Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove endpoint security from linux containers #6016

Conversation

kaanyalti
Copy link
Contributor

  • Enhancement

What does this PR do?

The goal of this implementation is to remove endpoint security from linux containers. Since we currently do not distribute any container other than linux containers (source), this PR does not consider selected platforms when excluding the endpoint security from container images.

Why is it important?

Endpoint security cannot run in containers since it has a systemd dependency.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • [ ] I have made corresponding changes to the documentation
  • [ ] I have made corresponding change to the default configuration files
  • [ ] I have added tests that prove my fix is effective or that my feature works
  • [ ] I have added an entry in ./changelog/fragments using the changelog tool
  • [ ] I have added an integration test or an E2E test

How to test this PR locally

Package elastic-agent for a non-docker platform and validate endpoint security is installed

  • Run SNAPSHOT=true PLATFORMS=linux/arm64 PACKAGES=tar.gz EXTERNAL=true mage package
  • Extract the compressed artifact tar xzvf elastic-agent-9.0.0-SNAPSHOT-linux-arm64.tar.gz
  • Go into the extracted dir
  • Go into data/elastic-agent-<commit>/components
  • Verify that endpoint security artifacts are present

Package elastic-agent for docker with linux and validate that endpoint security is not installed

  • Run SNAPSHOT=true PLATFORMS=linux/arm64 PACKAGES=docker EXTERNAL=true mage package
  • Start a container based on one of the images docker run --entrypoint /bin/bash -it e75d83ff01b5
  • Go into data/elastic-agent-<commit>/components
  • Verify that endpoint security is not installed

Related issues

Copy link
Contributor

mergify bot commented Nov 13, 2024

This pull request does not have a backport label. Could you fix it @kaanyalti? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

  • backport-./d./d is the label to automatically backport to the 8./d branch. /d is the digit

Copy link
Contributor

mergify bot commented Nov 13, 2024

backport-v8.x has been added to help with the transition to the new branch 8.x.
If you don't need it please use backport-skip label and remove the backport-8.x label.

@mergify mergify bot added the backport-8.x Automated backport to the 8.x branch with mergify label Nov 13, 2024
@kaanyalti kaanyalti force-pushed the enhancement/5495_remove_endpoint_security_from_linux_containers branch from fba6917 to 2f11581 Compare November 13, 2024 15:32
@pierrehilbert pierrehilbert added the Team:Elastic-Agent-Control-Plane Label for the Agent Control Plane team label Nov 13, 2024
@elasticmachine
Copy link
Contributor

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)

@pierrehilbert pierrehilbert requested review from blakerouse and removed request for andrzej-stencel November 13, 2024 16:09
@kaanyalti kaanyalti force-pushed the enhancement/5495_remove_endpoint_security_from_linux_containers branch from 8746aa2 to 37350ff Compare November 13, 2024 17:23
Copy link
Contributor

@blakerouse blakerouse left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good.

l like the small cleanups added in this PR as well.

@kaanyalti kaanyalti force-pushed the enhancement/5495_remove_endpoint_security_from_linux_containers branch from 2ea013e to e875ad3 Compare November 14, 2024 05:34
Copy link
Contributor

@michalpristas michalpristas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i like the change, it gives us a bit of flexibility for future changes.
it would also be nice enhancement (not a blocker) to have helper like AllPackageTypesExcept(pt ...PackageType)
so endpoint would become AllPackageTypesExcept(Docker)

@kaanyalti kaanyalti force-pushed the enhancement/5495_remove_endpoint_security_from_linux_containers branch from 04463d7 to 85389d5 Compare November 14, 2024 23:24
@kaanyalti kaanyalti force-pushed the enhancement/5495_remove_endpoint_security_from_linux_containers branch from 85389d5 to a09ce0f Compare November 15, 2024 07:43
Copy link

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarQube

@kaanyalti kaanyalti merged commit 9c7552f into elastic:main Nov 15, 2024
14 checks passed
mergify bot pushed a commit that referenced this pull request Nov 15, 2024
* enhancement(5495): added package types to expected binaries, updated packaging function

* enhancement(5495): ran mage addLicenseHeader

* enhancement(5495): added changelog fragment

* Update changelog/fragments/1731517501-removed-endpoint-security-from-linux-containers.yaml

Co-authored-by: Shaunak Kashyap <ycombinator@gmail.com>

* enhancement(5495): ran mage clean

---------

Co-authored-by: Shaunak Kashyap <ycombinator@gmail.com>
(cherry picked from commit 9c7552f)

# Conflicts:
#	dev-tools/mage/manifest/manifest.go
#	magefile.go
blakerouse pushed a commit to blakerouse/elastic-agent that referenced this pull request Nov 18, 2024
* enhancement(5495): added package types to expected binaries, updated packaging function

* enhancement(5495): ran mage addLicenseHeader

* enhancement(5495): added changelog fragment

* Update changelog/fragments/1731517501-removed-endpoint-security-from-linux-containers.yaml

Co-authored-by: Shaunak Kashyap <ycombinator@gmail.com>

* enhancement(5495): ran mage clean

---------

Co-authored-by: Shaunak Kashyap <ycombinator@gmail.com>
kaanyalti added a commit that referenced this pull request Nov 18, 2024
…6042)

* Remove endpoint security from linux containers (#6016)

* enhancement(5495): added package types to expected binaries, updated packaging function

* enhancement(5495): ran mage addLicenseHeader

* enhancement(5495): added changelog fragment

* Update changelog/fragments/1731517501-removed-endpoint-security-from-linux-containers.yaml

Co-authored-by: Shaunak Kashyap <ycombinator@gmail.com>

* enhancement(5495): ran mage clean

---------

Co-authored-by: Shaunak Kashyap <ycombinator@gmail.com>
(cherry picked from commit 9c7552f)

# Conflicts:
#	dev-tools/mage/manifest/manifest.go
#	magefile.go

* resolved conflicts

---------

Co-authored-by: Kaan Yalti <kaan.yalti@elastic.co>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport-8.x Automated backport to the 8.x branch with mergify Team:Elastic-Agent-Control-Plane Label for the Agent Control Plane team
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Remove Endpoint Security from Elastic-agent Linux Container
6 participants