ROX-30577: Add process baseline auto locking to cluster config

[JoukoVirtanen]

Description

Adds auto locking to the cluster protobuf. Also makes it so that the cluster configuration is used to control auto locking. Thus it will be possible to control process baseline auto locking at the cluster level. The feature flag is still in place and in order to enable process baseline auto locking for a cluster the feature flag needs to be enabled and it needs to be enabled for the cluster via the cluster config.

After this change it will not be possible to control this new cluster field via helm or operator. That will be done in other PRs.

The PR to control process baseline auto-locking via helm can be found here #16462

This PR replaces #16427

User-facing documentation

• CHANGELOG.md is updated OR update is not needed
• documentation PR is created and is linked above OR is not needed

Testing and quality

• the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
• CI results are inspected

Automated testing

• added unit tests
• added e2e tests
• added regression tests
• added compatibility tests
• modified existing tests

How I validated my change

et the following environment variables

export ROX_BASELINE_GENERATION_DURATION=5m
export ROX_AUTOLOCK_PROCESS_BASELINES=true

Deployed ACS.

Created a pod that could be used to run some processes and entered it.

kubectl run ubuntu-pod --image=ubuntu --restart=Never --command -- sleep infinity
kubectl exec ubuntu-pod -it -- /bin/bash

Logged into the UI and checked "Risk".

The process baseline was still unlocked after more than five minutes.

Ran the following script to enable process baseline auto locking for the cluster

#!/usr/bin/env bash
set -eou pipefail

ROX_ENDPOINT=${1:-https://localhost:8000}

start_time=$(date +%s)

json_clusters="$(curl --location --silent --request GET "${ROX_ENDPOINT}/v1/clusters" -k -H "Authorization: Bearer $ROX_API_TOKEN")"

json_cluster="$(echo "$json_clusters" | jq .clusters.[0])"
id="$(echo "$json_cluster" | jq -r .id)"

json_cluster="$(echo "$json_cluster" | jq '.dynamicConfig.autoLockProcessBaseline.enabled = true')"
echo "$json_cluster" | jq

echo
echo
echo
echo

json_clusters_response="$(curl --location --silent --request PUT "${ROX_ENDPOINT}/v1/clusters/${id}" -k -H "Authorization: Bearer $ROX_API_TOKEN" --data "$json_cluster")"

json_clusters="$(curl --location --silent --request GET "${ROX_ENDPOINT}/v1/clusters" -k -H "Authorization: Bearer $ROX_API_TOKEN")"
echo "$json_clusters" | jq

Created another pod, entered it, and ran a command

kubectl run ubuntu-pod-2 --image=ubuntu --restart=Never --command -- sleep infinity
kubectl exec ubuntu-pod-2 -it -- /bin/bash
cat /proc/1/net/tcp

Initially the process baseline is unlocked.

After a little more than five minutes the baseline is locked.

Running a new process results in a violation

tac /proc/1/net/tcp

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[rhacs-bot]

Images are ready for the commit at eda74d4.

To use with deploy scripts, first export MAIN_IMAGE_TAG=4.9.x-678-geda74d4721.

[codecov]

Codecov Report

❌ Patch coverage is 25.37313% with 50 lines in your changes missing coverage. Please review.
✅ Project coverage is 48.62%. Comparing base (cdacdd2) to head (eda74d4).
⚠️ Report is 17 commits behind head on master.

Files with missing lines	Patch %	Lines
central/graphql/resolvers/generated.go	10.52%	34 Missing ⚠️
central/detection/lifecycle/manager_impl.go	50.00%	9 Missing and 4 partials ⚠️
central/detection/lifecycle/manager.go	0.00%	2 Missing ⚠️
central/detection/lifecycle/singleton.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##           master   #16669       +/-   ##
===========================================
+ Coverage   47.97%   48.62%    +0.65%     
===========================================
  Files         768     2664     +1896     
  Lines       79004   199398   +120394     
===========================================
+ Hits        37903    96963    +59060     
- Misses      37648    94835    +57187     
- Partials     3453     7600     +4147     

Flag	Coverage Δ
go-unit-tests	48.62% <25.37%> (+0.65%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[openshift-ci]

@JoukoVirtanen: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/ocp-4-12-qa-e2e-tests	eda74d4	link	false	/test ocp-4-12-qa-e2e-tests
ci/prow/ocp-4-19-qa-e2e-tests	eda74d4	link	false	/test ocp-4-19-qa-e2e-tests

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.