From 2b3fcca7e8476b80dd1d073eab8e2bea98b37277 Mon Sep 17 00:00:00 2001 From: Amir Malka Date: Wed, 16 Nov 2022 12:12:40 +0200 Subject: [PATCH] omit raw resources flag in json output --- cmd/scan/control.go | 4 ++++ cmd/scan/framework.go | 4 +++- cmd/scan/scan.go | 2 ++ core/cautils/datastructures.go | 12 +++++++----- core/cautils/scaninfo.go | 1 + core/core/scan.go | 4 ++++ core/pkg/resultshandling/printer/v2/utils.go | 4 +++- 7 files changed, 24 insertions(+), 7 deletions(-) diff --git a/cmd/scan/control.go b/cmd/scan/control.go index f414d913..7d6a8ace 100644 --- a/cmd/scan/control.go +++ b/cmd/scan/control.go @@ -120,6 +120,10 @@ func getControlCmd(ks meta.IKubescape, scanInfo *cautils.ScanInfo) *cobra.Comman func validateControlScanInfo(scanInfo *cautils.ScanInfo) error { severity := scanInfo.FailThresholdSeverity + if scanInfo.Submit && scanInfo.OmitRawResources { + return fmt.Errorf("you can use `omit-raw-resources` or `submit`, but not both") + } + if err := validateSeverity(severity); severity != "" && err != nil { return err } diff --git a/cmd/scan/framework.go b/cmd/scan/framework.go index 70002c57..7d0b584e 100644 --- a/cmd/scan/framework.go +++ b/cmd/scan/framework.go @@ -201,7 +201,9 @@ func validateFrameworkScanInfo(scanInfo *cautils.ScanInfo) error { if 100 < scanInfo.FailThreshold || 0 > scanInfo.FailThreshold { return fmt.Errorf("bad argument: out of range threshold") } - + if scanInfo.Submit && scanInfo.OmitRawResources { + return fmt.Errorf("you can use `omit-raw-resources` or `submit`, but not both") + } severity := scanInfo.FailThresholdSeverity if err := validateSeverity(severity); severity != "" && err != nil { return err diff --git a/cmd/scan/scan.go b/cmd/scan/scan.go index f5e4d94b..77f6c930 100644 --- a/cmd/scan/scan.go +++ b/cmd/scan/scan.go @@ -88,11 +88,13 @@ func GetScanCommand(ks meta.IKubescape) *cobra.Command { scanCmd.PersistentFlags().StringVar(&scanInfo.FormatVersion, "format-version", "v1", "Output object can be different between versions, this is for maintaining backward and forward compatibility. Supported:'v1'/'v2'") scanCmd.PersistentFlags().StringVar(&scanInfo.CustomClusterName, "cluster-name", "", "Set the custom name of the cluster. Not same as the kube-context flag") scanCmd.PersistentFlags().BoolVarP(&scanInfo.Submit, "submit", "", false, "Submit the scan results to Kubescape SaaS where you can see the results in a user-friendly UI, choose your preferred compliance framework, check risk results history and trends, manage exceptions, get remediation recommendations and much more. By default the results are not submitted") + scanCmd.PersistentFlags().BoolVarP(&scanInfo.OmitRawResources, "omit-raw-resources", "", false, "Omit raw resources from the output. By default the raw resources are included in the output") scanCmd.PersistentFlags().MarkDeprecated("silent", "use '--logger' flag instead. Flag will be removed at 1.May.2022") // hidden flags scanCmd.PersistentFlags().MarkHidden("host-scan-yaml") // this flag should be used very cautiously. We prefer users will not use it at all unless the DaemonSet can not run pods on the nodes + scanCmd.PersistentFlags().MarkHidden("omit-raw-resources") // Retrieve --kubeconfig flag from https://github.com/kubernetes/kubectl/blob/master/pkg/cmd/cmd.go scanCmd.PersistentFlags().AddGoFlag(flag.Lookup("kubeconfig")) diff --git a/core/cautils/datastructures.go b/core/cautils/datastructures.go index 51c83843..49b3c6a5 100644 --- a/core/cautils/datastructures.go +++ b/core/cautils/datastructures.go @@ -18,18 +18,19 @@ type OPASessionObj struct { K8SResources *K8SResources // input k8s objects ArmoResource *KSResources // input ARMO objects AllPolicies *Policies // list of all frameworks - Policies []reporthandling.Framework // list of frameworks to scan AllResources map[string]workloadinterface.IMetadata // all scanned resources, map[] ResourcesResult map[string]resourcesresults.Result // resources scan results, map[] ResourceSource map[string]reporthandling.Source // resources sources, map[] ResourcesPrioritized map[string]prioritization.PrioritizedResource // resources prioritization information, map[] Report *reporthandlingv2.PostureReport // scan results v2 - Remove - Exceptions []armotypes.PostureExceptionPolicy // list of exceptions to apply on scan results RegoInputData RegoInputData // input passed to rego for scanning. map[][] Metadata *reporthandlingv2.Metadata - InfoMap map[string]apis.StatusInfo // Map errors of resources to StatusInfo - ResourceToControlsMap map[string][]string // map[] = [] - SessionID string // SessionID + InfoMap map[string]apis.StatusInfo // Map errors of resources to StatusInfo + ResourceToControlsMap map[string][]string // map[] = [] + SessionID string // SessionID + Policies []reporthandling.Framework // list of frameworks to scan + Exceptions []armotypes.PostureExceptionPolicy // list of exceptions to apply on scan results + OmitRawResources bool // omit raw resources from output } func NewOPASessionObj(frameworks []reporthandling.Framework, k8sResources *K8SResources, scanInfo *ScanInfo) *OPASessionObj { @@ -45,6 +46,7 @@ func NewOPASessionObj(frameworks []reporthandling.Framework, k8sResources *K8SRe ResourceSource: make(map[string]reporthandling.Source), SessionID: scanInfo.ScanID, Metadata: scanInfoToScanMetadata(scanInfo), + OmitRawResources: scanInfo.OmitRawResources, } } diff --git a/core/cautils/scaninfo.go b/core/cautils/scaninfo.go index 21bea2dc..d8c35f83 100644 --- a/core/cautils/scaninfo.go +++ b/core/cautils/scaninfo.go @@ -127,6 +127,7 @@ type ScanInfo struct { KubeContext string // context name FrameworkScan bool // false if scanning control ScanAll bool // true if scan all frameworks + OmitRawResources bool // true if omit raw resources from the output } type Getters struct { diff --git a/core/core/scan.go b/core/core/scan.go index 1d9570ab..f17405c0 100644 --- a/core/core/scan.go +++ b/core/core/scan.go @@ -54,6 +54,10 @@ func getInterfaces(scanInfo *cautils.ScanInfo) componentInterfaces { if err := tenantConfig.SetTenant(); err != nil { logger.L().Error(err.Error()) } + + if scanInfo.OmitRawResources { + logger.L().Warning("omit-raw-resources flag will be ignored in submit mode") + } } // ================== version testing ====================================== diff --git a/core/pkg/resultshandling/printer/v2/utils.go b/core/pkg/resultshandling/printer/v2/utils.go index 4933c09e..c071246c 100644 --- a/core/pkg/resultshandling/printer/v2/utils.go +++ b/core/pkg/resultshandling/printer/v2/utils.go @@ -27,7 +27,9 @@ func FinalizeResults(data *cautils.OPASessionObj) *reporthandlingv2.PostureRepor report.Results = make([]resourcesresults.Result, len(data.ResourcesResult)) finalizeResults(report.Results, data.ResourcesResult, data.ResourcesPrioritized) - report.Resources = finalizeResources(report.Results, data.AllResources, data.ResourceSource) + if !data.OmitRawResources { + report.Resources = finalizeResources(report.Results, data.AllResources, data.ResourceSource) + } return &report }