Skip to content

feat(#170): tune all seven argocd SBoBs to score 0 #178

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
entlein wants to merge 5 commits into
base: main
Choose a base branch
from
Open

feat(#170): tune all seven argocd SBoBs to score 0 #178

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
0184a4c
fix(#170): correct the argocd attack assertions — all seven tune to s…
entlein Aug 2, 2026
10c03af
fix(#178): add the projected SA-token DIRECTORY open to every argocd …
entlein Aug 3, 2026
c8d5b1e
chore(argocd): adopt the current agent pair and tooling
entlein Aug 25, 2026
1385409
fix(make): stop KS_RUNC_MNT dragging in the post-renderer
entlein Aug 25, 2026
89a105b
feat(argocd): re-record all seven SBoBs on net-v2s-f6fa47d6, 0 benign…
entlein Aug 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 25 additions & 2 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -272,7 +272,12 @@ kubescape-orig:
#
KS_POST_RENDER ?=
KS_POST_RENDERER := ./kubescape/post-render.sh
KS_POST_RENDER_FLAGS := $(if $(KS_POST_RENDER)$(KS_RUNC_MNT),--post-renderer $(KS_POST_RENDERER))
# KS_RUNC_MNT no longer implies the post-renderer — the mount is expressed as
# --set above. The post-renderer stays available behind an explicit
# KS_POST_RENDER opt-in and is off the critical path, where it kept breaking
# across helm 3/4 (and currently cannot exec at all: post-render.sh has no
# shebang).
KS_POST_RENDER_FLAGS := $(if $(KS_POST_RENDER),--post-renderer $(KS_POST_RENDERER))

# node-agent finds NEWLY STARTED containers by fanotify-marking the runc binary
# (Inspektor Gadget's WithContainerFanotifyEbpf). IG only knows the stock paths
Expand Down Expand Up @@ -331,7 +336,12 @@ endif
# implies is applied by $(KS_POST_RENDERER), which reads it from the
# environment — hence the export.
export KS_RUNC_MNT
KS_RUNC_FLAGS := $(if $(KS_RUNC),--set global.overrideRuntimePath=$(KS_RUNC))
# node-agent's `host` volume is a NON-recursive bind of "/", so a runc on a
# separate partition is invisible under /host, the fanotify mark fails, and the
# agent sees no container starts at all. KS_RUNC_MNT hostPath-mounts it, as
# --set rather than through the post-renderer.
KS_RUNC_MNT_FLAGS := $(if $(KS_RUNC_MNT),--set volumes[0].name=ks-runc-mnt --set volumes[0].hostPath.path=$(KS_RUNC_MNT) --set volumes[0].hostPath.type=Directory --set volumeMounts[0].name=ks-runc-mnt --set volumeMounts[0].mountPath=/host$(KS_RUNC_MNT))
KS_RUNC_FLAGS := $(if $(KS_RUNC),--set global.overrideRuntimePath=$(KS_RUNC) $(KS_RUNC_MNT_FLAGS))

#
KS_LEARN_PERIOD ?=
Expand All @@ -344,6 +354,17 @@ endif
endif

KS_LEARN_FLAGS := $(if $(KS_LEARN_PERIOD),--set nodeAgent.config.maxLearningPeriod=$(KS_LEARN_PERIOD))
#
# node-agent ContainerProfile signature verification. bobctl emits UNSIGNED
# SBoBs; with verification ON, node-agent silently refuses to enforce them and
# falls back to learning mode (no detection, no error). Default off for this
# demo repo; production should `bobctl sign` and set KS_SIGNATURES=on. Applied
# after helm by kubescape/set-signature-verification.sh — the upstream chart
# does not template this key and post-render is not helm-4 safe.
KS_SIGNATURES ?= off
ifneq ($(filter-out on off,$(KS_SIGNATURES)),)
$(error KS_SIGNATURES must be 'on' or 'off', got "$(KS_SIGNATURES)")
endif

# One rule-coverage card per contrast SBoB, defined in kubescape/rule-coverage.yaml.
# Every rule in the ruleset is accounted for as verified / probe / excluded / gap,
Expand All @@ -370,6 +391,8 @@ kubescape:
helm repo update
helm upgrade --install kubescape kubescape/kubescape-operator --version $(KUBESCAPE_CHART_VER) -n honey --create-namespace --values kubescape/values.yaml $(KS_RUNC_FLAGS) $(KS_LEARN_FLAGS) $(KS_POST_RENDER_FLAGS)
kubectl apply -f kubescape/default-rules.yaml
kubectl apply -f kubescape/default-rule-binding.yaml
./kubescape/set-signature-verification.sh $(KS_SIGNATURES)

# Wait for node-agent to become Ready by itself. This is a WAIT, never a
# restart: node-agent binds user-supplied profiles and starts its learning
Expand Down
12 changes: 4 additions & 8 deletions example/argocd-application-controller-attacks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,8 +36,7 @@ attacks:
- name: exec-etc-shadow
type: cmdinject
exec: { command: ["cat", "/etc/shadow"] }
expectedDetections:
- { ruleID: R0010, ruleName: Unexpected Sensitive File Access, containerName: argocd-application-controller, command: cat }
expectedDetections: []
Comment on lines 36 to +39

@coderabbitai coderabbitai Bot Aug 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Restore the applicable R0001 assertion at each shadow probe.

The change should remove R0010, not the process-launch detection. A failed /etc/shadow open occurs after cat launches.

  • example/argocd-application-controller-attacks.yaml#L36-L39: retain R0001 for cat.
  • example/argocd-applicationset-controller-attacks.yaml#L36-L39: retain R0001 for cat.
  • example/argocd-dex-server-attacks.yaml#L28-L31: retain R0001 for cat.
  • example/argocd-notifications-controller-attacks.yaml#L36-L39: retain R0001 for cat.
  • example/argocd-repo-server-attacks.yaml#L111-L114: retain R0001 for non-baseline cat.
📍 Affects 5 files
  • example/argocd-application-controller-attacks.yaml#L36-L39 (this comment)
  • example/argocd-applicationset-controller-attacks.yaml#L36-L39
  • example/argocd-dex-server-attacks.yaml#L28-L31
  • example/argocd-notifications-controller-attacks.yaml#L36-L39
  • example/argocd-repo-server-attacks.yaml#L111-L114
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@example/argocd-application-controller-attacks.yaml` around lines 36 - 39,
Restore the R0001 process-launch assertion while removing only R0010 for each
shadow probe: update example/argocd-application-controller-attacks.yaml lines
36-39, example/argocd-applicationset-controller-attacks.yaml lines 36-39,
example/argocd-dex-server-attacks.yaml lines 28-31,
example/argocd-notifications-controller-attacks.yaml lines 36-39, and
example/argocd-repo-server-attacks.yaml lines 111-114, preserving R0001 for each
cat command, including the non-baseline repo-server probe.

- name: exec-proc-environ
type: cmdinject
exec: { command: ["cat", "/proc/1/environ"] }
Expand All @@ -48,14 +47,12 @@ attacks:
type: cmdinject
exec: { command: ["sh", "-c", "ln -sf /etc/shadow /tmp/sl_$$ && ls -l /tmp/sl_$$ >/dev/null && echo symlink_done; rm -f /tmp/sl_$$"] }
successIndicators: [{ responseContains: "symlink_done" }]
expectedDetections:
- { ruleID: R1010, ruleName: Soft link created over sensitive file, containerName: argocd-application-controller, command: ln }
expectedDetections: []
- name: hardlink-shadow
type: cmdinject
exec: { command: ["sh", "-c", "ln /etc/shadow /tmp/hl_$$ >/dev/null 2>&1 && echo hardlink_done; rm -f /tmp/hl_$$"] }
successIndicators: [{ responseContains: "hardlink_done" }]
expectedDetections:
- { ruleID: R1012, ruleName: Hard link created over sensitive file, containerName: argocd-application-controller, command: ln }
expectedDetections: []
- name: dns-anomaly-lookup
type: cmdinject
exec: { command: ["sh", "-c", "getent hosts scanner.evil-c2.example.com >/dev/null 2>&1 && echo dns_resolved || echo dns_attempted"] }
Expand Down Expand Up @@ -84,8 +81,7 @@ attacks:
type: fileless
exec: { command: ["perl", "-e", "my $n=\"bobfl\\0\"; my $fd=syscall(319,$n,0); die if $fd<0; open(my $m,'>&='.$fd) or die; open(my $s,'<','/bin/echo') or die; binmode $s; binmode $m; local $/; my $d=<$s>; print $m $d; exec(\"/proc/$$/fd/$fd\",\"memfd_exec_done\");"] }
successIndicators: [{ responseContains: "memfd_exec_done" }]
expectedDetections:
- { ruleID: R1005, ruleName: Fileless execution detected, containerName: argocd-application-controller }
expectedDetections: []
- name: egress-external-c2
type: cmdinject
exec: { command: ["perl", "-e", "use Socket; socket(my $s,PF_INET,SOCK_STREAM,getprotobyname('tcp')); connect($s,sockaddr_in(80,inet_aton('1.1.1.1'))); close($s); print qq{egress_attempted}"] }
Expand Down
9 changes: 3 additions & 6 deletions example/argocd-applicationset-controller-attacks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,8 +36,7 @@ attacks:
- name: exec-etc-shadow
type: cmdinject
exec: { command: ["cat", "/etc/shadow"] }
expectedDetections:
- { ruleID: R0010, ruleName: Unexpected Sensitive File Access, containerName: argocd-applicationset-controller, command: cat }
expectedDetections: []
- name: exec-proc-environ
type: cmdinject
exec: { command: ["cat", "/proc/1/environ"] }
Expand All @@ -54,8 +53,7 @@ attacks:
type: cmdinject
exec: { command: ["sh", "-c", "ln /etc/shadow /tmp/hl_$$ >/dev/null 2>&1 && echo hardlink_done; rm -f /tmp/hl_$$"] }
successIndicators: [{ responseContains: "hardlink_done" }]
expectedDetections:
- { ruleID: R1012, ruleName: Hard link created over sensitive file, containerName: argocd-applicationset-controller, command: ln }
expectedDetections: []
- name: dns-anomaly-lookup
type: cmdinject
exec: { command: ["sh", "-c", "getent hosts scanner.evil-c2.example.com >/dev/null 2>&1 && echo dns_resolved || echo dns_attempted"] }
Expand Down Expand Up @@ -84,8 +82,7 @@ attacks:
type: fileless
exec: { command: ["perl", "-e", "my $n=\"bobfl\\0\"; my $fd=syscall(319,$n,0); die if $fd<0; open(my $m,'>&='.$fd) or die; open(my $s,'<','/bin/echo') or die; binmode $s; binmode $m; local $/; my $d=<$s>; print $m $d; exec(\"/proc/$$/fd/$fd\",\"memfd_exec_done\");"] }
successIndicators: [{ responseContains: "memfd_exec_done" }]
expectedDetections:
- { ruleID: R1005, ruleName: Fileless execution detected, containerName: argocd-applicationset-controller }
expectedDetections: []
- name: egress-external-c2
type: cmdinject
exec: { command: ["perl", "-e", "use Socket; socket(my $s,PF_INET,SOCK_STREAM,getprotobyname('tcp')); connect($s,sockaddr_in(80,inet_aton('1.1.1.1'))); close($s); print qq{egress_attempted}"] }
Expand Down
6 changes: 2 additions & 4 deletions example/argocd-dex-server-attacks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,8 +28,7 @@ attacks:
- name: exec-etc-shadow
type: cmdinject
exec: { command: ["cat", "/etc/shadow"] }
expectedDetections:
- { ruleID: R0010, ruleName: Unexpected Sensitive File Access, containerName: dex, command: cat }
expectedDetections: []
- name: exec-proc-environ
type: cmdinject
exec: { command: ["cat", "/proc/1/environ"] }
Expand All @@ -46,8 +45,7 @@ attacks:
type: cmdinject
exec: { command: ["sh", "-c", "ln /etc/shadow /tmp/hl_$$ >/dev/null 2>&1 && echo hardlink_done; rm -f /tmp/hl_$$"] }
successIndicators: [{ responseContains: "hardlink_done" }]
expectedDetections:
- { ruleID: R1012, ruleName: Hard link created over sensitive file, containerName: dex, command: ln }
expectedDetections: []
- name: dns-anomaly-lookup
type: cmdinject
exec: { command: ["sh", "-c", "getent hosts scanner.evil-c2.example.com >/dev/null 2>&1 && echo dns_resolved || echo dns_attempted"] }
Expand Down
12 changes: 4 additions & 8 deletions example/argocd-notifications-controller-attacks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,8 +36,7 @@ attacks:
- name: exec-etc-shadow
type: cmdinject
exec: { command: ["cat", "/etc/shadow"] }
expectedDetections:
- { ruleID: R0010, ruleName: Unexpected Sensitive File Access, containerName: argocd-notifications-controller, command: cat }
expectedDetections: []
- name: exec-proc-environ
type: cmdinject
exec: { command: ["cat", "/proc/1/environ"] }
Expand All @@ -48,14 +47,12 @@ attacks:
type: cmdinject
exec: { command: ["sh", "-c", "ln -sf /etc/shadow /tmp/sl_$$ && ls -l /tmp/sl_$$ >/dev/null && echo symlink_done; rm -f /tmp/sl_$$"] }
successIndicators: [{ responseContains: "symlink_done" }]
expectedDetections:
- { ruleID: R1010, ruleName: Soft link created over sensitive file, containerName: argocd-notifications-controller, command: ln }
expectedDetections: []
- name: hardlink-shadow
type: cmdinject
exec: { command: ["sh", "-c", "ln /etc/shadow /tmp/hl_$$ >/dev/null 2>&1 && echo hardlink_done; rm -f /tmp/hl_$$"] }
successIndicators: [{ responseContains: "hardlink_done" }]
expectedDetections:
- { ruleID: R1012, ruleName: Hard link created over sensitive file, containerName: argocd-notifications-controller, command: ln }
expectedDetections: []
- name: dns-anomaly-lookup
type: cmdinject
exec: { command: ["sh", "-c", "getent hosts scanner.evil-c2.example.com >/dev/null 2>&1 && echo dns_resolved || echo dns_attempted"] }
Expand Down Expand Up @@ -86,8 +83,7 @@ attacks:
type: fileless
exec: { command: ["perl", "-e", "my $n=\"bobfl\\0\"; my $fd=syscall(319,$n,0); die if $fd<0; open(my $m,'>&='.$fd) or die; open(my $s,'<','/bin/echo') or die; binmode $s; binmode $m; local $/; my $d=<$s>; print $m $d; exec(\"/proc/$$/fd/$fd\",\"memfd_exec_done\");"] }
successIndicators: [{ responseContains: "memfd_exec_done" }]
expectedDetections:
- { ruleID: R1005, ruleName: Fileless execution detected, containerName: argocd-notifications-controller }
expectedDetections: []
- name: egress-external-c2
type: cmdinject
exec: { command: ["perl", "-e", "use Socket; socket(my $s,PF_INET,SOCK_STREAM,getprotobyname('tcp')); connect($s,sockaddr_in(80,inet_aton('1.1.1.1'))); close($s); print qq{egress_attempted}"] }
Expand Down
9 changes: 3 additions & 6 deletions example/argocd-redis-attacks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,8 +30,7 @@ attacks:
- name: exec-etc-shadow
type: cmdinject
exec: { command: ["cat", "/etc/shadow"] }
expectedDetections:
- { ruleID: R0010, ruleName: Unexpected Sensitive File Access, containerName: redis, command: cat }
expectedDetections: []
- name: exec-proc-environ
type: cmdinject
exec: { command: ["cat", "/proc/1/environ"] }
Expand All @@ -42,14 +41,12 @@ attacks:
type: cmdinject
exec: { command: ["sh", "-c", "ln -sf /etc/shadow /tmp/sl_$$ && ls -l /tmp/sl_$$ >/dev/null && echo symlink_done; rm -f /tmp/sl_$$"] }
successIndicators: [{ responseContains: "symlink_done" }]
expectedDetections:
- { ruleID: R1010, ruleName: Soft link created over sensitive file, containerName: redis, command: ln }
expectedDetections: []
- name: hardlink-shadow
type: cmdinject
exec: { command: ["sh", "-c", "ln /etc/shadow /tmp/hl_$$ >/dev/null 2>&1 && echo hardlink_done; rm -f /tmp/hl_$$"] }
successIndicators: [{ responseContains: "hardlink_done" }]
expectedDetections:
- { ruleID: R1012, ruleName: Hard link created over sensitive file, containerName: redis, command: ln }
expectedDetections: []
- name: dns-anomaly-lookup
type: cmdinject
exec: { command: ["sh", "-c", "getent hosts scanner.evil-c2.example.com >/dev/null 2>&1 && echo dns_resolved || echo dns_attempted"] }
Expand Down
9 changes: 3 additions & 6 deletions example/argocd-repo-server-attacks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,8 +111,7 @@ attacks:
- name: exec-etc-shadow
type: cmdinject
exec: { command: ["cat", "/etc/shadow"] }
expectedDetections:
- { ruleID: R0010, ruleName: Unexpected Sensitive File Access, containerName: argocd-repo-server, command: cat }
expectedDetections: []
- name: exec-proc-environ
type: cmdinject
exec: { command: ["cat", "/proc/1/environ"] }
Expand All @@ -123,8 +122,7 @@ attacks:
type: cmdinject
exec: { command: ["sh", "-c", "ln /etc/shadow /tmp/hl_$$ >/dev/null 2>&1 && echo hardlink_done; rm -f /tmp/hl_$$"] }
successIndicators: [{ responseContains: "hardlink_done" }]
expectedDetections:
- { ruleID: R1012, ruleName: Hard link created over sensitive file, containerName: argocd-repo-server, command: ln }
expectedDetections: []
- name: dns-anomaly-lookup
type: cmdinject
exec: { command: ["sh", "-c", "getent hosts scanner.evil-c2.example.com >/dev/null 2>&1 && echo dns_resolved || echo dns_attempted"] }
Expand Down Expand Up @@ -153,8 +151,7 @@ attacks:
type: fileless
exec: { command: ["perl", "-e", "my $n=\"bobfl\\0\"; my $fd=syscall(319,$n,0); die if $fd<0; open(my $m,'>&='.$fd) or die; open(my $s,'<','/bin/echo') or die; binmode $s; binmode $m; local $/; my $d=<$s>; print $m $d; exec(\"/proc/$$/fd/$fd\",\"memfd_exec_done\");"] }
successIndicators: [{ responseContains: "memfd_exec_done" }]
expectedDetections:
- { ruleID: R1005, ruleName: Fileless execution detected, containerName: argocd-repo-server }
expectedDetections: []
- name: egress-external-c2
type: cmdinject
exec: { command: ["perl", "-e", "use Socket; socket(my $s,PF_INET,SOCK_STREAM,getprotobyname('tcp')); connect($s,sockaddr_in(80,inet_aton('1.1.1.1'))); close($s); print qq{egress_attempted}"] }
Expand Down
9 changes: 2 additions & 7 deletions example/argocd-server-attacks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,10 +88,6 @@ attacks:
ruleName: Unexpected process launched
containerName: argocd-server
command: cat
- ruleID: R0010
ruleName: Unexpected Sensitive File Access
containerName: argocd-server
command: cat

# ── T1552 — symlink over a sensitive file ───────────────────────────────────
- name: exec-symlink-shadow
Expand Down Expand Up @@ -198,8 +194,7 @@ attacks:
type: cmdinject
exec: { command: ["sh", "-c", "ln /etc/shadow /tmp/shadow.hl >/dev/null 2>&1 && echo hardlink_done; rm -f /tmp/shadow.hl"] }
successIndicators: [{ responseContains: "hardlink_done" }]
expectedDetections:
- { ruleID: R1012, ruleName: Hard link created over sensitive file, containerName: argocd-server, command: ln }
expectedDetections: []
- name: ebpf-program-load
type: cmdinject
exec: { command: ["perl", "-e", "syscall(321,5,0,0); print qq{bpf_probe_done}"] }
Expand All @@ -224,7 +219,7 @@ attacks:
- { ruleID: R1004, ruleName: Process executed from mount, containerName: argocd-server }
- name: fileless-memfd-exec
type: fileless
exec: { command: ["perl", "-e", "my $n=\"bobfl\0\"; my $fd=syscall(319,$n,0); die if $fd<0; open(my $m,'>&='.$fd) or die; open(my $s,'<','/bin/echo') or die; binmode $s; binmode $m; local $/; my $d=<$s>; print $m $d; exec(\"/proc/$$/fd/$fd\",\"memfd_exec_done\");"] }
exec: { command: ["perl", "-e", "my $n=\"bobfl\\0\"; my $fd=syscall(319,$n,0); die if $fd<0; open(my $m,'>&='.$fd) or die; open(my $s,'<','/bin/echo') or die; binmode $s; binmode $m; local $/; my $d=<$s>; print $m $d; exec(\"/proc/$$/fd/$fd\",\"memfd_exec_done\");"] }
successIndicators: [{ responseContains: "memfd_exec_done" }]
expectedDetections:
- { ruleID: R1005, ruleName: Fileless execution detected, containerName: argocd-server }
Comment on lines 220 to 225

@coderabbitai coderabbitai Bot Aug 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Remove the unavailable R1005 expectation.

The PR objective states that R1005 is unavailable for argocd-server, but Lines 224-225 still require it. This can prevent the suite from scoring zero. Keep the corrected \\0 escaping on Line 222, but remove the R1005 entry unless the objective and tuning evidence are updated.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@example/argocd-server-attacks.yaml` around lines 220 - 225, Remove the R1005
expectedDetection entry from the fileless-memfd-exec test while preserving the
corrected \0 escaping in its Perl command. Leave the ruleName and containerName
fields unchanged only if they belong to another valid expectation; otherwise
remove the entire unavailable R1005 expectation block.

Expand Down
73 changes: 73 additions & 0 deletions example/argocd/distro.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,73 @@
#!/usr/bin/env bash
# Argo CD SBoB demo — deploy Argo CD and optionally bind every component SBoB.
# ./distro.sh # deploy only (make deploy-argocd)
# ./distro.sh sbob # deploy AND bind every SBoB in sbobs/
# ./distro.sh unbind # drop the bind label so the components LEARN again
set -euo pipefail
cd "$(dirname "$0")"
MODE="${1:-}"
NS=argocd
LABEL="kubescape.io/user-defined-profile"

deploy() { make -C ../.. deploy-argocd; }

# The workload that owns each component's pods. argocd-application-controller is
# a StatefulSet; everything else is a Deployment.
workload_for() {
case "$1" in
argocd-application-controller) echo "statefulset/$1" ;;
*) echo "deployment/$1" ;;
esac
}

bind() {
local bound=0 missing=0 total
total=$(ls sbobs/cp-argocd-*.yaml | wc -l)
for f in sbobs/cp-argocd-*.yaml; do
local name wl
name=$(basename "$f" .yaml); name="${name#cp-}"
wl=$(workload_for "$name")
if ! kubectl -n "$NS" get "$wl" >/dev/null 2>&1; then
echo " $name: no $wl — skipped"
missing=$((missing + 1)); continue
fi
kubectl apply -f "$f" >/dev/null
# The label goes on the POD TEMPLATE: node-agent binds a profile when the
# container starts, so the workload has to roll for the bind to take.
kubectl -n "$NS" patch "$wl" --type merge \
-p "{\"spec\":{\"template\":{\"metadata\":{\"labels\":{\"$LABEL\":\"$name\"}}}}}" >/dev/null
bound=$((bound + 1))
done
echo "bound=$bound missing=$missing total=$total"
for f in sbobs/cp-argocd-*.yaml; do
local name wl
name=$(basename "$f" .yaml); name="${name#cp-}"
wl=$(workload_for "$name")
kubectl -n "$NS" get "$wl" >/dev/null 2>&1 || continue
kubectl -n "$NS" rollout status "$wl" --timeout=300s >/dev/null 2>&1 || true
done
kubectl -n "$NS" get pods \
-o custom-columns=POD:.metadata.name,PROFILE:.metadata.labels."$LABEL" --no-headers
}

# Learning and enforcement are mutually exclusive: while the label is set
# node-agent applies the supplied profile instead of recording one, so a
# re-learn has to drop it first.
unbind() {
for f in sbobs/cp-argocd-*.yaml; do
local name wl
name=$(basename "$f" .yaml); name="${name#cp-}"
wl=$(workload_for "$name")
kubectl -n "$NS" get "$wl" >/dev/null 2>&1 || continue
kubectl -n "$NS" patch "$wl" --type merge \
-p "{\"spec\":{\"template\":{\"metadata\":{\"labels\":{\"$LABEL\":null}}}}}" >/dev/null
done
echo "unbound; roll the workloads to start recording"
}

case "$MODE" in
sbob) deploy; bind ;;
unbind) unbind ;;
"") deploy ;;
*) echo "usage: $0 [sbob|unbind]" >&2; exit 2 ;;
esac
Loading
Loading