diff --git a/README.md b/README.md index 5eab281f..0717f8c4 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ logo
-![build](https://github.com/armosec/kubescape/actions/workflows/build.yaml/badge.svg) ![GitHub tag (latest by date)](https://img.shields.io/github/v/tag/armosec/kubescape) ![GitHub go.mod Go version](https://img.shields.io/github/go-mod/go-version/armosec/kubescape) +![build](https://github.com/armosec/kubescape/actions/workflows/build.yaml/badge.svg) ![GitHub tag (latest by date)](https://img.shields.io/github/v/tag/armosec/kubescape?label=release&color=blue) ![GitHub go.mod Go version](https://img.shields.io/github/go-mod/go-version/armosec/kubescape?color=yellow) Kubescape is a K8s open-source tool providing a multi-cloud K8s single pane of glass, including risk analysis, security compliance, RBAC visualizer and image vulnerabilities scanning. @@ -14,8 +14,8 @@ Kubescape integrates natively with other DevOps tools, including Jenkins, Circle # CLI Interface: -# Web Interface: - + # TL;DR ## Install: diff --git a/core/cautils/scaninfo.go b/core/cautils/scaninfo.go index 1cd26f73..544a7d62 100644 --- a/core/cautils/scaninfo.go +++ b/core/cautils/scaninfo.go @@ -38,6 +38,12 @@ func (bpf *BoolPtrFlag) String() string { func (bpf *BoolPtrFlag) Get() *bool { return bpf.valPtr } +func (bpf *BoolPtrFlag) GetBool() bool { + if bpf.valPtr == nil { + return false + } + return *bpf.valPtr +} func (bpf *BoolPtrFlag) SetBool(val bool) { bpf.valPtr = &val diff --git a/core/pkg/policyhandler/handlenotification.go b/core/pkg/policyhandler/handlenotification.go index 47e1a7d6..5577caac 100644 --- a/core/pkg/policyhandler/handlenotification.go +++ b/core/pkg/policyhandler/handlenotification.go @@ -2,7 +2,6 @@ package policyhandler import ( "fmt" - "strings" "github.com/armosec/k8s-interface/k8sinterface" "github.com/armosec/kubescape/core/cautils" @@ -47,30 +46,9 @@ func (policyHandler *PolicyHandler) CollectResources(notification *reporthandlin return opaSessionObj, nil } -func scanInfoToScanMetadata(opaSessionObj *cautils.OPASessionObj, scanInfo *cautils.ScanInfo) { - opaSessionObj.Metadata.ClusterMetadata.ContextName = k8sinterface.GetCurrentContext().Cluster - opaSessionObj.Metadata.ScanMetadata.Format = scanInfo.Format - opaSessionObj.Metadata.ScanMetadata.Submit = scanInfo.Submit - if len(scanInfo.ExcludedNamespaces) > 1 { - opaSessionObj.Metadata.ScanMetadata.ExcludedNamespaces = strings.Split(scanInfo.ExcludedNamespaces[1:], ",") - } - // scan type - if len(scanInfo.PolicyIdentifier) > 0 { - opaSessionObj.Metadata.ScanMetadata.TargetType = string(scanInfo.PolicyIdentifier[0].Kind) - } - // append frameworks - for _, policy := range scanInfo.PolicyIdentifier { - opaSessionObj.Metadata.ScanMetadata.TargetNames = append(opaSessionObj.Metadata.ScanMetadata.TargetNames, policy.Name) - } - opaSessionObj.Metadata.ScanMetadata.VerboseMode = scanInfo.VerboseMode - opaSessionObj.Metadata.ScanMetadata.FailThreshold = scanInfo.FailThreshold - opaSessionObj.Metadata.ScanMetadata.HostScanner = *(scanInfo.HostSensorEnabled.Get()) - opaSessionObj.Metadata.ScanMetadata.VerboseMode = scanInfo.VerboseMode - opaSessionObj.Metadata.ScanMetadata.ControlsInputs = scanInfo.ControlsInputs -} - func (policyHandler *PolicyHandler) getResources(notification *reporthandling.PolicyNotification, opaSessionObj *cautils.OPASessionObj, scanInfo *cautils.ScanInfo) error { opaSessionObj.Report.ClusterAPIServerInfo = policyHandler.resourceHandler.GetClusterAPIServerInfo() + scanInfoToScanMetadata(opaSessionObj, scanInfo) resourcesMap, allResources, armoResources, err := policyHandler.resourceHandler.GetResources(opaSessionObj, ¬ification.Designators) @@ -84,3 +62,31 @@ func (policyHandler *PolicyHandler) getResources(notification *reporthandling.Po return nil } + +func scanInfoToScanMetadata(opaSessionObj *cautils.OPASessionObj, scanInfo *cautils.ScanInfo) { + opaSessionObj.Metadata.ClusterMetadata.ContextName = k8sinterface.GetClusterName() + opaSessionObj.Metadata.ScanMetadata.Format = scanInfo.Format + opaSessionObj.Metadata.ScanMetadata.Submit = scanInfo.Submit + + // TODO - Add excluded and included namespaces + // if len(scanInfo.ExcludedNamespaces) > 1 { + // opaSessionObj.Metadata.ScanMetadata.ExcludedNamespaces = strings.Split(scanInfo.ExcludedNamespaces[1:], ",") + // } + // if len(scanInfo.IncludeNamespaces) > 1 { + // opaSessionObj.Metadata.ScanMetadata.IncludeNamespaces = strings.Split(scanInfo.IncludeNamespaces[1:], ",") + // } + + // scan type + if len(scanInfo.PolicyIdentifier) > 0 { + opaSessionObj.Metadata.ScanMetadata.TargetType = string(scanInfo.PolicyIdentifier[0].Kind) + } + // append frameworks + for _, policy := range scanInfo.PolicyIdentifier { + opaSessionObj.Metadata.ScanMetadata.TargetNames = append(opaSessionObj.Metadata.ScanMetadata.TargetNames, policy.Name) + } + opaSessionObj.Metadata.ScanMetadata.VerboseMode = scanInfo.VerboseMode + opaSessionObj.Metadata.ScanMetadata.FailThreshold = scanInfo.FailThreshold + opaSessionObj.Metadata.ScanMetadata.HostScanner = scanInfo.HostSensorEnabled.GetBool() + opaSessionObj.Metadata.ScanMetadata.VerboseMode = scanInfo.VerboseMode + opaSessionObj.Metadata.ScanMetadata.ControlsInputs = scanInfo.ControlsInputs +} diff --git a/core/pkg/resourcehandler/filesloader.go b/core/pkg/resourcehandler/filesloader.go index e9d6ff59..dec8e2e7 100644 --- a/core/pkg/resourcehandler/filesloader.go +++ b/core/pkg/resourcehandler/filesloader.go @@ -32,7 +32,7 @@ func (fileHandler *FileResourceHandler) GetResources(sessionObj *cautils.OPASess // map resources based on framework required resources: map["/group/version/kind"][] k8sResources := setK8sResourceMap(sessionObj.Policies) allResources := map[string]workloadinterface.IMetadata{} - var armoResources *cautils.ArmoResources + armoResources := &cautils.ArmoResources{} workloads := []workloadinterface.IMetadata{}