From 2a5712bd3c8246324018cb76785197d8b3620ad7 Mon Sep 17 00:00:00 2001 From: dwertent Date: Tue, 5 Oct 2021 16:11:41 +0300 Subject: [PATCH 1/7] fixed in cluster crash --- build/Dockerfile | 3 +++ cautils/k8sinterface/k8sconfig.go | 13 +++++++++---- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/build/Dockerfile b/build/Dockerfile index 008bc618..caf221cd 100644 --- a/build/Dockerfile +++ b/build/Dockerfile @@ -10,4 +10,7 @@ RUN GOOS=linux CGO_ENABLED=0 go build -ldflags="-s -w " -installsuffix cgo -o k FROM alpine COPY --from=builder /work/kubescape /usr/bin/kubescape +# # Download the frameworks. Use the "--use-default" flag when running kubescape +# RUN kubescape download framework nsa && kubescape download framework mitre + CMD ["kubescape"] diff --git a/cautils/k8sinterface/k8sconfig.go b/cautils/k8sinterface/k8sconfig.go index a0ca53eb..bc1804ac 100644 --- a/cautils/k8sinterface/k8sconfig.go +++ b/cautils/k8sinterface/k8sconfig.go @@ -104,13 +104,18 @@ func GetClusterName() string { } func GetDefaultNamespace() string { + defaultNamespace := "default" clientCfg, err := clientcmd.NewDefaultClientConfigLoadingRules().Load() if err != nil { - return "default" + return defaultNamespace } - namespace := clientCfg.Contexts[clientCfg.CurrentContext].Namespace - if namespace == "" { - namespace = "default" + apiContext, ok := clientCfg.Contexts[clientCfg.CurrentContext] + if !ok || apiContext == nil { + return defaultNamespace + } + namespace := apiContext.Namespace + if apiContext.Namespace == "" { + namespace = defaultNamespace } return namespace } From 2b67cc520c8541c7fbedfe2bf9b4472508b5e54a Mon Sep 17 00:00:00 2001 From: dwertent Date: Tue, 5 Oct 2021 16:43:05 +0300 Subject: [PATCH 2/7] windows install support --- .github/workflows/build.yaml | 2 +- README.md | 35 ++++++++++++++- build.py | 82 ++++++++++++++++++++++++++++++++++++ install.ps1 | 26 ++++++++++++ 4 files changed, 143 insertions(+), 2 deletions(-) create mode 100644 build.py create mode 100644 install.ps1 diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 454681c9..7b16864c 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -44,7 +44,7 @@ jobs: ArmoERServer: report.euprod1.cyberarmorsoft.com ArmoWebsite: portal.armo.cloud CGO_ENABLED: 0 - run: mkdir -p build/${{ matrix.os }} && go mod tidy && go build -ldflags "-w -s -X github.com/armosec/kubescape/cmd.BuildNumber=$RELEASE -X github.com/armosec/kubescape/cautils/getter.ArmoBEURL=$ArmoBEServer -X github.com/armosec/kubescape/cautils/getter.ArmoERURL=$ArmoERServer -X github.com/armosec/kubescape/cautils/getter.ArmoFEURL=$ArmoWebsite" -o build/${{ matrix.os }}/kubescape # && md5sum build/${{ matrix.os }}/kubescape > build/${{ matrix.os }}/kubescape.md5 + run: python build.py - name: Upload Release binaries id: upload-release-asset diff --git a/README.md b/README.md index 96817b2b..83f57a7c 100644 --- a/README.md +++ b/README.md @@ -15,6 +15,8 @@ Use Kubescape to test clusters or scan single YAML files and integrate it to you curl -s https://raw.githubusercontent.com/armosec/kubescape/master/install.sh | /bin/bash ``` +[Install on windows](#install-on-windows) + ## Run: ``` kubescape scan framework nsa --exclude-namespaces kube-system,kube-public @@ -39,6 +41,20 @@ Want to contribute? Want to discuss something? Have an issue? # Options and examples +## Install on Windows + +**Requires powershell v5.0+** + +``` powershell +iwr -useb https://raw.githubusercontent.com/armosec/kubescape/master/install.ps1 | iex +``` + +Note: if you get an error you might need to change the execution policy (i.e. enable Powershell) with + +``` powershell +Set-ExecutionPolicy RemoteSigned -scope CurrentUser +``` + ## Flags | flag | default | description | options | @@ -119,7 +135,24 @@ Kubescape is an open source project, we welcome your feedback and ideas for impr # How to build -## For development +## Build using python script + +Kubescpae can be built using: + +``` sh +python built.py +``` + +Note: In order to built using the above script, one must set the environment +variables in this script: + ++ RELEASE ++ ArmoBEServer ++ ArmoERServer ++ ArmoWebsite + + +## Build using go Note: development (and the release process) is done with Go `1.16` diff --git a/build.py b/build.py new file mode 100644 index 00000000..cec9f379 --- /dev/null +++ b/build.py @@ -0,0 +1,82 @@ +import os +import sys +import hashlib +import platform +import subprocess + +BASE_GETTER_CONST = "github.com/armosec/kubescape/cautils/getter" +BE_SERVER_CONST = BASE_GETTER_CONST + ".ArmoBEURL" +ER_SERVER_CONST = BASE_GETTER_CONST + ".ArmoERURL" +WEBSITE_CONST = BASE_GETTER_CONST + ".ArmoFEURL" + +def checkStatus(status, msg): + if status != 0: + sys.stderr.write(msg) + exit(status) + + +def getBuildDir(): + currentPlatform = platform.system() + buildDir = "build/" + + if currentPlatform == "Windows": buildDir += "windows-latest" + elif currentPlatform == "Linux": buildDir += "ubuntu-latest" + elif currentPlatform == "Darwin": buildDir += "macos-latest" + else: raise OSError("Platform %s is not supported!" % (currentPlatform)) + + return buildDir + +def getPackageName(): + packageName = "kubescape" + if platform.system() == "Windows": packageName += ".exe" + + return packageName + + +def main(): + print("Building Kubescape") + + # print environment variables + print(os.environ) + + # Set some variables + packageName = getPackageName() + buildUrl = "github.com/armosec/kubescape/cmd.BuildNumber" + releaseVersion = os.getenv("RELEASE") + ArmoBEServer = os.getenv("ArmoBEServer") + ArmoERServer = os.getenv("ArmoERServer") + ArmoWebsite = os.getenv("ArmoWebsite") + + # Create build directory + buildDir = getBuildDir() + + if not os.path.isdir(buildDir): + os.makedirs(buildDir) + + # Get dependencies + try: + status = subprocess.call(["go", "mod", "tidy"]) + checkStatus(status, "Faild to get dependancies") + + except OSError: + print("An error occure: (Hint: check if go is installed)") + raise + + # Build kubescape + ldflags = "-w -s -X %s=%s -X %s=%s -X %s=%s -X %s=%s" \ + % (buildUrl, releaseVersion, BE_SERVER_CONST, ArmoBEServer, + ER_SERVER_CONST, ArmoERServer, WEBSITE_CONST, ArmoWebsite) + status = subprocess.call(["go", "build", "-o", "%s/%s" % (buildDir, packageName), "-ldflags" ,ldflags]) + checkStatus(status, "Faild to build kubescape") + + + sha1 = hashlib.sha1() + with open(buildDir + "/" + packageName, "rb") as kube: + sha1.update(kube.read()) + with open(buildDir + "/" + packageName + ".sha1", "w") as kube_sha: + kube_sha.write(sha1.hexdigest()) + + print("Build Done.") + +if __name__ == "__main__": + main() \ No newline at end of file diff --git a/install.ps1 b/install.ps1 new file mode 100644 index 00000000..0bbcf61b --- /dev/null +++ b/install.ps1 @@ -0,0 +1,26 @@ +Write-Host "Installing Kubescape..." -ForegroundColor Cyan + +$BASE_DIR=$env:USERPROFILE + "\.kubescape" +$packageName = "/kubescape-windows-latest" + +# Get latest release url +$config = Invoke-WebRequest "https://api.github.com/repos/armosec/kubescape/releases/latest" | ConvertFrom-Json +$url = $config.html_url.Replace("/tag/","/download/") +$fullUrl = $url + $packageName + +# Create a new directory if needed +New-Item -Path $BASE_DIR -ItemType "directory" -ErrorAction SilentlyContinue + +# Download the binary +Invoke-WebRequest -Uri $fullUrl -OutFile $BASE_DIR\kubescape.exe + +# Update user PATH if needed +$currentPath = [Environment]::GetEnvironmentVariable("Path", "User") +if (-not $currentPath.Contains($BASE_DIR)) { + $confirmation = Read-Host "Add kubescape to user path? (y/n)" + if ($confirmation -eq 'y') { + [Environment]::SetEnvironmentVariable("Path", [Environment]::GetEnvironmentVariable("Path", "User") + ";$BASE_DIR;", "User") + } +} + +Write-Host "Finished Installation" -ForegroundColor Green From f11f054fea167aa76b0041da9d0580dc16c4e4b5 Mon Sep 17 00:00:00 2001 From: dwertent Date: Tue, 5 Oct 2021 16:51:03 +0300 Subject: [PATCH 3/7] offline not new feature --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 83f57a7c..4b0ee369 100644 --- a/README.md +++ b/README.md @@ -115,7 +115,7 @@ for example: ``` helm template bitnami/mysql --generate-name --dry-run | kubescape scan framework nsa - ``` -### Offline Support +### Offline Support It is possible to run Kubescape offline! From 84060e78234dbf27e9a2c94eae9011e8de904e6c Mon Sep 17 00:00:00 2001 From: dwertent Date: Tue, 5 Oct 2021 17:07:30 +0300 Subject: [PATCH 4/7] revert python build --- .github/workflows/build.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 7b16864c..3b495b27 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -44,7 +44,8 @@ jobs: ArmoERServer: report.euprod1.cyberarmorsoft.com ArmoWebsite: portal.armo.cloud CGO_ENABLED: 0 - run: python build.py + run: mkdir -p build/${{ matrix.os }} && go mod tidy && go build -ldflags "-w -s -X github.com/armosec/kubescape/cmd.BuildNumber=$RELEASE -X github.com/armosec/kubescape/cautils/getter.ArmoBEURL=$ArmoBEServer -X github.com/armosec/kubescape/cautils/getter.ArmoERURL=$ArmoERServer -X github.com/armosec/kubescape/cautils/getter.ArmoFEURL=$ArmoWebsite" -o build/${{ matrix.os }}/kubescape # && md5sum build/${{ matrix.os }}/kubescape > build/${{ matrix.os }}/kubescape.md5 + # run: python build.py - name: Upload Release binaries id: upload-release-asset From c12eb83b4bb09f72c74407fba31dfe960578614d Mon Sep 17 00:00:00 2001 From: dwertent Date: Tue, 5 Oct 2021 17:12:43 +0300 Subject: [PATCH 5/7] remove comment --- .github/workflows/build.yaml | 1 - build.py | 8 ++++---- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 3b495b27..454681c9 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -45,7 +45,6 @@ jobs: ArmoWebsite: portal.armo.cloud CGO_ENABLED: 0 run: mkdir -p build/${{ matrix.os }} && go mod tidy && go build -ldflags "-w -s -X github.com/armosec/kubescape/cmd.BuildNumber=$RELEASE -X github.com/armosec/kubescape/cautils/getter.ArmoBEURL=$ArmoBEServer -X github.com/armosec/kubescape/cautils/getter.ArmoERURL=$ArmoERServer -X github.com/armosec/kubescape/cautils/getter.ArmoFEURL=$ArmoWebsite" -o build/${{ matrix.os }}/kubescape # && md5sum build/${{ matrix.os }}/kubescape > build/${{ matrix.os }}/kubescape.md5 - # run: python build.py - name: Upload Release binaries id: upload-release-asset diff --git a/build.py b/build.py index cec9f379..895ae7bd 100644 --- a/build.py +++ b/build.py @@ -56,10 +56,10 @@ def main(): # Get dependencies try: status = subprocess.call(["go", "mod", "tidy"]) - checkStatus(status, "Faild to get dependancies") + checkStatus(status, "Failed to get dependencies") except OSError: - print("An error occure: (Hint: check if go is installed)") + print("An error occured: (Hint: check if go is installed)") raise # Build kubescape @@ -67,7 +67,7 @@ def main(): % (buildUrl, releaseVersion, BE_SERVER_CONST, ArmoBEServer, ER_SERVER_CONST, ArmoERServer, WEBSITE_CONST, ArmoWebsite) status = subprocess.call(["go", "build", "-o", "%s/%s" % (buildDir, packageName), "-ldflags" ,ldflags]) - checkStatus(status, "Faild to build kubescape") + checkStatus(status, "Failed to build kubescape") sha1 = hashlib.sha1() @@ -76,7 +76,7 @@ def main(): with open(buildDir + "/" + packageName + ".sha1", "w") as kube_sha: kube_sha.write(sha1.hexdigest()) - print("Build Done.") + print("Build Done") if __name__ == "__main__": main() \ No newline at end of file From 44b74e2681a68b28ccb2a29e312f3cd18fedbc6c Mon Sep 17 00:00:00 2001 From: David Delarosa Date: Tue, 5 Oct 2021 17:28:38 +0300 Subject: [PATCH 6/7] Change workflow to use build.py script --- .github/workflows/build.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 454681c9..84fcc155 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -38,13 +38,16 @@ jobs: with: go-version: 1.16 - name: Build + uses: actions/setup-python@v2 + with: + python-version: 3.7 env: RELEASE: v1.0.${{ github.run_number }} ArmoBEServer: api.armo.cloud ArmoERServer: report.euprod1.cyberarmorsoft.com ArmoWebsite: portal.armo.cloud CGO_ENABLED: 0 - run: mkdir -p build/${{ matrix.os }} && go mod tidy && go build -ldflags "-w -s -X github.com/armosec/kubescape/cmd.BuildNumber=$RELEASE -X github.com/armosec/kubescape/cautils/getter.ArmoBEURL=$ArmoBEServer -X github.com/armosec/kubescape/cautils/getter.ArmoERURL=$ArmoERServer -X github.com/armosec/kubescape/cautils/getter.ArmoFEURL=$ArmoWebsite" -o build/${{ matrix.os }}/kubescape # && md5sum build/${{ matrix.os }}/kubescape > build/${{ matrix.os }}/kubescape.md5 + run: python3 build.py - name: Upload Release binaries id: upload-release-asset From 25b8ec82e85456c64fd23338640395f6a6f4c627 Mon Sep 17 00:00:00 2001 From: David Delarosa Date: Wed, 6 Oct 2021 10:21:29 +0300 Subject: [PATCH 7/7] Cannot use both 'uses' and 'run' --- .github/workflows/build.yaml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 84fcc155..7b16864c 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -38,16 +38,13 @@ jobs: with: go-version: 1.16 - name: Build - uses: actions/setup-python@v2 - with: - python-version: 3.7 env: RELEASE: v1.0.${{ github.run_number }} ArmoBEServer: api.armo.cloud ArmoERServer: report.euprod1.cyberarmorsoft.com ArmoWebsite: portal.armo.cloud CGO_ENABLED: 0 - run: python3 build.py + run: python build.py - name: Upload Release binaries id: upload-release-asset