From 44084592cbb8754ee6bffbf30f3f9ea4ef52e6c0 Mon Sep 17 00:00:00 2001 From: DanielGrunbergerCA Date: Wed, 16 Mar 2022 14:16:48 +0200 Subject: [PATCH] fixes --- cmd/go.mod | 2 +- cmd/go.sum | 4 +-- core/go.mod | 2 +- core/go.sum | 4 +-- .../hostsensorutils/hostsensorgetfrompod.go | 35 +++++++++++++------ .../hostsensorutils/hostsensorinterface.go | 2 +- core/pkg/hostsensorutils/hostsensormock.go | 4 +-- core/pkg/hostsensorutils/utils.go | 14 ++++---- core/pkg/policyhandler/handlenotification.go | 16 +++++++-- core/pkg/resourcehandler/k8sresources.go | 19 ++++++---- 10 files changed, 67 insertions(+), 35 deletions(-) diff --git a/cmd/go.mod b/cmd/go.mod index b128883d..6e13399b 100644 --- a/cmd/go.mod +++ b/cmd/go.mod @@ -7,7 +7,7 @@ replace github.com/armosec/kubescape/core => ../core require ( github.com/armosec/k8s-interface v0.0.68 github.com/armosec/kubescape/core v0.0.0-00010101000000-000000000000 - github.com/armosec/opa-utils v0.0.119 + github.com/armosec/opa-utils v0.0.120 github.com/armosec/rbac-utils v0.0.14 github.com/google/uuid v1.3.0 github.com/mattn/go-isatty v0.0.14 diff --git a/cmd/go.sum b/cmd/go.sum index b1bba8cc..9e212048 100644 --- a/cmd/go.sum +++ b/cmd/go.sum @@ -109,8 +109,8 @@ github.com/armosec/k8s-interface v0.0.66/go.mod h1:vwprS8qn/iowd5yf0JHpqDsLA5I8W github.com/armosec/k8s-interface v0.0.68 h1:6CtSakISiI47YHkxh+Va9FzZQIBkWa6g9sbiNxq1Zkk= github.com/armosec/k8s-interface v0.0.68/go.mod h1:PeWn41C2uenZi+xfZdyFF/zG5wXACA00htQyknDUWDE= github.com/armosec/opa-utils v0.0.64/go.mod h1:6tQP8UDq2EvEfSqh8vrUdr/9QVSCG4sJfju1SXQOn4c= -github.com/armosec/opa-utils v0.0.119 h1:sUPJgz1WRXgGIlyypposNuB/EHJm9SqvIbwS54SREvY= -github.com/armosec/opa-utils v0.0.119/go.mod h1:gap+EaLG5rnyqvIRGxtdNDC9y7VvoGNm90zK8Ls7avQ= +github.com/armosec/opa-utils v0.0.120 h1:WAtgm2U1o9fgA/2pjYNy+igqNC6ju3/CxQ8qRHdO+5k= +github.com/armosec/opa-utils v0.0.120/go.mod h1:gap+EaLG5rnyqvIRGxtdNDC9y7VvoGNm90zK8Ls7avQ= github.com/armosec/rbac-utils v0.0.1/go.mod h1:pQ8CBiij8kSKV7aeZm9FMvtZN28VgA7LZcYyTWimq40= github.com/armosec/rbac-utils v0.0.14 h1:CKYKcgqJEXWF2Hen/B1pVGtS3nDAG1wp9dDv6oNtq90= github.com/armosec/rbac-utils v0.0.14/go.mod h1:Ex/IdGWhGv9HZq6Hs8N/ApzCKSIvpNe/ETqDfnuyah0= diff --git a/core/go.mod b/core/go.mod index c9df7592..c96360df 100644 --- a/core/go.mod +++ b/core/go.mod @@ -5,7 +5,7 @@ go 1.17 require ( github.com/armosec/armoapi-go v0.0.58 github.com/armosec/k8s-interface v0.0.68 - github.com/armosec/opa-utils v0.0.119 + github.com/armosec/opa-utils v0.0.120 github.com/armosec/rbac-utils v0.0.14 github.com/armosec/utils-go v0.0.3 github.com/armosec/utils-k8s-go v0.0.3 diff --git a/core/go.sum b/core/go.sum index 44620ebc..b645f269 100644 --- a/core/go.sum +++ b/core/go.sum @@ -109,8 +109,8 @@ github.com/armosec/k8s-interface v0.0.66/go.mod h1:vwprS8qn/iowd5yf0JHpqDsLA5I8W github.com/armosec/k8s-interface v0.0.68 h1:6CtSakISiI47YHkxh+Va9FzZQIBkWa6g9sbiNxq1Zkk= github.com/armosec/k8s-interface v0.0.68/go.mod h1:PeWn41C2uenZi+xfZdyFF/zG5wXACA00htQyknDUWDE= github.com/armosec/opa-utils v0.0.64/go.mod h1:6tQP8UDq2EvEfSqh8vrUdr/9QVSCG4sJfju1SXQOn4c= -github.com/armosec/opa-utils v0.0.119 h1:sUPJgz1WRXgGIlyypposNuB/EHJm9SqvIbwS54SREvY= -github.com/armosec/opa-utils v0.0.119/go.mod h1:gap+EaLG5rnyqvIRGxtdNDC9y7VvoGNm90zK8Ls7avQ= +github.com/armosec/opa-utils v0.0.120 h1:WAtgm2U1o9fgA/2pjYNy+igqNC6ju3/CxQ8qRHdO+5k= +github.com/armosec/opa-utils v0.0.120/go.mod h1:gap+EaLG5rnyqvIRGxtdNDC9y7VvoGNm90zK8Ls7avQ= github.com/armosec/rbac-utils v0.0.1/go.mod h1:pQ8CBiij8kSKV7aeZm9FMvtZN28VgA7LZcYyTWimq40= github.com/armosec/rbac-utils v0.0.14 h1:CKYKcgqJEXWF2Hen/B1pVGtS3nDAG1wp9dDv6oNtq90= github.com/armosec/rbac-utils v0.0.14/go.mod h1:Ex/IdGWhGv9HZq6Hs8N/ApzCKSIvpNe/ETqDfnuyah0= diff --git a/core/pkg/hostsensorutils/hostsensorgetfrompod.go b/core/pkg/hostsensorutils/hostsensorgetfrompod.go index e5ce7e2d..ff3cea72 100644 --- a/core/pkg/hostsensorutils/hostsensorgetfrompod.go +++ b/core/pkg/hostsensorutils/hostsensorgetfrompod.go @@ -157,10 +157,11 @@ func (hsh *HostSensorHandler) GetKubeletConfigurations() ([]hostsensor.HostSenso return res, err } -func (hsh *HostSensorHandler) CollectResources(infoMap map[string]apis.StatusInfo) ([]hostsensor.HostSensorDataEnvelope, error) { +func (hsh *HostSensorHandler) CollectResources() ([]hostsensor.HostSensorDataEnvelope, map[string]apis.StatusInfo, error) { res := make([]hostsensor.HostSensorDataEnvelope, 0) + infoMap := make(map[string]apis.StatusInfo) if hsh.DaemonSet == nil { - return res, nil + return res, nil, nil } var kcData []hostsensor.HostSensorDataEnvelope var err error @@ -170,49 +171,63 @@ func (hsh *HostSensorHandler) CollectResources(infoMap map[string]apis.StatusInf addInfoToMap(KubeletConfiguration, infoMap, err) logger.L().Warning(err.Error()) } - res = append(res, kcData...) + if len(kcData) > 0 { + res = append(res, kcData...) + } // kcData, err = hsh.GetKubeletCommandLine() if err != nil { addInfoToMap(KubeletCommandLine, infoMap, err) logger.L().Warning(err.Error()) } - res = append(res, kcData...) + if len(kcData) > 0 { + res = append(res, kcData...) + } // kcData, err = hsh.GetOsReleaseFile() if err != nil { addInfoToMap(OsReleaseFile, infoMap, err) logger.L().Warning(err.Error()) } - res = append(res, kcData...) + if len(kcData) > 0 { + res = append(res, kcData...) + } // kcData, err = hsh.GetKernelVersion() if err != nil { addInfoToMap(KernelVersion, infoMap, err) logger.L().Warning(err.Error()) } - res = append(res, kcData...) + if len(kcData) > 0 { + res = append(res, kcData...) + } // kcData, err = hsh.GetLinuxSecurityHardeningStatus() if err != nil { addInfoToMap(LinuxSecurityHardeningStatus, infoMap, err) logger.L().Warning(err.Error()) } - res = append(res, kcData...) + if len(kcData) > 0 { + res = append(res, kcData...) + } // kcData, err = hsh.GetOpenPortsList() if err != nil { addInfoToMap(OpenPortsList, infoMap, err) logger.L().Warning(err.Error()) } - res = append(res, kcData...) + if len(kcData) > 0 { + res = append(res, kcData...) + } // GetKernelVariables kcData, err = hsh.GetKernelVariables() if err != nil { addInfoToMap(LinuxKernelVariables, infoMap, err) logger.L().Warning(err.Error()) } - res = append(res, kcData...) + if len(kcData) > 0 { + res = append(res, kcData...) + } logger.L().Debug("Done reading information from host scanner") - return res, nil + return res, infoMap, nil } diff --git a/core/pkg/hostsensorutils/hostsensorinterface.go b/core/pkg/hostsensorutils/hostsensorinterface.go index 6fcda450..71d5e6ef 100644 --- a/core/pkg/hostsensorutils/hostsensorinterface.go +++ b/core/pkg/hostsensorutils/hostsensorinterface.go @@ -8,6 +8,6 @@ import ( type IHostSensor interface { Init() error TearDown() error - CollectResources(map[string]apis.StatusInfo) ([]hostsensor.HostSensorDataEnvelope, error) + CollectResources() ([]hostsensor.HostSensorDataEnvelope, map[string]apis.StatusInfo, error) GetNamespace() string } diff --git a/core/pkg/hostsensorutils/hostsensormock.go b/core/pkg/hostsensorutils/hostsensormock.go index 4067e8c0..f6f22fa0 100644 --- a/core/pkg/hostsensorutils/hostsensormock.go +++ b/core/pkg/hostsensorutils/hostsensormock.go @@ -16,8 +16,8 @@ func (hshm *HostSensorHandlerMock) TearDown() error { return nil } -func (hshm *HostSensorHandlerMock) CollectResources(errorMap map[string]apis.StatusInfo) ([]hostsensor.HostSensorDataEnvelope, error) { - return []hostsensor.HostSensorDataEnvelope{}, nil +func (hshm *HostSensorHandlerMock) CollectResources() ([]hostsensor.HostSensorDataEnvelope, map[string]apis.StatusInfo, error) { + return []hostsensor.HostSensorDataEnvelope{}, nil, nil } func (hshm *HostSensorHandlerMock) GetNamespace() string { diff --git a/core/pkg/hostsensorutils/utils.go b/core/pkg/hostsensorutils/utils.go index 92b89ddd..4f3eeb84 100644 --- a/core/pkg/hostsensorutils/utils.go +++ b/core/pkg/hostsensorutils/utils.go @@ -16,18 +16,18 @@ var ( MapResourceToApiGroup = map[string]string{ KubeletConfiguration: "hostdata.kubescape.cloud/v1beta0", - OsReleaseFile: "hostdata.kubescape.cloud/v1beta0/OsReleaseFile", - KubeletCommandLine: "hostdata.kubescape.cloud/v1beta0/KubeletCommandLine", - KernelVersion: "hostdata.kubescape.cloud/v1beta0/KernelVersion", - LinuxSecurityHardeningStatus: "hostdata.kubescape.cloud/v1beta0/LinuxSecurityHardeningStatus", - OpenPortsList: "hostdata.kubescape.cloud/v1beta0/OpenPortsList", - LinuxKernelVariables: "hostdata.kubescape.cloud/v1beta0/LinuxKernelVariables", + OsReleaseFile: "hostdata.kubescape.cloud/v1beta0/", + KubeletCommandLine: "hostdata.kubescape.cloud/v1beta0/", + KernelVersion: "hostdata.kubescape.cloud/v1beta0/", + LinuxSecurityHardeningStatus: "hostdata.kubescape.cloud/v1beta0/", + OpenPortsList: "hostdata.kubescape.cloud/v1beta0/", + LinuxKernelVariables: "hostdata.kubescape.cloud/v1beta0/", } ) func addInfoToMap(resource string, infoMap map[string]apis.StatusInfo, err error) { group, version := k8sinterface.SplitApiVersion(MapResourceToApiGroup[resource]) - r := k8sinterface.JoinResourceTriplets(group, version, KubeletConfiguration) + r := k8sinterface.JoinResourceTriplets(group, version, resource) infoMap[r] = apis.StatusInfo{ InnerStatus: apis.StatusSkipped, InnerInfo: err.Error(), diff --git a/core/pkg/policyhandler/handlenotification.go b/core/pkg/policyhandler/handlenotification.go index 9b167f3e..35fd6434 100644 --- a/core/pkg/policyhandler/handlenotification.go +++ b/core/pkg/policyhandler/handlenotification.go @@ -47,11 +47,21 @@ func (policyHandler *PolicyHandler) CollectResources(notification *reporthandlin return opaSessionObj, nil } -func setOpaSessionObj(opaSessionObj *cautils.OPASessionObj, scanInfo *cautils.ScanInfo) { +func scanInfoToScanMetadata(opaSessionObj *cautils.OPASessionObj, scanInfo *cautils.ScanInfo) { opaSessionObj.Metadata.ClusterMetadata.ContextName = k8sinterface.GetCurrentContext().Cluster opaSessionObj.Metadata.ScanMetadata.Format = scanInfo.Format opaSessionObj.Metadata.ScanMetadata.Submit = scanInfo.Submit - opaSessionObj.Metadata.ScanMetadata.ExcludedNamespaces = strings.Split(scanInfo.ExcludedNamespaces, ",") + if len(scanInfo.ExcludedNamespaces) > 1 { + opaSessionObj.Metadata.ScanMetadata.ExcludedNamespaces = strings.Split(scanInfo.ExcludedNamespaces[1:], ",") + } + // scan type + if len(scanInfo.PolicyIdentifier) > 0 { + opaSessionObj.Metadata.ScanMetadata.TargetType = string(scanInfo.PolicyIdentifier[0].Kind) + } + // append frameworks + for _, policy := range scanInfo.PolicyIdentifier { + opaSessionObj.Metadata.ScanMetadata.TargetNames = append(opaSessionObj.Metadata.ScanMetadata.TargetNames, policy.Name) + } opaSessionObj.Metadata.ScanMetadata.VerboseMode = scanInfo.VerboseMode opaSessionObj.Metadata.ScanMetadata.FailThreshold = scanInfo.FailThreshold opaSessionObj.Metadata.ScanMetadata.HostScanner = *scanInfo.HostSensorEnabled.Get() @@ -61,7 +71,7 @@ func setOpaSessionObj(opaSessionObj *cautils.OPASessionObj, scanInfo *cautils.Sc func (policyHandler *PolicyHandler) getResources(notification *reporthandling.PolicyNotification, opaSessionObj *cautils.OPASessionObj, scanInfo *cautils.ScanInfo) error { opaSessionObj.Report.ClusterAPIServerInfo = policyHandler.resourceHandler.GetClusterAPIServerInfo() - setOpaSessionObj(opaSessionObj, scanInfo) + scanInfoToScanMetadata(opaSessionObj, scanInfo) resourcesMap, allResources, armoResources, err := policyHandler.resourceHandler.GetResources(opaSessionObj, ¬ification.Designators) if err != nil { diff --git a/core/pkg/resourcehandler/k8sresources.go b/core/pkg/resourcehandler/k8sresources.go index ebb59818..73dd8207 100644 --- a/core/pkg/resourcehandler/k8sresources.go +++ b/core/pkg/resourcehandler/k8sresources.go @@ -90,12 +90,15 @@ func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessio // check that controls use host sensor resources if len(hostResources) > 0 { if sessionObj.Metadata.ScanMetadata.HostScanner { - if err := k8sHandler.collectHostResources(allResources, armoResourceMap, sessionObj.InfoMap); err != nil { + infoMap, err := k8sHandler.collectHostResources(allResources, armoResourceMap) + if err != nil { logger.L().Warning("failed to collect host scanner resources", helpers.Error(err)) cautils.SetInfoMapForResources(err.Error(), hostResources, sessionObj.InfoMap) } else if k8sHandler.hostSensorHandler == nil { // using hostSensor mock cautils.SetInfoMapForResources("failed to init host scanner", hostResources, sessionObj.InfoMap) + } else { + sessionObj.InfoMap = infoMap } } else { cautils.SetInfoMapForResources("enable-host-scan flag not used", hostResources, sessionObj.InfoMap) @@ -219,11 +222,11 @@ func ConvertMapListToMeta(resourceMap []map[string]interface{}) []workloadinterf // } // return nil // } -func (k8sHandler *K8sResourceHandler) collectHostResources(allResources map[string]workloadinterface.IMetadata, armoResourceMap *cautils.ArmoResources, errorMap map[string]apis.StatusInfo) error { +func (k8sHandler *K8sResourceHandler) collectHostResources(allResources map[string]workloadinterface.IMetadata, armoResourceMap *cautils.ArmoResources) (map[string]apis.StatusInfo, error) { logger.L().Debug("Collecting host scanner resources") - hostResources, err := k8sHandler.hostSensorHandler.CollectResources(errorMap) + hostResources, infoMap, err := k8sHandler.hostSensorHandler.CollectResources() if err != nil { - return err + return nil, err } for rscIdx := range hostResources { @@ -237,7 +240,7 @@ func (k8sHandler *K8sResourceHandler) collectHostResources(allResources map[stri } (*armoResourceMap)[groupResource] = append(grpResourceList, hostResources[rscIdx].GetID()) } - return nil + return infoMap, nil } func (k8sHandler *K8sResourceHandler) collectRbacResources(allResources map[string]workloadinterface.IMetadata) error { @@ -303,5 +306,9 @@ func (k8sHandler *K8sResourceHandler) pullWorkerNodesNumber() (int, error) { if err != nil { return 0, err } - return len(nodesList.Items), nil + nodesNumber := 0 + if nodesList != nil { + nodesNumber = len(nodesList.Items) + } + return nodesNumber, nil }