diff --git a/core/core/scan.go b/core/core/scan.go index efe5e6e8..56dc29c4 100644 --- a/core/core/scan.go +++ b/core/core/scan.go @@ -19,8 +19,6 @@ import ( "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/reporter" apisv1 "github.com/kubescape/opa-utils/httpserver/apis/v1" "go.opentelemetry.io/otel" - "go.opentelemetry.io/otel/attribute" - "go.opentelemetry.io/otel/trace" "github.com/kubescape/opa-utils/resources" ) @@ -35,7 +33,7 @@ type componentInterfaces struct { } func getInterfaces(ctx context.Context, scanInfo *cautils.ScanInfo) componentInterfaces { - ctx, span := otel.Tracer("").Start(ctx, "getInterfaces") + ctx, span := otel.Tracer("").Start(ctx, "setup interfaces") defer span.End() // ================== setup k8s interface object ====================================== @@ -121,25 +119,11 @@ func getInterfaces(ctx context.Context, scanInfo *cautils.ScanInfo) componentInt } func (ks *Kubescape) Scan(ctx context.Context, scanInfo *cautils.ScanInfo) (*resultshandling.ResultsHandler, error) { - ctx, spanScan := otel.Tracer("").Start(ctx, "kubescape.Scan") - defer spanScan.End() - - // scanInfo.FailThreshold - spanScan.AddEvent("getting previous container logs", - trace.WithAttributes(attribute.String("scanID", scanInfo.ScanID)), - trace.WithAttributes(attribute.Bool("scanAll", scanInfo.ScanAll)), - trace.WithAttributes(attribute.Bool("HostSensorEnabled", scanInfo.HostSensorEnabled.GetBool())), - trace.WithAttributes(attribute.String("excludedNamespaces", scanInfo.ExcludedNamespaces)), - trace.WithAttributes(attribute.String("includeNamespaces", scanInfo.IncludeNamespaces)), - trace.WithAttributes(attribute.String("hostSensorYamlPath", scanInfo.HostSensorYamlPath)), - trace.WithAttributes(attribute.String("kubeContext", scanInfo.KubeContext)), - ) + ctxInit, spanInit := otel.Tracer("").Start(ctx, "initialization") logger.L().Info("Kubescape scanner starting") // ===================== Initialization ===================== - ctxInit, spanInit := otel.Tracer("").Start(ctx, "initialization") - scanInfo.Init(ctxInit) // initialize scan info interfaces := getInterfaces(ctxInit, scanInfo) @@ -151,10 +135,10 @@ func (ks *Kubescape) Scan(ctx context.Context, scanInfo *cautils.ScanInfo) (*res downloadReleasedPolicy := getter.NewDownloadReleasedPolicy() // download config inputs from github release // set policy getter only after setting the customerGUID - scanInfo.Getters.PolicyGetter = getPolicyGetter(ctx, scanInfo.UseFrom, interfaces.tenantConfig.GetTenantEmail(), scanInfo.FrameworkScan, downloadReleasedPolicy) - scanInfo.Getters.ControlsInputsGetter = getConfigInputsGetter(ctx, scanInfo.ControlsInputs, interfaces.tenantConfig.GetAccountID(), downloadReleasedPolicy) - scanInfo.Getters.ExceptionsGetter = getExceptionsGetter(ctx, scanInfo.UseExceptions, interfaces.tenantConfig.GetAccountID(), downloadReleasedPolicy) - scanInfo.Getters.AttackTracksGetter = getAttackTracksGetter(ctx, scanInfo.AttackTracks, interfaces.tenantConfig.GetAccountID(), downloadReleasedPolicy) + scanInfo.Getters.PolicyGetter = getPolicyGetter(ctxInit, scanInfo.UseFrom, interfaces.tenantConfig.GetTenantEmail(), scanInfo.FrameworkScan, downloadReleasedPolicy) + scanInfo.Getters.ControlsInputsGetter = getConfigInputsGetter(ctxInit, scanInfo.ControlsInputs, interfaces.tenantConfig.GetAccountID(), downloadReleasedPolicy) + scanInfo.Getters.ExceptionsGetter = getExceptionsGetter(ctxInit, scanInfo.UseExceptions, interfaces.tenantConfig.GetAccountID(), downloadReleasedPolicy) + scanInfo.Getters.AttackTracksGetter = getAttackTracksGetter(ctxInit, scanInfo.AttackTracks, interfaces.tenantConfig.GetAccountID(), downloadReleasedPolicy) // TODO - list supported frameworks/controls if scanInfo.ScanAll { @@ -164,35 +148,37 @@ func (ks *Kubescape) Scan(ctx context.Context, scanInfo *cautils.ScanInfo) (*res // remove host scanner components defer func() { if err := interfaces.hostSensorHandler.TearDown(); err != nil { - logger.L().Ctx(ctxInit).Error("failed to tear down host scanner", helpers.Error(err)) + logger.L().Ctx(ctx).Error("failed to tear down host scanner", helpers.Error(err)) } }() resultsHandling := resultshandling.NewResultsHandler(interfaces.report, interfaces.outputPrinters, interfaces.uiPrinter) - spanInit.End() // ===================== policies & resources ===================== - ctxPolicies, spanPolicies := otel.Tracer("").Start(ctx, "policies & resources") + ctxPolicies, spanPolicies := otel.Tracer("").Start(ctxInit, "policies & resources") policyHandler := policyhandler.NewPolicyHandler(interfaces.resourceHandler) scanData, err := policyHandler.CollectResources(ctxPolicies, scanInfo.PolicyIdentifier, scanInfo) if err != nil { + spanInit.End() return resultsHandling, err } spanPolicies.End() + spanInit.End() // ========================= opa testing ===================== ctxOpa, spanOpa := otel.Tracer("").Start(ctx, "opa testing") + defer spanOpa.End() + deps := resources.NewRegoDependenciesData(k8sinterface.GetK8sConfig(), interfaces.tenantConfig.GetContextName()) reportResults := opaprocessor.NewOPAProcessor(scanData, deps) if err := reportResults.ProcessRulesListenner(ctxOpa, cautils.NewProgressHandler("")); err != nil { // TODO - do something return resultsHandling, fmt.Errorf("%w", err) } - spanOpa.End() // ======================== prioritization =================== - _, spanPrioritization := otel.Tracer("").Start(ctx, "prioritization") - if priotizationHandler, err := resourcesprioritization.NewResourcesPrioritizationHandler(ctx, scanInfo.Getters.AttackTracksGetter, scanInfo.PrintAttackTree); err != nil { + _, spanPrioritization := otel.Tracer("").Start(ctxOpa, "prioritization") + if priotizationHandler, err := resourcesprioritization.NewResourcesPrioritizationHandler(ctxOpa, scanInfo.Getters.AttackTracksGetter, scanInfo.PrintAttackTree); err != nil { logger.L().Ctx(ctx).Warning("failed to get attack tracks, this may affect the scanning results", helpers.Error(err)) } else if err := priotizationHandler.PrioritizeResources(scanData); err != nil { return resultsHandling, fmt.Errorf("%w", err) diff --git a/httphandler/handlerequests/v1/requestshandlerutils.go b/httphandler/handlerequests/v1/requestshandlerutils.go index 017c18bb..f38cc73b 100644 --- a/httphandler/handlerequests/v1/requestshandlerutils.go +++ b/httphandler/handlerequests/v1/requestshandlerutils.go @@ -18,6 +18,9 @@ import ( utilsapisv1 "github.com/kubescape/opa-utils/httpserver/apis/v1" utilsmetav1 "github.com/kubescape/opa-utils/httpserver/meta/v1" reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2" + "go.opentelemetry.io/otel" + "go.opentelemetry.io/otel/attribute" + "go.opentelemetry.io/otel/trace" ) // executeScan execute the scan request passed in the channel @@ -53,7 +56,21 @@ func (handler *HTTPHandler) executeScan() { } } func scan(ctx context.Context, scanInfo *cautils.ScanInfo, scanID string) (*reporthandlingv2.PostureReport, error) { + ctx, spanScan := otel.Tracer("").Start(ctx, "kubescape.scan") + defer spanScan.End() + ks := core.NewKubescape() + + spanScan.AddEvent("scanning metadata", + trace.WithAttributes(attribute.String("scanID", scanInfo.ScanID)), + trace.WithAttributes(attribute.Bool("scanAll", scanInfo.ScanAll)), + trace.WithAttributes(attribute.Bool("HostSensorEnabled", scanInfo.HostSensorEnabled.GetBool())), + trace.WithAttributes(attribute.String("excludedNamespaces", scanInfo.ExcludedNamespaces)), + trace.WithAttributes(attribute.String("includeNamespaces", scanInfo.IncludeNamespaces)), + trace.WithAttributes(attribute.String("hostSensorYamlPath", scanInfo.HostSensorYamlPath)), + trace.WithAttributes(attribute.String("kubeContext", scanInfo.KubeContext)), + ) + result, err := ks.Scan(ctx, scanInfo) if err != nil { return nil, writeScanErrorToFile(err, scanID)