diff --git a/core/cautils/getter/downloadreleasedpolicy.go b/core/cautils/getter/downloadreleasedpolicy.go index a28c3fc2..b33c002b 100644 --- a/core/cautils/getter/downloadreleasedpolicy.go +++ b/core/cautils/getter/downloadreleasedpolicy.go @@ -3,6 +3,7 @@ package getter import ( "strings" + "github.com/armosec/armoapi-go/armotypes" "github.com/kubescape/opa-utils/gitregostore" "github.com/kubescape/opa-utils/reporthandling" "github.com/kubescape/opa-utils/reporthandling/attacktrack/v1alpha1" @@ -99,3 +100,11 @@ func contains(s []string, str string) bool { } return false } + +func (drp *DownloadReleasedPolicy) GetExceptions(clusterName string) ([]armotypes.PostureExceptionPolicy, error) { + exceptions, err := drp.gs.GetSystemPostureExceptionPolicies() + if err != nil { + return nil, err + } + return exceptions, nil +} diff --git a/core/core/download.go b/core/core/download.go index 3e71a100..9ef6869d 100644 --- a/core/core/download.go +++ b/core/core/download.go @@ -106,7 +106,7 @@ func downloadExceptions(downloadInfo *metav1.DownloadInfo) error { var err error tenant := getTenantConfig(&downloadInfo.Credentials, "", "", getKubernetesApi()) - exceptionsGetter := getExceptionsGetter("") + exceptionsGetter := getExceptionsGetter("", tenant.GetAccountID(), nil) exceptions := []armotypes.PostureExceptionPolicy{} if tenant.GetAccountID() != "" { exceptions, err = exceptionsGetter.GetExceptions(tenant.GetContextName()) diff --git a/core/core/initutils.go b/core/core/initutils.go index 68749825..d103cf66 100644 --- a/core/core/initutils.go +++ b/core/core/initutils.go @@ -32,13 +32,24 @@ func getTenantConfig(credentials *cautils.Credentials, clusterName string, custo return cautils.NewClusterConfig(k8s, getter.GetKSCloudAPIConnector(), credentials, clusterName, customClusterName) } -func getExceptionsGetter(useExceptions string) getter.IExceptionsGetter { +func getExceptionsGetter(useExceptions string, accountID string, downloadReleasedPolicy *getter.DownloadReleasedPolicy) getter.IExceptionsGetter { if useExceptions != "" { // load exceptions from file return getter.NewLoadPolicy([]string{useExceptions}) - } else { + } + if accountID != "" { + // download exceptions from Kubescape Cloud backend return getter.GetKSCloudAPIConnector() } + // download exceptions from GitHub + if downloadReleasedPolicy == nil { + downloadReleasedPolicy = getter.NewDownloadReleasedPolicy() + } + if err := downloadReleasedPolicy.SetRegoObjects(); err != nil { + logger.L().Warning("failed to get exceptions from github release, this may affect the scanning results", helpers.Error(err)) + } + return downloadReleasedPolicy + } func getRBACHandler(tenantConfig cautils.ITenantConfig, k8s *k8sinterface.KubernetesApi, submit bool) *cautils.RBACObjects { diff --git a/core/core/list.go b/core/core/list.go index d4dd9afc..155be08e 100644 --- a/core/core/list.go +++ b/core/core/list.go @@ -63,10 +63,10 @@ func listControls(listPolicies *metav1.ListPolicies) ([]string, error) { func listExceptions(listPolicies *metav1.ListPolicies) ([]string, error) { // load tenant metav1 - getTenantConfig(&listPolicies.Credentials, "", "", getKubernetesApi()) + tenant := getTenantConfig(&listPolicies.Credentials, "", "", getKubernetesApi()) var exceptionsNames []string - ksCloudAPI := getExceptionsGetter("") + ksCloudAPI := getExceptionsGetter("", tenant.GetAccountID(), nil) exceptions, err := ksCloudAPI.GetExceptions("") if err != nil { return exceptionsNames, err diff --git a/core/core/scan.go b/core/core/scan.go index 49fa69ab..1d9570ab 100644 --- a/core/core/scan.go +++ b/core/core/scan.go @@ -122,7 +122,7 @@ func (ks *Kubescape) Scan(scanInfo *cautils.ScanInfo) (*resultshandling.ResultsH // set policy getter only after setting the customerGUID scanInfo.Getters.PolicyGetter = getPolicyGetter(scanInfo.UseFrom, interfaces.tenantConfig.GetTenantEmail(), scanInfo.FrameworkScan, downloadReleasedPolicy) scanInfo.Getters.ControlsInputsGetter = getConfigInputsGetter(scanInfo.ControlsInputs, interfaces.tenantConfig.GetAccountID(), downloadReleasedPolicy) - scanInfo.Getters.ExceptionsGetter = getExceptionsGetter(scanInfo.UseExceptions) + scanInfo.Getters.ExceptionsGetter = getExceptionsGetter(scanInfo.UseExceptions, interfaces.tenantConfig.GetAccountID(), downloadReleasedPolicy) scanInfo.Getters.AttackTracksGetter = getAttackTracksGetter(interfaces.tenantConfig.GetAccountID(), downloadReleasedPolicy) // TODO - list supported frameworks/controls diff --git a/go.mod b/go.mod index dc9779a2..7c515a4e 100644 --- a/go.mod +++ b/go.mod @@ -16,7 +16,7 @@ require ( github.com/johnfercher/maroto v0.37.0 github.com/kubescape/go-logger v0.0.6 github.com/kubescape/k8s-interface v0.0.84 - github.com/kubescape/opa-utils v0.0.194 + github.com/kubescape/opa-utils v0.0.196 github.com/kubescape/rbac-utils v0.0.17 github.com/libgit2/git2go/v33 v33.0.9 github.com/mattn/go-isatty v0.0.14 diff --git a/go.sum b/go.sum index e078c844..682f72ca 100644 --- a/go.sum +++ b/go.sum @@ -558,8 +558,8 @@ github.com/kubescape/go-logger v0.0.6 h1:ynhAmwrz0O7Jtqq1CdmCZUrKveji25hVP+B/FAb github.com/kubescape/go-logger v0.0.6/go.mod h1:DnVWEvC90LFY1nNMaNo6nBVOcqkLMK3S0qzXP1fzRvI= github.com/kubescape/k8s-interface v0.0.84 h1:k7YzpQ3SaN+bJCtpXzMj60WWIK9RkQQrU8dFQutr3LA= github.com/kubescape/k8s-interface v0.0.84/go.mod h1:ihX96yqar+xogHl45mFE8zT9DLI06iy7XQPAP+j5KJE= -github.com/kubescape/opa-utils v0.0.194 h1:DroUvGV1R/PXsLPF6H4GB9LzcEylEMUKULs8vQBOU3w= -github.com/kubescape/opa-utils v0.0.194/go.mod h1:frMpD9wuK6rE3tMRIy6EM1X9zi+sSbXoDWjcSaq11og= +github.com/kubescape/opa-utils v0.0.196 h1:7pCW+wiMl8RsDNg2rIkSQPhvvnBnFvk90Jm8h/vdOxs= +github.com/kubescape/opa-utils v0.0.196/go.mod h1:frMpD9wuK6rE3tMRIy6EM1X9zi+sSbXoDWjcSaq11og= github.com/kubescape/rbac-utils v0.0.17 h1:B78kjlTKqjYK/PXwmi4GPysHsFxIwVz1KFb4+IGT29w= github.com/kubescape/rbac-utils v0.0.17/go.mod h1:pBwjpcrVeuH/no+DiCZWvlhYtCDzd3U0o/hEZKi+eM8= github.com/lunixbochs/vtclean v1.0.0/go.mod h1:pHhQNgMf3btfWnGBVipUOjRYhoOsdGqdm/+2c2E2WMI= diff --git a/httphandler/go.mod b/httphandler/go.mod index 8dca7083..5d34d817 100644 --- a/httphandler/go.mod +++ b/httphandler/go.mod @@ -12,7 +12,7 @@ require ( github.com/gorilla/schema v1.2.0 github.com/kubescape/go-logger v0.0.6 github.com/kubescape/kubescape/v2 v2.0.0-00010101000000-000000000000 - github.com/kubescape/opa-utils v0.0.194 + github.com/kubescape/opa-utils v0.0.196 github.com/stretchr/testify v1.8.0 k8s.io/utils v0.0.0-20220706174534-f6158b442e7c ) diff --git a/httphandler/go.sum b/httphandler/go.sum index 1454fd32..a99eb715 100644 --- a/httphandler/go.sum +++ b/httphandler/go.sum @@ -615,8 +615,8 @@ github.com/kubescape/go-logger v0.0.6 h1:ynhAmwrz0O7Jtqq1CdmCZUrKveji25hVP+B/FAb github.com/kubescape/go-logger v0.0.6/go.mod h1:DnVWEvC90LFY1nNMaNo6nBVOcqkLMK3S0qzXP1fzRvI= github.com/kubescape/k8s-interface v0.0.84 h1:k7YzpQ3SaN+bJCtpXzMj60WWIK9RkQQrU8dFQutr3LA= github.com/kubescape/k8s-interface v0.0.84/go.mod h1:ihX96yqar+xogHl45mFE8zT9DLI06iy7XQPAP+j5KJE= -github.com/kubescape/opa-utils v0.0.194 h1:DroUvGV1R/PXsLPF6H4GB9LzcEylEMUKULs8vQBOU3w= -github.com/kubescape/opa-utils v0.0.194/go.mod h1:frMpD9wuK6rE3tMRIy6EM1X9zi+sSbXoDWjcSaq11og= +github.com/kubescape/opa-utils v0.0.196 h1:7pCW+wiMl8RsDNg2rIkSQPhvvnBnFvk90Jm8h/vdOxs= +github.com/kubescape/opa-utils v0.0.196/go.mod h1:frMpD9wuK6rE3tMRIy6EM1X9zi+sSbXoDWjcSaq11og= github.com/kubescape/rbac-utils v0.0.17 h1:B78kjlTKqjYK/PXwmi4GPysHsFxIwVz1KFb4+IGT29w= github.com/kubescape/rbac-utils v0.0.17/go.mod h1:pBwjpcrVeuH/no+DiCZWvlhYtCDzd3U0o/hEZKi+eM8= github.com/lunixbochs/vtclean v1.0.0/go.mod h1:pHhQNgMf3btfWnGBVipUOjRYhoOsdGqdm/+2c2E2WMI=