From 6f01f1b1a04bce9face25fca43b2e2570866089f Mon Sep 17 00:00:00 2001 From: Philip Schmid Date: Tue, 11 Jun 2024 18:34:12 +0200 Subject: [PATCH] Added automated Tetragon deployment in the example code Signed-off-by: Philip Schmid --- .gitignore | 2 ++ example/00-variables.tf | 37 +++++++++++++++++++++++++++++++++ example/04-tetragon-values.yaml | 10 +++++++++ example/04-tetragon.tf | 18 ++++++++++++++++ example/README.md | 7 +++++++ 5 files changed, 74 insertions(+) create mode 100644 example/04-tetragon-values.yaml create mode 100644 example/04-tetragon.tf diff --git a/.gitignore b/.gitignore index 78453ce..da13360 100644 --- a/.gitignore +++ b/.gitignore @@ -14,3 +14,5 @@ tf/ *.DS_Store* .timestamp test/conformance/env.tfvars +example/04-tetragon-values-override.yaml +example/tracingpolicies* \ No newline at end of file diff --git a/example/00-variables.tf b/example/00-variables.tf index edb43e6..4b8984e 100644 --- a/example/00-variables.tf +++ b/example/00-variables.tf @@ -134,3 +134,40 @@ variable "pre_cilium_install_script" { description = "A script to be run before installing Cilium." type = string } + +# Tetragon +variable "tetragon_namespace" { + default = "kube-system" + description = "The namespace in which to install Tetragon." + type = string +} + +variable "tetragon_helm_chart" { + default = "cilium/tetragon" + description = "The name of the Helm chart to use to install Tetragon. It is assumed that the Helm repository containing this chart has been added beforehand (e.g. using 'helm repo add')." + type = string +} + +variable "tetragon_helm_values_file_path" { + description = "The path to the file containing the values to use when installing Tetragon." + default = "04-tetragon-values.yaml" + type = string +} + +variable "tetragon_helm_values_override_file_path" { + default = "" + description = "The path to the file containing the values to use when installing Tetragon. These values will override the ones in 'tetragon_helm_values_file_path'." + type = string +} + +variable "tetragon_tracingpolicy_directory" { + description = "Path to the directory where TracingPolicy files are stored which should automatically be applied. The directory can contain one or multiple valid TracingPoliciy YAML files." + default = "" + type = string +} + +variable "tetragon_helm_version" { + description = "The version of the Tetragon Helm chart to install." + default = "1.1.0" + type = string +} \ No newline at end of file diff --git a/example/04-tetragon-values.yaml b/example/04-tetragon-values.yaml new file mode 100644 index 0000000..3068fdc --- /dev/null +++ b/example/04-tetragon-values.yaml @@ -0,0 +1,10 @@ +tetragon: + exportAllowList: |- + {"event_set":["PROCESS_EXEC", "PROCESS_EXIT", "PROCESS_KPROBE", "PROCESS_UPROBE", "PROCESS_TRACEPOINT"]} + enablePolicyFilter: true + enableProcessCred: true + enableProcessNs: true +export: + mode: stdout + filenames: + - tetragon.log \ No newline at end of file diff --git a/example/04-tetragon.tf b/example/04-tetragon.tf new file mode 100644 index 0000000..696e2d7 --- /dev/null +++ b/example/04-tetragon.tf @@ -0,0 +1,18 @@ +module "tetragon" { + source = "git::https://github.com/isovalent/terraform-k8s-tetragon.git?ref=pr/philip/conditional_tp_deployment" + + # Wait until Cilium CNI is done. + depends_on = [ + module.cilium + ] + + tetragon_helm_release_name = "tetragon" + tetragon_helm_values_file_path = var.tetragon_helm_values_file_path + tetragon_helm_version = var.tetragon_helm_version + tetragon_helm_chart = var.tetragon_helm_chart + tetragon_namespace = var.tetragon_namespace + path_to_kubeconfig_file = module.talos.path_to_kubeconfig_file + tetragon_helm_values_override_file_path = var.tetragon_helm_values_override_file_path + tetragon_tracingpolicy_directory = var.tetragon_tracingpolicy_directory + extra_provisioner_environment_variables = local.extra_provisioner_environment_variables +} \ No newline at end of file diff --git a/example/README.md b/example/README.md index 04603a6..7be2a0e 100644 --- a/example/README.md +++ b/example/README.md @@ -110,6 +110,7 @@ aws-delete-vpc -cluster-name |------|--------|---------| | [cilium](#module\_cilium) | git::https://github.com/isovalent/terraform-k8s-cilium.git | v1.6.3 | | [talos](#module\_talos) | ../ | n/a | +| [tetragon](#module\_tetragon) | git::https://github.com/isovalent/terraform-k8s-tetragon.git | pr/philip/conditional_tp_deployment | | [vpc](#module\_vpc) | git::https://github.com/isovalent/terraform-aws-vpc.git | v1.8 | ### Resources @@ -140,6 +141,12 @@ aws-delete-vpc -cluster-name | [service\_cidr](#input\_service\_cidr) | The CIDR to use for K8s Services | `string` | `"100.68.0.0/16"` | no | | [tags](#input\_tags) | The set of tags to place on the created resources. These will be merged with the default tags defined via local.tags in 00-locals.tf. | `map(string)` | 
{
  "platform": "talos",
  "usage": "cute"
}
| no | | [talos\_version](#input\_talos\_version) | Talos version to use for the cluster, if not set the newest Talos version. Check https://github.com/siderolabs/talos/releases for available releases. | `string` | `"v1.7.1"` | no | +| [tetragon\_helm\_chart](#input\_tetragon\_helm\_chart) | The name of the Helm chart to use to install Tetragon. It is assumed that the Helm repository containing this chart has been added beforehand (e.g. using 'helm repo add'). | `string` | `"cilium/tetragon"` | no | +| [tetragon\_helm\_values\_file\_path](#input\_tetragon\_helm\_values\_file\_path) | The path to the file containing the values to use when installing Tetragon. | `string` | `"04-tetragon-values.yaml"` | no | +| [tetragon\_helm\_values\_override\_file\_path](#input\_tetragon\_helm\_values\_override\_file\_path) | The path to the file containing the values to use when installing Tetragon. These values will override the ones in 'tetragon\_helm\_values\_file\_path'. | `string` | `""` | no | +| [tetragon\_helm\_version](#input\_tetragon\_helm\_version) | The version of the Tetragon Helm chart to install. | `string` | `"1.1.0"` | no | +| [tetragon\_namespace](#input\_tetragon\_namespace) | The namespace in which to install Tetragon. | `string` | `"kube-system"` | no | +| [tetragon\_tracingpolicy\_directory](#input\_tetragon\_tracingpolicy\_directory) | Path to the directory where TracingPolicy files are stored which should automatically be applied. The directory can contain one or multiple valid TracingPoliciy YAML files. | `string` | `""` | no | | [vpc\_cidr](#input\_vpc\_cidr) | The CIDR to use for the VPC. Currently it must be a /16 or /24. | `string` | `"10.0.0.0/16"` | no | | [worker\_groups](#input\_worker\_groups) | List of node worker node groups to create | 
list(object({
    name               = string
    instance_type      = optional(string, "m5.large")
    config_patch_files = optional(list(string), [])
    tags               = optional(map(string), {})
  }))
| 
[
  {
    "name": "default"
  }
]
| no |