Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[RS-1843] DPI Snort rules configurable via intrusiondetection CR. #3488

Merged
merged 17 commits into from
Sep 10, 2024
Merged

[RS-1843] DPI Snort rules configurable via intrusiondetection CR. #3488

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
0f817fe
intrusion detection crd changes.
bartolini Sep 4, 2024
9897dbe
snort init container - operator machinery.
bartolini Sep 4, 2024
3429820
mistakes were made.
bartolini Sep 4, 2024
d354bb3
non-initialized list fix.
bartolini Sep 4, 2024
975b2cb
accidentally removed comment reinstantiated.
bartolini Sep 4, 2024
feaf445
PR comment - requested changes.
bartolini Sep 6, 2024
7b29210
removed unused constant.
bartolini Sep 6, 2024
9dc3ecf
dpi snort init container unit tests.
bartolini Sep 9, 2024
9adb213
missed assertions.
bartolini Sep 9, 2024
0b94815
Update api/v1/intrusiondetection_types.go
bartolini Sep 10, 2024
73e16a2
Update api/v1/intrusiondetection_types.go
bartolini Sep 10, 2024
7c86557
more pr changes - comments.
bartolini Sep 10, 2024
41af422
requested pr change.
bartolini Sep 10, 2024
bef2c4f
reverted unit tests for dpi - to be moved into a new context.
bartolini Sep 10, 2024
4465397
unit tests as per code review request.
bartolini Sep 10, 2024
10b1b3d
dirty file.
bartolini Sep 10, 2024
57a2e51
please run.
bartolini Sep 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 43 additions & 0 deletions api/v1/intrusiondetection_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,49 @@ type IntrusionDetectionSpec struct {
// IntrusionDetectionControllerDeployment configures the IntrusionDetection Controller Deployment.
// +optional
IntrusionDetectionControllerDeployment *IntrusionDetectionControllerDeployment `json:"intrusionDetectionControllerDeployment,omitempty"`

// DeepPacketInspectionDaemonset configures the DPI Daemonset
// +optional
DeepPacketInspectionDaemonset *DeepPacketInspectionDaemonset `json:"deepPacketInspectionDaemonset,omitempty"`
}

type DeepPacketInspectionDaemonset struct {
bartolini marked this conversation as resolved.
Show resolved Hide resolved
// DPIDaemonsetSpec configures the DPI Daemonset
// +optional
Spec *DPIDaemonsetSpec `json:"spec,omitempty"`
}

type DPIDaemonsetSpec struct {
// Template specifies DPI Daemonset Template
// +optional
Template *DPIDaemonsetTemplate `json:"template,omitempty"`
}

type DPIDaemonsetTemplate struct {
// Spec specifies DPI Daemonset Template Spec
// +optional
Spec *DPIDaemonsetTemplateSpec `json:"spec,omitempty"`
}

type DPIDaemonsetTemplateSpec struct {
// List of DPI Daemonset Init containers definitions
// +kubebuilder:validation:MaxItems=1
InitContainers []DPIDaemonsetInitContainer `json:"initContainers,omitempty"`
}

type DPIDaemonsetInitContainer struct {
// Name is an enum that identifies the init container by its name.
// +kubebuilder:validation:Enum=snort-rules
Name string `json:"name"`
bartolini marked this conversation as resolved.
Show resolved Hide resolved

// Image name for the init container
Image string `json:"image"`
bartolini marked this conversation as resolved.
Show resolved Hide resolved

// Resources allows customization of limits and requests for compute resources such as cpu and memory.
// If specified, this overrides the init container's resources.
// If omitted, the default values will be used for the init container's resources.
// +optional
Resources *corev1.ResourceRequirements `json:"resources,omitempty"`
}

type AnomalyDetectionSpec struct {
Expand Down
107 changes: 107 additions & 0 deletions api/v1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

52 changes: 52 additions & 0 deletions pkg/crds/enterprise/crd.projectcalico.org_bgpfilters.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,19 @@ spec:
type: string
matchOperator:
type: string
prefixLength:
properties:
max:
format: int32
maximum: 32
minimum: 0
type: integer
min:
format: int32
maximum: 32
minimum: 0
type: integer
type: object
source:
type: string
required:
Expand All @@ -70,6 +83,19 @@ spec:
type: string
matchOperator:
type: string
prefixLength:
properties:
max:
format: int32
maximum: 128
minimum: 0
type: integer
min:
format: int32
maximum: 128
minimum: 0
type: integer
type: object
source:
type: string
required:
Expand All @@ -91,6 +117,19 @@ spec:
type: string
matchOperator:
type: string
prefixLength:
properties:
max:
format: int32
maximum: 32
minimum: 0
type: integer
min:
format: int32
maximum: 32
minimum: 0
type: integer
type: object
source:
type: string
required:
Expand All @@ -112,6 +151,19 @@ spec:
type: string
matchOperator:
type: string
prefixLength:
properties:
max:
format: int32
maximum: 128
minimum: 0
type: integer
min:
format: int32
maximum: 128
minimum: 0
type: integer
type: object
source:
type: string
required:
Expand Down
91 changes: 91 additions & 0 deletions pkg/crds/operator/operator.tigera.io_intrusiondetections.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,6 +119,97 @@ spec:
- resourceRequirements
type: object
type: array
deepPacketInspectionDaemonset:
description: DeepPacketInspectionDaemonset configures the DPI Daemonset
properties:
spec:
description: DPIDaemonsetSpec configures the DPI Daemonset
properties:
template:
description: Template specifies DPI Daemonset Template
properties:
spec:
description: Spec specifies DPI Daemonset Template Spec
properties:
initContainers:
description: List of DPI Daemonset Init containers
definitions
items:
properties:
image:
description: Image name for the init container
type: string
name:
description: Name is an enum that identifies
the init container by its name.
enum:
- snort-rules
type: string
resources:
description: |-
Resources allows customization of limits and requests for compute resources such as cpu and memory.
If specified, this overrides the init container's resources.
If omitted, the default values will be used for the init container's resources.
properties:
claims:
description: |-
Claims lists the names of resources, defined in spec.resourceClaims,
that are used by this container.
This is an alpha field and requires enabling the
DynamicResourceAllocation feature gate.
This field is immutable. It can only be set for containers.
items:
description: ResourceClaim references
one entry in PodSpec.ResourceClaims.
properties:
name:
description: |-
Name must match the name of one entry in pod.spec.resourceClaims of
the Pod where this field is used. It makes that resource available
inside a container.
type: string
required:
- name
type: object
type: array
x-kubernetes-list-map-keys:
- name
x-kubernetes-list-type: map
limits:
additionalProperties:
anyOf:
- type: integer
- type: string
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
x-kubernetes-int-or-string: true
description: |-
Limits describes the maximum amount of compute resources allowed.
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
type: object
requests:
additionalProperties:
anyOf:
- type: integer
- type: string
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
x-kubernetes-int-or-string: true
description: |-
Requests describes the minimum amount of compute resources required.
If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
otherwise to an implementation-defined value. Requests cannot exceed Limits.
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
type: object
type: object
required:
- image
- name
type: object
maxItems: 1
type: array
type: object
type: object
type: object
type: object
intrusionDetectionControllerDeployment:
description: IntrusionDetectionControllerDeployment configures the
IntrusionDetection Controller Deployment.
Expand Down
Loading
Loading