Skip to content

Commit 402168f

Browse files
mmetcmmetc
authored
fix #4066: don't prepare the hub in lapi-only containers (#4169)
1 parent a242362 commit 402168f

1 file changed

Lines changed: 107 additions & 92 deletions

File tree

‎build/docker/docker_start.sh‎

Lines changed: 107 additions & 92 deletions
Original file line numberDiff line numberDiff line change
@@ -181,26 +181,118 @@ cscli_if_clean() {
181181
# Output the difference between two lists
182182
# of items separated by spaces
183183
difference() {
184-
list1="$1"
185-
list2="$2"
186-
187-
# split into words
188-
# shellcheck disable=SC2086
189-
set -- $list1
190-
for item in "$@"; do
191-
found=false
192-
for i in $list2; do
193-
if [ "$item" = "$i" ]; then
194-
found=true
195-
break
196-
fi
184+
list1="$1"
185+
list2="$2"
186+
187+
# split into words
188+
# shellcheck disable=SC2086
189+
set -- $list1
190+
for item in "$@"; do
191+
found=false
192+
for i in $list2; do
193+
if [ "$item" = "$i" ]; then
194+
found=true
195+
break
196+
fi
197197
done
198+
198199
if [ "$found" = false ]; then
199-
echo "$item"
200+
echo "$item"
200201
fi
201202
done
202203
}
203204

205+
# prepare_hub updates/installs/removes Hub items based on env vars, but only when the agent is expected to run.
206+
# It exits early when the agent is disabled with DISABLE_AGENT or in the configuration.
207+
prepare_hub() {
208+
if istrue "$DISABLE_AGENT"; then
209+
return
210+
fi
211+
212+
if conf_get '.crowdsec_service ?= null or (.crowdsec_service.enable? == false)' >/dev/null 2>&1; then
213+
return
214+
fi
215+
216+
## Install hub items
217+
218+
run_hub_update_if_from_volume || true
219+
run_hub_upgrade_if_from_volume || true
220+
221+
cscli_if_clean parsers install crowdsecurity/docker-logs
222+
cscli_if_clean parsers install crowdsecurity/cri-logs
223+
224+
if [ "$COLLECTIONS" != "" ]; then
225+
# shellcheck disable=SC2086
226+
cscli_if_clean collections install "$(difference "$COLLECTIONS" "$DISABLE_COLLECTIONS")"
227+
fi
228+
229+
if [ "$PARSERS" != "" ]; then
230+
# shellcheck disable=SC2086
231+
cscli_if_clean parsers install "$(difference "$PARSERS" "$DISABLE_PARSERS")"
232+
fi
233+
234+
if [ "$SCENARIOS" != "" ]; then
235+
# shellcheck disable=SC2086
236+
cscli_if_clean scenarios install "$(difference "$SCENARIOS" "$DISABLE_SCENARIOS")"
237+
fi
238+
239+
if [ "$POSTOVERFLOWS" != "" ]; then
240+
# shellcheck disable=SC2086
241+
cscli_if_clean postoverflows install "$(difference "$POSTOVERFLOWS" "$DISABLE_POSTOVERFLOWS")"
242+
fi
243+
244+
if [ "$CONTEXTS" != "" ]; then
245+
# shellcheck disable=SC2086
246+
cscli_if_clean contexts install "$(difference "$CONTEXTS" "$DISABLE_CONTEXTS")"
247+
fi
248+
249+
if [ "$APPSEC_CONFIGS" != "" ]; then
250+
# shellcheck disable=SC2086
251+
cscli_if_clean appsec-configs install "$(difference "$APPSEC_CONFIGS" "$DISABLE_APPSEC_CONFIGS")"
252+
fi
253+
254+
if [ "$APPSEC_RULES" != "" ]; then
255+
# shellcheck disable=SC2086
256+
cscli_if_clean appsec-rules install "$(difference "$APPSEC_RULES" "$DISABLE_APPSEC_RULES")"
257+
fi
258+
259+
## Remove collections, parsers, scenarios & postoverflows
260+
if [ "$DISABLE_COLLECTIONS" != "" ]; then
261+
# shellcheck disable=SC2086
262+
cscli_if_clean collections remove "$DISABLE_COLLECTIONS" --force
263+
fi
264+
265+
if [ "$DISABLE_PARSERS" != "" ]; then
266+
# shellcheck disable=SC2086
267+
cscli_if_clean parsers remove "$DISABLE_PARSERS" --force
268+
fi
269+
270+
if [ "$DISABLE_SCENARIOS" != "" ]; then
271+
# shellcheck disable=SC2086
272+
cscli_if_clean scenarios remove "$DISABLE_SCENARIOS" --force
273+
fi
274+
275+
if [ "$DISABLE_POSTOVERFLOWS" != "" ]; then
276+
# shellcheck disable=SC2086
277+
cscli_if_clean postoverflows remove "$DISABLE_POSTOVERFLOWS" --force
278+
fi
279+
280+
if [ "$DISABLE_CONTEXTS" != "" ]; then
281+
# shellcheck disable=SC2086
282+
cscli_if_clean contexts remove "$DISABLE_CONTEXTS" --force
283+
fi
284+
285+
if [ "$DISABLE_APPSEC_CONFIGS" != "" ]; then
286+
# shellcheck disable=SC2086
287+
cscli_if_clean appsec-configs remove "$DISABLE_APPSEC_CONFIGS" --force
288+
fi
289+
290+
if [ "$DISABLE_APPSEC_RULES" != "" ]; then
291+
# shellcheck disable=SC2086
292+
cscli_if_clean appsec-rules remove "$DISABLE_APPSEC_RULES" --force
293+
fi
294+
}
295+
204296
#-----------------------------------#
205297

206298
if [ -n "$CERT_FILE" ] || [ -n "$KEY_FILE" ] ; then
@@ -374,84 +466,7 @@ fi
374466

375467
conf_set_if "$PLUGIN_DIR" '.config_paths.plugin_dir = strenv(PLUGIN_DIR)'
376468

377-
## Install hub items
378-
379-
run_hub_update_if_from_volume || true
380-
run_hub_upgrade_if_from_volume || true
381-
382-
cscli_if_clean parsers install crowdsecurity/docker-logs
383-
cscli_if_clean parsers install crowdsecurity/cri-logs
384-
385-
if [ "$COLLECTIONS" != "" ]; then
386-
# shellcheck disable=SC2086
387-
cscli_if_clean collections install "$(difference "$COLLECTIONS" "$DISABLE_COLLECTIONS")"
388-
fi
389-
390-
if [ "$PARSERS" != "" ]; then
391-
# shellcheck disable=SC2086
392-
cscli_if_clean parsers install "$(difference "$PARSERS" "$DISABLE_PARSERS")"
393-
fi
394-
395-
if [ "$SCENARIOS" != "" ]; then
396-
# shellcheck disable=SC2086
397-
cscli_if_clean scenarios install "$(difference "$SCENARIOS" "$DISABLE_SCENARIOS")"
398-
fi
399-
400-
if [ "$POSTOVERFLOWS" != "" ]; then
401-
# shellcheck disable=SC2086
402-
cscli_if_clean postoverflows install "$(difference "$POSTOVERFLOWS" "$DISABLE_POSTOVERFLOWS")"
403-
fi
404-
405-
if [ "$CONTEXTS" != "" ]; then
406-
# shellcheck disable=SC2086
407-
cscli_if_clean contexts install "$(difference "$CONTEXTS" "$DISABLE_CONTEXTS")"
408-
fi
409-
410-
if [ "$APPSEC_CONFIGS" != "" ]; then
411-
# shellcheck disable=SC2086
412-
cscli_if_clean appsec-configs install "$(difference "$APPSEC_CONFIGS" "$DISABLE_APPSEC_CONFIGS")"
413-
fi
414-
415-
if [ "$APPSEC_RULES" != "" ]; then
416-
# shellcheck disable=SC2086
417-
cscli_if_clean appsec-rules install "$(difference "$APPSEC_RULES" "$DISABLE_APPSEC_RULES")"
418-
fi
419-
420-
## Remove collections, parsers, scenarios & postoverflows
421-
if [ "$DISABLE_COLLECTIONS" != "" ]; then
422-
# shellcheck disable=SC2086
423-
cscli_if_clean collections remove "$DISABLE_COLLECTIONS" --force
424-
fi
425-
426-
if [ "$DISABLE_PARSERS" != "" ]; then
427-
# shellcheck disable=SC2086
428-
cscli_if_clean parsers remove "$DISABLE_PARSERS" --force
429-
fi
430-
431-
if [ "$DISABLE_SCENARIOS" != "" ]; then
432-
# shellcheck disable=SC2086
433-
cscli_if_clean scenarios remove "$DISABLE_SCENARIOS" --force
434-
fi
435-
436-
if [ "$DISABLE_POSTOVERFLOWS" != "" ]; then
437-
# shellcheck disable=SC2086
438-
cscli_if_clean postoverflows remove "$DISABLE_POSTOVERFLOWS" --force
439-
fi
440-
441-
if [ "$DISABLE_CONTEXTS" != "" ]; then
442-
# shellcheck disable=SC2086
443-
cscli_if_clean contexts remove "$DISABLE_CONTEXTS" --force
444-
fi
445-
446-
if [ "$DISABLE_APPSEC_CONFIGS" != "" ]; then
447-
# shellcheck disable=SC2086
448-
cscli_if_clean appsec-configs remove "$DISABLE_APPSEC_CONFIGS" --force
449-
fi
450-
451-
if [ "$DISABLE_APPSEC_RULES" != "" ]; then
452-
# shellcheck disable=SC2086
453-
cscli_if_clean appsec-rules remove "$DISABLE_APPSEC_RULES" --force
454-
fi
469+
prepare_hub
455470

456471
## Register bouncers via env
457472
for BOUNCER in $(compgen -A variable | grep -i BOUNCER_KEY); do

0 commit comments

Comments
 (0)