diff --git a/cmd/scan/scan.go b/cmd/scan/scan.go index 47f1529c..f5e4d94b 100644 --- a/cmd/scan/scan.go +++ b/cmd/scan/scan.go @@ -14,7 +14,7 @@ var scanCmdExamples = ` Scan command is for scanning an existing cluster or kubernetes manifest files based on pre-defined frameworks # Scan current cluster with all frameworks - kubescape scan --submit --enable-host-scan --verbose + kubescape scan --enable-host-scan --verbose # Scan kubernetes YAML manifest files kubescape scan *.yaml @@ -87,24 +87,17 @@ func GetScanCommand(ks meta.IKubescape) *cobra.Command { scanCmd.PersistentFlags().StringVar(&scanInfo.HostSensorYamlPath, "host-scan-yaml", "", "Override default host scanner DaemonSet. Use this flag cautiously") scanCmd.PersistentFlags().StringVar(&scanInfo.FormatVersion, "format-version", "v1", "Output object can be different between versions, this is for maintaining backward and forward compatibility. Supported:'v1'/'v2'") scanCmd.PersistentFlags().StringVar(&scanInfo.CustomClusterName, "cluster-name", "", "Set the custom name of the cluster. Not same as the kube-context flag") + scanCmd.PersistentFlags().BoolVarP(&scanInfo.Submit, "submit", "", false, "Submit the scan results to Kubescape SaaS where you can see the results in a user-friendly UI, choose your preferred compliance framework, check risk results history and trends, manage exceptions, get remediation recommendations and much more. By default the results are not submitted") - // Deprecated flags - remove 1.May.2022 - scanCmd.PersistentFlags().BoolVarP(&scanInfo.Silent, "silent", "s", false, "Silent progress messages") scanCmd.PersistentFlags().MarkDeprecated("silent", "use '--logger' flag instead. Flag will be removed at 1.May.2022") - // Deprecated flags - remove 1.Jan.2023 - scanCmd.PersistentFlags().BoolVarP(&scanInfo.Submit, "submit", "", false, "Send the scan results to ARMO management portal where you can see the results in a user-friendly UI, choose your preferred compliance framework, check risk results history and trends, manage exceptions, get remediation recommendations and much more. By default the results are not submitted") - scanCmd.PersistentFlags().MarkDeprecated("submit", "Kubescape will automatically submit the scan results whenever an account ID is configured. An account ID can be configured either with (1) '--account' flag (2) Kubescape configuration (3) 'KS_ACCOUNT_ID' environment variable. '--submit' flag will be removed at 1.Jan.2023") - // hidden flags scanCmd.PersistentFlags().MarkHidden("host-scan-yaml") // this flag should be used very cautiously. We prefer users will not use it at all unless the DaemonSet can not run pods on the nodes - scanCmd.PersistentFlags().MarkHidden("silent") // this flag should be deprecated since we added the --logger support - // scanCmd.PersistentFlags().MarkHidden("format-version") // meant for testing different output approaches and not for common use // Retrieve --kubeconfig flag from https://github.com/kubernetes/kubectl/blob/master/pkg/cmd/cmd.go scanCmd.PersistentFlags().AddGoFlag(flag.Lookup("kubeconfig")) - hostF := scanCmd.PersistentFlags().VarPF(&scanInfo.HostSensorEnabled, "enable-host-scan", "", "Deploy ARMO K8s host-sensor daemonset in the scanned cluster. Deleting it right after we collecting the data. Required to collect valuable data from cluster nodes for certain controls. Yaml file: https://github.com/kubescape/kubescape/blob/master/core/pkg/hostsensorutils/hostsensor.yaml") + hostF := scanCmd.PersistentFlags().VarPF(&scanInfo.HostSensorEnabled, "enable-host-scan", "", "Deploy Kubescape host-sensor daemonset in the scanned cluster. Deleting it right after we collecting the data. Required to collect valuable data from cluster nodes for certain controls. Yaml file: https://github.com/kubescape/kubescape/blob/master/core/pkg/hostsensorutils/hostsensor.yaml") hostF.NoOptDefVal = "true" hostF.DefValue = "false, for no TTY in stdin" diff --git a/core/pkg/registryadaptors/gcp/v1/datastructure.go b/core/pkg/registryadaptors/gcp/v1/datastructure.go index 69fc4c9e..b39be566 100644 --- a/core/pkg/registryadaptors/gcp/v1/datastructure.go +++ b/core/pkg/registryadaptors/gcp/v1/datastructure.go @@ -1,7 +1,7 @@ package v1 import ( - "github.com/kubescape/kubescape/v2/core/cautils/getter" + "github.com/kubescape/kubescape/v2/core/cautils/getter" ) type GCPAdaptor struct { @@ -21,4 +21,4 @@ type Mock struct { FixAvailable bool AffectedVersion string FixedVersion string -} \ No newline at end of file +} diff --git a/core/pkg/registryadaptors/gcp/v1/gcpadaptor_test.go b/core/pkg/registryadaptors/gcp/v1/gcpadaptor_test.go index b34a0518..9f46f57f 100644 --- a/core/pkg/registryadaptors/gcp/v1/gcpadaptor_test.go +++ b/core/pkg/registryadaptors/gcp/v1/gcpadaptor_test.go @@ -19,13 +19,13 @@ func TestSum(t *testing.T) { imageVulnerabilityReports, err := adaptor.GetImagesVulnerabilities([]registryvulnerabilities.ContainerImageIdentifier{{Tag: "gcr.io/myproject/nginx@sha256:1XXXXX"}, {Tag: "gcr.io/myproject/nginx@sha256:2XXXXX"}}) assert.NoError(t, err) - for i,_ := range imageVulnerabilityReports { - var length int - if i==0 { - length= 5 - }else if i==1 { - length=3 + for i := range imageVulnerabilityReports { + var length int + if i == 0 { + length = 5 + } else if i == 1 { + length = 3 } assert.Equal(t, length, len(imageVulnerabilityReports[i].Vulnerabilities)) } -} \ No newline at end of file +} diff --git a/core/pkg/registryadaptors/gcp/v1/gcpadaptormock.go b/core/pkg/registryadaptors/gcp/v1/gcpadaptormock.go index f09e677a..a99496b0 100644 --- a/core/pkg/registryadaptors/gcp/v1/gcpadaptormock.go +++ b/core/pkg/registryadaptors/gcp/v1/gcpadaptormock.go @@ -1,7 +1,6 @@ package v1 import ( - "github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities" grafeaspb "google.golang.org/genproto/googleapis/grafeas/v1" "google.golang.org/protobuf/types/known/timestamppb" @@ -38,11 +37,11 @@ func (GCPAdaptorMock *GCPAdaptorMock) GetImagesVulnerabilities(imageIDs []regist func (GCPAdaptorMock *GCPAdaptorMock) GetImageVulnerability(imageID *registryvulnerabilities.ContainerImageIdentifier) (*registryvulnerabilities.ContainerImageVulnerabilityReport, error) { vulnerability := []*grafeaspb.Occurrence_Vulnerability{} - occurence := []*grafeaspb.Occurrence{} + occurrence := []*grafeaspb.Occurrence{} arr := GetMockData() for i, _ := range arr { - if imageID.Tag == "gcr.io/myproject/nginx@sha256:2XXXXX" && i==4 { + if imageID.Tag == "gcr.io/myproject/nginx@sha256:2XXXXX" && i == 4 { break } vulnerability = append(vulnerability, &grafeaspb.Occurrence_Vulnerability{ @@ -66,7 +65,7 @@ func (GCPAdaptorMock *GCPAdaptorMock) GetImageVulnerability(imageID *registryvul }, }) - occurence = append(occurence, &grafeaspb.Occurrence{ + occurrence = append(occurrence, &grafeaspb.Occurrence{ Name: arr[i].Name, Kind: grafeaspb.NoteKind_ATTESTATION, NoteName: arr[i].Notename, @@ -80,8 +79,7 @@ func (GCPAdaptorMock *GCPAdaptorMock) GetImageVulnerability(imageID *registryvul }) } - - vulnerabilities := responseObjectToVulnerabilities(occurence, 5) + vulnerabilities := responseObjectToVulnerabilities(occurrence, 5) resultImageVulnerabilityReport := registryvulnerabilities.ContainerImageVulnerabilityReport{ ImageID: *imageID, @@ -112,76 +110,76 @@ func (GCPAdaptorMock *GCPAdaptorMock) GetImagesScanStatus(imageIDs []registryvul func GetMockData() []Mock { arr := []Mock{ { - Name: "projects/stable-furnace-356005/occurrences/41fd9fec-6fab-4531-a4ee-e7b97d518554", - Notename: "projects/goog-vulnz/notes/CVE-2009-4487", - CvssScore: 6.8, - CreatedTime: 1661061853, - UpdatedTime: 1661061853, - Type: "OS", + Name: "projects/stable-furnace-356005/occurrences/41fd9fec-6fab-4531-a4ee-e7b97d518554", + Notename: "projects/goog-vulnz/notes/CVE-2009-4487", + CvssScore: 6.8, + CreatedTime: 1661061853, + UpdatedTime: 1661061853, + Type: "OS", ShortDescription: "CVE-2009-4487", - AffectedCPEURI: "cpe:/o:debian:debian_linux:11", - AffectedPackage: "nginx", - FixAvailable: true, - AffectedVersion: "1.23.1-1~bullseye", - FixedVersion: "", + AffectedCPEURI: "cpe:/o:debian:debian_linux:11", + AffectedPackage: "nginx", + FixAvailable: true, + AffectedVersion: "1.23.1-1~bullseye", + FixedVersion: "", }, { - Name: "projects/stable-furnace-356005/occurrences/b28fa29f-5c2b-45c7-9727-2f1f02ed1957", - Notename: "projects/goog-vulnz/notes/CVE-2017-17740", - CvssScore: 2.3, - CreatedTime: 3237628, - UpdatedTime: 5989893, - Type: "OS", + Name: "projects/stable-furnace-356005/occurrences/b28fa29f-5c2b-45c7-9727-2f1f02ed1957", + Notename: "projects/goog-vulnz/notes/CVE-2017-17740", + CvssScore: 2.3, + CreatedTime: 3237628, + UpdatedTime: 5989893, + Type: "OS", ShortDescription: "CVE-2017-17740", - AffectedCPEURI: "cpe:/o:debian:debian_linux:11", - AffectedPackage: "openldap", - FixAvailable: false, - AffectedVersion: "1.3.5", - FixedVersion: "1.3.5", + AffectedCPEURI: "cpe:/o:debian:debian_linux:11", + AffectedPackage: "openldap", + FixAvailable: false, + AffectedVersion: "1.3.5", + FixedVersion: "1.3.5", }, { - Name: "projects/stable-furnace-356005/occurrences/b28fa29f-5c2b-45c7-9727-2f1f02ed1957", - Notename: "projects/goog-vulnz/notes/CVE-2017-17740", - CvssScore: 2.3, - CreatedTime: 3237628, - UpdatedTime: 5989893, - Type: "OS", + Name: "projects/stable-furnace-356005/occurrences/b28fa29f-5c2b-45c7-9727-2f1f02ed1957", + Notename: "projects/goog-vulnz/notes/CVE-2017-17740", + CvssScore: 2.3, + CreatedTime: 3237628, + UpdatedTime: 5989893, + Type: "OS", ShortDescription: "CVE-2017-17740", - AffectedCPEURI: "cpe:/o:debian:debian_linux:11", - AffectedPackage: "openldap", - FixAvailable: false, - AffectedVersion: "1.3.5", - FixedVersion: "1.3.5", + AffectedCPEURI: "cpe:/o:debian:debian_linux:11", + AffectedPackage: "openldap", + FixAvailable: false, + AffectedVersion: "1.3.5", + FixedVersion: "1.3.5", }, { - Name: "projects/stable-furnace-356005/occurrences/b28fa29f-5c2b-45c7-9727-2f1f02ed1957", - Notename: "projects/goog-vulnz/notes/CVE-2017-17740", - CvssScore: 2.3, - CreatedTime: 3237628, - UpdatedTime: 5989893, - Type: "OS", + Name: "projects/stable-furnace-356005/occurrences/b28fa29f-5c2b-45c7-9727-2f1f02ed1957", + Notename: "projects/goog-vulnz/notes/CVE-2017-17740", + CvssScore: 2.3, + CreatedTime: 3237628, + UpdatedTime: 5989893, + Type: "OS", ShortDescription: "CVE-2017-17740", - AffectedCPEURI: "cpe:/o:debian:debian_linux:11", - AffectedPackage: "openldap", - FixAvailable: false, - AffectedVersion: "1.3.5", - FixedVersion: "1.3.5", + AffectedCPEURI: "cpe:/o:debian:debian_linux:11", + AffectedPackage: "openldap", + FixAvailable: false, + AffectedVersion: "1.3.5", + FixedVersion: "1.3.5", }, { - Name: "projects/stable-furnace-356005/occurrences/b28fa29f-5c2b-45c7-9727-2f1f02ed1957", - Notename: "projects/goog-vulnz/notes/CVE-2017-17740", - CvssScore: 2.3, - CreatedTime: 3237628, - UpdatedTime: 5989893, - Type: "OS", + Name: "projects/stable-furnace-356005/occurrences/b28fa29f-5c2b-45c7-9727-2f1f02ed1957", + Notename: "projects/goog-vulnz/notes/CVE-2017-17740", + CvssScore: 2.3, + CreatedTime: 3237628, + UpdatedTime: 5989893, + Type: "OS", ShortDescription: "CVE-2017-17740", - AffectedCPEURI: "cpe:/o:debian:debian_linux:11", - AffectedPackage: "openldap", - FixAvailable: false, - AffectedVersion: "1.3.5", - FixedVersion: "1.3.5", + AffectedCPEURI: "cpe:/o:debian:debian_linux:11", + AffectedPackage: "openldap", + FixAvailable: false, + AffectedVersion: "1.3.5", + FixedVersion: "1.3.5", }, } return arr -} \ No newline at end of file +} diff --git a/core/pkg/registryadaptors/gcp/v1/gcpadaptorutils.go b/core/pkg/registryadaptors/gcp/v1/gcpadaptorutils.go index f4a9e53b..eeba5121 100644 --- a/core/pkg/registryadaptors/gcp/v1/gcpadaptorutils.go +++ b/core/pkg/registryadaptors/gcp/v1/gcpadaptorutils.go @@ -33,4 +33,4 @@ func responseObjectToVulnerabilities(vulnerabilityList []*grafeaspb.Occurrence, } return vulnerabilities -} \ No newline at end of file +} diff --git a/install.sh b/install.sh index a465b3e7..213860c9 100755 --- a/install.sh +++ b/install.sh @@ -66,6 +66,6 @@ echo -e "\033[0m" $KUBESCAPE_EXEC version echo -echo -e "\033[35mUsage: $ $KUBESCAPE_EXEC scan --submit --enable-host-scan --verbose" +echo -e "\033[35mUsage: $ $KUBESCAPE_EXEC scan --enable-host-scan --verbose" echo -e "\033[0m"