From b4fc6dddd3a963ca1747d600645d914a91943240 Mon Sep 17 00:00:00 2001 From: David Wertenteil Date: Thu, 29 Sep 2022 10:35:54 +0300 Subject: [PATCH 1/9] change user to ks --- build/Dockerfile | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/build/Dockerfile b/build/Dockerfile index d626ec3b..8b5c144b 100644 --- a/build/Dockerfile +++ b/build/Dockerfile @@ -35,15 +35,15 @@ RUN /work/build/ubuntu-latest/kubescape download artifacts -o /work/artifacts FROM alpine:3.16.2 -RUN addgroup -S armo && adduser -S armo -G armo +RUN addgroup -S ks && adduser -S ks -G ks -COPY --from=builder /work/artifacts/ /home/armo/.kubescape +COPY --from=builder /work/artifacts/ /home/ks/.kubescape -RUN chown -R armo:armo /home/armo/.kubescape +RUN chown -R ks:ks /home/ks/.kubescape -USER armo +USER ks -WORKDIR /home/armo +WORKDIR /home/ks COPY --from=builder /work/httphandler/build/ubuntu-latest/kubescape /usr/bin/ksserver COPY --from=builder /work/build/ubuntu-latest/kubescape /usr/bin/kubescape From ea768602fbeab7e618a8dca9d03df9e5e61ee20d Mon Sep 17 00:00:00 2001 From: David Wertenteil Date: Thu, 29 Sep 2022 10:36:27 +0300 Subject: [PATCH 2/9] update logs --- core/pkg/resourcehandler/k8sresources.go | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/core/pkg/resourcehandler/k8sresources.go b/core/pkg/resourcehandler/k8sresources.go index 52ab967f..a2b322ab 100644 --- a/core/pkg/resourcehandler/k8sresources.go +++ b/core/pkg/resourcehandler/k8sresources.go @@ -79,9 +79,14 @@ func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessio sessionObj.SetNumberOfWorkerNodes(numberOfWorkerNodes) } + cautils.StopSpinner() + logger.L().Success("Accessed to Kubernetes objects") + imgVulnResources := cautils.MapImageVulnResources(ksResourceMap) // check that controls use image vulnerability resources - if len(imgVulnResources) > 0 { + if false { //len(imgVulnResources) > 0 { + logger.L().Info("Requesting images vulnerabilities results") + cautils.StartSpinner() if err := k8sHandler.registryAdaptors.collectImagesVulnerabilities(k8sResourcesMap, allResources, ksResourceMap); err != nil { logger.L().Warning("failed to collect image vulnerabilities", helpers.Error(err)) cautils.SetInfoMapForResources(fmt.Sprintf("failed to pull image scanning data: %s. for more information: https://hub.armosec.io/docs/configuration-of-image-vulnerabilities", err.Error()), imgVulnResources, sessionObj.InfoMap) @@ -90,11 +95,15 @@ func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessio cautils.SetInfoMapForResources("image scanning is not configured. for more information: https://hub.armosec.io/docs/configuration-of-image-vulnerabilities", imgVulnResources, sessionObj.InfoMap) } } + cautils.StopSpinner() + logger.L().Success("Requested images vulnerabilities results") } hostResources := cautils.MapHostResources(ksResourceMap) // check that controls use host sensor resources if len(hostResources) > 0 { + logger.L().Info("Requesting Host scanner data") + cautils.StartSpinner() if sessionObj.Metadata.ScanMetadata.HostScanner { infoMap, err := k8sHandler.collectHostResources(allResources, ksResourceMap) if err != nil { @@ -108,6 +117,8 @@ func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessio sessionObj.InfoMap = infoMap } } + cautils.StopSpinner() + logger.L().Success("Requested Host scanner data") } else { cautils.SetInfoMapForResources("enable-host-scan flag not used. For more information: https://hub.armosec.io/docs/host-sensor", hostResources, sessionObj.InfoMap) } @@ -123,6 +134,8 @@ func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessio // check that controls use cloud resources if len(cloudResources) > 0 { + logger.L().Info("Requesting cloud provider data") + cautils.StartSpinner() provider, err := getCloudProviderDescription(allResources, ksResourceMap) if err != nil { cautils.SetInfoMapForResources(err.Error(), cloudResources, sessionObj.InfoMap) @@ -133,11 +146,10 @@ func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessio sessionObj.Metadata.ContextMetadata.ClusterContextMetadata.CloudProvider = provider } } + cautils.StopSpinner() + logger.L().Info("Requested cloud provider data") } - cautils.StopSpinner() - logger.L().Success("Accessed to Kubernetes objects") - return k8sResourcesMap, allResources, ksResourceMap, nil } From 53ae57e4783af81ebdbb34f25215984819104c1c Mon Sep 17 00:00:00 2001 From: David Wertenteil Date: Thu, 29 Sep 2022 11:19:24 +0300 Subject: [PATCH 3/9] host scanner with fixed version --- .github/workflows/build.yaml | 13 ++----------- core/pkg/hostsensorutils/hostsensor.yaml | 2 +- 2 files changed, 3 insertions(+), 12 deletions(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 2b0f5861..58588bcb 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -72,8 +72,6 @@ jobs: uses: actions/setup-go@v3 with: go-version: 1.18 - # - name: Test cmd pkg - # run: cd cmd && go test -v ./... - name: Install MSYS2 & libgit2 (Windows) shell: cmd @@ -137,7 +135,7 @@ jobs: contents: read steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@v3 with: submodules: recursive @@ -164,17 +162,10 @@ jobs: - name: Build the Docker image run: docker buildx build . --file build/Dockerfile --tag ${{ steps.image-name.outputs.IMAGE_NAME }}:${{ steps.image-version.outputs.IMAGE_VERSION }} --tag ${{ steps.image-name.outputs.IMAGE_NAME }}:latest --build-arg image_version=${{ steps.image-version.outputs.IMAGE_VERSION }} --build-arg client=image-release --push --platform linux/amd64,linux/arm64 - # - name: Login to GitHub Container Registry - # uses: docker/login-action@v1 - # with: - # registry: ghcr.io - # username: ${{ github.actor }} - # password: ${{ secrets.GITHUB_TOKEN }} - - name: Install cosign uses: sigstore/cosign-installer@main with: - cosign-release: 'v1.12.0' # optional + cosign-release: 'v1.12.0' - name: sign kubescape container image env: COSIGN_EXPERIMENTAL: "true" diff --git a/core/pkg/hostsensorutils/hostsensor.yaml b/core/pkg/hostsensorutils/hostsensor.yaml index 16f368c2..64bd5ab8 100644 --- a/core/pkg/hostsensorutils/hostsensor.yaml +++ b/core/pkg/hostsensorutils/hostsensor.yaml @@ -33,7 +33,7 @@ spec: effect: NoSchedule containers: - name: host-sensor - image: quay.io/kubescape/host-scanner:latest + image: quay.io/kubescape/host-scanner:v1.0.28 securityContext: privileged: true readOnlyRootFilesystem: true From 7275b8eac785cae2900261eadc8169af5fb030bb Mon Sep 17 00:00:00 2001 From: David Wertenteil Date: Mon, 3 Oct 2022 09:09:50 +0300 Subject: [PATCH 4/9] testing gh actions --- .github/workflows/build_dev.yaml | 174 +++++++++++++++---------------- 1 file changed, 82 insertions(+), 92 deletions(-) diff --git a/.github/workflows/build_dev.yaml b/.github/workflows/build_dev.yaml index ad03b6d8..e251a3fa 100644 --- a/.github/workflows/build_dev.yaml +++ b/.github/workflows/build_dev.yaml @@ -2,111 +2,100 @@ name: build-dev on: push: - branches: [ dev ] + branches: [ master ] paths-ignore: # Do not run the pipeline if only Markdown files changed - '**.md' jobs: - build: - name: Create cross-platform dev build - runs-on: ${{ matrix.os }} - strategy: - matrix: - os: [ubuntu-latest, macos-latest, windows-latest] - steps: - - uses: actions/checkout@v3 - with: - submodules: recursive + # build: + # name: Create cross-platform dev build + # runs-on: ${{ matrix.os }} + # strategy: + # matrix: + # os: [ubuntu-latest, macos-latest, windows-latest] + # steps: + # - uses: actions/checkout@v3 + # with: + # submodules: recursive - - name: Cache Go modules (Linux) - if: matrix.os == 'ubuntu-latest' - uses: actions/cache@v3 - with: - path: | - ~/.cache/go-build - ~/go/pkg/mod - key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} - restore-keys: | - ${{ runner.os }}-go- + # - name: Cache Go modules (Linux) + # if: matrix.os == 'ubuntu-latest' + # uses: actions/cache@v3 + # with: + # path: | + # ~/.cache/go-build + # ~/go/pkg/mod + # key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} + # restore-keys: | + # ${{ runner.os }}-go- - - name: Cache Go modules (macOS) - if: matrix.os == 'macos-latest' - uses: actions/cache@v3 - with: - path: | - ~/Library/Caches/go-build - ~/go/pkg/mod - key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} - restore-keys: | - ${{ runner.os }}-go- + # - name: Cache Go modules (macOS) + # if: matrix.os == 'macos-latest' + # uses: actions/cache@v3 + # with: + # path: | + # ~/Library/Caches/go-build + # ~/go/pkg/mod + # key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} + # restore-keys: | + # ${{ runner.os }}-go- - - name: Cache Go modules (Windows) - if: matrix.os == 'windows-latest' - uses: actions/cache@v3 - with: - path: | - ~\AppData\Local\go-build - ~\go\pkg\mod - key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} - restore-keys: | - ${{ runner.os }}-go- + # - name: Cache Go modules (Windows) + # if: matrix.os == 'windows-latest' + # uses: actions/cache@v3 + # with: + # path: | + # ~\AppData\Local\go-build + # ~\go\pkg\mod + # key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} + # restore-keys: | + # ${{ runner.os }}-go- - - name: Set up Go - uses: actions/setup-go@v3 - with: - go-version: 1.18 - - # - name: Test cmd pkg - # run: cd cmd && go test -v ./... + # - name: Set up Go + # uses: actions/setup-go@v3 + # with: + # go-version: 1.18 + + # - name: Install MSYS2 & libgit2 (Windows) + # shell: cmd + # run: .\build.bat all + # if: matrix.os == 'windows-latest' + + # - name: Install libgit2 (Linux/macOS) + # run: make libgit2 + # if: matrix.os != 'windows-latest' + + # - name: Test core pkg + # env: + # GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # run: go test -tags=static -v ./... + + # - name: Test httphandler pkg + # run: cd httphandler && go test -tags=static -v ./... + + # - name: Build + # env: + # RELEASE: v2.0.${{ github.run_number }} + # CLIENT: release-dev + # CGO_ENABLED: 1 + # run: python3 --version && python3 build.py - # - name: Test core pkg - # env: - # GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # run: cd core && go test -v ./... + # - name: Smoke Testing + # env: + # RELEASE: v2.0.${{ github.run_number }} + # KUBESCAPE_SKIP_UPDATE_CHECK: "true" + # run: python3 smoke_testing/init.py ${PWD}/build/${{ matrix.os }}/kubescape - # - name: Test cmd pkg - # run: cd cmd && go test -v ./... - - - name: Install MSYS2 & libgit2 (Windows) - shell: cmd - run: .\build.bat all - if: matrix.os == 'windows-latest' - - - name: Install libgit2 (Linux/macOS) - run: make libgit2 - if: matrix.os != 'windows-latest' - - - name: Test core pkg - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: go test -tags=static -v ./... - - - name: Test httphandler pkg - run: cd httphandler && go test -tags=static -v ./... - - - name: Build - env: - RELEASE: v2.0.${{ github.run_number }} - CLIENT: release-dev - CGO_ENABLED: 1 - run: python3 --version && python3 build.py - - - name: Smoke Testing - env: - RELEASE: v2.0.${{ github.run_number }} - KUBESCAPE_SKIP_UPDATE_CHECK: "true" - run: python3 smoke_testing/init.py ${PWD}/build/${{ matrix.os }}/kubescape - - - name: Upload build artifacts - uses: actions/upload-artifact@v2 - with: - name: kubescape-${{ matrix.os }} - path: build/${{ matrix.os }}/kubescape + # - name: Upload build artifacts + # uses: actions/upload-artifact@v2 + # with: + # name: kubescape-${{ matrix.os }} + # path: build/${{ matrix.os }}/kubescape build-docker: name: Build docker container, tag and upload to registry needs: build - if: ${{ github.repository == 'kubescape/kubescape' }} # TODO + # if: ${{ github.repository == 'kubescape/kubescape' }} # TODO runs-on: ubuntu-latest permissions: id-token: write @@ -139,4 +128,5 @@ jobs: run: docker login -u="${QUAY_USERNAME}" -p="${QUAY_PASSWORD}" quay.io - name: Build the Docker image - run: docker buildx build . --file build/Dockerfile --tag ${{ steps.image-name.outputs.IMAGE_NAME }}:${{ steps.image-version.outputs.IMAGE_VERSION }} --build-arg image_version=${{ steps.image-version.outputs.IMAGE_VERSION }} --build-arg client=image-dev --push --platform linux/amd64,linux/arm64 + run: docker buildx build . --file build/Dockerfile --tag ${{ steps.image-name.outputs.IMAGE_NAME }}:${{ steps.image-version.outputs.IMAGE_VERSION }} --build-arg image_version=${{ steps.image-version.outputs.IMAGE_VERSION }} --build-arg client=image-dwertent --push + # --platform linux/amd64,linux/arm64 From dd5dd53a38ea594dfeb7ea1c61cebc6b0a11c01d Mon Sep 17 00:00:00 2001 From: David Wertenteil Date: Mon, 3 Oct 2022 09:10:08 +0300 Subject: [PATCH 5/9] testing gh actions --- .github/workflows/build_dev.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build_dev.yaml b/.github/workflows/build_dev.yaml index e251a3fa..cb84f390 100644 --- a/.github/workflows/build_dev.yaml +++ b/.github/workflows/build_dev.yaml @@ -2,7 +2,7 @@ name: build-dev on: push: - branches: [ master ] + branches: [ gh-testing ] paths-ignore: # Do not run the pipeline if only Markdown files changed - '**.md' From 7cf1302e8a2fbf51a543c451d86679de9867f865 Mon Sep 17 00:00:00 2001 From: David Wertenteil Date: Mon, 3 Oct 2022 13:48:50 +0300 Subject: [PATCH 6/9] Workflow call testing (#7) * testing gh actions * testing gh actions * remove deps * build multi platforms * workflow_call testing * adding workflow-call-testing branch name * specify URL * adding org name * adding workflows --- .github/workflows/build-image.yaml | 81 +++++++++++++++ .github/workflows/build.yaml | 152 +++++++---------------------- .github/workflows/build_dev.yaml | 150 ++++------------------------ .github/workflows/pr_checks.yaml | 90 ++--------------- .github/workflows/release.yaml | 44 +++++++++ .github/workflows/test.yaml | 91 +++++++++++++++++ 6 files changed, 274 insertions(+), 334 deletions(-) create mode 100644 .github/workflows/build-image.yaml create mode 100644 .github/workflows/release.yaml create mode 100644 .github/workflows/test.yaml diff --git a/.github/workflows/build-image.yaml b/.github/workflows/build-image.yaml new file mode 100644 index 00000000..c3a9bc6a --- /dev/null +++ b/.github/workflows/build-image.yaml @@ -0,0 +1,81 @@ +name: build + +on: + workflow_call: + inputs: + client: + description: 'client name' + required: true + type: string + image_tag: + description: 'image tag' + required: true + type: string + image_name: + description: 'image registry and name' + required: true + type: string + cosign: + required: false + default: false + type: boolean + description: 'run cosign on released image' + support_platforms: + required: false + default: true + type: boolean + description: 'support amd64/arm64' + + secrets: + QUAYIO_REGISTRY_USERNAME: + required: true + QUAYIO_REGISTRY_PASSWORD: + required: true + +jobs: + build-image: + name: Build image and upload to registry + runs-on: ubuntu-latest + if: ${{ github.repository == 'kubescape/kubescape' }} # TODO + permissions: + id-token: write + packages: write + contents: read + + steps: + - uses: actions/checkout@v3 + with: + submodules: recursive + + - name: Set up QEMU + uses: docker/setup-qemu-action@v2 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v2 + + - name: Login to Quay.io + env: + QUAY_PASSWORD: ${{ secrets.QUAYIO_REGISTRY_PASSWORD }} + QUAY_USERNAME: ${{ secrets.QUAYIO_REGISTRY_USERNAME }} + run: docker login -u="${QUAY_USERNAME}" -p="${QUAY_PASSWORD}" quay.io + + - name: Build and push image + if: ${{ inputs.support_platforms }} + run: docker buildx build . --file build/Dockerfile --tag ${{ inputs.image_name }}:${{ inputs.image_tag }} --tag ${{ inputs.image_name }}:latest --build-arg image_version=${{ inputs.image_tag }} --build-arg client=${{ inputs.client }} --push --platform linux/amd64,linux/arm64 + + - name: Build and push image without amd64/arm64 support + if: ${{ !inputs.support_platforms }} + run: docker buildx build . --file build/Dockerfile --tag ${{ inputs.image_name }}:${{ inputs.image_tag }} --tag ${{ inputs.image_name }}:latest --build-arg image_version=${{ inputs.image_tag }} --build-arg client=${{ inputs.client }} --push + + - name: Install cosign + uses: sigstore/cosign-installer@main + with: + cosign-release: 'v1.12.0' + - name: sign kubescape container image + if: ${{ inputs.cosign }} + env: + COSIGN_EXPERIMENTAL: "true" + run: | + cosign sign --force ${{ inputs.image_name }}:latest + cosign sign --force ${{ inputs.image_name }}:${{ inputs.image_tag }} + diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 58588bcb..6c5a4bcb 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -7,25 +7,23 @@ on: # Do not run the pipeline if only Markdown files changed - '**.md' jobs: - once: - name: Create release - runs-on: ubuntu-latest - outputs: - upload_url: ${{ steps.create_release.outputs.upload_url }} - steps: - - name: Create a release - id: create_release - uses: actions/create-release@v1 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - tag_name: v2.0.${{ github.run_number }} - release_name: Release v2.0.${{ github.run_number }} - draft: false - prerelease: false - build: - name: Create cross-platform release build, tag and upload binaries - needs: once + test: + uses: ./.github/workflows/test.yaml + with: + release: "v2.0.${{ github.run_number }}" + client: test + + create-release: + uses: ./.github/workflows/release.yaml + needs: test + with: + release_name: "Release v2.0.${{ github.run_number }}" + tag_name: "v2.0.${{ github.run_number }}" + secrets: inherit + + publish-artifacts: + name: Build and publish artifacts + needs: create-release runs-on: ${{ matrix.os }} strategy: matrix: @@ -34,40 +32,7 @@ jobs: - uses: actions/checkout@v3 with: submodules: recursive - - - name: Cache Go modules (Linux) - if: matrix.os == 'ubuntu-latest' - uses: actions/cache@v3 - with: - path: | - ~/.cache/go-build - ~/go/pkg/mod - key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} - restore-keys: | - ${{ runner.os }}-go- - - - name: Cache Go modules (macOS) - if: matrix.os == 'macos-latest' - uses: actions/cache@v3 - with: - path: | - ~/Library/Caches/go-build - ~/go/pkg/mod - key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} - restore-keys: | - ${{ runner.os }}-go- - - - name: Cache Go modules (Windows) - if: matrix.os == 'windows-latest' - uses: actions/cache@v3 - with: - path: | - ~\AppData\Local\go-build - ~\go\pkg\mod - key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} - restore-keys: | - ${{ runner.os }}-go- - + - name: Set up Go uses: actions/setup-go@v3 with: @@ -82,34 +47,20 @@ jobs: run: make libgit2 if: matrix.os != 'windows-latest' - - name: Test core pkg - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: go test -tags=static -v ./... - - - name: Test httphandler pkg - run: cd httphandler && go test -tags=static -v ./... - - name: Build env: RELEASE: v2.0.${{ github.run_number }} CLIENT: release CGO_ENABLED: 1 run: python3 --version && python3 build.py - - - name: Smoke Testing - env: - RELEASE: v2.0.${{ github.run_number }} - KUBESCAPE_SKIP_UPDATE_CHECK: "true" - run: python3 smoke_testing/init.py ${PWD}/build/${{ matrix.os }}/kubescape - + - name: Upload release binaries id: upload-release-asset uses: actions/upload-release-asset@v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: - upload_url: ${{ needs.once.outputs.upload_url }} + upload_url: ${{ needs.create-release.outputs.upload_url }} asset_path: build/${{ matrix.os }}/kubescape asset_name: kubescape-${{ matrix.os }} asset_content_type: application/octet-stream @@ -120,56 +71,19 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: - upload_url: ${{ needs.once.outputs.upload_url }} + upload_url: ${{ needs.create-release.outputs.upload_url }} asset_path: build/${{ matrix.os }}/kubescape.sha256 asset_name: kubescape-${{ matrix.os }}-sha256 asset_content_type: application/octet-stream - build-docker: - name: Build docker container, tag and upload to registry - needs: build - runs-on: ubuntu-latest - if: ${{ github.repository == 'kubescape/kubescape' }} # TODO - permissions: - id-token: write - packages: write - contents: read - - steps: - - uses: actions/checkout@v3 - with: - submodules: recursive - - - name: Set image version - id: image-version - run: echo '::set-output name=IMAGE_VERSION::v2.0.${{ github.run_number }}' - - - name: Set image name - id: image-name - run: echo '::set-output name=IMAGE_NAME::quay.io/${{ github.repository_owner }}/kubescape' - - - name: Set up QEMU - uses: docker/setup-qemu-action@v2 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v2 - - - name: Login to Quay.io - env: - QUAY_PASSWORD: ${{ secrets.QUAYIO_REGISTRY_PASSWORD }} - QUAY_USERNAME: ${{ secrets.QUAYIO_REGISTRY_USERNAME }} - run: docker login -u="${QUAY_USERNAME}" -p="${QUAY_PASSWORD}" quay.io - - - name: Build the Docker image - run: docker buildx build . --file build/Dockerfile --tag ${{ steps.image-name.outputs.IMAGE_NAME }}:${{ steps.image-version.outputs.IMAGE_VERSION }} --tag ${{ steps.image-name.outputs.IMAGE_NAME }}:latest --build-arg image_version=${{ steps.image-version.outputs.IMAGE_VERSION }} --build-arg client=image-release --push --platform linux/amd64,linux/arm64 - - - name: Install cosign - uses: sigstore/cosign-installer@main - with: - cosign-release: 'v1.12.0' - - name: sign kubescape container image - env: - COSIGN_EXPERIMENTAL: "true" - run: | - cosign sign --force ${{ steps.image-name.outputs.IMAGE_NAME }}:latest - cosign sign --force ${{ steps.image-name.outputs.IMAGE_NAME }}:${{ steps.image-version.outputs.IMAGE_VERSION }} - + + publish-image: + # if: ${{ github.repository == 'kubescape/kubescape' }} # TODO + uses: ./.github/workflows/build-image.yaml + needs: create-release + with: + client: "image-release" + image_name: "quay.io/${{ github.repository_owner }}/kubescape" + image_tag: "v2.0.${{ github.run_number }}" + support_platforms: true + cosign: true + secrets: inherit diff --git a/.github/workflows/build_dev.yaml b/.github/workflows/build_dev.yaml index ad03b6d8..4da6346b 100644 --- a/.github/workflows/build_dev.yaml +++ b/.github/workflows/build_dev.yaml @@ -7,136 +7,20 @@ on: # Do not run the pipeline if only Markdown files changed - '**.md' jobs: - build: - name: Create cross-platform dev build - runs-on: ${{ matrix.os }} - strategy: - matrix: - os: [ubuntu-latest, macos-latest, windows-latest] - steps: - - uses: actions/checkout@v3 - with: - submodules: recursive - - - name: Cache Go modules (Linux) - if: matrix.os == 'ubuntu-latest' - uses: actions/cache@v3 - with: - path: | - ~/.cache/go-build - ~/go/pkg/mod - key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} - restore-keys: | - ${{ runner.os }}-go- - - - name: Cache Go modules (macOS) - if: matrix.os == 'macos-latest' - uses: actions/cache@v3 - with: - path: | - ~/Library/Caches/go-build - ~/go/pkg/mod - key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} - restore-keys: | - ${{ runner.os }}-go- - - - name: Cache Go modules (Windows) - if: matrix.os == 'windows-latest' - uses: actions/cache@v3 - with: - path: | - ~\AppData\Local\go-build - ~\go\pkg\mod - key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} - restore-keys: | - ${{ runner.os }}-go- - - - name: Set up Go - uses: actions/setup-go@v3 - with: - go-version: 1.18 - - # - name: Test cmd pkg - # run: cd cmd && go test -v ./... - - # - name: Test core pkg - # env: - # GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # run: cd core && go test -v ./... - - # - name: Test cmd pkg - # run: cd cmd && go test -v ./... - - - name: Install MSYS2 & libgit2 (Windows) - shell: cmd - run: .\build.bat all - if: matrix.os == 'windows-latest' - - - name: Install libgit2 (Linux/macOS) - run: make libgit2 - if: matrix.os != 'windows-latest' - - - name: Test core pkg - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: go test -tags=static -v ./... - - - name: Test httphandler pkg - run: cd httphandler && go test -tags=static -v ./... - - - name: Build - env: - RELEASE: v2.0.${{ github.run_number }} - CLIENT: release-dev - CGO_ENABLED: 1 - run: python3 --version && python3 build.py - - - name: Smoke Testing - env: - RELEASE: v2.0.${{ github.run_number }} - KUBESCAPE_SKIP_UPDATE_CHECK: "true" - run: python3 smoke_testing/init.py ${PWD}/build/${{ matrix.os }}/kubescape - - - name: Upload build artifacts - uses: actions/upload-artifact@v2 - with: - name: kubescape-${{ matrix.os }} - path: build/${{ matrix.os }}/kubescape - - build-docker: - name: Build docker container, tag and upload to registry - needs: build - if: ${{ github.repository == 'kubescape/kubescape' }} # TODO - runs-on: ubuntu-latest - permissions: - id-token: write - packages: write - contents: read - - steps: - - uses: actions/checkout@v2 - with: - submodules: recursive - - - name: Set image version - id: image-version - run: echo '::set-output name=IMAGE_VERSION::dev-v2.0.${{ github.run_number }}' - - - name: Set image name - id: image-name - run: echo '::set-output name=IMAGE_NAME::quay.io/${{ github.repository_owner }}/kubescape' - - - name: Set up QEMU - uses: docker/setup-qemu-action@v2 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v2 - - - name: Login to Quay.io - env: - QUAY_PASSWORD: ${{ secrets.QUAYIO_REGISTRY_PASSWORD }} - QUAY_USERNAME: ${{ secrets.QUAYIO_REGISTRY_USERNAME }} - run: docker login -u="${QUAY_USERNAME}" -p="${QUAY_PASSWORD}" quay.io - - - name: Build the Docker image - run: docker buildx build . --file build/Dockerfile --tag ${{ steps.image-name.outputs.IMAGE_NAME }}:${{ steps.image-version.outputs.IMAGE_VERSION }} --build-arg image_version=${{ steps.image-version.outputs.IMAGE_VERSION }} --build-arg client=image-dev --push --platform linux/amd64,linux/arm64 + test: + uses: ./.github/workflows/test.yaml + with: + release: "v2.0.${{ github.run_number }}" + client: test + + publish-dev-image: + # if: ${{ github.repository == 'kubescape/kubescape' }} # TODO + uses: ./.github/workflows/build-image.yaml + needs: test + with: + client: "image-dev" + image_name: "quay.io/${{ github.repository_owner }}/kubescape" + image_tag: "dev-v2.0.${{ github.run_number }}" + support_platforms: false + cosign: true + secrets: inherit diff --git a/.github/workflows/pr_checks.yaml b/.github/workflows/pr_checks.yaml index ca3c7b9d..e498c700 100644 --- a/.github/workflows/pr_checks.yaml +++ b/.github/workflows/pr_checks.yaml @@ -6,87 +6,13 @@ on: types: [ edited, opened, synchronize, reopened ] paths-ignore: # Do not run the pipeline if only Markdown files changed + - '**.yaml' - '**.md' + push: + branches: [ workflow-call-testing ] jobs: - build: - name: Create cross-platform build - runs-on: ${{ matrix.os }} - strategy: - matrix: - os: [ubuntu-latest, macos-latest, windows-latest] - steps: - - uses: actions/checkout@v3 - with: - submodules: recursive - - - name: Cache Go modules (Linux) - if: matrix.os == 'ubuntu-latest' - uses: actions/cache@v3 - with: - path: | - ~/.cache/go-build - ~/go/pkg/mod - key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} - restore-keys: | - ${{ runner.os }}-go- - - - name: Cache Go modules (macOS) - if: matrix.os == 'macos-latest' - uses: actions/cache@v3 - with: - path: | - ~/Library/Caches/go-build - ~/go/pkg/mod - key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} - restore-keys: | - ${{ runner.os }}-go- - - - name: Cache Go modules (Windows) - if: matrix.os == 'windows-latest' - uses: actions/cache@v3 - with: - path: | - ~\AppData\Local\go-build - ~\go\pkg\mod - key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} - restore-keys: | - ${{ runner.os }}-go- - - - name: Set up Go - uses: actions/setup-go@v3 - with: - go-version: 1.18 - - - name: Install MSYS2 & libgit2 (Windows) - shell: cmd - run: .\build.bat all - if: matrix.os == 'windows-latest' - - - name: Install libgit2 (Linux/macOS) - run: make libgit2 - if: matrix.os != 'windows-latest' - - # - name: Test cmd pkg - # run: cd cmd && go test -v ./... - - - name: Test core pkg - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: go test -tags=static -v ./... - - - name: Test httphandler pkg - run: cd httphandler && go test -tags=static -v ./... - - - name: Build - env: - RELEASE: v2.0.${{ github.run_number }} - CLIENT: test - CGO_ENABLED: 1 - run: python3 --version && python3 build.py - - - name: Smoke Testing - env: - RELEASE: v2.0.${{ github.run_number }} - KUBESCAPE_SKIP_UPDATE_CHECK: "true" - run: python3 smoke_testing/init.py ${PWD}/build/${{ matrix.os }}/kubescape - + trigger-test-workflow: + uses: ./.github/workflows/test.yaml + with: + release: "v2.0.${{ github.run_number }}" + client: test diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml new file mode 100644 index 00000000..4f91b854 --- /dev/null +++ b/.github/workflows/release.yaml @@ -0,0 +1,44 @@ +name: build + +on: + workflow_call: + inputs: + release_name: + description: 'release' + required: true + type: string + tag_name: + description: 'tag' + required: true + type: string + draft: + description: 'create draft release' + required: false + type: boolean + default: false + secrets: + GITHUB_TOKEN: + required: true + outputs: + upload_url: + description: "The first output string" + value: ${{ jobs.release.outputs.upload_url }} + +jobs: + release: + name: Create release + runs-on: ubuntu-latest + outputs: + upload_url: ${{ steps.create_release.outputs.upload_url }} + steps: + - name: Create a release + id: create_release + uses: actions/create-release@v1 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + tag_name: ${{ inputs.tag_name }} + release_name: ${{ inputs.release_name }} + draft: ${{ inputs.draft }} + prerelease: false + \ No newline at end of file diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml new file mode 100644 index 00000000..696a9dc9 --- /dev/null +++ b/.github/workflows/test.yaml @@ -0,0 +1,91 @@ +name: test + +on: + workflow_call: + inputs: + release: + description: 'release' + required: true + type: string + client: + description: 'Client name' + required: true + type: string +jobs: + build: + name: Create cross-platform build + runs-on: ${{ matrix.os }} + strategy: + matrix: + os: [ubuntu-latest, macos-latest, windows-latest] + steps: + - uses: actions/checkout@v3 + with: + submodules: recursive + + - name: Cache Go modules (Linux) + if: matrix.os == 'ubuntu-latest' + uses: actions/cache@v3 + with: + path: | + ~/.cache/go-build + ~/go/pkg/mod + key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} + restore-keys: | + ${{ runner.os }}-go- + + - name: Cache Go modules (macOS) + if: matrix.os == 'macos-latest' + uses: actions/cache@v3 + with: + path: | + ~/Library/Caches/go-build + ~/go/pkg/mod + key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} + restore-keys: | + ${{ runner.os }}-go- + + - name: Cache Go modules (Windows) + if: matrix.os == 'windows-latest' + uses: actions/cache@v3 + with: + path: | + ~\AppData\Local\go-build + ~\go\pkg\mod + key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} + restore-keys: | + ${{ runner.os }}-go- + + - name: Set up Go + uses: actions/setup-go@v3 + with: + go-version: 1.18 + + - name: Install MSYS2 & libgit2 (Windows) + shell: cmd + run: .\build.bat all + if: matrix.os == 'windows-latest' + + - name: Install libgit2 (Linux/macOS) + run: make libgit2 + if: matrix.os != 'windows-latest' + + - name: Test core pkg + run: go test -tags=static -v ./... + + - name: Test httphandler pkg + run: cd httphandler && go test -tags=static -v ./... + + - name: Build + env: + RELEASE: ${{ inputs.release }} + CLIENT: test + CGO_ENABLED: 1 + run: python3 --version && python3 build.py + + - name: Smoke Testing + env: + RELEASE: ${{ inputs.release }} + KUBESCAPE_SKIP_UPDATE_CHECK: "true" + run: python3 smoke_testing/init.py ${PWD}/build/${{ matrix.os }}/kubescape + From b7b83b26b57f80324b90025da1d012b10c3ab41e Mon Sep 17 00:00:00 2001 From: David Wertenteil Date: Mon, 3 Oct 2022 14:35:07 +0300 Subject: [PATCH 7/9] cleaning from unused branches --- .github/workflows/build.yaml | 2 +- .github/workflows/build_dev.yaml | 4 ++-- .github/workflows/pr_checks.yaml | 4 +--- 3 files changed, 4 insertions(+), 6 deletions(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 6c5a4bcb..afa64862 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -77,7 +77,7 @@ jobs: asset_content_type: application/octet-stream publish-image: - # if: ${{ github.repository == 'kubescape/kubescape' }} # TODO + if: ${{ github.repository == 'kubescape/kubescape' }} # TODO uses: ./.github/workflows/build-image.yaml needs: create-release with: diff --git a/.github/workflows/build_dev.yaml b/.github/workflows/build_dev.yaml index 71f88a54..be9acb34 100644 --- a/.github/workflows/build_dev.yaml +++ b/.github/workflows/build_dev.yaml @@ -2,7 +2,7 @@ name: build-dev on: push: - branches: [ gh-testing ] + branches: [ dev ] paths-ignore: # Do not run the pipeline if only Markdown files changed - '**.md' @@ -14,7 +14,7 @@ jobs: client: test publish-dev-image: - # if: ${{ github.repository == 'kubescape/kubescape' }} # TODO + if: ${{ github.repository == 'kubescape/kubescape' }} # TODO uses: ./.github/workflows/build-image.yaml needs: test with: diff --git a/.github/workflows/pr_checks.yaml b/.github/workflows/pr_checks.yaml index e498c700..ad0c9dc9 100644 --- a/.github/workflows/pr_checks.yaml +++ b/.github/workflows/pr_checks.yaml @@ -8,10 +8,8 @@ on: # Do not run the pipeline if only Markdown files changed - '**.yaml' - '**.md' - push: - branches: [ workflow-call-testing ] jobs: - trigger-test-workflow: + test: uses: ./.github/workflows/test.yaml with: release: "v2.0.${{ github.run_number }}" From acd3a94c46b8de1a9823157ccae5cfdec887203a Mon Sep 17 00:00:00 2001 From: David Wertenteil Date: Thu, 6 Oct 2022 08:15:58 +0300 Subject: [PATCH 8/9] Adopt custom cluster name --- core/cautils/customerloader.go | 17 ++--------------- 1 file changed, 2 insertions(+), 15 deletions(-) diff --git a/core/cautils/customerloader.go b/core/cautils/customerloader.go index 44df78cb..5548ce5c 100644 --- a/core/cautils/customerloader.go +++ b/core/cautils/customerloader.go @@ -106,7 +106,7 @@ func NewLocalConfig( // If a custom cluster name is provided then set that name, else use the cluster's original name if customClusterName != "" { - lc.configObj.ClusterName = AdoptCustomClusterName(customClusterName) + lc.configObj.ClusterName = AdoptClusterName(customClusterName) } else if clusterName != "" { lc.configObj.ClusterName = AdoptClusterName(clusterName) // override config clusterName } @@ -216,7 +216,7 @@ func NewClusterConfig(k8s *k8sinterface.KubernetesApi, backendAPI getter.IBacken // If a custom cluster name is provided then set that name, else use the cluster's original name if customClusterName != "" { - c.configObj.ClusterName = AdoptCustomClusterName(customClusterName) + c.configObj.ClusterName = AdoptClusterName(customClusterName) } else if clusterName != "" { c.configObj.ClusterName = AdoptClusterName(clusterName) // override config clusterName } @@ -474,19 +474,6 @@ func DeleteConfigFile() error { return os.Remove(ConfigFileFullPath()) } -// To check if the custom cluster name is valid: -func AdoptCustomClusterName(customClusterName string) string { - is_alphanumeric := regexp.MustCompile(`^[a-zA-Z0-9]*$`).MatchString(customClusterName) - - // Check it does not contain special-characters - if is_alphanumeric == false { - logger.L().Fatal("custom cluster name cannot contain special characters") - } else if len(customClusterName) >= 256 { // Check it contains less than 256 characters - logger.L().Fatal("custom cluster name cannot contain more than 255 characters") - } - return customClusterName -} - func AdoptClusterName(clusterName string) string { re, err := regexp.Compile(`[^\w]+`) if err != nil { From 4c6e5903e3f22046f3e6784ce9adc7f23474f066 Mon Sep 17 00:00:00 2001 From: David Wertenteil Date: Tue, 25 Oct 2022 09:49:43 +0300 Subject: [PATCH 9/9] Adding links to readme --- README.md | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index a9a49874..61c96785 100644 --- a/README.md +++ b/README.md @@ -52,11 +52,15 @@ kubescape scan --submit --enable-host-scan --verbose
## Architecture in short -### CLI - +### [CLI](#kubescape-cli) +
+ cli-diagram +
-### Operator - +### [Operator](https://github.com/kubescape/helm-charts#readme) +
+ operator-diagram +
### Please [star ⭐](https://github.com/kubescape/kubescape/stargazers) the repo if you want us to continue developing and improving Kubescape 😀