-podvm-image-handler.sh

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,8 @@
88
# Create image (-c)
99
# Delete image (-C)
1010

11-
set -x
11+
[[ "$DEBUG" == "true" ]] && set -x
12+
1213
# include common functions from lib.sh
1314
# shellcheck source=/dev/null
1415
# The directory is where aws-podvm-image-handler.sh is located

‎config/peerpods/podvm/azure-podvm-image-cm.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,3 +56,6 @@ data:
5656
# NVIDIA GPU vars
5757
NVIDIA_DRIVER_VERSION: "535"
5858
NVIDIA_USERSPACE_VERSION: "1.13.5-1"
59+
60+
# Custom Agent Policy
61+
#AGENT_POLICY: "" # set to base64 encoded agent policy

‎config/peerpods/podvm/azure-podvm-image-handler.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
# Create image version (-i)
2020
# Delete image version (-I)
2121

22-
set -x
22+
[[ "$DEBUG" == "true" ]] && set -x
2323

2424
# include common functions from lib.sh
2525
# shellcheck source=/dev/null

‎config/peerpods/podvm/lib.sh

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
#!/bin/bash
22
# Contains common functions used by the scripts
33

4-
set -x
4+
[[ "$DEBUG" == "true" ]] && set -x
55

66
# Defaults for pause image
77
# This pause image is multi-arch
@@ -205,11 +205,23 @@ function prepare_source_code() {
205205
error_exit "Failed to enable fips mode"
206206
fi
207207

208-
if [[ "$CONFIDENTIAL_COMPUTE_ENABLED" == "yes" ]]; then
209-
sed 's/default SetPolicyRequest := true/default SetPolicyRequest := false/; s/default ExecProcessRequest := true/default ExecProcessRequest := false/' \
208+
# links must be relative
209+
if [[ "${AGENT_POLICY}" ]]; then
210+
echo "Custom agent policy is being set through the AGENT_POLICY value"
211+
echo ${AGENT_POLICY} | base64 -d > "${podvm_dir}"/files/etc/kata-opa/custom.rego
212+
if [[ $? == 0 ]] && grep -q "agent_policy" "${podvm_dir}"/files/etc/kata-opa/custom.rego; then # checks policy validity
213+
ln -sf custom.rego "${podvm_dir}"/files/etc/kata-opa/default-policy.rego
214+
else
215+
error_exit "Invalid AGENT_POLICY value set, expected base64 encoded valid agent policy, got: \"${AGENT_POLICY}\""
216+
fi
217+
elif [[ "$CONFIDENTIAL_COMPUTE_ENABLED" == "yes" ]]; then
218+
echo "Setting custom agent policy to CoCo's recommended policy"
219+
sed 's/default ReadStreamRequest := true/default ReadStreamRequest := false/;
220+
s/default ExecProcessRequest := true/default ExecProcessRequest := false/' \
210221
"${podvm_dir}"/files/etc/kata-opa/default-policy.rego > "${podvm_dir}"/files/etc/kata-opa/coco-default-policy.rego
211-
ln -sf "${podvm_dir}"/files/etc/kata-opa/coco-default-policy.rego "${podvm_dir}"/files/etc/kata-opa/default-policy.rego
222+
ln -sf coco-default-policy.rego "${podvm_dir}"/files/etc/kata-opa/default-policy.rego
212223
fi
224+
echo "~~~ Current Agent Policy ~~~" && cat "${podvm_dir}"/files/etc/kata-opa/default-policy.rego
213225
}
214226

215227
# Download and extract pause container image

0 commit comments

Comments
 (0)