github/kube-hunter
1
0
Fork 0
mirror of https://github.com/aquasecurity/kube-hunter.git synced 2026-05-11 11:47:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed PR comment: Added proper exception handling.

Browse Source 
Added logging for this hunter.
This commit is contained in:
ori.agmon
2018-10-14 12:27:54 +03:00
committed by oriagmon
parent ad5a4eba86
commit 7a006ef51e
1 changed files with 21 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
src/modules/hunting/apiserver.py
View File

@@ -37,23 +37,29 @@ class AccessApiServerViaServiceAccountToken(Hunter):
def access_api_server(self):
logging.debug(self.event.host)
res = requests.get("https://{host}:{port}/api".format(host=self.event.host, port=6443), headers={'Authorization': 'Bearer ' + self.service_account_token_evidence},
verify=False)
self.api_server_evidence = res.content
return res.status_code == 200 and res.content != ''
logging.debug('Passive Hunter is attempting to access the API server using the pod\'s service account token')
try:
res = requests.get("https://{host}:{port}/api".format(host=self.event.host, port=6443),
headers={'Authorization': 'Bearer ' + self.service_account_token_evidence}, verify=False)
self.api_server_evidence = res.content
return res.status_code == 200 and res.content != ''
except requests.exceptions.ConnectionError: # e.g. DNS failure, refused connection, etc
return False
def get_service_account_token(self):
logging.debug(self.event.host)
with open('/var/run/secrets/kubernetes.io/serviceaccount/token', 'r') as token:
data = token.read()
self.service_account_token_evidence = data
return True
logging.debug('Passive Hunter is attempting to access pod\'s service account token')
try:
with open('/var/run/secrets/kubernetes.io/serviceaccount/token', 'r') as token:
data = token.read()
self.service_account_token_evidence = data
return True
except IOError: # Couldn't read file
return False
def execute(self):
try:
if self.get_service_account_token():
self.publish_event(ServiceAccountTokenAccess(self.service_account_token_evidence))
if self.access_api_server():
self.publish_event(ServerApiAccess(self.api_server_evidence))
except: #We dont want to interrupt the program on any connection error)
pass
if self.get_service_account_token():
self.publish_event(ServiceAccountTokenAccess(self.service_account_token_evidence))
if self.access_api_server():
self.publish_event(ServerApiAccess(self.api_server_evidence))