From 0c79df7299c693e4df7be40130c07aaf86611bff Mon Sep 17 00:00:00 2001 From: dwertent Date: Mon, 11 Oct 2021 16:29:26 +0300 Subject: [PATCH] restore id after local run, update readme --- README.md | 5 +++-- cautils/customerloader.go | 3 +++ cmd/config.go | 1 - cmd/framework.go | 28 ++++++++++++++++++---------- 4 files changed, 24 insertions(+), 13 deletions(-) diff --git a/README.md b/README.md index 5208d8a9..bf984bd0 100644 --- a/README.md +++ b/README.md @@ -80,18 +80,19 @@ Set-ExecutionPolicy RemoteSigned -scope CurrentUser | `--exceptions` | | Path to an [exceptions obj](examples/exceptions.json). If not set will download exceptions from Armo management portal | | `--submit` | `false` | If set, Kubescape will send scan results to Armo management portal to allow users to control exceptions and maintain chronological scan results. By default the results are not sent | `true`/`false`| | `--local` | `false` | Kubescape will not send scan results to Armo management portal. Use this flag if you ran with the `--submit` flag in the past and you do not want to submit your current scan results | `true`/`false`| +| `--account` | | Armo portal account ID. Default will load account ID from configMap or config file | | ## Usage & Examples ### Examples -* Scan a running Kubernetes cluster with [`nsa`](https://www.nsa.gov/News-Features/Feature-Stories/Article-View/Article/2716980/nsa-cisa-release-kubernetes-hardening-guidance/) framework and submit results to Armo portal +* Scan a running Kubernetes cluster with [`nsa`](https://www.nsa.gov/News-Features/Feature-Stories/Article-View/Article/2716980/nsa-cisa-release-kubernetes-hardening-guidance/) framework and submit results to [Armo portal](https://portal.armo.cloud/) ``` kubescape scan framework nsa --exclude-namespaces kube-system,kube-public --submit ``` -* Scan a running Kubernetes cluster with [`mitre`](https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/) framework and submit results to Armo portal +* Scan a running Kubernetes cluster with [`mitre`](https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/) framework and submit results to [Armo portal](https://portal.armo.cloud/) ``` kubescape scan framework mitre --exclude-namespaces kube-system,kube-public --submit ``` diff --git a/cautils/customerloader.go b/cautils/customerloader.go index 3b08ea28..339c4ddf 100644 --- a/cautils/customerloader.go +++ b/cautils/customerloader.go @@ -76,6 +76,9 @@ func ClusterConfigSetup(scanInfo *ScanInfo, k8s *k8sinterface.KubernetesApi, beA */ clusterConfig := NewClusterConfig(k8s, beAPI) + if err := clusterConfig.SetCustomerGUID(scanInfo.Account); err != nil { + fmt.Println(err) + } if !IsSubmitted(clusterConfig) { if scanInfo.Submit { return clusterConfig // submit - Create tenant & Submit report diff --git a/cmd/config.go b/cmd/config.go index 9b4e4d4a..10b0f3ec 100644 --- a/cmd/config.go +++ b/cmd/config.go @@ -10,7 +10,6 @@ var configCmd = &cobra.Command{ Short: "Set configuration", Long: ``, Run: func(cmd *cobra.Command, args []string) { - }, } diff --git a/cmd/framework.go b/cmd/framework.go index 222d3056..f4589e3b 100644 --- a/cmd/framework.go +++ b/cmd/framework.go @@ -95,20 +95,16 @@ func init() { frameworkCmd.Flags().StringVarP(&scanInfo.Output, "output", "o", "", "Output file. Print output to file and not stdout") frameworkCmd.Flags().BoolVarP(&scanInfo.Silent, "silent", "s", false, "Silent progress messages") frameworkCmd.Flags().Uint16VarP(&scanInfo.FailThreshold, "fail-threshold", "t", 0, "Failure threshold is the percent bellow which the command fails and returns exit code 1") - frameworkCmd.Flags().BoolVarP(&scanInfo.DoNotSendResults, "results-locally", "", false, "Kubescape sends scan results to Armo backend to allow users to control exceptions and maintain chronological scan results. Use this flag if you do not wish to use these features") + frameworkCmd.Flags().BoolVarP(&scanInfo.DoNotSendResults, "results-locally", "", false, "Deprecated. Please use `--local` instead") frameworkCmd.Flags().BoolVarP(&scanInfo.Submit, "submit", "", false, "Use this flag if you wish to send your Kubescape results to Armo backend to control exceptions and maintain chronological scan results. By default the results are not submitted") frameworkCmd.Flags().BoolVarP(&scanInfo.Local, "local", "", false, "If you do not want your Kubescape results reported to Armo backend. Use this flag if you ran with the `--submit` flag in the past and you do not want to submit your current scan results") - frameworkCmd.Flags().StringVarP(&scanInfo.Account, "account", "", "", "Account ID. Default will load accout ID from configMap/file") + frameworkCmd.Flags().StringVarP(&scanInfo.Account, "account", "", "", "Armo portal account ID. Default will load account ID from configMap or config file") } func CliSetup() error { flag.Parse() - - if 100 < scanInfo.FailThreshold { - fmt.Println("bad argument: out of range threshold") - os.Exit(1) - } + flagValidation() var k8s *k8sinterface.KubernetesApi if !scanInfo.ScanRunningCluster() { @@ -126,9 +122,6 @@ func CliSetup() error { // setup cluster config clusterConfig := cautils.ClusterConfigSetup(&scanInfo, k8s, getter.NewArmoAPI()) - if err := clusterConfig.SetCustomerGUID(scanInfo.Account); err != nil { - fmt.Println(err) - } cautils.CustomerGUID = clusterConfig.GetCustomerGUID() cautils.ClusterName = k8sinterface.GetClusterName() @@ -188,3 +181,18 @@ func (clihandler *CLIHandler) Scan() error { } return nil } + +func flagValidation() { + if scanInfo.DoNotSendResults { + fmt.Println("Deprecated. Please use `--local` instead") + } + + if scanInfo.Submit && scanInfo.Local { + fmt.Println("You can use `local` or `submit`, but not both") + os.Exit(1) + } + if 100 < scanInfo.FailThreshold { + fmt.Println("bad argument: out of range threshold") + os.Exit(1) + } +}