github/kubescape
1
0
Fork 0
mirror of https://github.com/kubescape/kubescape.git synced 2026-04-15 06:58:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

fixes

Browse Source
This commit is contained in:
DanielGrunbergerCA
2022-03-16 14:16:48 +02:00
parent 6cacfb7b16
commit 44084592cb
10 changed files with 67 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/go.mod
+1 -1
View File
@@ -7,7 +7,7 @@ replace github.com/armosec/kubescape/core => ../core
require (
github.com/armosec/k8s-interface v0.0.68
github.com/armosec/kubescape/core v0.0.0-00010101000000-000000000000
github.com/armosec/opa-utils v0.0.119
github.com/armosec/opa-utils v0.0.120
github.com/armosec/rbac-utils v0.0.14
github.com/google/uuid v1.3.0
github.com/mattn/go-isatty v0.0.14
cmd/go.sum
+2 -2
View File
@@ -109,8 +109,8 @@ github.com/armosec/k8s-interface v0.0.66/go.mod h1:vwprS8qn/iowd5yf0JHpqDsLA5I8W
github.com/armosec/k8s-interface v0.0.68 h1:6CtSakISiI47YHkxh+Va9FzZQIBkWa6g9sbiNxq1Zkk=
github.com/armosec/k8s-interface v0.0.68/go.mod h1:PeWn41C2uenZi+xfZdyFF/zG5wXACA00htQyknDUWDE=
github.com/armosec/opa-utils v0.0.64/go.mod h1:6tQP8UDq2EvEfSqh8vrUdr/9QVSCG4sJfju1SXQOn4c=
github.com/armosec/opa-utils v0.0.119 h1:sUPJgz1WRXgGIlyypposNuB/EHJm9SqvIbwS54SREvY=
github.com/armosec/opa-utils v0.0.119/go.mod h1:gap+EaLG5rnyqvIRGxtdNDC9y7VvoGNm90zK8Ls7avQ=
github.com/armosec/opa-utils v0.0.120 h1:WAtgm2U1o9fgA/2pjYNy+igqNC6ju3/CxQ8qRHdO+5k=
github.com/armosec/opa-utils v0.0.120/go.mod h1:gap+EaLG5rnyqvIRGxtdNDC9y7VvoGNm90zK8Ls7avQ=
github.com/armosec/rbac-utils v0.0.1/go.mod h1:pQ8CBiij8kSKV7aeZm9FMvtZN28VgA7LZcYyTWimq40=
github.com/armosec/rbac-utils v0.0.14 h1:CKYKcgqJEXWF2Hen/B1pVGtS3nDAG1wp9dDv6oNtq90=
github.com/armosec/rbac-utils v0.0.14/go.mod h1:Ex/IdGWhGv9HZq6Hs8N/ApzCKSIvpNe/ETqDfnuyah0=
core/go.mod
+1 -1
View File
@@ -5,7 +5,7 @@ go 1.17
require (
github.com/armosec/armoapi-go v0.0.58
github.com/armosec/k8s-interface v0.0.68
github.com/armosec/opa-utils v0.0.119
github.com/armosec/opa-utils v0.0.120
github.com/armosec/rbac-utils v0.0.14
github.com/armosec/utils-go v0.0.3
github.com/armosec/utils-k8s-go v0.0.3
core/go.sum
+2 -2
View File
@@ -109,8 +109,8 @@ github.com/armosec/k8s-interface v0.0.66/go.mod h1:vwprS8qn/iowd5yf0JHpqDsLA5I8W
github.com/armosec/k8s-interface v0.0.68 h1:6CtSakISiI47YHkxh+Va9FzZQIBkWa6g9sbiNxq1Zkk=
github.com/armosec/k8s-interface v0.0.68/go.mod h1:PeWn41C2uenZi+xfZdyFF/zG5wXACA00htQyknDUWDE=
github.com/armosec/opa-utils v0.0.64/go.mod h1:6tQP8UDq2EvEfSqh8vrUdr/9QVSCG4sJfju1SXQOn4c=
github.com/armosec/opa-utils v0.0.119 h1:sUPJgz1WRXgGIlyypposNuB/EHJm9SqvIbwS54SREvY=
github.com/armosec/opa-utils v0.0.119/go.mod h1:gap+EaLG5rnyqvIRGxtdNDC9y7VvoGNm90zK8Ls7avQ=
github.com/armosec/opa-utils v0.0.120 h1:WAtgm2U1o9fgA/2pjYNy+igqNC6ju3/CxQ8qRHdO+5k=
github.com/armosec/opa-utils v0.0.120/go.mod h1:gap+EaLG5rnyqvIRGxtdNDC9y7VvoGNm90zK8Ls7avQ=
github.com/armosec/rbac-utils v0.0.1/go.mod h1:pQ8CBiij8kSKV7aeZm9FMvtZN28VgA7LZcYyTWimq40=
github.com/armosec/rbac-utils v0.0.14 h1:CKYKcgqJEXWF2Hen/B1pVGtS3nDAG1wp9dDv6oNtq90=
github.com/armosec/rbac-utils v0.0.14/go.mod h1:Ex/IdGWhGv9HZq6Hs8N/ApzCKSIvpNe/ETqDfnuyah0=
core/pkg/hostsensorutils/hostsensorgetfrompod.go
+25 -10
View File
@@ -157,10 +157,11 @@ func (hsh *HostSensorHandler) GetKubeletConfigurations() ([]hostsensor.HostSenso
return res, err
}
func (hsh *HostSensorHandler) CollectResources(infoMap map[string]apis.StatusInfo) ([]hostsensor.HostSensorDataEnvelope, error) {
func (hsh *HostSensorHandler) CollectResources() ([]hostsensor.HostSensorDataEnvelope, map[string]apis.StatusInfo, error) {
res := make([]hostsensor.HostSensorDataEnvelope, 0)
infoMap := make(map[string]apis.StatusInfo)
if hsh.DaemonSet == nil {
return res, nil
return res, nil, nil
}
var kcData []hostsensor.HostSensorDataEnvelope
var err error
@@ -170,49 +171,63 @@ func (hsh *HostSensorHandler) CollectResources(infoMap map[string]apis.StatusInf
addInfoToMap(KubeletConfiguration, infoMap, err)
logger.L().Warning(err.Error())
}
res = append(res, kcData...)
if len(kcData) > 0 {
res = append(res, kcData...)
}
//
kcData, err = hsh.GetKubeletCommandLine()
if err != nil {
addInfoToMap(KubeletCommandLine, infoMap, err)
logger.L().Warning(err.Error())
}
res = append(res, kcData...)
if len(kcData) > 0 {
res = append(res, kcData...)
}
//
kcData, err = hsh.GetOsReleaseFile()
if err != nil {
addInfoToMap(OsReleaseFile, infoMap, err)
logger.L().Warning(err.Error())
}
res = append(res, kcData...)
if len(kcData) > 0 {
res = append(res, kcData...)
}
//
kcData, err = hsh.GetKernelVersion()
if err != nil {
addInfoToMap(KernelVersion, infoMap, err)
logger.L().Warning(err.Error())
}
res = append(res, kcData...)
if len(kcData) > 0 {
res = append(res, kcData...)
}
//
kcData, err = hsh.GetLinuxSecurityHardeningStatus()
if err != nil {
addInfoToMap(LinuxSecurityHardeningStatus, infoMap, err)
logger.L().Warning(err.Error())
}
res = append(res, kcData...)
if len(kcData) > 0 {
res = append(res, kcData...)
}
//
kcData, err = hsh.GetOpenPortsList()
if err != nil {
addInfoToMap(OpenPortsList, infoMap, err)
logger.L().Warning(err.Error())
}
res = append(res, kcData...)
if len(kcData) > 0 {
res = append(res, kcData...)
}
// GetKernelVariables
kcData, err = hsh.GetKernelVariables()
if err != nil {
addInfoToMap(LinuxKernelVariables, infoMap, err)
logger.L().Warning(err.Error())
}
res = append(res, kcData...)
if len(kcData) > 0 {
res = append(res, kcData...)
}
logger.L().Debug("Done reading information from host scanner")
return res, nil
return res, infoMap, nil
}
core/pkg/hostsensorutils/hostsensorinterface.go
+1 -1
View File
@@ -8,6 +8,6 @@ import (
type IHostSensor interface {
Init() error
TearDown() error
CollectResources(map[string]apis.StatusInfo) ([]hostsensor.HostSensorDataEnvelope, error)
CollectResources() ([]hostsensor.HostSensorDataEnvelope, map[string]apis.StatusInfo, error)
GetNamespace() string
}
core/pkg/hostsensorutils/hostsensormock.go
+2 -2
View File
@@ -16,8 +16,8 @@ func (hshm *HostSensorHandlerMock) TearDown() error {
return nil
}
func (hshm *HostSensorHandlerMock) CollectResources(errorMap map[string]apis.StatusInfo) ([]hostsensor.HostSensorDataEnvelope, error) {
return []hostsensor.HostSensorDataEnvelope{}, nil
func (hshm *HostSensorHandlerMock) CollectResources() ([]hostsensor.HostSensorDataEnvelope, map[string]apis.StatusInfo, error) {
return []hostsensor.HostSensorDataEnvelope{}, nil, nil
}
func (hshm *HostSensorHandlerMock) GetNamespace() string {
core/pkg/hostsensorutils/utils.go
+7 -7
View File
@@ -16,18 +16,18 @@ var (
MapResourceToApiGroup = map[string]string{
KubeletConfiguration: "hostdata.kubescape.cloud/v1beta0",
OsReleaseFile: "hostdata.kubescape.cloud/v1beta0/OsReleaseFile",
KubeletCommandLine: "hostdata.kubescape.cloud/v1beta0/KubeletCommandLine",
KernelVersion: "hostdata.kubescape.cloud/v1beta0/KernelVersion",
LinuxSecurityHardeningStatus: "hostdata.kubescape.cloud/v1beta0/LinuxSecurityHardeningStatus",
OpenPortsList: "hostdata.kubescape.cloud/v1beta0/OpenPortsList",
LinuxKernelVariables: "hostdata.kubescape.cloud/v1beta0/LinuxKernelVariables",
OsReleaseFile: "hostdata.kubescape.cloud/v1beta0/",
KubeletCommandLine: "hostdata.kubescape.cloud/v1beta0/",
KernelVersion: "hostdata.kubescape.cloud/v1beta0/",
LinuxSecurityHardeningStatus: "hostdata.kubescape.cloud/v1beta0/",
OpenPortsList: "hostdata.kubescape.cloud/v1beta0/",
LinuxKernelVariables: "hostdata.kubescape.cloud/v1beta0/",
}
)
func addInfoToMap(resource string, infoMap map[string]apis.StatusInfo, err error) {
group, version := k8sinterface.SplitApiVersion(MapResourceToApiGroup[resource])
r := k8sinterface.JoinResourceTriplets(group, version, KubeletConfiguration)
r := k8sinterface.JoinResourceTriplets(group, version, resource)
infoMap[r] = apis.StatusInfo{
InnerStatus: apis.StatusSkipped,
InnerInfo: err.Error(),
core/pkg/policyhandler/handlenotification.go
+13 -3
View File
@@ -47,11 +47,21 @@ func (policyHandler *PolicyHandler) CollectResources(notification *reporthandlin
return opaSessionObj, nil
}
func setOpaSessionObj(opaSessionObj *cautils.OPASessionObj, scanInfo *cautils.ScanInfo) {
func scanInfoToScanMetadata(opaSessionObj *cautils.OPASessionObj, scanInfo *cautils.ScanInfo) {
opaSessionObj.Metadata.ClusterMetadata.ContextName = k8sinterface.GetCurrentContext().Cluster
opaSessionObj.Metadata.ScanMetadata.Format = scanInfo.Format
opaSessionObj.Metadata.ScanMetadata.Submit = scanInfo.Submit
opaSessionObj.Metadata.ScanMetadata.ExcludedNamespaces = strings.Split(scanInfo.ExcludedNamespaces, ",")
if len(scanInfo.ExcludedNamespaces) > 1 {
opaSessionObj.Metadata.ScanMetadata.ExcludedNamespaces = strings.Split(scanInfo.ExcludedNamespaces[1:], ",")
}
// scan type
if len(scanInfo.PolicyIdentifier) > 0 {
opaSessionObj.Metadata.ScanMetadata.TargetType = string(scanInfo.PolicyIdentifier[0].Kind)
}
// append frameworks
for _, policy := range scanInfo.PolicyIdentifier {
opaSessionObj.Metadata.ScanMetadata.TargetNames = append(opaSessionObj.Metadata.ScanMetadata.TargetNames, policy.Name)
}
opaSessionObj.Metadata.ScanMetadata.VerboseMode = scanInfo.VerboseMode
opaSessionObj.Metadata.ScanMetadata.FailThreshold = scanInfo.FailThreshold
opaSessionObj.Metadata.ScanMetadata.HostScanner = *scanInfo.HostSensorEnabled.Get()
@@ -61,7 +71,7 @@ func setOpaSessionObj(opaSessionObj *cautils.OPASessionObj, scanInfo *cautils.Sc
func (policyHandler *PolicyHandler) getResources(notification *reporthandling.PolicyNotification, opaSessionObj *cautils.OPASessionObj, scanInfo *cautils.ScanInfo) error {
opaSessionObj.Report.ClusterAPIServerInfo = policyHandler.resourceHandler.GetClusterAPIServerInfo()
setOpaSessionObj(opaSessionObj, scanInfo)
scanInfoToScanMetadata(opaSessionObj, scanInfo)
resourcesMap, allResources, armoResources, err := policyHandler.resourceHandler.GetResources(opaSessionObj, &notification.Designators)
if err != nil {
core/pkg/resourcehandler/k8sresources.go
+13 -6
View File
@@ -90,12 +90,15 @@ func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessio
// check that controls use host sensor resources
if len(hostResources) > 0 {
if sessionObj.Metadata.ScanMetadata.HostScanner {
if err := k8sHandler.collectHostResources(allResources, armoResourceMap, sessionObj.InfoMap); err != nil {
infoMap, err := k8sHandler.collectHostResources(allResources, armoResourceMap)
if err != nil {
logger.L().Warning("failed to collect host scanner resources", helpers.Error(err))
cautils.SetInfoMapForResources(err.Error(), hostResources, sessionObj.InfoMap)
} else if k8sHandler.hostSensorHandler == nil {
// using hostSensor mock
cautils.SetInfoMapForResources("failed to init host scanner", hostResources, sessionObj.InfoMap)
} else {
sessionObj.InfoMap = infoMap
}
} else {
cautils.SetInfoMapForResources("enable-host-scan flag not used", hostResources, sessionObj.InfoMap)
@@ -219,11 +222,11 @@ func ConvertMapListToMeta(resourceMap []map[string]interface{}) []workloadinterf
// }
// return nil
// }
func (k8sHandler *K8sResourceHandler) collectHostResources(allResources map[string]workloadinterface.IMetadata, armoResourceMap *cautils.ArmoResources, errorMap map[string]apis.StatusInfo) error {
func (k8sHandler *K8sResourceHandler) collectHostResources(allResources map[string]workloadinterface.IMetadata, armoResourceMap *cautils.ArmoResources) (map[string]apis.StatusInfo, error) {
logger.L().Debug("Collecting host scanner resources")
hostResources, err := k8sHandler.hostSensorHandler.CollectResources(errorMap)
hostResources, infoMap, err := k8sHandler.hostSensorHandler.CollectResources()
if err != nil {
return err
return nil, err
}
for rscIdx := range hostResources {
@@ -237,7 +240,7 @@ func (k8sHandler *K8sResourceHandler) collectHostResources(allResources map[stri
}
(*armoResourceMap)[groupResource] = append(grpResourceList, hostResources[rscIdx].GetID())
}
return nil
return infoMap, nil
}
func (k8sHandler *K8sResourceHandler) collectRbacResources(allResources map[string]workloadinterface.IMetadata) error {
@@ -303,5 +306,9 @@ func (k8sHandler *K8sResourceHandler) pullWorkerNodesNumber() (int, error) {
if err != nil {
return 0, err
}
return len(nodesList.Items), nil
nodesNumber := 0
if nodesList != nil {
nodesNumber = len(nodesList.Items)
}
return nodesNumber, nil
}