enforcer(bpf): automatically mount bpffs

[DelusionalOptimist]

Signed-off-by: Rudraksh Pareek rudraksh@accuknox.comPurpose of PR?:

May fix #1005

Does this PR introduce a breaking change?
Nope

If the changes in this PR are manually verified, list down the scenarios covered::

• Tested on k3s using kubearmor-test-k3s.yaml
  • bpffs is not mounted on the host (umount /sys/fs/bpf) - kubearmor-init now mounts it when deployed
  • bpffs is mounted on the host - no changes

Additional information for reviewer? :
Mention if this PR is part of any design or a continuation of previous PRs
Though SYS_ADMIN capability should be enough for mounting filesystems but bpffs needs the container to be privileged.

Checklist:

• Bug fix. Fixes #
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update
• PR Title follows the convention of <type>(<scope>): <subject>
• Commit has unit tests
• Commit has integration tests

[DelusionalOptimist]

Update - Cilium too uses a privileged init Mount-bpf container for bidirectional mounting and the cilium-agent is unprivileged by default but may be privileged if specified through helm values. Mount-bpf does the mounting work when Cilium is running in K8s.

However the logic we've implemented now would create /sys/fs/bpf in kubearmor's container if it wasn't mounted on host and mount the bpffs in it. The host would remain undisturbed and we could bypass the need for privileged container.
Also, @daemon1024 pointed out that we don't really need persistence of bpf maps so even if kubearmor pod was killed, the policies will remain intact and be restored on restart (we also tried this out).
In case Kubearmor is running outside K8s, it would mount bpffs itself if not already mounted.

cc @nyrahul @kranurag7

[nyrahul]

Mostly LGTM. Please check for review comment inline.

[daemon1024]

LGTM, just one minor nit

[achrefbensaad]

LGTM!. Needs to be tested on AZL2 before merging.

[nyrahul]

LGTM

[DelusionalOptimist]

Tested on AL2. Good to merge.