github/kubescape
1
0
Fork 0
mirror of https://github.com/kubescape/kubescape.git synced 2026-04-15 06:58:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #896 from kubescape/revert-submit-dep

Browse Source 
Revert submit deprecation
This commit is contained in:
David Wertenteil
2022-11-06 15:06:49 +02:00
committed by GitHub
parent 6f651fa2d0 0c1eda0d08
commit 691fa61362
6 changed files with 74 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/scan/scan.go
+3 -10
View File
@@ -14,7 +14,7 @@ var scanCmdExamples = `
Scan command is for scanning an existing cluster or kubernetes manifest files based on pre-defined frameworks
# Scan current cluster with all frameworks
kubescape scan --submit --enable-host-scan --verbose
kubescape scan --enable-host-scan --verbose
# Scan kubernetes YAML manifest files
kubescape scan *.yaml
@@ -87,24 +87,17 @@ func GetScanCommand(ks meta.IKubescape) *cobra.Command {
scanCmd.PersistentFlags().StringVar(&scanInfo.HostSensorYamlPath, "host-scan-yaml", "", "Override default host scanner DaemonSet. Use this flag cautiously")
scanCmd.PersistentFlags().StringVar(&scanInfo.FormatVersion, "format-version", "v1", "Output object can be different between versions, this is for maintaining backward and forward compatibility. Supported:'v1'/'v2'")
scanCmd.PersistentFlags().StringVar(&scanInfo.CustomClusterName, "cluster-name", "", "Set the custom name of the cluster. Not same as the kube-context flag")
scanCmd.PersistentFlags().BoolVarP(&scanInfo.Submit, "submit", "", false, "Submit the scan results to Kubescape SaaS where you can see the results in a user-friendly UI, choose your preferred compliance framework, check risk results history and trends, manage exceptions, get remediation recommendations and much more. By default the results are not submitted")
// Deprecated flags - remove 1.May.2022
scanCmd.PersistentFlags().BoolVarP(&scanInfo.Silent, "silent", "s", false, "Silent progress messages")
scanCmd.PersistentFlags().MarkDeprecated("silent", "use '--logger' flag instead. Flag will be removed at 1.May.2022")
// Deprecated flags - remove 1.Jan.2023
scanCmd.PersistentFlags().BoolVarP(&scanInfo.Submit, "submit", "", false, "Send the scan results to ARMO management portal where you can see the results in a user-friendly UI, choose your preferred compliance framework, check risk results history and trends, manage exceptions, get remediation recommendations and much more. By default the results are not submitted")
scanCmd.PersistentFlags().MarkDeprecated("submit", "Kubescape will automatically submit the scan results whenever an account ID is configured. An account ID can be configured either with (1) '--account' flag (2) Kubescape configuration (3) 'KS_ACCOUNT_ID' environment variable. '--submit' flag will be removed at 1.Jan.2023")
// hidden flags
scanCmd.PersistentFlags().MarkHidden("host-scan-yaml") // this flag should be used very cautiously. We prefer users will not use it at all unless the DaemonSet can not run pods on the nodes
scanCmd.PersistentFlags().MarkHidden("silent") // this flag should be deprecated since we added the --logger support
// scanCmd.PersistentFlags().MarkHidden("format-version") // meant for testing different output approaches and not for common use
// Retrieve --kubeconfig flag from https://github.com/kubernetes/kubectl/blob/master/pkg/cmd/cmd.go
scanCmd.PersistentFlags().AddGoFlag(flag.Lookup("kubeconfig"))
hostF := scanCmd.PersistentFlags().VarPF(&scanInfo.HostSensorEnabled, "enable-host-scan", "", "Deploy ARMO K8s host-sensor daemonset in the scanned cluster. Deleting it right after we collecting the data. Required to collect valuable data from cluster nodes for certain controls. Yaml file: https://github.com/kubescape/kubescape/blob/master/core/pkg/hostsensorutils/hostsensor.yaml")
hostF := scanCmd.PersistentFlags().VarPF(&scanInfo.HostSensorEnabled, "enable-host-scan", "", "Deploy Kubescape host-sensor daemonset in the scanned cluster. Deleting it right after we collecting the data. Required to collect valuable data from cluster nodes for certain controls. Yaml file: https://github.com/kubescape/kubescape/blob/master/core/pkg/hostsensorutils/hostsensor.yaml")
hostF.NoOptDefVal = "true"
hostF.DefValue = "false, for no TTY in stdin"
core/pkg/registryadaptors/gcp/v1/datastructure.go
+2 -2
View File
@@ -1,7 +1,7 @@
package v1
import (
"github.com/kubescape/kubescape/v2/core/cautils/getter"
"github.com/kubescape/kubescape/v2/core/cautils/getter"
)
type GCPAdaptor struct {
@@ -21,4 +21,4 @@ type Mock struct {
FixAvailable bool
AffectedVersion string
FixedVersion string
}
}
core/pkg/registryadaptors/gcp/v1/gcpadaptor_test.go
+7 -7
View File
@@ -19,13 +19,13 @@ func TestSum(t *testing.T) {
imageVulnerabilityReports, err := adaptor.GetImagesVulnerabilities([]registryvulnerabilities.ContainerImageIdentifier{{Tag: "gcr.io/myproject/nginx@sha256:1XXXXX"}, {Tag: "gcr.io/myproject/nginx@sha256:2XXXXX"}})
assert.NoError(t, err)
for i,_ := range imageVulnerabilityReports {
var length int
if i==0 {
length= 5
}else if i==1 {
length=3
for i := range imageVulnerabilityReports {
var length int
if i == 0 {
length = 5
} else if i == 1 {
length = 3
}
assert.Equal(t, length, len(imageVulnerabilityReports[i].Vulnerabilities))
}
}
}
core/pkg/registryadaptors/gcp/v1/gcpadaptormock.go
+60 -62
View File
@@ -1,7 +1,6 @@
package v1
import (
"github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities"
grafeaspb "google.golang.org/genproto/googleapis/grafeas/v1"
"google.golang.org/protobuf/types/known/timestamppb"
@@ -38,11 +37,11 @@ func (GCPAdaptorMock *GCPAdaptorMock) GetImagesVulnerabilities(imageIDs []regist
func (GCPAdaptorMock *GCPAdaptorMock) GetImageVulnerability(imageID *registryvulnerabilities.ContainerImageIdentifier) (*registryvulnerabilities.ContainerImageVulnerabilityReport, error) {
vulnerability := []*grafeaspb.Occurrence_Vulnerability{}
occurence := []*grafeaspb.Occurrence{}
occurrence := []*grafeaspb.Occurrence{}
arr := GetMockData()
for i, _ := range arr {
if imageID.Tag == "gcr.io/myproject/nginx@sha256:2XXXXX" && i==4 {
if imageID.Tag == "gcr.io/myproject/nginx@sha256:2XXXXX" && i == 4 {
break
}
vulnerability = append(vulnerability, &grafeaspb.Occurrence_Vulnerability{
@@ -66,7 +65,7 @@ func (GCPAdaptorMock *GCPAdaptorMock) GetImageVulnerability(imageID *registryvul
},
})
occurence = append(occurence, &grafeaspb.Occurrence{
occurrence = append(occurrence, &grafeaspb.Occurrence{
Name: arr[i].Name,
Kind: grafeaspb.NoteKind_ATTESTATION,
NoteName: arr[i].Notename,
@@ -80,8 +79,7 @@ func (GCPAdaptorMock *GCPAdaptorMock) GetImageVulnerability(imageID *registryvul
})
}
vulnerabilities := responseObjectToVulnerabilities(occurence, 5)
vulnerabilities := responseObjectToVulnerabilities(occurrence, 5)
resultImageVulnerabilityReport := registryvulnerabilities.ContainerImageVulnerabilityReport{
ImageID: *imageID,
@@ -112,76 +110,76 @@ func (GCPAdaptorMock *GCPAdaptorMock) GetImagesScanStatus(imageIDs []registryvul
func GetMockData() []Mock {
arr := []Mock{
{
Name: "projects/stable-furnace-356005/occurrences/41fd9fec-6fab-4531-a4ee-e7b97d518554",
Notename: "projects/goog-vulnz/notes/CVE-2009-4487",
CvssScore: 6.8,
CreatedTime: 1661061853,
UpdatedTime: 1661061853,
Type: "OS",
Name: "projects/stable-furnace-356005/occurrences/41fd9fec-6fab-4531-a4ee-e7b97d518554",
Notename: "projects/goog-vulnz/notes/CVE-2009-4487",
CvssScore: 6.8,
CreatedTime: 1661061853,
UpdatedTime: 1661061853,
Type: "OS",
ShortDescription: "CVE-2009-4487",
AffectedCPEURI: "cpe:/o:debian:debian_linux:11",
AffectedPackage: "nginx",
FixAvailable: true,
AffectedVersion: "1.23.1-1~bullseye",
FixedVersion: "",
AffectedCPEURI: "cpe:/o:debian:debian_linux:11",
AffectedPackage: "nginx",
FixAvailable: true,
AffectedVersion: "1.23.1-1~bullseye",
FixedVersion: "",
},
{
Name: "projects/stable-furnace-356005/occurrences/b28fa29f-5c2b-45c7-9727-2f1f02ed1957",
Notename: "projects/goog-vulnz/notes/CVE-2017-17740",
CvssScore: 2.3,
CreatedTime: 3237628,
UpdatedTime: 5989893,
Type: "OS",
Name: "projects/stable-furnace-356005/occurrences/b28fa29f-5c2b-45c7-9727-2f1f02ed1957",
Notename: "projects/goog-vulnz/notes/CVE-2017-17740",
CvssScore: 2.3,
CreatedTime: 3237628,
UpdatedTime: 5989893,
Type: "OS",
ShortDescription: "CVE-2017-17740",
AffectedCPEURI: "cpe:/o:debian:debian_linux:11",
AffectedPackage: "openldap",
FixAvailable: false,
AffectedVersion: "1.3.5",
FixedVersion: "1.3.5",
AffectedCPEURI: "cpe:/o:debian:debian_linux:11",
AffectedPackage: "openldap",
FixAvailable: false,
AffectedVersion: "1.3.5",
FixedVersion: "1.3.5",
},
{
Name: "projects/stable-furnace-356005/occurrences/b28fa29f-5c2b-45c7-9727-2f1f02ed1957",
Notename: "projects/goog-vulnz/notes/CVE-2017-17740",
CvssScore: 2.3,
CreatedTime: 3237628,
UpdatedTime: 5989893,
Type: "OS",
Name: "projects/stable-furnace-356005/occurrences/b28fa29f-5c2b-45c7-9727-2f1f02ed1957",
Notename: "projects/goog-vulnz/notes/CVE-2017-17740",
CvssScore: 2.3,
CreatedTime: 3237628,
UpdatedTime: 5989893,
Type: "OS",
ShortDescription: "CVE-2017-17740",
AffectedCPEURI: "cpe:/o:debian:debian_linux:11",
AffectedPackage: "openldap",
FixAvailable: false,
AffectedVersion: "1.3.5",
FixedVersion: "1.3.5",
AffectedCPEURI: "cpe:/o:debian:debian_linux:11",
AffectedPackage: "openldap",
FixAvailable: false,
AffectedVersion: "1.3.5",
FixedVersion: "1.3.5",
},
{
Name: "projects/stable-furnace-356005/occurrences/b28fa29f-5c2b-45c7-9727-2f1f02ed1957",
Notename: "projects/goog-vulnz/notes/CVE-2017-17740",
CvssScore: 2.3,
CreatedTime: 3237628,
UpdatedTime: 5989893,
Type: "OS",
Name: "projects/stable-furnace-356005/occurrences/b28fa29f-5c2b-45c7-9727-2f1f02ed1957",
Notename: "projects/goog-vulnz/notes/CVE-2017-17740",
CvssScore: 2.3,
CreatedTime: 3237628,
UpdatedTime: 5989893,
Type: "OS",
ShortDescription: "CVE-2017-17740",
AffectedCPEURI: "cpe:/o:debian:debian_linux:11",
AffectedPackage: "openldap",
FixAvailable: false,
AffectedVersion: "1.3.5",
FixedVersion: "1.3.5",
AffectedCPEURI: "cpe:/o:debian:debian_linux:11",
AffectedPackage: "openldap",
FixAvailable: false,
AffectedVersion: "1.3.5",
FixedVersion: "1.3.5",
},
{
Name: "projects/stable-furnace-356005/occurrences/b28fa29f-5c2b-45c7-9727-2f1f02ed1957",
Notename: "projects/goog-vulnz/notes/CVE-2017-17740",
CvssScore: 2.3,
CreatedTime: 3237628,
UpdatedTime: 5989893,
Type: "OS",
Name: "projects/stable-furnace-356005/occurrences/b28fa29f-5c2b-45c7-9727-2f1f02ed1957",
Notename: "projects/goog-vulnz/notes/CVE-2017-17740",
CvssScore: 2.3,
CreatedTime: 3237628,
UpdatedTime: 5989893,
Type: "OS",
ShortDescription: "CVE-2017-17740",
AffectedCPEURI: "cpe:/o:debian:debian_linux:11",
AffectedPackage: "openldap",
FixAvailable: false,
AffectedVersion: "1.3.5",
FixedVersion: "1.3.5",
AffectedCPEURI: "cpe:/o:debian:debian_linux:11",
AffectedPackage: "openldap",
FixAvailable: false,
AffectedVersion: "1.3.5",
FixedVersion: "1.3.5",
},
}
return arr
}
}
core/pkg/registryadaptors/gcp/v1/gcpadaptorutils.go
+1 -1
View File
@@ -33,4 +33,4 @@ func responseObjectToVulnerabilities(vulnerabilityList []*grafeaspb.Occurrence,
}
return vulnerabilities
}
}
install.sh
+1 -1
View File
@@ -66,6 +66,6 @@ echo -e "\033[0m"
$KUBESCAPE_EXEC version
echo
echo -e "\033[35mUsage: $ $KUBESCAPE_EXEC scan --submit --enable-host-scan --verbose"
echo -e "\033[35mUsage: $ $KUBESCAPE_EXEC scan --enable-host-scan --verbose"
echo -e "\033[0m"