From b4fc6dddd3a963ca1747d600645d914a91943240 Mon Sep 17 00:00:00 2001 From: David Wertenteil Date: Thu, 29 Sep 2022 10:35:54 +0300 Subject: [PATCH 1/3] change user to ks --- build/Dockerfile | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/build/Dockerfile b/build/Dockerfile index d626ec3b..8b5c144b 100644 --- a/build/Dockerfile +++ b/build/Dockerfile @@ -35,15 +35,15 @@ RUN /work/build/ubuntu-latest/kubescape download artifacts -o /work/artifacts FROM alpine:3.16.2 -RUN addgroup -S armo && adduser -S armo -G armo +RUN addgroup -S ks && adduser -S ks -G ks -COPY --from=builder /work/artifacts/ /home/armo/.kubescape +COPY --from=builder /work/artifacts/ /home/ks/.kubescape -RUN chown -R armo:armo /home/armo/.kubescape +RUN chown -R ks:ks /home/ks/.kubescape -USER armo +USER ks -WORKDIR /home/armo +WORKDIR /home/ks COPY --from=builder /work/httphandler/build/ubuntu-latest/kubescape /usr/bin/ksserver COPY --from=builder /work/build/ubuntu-latest/kubescape /usr/bin/kubescape From ea768602fbeab7e618a8dca9d03df9e5e61ee20d Mon Sep 17 00:00:00 2001 From: David Wertenteil Date: Thu, 29 Sep 2022 10:36:27 +0300 Subject: [PATCH 2/3] update logs --- core/pkg/resourcehandler/k8sresources.go | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/core/pkg/resourcehandler/k8sresources.go b/core/pkg/resourcehandler/k8sresources.go index 52ab967f..a2b322ab 100644 --- a/core/pkg/resourcehandler/k8sresources.go +++ b/core/pkg/resourcehandler/k8sresources.go @@ -79,9 +79,14 @@ func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessio sessionObj.SetNumberOfWorkerNodes(numberOfWorkerNodes) } + cautils.StopSpinner() + logger.L().Success("Accessed to Kubernetes objects") + imgVulnResources := cautils.MapImageVulnResources(ksResourceMap) // check that controls use image vulnerability resources - if len(imgVulnResources) > 0 { + if false { //len(imgVulnResources) > 0 { + logger.L().Info("Requesting images vulnerabilities results") + cautils.StartSpinner() if err := k8sHandler.registryAdaptors.collectImagesVulnerabilities(k8sResourcesMap, allResources, ksResourceMap); err != nil { logger.L().Warning("failed to collect image vulnerabilities", helpers.Error(err)) cautils.SetInfoMapForResources(fmt.Sprintf("failed to pull image scanning data: %s. for more information: https://hub.armosec.io/docs/configuration-of-image-vulnerabilities", err.Error()), imgVulnResources, sessionObj.InfoMap) @@ -90,11 +95,15 @@ func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessio cautils.SetInfoMapForResources("image scanning is not configured. for more information: https://hub.armosec.io/docs/configuration-of-image-vulnerabilities", imgVulnResources, sessionObj.InfoMap) } } + cautils.StopSpinner() + logger.L().Success("Requested images vulnerabilities results") } hostResources := cautils.MapHostResources(ksResourceMap) // check that controls use host sensor resources if len(hostResources) > 0 { + logger.L().Info("Requesting Host scanner data") + cautils.StartSpinner() if sessionObj.Metadata.ScanMetadata.HostScanner { infoMap, err := k8sHandler.collectHostResources(allResources, ksResourceMap) if err != nil { @@ -108,6 +117,8 @@ func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessio sessionObj.InfoMap = infoMap } } + cautils.StopSpinner() + logger.L().Success("Requested Host scanner data") } else { cautils.SetInfoMapForResources("enable-host-scan flag not used. For more information: https://hub.armosec.io/docs/host-sensor", hostResources, sessionObj.InfoMap) } @@ -123,6 +134,8 @@ func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessio // check that controls use cloud resources if len(cloudResources) > 0 { + logger.L().Info("Requesting cloud provider data") + cautils.StartSpinner() provider, err := getCloudProviderDescription(allResources, ksResourceMap) if err != nil { cautils.SetInfoMapForResources(err.Error(), cloudResources, sessionObj.InfoMap) @@ -133,11 +146,10 @@ func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessio sessionObj.Metadata.ContextMetadata.ClusterContextMetadata.CloudProvider = provider } } + cautils.StopSpinner() + logger.L().Info("Requested cloud provider data") } - cautils.StopSpinner() - logger.L().Success("Accessed to Kubernetes objects") - return k8sResourcesMap, allResources, ksResourceMap, nil } From 53ae57e4783af81ebdbb34f25215984819104c1c Mon Sep 17 00:00:00 2001 From: David Wertenteil Date: Thu, 29 Sep 2022 11:19:24 +0300 Subject: [PATCH 3/3] host scanner with fixed version --- .github/workflows/build.yaml | 13 ++----------- core/pkg/hostsensorutils/hostsensor.yaml | 2 +- 2 files changed, 3 insertions(+), 12 deletions(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 2b0f5861..58588bcb 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -72,8 +72,6 @@ jobs: uses: actions/setup-go@v3 with: go-version: 1.18 - # - name: Test cmd pkg - # run: cd cmd && go test -v ./... - name: Install MSYS2 & libgit2 (Windows) shell: cmd @@ -137,7 +135,7 @@ jobs: contents: read steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@v3 with: submodules: recursive @@ -164,17 +162,10 @@ jobs: - name: Build the Docker image run: docker buildx build . --file build/Dockerfile --tag ${{ steps.image-name.outputs.IMAGE_NAME }}:${{ steps.image-version.outputs.IMAGE_VERSION }} --tag ${{ steps.image-name.outputs.IMAGE_NAME }}:latest --build-arg image_version=${{ steps.image-version.outputs.IMAGE_VERSION }} --build-arg client=image-release --push --platform linux/amd64,linux/arm64 - # - name: Login to GitHub Container Registry - # uses: docker/login-action@v1 - # with: - # registry: ghcr.io - # username: ${{ github.actor }} - # password: ${{ secrets.GITHUB_TOKEN }} - - name: Install cosign uses: sigstore/cosign-installer@main with: - cosign-release: 'v1.12.0' # optional + cosign-release: 'v1.12.0' - name: sign kubescape container image env: COSIGN_EXPERIMENTAL: "true" diff --git a/core/pkg/hostsensorutils/hostsensor.yaml b/core/pkg/hostsensorutils/hostsensor.yaml index 16f368c2..64bd5ab8 100644 --- a/core/pkg/hostsensorutils/hostsensor.yaml +++ b/core/pkg/hostsensorutils/hostsensor.yaml @@ -33,7 +33,7 @@ spec: effect: NoSchedule containers: - name: host-sensor - image: quay.io/kubescape/host-scanner:latest + image: quay.io/kubescape/host-scanner:v1.0.28 securityContext: privileged: true readOnlyRootFilesystem: true