fix(docker): honor DISABLE_* hub knobs when the agent is disabled - #4615
fix(docker): honor DISABLE_* hub knobs when the agent is disabled#4615hamodywe wants to merge 1 commit into
Conversation
The default hub items are copied into /etc/crowdsec by the staging step, which is not gated on DISABLE_AGENT. The knobs that remove them live in prepare_hub(), which returns early when the agent is disabled. So a LAPI-only container (DISABLE_AGENT=true) keeps the collections it was explicitly told to drop: DISABLE_COLLECTIONS=crowdsecurity/linux has no effect, and the collection stays listed in cscli collections list. Move the removal block into remove_hub_items() and call it on the paths that return early, so removal follows the same rule as the copy it is meant to undo. Installing hub items still requires the agent, so that path is unchanged. Fixes crowdsecurity#4563 Signed-off-by: hamodywe <iosapk.org@gmail.com>
|
@hamodywe: There are no 'kind' label on this PR. You need a 'kind' label to generate the release automatically.
DetailsI am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository. |
|
@hamodywe: There are no area labels on this PR. You can add as many areas as you see fit.
DetailsI am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository. |
|
/kind fix |
|
/area configuration |
github-actions
Bot
added
kind/fix
area/configuration
and removed
needs/kind
needs/area
labels
1 participant
Fixes #4563.
The problem
The reporter root-caused this precisely, so briefly: the default hub items are copied into
/etc/crowdsecby the stagingrsync, which is not gated onDISABLE_AGENT. The knobs that remove them live inprepare_hub(), which returns early when the agent is disabled.The copy is unconditional but the removal is agent-gated, so a LAPI-only container (
DISABLE_AGENT=true, used purely as a decision store fed by CAPI) keeps the collections it was explicitly told to drop.DISABLE_COLLECTIONS=crowdsecurity/linuxhas no effect and the collection stays incscli collections list.The change
The removal block moves into
remove_hub_items(), which is called on the two paths that return early as well as at the end of the normal path. Removal now follows the same rule as the copy it is meant to undo.Installing hub items still requires the agent, so that path is unchanged — this only makes the
DISABLE_*knobs apply wherever the items can actually be present.It covers all seven knobs, not just
DISABLE_COLLECTIONS, since they are gated by the same early return: parsers, scenarios, postoverflows, contexts, appsec-configs and appsec-rules had the same problem.Verification
Since this path needs a built image and a LAPI-only container to exercise end to end, I verified it by extracting
prepare_hub/remove_hub_itemsand running them against stubbedcscli_if_clean/istrue/conf_get, capturing thecsclicalls:DISABLE_AGENT=true,DISABLE_COLLECTIONS=crowdsecurity/linuxcsclicalls at all — the knob is silently ignored, which is the reported bugcollections remove crowdsecurity/linux --forceCOLLECTIONSandDISABLE_COLLECTIONSsetparsers install …,collections install crowdsecurity/nginx,collections remove crowdsecurity/linux --forceshellcheckis clean on the result (run on the LF-normalised file; my checkout is CRLF).Happy to add a case to
build/docker/testinstead if you would rather have it covered there — I did not want to guess at the fixture conventions.