fix v1beta2 k8s policy generation

Co-authored-by: Daniel Eisenberg <danielei@checkpoint.com>

build_system/docker/entry.sh

@@ -36,7 +36,7 @@ if [ ! -f /nano-service-installers/$ORCHESTRATION_INSTALLATION_SCRIPT ]; then
     exit 1
 fi
 
-if [ -z "$1" ]; then
+if [ -z $1 ]; then
     var_mode="--hybrid_mode"
 fi
 
@@ -60,30 +60,30 @@ while true; do
     shift
 done
 
-if [ -z "$var_token" ] && [ "$var_mode" != "--hybrid_mode" ]; then
+if [ -z $var_token ] && [ $var_mode != "--hybrid_mode" ]; then
     var_token=$(env | grep 'AGENT_TOKEN=' | cut -d'=' -f2-)
-    if  [ -z "$var_token" ]; then
+    if  [ -z $var_token ]; then
         echo "Error: Token was not provided as input argument."
         exit 1
     fi
 fi
 
 orchestration_service_installation_flags="--container_mode --skip_registration"
-if [ -n "$var_token" ]; then
+if [ ! -z $var_token ]; then
     export AGENT_TOKEN="$var_token"
     orchestration_service_installation_flags="$orchestration_service_installation_flags --token $var_token"
 fi
-if [ -n "$var_fog_address" ]; then
+if [ ! -z $var_fog_address ]; then
     orchestration_service_installation_flags="$orchestration_service_installation_flags --fog $var_fog_address"
 fi
-if [ -n "$var_proxy" ]; then
+if [ ! -z $var_proxy ]; then
     orchestration_service_installation_flags="$orchestration_service_installation_flags --proxy $var_proxy"
 fi
 
-if [ -n "$var_mode" ]; then
+if [ ! -z $var_mode ]; then
     orchestration_service_installation_flags="$orchestration_service_installation_flags $var_mode"
 fi
-if [ -n "$var_ignore" ]; then
+if [ ! -z "$var_ignore" ]; then
     orchestration_service_installation_flags="$orchestration_service_installation_flags $var_ignore"
 fi
 
@@ -114,7 +114,7 @@ fi
 # use advanced model if exist as data for agent
 FILE=/advanced-model/open-appsec-advanced-model.tgz
 if [ -f "$FILE" ]; then
-    tar -xzvf "$FILE" -C /etc/cp/conf/waap
+    tar -xzvf $FILE -C /etc/cp/conf/waap
 fi
 
 touch /etc/cp/watchdog/wd.startup

components/security_apps/local_policy_mgmt_gen/k8s_policy_utils.cc

@@ -515,60 +515,63 @@ K8sPolicyUtils::createAppsecPolicyK8sFromV1beta2Crds(
 }
 // LCOV_EXCL_STOP
 
-std::tuple<Maybe<AppsecLinuxPolicy>, Maybe<V1beta2AppsecLinuxPolicy>>
+tuple<Maybe<AppsecLinuxPolicy>, Maybe<V1beta2AppsecLinuxPolicy>>
 K8sPolicyUtils::createAppsecPolicyK8s(const string &policy_name, const string &ingress_mode) const
 {
-    auto maybe_appsec_policy_spec = getObjectFromCluster<AppsecSpecParser<AppsecPolicySpec>>(
-        "/apis/openappsec.io/v1beta1/policies/" + policy_name
+    string ns_suffix = getAppSecScopeType() == "namespaced" ? "ns" : "";
+    string ns = getAppSecScopeType() == "namespaced" ? "namespaces/" : "";
+    auto maybe_v1beta2_appsec_policy_spec = getObjectFromCluster<AppsecSpecParser<NewAppsecPolicySpec>>(
+        "/apis/openappsec.io/v1beta2/" + ns + agent_ns + "policies" + ns_suffix + "/" + policy_name
     );
 
-    if (!maybe_appsec_policy_spec.ok() ||
-        maybe_appsec_policy_spec.unpack().getApiVersion().find("v1beta1") == std::string::npos
+    if (!maybe_v1beta2_appsec_policy_spec.ok() ||
+        maybe_v1beta2_appsec_policy_spec.unpack().getApiVersion().find("v1beta2") == std::string::npos
     ) {
         try {
-            std::string v1beta1_error =
-                maybe_appsec_policy_spec.ok() ? "There is no v1beta1 policy" : maybe_appsec_policy_spec.getErr();
+            string policy_error = maybe_v1beta2_appsec_policy_spec.getErr();
+            string v1beta2_error =
+                maybe_v1beta2_appsec_policy_spec.ok() ? "There is no v1beta2 policy" : policy_error;
             dbgWarning(D_LOCAL_POLICY
             ) << "Failed to retrieve Appsec policy with crds version: v1beta1, Trying version: v1beta2";
-            string ns_suffix = getAppSecScopeType() == "namespaced" ? "ns" : "";
-            string ns = getAppSecScopeType() == "namespaced" ? "namespaces/" : "";
-            auto maybe_v1beta2_appsec_policy_spec = getObjectFromCluster<AppsecSpecParser<NewAppsecPolicySpec>>(
-                "/apis/openappsec.io/v1beta2/" + ns + agent_ns + "policies" + ns_suffix + "/" + policy_name
+            auto maybe_appsec_policy_spec = getObjectFromCluster<AppsecSpecParser<AppsecPolicySpec>>(
+                "/apis/openappsec.io/v1beta1/policies/" + policy_name
             );
 
-            if (!maybe_v1beta2_appsec_policy_spec.ok()) {
+            if (!maybe_appsec_policy_spec.ok()) {
                 dbgWarning(D_LOCAL_POLICY)
-                    << "Failed to retrieve AppSec policy. Error: " << maybe_v1beta2_appsec_policy_spec.getErr();
+                    << "Failed to retrieve AppSec policy. Error: " << maybe_appsec_policy_spec.getErr();
                 return std::make_tuple(
-                    genError("Failed to retrieve AppSec v1beta1 policy. Error: " + v1beta1_error),
+                    genError("Failed to retrieve AppSec v1beta1 policy. Error: " + maybe_appsec_policy_spec.getErr()),
                     genError(
-                        "Failed to retrieve AppSec v1beta2 policy. Error: " + maybe_v1beta2_appsec_policy_spec.getErr()
+                        "Failed to retrieve AppSec v1beta2 policy. Error: " + v1beta2_error
                     )
                 );
             }
             return std::make_tuple(
-                genError("There is no v1beta1 policy"),
-                createAppsecPolicyK8sFromV1beta2Crds(maybe_v1beta2_appsec_policy_spec.unpack(), ingress_mode)
+                createAppsecPolicyK8sFromV1beta1Crds(maybe_appsec_policy_spec.unpack(), ingress_mode),
+                genError("There is no v1beta2 policy")
             );
+
         } catch (const PolicyGenException &e) {
             dbgDebug(D_LOCAL_POLICY) << "Failed in policy generation. Error: " << e.what();
-            return std::make_tuple(
+            return make_tuple(
                 genError("There is no v1beta1 policy"),
                 genError("Failed to retrieve AppSec v1beta2 policy. Error: " + string(e.what()))
             );
         }
     }
 
-    return std::make_tuple(
-        createAppsecPolicyK8sFromV1beta1Crds(maybe_appsec_policy_spec.unpack(), ingress_mode),
-        genError("There is no v1beta2 policy"));
+    return make_tuple(
+        genError("There is no v1beta1 policy"),
+        createAppsecPolicyK8sFromV1beta2Crds(maybe_v1beta2_appsec_policy_spec.unpack(), ingress_mode)
+    );
 }
 
 template<class T, class K>
 void
 K8sPolicyUtils::createPolicyFromIngress(
     T &appsec_policy,
-    map<std::string, T> &policies,
+    map<string, T> &policies,
     map<AnnotationKeys, string> &annotations_values,
     const SingleIngressData &item) const
 {
@@ -608,7 +611,7 @@ template<class T, class K>
 void
 K8sPolicyUtils::createPolicyFromActivation(
     T &appsec_policy,
-    map<std::string, T> &policies,
+    map<string, T> &policies,
     const EnabledPolicy &policy) const
 {
     if (policies.find(policy.getName()) == policies.end()) {

components/security_apps/orchestration/orchestration_comp.cc

@@ -1522,6 +1522,12 @@ private:
 
         agent_data_report << make_pair("registeredServer", i_agent_details->getRegisteredServer());
 
+        const char *prometheus_env = getenv("PROMETHEUS");
+        if (prometheus_env != nullptr) {
+            auto enable_prometheus = string(prometheus_env) == "true";
+            agent_data_report << AgentReportFieldWithLabel("enablePrometheus", enable_prometheus ? "true" : "false");
+        }
+
 #if defined(gaia) || defined(smb)
         if (i_details_resolver->compareCheckpointVersion(8100, greater_equal<int>())) {
             agent_data_report << AgentReportFieldWithLabel("isCheckpointVersionGER81", "true");
@@ -2272,4 +2278,4 @@ OrchestrationComp::preload()
     registerExpectedSetting<uint>("successUpgradeInterval");
     registerExpectedConfigFile("orchestration", Config::ConfigFileType::Policy);
     registerExpectedConfigFile("registration-data", Config::ConfigFileType::Policy);
-}
+}

components/security_apps/orchestration/update_communication/fog_authenticator.cc

@@ -227,6 +227,11 @@ FogAuthenticator::registerAgent(
 
     request << make_pair("userEdition", getUserEdition());
 
+    const char *prometheus_env = getenv("PROMETHEUS");
+    if (prometheus_env != nullptr) {
+        request << make_pair("enablePrometheus", string(prometheus_env) == "true" ? "true" : "false");
+    }
+
     if (getDeplymentType() == "Docker" || getDeplymentType() == "K8S") {
         const char *image_version_otp = getenv("IMAGE_VERSION");
         if (image_version_otp) {

nodes/orchestration/package/orchestration_package.sh

@@ -209,6 +209,9 @@ save_local_policy_config()
 if [ -n "${CP_ENV_FILESYSTEM}" ] ; then
     export FILESYSTEM_PATH=$CP_ENV_FILESYSTEM
 fi
+if [ -n "${PROMETHEUS}" ] ; then
+    export PROMETHEUS=$PROMETHEUS
+fi
 if [ -n "${CP_ENV_LOG_FILE}" ] ; then
     LOG_FILE_PATH=$CP_ENV_LOG_FILE
 fi
@@ -433,7 +436,7 @@ if command -v which &>/dev/null; then
     var_which_cmd_exists=1
 fi
 
-if [ $var_arch != "gaia" ] && [ $var_arch != "gaia_arm" ] && [ $var_which_cmd_exists -eq 1 ]; then 
+if [ $var_arch != "gaia" ] && [ $var_arch != "gaia_arm" ] && [ $var_which_cmd_exists -eq 1 ]; then
     if [ -n "$(which systemctl)" ]; then
         var_startup_service="systemd"
     else
@@ -974,7 +977,7 @@ install_orchestration()
         fi
         ${INSTALL_COMMAND} lib/*.so* ${USR_LIB_PATH}/
         ${INSTALL_COMMAND} lib/boost/*.so* ${USR_LIB_PATH}/
-        cp_print "Done successfully doing only unpacking lib64 to Path: ${USR_LIB_PATH}" ${FORCE_STDOUT}	
+        cp_print "Done successfully doing only unpacking lib64 to Path: ${USR_LIB_PATH}" ${FORCE_STDOUT}
         exit 0
     fi
 
@@ -1149,6 +1152,9 @@ install_orchestration()
 		if [ -n "${FILESYSTEM_PATH}" ]; then
 			echo "CP_ENV_FILESYSTEM=${FILESYSTEM_PATH}" >> ${FILESYSTEM_PATH}/${ENV_DETAILS_FILE}
 		fi
+        if [ -n "${PROMETHEUS}" ]; then
+            echo "PROMETHEUS=${PROMETHEUS}" >> ${FILESYSTEM_PATH}/${ENV_DETAILS_FILE}
+        fi
 		if [ -n "${VS_ID}" ]; then
 			echo "CP_VS_ID=${VS_ID}" >> ${FILESYSTEM_PATH}/${ENV_DETAILS_FILE}
 		fi

nodes/orchestration/package/watchdog/watchdog

@@ -115,6 +115,11 @@ load_paths()
     if [ -n "${CP_ENV_LOG_FILE}" ]; then
         LOG_FILE_PATH=$CP_ENV_LOG_FILE
     fi
+
+    if [ -n "${PROMETHEUS}" ]; then
+        export PROMETHEUS=$PROMETHEUS
+    fi
+
     if [ -n "${CP_VS_ID}" ]; then
         VS_ID=${CP_VS_ID}
         VS_EVAL_PREFIX="ip netns exec CTX0000${VS_ID} env"