From 27e2c044da618ae4a106b4f0fd19fe8e79d3cd4e Mon Sep 17 00:00:00 2001 From: yiscah Date: Mon, 3 Jan 2022 09:59:34 +0200 Subject: [PATCH 1/3] update rbac-utils version for SAID2WLIDmap obj --- cautils/rbac.go | 7 +++++++ go.mod | 2 +- go.sum | 4 ++-- 3 files changed, 10 insertions(+), 3 deletions(-) diff --git a/cautils/rbac.go b/cautils/rbac.go index 61eac56a..64854016 100644 --- a/cautils/rbac.go +++ b/cautils/rbac.go @@ -43,12 +43,19 @@ func (rbacObjects *RBACObjects) ListAllResources() (map[string]workloadinterface func (rbacObjects *RBACObjects) rbacObjectsToResources(resources *rbacutils.RbacObjects) (map[string]workloadinterface.IMetadata, error) { allresources := map[string]workloadinterface.IMetadata{} // wrap rbac aggregated objects in IMetadata and add to allresources + // TODO - DEPRECATE SA2WLIDmap SA2WLIDmapIMeta, err := rbacutils.SA2WLIDmapIMetadataWrapper(resources.SA2WLIDmap) if err != nil { return nil, err } allresources[SA2WLIDmapIMeta.GetID()] = SA2WLIDmapIMeta + SAID2WLIDmapIMeta, err := rbacutils.SAID2WLIDmapIMetadataWrapper(resources.SAID2WLIDmap) + if err != nil { + return nil, err + } + allresources[SAID2WLIDmapIMeta.GetID()] = SAID2WLIDmapIMeta + // convert rbac k8s resources to IMetadata and add to allresources for _, cr := range resources.ClusterRoles.Items { crmap, err := convertToMap(cr) diff --git a/go.mod b/go.mod index 1be3fc6a..48875f78 100644 --- a/go.mod +++ b/go.mod @@ -6,7 +6,7 @@ require ( github.com/armosec/armoapi-go v0.0.40 github.com/armosec/k8s-interface v0.0.50 github.com/armosec/opa-utils v0.0.78 - github.com/armosec/rbac-utils v0.0.10 + github.com/armosec/rbac-utils v0.0.11 github.com/armosec/utils-go v0.0.3 github.com/briandowns/spinner v1.18.0 github.com/enescakir/emoji v1.0.0 diff --git a/go.sum b/go.sum index e5c512ca..103f92da 100644 --- a/go.sum +++ b/go.sum @@ -95,8 +95,8 @@ github.com/armosec/opa-utils v0.0.64/go.mod h1:6tQP8UDq2EvEfSqh8vrUdr/9QVSCG4sJf github.com/armosec/opa-utils v0.0.78 h1:wFkVqJ1vEftn3E1hHdUfKlp5xHgof616ljyKKebuNkI= github.com/armosec/opa-utils v0.0.78/go.mod h1:ZOXYVTtuyrV4TldcfbzgRqP6F9Drlf4hB0zr210OXgM= github.com/armosec/rbac-utils v0.0.1/go.mod h1:pQ8CBiij8kSKV7aeZm9FMvtZN28VgA7LZcYyTWimq40= -github.com/armosec/rbac-utils v0.0.10 h1:bFjesO8+xJS1ryR9vqj4xFEo1cQ0HvClzR+LWHzozW4= -github.com/armosec/rbac-utils v0.0.10/go.mod h1:Ex/IdGWhGv9HZq6Hs8N/ApzCKSIvpNe/ETqDfnuyah0= +github.com/armosec/rbac-utils v0.0.11 h1:SCiVLqUeV+WGpUsWbOBt6jKkFAd62jztuzB6PIgHz7w= +github.com/armosec/rbac-utils v0.0.11/go.mod h1:Ex/IdGWhGv9HZq6Hs8N/ApzCKSIvpNe/ETqDfnuyah0= github.com/armosec/utils-go v0.0.2/go.mod h1:itWmRLzRdsnwjpEOomL0mBWGnVNNIxSjDAdyc+b0iUo= github.com/armosec/utils-go v0.0.3 h1:uyQI676yRciQM0sSN9uPoqHkbspTxHO0kmzXhBeE/xU= github.com/armosec/utils-go v0.0.3/go.mod h1:itWmRLzRdsnwjpEOomL0mBWGnVNNIxSjDAdyc+b0iUo= From a4c88edfca161fcf46cc902837ccee57be994d88 Mon Sep 17 00:00:00 2001 From: yiscah Date: Wed, 5 Jan 2022 15:56:24 +0200 Subject: [PATCH 2/3] begin download config + download exceptions --- clihandler/clidownload.go | 85 ++++++++++++++++++++++++++++++++++ clihandler/cmd/download.go | 94 -------------------------------------- clihandler/initcli.go | 4 +- clihandler/initcliutils.go | 27 +++++------ 4 files changed, 101 insertions(+), 109 deletions(-) create mode 100644 clihandler/clidownload.go diff --git a/clihandler/clidownload.go b/clihandler/clidownload.go new file mode 100644 index 00000000..1faf8656 --- /dev/null +++ b/clihandler/clidownload.go @@ -0,0 +1,85 @@ +package clihandler + +import ( + "fmt" + "strings" + + "github.com/armosec/k8s-interface/k8sinterface" + "github.com/armosec/kubescape/cautils" + "github.com/armosec/kubescape/cautils/getter" +) + +var downloadInfo cautils.DownloadInfo + +func CliDownload(args []string) error { + switch strings.ToLower(args[0]) { + case "framework": + return downloadFramework(args[1]) + case "control": + return downloadControl(args[1]) + case "exceptions": + return downloadExceptions(args[1]) + case "configinputs": + return downloadConfigInputs(args[1]) + // case "artifacts": + default: + return fmt.Errorf("unknown command to download") + } +} + +func downloadConfigInputs(controlsInputs string) error { + tenant := getTenantConfig("", &k8sinterface.KubernetesApi{}) // change k8sinterface + downloadReleasedPolicy := getter.NewDownloadReleasedPolicy() // download config inputs from github release + controlsInputsGetter := getConfigInputsGetter(controlsInputs, tenant.GetCustomerGUID(), downloadReleasedPolicy) + controlInputs, err := controlsInputsGetter.GetControlsInputs(tenant.GetCustomerGUID(), tenant.GetClusterName()) + if err != nil { + return err + } + // save in file + return nil +} + +func downloadExceptions(frameworkName string) error { + return nil +} + +func downloadFramework(frameworkName string) error { + downloadInfo.FrameworkName = strings.ToLower(frameworkName) + g := getter.NewDownloadReleasedPolicy() + if err := g.SetRegoObjects(); err != nil { + return err + } + + if downloadInfo.Path == "" { + downloadInfo.Path = getter.GetDefaultPath(downloadInfo.FrameworkName + ".json") + } + frameworks, err := g.GetFramework(downloadInfo.FrameworkName) + if err != nil { + return err + } + err = getter.SaveFrameworkInFile(frameworks, downloadInfo.Path) + if err != nil { + return err + } + return nil +} + +func downloadControl(controlName string) error { + downloadInfo.ControlName = strings.ToLower(controlName) + g := getter.NewDownloadReleasedPolicy() + if err := g.SetRegoObjects(); err != nil { + return err + } + if downloadInfo.Path == "" { + downloadInfo.Path = getter.GetDefaultPath(downloadInfo.ControlName + ".json") + } + controls, err := g.GetControl(downloadInfo.ControlName) + if err != nil { + return err + } + err = getter.SaveControlInFile(controls, downloadInfo.Path) + if err != nil { + return err + } + return nil +} diff --git a/clihandler/cmd/download.go b/clihandler/cmd/download.go index bc4bd3ca..1d619dd0 100644 --- a/clihandler/cmd/download.go +++ b/clihandler/cmd/download.go @@ -1,95 +1 @@ package cmd - -import ( - "fmt" - "os" - "strings" - - "github.com/armosec/kubescape/cautils" - "github.com/armosec/kubescape/cautils/getter" - "github.com/spf13/cobra" -) - -var downloadInfo cautils.DownloadInfo - -var downloadCmd = &cobra.Command{ - Use: fmt.Sprintf("download framework/control / [flags]\nSupported frameworks: %s", getter.NativeFrameworks), - Short: "Download framework/control", - Long: ``, - Args: func(cmd *cobra.Command, args []string) error { - if len(args) != 2 { - return fmt.Errorf("requires two arguments : framework/control /") - } - if !strings.EqualFold(args[0], "framework") && !strings.EqualFold(args[0], "control") { - return fmt.Errorf("invalid parameter '%s'. Supported parameters: framework, control", args[0]) - } - return nil - }, - RunE: func(cmd *cobra.Command, args []string) error { - if err := download(args); err != nil { - fmt.Fprintf(os.Stderr, "error: %v\n", err) - os.Exit(1) - } - return nil - }, -} - -func init() { - rootCmd.AddCommand(downloadCmd) - downloadInfo = cautils.DownloadInfo{} - downloadCmd.Flags().StringVarP(&downloadInfo.Path, "output", "o", "", "Output file. If specified, will store save to `~/.kubescape/.json`") -} - -func download(args []string) error { - switch strings.ToLower(args[0]) { - case "framework": - return downloadFramework(args[1]) - case "control": - return downloadControl(args[1]) - // case "exceptions": - // case "artifacts": - default: - return fmt.Errorf("unknown command to download") - } -} - -func downloadFramework(frameworkName string) error { - downloadInfo.FrameworkName = strings.ToLower(frameworkName) - g := getter.NewDownloadReleasedPolicy() - if err := g.SetRegoObjects(); err != nil { - return err - } - - if downloadInfo.Path == "" { - downloadInfo.Path = getter.GetDefaultPath(downloadInfo.FrameworkName + ".json") - } - frameworks, err := g.GetFramework(downloadInfo.FrameworkName) - if err != nil { - return err - } - err = getter.SaveFrameworkInFile(frameworks, downloadInfo.Path) - if err != nil { - return err - } - return nil -} - -func downloadControl(controlName string) error { - downloadInfo.ControlName = strings.ToLower(controlName) - g := getter.NewDownloadReleasedPolicy() - if err := g.SetRegoObjects(); err != nil { - return err - } - if downloadInfo.Path == "" { - downloadInfo.Path = getter.GetDefaultPath(downloadInfo.ControlName + ".json") - } - controls, err := g.GetControl(downloadInfo.ControlName) - if err != nil { - return err - } - err = getter.SaveControlInFile(controls, downloadInfo.Path) - if err != nil { - return err - } - return nil -} diff --git a/clihandler/initcli.go b/clihandler/initcli.go index c8faee0f..57ef5411 100644 --- a/clihandler/initcli.go +++ b/clihandler/initcli.go @@ -32,7 +32,7 @@ func getInterfaces(scanInfo *cautils.ScanInfo) componentInterfaces { k8s := getKubernetesApi(scanInfo) - tenantConfig := getTenantConfig(scanInfo, k8s) + tenantConfig := getTenantConfig(scanInfo.Account, k8s) // Set submit behavior AFTER loading tenant config setSubmitBehavior(scanInfo, tenantConfig) @@ -89,7 +89,7 @@ func ScanCliSetup(scanInfo *cautils.ScanInfo) error { downloadReleasedPolicy := getter.NewDownloadReleasedPolicy() // download config inputs from github release // set policy getter only after setting the customerGUID setPolicyGetter(scanInfo, interfaces.tenantConfig.GetCustomerGUID(), downloadReleasedPolicy) - setConfigInputsGetter(scanInfo, interfaces.tenantConfig.GetCustomerGUID(), downloadReleasedPolicy) + scanInfo.Getters.ControlsInputsGetter = getConfigInputsGetter(scanInfo.ControlsInputs, interfaces.tenantConfig.GetCustomerGUID(), downloadReleasedPolicy) defer func() { if err := interfaces.hostSensorHandler.TearDown(); err != nil { diff --git a/clihandler/initcliutils.go b/clihandler/initcliutils.go index 667f43a3..9f930b45 100644 --- a/clihandler/initcliutils.go +++ b/clihandler/initcliutils.go @@ -21,11 +21,11 @@ func getKubernetesApi(scanInfo *cautils.ScanInfo) *k8sinterface.KubernetesApi { } return k8sinterface.NewKubernetesApi() } -func getTenantConfig(scanInfo *cautils.ScanInfo, k8s *k8sinterface.KubernetesApi) cautils.ITenantConfig { - if scanInfo.GetScanningEnvironment() == cautils.ScanLocalFiles { - return cautils.NewLocalConfig(getter.GetArmoAPIConnector(), scanInfo.Account) +func getTenantConfig(Account string, k8s *k8sinterface.KubernetesApi) cautils.ITenantConfig { + if !k8sinterface.IsConnectedToCluster() { + return cautils.NewLocalConfig(getter.GetArmoAPIConnector(), Account) } - return cautils.NewClusterConfig(k8s, getter.GetArmoAPIConnector(), scanInfo.Account) + return cautils.NewClusterConfig(k8s, getter.GetArmoAPIConnector(), Account) } func getRBACHandler(tenantConfig cautils.ITenantConfig, k8s *k8sinterface.KubernetesApi, submit bool) *cautils.RBACObjects { @@ -142,7 +142,7 @@ func setPolicyGetter(scanInfo *cautils.ScanInfo, customerGUID string, downloadRe scanInfo.PolicyGetter = getter.NewLoadPolicy(scanInfo.UseFrom) } else { if customerGUID == "" || !scanInfo.FrameworkScan { - setDownloadReleasedPolicy(scanInfo, downloadReleasedPolicy) + scanInfo.PolicyGetter = getDownloadReleasedPolicy(downloadReleasedPolicy) } else { setGetArmoAPIConnector(scanInfo, customerGUID) } @@ -150,29 +150,30 @@ func setPolicyGetter(scanInfo *cautils.ScanInfo, customerGUID string, downloadRe } // setConfigInputsGetter sets the config input getter - local file/github release/ArmoAPI -func setConfigInputsGetter(scanInfo *cautils.ScanInfo, customerGUID string, downloadReleasedPolicy *getter.DownloadReleasedPolicy) { - if len(scanInfo.ControlsInputs) > 0 { - scanInfo.Getters.ControlsInputsGetter = getter.NewLoadPolicy([]string{scanInfo.ControlsInputs}) +func getConfigInputsGetter(ControlsInputs string, customerGUID string, downloadReleasedPolicy *getter.DownloadReleasedPolicy) getter.IControlsInputsGetter { + if len(ControlsInputs) > 0 { + return getter.NewLoadPolicy([]string{ControlsInputs}) } else { if customerGUID != "" { - scanInfo.Getters.ControlsInputsGetter = getter.GetArmoAPIConnector() + return getter.GetArmoAPIConnector() } else { if err := downloadReleasedPolicy.SetRegoObjects(); err != nil { // if failed to pull config inputs, fallback to BE cautils.WarningDisplay(os.Stderr, "Warning: failed to get config inputs from github release, this may affect the scanning results\n") } - scanInfo.Getters.ControlsInputsGetter = downloadReleasedPolicy + return downloadReleasedPolicy } } } -func setDownloadReleasedPolicy(scanInfo *cautils.ScanInfo, downloadReleasedPolicy *getter.DownloadReleasedPolicy) { +func getDownloadReleasedPolicy(downloadReleasedPolicy *getter.DownloadReleasedPolicy) getter.IPolicyGetter { if err := downloadReleasedPolicy.SetRegoObjects(); err != nil { // if failed to pull policy, fallback to cache cautils.WarningDisplay(os.Stderr, "Warning: failed to get policies from github release, loading policies from cache\n") - scanInfo.PolicyGetter = getter.NewLoadPolicy(getDefaultFrameworksPaths()) + return getter.NewLoadPolicy(getDefaultFrameworksPaths()) } else { - scanInfo.PolicyGetter = downloadReleasedPolicy + return downloadReleasedPolicy } } + func setGetArmoAPIConnector(scanInfo *cautils.ScanInfo, customerGUID string) { g := getter.GetArmoAPIConnector() // download policy from ARMO backend g.SetCustomerGUID(customerGUID) From 1efdae519714f6d616f7fc13334f89bbcb43fabe Mon Sep 17 00:00:00 2001 From: yiscah Date: Wed, 5 Jan 2022 15:56:38 +0200 Subject: [PATCH 3/3] begin download config + download exceptions --- clihandler/cmd/download.go | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) diff --git a/clihandler/cmd/download.go b/clihandler/cmd/download.go index 1d619dd0..42cb9fa0 100644 --- a/clihandler/cmd/download.go +++ b/clihandler/cmd/download.go @@ -1 +1,39 @@ package cmd + +import ( + "fmt" + "os" + "strings" + + "github.com/armosec/kubescape/cautils" + "github.com/armosec/kubescape/cautils/getter" + "github.com/spf13/cobra" +) + +var downloadCmd = &cobra.Command{ + Use: fmt.Sprintf("download framework/control / [flags]\nSupported frameworks: %s", getter.NativeFrameworks), + Short: "Download framework/control", + Long: ``, + Args: func(cmd *cobra.Command, args []string) error { + if len(args) != 2 { + return fmt.Errorf("requires two arguments : framework/control /") + } + if !strings.EqualFold(args[0], "framework") && !strings.EqualFold(args[0], "control") { + return fmt.Errorf("invalid parameter '%s'. Supported parameters: framework, control", args[0]) + } + return nil + }, + RunE: func(cmd *cobra.Command, args []string) error { + if err := CliDownload(args); err != nil { + fmt.Fprintf(os.Stderr, "error: %v\n", err) + os.Exit(1) + } + return nil + }, +} + +func init() { + rootCmd.AddCommand(downloadCmd) + downloadInfo := cautils.DownloadInfo{} + downloadCmd.Flags().StringVarP(&downloadInfo.Path, "output", "o", "", "Output file. If specified, will store save to `~/.kubescape/.json`") +}