From b34f4f39e201602bfcf1c08b3ee58a3e0cb3af67 Mon Sep 17 00:00:00 2001 From: Kornilios Kourtis Date: Wed, 24 Jul 2024 12:16:38 +0200 Subject: [PATCH 1/4] rthooks: name final target release While tagging rthooks/v0.1, the GH action that builds the images failed with: Error: buildx failed with: ERROR: failed to solve: target stage "release" could not be found Rename the final taret to release to fix this. Signed-off-by: Kornilios Kourtis --- Dockerfile.rthooks | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile.rthooks b/Dockerfile.rthooks index 8b1d7288f63..2dfa272badb 100644 --- a/Dockerfile.rthooks +++ b/Dockerfile.rthooks @@ -21,7 +21,7 @@ RUN --mount=type=bind,readwrite,target=/go/src/github.com/cilium/tetragon \ && mv ./contrib/tetragon-rthooks/tetragon-oci-hook-setup /out/${TARGETOS}/${TARGETARCH}/usr/bin \ && mv ./contrib/tetragon-rthooks/tetragon-nri-hook /out/${TARGETOS}/${TARGETARCH}/usr/bin -FROM ${BASE_IMAGE} AS image +FROM ${BASE_IMAGE} AS release # TARGETOS is an automatic platform ARG enabled by Docker BuildKit. ARG TARGETOS # TARGETARCH is an automatic platform ARG enabled by Docker BuildKit. From 91170b21cefa9364eb634e9a586b5aad0699d96e Mon Sep 17 00:00:00 2001 From: Kornilios Kourtis Date: Wed, 24 Jul 2024 12:31:22 +0200 Subject: [PATCH 2/4] helm: whitespace fixes Signed-off-by: Kornilios Kourtis --- install/kubernetes/tetragon/templates/_container_rthooks.tpl | 2 +- install/kubernetes/tetragon/templates/rthooks-daemonset.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/install/kubernetes/tetragon/templates/_container_rthooks.tpl b/install/kubernetes/tetragon/templates/_container_rthooks.tpl index 7b36c8a0745..38d7f021e60 100644 --- a/install/kubernetes/tetragon/templates/_container_rthooks.tpl +++ b/install/kubernetes/tetragon/templates/_container_rthooks.tpl @@ -5,7 +5,7 @@ image: "{{ if .Values.rthooks.image.override }}{{ .Values.rthooks.image.override }}{{ else }}{{ .Values.rthooks.image.repository }}:{{ .Values.rthooks.image.tag }}{{ end }}" terminationMessagePolicy: FallbackToLogsOnError imagePullPolicy: {{ .Values.imagePullPolicy }} - command: + command: - tetragon-oci-hook-setup - install - --interface={{ include "rthooksInterface" . | required "rtooks.interface needs to be correctly defined" }} diff --git a/install/kubernetes/tetragon/templates/rthooks-daemonset.yaml b/install/kubernetes/tetragon/templates/rthooks-daemonset.yaml index 0714a9ce517..1a8c0a52052 100644 --- a/install/kubernetes/tetragon/templates/rthooks-daemonset.yaml +++ b/install/kubernetes/tetragon/templates/rthooks-daemonset.yaml @@ -6,7 +6,7 @@ metadata: annotations: {{- toYaml . | nindent 4 }} {{- end }} - labels: + labels: {{- include "tetragon-rthooks.labels" . | nindent 4 }} {{- with .Values.rthooks.extraLabels }} {{- toYaml . | nindent 4 }} From 9fe3079bbc686ffa6cf6514be39f3f507bcab8f4 Mon Sep 17 00:00:00 2001 From: Kornilios Kourtis Date: Wed, 24 Jul 2024 12:32:01 +0200 Subject: [PATCH 3/4] rthooks: update image to v0.2 The v0.1 tag failed to build, so let's move to the next. Signed-off-by: Kornilios Kourtis --- install/kubernetes/tetragon/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/install/kubernetes/tetragon/values.yaml b/install/kubernetes/tetragon/values.yaml index 381a8824b74..9bd2e99b5bb 100644 --- a/install/kubernetes/tetragon/values.yaml +++ b/install/kubernetes/tetragon/values.yaml @@ -384,4 +384,4 @@ rthooks: image: override: ~ repository: quay.io/cilium/tetragon-rthooks - tag: v0.1 + tag: v0.2 From 4a0e8dfca0875eeb0f2129f3f106a7bf5aaa2b9b Mon Sep 17 00:00:00 2001 From: Kornilios Kourtis Date: Wed, 24 Jul 2024 12:33:31 +0200 Subject: [PATCH 4/4] autochore: make -C install/kubernetes Signed-off-by: Kornilios Kourtis --- docs/content/en/docs/reference/helm-chart.md | 4 ++-- install/kubernetes/tetragon/README.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/content/en/docs/reference/helm-chart.md b/docs/content/en/docs/reference/helm-chart.md index 83923cea070..2ac2497c8ba 100644 --- a/docs/content/en/docs/reference/helm-chart.md +++ b/docs/content/en/docs/reference/helm-chart.md @@ -46,14 +46,14 @@ To use [the values available](#values), with `helm install` or `helm upgrade`, u | podLabelsOverride | object | `{}` | | | podSecurityContext | object | `{}` | | | priorityClassName | string | `""` | | -| rthooks | object | `{"annotations":{},"enabled":false,"extraHookArgs":{},"extraLabels":{},"extraVolumeMounts":[],"failAllowNamespaces":"","image":{"override":null,"repository":"quay.io/cilium/tetragon-rthooks","tag":"v0.1"},"installDir":"/opt/tetragon","interface":"","nriHook":{"nriSocket":"/var/run/nri/nri.sock"},"ociHooks":{"hooksPath":"/usr/share/containers/oci/hooks.d"},"podAnnotations":{},"priorityClassName":"","resources":{},"securityContext":{"privileged":true}}` | Method for installing Tetagon rthooks (tetragon-rthooks) daemonset The tetragon-rthooks daemonset is responsible for installing run-time hooks on the host. See: https://tetragon.io/docs/concepts/runtime-hooks | +| rthooks | object | `{"annotations":{},"enabled":false,"extraHookArgs":{},"extraLabels":{},"extraVolumeMounts":[],"failAllowNamespaces":"","image":{"override":null,"repository":"quay.io/cilium/tetragon-rthooks","tag":"v0.2"},"installDir":"/opt/tetragon","interface":"","nriHook":{"nriSocket":"/var/run/nri/nri.sock"},"ociHooks":{"hooksPath":"/usr/share/containers/oci/hooks.d"},"podAnnotations":{},"priorityClassName":"","resources":{},"securityContext":{"privileged":true}}` | Method for installing Tetagon rthooks (tetragon-rthooks) daemonset The tetragon-rthooks daemonset is responsible for installing run-time hooks on the host. See: https://tetragon.io/docs/concepts/runtime-hooks | | rthooks.annotations | object | `{}` | Annotations for the Tetragon rthooks daemonset | | rthooks.enabled | bool | `false` | Enable the Tetragon rthooks daemonset | | rthooks.extraHookArgs | object | `{}` | extra args to pass to tetragon-oci-hook | | rthooks.extraLabels | object | `{}` | Extra labels for the Tetrargon rthooks daemonset | | rthooks.extraVolumeMounts | list | `[]` | Extra volume mounts to add to the oci-hook-setup init container | | rthooks.failAllowNamespaces | string | `""` | Comma-separated list of namespaces to allow Pod creation for, in case tetragon-oci-hook fails to reach Tetragon agent. The namespace Tetragon is deployed in is always added as an exception and must not be added again. | -| rthooks.image | object | `{"override":null,"repository":"quay.io/cilium/tetragon-rthooks","tag":"v0.1"}` | image for the Tetragon rthooks pod | +| rthooks.image | object | `{"override":null,"repository":"quay.io/cilium/tetragon-rthooks","tag":"v0.2"}` | image for the Tetragon rthooks pod | | rthooks.installDir | string | `"/opt/tetragon"` | installDir is the host location where the tetragon-oci-hook binary will be installed | | rthooks.interface | string | `""` | Method to use for installing rthooks. Values: "oci-hooks": Add an apppriate file to "/usr/share/containers/oci/hooks.d". Use this with CRI-O. See https://github.com/containers/common/blob/main/pkg/hooks/docs/oci-hooks.5.md for more details. Specific configuration for this interface can be found under "OciHooks". "nri-hook": Install the hook via NRI. Use this with containerd. Requires NRI being enabled. see: https://github.com/containerd/containerd/blob/main/docs/NRI.md. | | rthooks.nriHook | object | `{"nriSocket":"/var/run/nri/nri.sock"}` | configuration for the "nri-hook" interface | diff --git a/install/kubernetes/tetragon/README.md b/install/kubernetes/tetragon/README.md index 6610ab68edf..96f37c5df4f 100644 --- a/install/kubernetes/tetragon/README.md +++ b/install/kubernetes/tetragon/README.md @@ -28,14 +28,14 @@ Helm chart for Tetragon | podLabelsOverride | object | `{}` | | | podSecurityContext | object | `{}` | | | priorityClassName | string | `""` | | -| rthooks | object | `{"annotations":{},"enabled":false,"extraHookArgs":{},"extraLabels":{},"extraVolumeMounts":[],"failAllowNamespaces":"","image":{"override":null,"repository":"quay.io/cilium/tetragon-rthooks","tag":"v0.1"},"installDir":"/opt/tetragon","interface":"","nriHook":{"nriSocket":"/var/run/nri/nri.sock"},"ociHooks":{"hooksPath":"/usr/share/containers/oci/hooks.d"},"podAnnotations":{},"priorityClassName":"","resources":{},"securityContext":{"privileged":true}}` | Method for installing Tetagon rthooks (tetragon-rthooks) daemonset The tetragon-rthooks daemonset is responsible for installing run-time hooks on the host. See: https://tetragon.io/docs/concepts/runtime-hooks | +| rthooks | object | `{"annotations":{},"enabled":false,"extraHookArgs":{},"extraLabels":{},"extraVolumeMounts":[],"failAllowNamespaces":"","image":{"override":null,"repository":"quay.io/cilium/tetragon-rthooks","tag":"v0.2"},"installDir":"/opt/tetragon","interface":"","nriHook":{"nriSocket":"/var/run/nri/nri.sock"},"ociHooks":{"hooksPath":"/usr/share/containers/oci/hooks.d"},"podAnnotations":{},"priorityClassName":"","resources":{},"securityContext":{"privileged":true}}` | Method for installing Tetagon rthooks (tetragon-rthooks) daemonset The tetragon-rthooks daemonset is responsible for installing run-time hooks on the host. See: https://tetragon.io/docs/concepts/runtime-hooks | | rthooks.annotations | object | `{}` | Annotations for the Tetragon rthooks daemonset | | rthooks.enabled | bool | `false` | Enable the Tetragon rthooks daemonset | | rthooks.extraHookArgs | object | `{}` | extra args to pass to tetragon-oci-hook | | rthooks.extraLabels | object | `{}` | Extra labels for the Tetrargon rthooks daemonset | | rthooks.extraVolumeMounts | list | `[]` | Extra volume mounts to add to the oci-hook-setup init container | | rthooks.failAllowNamespaces | string | `""` | Comma-separated list of namespaces to allow Pod creation for, in case tetragon-oci-hook fails to reach Tetragon agent. The namespace Tetragon is deployed in is always added as an exception and must not be added again. | -| rthooks.image | object | `{"override":null,"repository":"quay.io/cilium/tetragon-rthooks","tag":"v0.1"}` | image for the Tetragon rthooks pod | +| rthooks.image | object | `{"override":null,"repository":"quay.io/cilium/tetragon-rthooks","tag":"v0.2"}` | image for the Tetragon rthooks pod | | rthooks.installDir | string | `"/opt/tetragon"` | installDir is the host location where the tetragon-oci-hook binary will be installed | | rthooks.interface | string | `""` | Method to use for installing rthooks. Values: "oci-hooks": Add an apppriate file to "/usr/share/containers/oci/hooks.d". Use this with CRI-O. See https://github.com/containers/common/blob/main/pkg/hooks/docs/oci-hooks.5.md for more details. Specific configuration for this interface can be found under "OciHooks". "nri-hook": Install the hook via NRI. Use this with containerd. Requires NRI being enabled. see: https://github.com/containerd/containerd/blob/main/docs/NRI.md. | | rthooks.nriHook | object | `{"nriSocket":"/var/run/nri/nri.sock"}` | configuration for the "nri-hook" interface |