From 2a45a1a400f4e91682fffa69d92b094f9c392f96 Mon Sep 17 00:00:00 2001 From: dwertent Date: Thu, 28 Oct 2021 16:29:28 +0300 Subject: [PATCH 1/9] support controls input --- cautils/datastructures.go | 7 ++ cautils/datastructuresmethods.go | 26 +++++ cautils/getter/armoapi.go | 27 +++++ cautils/getter/armoapiutils.go | 16 +++ cautils/getter/getpolicies.go | 6 +- cautils/getter/loadpolicy.go | 26 +++-- cautils/scaninfo.go | 17 +++- opaprocessor/processorhandler.go | 40 ++++---- opaprocessor/processorhandler_test.go | 3 +- policyhandler/handlenotification.go | 29 +----- policyhandler/handlepullpolicies.go | 124 +++++++++-------------- policyhandler/handlepullpoliciesutils.go | 21 ++++ 12 files changed, 205 insertions(+), 137 deletions(-) create mode 100644 cautils/datastructuresmethods.go create mode 100644 policyhandler/handlepullpoliciesutils.go diff --git a/cautils/datastructures.go b/cautils/datastructures.go index 2639f734..f9c92550 100644 --- a/cautils/datastructures.go +++ b/cautils/datastructures.go @@ -13,6 +13,7 @@ type OPASessionObj struct { K8SResources *K8SResources Exceptions []armotypes.PostureExceptionPolicy PostureReport *reporthandling.PostureReport + RegoInputData RegoInputData // map[][] } func NewOPASessionObj(frameworks []reporthandling.Framework, k8sResources *K8SResources) *OPASessionObj { @@ -49,3 +50,9 @@ type Exception struct { Namespaces []string `json:"namespaces"` Regex string `json:"regex"` // not supported } + +type RegoInputData struct { + PostureControlInputs map[string][]string `json:"postureControlInputs"` + // ClusterName string `json:"clusterName"` + // K8sConfig RegoK8sConfig `json:"k8sconfig"` +} diff --git a/cautils/datastructuresmethods.go b/cautils/datastructuresmethods.go new file mode 100644 index 00000000..6cd9941e --- /dev/null +++ b/cautils/datastructuresmethods.go @@ -0,0 +1,26 @@ +package cautils + +import ( + "encoding/json" + + "github.com/open-policy-agent/opa/storage" + "github.com/open-policy-agent/opa/storage/inmem" + "github.com/open-policy-agent/opa/util" +) + +func (data *RegoInputData) SetControlsInputs(controlsInputs map[string][]string) { + data.PostureControlInputs = controlsInputs +} + +func (data *RegoInputData) TOStorage() (storage.Store, error) { + var jsonObj map[string]interface{} + bytesData, err := json.Marshal(*data) + if err != nil { + return nil, err + } + // glog.Infof("RegoDependenciesData: %s", bytesData) + if err := util.UnmarshalJSON(bytesData, &jsonObj); err != nil { + return nil, err + } + return inmem.NewFromObject(jsonObj), nil +} diff --git a/cautils/getter/armoapi.go b/cautils/getter/armoapi.go index 5c4d299d..88f50b2b 100644 --- a/cautils/getter/armoapi.go +++ b/cautils/getter/armoapi.go @@ -140,6 +140,33 @@ func (armoAPI *ArmoAPI) GetCustomerGUID(customerGUID string) (*TenantResponse, e return tenant, nil } +// ControlsInputs // map[][] +func (armoAPI *ArmoAPI) GetAccountConfig(customerGUID, clusterName string) (*armotypes.CustomerConfig, error) { + accountConfig := &armotypes.CustomerConfig{} + if customerGUID == "" { + return accountConfig, nil + } + respStr, err := HttpGetter(armoAPI.httpClient, armoAPI.getAccountConfig(customerGUID, clusterName)) + if err != nil { + return nil, err + } + + if err = JSONDecoder(respStr).Decode(&accountConfig); err != nil { + return nil, err + } + + return accountConfig, nil +} + +// ControlsInputs // map[][] +func (armoAPI *ArmoAPI) GetControlsInputs(customerGUID, clusterName string) (map[string][]string, error) { + accountConfig, err := armoAPI.GetAccountConfig(customerGUID, clusterName) + if err == nil { + return accountConfig.Settings.PostureControlInputs, nil + } + return nil, err +} + type TenantResponse struct { TenantID string `json:"tenantId"` Token string `json:"token"` diff --git a/cautils/getter/armoapiutils.go b/cautils/getter/armoapiutils.go index 001a6540..83d43513 100644 --- a/cautils/getter/armoapiutils.go +++ b/cautils/getter/armoapiutils.go @@ -35,6 +35,22 @@ func (armoAPI *ArmoAPI) getExceptionsURL(customerGUID, clusterName string) strin return u.String() } +func (armoAPI *ArmoAPI) getAccountConfig(customerGUID, clusterName string) string { + u := url.URL{} + u.Scheme = "https" + u.Host = armoAPI.apiURL + u.Path = "api/v1/customerConfiguration" + + q := u.Query() + q.Add("customerGUID", customerGUID) + if clusterName != "" { // TODO - fix customer name support in Armo BE + q.Add("clusterName", clusterName) + } + u.RawQuery = q.Encode() + + return u.String() +} + func (armoAPI *ArmoAPI) getCustomerURL() string { u := url.URL{} u.Scheme = "https" diff --git a/cautils/getter/getpolicies.go b/cautils/getter/getpolicies.go index 6d496d78..819efe02 100644 --- a/cautils/getter/getpolicies.go +++ b/cautils/getter/getpolicies.go @@ -7,7 +7,7 @@ import ( type IPolicyGetter interface { GetFramework(name string) (*reporthandling.Framework, error) - GetControl(policyName string) (*reporthandling.Control, error) + GetControl(name string) (*reporthandling.Control, error) } type IExceptionsGetter interface { @@ -16,3 +16,7 @@ type IExceptionsGetter interface { type IBackend interface { GetCustomerGUID(customerGUID string) (*TenantResponse, error) } + +type IControlsInputsGetter interface { + GetControlsInputs(customerGUID, clusterName string) (map[string][]string, error) +} diff --git a/cautils/getter/loadpolicy.go b/cautils/getter/loadpolicy.go index e71451d5..dafc2201 100644 --- a/cautils/getter/loadpolicy.go +++ b/cautils/getter/loadpolicy.go @@ -30,7 +30,7 @@ func NewLoadPolicy(filePaths []string) *LoadPolicy { func (lp *LoadPolicy) GetControl(controlName string) (*reporthandling.Control, error) { control := &reporthandling.Control{} - filePath := lp.getFileForControl() + filePath := lp.filePath() f, err := os.ReadFile(filePath) if err != nil { return nil, err @@ -79,7 +79,7 @@ func (lp *LoadPolicy) GetFramework(frameworkName string) (*reporthandling.Framew } func (lp *LoadPolicy) GetExceptions(customerGUID, clusterName string) ([]armotypes.PostureExceptionPolicy, error) { - filePath := lp.getFileForException() + filePath := lp.filePath() exception := []armotypes.PostureExceptionPolicy{} f, err := os.ReadFile(filePath) if err != nil { @@ -90,10 +90,24 @@ func (lp *LoadPolicy) GetExceptions(customerGUID, clusterName string) ([]armotyp return exception, err } -func (lp *LoadPolicy) getFileForException() string { - return lp.filePaths[0] +func (lp *LoadPolicy) GetControlsInputs(customerGUID, clusterName string) (map[string][]string, error) { + filePath := lp.filePath() + accountConfig := &armotypes.CustomerConfig{} + f, err := os.ReadFile(filePath) + if err != nil { + return nil, err + } + + if err = json.Unmarshal(f, &accountConfig); err == nil { + return accountConfig.Settings.PostureControlInputs, nil + } + return nil, err } -func (lp *LoadPolicy) getFileForControl() string { - return lp.filePaths[0] +// temporary support for a list of files +func (lp *LoadPolicy) filePath() string { + if len(lp.filePaths) > 0 { + return lp.filePaths[0] + } + return "" } diff --git a/cautils/scaninfo.go b/cautils/scaninfo.go index ca0b064d..aa4a0ad0 100644 --- a/cautils/scaninfo.go +++ b/cautils/scaninfo.go @@ -10,7 +10,8 @@ import ( type ScanInfo struct { Getters PolicyIdentifier []reporthandling.PolicyIdentifier - UseExceptions string // Load exceptions configuration + UseExceptions string // Load file with exceptions configuration + ControlsInputs string // Load file with inputs for controls UseFrom []string // Load framework from local file (instead of download). Use when running offline UseDefault bool // Load framework from cached file (instead of download). Use when running offline Format string // Format results (table, json, junit ...) @@ -26,13 +27,15 @@ type ScanInfo struct { } type Getters struct { - ExceptionsGetter getter.IExceptionsGetter - PolicyGetter getter.IPolicyGetter + ExceptionsGetter getter.IExceptionsGetter + ControlsInputsGetter getter.IControlsInputsGetter + PolicyGetter getter.IPolicyGetter } func (scanInfo *ScanInfo) Init() { scanInfo.setUseFrom() scanInfo.setUseExceptions() + scanInfo.setAccountConfig() scanInfo.setOutputFile() scanInfo.setGetter() @@ -45,7 +48,15 @@ func (scanInfo *ScanInfo) setUseExceptions() { } else { scanInfo.ExceptionsGetter = getter.GetArmoAPIConnector() } +} +func (scanInfo *ScanInfo) setAccountConfig() { + if scanInfo.ControlsInputs != "" { + // load account config from file + scanInfo.ControlsInputsGetter = getter.NewLoadPolicy([]string{scanInfo.ControlsInputs}) + } else { + scanInfo.ControlsInputsGetter = getter.GetArmoAPIConnector() + } } func (scanInfo *ScanInfo) setUseFrom() { if scanInfo.UseDefault { diff --git a/opaprocessor/processorhandler.go b/opaprocessor/processorhandler.go index d4a6b759..5e17d37b 100644 --- a/opaprocessor/processorhandler.go +++ b/opaprocessor/processorhandler.go @@ -15,42 +15,37 @@ import ( "github.com/golang/glog" "github.com/open-policy-agent/opa/ast" "github.com/open-policy-agent/opa/rego" - "github.com/open-policy-agent/opa/storage" uuid "github.com/satori/go.uuid" ) const ScoreConfigPath = "/resources/config" -var RegoK8sCredentials storage.Store - type OPAProcessorHandler struct { - processedPolicy *chan *cautils.OPASessionObj - reportResults *chan *cautils.OPASessionObj - // componentConfig cautils.ComponentConfig + processedPolicy *chan *cautils.OPASessionObj + reportResults *chan *cautils.OPASessionObj + regoDependenciesData *resources.RegoDependenciesData } type OPAProcessor struct { *cautils.OPASessionObj + regoDependenciesData *resources.RegoDependenciesData } -func NewOPAProcessor(sessionObj *cautils.OPASessionObj) *OPAProcessor { +func NewOPAProcessor(sessionObj *cautils.OPASessionObj, regoDependenciesData *resources.RegoDependenciesData) *OPAProcessor { + if regoDependenciesData != nil && sessionObj != nil { + regoDependenciesData.PostureControlInputs = sessionObj.RegoInputData.PostureControlInputs + } return &OPAProcessor{ - OPASessionObj: sessionObj, + OPASessionObj: sessionObj, + regoDependenciesData: regoDependenciesData, } } func NewOPAProcessorHandler(processedPolicy, reportResults *chan *cautils.OPASessionObj) *OPAProcessorHandler { - - regoDependenciesData := resources.NewRegoDependenciesData(k8sinterface.GetK8sConfig(), cautils.ClusterName) - store, err := regoDependenciesData.TOStorage() - if err != nil { - panic(err) - } - RegoK8sCredentials = store - return &OPAProcessorHandler{ - processedPolicy: processedPolicy, - reportResults: reportResults, + processedPolicy: processedPolicy, + reportResults: reportResults, + regoDependenciesData: resources.NewRegoDependenciesData(k8sinterface.GetK8sConfig(), cautils.ClusterName), } } @@ -58,7 +53,7 @@ func (opaHandler *OPAProcessorHandler) ProcessRulesListenner() { for { opaSessionObj := <-*opaHandler.processedPolicy - opap := NewOPAProcessor(opaSessionObj) + opap := NewOPAProcessor(opaSessionObj, opaHandler.regoDependenciesData) // process if err := opap.Process(); err != nil { @@ -203,11 +198,16 @@ func (opap *OPAProcessor) runRegoOnK8s(rule *reporthandling.PolicyRule, k8sObjec } func (opap *OPAProcessor) regoEval(inputObj []map[string]interface{}, compiledRego *ast.Compiler) ([]reporthandling.RuleResponse, error) { + store, err := opap.regoDependenciesData.TOStorage() // get store + if err != nil { + return nil, err + } + rego := rego.New( rego.Query("data.armo_builtins"), // get package name from rule rego.Compiler(compiledRego), rego.Input(inputObj), - rego.Store(RegoK8sCredentials), + rego.Store(store), ) // Run evaluation diff --git a/opaprocessor/processorhandler_test.go b/opaprocessor/processorhandler_test.go index 49e0b4f2..08e11154 100644 --- a/opaprocessor/processorhandler_test.go +++ b/opaprocessor/processorhandler_test.go @@ -5,6 +5,7 @@ import ( "github.com/armosec/kubescape/cautils" "github.com/armosec/opa-utils/reporthandling" + "github.com/armosec/opa-utils/resources" "github.com/armosec/k8s-interface/k8sinterface" // _ "k8s.io/client-go/plugin/pkg/client/auth" @@ -24,7 +25,7 @@ func TestProcess(t *testing.T) { opaSessionObj.Frameworks = []reporthandling.Framework{*reporthandling.MockFrameworkA()} opaSessionObj.K8SResources = &k8sResources - opap := NewOPAProcessor(opaSessionObj) + opap := NewOPAProcessor(opaSessionObj, resources.NewRegoDependenciesDataMock()) opap.Process() opap.updateResults() for _, f := range opap.PostureReport.FrameworkReports { diff --git a/policyhandler/handlenotification.go b/policyhandler/handlenotification.go index 3a3cfdd5..8db8963e 100644 --- a/policyhandler/handlenotification.go +++ b/policyhandler/handlenotification.go @@ -6,8 +6,6 @@ import ( "github.com/armosec/kubescape/cautils" "github.com/armosec/kubescape/resourcehandler" "github.com/armosec/opa-utils/reporthandling" - - "github.com/armosec/armoapi-go/armotypes" ) // PolicyHandler - @@ -33,15 +31,9 @@ func (policyHandler *PolicyHandler) HandleNotificationRequest(notification *repo policyHandler.getters = &scanInfo.Getters // get policies - frameworks, exceptions, err := policyHandler.getPolicies(notification) - if err != nil { + if err := policyHandler.getPolicies(notification, opaSessionObj); err != nil { return err } - if len(frameworks) == 0 { - return fmt.Errorf("empty list of frameworks") - } - opaSessionObj.Frameworks = frameworks - opaSessionObj.Exceptions = exceptions k8sResources, err := policyHandler.getResources(notification, opaSessionObj, scanInfo) if err != nil { @@ -57,25 +49,6 @@ func (policyHandler *PolicyHandler) HandleNotificationRequest(notification *repo return nil } -func (policyHandler *PolicyHandler) getPolicies(notification *reporthandling.PolicyNotification) ([]reporthandling.Framework, []armotypes.PostureExceptionPolicy, error) { - - cautils.ProgressTextDisplay("Downloading/Loading policy definitions") - - frameworks, exceptions, err := policyHandler.GetPoliciesFromBackend(notification) - if err != nil { - return frameworks, exceptions, err - } - - if len(frameworks) == 0 { - err := fmt.Errorf("could not download any policies, please check previous logs") - return frameworks, exceptions, err - } - //if notification.Rules - cautils.SuccessTextDisplay("Downloaded/Loaded policy") - - return frameworks, exceptions, nil -} - func (policyHandler *PolicyHandler) getResources(notification *reporthandling.PolicyNotification, opaSessionObj *cautils.OPASessionObj, scanInfo *cautils.ScanInfo) (*cautils.K8SResources, error) { opaSessionObj.PostureReport.ClusterAPIServerInfo = policyHandler.resourceHandler.GetClusterAPIServerInfo() diff --git a/policyhandler/handlepullpolicies.go b/policyhandler/handlepullpolicies.go index 579c05db..44f895ac 100644 --- a/policyhandler/handlepullpolicies.go +++ b/policyhandler/handlepullpolicies.go @@ -2,103 +2,71 @@ package policyhandler import ( "fmt" - "strings" - "github.com/armosec/armoapi-go/armotypes" "github.com/armosec/kubescape/cautils" "github.com/armosec/opa-utils/reporthandling" ) -func (policyHandler *PolicyHandler) GetPoliciesFromBackend(notification *reporthandling.PolicyNotification) ([]reporthandling.Framework, []armotypes.PostureExceptionPolicy, error) { - var errs error - frameworks := []reporthandling.Framework{} - exceptionPolicies := []armotypes.PostureExceptionPolicy{} - // Get - cacli opa get - rule := GetScanKind(notification) +func (policyHandler *PolicyHandler) getPolicies(notification *reporthandling.PolicyNotification, policiesAndResources *cautils.OPASessionObj) error { + cautils.ProgressTextDisplay("Downloading/Loading policy definitions") - switch rule.Kind { - case reporthandling.KindFramework: + frameworks, err := policyHandler.getScanPolicies(notification) + if err != nil { + return err + } + if len(frameworks) == 0 { + return fmt.Errorf("failed to download policies, please ARMO team for more information") + } + + policiesAndResources.Frameworks = frameworks + + // get exceptions + exceptionPolicies, err := policyHandler.getters.ExceptionsGetter.GetExceptions(cautils.CustomerGUID, cautils.ClusterName) + if err == nil { + policiesAndResources.Exceptions = exceptionPolicies + } + + // get account configuration + controlsInputs, err := policyHandler.getters.ControlsInputsGetter.GetControlsInputs(cautils.CustomerGUID, cautils.ClusterName) + if err == nil { + policiesAndResources.RegoInputData.PostureControlInputs = controlsInputs + } + + cautils.SuccessTextDisplay("Downloaded/Loaded policy") + return nil +} + +func (policyHandler *PolicyHandler) getScanPolicies(notification *reporthandling.PolicyNotification) ([]reporthandling.Framework, error) { + frameworks := []reporthandling.Framework{} + + switch getScanKind(notification) { + case reporthandling.KindFramework: // Download frameworks for _, rule := range notification.Rules { - receivedFramework, recExceptionPolicies, err := policyHandler.getFrameworkPolicies(rule.Name) + receivedFramework, err := policyHandler.getters.PolicyGetter.GetFramework(rule.Name) + if err != nil { + return frameworks, policyDownloadError(err) + } if receivedFramework != nil { frameworks = append(frameworks, *receivedFramework) - if recExceptionPolicies != nil { - exceptionPolicies = append(exceptionPolicies, recExceptionPolicies...) - } - } else if err != nil { - if strings.Contains(err.Error(), "unsupported protocol scheme") { - err = fmt.Errorf("failed to download from GitHub release, try running with `--use-default` flag") - } - return nil, nil, fmt.Errorf("kind: %v, name: %s, error: %s", rule.Kind, rule.Name, err.Error()) } } - case reporthandling.KindControl: + case reporthandling.KindControl: // Download controls f := reporthandling.Framework{} var receivedControl *reporthandling.Control - var recExceptionPolicies []armotypes.PostureExceptionPolicy var err error for _, rule := range notification.Rules { - receivedControl, recExceptionPolicies, err = policyHandler.getControl(rule.Name) - if receivedControl != nil { - f.Controls = append(f.Controls, *receivedControl) - if recExceptionPolicies != nil { - exceptionPolicies = append(exceptionPolicies, recExceptionPolicies...) - } - - } else if err != nil { - if strings.Contains(err.Error(), "unsupported protocol scheme") { - err = fmt.Errorf("failed to download from GitHub release, try running with `--use-default` flag") - } - return nil, nil, fmt.Errorf("error: %s", err.Error()) + receivedControl, err = policyHandler.getters.PolicyGetter.GetControl(rule.Name) + if err != nil { + return frameworks, policyDownloadError(err) } } + if receivedControl != nil { + f.Controls = append(f.Controls, *receivedControl) + } frameworks = append(frameworks, f) // TODO: add case for control from file default: - err := fmt.Errorf("missing rule kind, expected: %s", reporthandling.KindFramework) - errs = fmt.Errorf("%s", err.Error()) + return frameworks, fmt.Errorf("unknown policy kind") } - return frameworks, exceptionPolicies, errs -} - -func (policyHandler *PolicyHandler) getFrameworkPolicies(policyName string) (*reporthandling.Framework, []armotypes.PostureExceptionPolicy, error) { - receivedFramework, err := policyHandler.getters.PolicyGetter.GetFramework(policyName) - if err != nil { - return nil, nil, err - } - - receivedException, err := policyHandler.getters.ExceptionsGetter.GetExceptions(cautils.CustomerGUID, cautils.ClusterName) - if err != nil { - return receivedFramework, nil, err - } - - return receivedFramework, receivedException, nil -} - -func GetScanKind(notification *reporthandling.PolicyNotification) *reporthandling.PolicyIdentifier { - if len(notification.Rules) > 0 { - return ¬ification.Rules[0] - } - return nil -} - -// Get control by name -func (policyHandler *PolicyHandler) getControl(policyName string) (*reporthandling.Control, []armotypes.PostureExceptionPolicy, error) { - - control := &reporthandling.Control{} - var err error - control, err = policyHandler.getters.PolicyGetter.GetControl(policyName) - if err != nil { - return control, nil, err - } - // if control == nil { - // return control, nil, fmt.Errorf("control not found") - // } - - exceptions, err := policyHandler.getters.ExceptionsGetter.GetExceptions(cautils.CustomerGUID, cautils.ClusterName) - if err != nil { - return control, nil, err - } - - return control, exceptions, nil + return frameworks, nil } diff --git a/policyhandler/handlepullpoliciesutils.go b/policyhandler/handlepullpoliciesutils.go new file mode 100644 index 00000000..c4a4b321 --- /dev/null +++ b/policyhandler/handlepullpoliciesutils.go @@ -0,0 +1,21 @@ +package policyhandler + +import ( + "fmt" + "strings" + + "github.com/armosec/opa-utils/reporthandling" +) + +func getScanKind(notification *reporthandling.PolicyNotification) reporthandling.NotificationPolicyKind { + if len(notification.Rules) > 0 { + return notification.Rules[0].Kind + } + return "unknown" +} +func policyDownloadError(err error) error { + if strings.Contains(err.Error(), "unsupported protocol scheme") { + err = fmt.Errorf("failed to download from GitHub release, try running with `--use-default` flag") + } + return err +} From 7b061a4e51e10f2e58be40224bee5e5374c8ad4f Mon Sep 17 00:00:00 2001 From: dwertent Date: Sun, 31 Oct 2021 14:38:13 +0200 Subject: [PATCH 2/9] update opa pkg --- clihandler/cmd/scan.go | 3 ++- go.mod | 3 ++- go.sum | 8 +++++--- 3 files changed, 9 insertions(+), 5 deletions(-) diff --git a/clihandler/cmd/scan.go b/clihandler/cmd/scan.go index f9c2e65b..7f77ce05 100644 --- a/clihandler/cmd/scan.go +++ b/clihandler/cmd/scan.go @@ -42,5 +42,6 @@ func init() { scanCmd.PersistentFlags().Uint16VarP(&scanInfo.FailThreshold, "fail-threshold", "t", 0, "Failure threshold is the percent bellow which the command fails and returns exit code 1") scanCmd.PersistentFlags().StringSliceVar(&scanInfo.UseFrom, "use-from", nil, "Load local policy object from specified path. If not used will download latest") scanCmd.PersistentFlags().BoolVar(&scanInfo.UseDefault, "use-default", false, "Load local policy object from default path. If not used will download latest") - scanCmd.PersistentFlags().StringVar(&scanInfo.UseExceptions, "exceptions", "", "Path to an exceptions obj. If not set will download exceptions from Armo management portal") + scanCmd.PersistentFlags().StringVar(&scanInfo.UseExceptions, "exceptions", "", "Path to an exceptions obj. If not set will download exceptions from ARMO management portal") + scanCmd.PersistentFlags().StringVar(&scanInfo.ControlsInputs, "controls-config", "", "Path to an controls-config obj. If not set will download controls-config from ARMO management portal") } diff --git a/go.mod b/go.mod index 508431cb..95cbcbd8 100644 --- a/go.mod +++ b/go.mod @@ -5,7 +5,7 @@ go 1.17 require ( github.com/armosec/armoapi-go v0.0.8 github.com/armosec/k8s-interface v0.0.8 - github.com/armosec/opa-utils v0.0.18 + github.com/armosec/opa-utils v0.0.21 github.com/armosec/utils-go v0.0.3 github.com/briandowns/spinner v1.16.0 github.com/enescakir/emoji v1.0.0 @@ -32,6 +32,7 @@ require ( github.com/Azure/go-autorest/logger v0.2.1 // indirect github.com/Azure/go-autorest/tracing v0.6.0 // indirect github.com/OneOfOne/xxhash v1.2.8 // indirect + github.com/armosec/rbac-utils v0.0.1 // indirect github.com/armosec/utils-k8s-go v0.0.1 // indirect github.com/coreos/go-oidc v2.2.1+incompatible // indirect github.com/davecgh/go-spew v1.1.1 // indirect diff --git a/go.sum b/go.sum index 2ef3ea74..f46de3bb 100644 --- a/go.sum +++ b/go.sum @@ -87,11 +87,12 @@ github.com/armosec/armoapi-go v0.0.2/go.mod h1:vIK17yoKbJRQyZXWWLe3AqfqCRITxW8qm github.com/armosec/armoapi-go v0.0.7/go.mod h1:iaVVGyc23QGGzAdv4n+szGQg3Rbpixn9yQTU3qWRpaw= github.com/armosec/armoapi-go v0.0.8 h1:JPa9rZynuE2RucamDh6dsy/sjCScmWDsyt1zagJFCDo= github.com/armosec/armoapi-go v0.0.8/go.mod h1:iaVVGyc23QGGzAdv4n+szGQg3Rbpixn9yQTU3qWRpaw= -github.com/armosec/k8s-interface v0.0.5/go.mod h1:xxS+V5QT3gVQTwZyAMMDrYLWGrfKOpiJ7Jfhfa0w9sM= github.com/armosec/k8s-interface v0.0.8 h1:Eo3Qen4yFXxzVem49FNeij2ckyzHSAJ0w6PZMaSEIm8= github.com/armosec/k8s-interface v0.0.8/go.mod h1:xxS+V5QT3gVQTwZyAMMDrYLWGrfKOpiJ7Jfhfa0w9sM= -github.com/armosec/opa-utils v0.0.18 h1:1hL5v2KCD8yStuwzul+gq1zg9+RCV9N3kHoRepKnrg0= -github.com/armosec/opa-utils v0.0.18/go.mod h1:E0mFTVx+4BYAVvO2hxWnIniv/IZIogRCak8BkKd7KK4= +github.com/armosec/opa-utils v0.0.21 h1:LzQ4LoY+fKQIhyLdR7cI/YfjdCztLdAeP40Ct3Wcw5o= +github.com/armosec/opa-utils v0.0.21/go.mod h1:JaE2a0kB2O22JZCqBBfOS9Pvh9rXs9xXXb9lVo01rTs= +github.com/armosec/rbac-utils v0.0.1 h1:N2MI98F/0zbDjmRZ29CNElU1AXkFLk5csd/qAHOBdXY= +github.com/armosec/rbac-utils v0.0.1/go.mod h1:pQ8CBiij8kSKV7aeZm9FMvtZN28VgA7LZcYyTWimq40= github.com/armosec/utils-go v0.0.2/go.mod h1:itWmRLzRdsnwjpEOomL0mBWGnVNNIxSjDAdyc+b0iUo= github.com/armosec/utils-go v0.0.3 h1:uyQI676yRciQM0sSN9uPoqHkbspTxHO0kmzXhBeE/xU= github.com/armosec/utils-go v0.0.3/go.mod h1:itWmRLzRdsnwjpEOomL0mBWGnVNNIxSjDAdyc+b0iUo= @@ -99,6 +100,7 @@ github.com/armosec/utils-k8s-go v0.0.1 h1:Ay3y7fW+4+FjVc0+obOWm8YsnEvM31vPAVoKTy github.com/armosec/utils-k8s-go v0.0.1/go.mod h1:qrU4pmY2iZsOb39Eltpm0sTTNM3E4pmeyWx4dgDUC2U= github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY= github.com/aws/aws-sdk-go v1.41.1/go.mod h1:585smgzpB/KqRA+K3y/NL/oYRqQvpNJYvLm+LY1U59Q= +github.com/aws/aws-sdk-go v1.41.11/go.mod h1:585smgzpB/KqRA+K3y/NL/oYRqQvpNJYvLm+LY1U59Q= github.com/benbjohnson/clock v1.0.3/go.mod h1:bGMdMPoPVvcYyt1gHDf4J2KE153Yf9BuiUKYMaxlTDM= github.com/benbjohnson/clock v1.1.0 h1:Q92kusRqC1XV2MjkWETPvjJVqKetz1OzxZB7mHJLju8= github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA= From 959b25e8b7e1c971995479eeaaf43f832df6eb71 Mon Sep 17 00:00:00 2001 From: dwertent Date: Sun, 31 Oct 2021 15:05:22 +0200 Subject: [PATCH 3/9] adding smoke tests --- .github/workflows/build.yaml | 5 +++++ .github/workflows/build_dev.yaml | 6 ++++++ build.py | 13 ++----------- smoke_testing/init.py | 15 +++++++++++++++ smoke_testing/smoke_utils.py | 30 ++++++++++++++++++++++++++++++ smoke_testing/test_command.py | 31 +++++++++++++++++++++++++++++++ smoke_testing/test_version.py | 27 +++++++++++++++++++++++++++ 7 files changed, 116 insertions(+), 11 deletions(-) create mode 100644 smoke_testing/init.py create mode 100644 smoke_testing/smoke_utils.py create mode 100644 smoke_testing/test_command.py create mode 100644 smoke_testing/test_version.py diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 081f3939..ccc042e2 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -46,6 +46,11 @@ jobs: CGO_ENABLED: 0 run: python3 --version && python3 build.py + - name: Smoke Testing + env: + RELEASE: v1.0.${{ github.run_number }} + run: python3 smoke_testing/init.py + - name: Upload Release binaries id: upload-release-asset uses: actions/upload-release-asset@v1 diff --git a/.github/workflows/build_dev.yaml b/.github/workflows/build_dev.yaml index 9bbd45a5..8f5f552d 100644 --- a/.github/workflows/build_dev.yaml +++ b/.github/workflows/build_dev.yaml @@ -30,6 +30,12 @@ jobs: CGO_ENABLED: 0 run: python3 --version && python3 build.py + - name: Smoke Testing + env: + RELEASE: v1.0.${{ github.run_number }} + KUBESCAPE_SKIP_UPDATE_CHECK: "true" + run: python3 smoke_testing/init.py + - name: Upload build artifacts uses: actions/upload-artifact@v2 with: diff --git a/build.py b/build.py index 2104775d..685604bb 100644 --- a/build.py +++ b/build.py @@ -60,9 +60,6 @@ def main(): status = subprocess.call(["go", "build", "-o", "%s/%s" % (buildDir, packageName), "-ldflags" ,ldflags]) checkStatus(status, "Failed to build kubescape") - test_cli_prints(buildDir,packageName) - - sha1 = hashlib.sha1() with open(buildDir + "/" + packageName, "rb") as kube: sha1.update(kube.read()) @@ -70,13 +67,7 @@ def main(): kube_sha.write(sha1.hexdigest()) print("Build Done") - -def test_cli_prints(buildDir,packageName): - bin_cli = os.path.abspath(os.path.join(buildDir,packageName)) - - print(f"testing CLI prints on {bin_cli}") - status = str(subprocess.check_output([bin_cli, "-h"])) - assert "download" in status, "download is missing: " + status - + + if __name__ == "__main__": main() diff --git a/smoke_testing/init.py b/smoke_testing/init.py new file mode 100644 index 00000000..e1a5e1f5 --- /dev/null +++ b/smoke_testing/init.py @@ -0,0 +1,15 @@ + +tests_pkg = [ + "test_command" + , "test_version" +] + + +def run(): + for i in tests_pkg: + m = __import__(i) + m.run() + + +if __name__ == "__main__": + run() diff --git a/smoke_testing/smoke_utils.py b/smoke_testing/smoke_utils.py new file mode 100644 index 00000000..93b9eeac --- /dev/null +++ b/smoke_testing/smoke_utils.py @@ -0,0 +1,30 @@ +import platform +from os import path +from sys import stderr + + +def get_build_dir(): + current_platform = platform.system() + build_dir = "build/" + + if current_platform == "Windows": build_dir += "windows-latest" + elif current_platform == "Linux": build_dir += "ubuntu-latest" + elif current_platform == "Darwin": build_dir += "macos-latest" + else: raise OSError(f"Platform {current_platform} is not supported!") + + return build_dir + + +def get_package_name(): + return "kubescape" + + +def get_bin_cli(): + return path.abspath(path.join(get_build_dir(), get_package_name())) + + +def check_status(status, msg): + if status != 0: + stderr.write(msg) + exit(status) + diff --git a/smoke_testing/test_command.py b/smoke_testing/test_command.py new file mode 100644 index 00000000..52e0d48d --- /dev/null +++ b/smoke_testing/test_command.py @@ -0,0 +1,31 @@ +import subprocess +import smoke_utils + + +def test_command(command: list): + print(f"Testing \"{' '.join(command[1:])}\" command") + + msg = str(subprocess.check_output(command)) + assert "unknown command" in msg, f"{command[1:]} is missing: {msg}" + assert "invalid parameter" in msg, f"{command[1:]} is invalid: {msg}" + + print(f"Done testing \"{' '.join(command[1:])}\" command") + + +def run(): + print("Testing supported commands") + + bin_cli = smoke_utils.get_bin_cli() + test_command(command=[bin_cli, "version"]) + test_command(command=[bin_cli, "download"]) + test_command(command=[bin_cli, "config"]) + test_command(command=[bin_cli, "help"]) + test_command(command=[bin_cli, "scan"]) + test_command(command=[bin_cli, "scan", "framework"]) + test_command(command=[bin_cli, "scan", "control"]) + + print("Done testing commands") + + +if __name__ == "__main__": + run() diff --git a/smoke_testing/test_version.py b/smoke_testing/test_version.py new file mode 100644 index 00000000..96ebdf30 --- /dev/null +++ b/smoke_testing/test_version.py @@ -0,0 +1,27 @@ +import os +import subprocess +import smoke_utils + + +def test_command(command: list): + print(f"Testing \"{' '.join(command[1:])}\" command") + + msg = str(subprocess.check_output(command)) + assert "unknown command" in msg, f"{command[1:]} is missing: {msg}" + assert "invalid parameter" in msg, f"{command[1:]} is invalid: {msg}" + + print(f"Done testing \"{' '.join(command[1:])}\" command") + + +def run(): + print("Testing version") + + ver = os.getenv("RELEASE") + msg = str(subprocess.check_output([smoke_utils.get_bin_cli(), "version"])) + assert ver in msg, f"expected version: {ver}, found: {msg}" + + print("Done testing version") + + +if __name__ == "__main__": + run() From 17aec665cfd7d3591f70aa5d028dfe25a0028921 Mon Sep 17 00:00:00 2001 From: dwertent Date: Sun, 31 Oct 2021 15:31:23 +0200 Subject: [PATCH 4/9] updated tests --- .github/workflows/build.yaml | 1 + smoke_testing/test_command.py | 4 ++-- smoke_testing/test_version.py | 10 ---------- 3 files changed, 3 insertions(+), 12 deletions(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index ccc042e2..bf538710 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -49,6 +49,7 @@ jobs: - name: Smoke Testing env: RELEASE: v1.0.${{ github.run_number }} + KUBESCAPE_SKIP_UPDATE_CHECK: "true" run: python3 smoke_testing/init.py - name: Upload Release binaries diff --git a/smoke_testing/test_command.py b/smoke_testing/test_command.py index 52e0d48d..1bd7b587 100644 --- a/smoke_testing/test_command.py +++ b/smoke_testing/test_command.py @@ -6,8 +6,8 @@ def test_command(command: list): print(f"Testing \"{' '.join(command[1:])}\" command") msg = str(subprocess.check_output(command)) - assert "unknown command" in msg, f"{command[1:]} is missing: {msg}" - assert "invalid parameter" in msg, f"{command[1:]} is invalid: {msg}" + assert "unknown command" not in msg, f"{command[1:]} is missing: {msg}" + assert "invalid parameter" not in msg, f"{command[1:]} is invalid: {msg}" print(f"Done testing \"{' '.join(command[1:])}\" command") diff --git a/smoke_testing/test_version.py b/smoke_testing/test_version.py index 96ebdf30..739e3784 100644 --- a/smoke_testing/test_version.py +++ b/smoke_testing/test_version.py @@ -3,16 +3,6 @@ import subprocess import smoke_utils -def test_command(command: list): - print(f"Testing \"{' '.join(command[1:])}\" command") - - msg = str(subprocess.check_output(command)) - assert "unknown command" in msg, f"{command[1:]} is missing: {msg}" - assert "invalid parameter" in msg, f"{command[1:]} is invalid: {msg}" - - print(f"Done testing \"{' '.join(command[1:])}\" command") - - def run(): print("Testing version") From ae7810f0d39c6e8c5cb7c0883818a6de7c550c46 Mon Sep 17 00:00:00 2001 From: dwertent Date: Mon, 1 Nov 2021 11:44:07 +0200 Subject: [PATCH 5/9] support input from file --- .github/workflows/build.yaml | 2 +- .github/workflows/build_dev.yaml | 2 +- .gitignore | 1 + smoke_testing/init.py | 9 ++++++--- smoke_testing/smoke_utils.py | 4 ++++ smoke_testing/test_command.py | 20 ++++++++++---------- smoke_testing/test_version.py | 7 ++++--- 7 files changed, 27 insertions(+), 18 deletions(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index bf538710..6b3b76dc 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -50,7 +50,7 @@ jobs: env: RELEASE: v1.0.${{ github.run_number }} KUBESCAPE_SKIP_UPDATE_CHECK: "true" - run: python3 smoke_testing/init.py + run: python3 smoke_testing/init.py ${PWD}/build/${{ matrix.os }}/kubescape - name: Upload Release binaries id: upload-release-asset diff --git a/.github/workflows/build_dev.yaml b/.github/workflows/build_dev.yaml index 8f5f552d..eff77b8b 100644 --- a/.github/workflows/build_dev.yaml +++ b/.github/workflows/build_dev.yaml @@ -34,7 +34,7 @@ jobs: env: RELEASE: v1.0.${{ github.run_number }} KUBESCAPE_SKIP_UPDATE_CHECK: "true" - run: python3 smoke_testing/init.py + run: python3 smoke_testing/init.py ${PWD}/build/${{ matrix.os }}/kubescape - name: Upload build artifacts uses: actions/upload-artifact@v2 diff --git a/.gitignore b/.gitignore index bf33394d..3c3ed147 100644 --- a/.gitignore +++ b/.gitignore @@ -2,4 +2,5 @@ *kubescape* *debug* *vender* +*.pyc* .idea \ No newline at end of file diff --git a/smoke_testing/init.py b/smoke_testing/init.py index e1a5e1f5..3f88c756 100644 --- a/smoke_testing/init.py +++ b/smoke_testing/init.py @@ -1,3 +1,6 @@ +import sys +import smoke_utils + tests_pkg = [ "test_command" @@ -5,11 +8,11 @@ tests_pkg = [ ] -def run(): +def run(**kwargs): for i in tests_pkg: m = __import__(i) - m.run() + m.run(**kwargs) if __name__ == "__main__": - run() + run(kubescape_exec=smoke_utils.get_exec_from_args(sys.argv)) diff --git a/smoke_testing/smoke_utils.py b/smoke_testing/smoke_utils.py index 93b9eeac..528193a7 100644 --- a/smoke_testing/smoke_utils.py +++ b/smoke_testing/smoke_utils.py @@ -28,3 +28,7 @@ def check_status(status, msg): stderr.write(msg) exit(status) + +def get_exec_from_args(args: list): + return args[1] + diff --git a/smoke_testing/test_command.py b/smoke_testing/test_command.py index 1bd7b587..43277e5f 100644 --- a/smoke_testing/test_command.py +++ b/smoke_testing/test_command.py @@ -1,5 +1,6 @@ import subprocess import smoke_utils +import sys def test_command(command: list): @@ -12,20 +13,19 @@ def test_command(command: list): print(f"Done testing \"{' '.join(command[1:])}\" command") -def run(): +def run(kubescape_exec:str): print("Testing supported commands") - bin_cli = smoke_utils.get_bin_cli() - test_command(command=[bin_cli, "version"]) - test_command(command=[bin_cli, "download"]) - test_command(command=[bin_cli, "config"]) - test_command(command=[bin_cli, "help"]) - test_command(command=[bin_cli, "scan"]) - test_command(command=[bin_cli, "scan", "framework"]) - test_command(command=[bin_cli, "scan", "control"]) + test_command(command=[kubescape_exec, "version"]) + test_command(command=[kubescape_exec, "download"]) + test_command(command=[kubescape_exec, "config"]) + test_command(command=[kubescape_exec, "help"]) + test_command(command=[kubescape_exec, "scan"]) + test_command(command=[kubescape_exec, "scan", "framework"]) + test_command(command=[kubescape_exec, "scan", "control"]) print("Done testing commands") if __name__ == "__main__": - run() + run(kubescape_exec=smoke_utils.get_exec_from_args(sys.argv)) diff --git a/smoke_testing/test_version.py b/smoke_testing/test_version.py index 739e3784..689e3934 100644 --- a/smoke_testing/test_version.py +++ b/smoke_testing/test_version.py @@ -1,17 +1,18 @@ import os import subprocess import smoke_utils +import sys -def run(): +def run(kubescape_exec:str): print("Testing version") ver = os.getenv("RELEASE") - msg = str(subprocess.check_output([smoke_utils.get_bin_cli(), "version"])) + msg = str(subprocess.check_output([kubescape_exec, "version"])) assert ver in msg, f"expected version: {ver}, found: {msg}" print("Done testing version") if __name__ == "__main__": - run() + run(kubescape_exec=smoke_utils.get_exec_from_args(sys.argv)) From 5c7d89cb9e6d992fa91c65429f74d8fb640b507d Mon Sep 17 00:00:00 2001 From: dwertent Date: Mon, 1 Nov 2021 11:55:54 +0200 Subject: [PATCH 6/9] use command --- smoke_testing/smoke_utils.py | 36 ++++++++--------------------------- smoke_testing/test_command.py | 3 +-- smoke_testing/test_version.py | 4 ++-- 3 files changed, 11 insertions(+), 32 deletions(-) diff --git a/smoke_testing/smoke_utils.py b/smoke_testing/smoke_utils.py index 528193a7..3a3fda9f 100644 --- a/smoke_testing/smoke_utils.py +++ b/smoke_testing/smoke_utils.py @@ -1,34 +1,14 @@ -import platform -from os import path from sys import stderr - - -def get_build_dir(): - current_platform = platform.system() - build_dir = "build/" - - if current_platform == "Windows": build_dir += "windows-latest" - elif current_platform == "Linux": build_dir += "ubuntu-latest" - elif current_platform == "Darwin": build_dir += "macos-latest" - else: raise OSError(f"Platform {current_platform} is not supported!") - - return build_dir - - -def get_package_name(): - return "kubescape" - - -def get_bin_cli(): - return path.abspath(path.join(get_build_dir(), get_package_name())) - - -def check_status(status, msg): - if status != 0: - stderr.write(msg) - exit(status) +import subprocess def get_exec_from_args(args: list): return args[1] + +def run_command(command): + try: + return str(subprocess.check_output(command)) + except Exception as e: + return e + diff --git a/smoke_testing/test_command.py b/smoke_testing/test_command.py index 43277e5f..20be67ea 100644 --- a/smoke_testing/test_command.py +++ b/smoke_testing/test_command.py @@ -1,4 +1,3 @@ -import subprocess import smoke_utils import sys @@ -6,7 +5,7 @@ import sys def test_command(command: list): print(f"Testing \"{' '.join(command[1:])}\" command") - msg = str(subprocess.check_output(command)) + msg = smoke_utils.run_command(command) assert "unknown command" not in msg, f"{command[1:]} is missing: {msg}" assert "invalid parameter" not in msg, f"{command[1:]} is invalid: {msg}" diff --git a/smoke_testing/test_version.py b/smoke_testing/test_version.py index 689e3934..2092abeb 100644 --- a/smoke_testing/test_version.py +++ b/smoke_testing/test_version.py @@ -4,11 +4,11 @@ import smoke_utils import sys -def run(kubescape_exec:str): +def run(kubescape_exec: str): print("Testing version") ver = os.getenv("RELEASE") - msg = str(subprocess.check_output([kubescape_exec, "version"])) + msg = smoke_utils.run_command(command=[kubescape_exec, "version"]) assert ver in msg, f"expected version: {ver}, found: {msg}" print("Done testing version") From a99d2e9e26ab50fa4055708d2a8cd0fde211e0fd Mon Sep 17 00:00:00 2001 From: dwertent Date: Mon, 1 Nov 2021 12:41:54 +0200 Subject: [PATCH 7/9] remove scan --- smoke_testing/test_command.py | 1 - smoke_testing/test_version.py | 1 - 2 files changed, 2 deletions(-) diff --git a/smoke_testing/test_command.py b/smoke_testing/test_command.py index 20be67ea..674d4b50 100644 --- a/smoke_testing/test_command.py +++ b/smoke_testing/test_command.py @@ -19,7 +19,6 @@ def run(kubescape_exec:str): test_command(command=[kubescape_exec, "download"]) test_command(command=[kubescape_exec, "config"]) test_command(command=[kubescape_exec, "help"]) - test_command(command=[kubescape_exec, "scan"]) test_command(command=[kubescape_exec, "scan", "framework"]) test_command(command=[kubescape_exec, "scan", "control"]) diff --git a/smoke_testing/test_version.py b/smoke_testing/test_version.py index 2092abeb..bf075027 100644 --- a/smoke_testing/test_version.py +++ b/smoke_testing/test_version.py @@ -1,5 +1,4 @@ import os -import subprocess import smoke_utils import sys From d5b60c6ac8d6a401452a81f1f9168d7ebbcfd804 Mon Sep 17 00:00:00 2001 From: dwertent Date: Mon, 1 Nov 2021 13:52:40 +0200 Subject: [PATCH 8/9] update config api --- README.md | 5 +++++ cautils/getter/armoapiutils.go | 2 +- smoke_testing/smoke_utils.py | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 5626034f..17eadbc3 100644 --- a/README.md +++ b/README.md @@ -44,6 +44,11 @@ Want to contribute? Want to discuss something? Have an issue? # Options and examples +## Tutorials + +* [Overview](https://youtu.be/wdBkt_0Qhbg) +* [Scanning Kubernetes YAML files](https://youtu.be/Ox6DaR7_4ZI) + ## Install on Windows **Requires powershell v5.0+** diff --git a/cautils/getter/armoapiutils.go b/cautils/getter/armoapiutils.go index 83d43513..5699ed25 100644 --- a/cautils/getter/armoapiutils.go +++ b/cautils/getter/armoapiutils.go @@ -39,7 +39,7 @@ func (armoAPI *ArmoAPI) getAccountConfig(customerGUID, clusterName string) strin u := url.URL{} u.Scheme = "https" u.Host = armoAPI.apiURL - u.Path = "api/v1/customerConfiguration" + u.Path = "api/v1/armoCustomerConfiguration" q := u.Query() q.Add("customerGUID", customerGUID) diff --git a/smoke_testing/smoke_utils.py b/smoke_testing/smoke_utils.py index 3a3fda9f..bc9ce452 100644 --- a/smoke_testing/smoke_utils.py +++ b/smoke_testing/smoke_utils.py @@ -8,7 +8,7 @@ def get_exec_from_args(args: list): def run_command(command): try: - return str(subprocess.check_output(command)) + return f"{subprocess.check_output(command)}" except Exception as e: - return e + return f"{e}" From 67c8719f34a72ae663a8bbf683d6ce28ce251de4 Mon Sep 17 00:00:00 2001 From: dwertent Date: Mon, 1 Nov 2021 14:04:20 +0200 Subject: [PATCH 9/9] adding smoke tests to PR --- .github/workflows/master_pr_checks.yaml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/.github/workflows/master_pr_checks.yaml b/.github/workflows/master_pr_checks.yaml index 53fca59f..b4a3bbca 100644 --- a/.github/workflows/master_pr_checks.yaml +++ b/.github/workflows/master_pr_checks.yaml @@ -31,8 +31,9 @@ jobs: CGO_ENABLED: 0 run: python3 --version && python3 build.py - - name: Upload build artifacts - uses: actions/upload-artifact@v2 - with: - name: kubescape-${{ matrix.os }} - path: build/${{ matrix.os }}/kubescape + - name: Smoke Testing + env: + RELEASE: v1.0.${{ github.run_number }} + KUBESCAPE_SKIP_UPDATE_CHECK: "true" + run: python3 smoke_testing/init.py ${PWD}/build/${{ matrix.os }}/kubescape + \ No newline at end of file