Test/improvecomponenttest by entlein · Pull Request #747 · kubescape/node-agent

entlein · 2026-03-12T21:41:52Z

Overview

Signed-off-by: entlein <einentlein@gmail.com>

Signed-off-by: Duck <70207455+entlein@users.noreply.github.com>

Signed-off-by: entlein <einentlein@gmail.com>

testing if nodeagent ci runs against fork

* Strip unused SBOM fields to reduce object size by ~52% Signed-off-by: Ben <ben@armosec.io> Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * use fixed StripSBOM from storage v0.0.247 Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * bump github.com/goradd/maps v1.3.0 Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * Refactor DatasourceEvent methods to handle missing fields gracefully and improve logging Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * Simplify StructEvent methods by removing event type checks and improving consistency Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * Remove kskubemanager dependency and replace with kubemanager in tracer_factory Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * Improve logging for DatasourceEvent field access errors, fix error_raw type Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * Pass alert platform to RuleFailureCreator Update github.com/armosec/armoapi-go to v0.0.678. Pass AlertSourcePlatform to the constructor instead of hardcoding AlertSourcePlatformK8s. Set the value to AlertSourcePlatformK8sAgent. * Remove LocalManager.host parameter from gadget execution to fix host detection Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * fix http body parsing to respect Content-Length Signed-off-by: Yakir Oren <yakiroren@gmail.com> * Support for chunked Signed-off-by: Ben <ben@armosec.io> * Support for chunked also in response Signed-off-by: Ben <ben@armosec.io> * Don't log warning for missing proc enrichment in SyscallEventType DatasourceEvent methods Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * add NormalizePath to ensure IG paths are always full Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> # Conflicts: # pkg/utils/datasource_event.go # pkg/utils/struct_event.go * dont merge workflows Signed-off-by: croedig <croedig@users.noreply.github.com> * Bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 Bumps [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) from 1.39.0 to 1.40.0. - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.39.0...v1.40.0) --- updated-dependencies: - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.40.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * testing the component tests * Refactor DatasourceEvent methods to suppress invalid field length warnings Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * add buf_len field to HTTP gadget to fix ring buffer data bleed Signed-off-by: Yakir Oren <yakiroren@gmail.com> * add buf_len to TestHttpFields expected fields Signed-off-by: Yakir Oren <yakiroren@gmail.com> * add GetValidBuf edge case tests for buf_len handling Signed-off-by: Yakir Oren <yakiroren@gmail.com> * node-agent test auto trigger Signed-off-by: croedig <croedig@users.noreply.github.com> * node-agent test auto trigger Signed-off-by: croedig <croedig@users.noreply.github.com> * node-agent component tests need to wait for node-agent image to be built Signed-off-by: croedig <croedig@users.noreply.github.com> * go mod again... Signed-off-by: croedig <croedig@users.noreply.github.com> * go mod again... Signed-off-by: croedig <croedig@users.noreply.github.com> * go-- behave Signed-off-by: croedig <croedig@users.noreply.github.com> * still broken dependencies Signed-off-by: croedig <croedig@users.noreply.github.com> * aligning the component tests with CRDs and helm charts Signed-off-by: croedig <croedig@users.noreply.github.com> * there was a go module missing * driving me nuts * brute force Signed-off-by: croedig <croedig@users.noreply.github.com> * fixing the version clashes * maybe we will get this whole go mod replace thing working in this century --------- Signed-off-by: Ben <ben@armosec.io> Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> Signed-off-by: Yakir Oren <yakiroren@gmail.com> Signed-off-by: croedig <croedig@users.noreply.github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Ben <ben@armosec.io> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Matthias Bertschy <matthias.bertschy@gmail.com> Co-authored-by: Yakir Oren <yakiroren@gmail.com> Co-authored-by: croedig <croedig@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…nt tests Signed-off-by: entlein <einentlein@gmail.com>

Signed-off-by: entlein <einentlein@gmail.com>

Implement generic signing and verification framework for ApplicationProfiles and SeccompProfiles using ECDSA P-256 signatures compatible with cosign. Key features: - SignableProfile interface for extensible profile type support - Keyless signing support using OIDC identity providers - Key-based signing for offline/air-gapped environments - Signature storage in profile metadata.annotations - CLI tool (sign-profile) for signing and verifying profiles - Automatic verification in ApplicationProfileCache on profile load Core implementation: - pkg/signature/ package with ECDSA P-256 signing/verification - Profile adapters for ApplicationProfile and SeccompProfile - EnableProfileVerification config flag (default: false) - On verification failure: skip profile with warning (don't crash) Files: - pkg/signature/annotations.go, interface.go, sign.go, verify.go - pkg/signature/cosign_adapter.go, signer.go, verifier.go - pkg/signature/profiles/applicationprofile_adapter.go - pkg/signature/profiles/seccompprofile_adapter.go - cmd/sign-profile/main.go - pkg/config/config.go - add EnableProfileVerification flag - pkg/objectcache/applicationprofilecache/ - integrate verification at load time - docs/signing/README.md - comprehensive documentation Tests: - 15 signature package tests covering signing, verification, tampering detection - 5 adapter tests for ApplicationProfile and SeccompProfile adapters - All tests passing Co-authored-by: Cerebras Agent <193945191+isaact-cerebras@users.noreply.github.com> Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> Co-authored-by: Cerebras Agent <193945191+isaact-cerebras@users.noreply.github.com> Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>

Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>

* first step towards constanze working to understanding all the component tests Signed-off-by: entlein <einentlein@gmail.com> * fix malicious app test by local dns resolution Signed-off-by: entlein <einentlein@gmail.com> * revert tests Signed-off-by: entlein <einentlein@gmail.com> * testing user defined profile Signed-off-by: entlein <einentlein@gmail.com> * adding a latest tag to the build image workflow Signed-off-by: entlein <einentlein@gmail.com> * quick turnaround: run componenttest on latest Signed-off-by: entlein <einentlein@gmail.com> * adding absolute path tests to test 27 Signed-off-by: entlein <einentlein@gmail.com> * tests with correct storage tg Signed-off-by: entlein <einentlein@gmail.com> * adding absolute path tests to test 27 Signed-off-by: entlein <einentlein@gmail.com> * adding test failure summary Signed-off-by: entlein <einentlein@gmail.com> * nginx test Signed-off-by: entlein <einentlein@gmail.com> --------- Signed-off-by: entlein <einentlein@gmail.com>

Signed-off-by: entlein <einentlein@gmail.com>

Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>

* Strip unused SBOM fields to reduce object size by ~52% Signed-off-by: Ben <ben@armosec.io> Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * use fixed StripSBOM from storage v0.0.247 Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * bump github.com/goradd/maps v1.3.0 Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * Refactor DatasourceEvent methods to handle missing fields gracefully and improve logging Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * Simplify StructEvent methods by removing event type checks and improving consistency Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * Remove kskubemanager dependency and replace with kubemanager in tracer_factory Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * Improve logging for DatasourceEvent field access errors, fix error_raw type Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * Pass alert platform to RuleFailureCreator Update github.com/armosec/armoapi-go to v0.0.678. Pass AlertSourcePlatform to the constructor instead of hardcoding AlertSourcePlatformK8s. Set the value to AlertSourcePlatformK8sAgent. * Remove LocalManager.host parameter from gadget execution to fix host detection Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * fix http body parsing to respect Content-Length Signed-off-by: Yakir Oren <yakiroren@gmail.com> * Support for chunked Signed-off-by: Ben <ben@armosec.io> * Support for chunked also in response Signed-off-by: Ben <ben@armosec.io> * Don't log warning for missing proc enrichment in SyscallEventType DatasourceEvent methods Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * Bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 Bumps [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) from 1.39.0 to 1.40.0. - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.39.0...v1.40.0) --- updated-dependencies: - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.40.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * Refactor DatasourceEvent methods to suppress invalid field length warnings Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * Fix: Add ContainerID to virtual host container Ensure ready channel is closed only once Co-authored-by: Cerebras Agent <193945191+isaact-cerebras@users.noreply.github.com> Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * Skip containers with empty image name Return early when ContainerImageName is empty and log debug details including namespace, pod, container name, and container ID. Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * add buf_len field to HTTP gadget to fix ring buffer data bleed Signed-off-by: Yakir Oren <yakiroren@gmail.com> * add buf_len to TestHttpFields expected fields Signed-off-by: Yakir Oren <yakiroren@gmail.com> * add GetValidBuf edge case tests for buf_len handling Signed-off-by: Yakir Oren <yakiroren@gmail.com> * Set ContainerID for Host context before NodeName Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * Skip shared data wait for host containers in RuleManager Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * Refactor: Introduce IsHostContainer utility function and update checks in RuleManager and ContainerWatcher Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * Fix: Skip processing for host containers in ContainerCallback methods Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * Fix: Skip processing for host containers in network stream events Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * Fix: Use utils.HostContainerID for host container identification Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * Fix: Add AlertSourcePlatform to runtime alerts in http_exporter Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * Fix: Add AlertSourcePlatform parameter to InitExporters and update related functions Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * Fix: Skip processing profile metadata for host containers in creator.go Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * Fix: Ensure ready channel is closed and container entry is removed on errors and timeouts in lifecycle.go Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * Fix: Update armoapi-go dependency to v0.0.682 and refactor related imports Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * Fix: Normalize host container ID to nodeName in network stream handling Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> --------- Signed-off-by: Ben <ben@armosec.io> Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> Signed-off-by: Yakir Oren <yakiroren@gmail.com> Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: entlein <einentlein@gmail.com> Co-authored-by: Ben <ben@armosec.io> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Matthias Bertschy <matthias.bertschy@gmail.com> Co-authored-by: Yakir Oren <yakiroren@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Cerebras Agent <193945191+isaact-cerebras@users.noreply.github.com>

Signed-off-by: entlein <einentlein@gmail.com>

Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>

Signed-off-by: entlein <einentlein@gmail.com>

…omalies Signed-off-by: entlein <einentlein@gmail.com>

Signed-off-by: entlein <einentlein@gmail.com>

coderabbitai · 2026-03-12T21:42:01Z

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 1d95f08e-360c-474a-841d-15d62d38f38f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

📝 Coding Plan

Generate coding plan for human review comments

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Tip

CodeRabbit can use Trivy to scan for security misconfigurations and secrets in Infrastructure as Code files.

Add a .trivyignore file to your project to customize which findings Trivy reports.

entlein and others added 30 commits January 30, 2026 20:32

testing if nodeagent ci runs against fork

2ff0a8d

Signed-off-by: entlein <einentlein@gmail.com>

where is that unit test trigger

52af940

Signed-off-by: entlein <einentlein@gmail.com>

debug test workflow on fork

306782e

Signed-off-by: entlein <einentlein@gmail.com>

debug test workflow on fork

4e08946

Signed-off-by: entlein <einentlein@gmail.com>

debug test workflow on fork

4639e09

Signed-off-by: entlein <einentlein@gmail.com>

debug test workflow on fork

cd2ef91

Signed-off-by: entlein <einentlein@gmail.com>

apparently we need to rebuild the storage go module into node-agent

9316ab6

Signed-off-by: entlein <einentlein@gmail.com>

Uncomment component tests in workflow configuration

8e6a60c

Signed-off-by: Duck <70207455+entlein@users.noreply.github.com>

apparently we need to rebuild the storage go module into node-agent

8a33ce1

Signed-off-by: entlein <einentlein@gmail.com>

apparently we need to rebuild the storage go module into node-agent

ac13916

Signed-off-by: entlein <einentlein@gmail.com>

Merge pull request #1 from k8sstormcenter/test/localtestbuild

b25dea4

testing if nodeagent ci runs against fork

Merge branch 'kubescape:main' into main

9a82d0e

first step towards constanze working to understanding all the compone…

68c59de

…nt tests Signed-off-by: entlein <einentlein@gmail.com>

fix malicious app test by local dns resolution

3094368

Signed-off-by: entlein <einentlein@gmail.com>

revert tests

cbcf5bd

Signed-off-by: entlein <einentlein@gmail.com>

testing user defined profile

eca7bd6

Signed-off-by: entlein <einentlein@gmail.com>

adding a latest tag to the build image workflow

89db204

Signed-off-by: entlein <einentlein@gmail.com>

quick turnaround: run componenttest on latest

272231d

Signed-off-by: entlein <einentlein@gmail.com>

adding absolute path tests to test 27

ec9ff9d

Signed-off-by: entlein <einentlein@gmail.com>

addressing comments

0de39d2

Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>

review comments

85fa7e1

Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>

review comments

fb604bd

Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>

use cosign instead

93a27a0

Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>

final touches

63c7049

Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>

fix signature and verification to use canonical hash

1f752bd

Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>

update docs

c9e0936

Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>

fix signing with keys

966cc3a

Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>

fix hash calculation from cluster

f70da28

Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>

entlein and others added 25 commits March 11, 2026 20:41

user-defined-network test 1

73f14bb

Signed-off-by: entlein <einentlein@gmail.com>

forgot to switch the new test on

5ff4fdb

Signed-off-by: entlein <einentlein@gmail.com>

review comments

846f8ef

Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>

adding the user-provided-network

66fcf90

Signed-off-by: entlein <einentlein@gmail.com>

testing the user-defined-network

04fb5cf

Signed-off-by: entlein <einentlein@gmail.com>

use keys for signature tests, option for keyless

011e175

Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>

merge main

41380d9

Signed-off-by: entlein <einentlein@gmail.com>

more logging for new test

60321f8

Signed-off-by: entlein <einentlein@gmail.com>

curl instead of wget, as wget is not in the nginx image

26bd96b

Signed-off-by: entlein <einentlein@gmail.com>

and now we use the curl image, so that we have curl

064375b

Signed-off-by: entlein <einentlein@gmail.com>

restoringt test 27, independently learning dns for test 28

cd1320e

Signed-off-by: entlein <einentlein@gmail.com>

using profiles learnt from IRL

d495dc5

Signed-off-by: entlein <einentlein@gmail.com>

Test 27 : adding a more elaborate profile for wildcard opens

9d36f7f

Signed-off-by: entlein <einentlein@gmail.com>

Test 28: add nslookup to test, still not clear why we dont see DNS an…

00d27c3

…omalies Signed-off-by: entlein <einentlein@gmail.com>

Test 28: labels and annotations

02a2305

Signed-off-by: entlein <einentlein@gmail.com>

Test 28: annotations back

40c9d6b

Signed-off-by: entlein <einentlein@gmail.com>

Test 28: simplification

6ac9b76

Signed-off-by: entlein <einentlein@gmail.com>

need to switch ON the networkrules, they were off

55ca148

TEST 28 now adding DNS ,also switching on the rules helps trememdosly

a493ba8

need to wait until profile ready

07b185d

switching again to the curl image

3449829

waiting longer for alerts

7d513d8

Merge Sign PR from Matthias

da4184b

Signed-off-by: entlein <einentlein@gmail.com>

entlein closed this Mar 12, 2026

entlein deleted the test/improvecomponenttest branch March 12, 2026 21:57

matthyx mentioned this pull request Oct 27, 2026

feat(sandboxpolicy): add opt-in persistent exec enforcement #1054

Draft

AlonLiwsky mentioned this pull request Nov 5, 2026

feat(sandboxpolicy): report privilege, network and file verdicts to the exporter receivers #1080

Closed

Navigation Menu

Repository navigation

Test/improvecomponenttest - #747

Test/improvecomponenttest#747
entlein wants to merge 67 commits into
kubescape:mainfrom
k8sstormcenter:test/improvecomponenttest

entlein commented Mar 12, 2026

Uh oh!

coderabbitai Bot commented Mar 12, 2026

Review skipped

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

entlein commented Mar 12, 2026

Overview

Uh oh!

coderabbitai Bot commented Mar 12, 2026

Review skipped

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants