From a10b15ba4b94e0df8246b7276e415611c488dd04 Mon Sep 17 00:00:00 2001 From: kooomix Date: Tue, 29 Nov 2022 13:53:10 +0200 Subject: [PATCH] update opa-utils functions --- cmd/scan/control.go | 2 +- cmd/scan/framework.go | 10 +++--- cmd/scan/scan_test.go | 32 +++++++++---------- core/cautils/datastructures.go | 1 + core/pkg/opaprocessor/processorhandler.go | 21 ++++++++---- .../printer/v2/prettyprinter.go | 10 +++--- go.mod | 2 +- go.sum | 4 +-- 8 files changed, 46 insertions(+), 36 deletions(-) diff --git a/cmd/scan/control.go b/cmd/scan/control.go index f414d913..3b462432 100644 --- a/cmd/scan/control.go +++ b/cmd/scan/control.go @@ -109,7 +109,7 @@ func getControlCmd(ks meta.IKubescape, scanInfo *cautils.ScanInfo) *cobra.Comman if results.GetRiskScore() > float32(scanInfo.FailThreshold) { logger.L().Fatal("scan risk-score is above permitted threshold", helpers.String("risk-score", fmt.Sprintf("%.2f", results.GetRiskScore())), helpers.String("fail-threshold", fmt.Sprintf("%.2f", scanInfo.FailThreshold))) } - enforceSeverityThresholds(&results.GetResults().SummaryDetails.SeverityCounters, scanInfo, terminateOnExceedingSeverity) + enforceSeverityThresholds(results.GetResults().SummaryDetails.GetResourcesSeverityCounters(), scanInfo, terminateOnExceedingSeverity) return nil }, diff --git a/cmd/scan/framework.go b/cmd/scan/framework.go index 70002c57..90e4935f 100644 --- a/cmd/scan/framework.go +++ b/cmd/scan/framework.go @@ -119,7 +119,7 @@ func getFrameworkCmd(ks meta.IKubescape, scanInfo *cautils.ScanInfo) *cobra.Comm logger.L().Fatal("scan risk-score is above permitted threshold", helpers.String("risk-score", fmt.Sprintf("%.2f", results.GetRiskScore())), helpers.String("fail-threshold", fmt.Sprintf("%.2f", scanInfo.FailThreshold))) } - enforceSeverityThresholds(&results.GetData().Report.SummaryDetails.SeverityCounters, scanInfo, terminateOnExceedingSeverity) + enforceSeverityThresholds(results.GetData().Report.SummaryDetails.GetResourcesSeverityCounters(), scanInfo, terminateOnExceedingSeverity) return nil }, } @@ -136,10 +136,10 @@ func countersExceedSeverityThreshold(severityCounters reportsummary.ISeverityCou SeverityName string GetFailedResources func() int }{ - {reporthandlingapis.SeverityLowString, severityCounters.NumberOfResourcesWithLowSeverity}, - {reporthandlingapis.SeverityMediumString, severityCounters.NumberOfResourcesWithMediumSeverity}, - {reporthandlingapis.SeverityHighString, severityCounters.NumberOfResourcesWithHighSeverity}, - {reporthandlingapis.SeverityCriticalString, severityCounters.NumberOfResourcesWithCriticalSeverity}, + {reporthandlingapis.SeverityLowString, severityCounters.NumberOfLowSeverity}, + {reporthandlingapis.SeverityMediumString, severityCounters.NumberOfMediumSeverity}, + {reporthandlingapis.SeverityHighString, severityCounters.NumberOfHighSeverity}, + {reporthandlingapis.SeverityCriticalString, severityCounters.NumberOfCriticalSeverity}, } targetSeverityIdx := 0 diff --git a/cmd/scan/scan_test.go b/cmd/scan/scan_test.go index 59ba7b46..c2c16632 100644 --- a/cmd/scan/scan_test.go +++ b/cmd/scan/scan_test.go @@ -24,91 +24,91 @@ func TestExceedsSeverity(t *testing.T) { { Description: "Critical failed resource should exceed Critical threshold", ScanInfo: &cautils.ScanInfo{FailThresholdSeverity: "critical"}, - SeverityCounters: &reportsummary.SeverityCounters{ResourcesWithCriticalSeverityCounter: 1}, + SeverityCounters: &reportsummary.SeverityCounters{CriticalSeverityCounter: 1}, Want: true, }, { Description: "Critical failed resource should exceed Critical threshold set as constant", ScanInfo: &cautils.ScanInfo{FailThresholdSeverity: apis.SeverityCriticalString}, - SeverityCounters: &reportsummary.SeverityCounters{ResourcesWithCriticalSeverityCounter: 1}, + SeverityCounters: &reportsummary.SeverityCounters{CriticalSeverityCounter: 1}, Want: true, }, { Description: "High failed resource should not exceed Critical threshold", ScanInfo: &cautils.ScanInfo{FailThresholdSeverity: "critical"}, - SeverityCounters: &reportsummary.SeverityCounters{ResourcesWithHighSeverityCounter: 1}, + SeverityCounters: &reportsummary.SeverityCounters{HighSeverityCounter: 1}, Want: false, }, { Description: "Critical failed resource exceeds High threshold", ScanInfo: &cautils.ScanInfo{FailThresholdSeverity: "high"}, - SeverityCounters: &reportsummary.SeverityCounters{ResourcesWithCriticalSeverityCounter: 1}, + SeverityCounters: &reportsummary.SeverityCounters{CriticalSeverityCounter: 1}, Want: true, }, { Description: "High failed resource exceeds High threshold", ScanInfo: &cautils.ScanInfo{FailThresholdSeverity: "high"}, - SeverityCounters: &reportsummary.SeverityCounters{ResourcesWithHighSeverityCounter: 1}, + SeverityCounters: &reportsummary.SeverityCounters{HighSeverityCounter: 1}, Want: true, }, { Description: "Medium failed resource does not exceed High threshold", ScanInfo: &cautils.ScanInfo{FailThresholdSeverity: "high"}, - SeverityCounters: &reportsummary.SeverityCounters{ResourcesWithMediumSeverityCounter: 1}, + SeverityCounters: &reportsummary.SeverityCounters{MediumSeverityCounter: 1}, Want: false, }, { Description: "Critical failed resource exceeds Medium threshold", ScanInfo: &cautils.ScanInfo{FailThresholdSeverity: "medium"}, - SeverityCounters: &reportsummary.SeverityCounters{ResourcesWithCriticalSeverityCounter: 1}, + SeverityCounters: &reportsummary.SeverityCounters{CriticalSeverityCounter: 1}, Want: true, }, { Description: "High failed resource exceeds Medium threshold", ScanInfo: &cautils.ScanInfo{FailThresholdSeverity: "medium"}, - SeverityCounters: &reportsummary.SeverityCounters{ResourcesWithHighSeverityCounter: 1}, + SeverityCounters: &reportsummary.SeverityCounters{HighSeverityCounter: 1}, Want: true, }, { Description: "Medium failed resource exceeds Medium threshold", ScanInfo: &cautils.ScanInfo{FailThresholdSeverity: "medium"}, - SeverityCounters: &reportsummary.SeverityCounters{ResourcesWithMediumSeverityCounter: 1}, + SeverityCounters: &reportsummary.SeverityCounters{MediumSeverityCounter: 1}, Want: true, }, { Description: "Low failed resource does not exceed Medium threshold", ScanInfo: &cautils.ScanInfo{FailThresholdSeverity: "medium"}, - SeverityCounters: &reportsummary.SeverityCounters{ResourcesWithLowSeverityCounter: 1}, + SeverityCounters: &reportsummary.SeverityCounters{LowSeverityCounter: 1}, Want: false, }, { Description: "Critical failed resource exceeds Low threshold", ScanInfo: &cautils.ScanInfo{FailThresholdSeverity: "low"}, - SeverityCounters: &reportsummary.SeverityCounters{ResourcesWithCriticalSeverityCounter: 1}, + SeverityCounters: &reportsummary.SeverityCounters{CriticalSeverityCounter: 1}, Want: true, }, { Description: "High failed resource exceeds Low threshold", ScanInfo: &cautils.ScanInfo{FailThresholdSeverity: "low"}, - SeverityCounters: &reportsummary.SeverityCounters{ResourcesWithHighSeverityCounter: 1}, + SeverityCounters: &reportsummary.SeverityCounters{HighSeverityCounter: 1}, Want: true, }, { Description: "Medium failed resource exceeds Low threshold", ScanInfo: &cautils.ScanInfo{FailThresholdSeverity: "low"}, - SeverityCounters: &reportsummary.SeverityCounters{ResourcesWithMediumSeverityCounter: 1}, + SeverityCounters: &reportsummary.SeverityCounters{MediumSeverityCounter: 1}, Want: true, }, { Description: "Low failed resource exceeds Low threshold", ScanInfo: &cautils.ScanInfo{FailThresholdSeverity: "low"}, - SeverityCounters: &reportsummary.SeverityCounters{ResourcesWithLowSeverityCounter: 1}, + SeverityCounters: &reportsummary.SeverityCounters{LowSeverityCounter: 1}, Want: true, }, { Description: "Unknown severity returns an error", ScanInfo: &cautils.ScanInfo{FailThresholdSeverity: "unknown"}, - SeverityCounters: &reportsummary.SeverityCounters{ResourcesWithLowSeverityCounter: 1}, + SeverityCounters: &reportsummary.SeverityCounters{LowSeverityCounter: 1}, Want: false, Error: ErrUnknownSeverity, }, @@ -139,7 +139,7 @@ func Test_enforceSeverityThresholds(t *testing.T) { }{ { "Exceeding Critical severity counter should call the terminating function", - &reportsummary.SeverityCounters{ResourcesWithCriticalSeverityCounter: 1}, + &reportsummary.SeverityCounters{CriticalSeverityCounter: 1}, &cautils.ScanInfo{FailThresholdSeverity: apis.SeverityCriticalString}, true, }, diff --git a/core/cautils/datastructures.go b/core/cautils/datastructures.go index 51c83843..ddd21b00 100644 --- a/core/cautils/datastructures.go +++ b/core/cautils/datastructures.go @@ -94,6 +94,7 @@ type Exception struct { type RegoInputData struct { PostureControlInputs map[string][]string `json:"postureControlInputs"` + DataControlInputs map[string]string `json:"dataControlInputs"` // ClusterName string `json:"clusterName"` // K8sConfig RegoK8sConfig `json:"k8sconfig"` } diff --git a/core/pkg/opaprocessor/processorhandler.go b/core/pkg/opaprocessor/processorhandler.go index 8f2e32a6..9c32d9f5 100644 --- a/core/pkg/opaprocessor/processorhandler.go +++ b/core/pkg/opaprocessor/processorhandler.go @@ -35,6 +35,7 @@ type OPAProcessor struct { func NewOPAProcessor(sessionObj *cautils.OPASessionObj, regoDependenciesData *resources.RegoDependenciesData) *OPAProcessor { if regoDependenciesData != nil && sessionObj != nil { regoDependenciesData.PostureControlInputs = sessionObj.RegoInputData.PostureControlInputs + regoDependenciesData.DataControlInputs = sessionObj.RegoInputData.DataControlInputs } return &OPAProcessor{ OPASessionObj: sessionObj, @@ -153,12 +154,16 @@ func (opap *OPAProcessor) processControl(control *reporthandling.Control) (map[s func (opap *OPAProcessor) processRule(rule *reporthandling.PolicyRule, fixedControlInputs map[string][]string) (map[string]*resourcesresults.ResourceAssociatedRule, error) { postureControlInputs := opap.regoDependenciesData.GetFilteredPostureControlInputs(rule.ConfigInputs) // get store + dataControlInputs := map[string]string{"cloudProvider": opap.OPASessionObj.Report.ClusterCloudProvider} // Merge configurable control input and fixed control input for k, v := range fixedControlInputs { postureControlInputs[k] = v } + RuleRegoDependenciesData := resources.RegoDependenciesData{DataControlInputs: dataControlInputs, + PostureControlInputs: postureControlInputs} + inputResources, err := reporthandling.RegoResourcesAggregator(rule, getAllSupportedObjects(opap.K8SResources, opap.ArmoResource, opap.AllResources, rule)) if err != nil { return nil, fmt.Errorf("error getting aggregated k8sObjects: %s", err.Error()) @@ -185,7 +190,7 @@ func (opap *OPAProcessor) processRule(rule *reporthandling.PolicyRule, fixedCont opap.AllResources[inputResources[i].GetID()] = inputResources[i] } - ruleResponses, err := opap.runOPAOnSingleRule(rule, inputRawResources, ruleData, postureControlInputs) + ruleResponses, err := opap.runOPAOnSingleRule(rule, inputRawResources, ruleData, RuleRegoDependenciesData) if err != nil { // TODO - Handle error logger.L().Error(err.Error()) @@ -217,16 +222,16 @@ func (opap *OPAProcessor) processRule(rule *reporthandling.PolicyRule, fixedCont return resources, err } -func (opap *OPAProcessor) runOPAOnSingleRule(rule *reporthandling.PolicyRule, k8sObjects []map[string]interface{}, getRuleData func(*reporthandling.PolicyRule) string, postureControlInputs map[string][]string) ([]reporthandling.RuleResponse, error) { +func (opap *OPAProcessor) runOPAOnSingleRule(rule *reporthandling.PolicyRule, k8sObjects []map[string]interface{}, getRuleData func(*reporthandling.PolicyRule) string, ruleRegoDependenciesData resources.RegoDependenciesData) ([]reporthandling.RuleResponse, error) { switch rule.RuleLanguage { case reporthandling.RegoLanguage, reporthandling.RegoLanguage2: - return opap.runRegoOnK8s(rule, k8sObjects, getRuleData, postureControlInputs) + return opap.runRegoOnK8s(rule, k8sObjects, getRuleData, ruleRegoDependenciesData) default: return nil, fmt.Errorf("rule: '%s', language '%v' not supported", rule.Name, rule.RuleLanguage) } } -func (opap *OPAProcessor) runRegoOnK8s(rule *reporthandling.PolicyRule, k8sObjects []map[string]interface{}, getRuleData func(*reporthandling.PolicyRule) string, postureControlInputs map[string][]string) ([]reporthandling.RuleResponse, error) { +func (opap *OPAProcessor) runRegoOnK8s(rule *reporthandling.PolicyRule, k8sObjects []map[string]interface{}, getRuleData func(*reporthandling.PolicyRule) string, ruleRegoDependenciesData resources.RegoDependenciesData) ([]reporthandling.RuleResponse, error) { // compile modules modules, err := getRuleDependencies() @@ -239,7 +244,7 @@ func (opap *OPAProcessor) runRegoOnK8s(rule *reporthandling.PolicyRule, k8sObjec return nil, fmt.Errorf("in 'runRegoOnSingleRule', failed to compile rule, name: %s, reason: %s", rule.Name, err.Error()) } - store, err := resources.TOStorage(postureControlInputs) + store, err := ruleRegoDependenciesData.TOStorage() if err != nil { return nil, err } @@ -282,8 +287,12 @@ func (opap *OPAProcessor) enumerateData(rule *reporthandling.PolicyRule, k8sObje return k8sObjects, nil } postureControlInputs := opap.regoDependenciesData.GetFilteredPostureControlInputs(rule.ConfigInputs) + dataControlInputs := map[string]string{"cloudProvider": opap.OPASessionObj.Report.ClusterCloudProvider} - ruleResponse, err := opap.runOPAOnSingleRule(rule, k8sObjects, ruleEnumeratorData, postureControlInputs) + RuleRegoDependenciesData := resources.RegoDependenciesData{DataControlInputs: dataControlInputs, + PostureControlInputs: postureControlInputs} + + ruleResponse, err := opap.runOPAOnSingleRule(rule, k8sObjects, ruleEnumeratorData, RuleRegoDependenciesData) if err != nil { return nil, err } diff --git a/core/pkg/resultshandling/printer/v2/prettyprinter.go b/core/pkg/resultshandling/printer/v2/prettyprinter.go index 37676f10..09ebaefc 100644 --- a/core/pkg/resultshandling/printer/v2/prettyprinter.go +++ b/core/pkg/resultshandling/printer/v2/prettyprinter.go @@ -192,7 +192,7 @@ func (prettyPrinter *PrettyPrinter) printSummaryTable(summaryDetails *reportsumm return } cautils.InfoTextDisplay(prettyPrinter.writer, "\n"+controlCountersForSummary(summaryDetails.NumberOfControls())+"\n") - cautils.InfoTextDisplay(prettyPrinter.writer, renderSeverityCountersSummary(&summaryDetails.SeverityCounters)+"\n\n") + cautils.InfoTextDisplay(prettyPrinter.writer, renderSeverityCountersSummary(summaryDetails.GetResourcesSeverityCounters())+"\n\n") // cautils.InfoTextDisplay(prettyPrinter.writer, "\n"+"Severities: SOME OTHER"+"\n\n") @@ -256,10 +256,10 @@ func frameworksScoresToString(frameworks []reportsummary.IFrameworkSummary) stri // renderSeverityCountersSummary renders the string that reports severity counters summary func renderSeverityCountersSummary(counters reportsummary.ISeverityCounters) string { - critical := counters.NumberOfResourcesWithCriticalSeverity() - high := counters.NumberOfResourcesWithHighSeverity() - medium := counters.NumberOfResourcesWithMediumSeverity() - low := counters.NumberOfResourcesWithLowSeverity() + critical := counters.NumberOfCriticalSeverity() + high := counters.NumberOfHighSeverity() + medium := counters.NumberOfMediumSeverity() + low := counters.NumberOfLowSeverity() return fmt.Sprintf( "Failed Resources by Severity: Critical — %d, High — %d, Medium — %d, Low — %d", diff --git a/go.mod b/go.mod index 50358502..8cd54d46 100644 --- a/go.mod +++ b/go.mod @@ -17,7 +17,7 @@ require ( github.com/johnfercher/maroto v0.37.0 github.com/kubescape/go-logger v0.0.6 github.com/kubescape/k8s-interface v0.0.89 - github.com/kubescape/opa-utils v0.0.200 + github.com/kubescape/opa-utils v0.0.204 github.com/kubescape/rbac-utils v0.0.19 github.com/libgit2/git2go/v33 v33.0.9 github.com/mattn/go-isatty v0.0.14 diff --git a/go.sum b/go.sum index 1536f3c6..19d42408 100644 --- a/go.sum +++ b/go.sum @@ -589,8 +589,8 @@ github.com/kubescape/go-logger v0.0.6 h1:ynhAmwrz0O7Jtqq1CdmCZUrKveji25hVP+B/FAb github.com/kubescape/go-logger v0.0.6/go.mod h1:DnVWEvC90LFY1nNMaNo6nBVOcqkLMK3S0qzXP1fzRvI= github.com/kubescape/k8s-interface v0.0.89 h1:OtlvZosHpjlbHfsilfQk2wRbuBnxwF0e+WZX6GbkfLU= github.com/kubescape/k8s-interface v0.0.89/go.mod h1:pgFRs20mHiavf6+fFWY7h/f8HuKlwuZwirvjxiKJlu0= -github.com/kubescape/opa-utils v0.0.200 h1:7EhE9FTabzkUxicvxdchXuaTWW0J2mFj04vK4jTrxN0= -github.com/kubescape/opa-utils v0.0.200/go.mod h1:rDC3PANuk8gU5lSDO/WPFTluypBQ+/6qiuZLye+slYg= +github.com/kubescape/opa-utils v0.0.204 h1:9O9drjyzjOhI7Xi2S4Px0WKa66U5GFPQqeOLvhDqHnw= +github.com/kubescape/opa-utils v0.0.204/go.mod h1:rDC3PANuk8gU5lSDO/WPFTluypBQ+/6qiuZLye+slYg= github.com/kubescape/rbac-utils v0.0.19 h1:7iydgVxlMLW15MgHORfMBMqNj9jHtFGACd744fdtrFs= github.com/kubescape/rbac-utils v0.0.19/go.mod h1:t57AhSrjuNGQ+mpZWQM/hBzrCOeKBDHegFoVo4tbikQ= github.com/leodido/go-urn v1.2.0/go.mod h1:+8+nEpDfqqsY+g338gtMEUOtuK+4dEMhiQEgxpxOKII=