Skip to content

Commit 1cdc408

Browse files
bleggettbleggett
authored
Bump proto libraries to current versions + add some example snippets (#48)
* Bump proto libs * Add some examples too * Add example helm values * fixup
1 parent 18e1645 commit 1cdc408

11 files changed

Lines changed: 833 additions & 100 deletions

File tree

‎examples/README.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Example snippets
2+
3+
- [`example-rule.yaml`](example-rule.yaml) -> A trivial Falco rule snippet to log syscall events from Edera workloads to Falco's stdout stream.
4+
- [`example-config.yaml`](example-config.yaml) -> A minimal Falco config file that only loads the Edera plugin source.
5+
- [`falco-helm-values.yaml`](falco-helm-values.yaml) -> A basic set of Helm values to use when deploying Falco via the [upstream Helm chart](https://falco.org/docs/setup/kubernetes/) in an Edera cluster.

‎examples/example-config.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# This config disables all other default Falco drivers and syscall capturing and
2+
# only loads the Edera source plugin.
3+
plugins:
4+
- name: edera
5+
library_path: /var/lib/edera/protect/falco/libedera_falco_plugin.so
6+
init_config:
7+
mirror_host_syscalls: false
8+
load_plugins: [edera]
9+
stdout_output:
10+
enabled: true
11+
engine:
12+
kind: nodriver
13+
log_stderr: true

‎examples/example-rule.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
- macro: open_read_edera
2+
condition: (evt.pluginname == "edera")
3+
4+
- rule: Edera Events
5+
desc: >
6+
Logs every syscall event from every running Edera zone, with no filtering.
7+
Useful for testing and understanding what events are available.
8+
source: edera_zone
9+
output: >
10+
Edera Event | time=%evt.time zone_id=%edera.zone.id evt.type=%evt.type
11+
syscall.type=%syscall.type evt.category=%evt.category evt.dir=%evt.dir
12+
proc.exe=%proc.exe evt.args=%evt.args is_open=%evt.type.is[open]
13+
priority: WARNING
14+
tags: [edera_zone, filesystem]
15+
condition: >
16+
open_read_edera

‎examples/falco-helm-values.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
mounts:
2+
volumes:
3+
- name: edera-plugin
4+
hostPath:
5+
path: /var/lib/edera/protect/falco
6+
- name: edera-daemon-socket
7+
hostPath:
8+
path: /var/lib/edera/protect
9+
volumeMounts:
10+
- name: edera-plugin
11+
mountPath: /var/lib/edera/protect/falco
12+
readOnly: true
13+
- name: edera-daemon-socket
14+
mountPath: /var/lib/edera/protect
15+
readOnly: false
16+
17+
falco:
18+
plugins:
19+
- name: edera
20+
library_path: /var/lib/edera/protect/falco/libedera_falco_plugin.so
21+
init_config:
22+
mirror_host_syscalls: true
23+
load_plugins: [edera]

‎hack/proto/buf.gen.control.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@ managed:
44
enabled: true
55
plugins:
66
- local: protoc-gen-prost
7-
out: src/proto/generated/protect/control
7+
out: src/proto/generated
88
opt:
99
- compile_well_known_types
1010
- extern_path=.google.protobuf=::pbjson_types
1111
- local: protoc-gen-prost-serde
12-
out: src/proto/generated/protect/control
12+
out: src/proto/generated
1313
- local: protoc-gen-tonic
14-
out: src/proto/generated/protect/control
14+
out: src/proto/generated
1515
inputs:
1616
- module: buf.build/edera-dev/protect

‎hack/proto/install-tools.sh‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#!/usr/bin/env sh
2+
# shellcheck disable=SC2086
3+
set -e
4+
5+
# shellcheck source-path=SCRIPTDIR source=versions.sh
6+
. "$(dirname "${0}")/versions.sh"
7+
8+
[ -z "${ADD_GO_FLAGS}" ] && ADD_GO_FLAGS=""
9+
[ -z "${ADD_CARGO_FLAGS}" ] && ADD_CARGO_FLAGS="--force"
10+
11+
${INSTALL_BUF} ${ADD_GO_FLAGS}
12+
${INSTALL_PROTOC_GEN_GO} ${ADD_GO_FLAGS}
13+
${INSTALL_PROTOC_GEN_GO_GRPC} ${ADD_GO_FLAGS}
14+
${INSTALL_PROTOC_GEN_PROST} ${ADD_CARGO_FLAGS}
15+
${INSTALL_PROTOC_GEN_TONIC} ${ADD_CARGO_FLAGS}
16+
${INSTALL_PROTOC_GEN_PROST_SERDE} ${ADD_CARGO_FLAGS}

‎hack/proto/versions.sh‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,15 @@
33
set -e
44

55
PROTOC_GEN_PROST_REPOSITORY="https://github.com/neoeinstein/protoc-gen-prost.git"
6-
PROTOC_GEN_PROST_COMMIT=66b503dd1631bc2eaf79db37cde74b01567c8224
7-
BUF_COMMIT=69a3227530199878cc50df6ce889b176b498e077
6+
PROTOC_GEN_PROST_COMMIT=6915e08b082a15feb260062fe82d049edc0eadd6
7+
BUF_COMMIT=8ecc976ddc58ac372f045092202061f3c53f9f88
88

9-
BUF_VERSION=v1.56.0
10-
PROTOC_GEN_PROST_VERSION=0.4.1
11-
PROTOC_GEN_TONIC_VERSION=0.4.2
12-
PROTOC_GEN_PROST_SERDE_VERSION=0.3.2
9+
BUF_VERSION=v1.64.0
10+
PROTOC_GEN_PROST_VERSION=0.5.0
11+
PROTOC_GEN_TONIC_VERSION=0.5.0
12+
PROTOC_GEN_PROST_SERDE_VERSION=0.4.0
1313

1414
INSTALL_BUF="go install github.com/bufbuild/buf/cmd/buf@${BUF_COMMIT}"
15-
INSTALL_PROTOC_GEN_PROST="cargo install --git ${PROTOC_GEN_PROST_REPOSITORY} --rev ${PROTOC_GEN_PROST_COMMIT} protoc-gen-prost"
16-
INSTALL_PROTOC_GEN_TONIC="cargo install --git ${PROTOC_GEN_PROST_REPOSITORY} --rev ${PROTOC_GEN_PROST_COMMIT} protoc-gen-tonic"
17-
INSTALL_PROTOC_GEN_PROST_SERDE="cargo install --git ${PROTOC_GEN_PROST_REPOSITORY} --rev ${PROTOC_GEN_PROST_COMMIT} protoc-gen-prost-serde"
15+
INSTALL_PROTOC_GEN_PROST="cargo install --locked --git ${PROTOC_GEN_PROST_REPOSITORY} --rev ${PROTOC_GEN_PROST_COMMIT} protoc-gen-prost"
16+
INSTALL_PROTOC_GEN_TONIC="cargo install --locked --git ${PROTOC_GEN_PROST_REPOSITORY} --rev ${PROTOC_GEN_PROST_COMMIT} protoc-gen-tonic"
17+
INSTALL_PROTOC_GEN_PROST_SERDE="cargo install --locked --git ${PROTOC_GEN_PROST_REPOSITORY} --rev ${PROTOC_GEN_PROST_COMMIT} protoc-gen-prost-serde"

‎src/proto/generated.rs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
#[allow(clippy::all)]
33
pub mod protect {
44
pub mod control {
5-
#[path = "protect.control.v1.rs"]
5+
#[path = "v1/protect.control.v1.rs"]
66
pub mod v1;
77
}
88
}

src/proto/generated/protect/control/protect.control.v1.rs renamed to src/proto/generated/protect/control/v1/protect.control.v1.rs

Lines changed: 61 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -181,6 +181,22 @@ pub struct DeviceReferenceSpec {
181181
#[prost(string, tag="1")]
182182
pub name: ::prost::alloc::string::String,
183183
}
184+
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
185+
pub struct WorkloadBlockDeviceSpec {
186+
#[prost(string, tag="1")]
187+
pub target_path: ::prost::alloc::string::String,
188+
#[prost(string, tag="2")]
189+
pub device_path: ::prost::alloc::string::String,
190+
#[prost(message, optional, tag="3")]
191+
pub mount_options: ::core::option::Option<BlockDeviceMountOptions>,
192+
}
193+
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
194+
pub struct BlockDeviceMountOptions {
195+
#[prost(bool, tag="1")]
196+
pub readonly: bool,
197+
#[prost(string, tag="2")]
198+
pub permissions: ::prost::alloc::string::String,
199+
}
184200
#[derive(Clone, PartialEq, ::prost::Message)]
185201
pub struct ZoneStatus {
186202
#[prost(enumeration="ZoneState", tag="1")]
@@ -379,6 +395,19 @@ pub struct WorkloadSpec {
379395
pub security: ::core::option::Option<WorkloadSecuritySpec>,
380396
#[prost(message, repeated, tag="8")]
381397
pub scratch_mount: ::prost::alloc::vec::Vec<WorkloadScratchMount>,
398+
#[prost(message, repeated, tag="9")]
399+
pub cgroup_limits: ::prost::alloc::vec::Vec<CgroupLimit>,
400+
#[prost(string, tag="10")]
401+
pub hostname: ::prost::alloc::string::String,
402+
#[prost(message, repeated, tag="11")]
403+
pub block_devices: ::prost::alloc::vec::Vec<WorkloadBlockDeviceSpec>,
404+
}
405+
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
406+
pub struct CgroupLimit {
407+
#[prost(string, tag="1")]
408+
pub limit_name: ::prost::alloc::string::String,
409+
#[prost(string, tag="2")]
410+
pub value: ::prost::alloc::string::String,
382411
}
383412
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
384413
pub struct WorkloadScratchMount {
@@ -401,6 +430,10 @@ pub struct WorkloadSecuritySpec {
401430
pub disable_all_namespaces: bool,
402431
#[prost(enumeration="ProcessNamespace", repeated, tag="7")]
403432
pub disable_namespaces: ::prost::alloc::vec::Vec<i32>,
433+
#[prost(bool, tag="8")]
434+
pub read_only_rootfs: bool,
435+
#[prost(bool, tag="9")]
436+
pub no_new_privs: bool,
404437
}
405438
#[derive(Clone, PartialEq, ::prost::Message)]
406439
pub struct WorkloadStatus {
@@ -423,8 +456,10 @@ pub struct WorkloadBlockDeviceInfo {
423456
pub block_index: u32,
424457
#[prost(uint64, tag="2")]
425458
pub device_id: u64,
426-
#[prost(string, tag="3")]
427-
pub loop_device: ::prost::alloc::string::String,
459+
#[prost(string, tag="4")]
460+
pub device: ::prost::alloc::string::String,
461+
#[prost(bool, tag="5")]
462+
pub loop_dev: bool,
428463
}
429464
#[derive(Clone, PartialEq, ::prost::Message)]
430465
pub struct WorkloadBlockDeviceStatus {
@@ -433,21 +468,17 @@ pub struct WorkloadBlockDeviceStatus {
433468
}
434469
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
435470
pub struct WorkloadMountInfo {
436-
#[prost(uint64, tag="1")]
437-
pub device_id: u64,
438471
#[prost(string, tag="2")]
439472
pub tag: ::prost::alloc::string::String,
440473
#[prost(string, tag="3")]
441-
pub host_directory: ::prost::alloc::string::String,
442-
#[prost(string, tag="4")]
443-
pub host_file: ::prost::alloc::string::String,
474+
pub host_path: ::prost::alloc::string::String,
444475
#[prost(string, tag="5")]
445476
pub target_path: ::prost::alloc::string::String,
446477
}
447478
#[derive(Clone, PartialEq, ::prost::Message)]
448479
pub struct WorkloadMountStatus {
449-
#[prost(message, repeated, tag="1")]
450-
pub devices: ::prost::alloc::vec::Vec<WorkloadMountInfo>,
480+
#[prost(message, repeated, tag="2")]
481+
pub mounts: ::prost::alloc::vec::Vec<WorkloadMountInfo>,
451482
}
452483
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
453484
pub struct WorkloadExitStatus {
@@ -586,6 +617,8 @@ pub struct ZoneScratchDiskSpecStaticBlock {
586617
pub struct ZoneDeviceStatus {
587618
#[prost(message, repeated, tag="1")]
588619
pub disks: ::prost::alloc::vec::Vec<ZoneDiskStatus>,
620+
#[prost(message, optional, tag="2")]
621+
pub mount: ::core::option::Option<ZoneMountStatus>,
589622
}
590623
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
591624
pub struct ZoneDiskStatus {
@@ -603,6 +636,15 @@ pub struct ZoneDiskStatus {
603636
pub delete: bool,
604637
}
605638
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
639+
pub struct ZoneMountStatus {
640+
#[prost(uint64, tag="1")]
641+
pub device_id: u64,
642+
#[prost(string, tag="2")]
643+
pub host_path: ::prost::alloc::string::String,
644+
#[prost(string, tag="3")]
645+
pub tag: ::prost::alloc::string::String,
646+
}
647+
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
606648
pub struct OciRegistryUsernamePassword {
607649
/// username to provide, empty means no username.
608650
#[prost(string, tag="1")]
@@ -709,6 +751,7 @@ pub enum ZoneVirtualizationBackend {
709751
Unknown = 0,
710752
Pv = 1,
711753
Pvh = 2,
754+
Automatic = 3,
712755
}
713756
impl ZoneVirtualizationBackend {
714757
/// String value of the enum field names used in the ProtoBuf definition.
@@ -720,6 +763,7 @@ impl ZoneVirtualizationBackend {
720763
Self::Unknown => "ZONE_VIRTUALIZATION_BACKEND_UNKNOWN",
721764
Self::Pv => "ZONE_VIRTUALIZATION_BACKEND_PV",
722765
Self::Pvh => "ZONE_VIRTUALIZATION_BACKEND_PVH",
766+
Self::Automatic => "ZONE_VIRTUALIZATION_BACKEND_AUTOMATIC",
723767
}
724768
}
725769
/// Creates an enum from field names used in the ProtoBuf definition.
@@ -728,6 +772,7 @@ impl ZoneVirtualizationBackend {
728772
"ZONE_VIRTUALIZATION_BACKEND_UNKNOWN" => Some(Self::Unknown),
729773
"ZONE_VIRTUALIZATION_BACKEND_PV" => Some(Self::Pv),
730774
"ZONE_VIRTUALIZATION_BACKEND_PVH" => Some(Self::Pvh),
775+
"ZONE_VIRTUALIZATION_BACKEND_AUTOMATIC" => Some(Self::Automatic),
731776
_ => None,
732777
}
733778
}
@@ -927,6 +972,7 @@ pub enum WorkloadState {
927972
Destroying = 5,
928973
Destroyed = 6,
929974
Failed = 7,
975+
Oomkilled = 8,
930976
}
931977
impl WorkloadState {
932978
/// String value of the enum field names used in the ProtoBuf definition.
@@ -943,6 +989,7 @@ impl WorkloadState {
943989
Self::Destroying => "WORKLOAD_STATE_DESTROYING",
944990
Self::Destroyed => "WORKLOAD_STATE_DESTROYED",
945991
Self::Failed => "WORKLOAD_STATE_FAILED",
992+
Self::Oomkilled => "WORKLOAD_STATE_OOMKILLED",
946993
}
947994
}
948995
/// Creates an enum from field names used in the ProtoBuf definition.
@@ -956,6 +1003,7 @@ impl WorkloadState {
9561003
"WORKLOAD_STATE_DESTROYING" => Some(Self::Destroying),
9571004
"WORKLOAD_STATE_DESTROYED" => Some(Self::Destroyed),
9581005
"WORKLOAD_STATE_FAILED" => Some(Self::Failed),
1006+
"WORKLOAD_STATE_OOMKILLED" => Some(Self::Oomkilled),
9591007
_ => None,
9601008
}
9611009
}
@@ -1156,6 +1204,8 @@ pub struct GetHostStatusReply {
11561204
pub host_ipv6: ::prost::alloc::string::String,
11571205
#[prost(string, tag="6")]
11581206
pub host_mac: ::prost::alloc::string::String,
1207+
#[prost(uint64, optional, tag="7")]
1208+
pub hyp_free_mem: ::core::option::Option<u64>,
11591209
}
11601210
#[derive(Clone, PartialEq, ::prost::Message)]
11611211
pub struct CreateZoneRequest {
@@ -1856,6 +1906,8 @@ pub struct StartWorkloadReply {
18561906
pub struct StopWorkloadRequest {
18571907
#[prost(string, tag="1")]
18581908
pub workload_id: ::prost::alloc::string::String,
1909+
#[prost(uint64, tag="2")]
1910+
pub timeout: u64,
18591911
}
18601912
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
18611913
pub struct StopWorkloadReply {

0 commit comments

Comments
 (0)