From 06a2fa05be7d07e8b69d44357d8477e8e09e5ab7 Mon Sep 17 00:00:00 2001 From: dwertent Date: Tue, 15 Mar 2022 22:10:27 +0200 Subject: [PATCH] add ks user to dockerfile --- build/Dockerfile | 8 ++++++-- httphandler/README.md | 7 ++++--- httphandler/examples/microservice/README.md | 2 +- httphandler/handlerequests/v1/datastructure.go | 1 + httphandler/handlerequests/v1/datastructuremethods.go | 5 +++++ 5 files changed, 17 insertions(+), 6 deletions(-) diff --git a/build/Dockerfile b/build/Dockerfile index 4374e2ee..9e1668de 100644 --- a/build/Dockerfile +++ b/build/Dockerfile @@ -30,10 +30,14 @@ RUN python build.py RUN /work/build/ubuntu-latest/kubescape download artifacts -o /work/artifacts FROM alpine + +RUN addgroup -S ks && adduser -S ks -G ks +USER ks + COPY --from=builder /work/httphandler/build/ubuntu-latest/kubescape /usr/bin/kubescape COPY --from=builder /work/build/ubuntu-latest/kubescape /usr/bin/kscli -RUN mkdir $HOME/.kubescape && chmod 777 -R $HOME/.kubescape -COPY --from=builder /work/artifacts/ $HOME/.kubescape +RUN mkdir /home/ks/.kubescape && chmod 777 -R /home/ks/.kubescape +COPY --from=builder /work/artifacts/ /home/ks/.kubescape ENTRYPOINT ["kubescape"] diff --git a/httphandler/README.md b/httphandler/README.md index 82c74707..07a75d41 100644 --- a/httphandler/README.md +++ b/httphandler/README.md @@ -7,12 +7,12 @@ Running `kubescape` will start up a webserver on port `8080` which will serve th * POST `/v1/scan` - Trigger a kubescape scan. The server will return an ID and will execute the scanning asynchronously * * `wait`: scan synchronously (return results and not ID). Use only in small clusters are with an increased timeout * GET `/v1/results` - Request kubescape scan results -* * query `id=` -> ID returned when triggering the scan action. If empty will return latest results +* * query `id=` -> ID returned when triggering the scan action. ~If empty will return latest results~ (not supported) * * query `remove` -> Remove results from storage after reading the results -* DELETE `/v1/results` - Delete kubescape scan results from storage If empty will delete latest results +* DELETE `/v1/results` - Delete kubescape scan results from storage. ~If empty will delete latest results~ (not supported) * * query `id=`: Delete ID of specific results * * query `all`: Delete all cached results -* GET/POST `/v1/metrics` - will trigger cluster scan. will respond with prometheus metrics once they have been scanned. This will respond 503 if the scan failed. +* GET/POST `/metrics` - will trigger cluster scan. will respond with prometheus metrics once they have been scanned. This will respond 503 if the scan failed. * `/livez` - will respond 200 is server is alive * `/readyz` - will respond 200 if server can receive requests @@ -25,6 +25,7 @@ body: "format": , // results format [default: json] (same as 'kubescape scan --format') "excludedNamespaces": <[]str>, // list of namespaces to exclude (same as 'kubescape scan --excluded-namespaces') "includeNamespaces": <[]str>, // list of namespaces to include (same as 'kubescape scan --include-namespaces') + "useCachedArtifacts"`: , // use the cached artifacts instead of downloading (offline support) "submit": , // submit results to Kubescape cloud (same as 'kubescape scan --submit') "hostScanner": , // deploy kubescape K8s host-scanner DaemonSet in the scanned cluster (same as 'kubescape scan --enable-host-scan') "keepLocal": , // do not submit results to Kubescape cloud (same as 'kubescape scan --keep-local') diff --git a/httphandler/examples/microservice/README.md b/httphandler/examples/microservice/README.md index c6b7185d..4d0ce74c 100644 --- a/httphandler/examples/microservice/README.md +++ b/httphandler/examples/microservice/README.md @@ -17,4 +17,4 @@ 3. Get results ```bash curl --request GET http://127.0.0.1:8080/v1/results -o results.json - ``` \ No newline at end of file + ``` diff --git a/httphandler/handlerequests/v1/datastructure.go b/httphandler/handlerequests/v1/datastructure.go index 156b0fa5..1fac02e1 100644 --- a/httphandler/handlerequests/v1/datastructure.go +++ b/httphandler/handlerequests/v1/datastructure.go @@ -9,6 +9,7 @@ type PostScanRequest struct { HostScanner bool `json:"hostScanner"` // Deploy ARMO K8s host scanner to collect data from certain controls KeepLocal bool `json:"keepLocal"` // Do not submit results Account string `json:"account"` // account ID + UseCachedArtifacts bool `json:"useCachedArtifacts"` // Use the cached artifacts instead of downloading Logger string `json:"-"` // logger level - debug/info/error - default is debug TargetType string `json:"-"` // framework/control - default is framework TargetNames []string `json:"-"` // default is all diff --git a/httphandler/handlerequests/v1/datastructuremethods.go b/httphandler/handlerequests/v1/datastructuremethods.go index ad6f6cfd..4cf50616 100644 --- a/httphandler/handlerequests/v1/datastructuremethods.go +++ b/httphandler/handlerequests/v1/datastructuremethods.go @@ -4,6 +4,7 @@ import ( "strings" "github.com/armosec/kubescape/core/cautils" + "github.com/armosec/kubescape/core/cautils/getter" ) func (scanRequest *PostScanRequest) ToScanInfo() *cautils.ScanInfo { @@ -15,6 +16,10 @@ func (scanRequest *PostScanRequest) ToScanInfo() *cautils.ScanInfo { scanInfo.Format = scanRequest.Format // TODO - handle default + if scanRequest.UseCachedArtifacts { + scanInfo.UseArtifactsFrom = getter.DefaultLocalStore // Load files from cache (this will prevent kubescape fom downloading the artifacts every time) + } + scanInfo.Local = scanRequest.KeepLocal scanInfo.Submit = scanRequest.Submit scanInfo.HostSensorEnabled.SetBool(scanRequest.HostScanner)