From 53402d9a1c760122b7f411bb67fa7a4b0bc7285c Mon Sep 17 00:00:00 2001 From: kooomix Date: Wed, 23 Nov 2022 11:57:36 +0200 Subject: [PATCH 1/3] Added "CloudProvider" to postureControlInputs --- core/pkg/opaprocessor/processorhandler.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/core/pkg/opaprocessor/processorhandler.go b/core/pkg/opaprocessor/processorhandler.go index 8f2e32a6..72977e4f 100644 --- a/core/pkg/opaprocessor/processorhandler.go +++ b/core/pkg/opaprocessor/processorhandler.go @@ -8,6 +8,7 @@ import ( "github.com/armosec/armoapi-go/armotypes" logger "github.com/kubescape/go-logger" "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/k8s-interface/cloudsupport" "github.com/kubescape/kubescape/v2/core/cautils" "github.com/kubescape/kubescape/v2/core/pkg/score" "github.com/kubescape/opa-utils/objectsenvelopes" @@ -154,6 +155,11 @@ func (opap *OPAProcessor) processRule(rule *reporthandling.PolicyRule, fixedCont postureControlInputs := opap.regoDependenciesData.GetFilteredPostureControlInputs(rule.ConfigInputs) // get store + clusterName := cautils.ClusterName + provider := cloudsupport.GetCloudProvider(clusterName) + + postureControlInputs["CloudProvider"] = []string{provider} + // Merge configurable control input and fixed control input for k, v := range fixedControlInputs { postureControlInputs[k] = v From 03a0f97669ecea23c64cd01632f6551c16560bdb Mon Sep 17 00:00:00 2001 From: kooomix Date: Thu, 24 Nov 2022 16:09:05 +0200 Subject: [PATCH 2/3] Getting cluster name from context --- core/pkg/opaprocessor/processorhandler.go | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/core/pkg/opaprocessor/processorhandler.go b/core/pkg/opaprocessor/processorhandler.go index 72977e4f..7ff1d2a7 100644 --- a/core/pkg/opaprocessor/processorhandler.go +++ b/core/pkg/opaprocessor/processorhandler.go @@ -8,7 +8,6 @@ import ( "github.com/armosec/armoapi-go/armotypes" logger "github.com/kubescape/go-logger" "github.com/kubescape/go-logger/helpers" - "github.com/kubescape/k8s-interface/cloudsupport" "github.com/kubescape/kubescape/v2/core/cautils" "github.com/kubescape/kubescape/v2/core/pkg/score" "github.com/kubescape/opa-utils/objectsenvelopes" @@ -18,6 +17,8 @@ import ( "github.com/open-policy-agent/opa/storage" + "github.com/kubescape/k8s-interface/cloudsupport" + "github.com/kubescape/k8s-interface/k8sinterface" "github.com/kubescape/k8s-interface/workloadinterface" reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2" @@ -155,10 +156,10 @@ func (opap *OPAProcessor) processRule(rule *reporthandling.PolicyRule, fixedCont postureControlInputs := opap.regoDependenciesData.GetFilteredPostureControlInputs(rule.ConfigInputs) // get store - clusterName := cautils.ClusterName + clusterName := k8sinterface.GetContextName() provider := cloudsupport.GetCloudProvider(clusterName) - postureControlInputs["CloudProvider"] = []string{provider} + postureControlInputs["cloudProvider"] = []string{provider} // Merge configurable control input and fixed control input for k, v := range fixedControlInputs { From e1773acf24444754ec14656e5ca8f4265929f252 Mon Sep 17 00:00:00 2001 From: kooomix Date: Fri, 25 Nov 2022 09:27:27 +0200 Subject: [PATCH 3/3] Getting cloud provider from gitversion of discovered API version --- core/pkg/opaprocessor/processorhandler.go | 7 +------ core/pkg/policyhandler/handlenotification.go | 13 +++++++++++++ 2 files changed, 14 insertions(+), 6 deletions(-) diff --git a/core/pkg/opaprocessor/processorhandler.go b/core/pkg/opaprocessor/processorhandler.go index 7ff1d2a7..397ecb3a 100644 --- a/core/pkg/opaprocessor/processorhandler.go +++ b/core/pkg/opaprocessor/processorhandler.go @@ -17,8 +17,6 @@ import ( "github.com/open-policy-agent/opa/storage" - "github.com/kubescape/k8s-interface/cloudsupport" - "github.com/kubescape/k8s-interface/k8sinterface" "github.com/kubescape/k8s-interface/workloadinterface" reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2" @@ -156,10 +154,7 @@ func (opap *OPAProcessor) processRule(rule *reporthandling.PolicyRule, fixedCont postureControlInputs := opap.regoDependenciesData.GetFilteredPostureControlInputs(rule.ConfigInputs) // get store - clusterName := k8sinterface.GetContextName() - provider := cloudsupport.GetCloudProvider(clusterName) - - postureControlInputs["cloudProvider"] = []string{provider} + postureControlInputs["cloudProvider"] = []string{opap.OPASessionObj.Report.ClusterCloudProvider} // Merge configurable control input and fixed control input for k, v := range fixedControlInputs { diff --git a/core/pkg/policyhandler/handlenotification.go b/core/pkg/policyhandler/handlenotification.go index cb86ae14..797fe881 100644 --- a/core/pkg/policyhandler/handlenotification.go +++ b/core/pkg/policyhandler/handlenotification.go @@ -4,6 +4,8 @@ import ( "fmt" "github.com/armosec/armoapi-go/armotypes" + "github.com/kubescape/k8s-interface/cloudsupport" + "github.com/kubescape/k8s-interface/k8sinterface" "github.com/kubescape/kubescape/v2/core/cautils" "github.com/kubescape/kubescape/v2/core/pkg/resourcehandler" ) @@ -49,6 +51,17 @@ func (policyHandler *PolicyHandler) CollectResources(policyIdentifier []cautils. func (policyHandler *PolicyHandler) getResources(policyIdentifier []cautils.PolicyIdentifier, opaSessionObj *cautils.OPASessionObj, scanInfo *cautils.ScanInfo) error { opaSessionObj.Report.ClusterAPIServerInfo = policyHandler.resourceHandler.GetClusterAPIServerInfo() + // attempting to get cloud provider from API server git version + if opaSessionObj.Report.ClusterAPIServerInfo != nil { + opaSessionObj.Report.ClusterCloudProvider = cloudsupport.GetCloudProvider(opaSessionObj.Report.ClusterAPIServerInfo.GitVersion) + } + + // if didn't succeed getting cloud provider from API server git version, try from context. + if opaSessionObj.Report.ClusterCloudProvider == "" { + clusterName := k8sinterface.GetContextName() + opaSessionObj.Report.ClusterCloudProvider = cloudsupport.GetCloudProvider(clusterName) + } + resourcesMap, allResources, ksResources, err := policyHandler.resourceHandler.GetResources(opaSessionObj, &policyIdentifier[0].Designators) if err != nil { return err