Add Configuration for SCALIBR - #1034
Conversation
|
Hi @bromivipo. Thanks for your PR. I'm waiting for a GoogleCloudPlatform member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
| scalibrLinuxEnabled bool | ||
| guestAttributesEnabled bool | ||
| traceGetInventory bool | ||
| extendedInventoryEnabled bool |
There was a problem hiding this comment.
If we're updating the SCALIBR flow, am I right in understanding that we can drop scalibrLinuxEnabled and rely on extendedInventoryEnabled for both linux and windows?
There was a problem hiding this comment.
No, scalibrLinuxEnabled is a flag to enable extraction using osv-scalibr and extendedInventoryEnabled is used to enable extraction with extended set of extractors (other than currently supported).
There was a problem hiding this comment.
please correct me if i'm wrong. if we have scalibrLinuxEnabled = true - we just start to use current default extractors ("os/cos", "os/dpkg", "os/rpm"). with additional extendedInventoryEnabled = true we start to use other extractors by default, language extractors for example. and extendedInventoryExtractorsAllowed is used to filter those additionally activated extractors. @petercieslak is that correct?
my other theory - extendedInventoryExtractorsAllowed must be non-empty to use any additional extractors with extendedInventoryEnabled, otherwise will be no effect.
There was a problem hiding this comment.
The first description is correct, with scalibrLinuxEnabled we use the default extractors. Additionally extendedInventoryEnabled allows us to use extendedInventoryExtractorsAllowed in the extraction process. The extendedInventoryExtractorsAllowed don't have to be non-empty - if that's the case we just use the default extractors.
| guestAttributesEnabled bool | ||
| traceGetInventory bool | ||
| extendedInventoryEnabled bool | ||
| extendedInventoryCollectionInterval int |
There was a problem hiding this comment.
Is this field necessary, or could we reuse the existing osConfigPollInterval ticker instead of adding a new interval configuration? Since we discussed merging the results of extended and legacy scans, it makes sense for them to run simultaneously.
There was a problem hiding this comment.
That's a good point, it seems that we can reuse the existing ticker
|
/ok-to-test |
|
/gcbrun |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: bromivipo, iliatsuprik, petercieslak The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
/gcbrun |
4 participants
This PR adds configuration support for SCALIBR extended inventory collection in
agentconfig.Changes Included:
osconfig-extended-inventory-enabled,osconfig-extended-inventory-collection-interval,osconfig-extended-inventory-extractors-allowed.setExtendedInventoryto support instance-level overrides for project settings, along with aparseSlicehelper for extractors.agentconfig_test.gofor defaults, project settings, and instance overrides.