Merge branch 'dev' into dev

This commit is contained in:
Moshe Rappaport
2022-08-23 15:51:57 +03:00
committed by GitHub
116 changed files with 581 additions and 513 deletions
+1 -5
View File
@@ -96,10 +96,6 @@ jobs:
env:
RELEASE: v2.0.${{ github.run_number }}
CLIENT: release
ArmoBEServer: api.armo.cloud
ArmoAuthServer: auth.armo.cloud
ArmoERServer: report.armo.cloud
ArmoWebsite: portal.armo.cloud
CGO_ENABLED: 1
run: python3 --version && python3 build.py
@@ -134,7 +130,7 @@ jobs:
name: Build docker container, tag and upload to registry
needs: build
runs-on: ubuntu-latest
if: ${{ github.repository == 'armosec/kubescape' }} # TODO
if: ${{ github.repository == 'kubescape/kubescape' }} # TODO
permissions:
id-token: write
packages: write
+1 -5
View File
@@ -88,10 +88,6 @@ jobs:
env:
RELEASE: v2.0.${{ github.run_number }}
CLIENT: release-dev
ArmoBEServer: api.armo.cloud
ArmoAuthServer: auth.armo.cloud
ArmoERServer: report.armo.cloud
ArmoWebsite: portal.armo.cloud
CGO_ENABLED: 1
run: python3 --version && python3 build.py
@@ -110,7 +106,7 @@ jobs:
build-docker:
name: Build docker container, tag and upload to registry
needs: build
if: ${{ github.repository == 'armosec/kubescape' }} # TODO
if: ${{ github.repository == 'kubescape/kubescape' }} # TODO
runs-on: ubuntu-latest
permissions:
id-token: write
-4
View File
@@ -81,10 +81,6 @@ jobs:
env:
RELEASE: v2.0.${{ github.run_number }}
CLIENT: test
ArmoBEServer: api.armo.cloud
ArmoAuthServer: auth.armo.cloud
ArmoERServer: report.armo.cloud
ArmoWebsite: portal.armo.cloud
CGO_ENABLED: 1
run: python3 --version && python3 build.py
+8 -8
View File
@@ -1,7 +1,7 @@
<img src="docs/kubescape.png" width="300" alt="logo" align="center">
[![build](https://github.com/armosec/kubescape/actions/workflows/build.yaml/badge.svg)](https://github.com/armosec/kubescape/actions/workflows/build.yaml)
[![Go Report Card](https://goreportcard.com/badge/github.com/armosec/kubescape)](https://goreportcard.com/report/github.com/armosec/kubescape)
[![build](https://github.com/kubescape/kubescape/actions/workflows/build.yaml/badge.svg)](https://github.com/kubescape/kubescape/actions/workflows/build.yaml)
[![Go Report Card](https://goreportcard.com/badge/github.com/kubescape/kubescape)](https://goreportcard.com/report/github.com/kubescape/kubescape)
@@ -29,7 +29,7 @@ Kubescape integrates natively with other DevOps tools, including Jenkins, Circle
# TL;DR
## Install:
```sh
curl -s https://raw.githubusercontent.com/armosec/kubescape/master/install.sh | /bin/bash
curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | /bin/bash
```
[Install on windows](#install-on-windows)
@@ -53,7 +53,7 @@ kubescape scan --submit --enable-host-scan --verbose
</br>
### Click [👍](https://github.com/armosec/kubescape/stargazers) if you want us to continue to develop and improve Kubescape 😀
### Click [👍](https://github.com/kubescape/kubescape/stargazers) if you want us to continue to develop and improve Kubescape 😀
</br>
@@ -96,7 +96,7 @@ Want to contribute? Want to discuss something? Have an issue?
**Requires powershell v5.0+**
``` powershell
iwr -useb https://raw.githubusercontent.com/armosec/kubescape/master/install.ps1 | iex
iwr -useb https://raw.githubusercontent.com/kubescape/kubescape/master/install.ps1 | iex
```
Note: if you get an error you might need to change the execution policy (i.e. enable Powershell) with
@@ -200,7 +200,7 @@ kubescape scan *.yaml --submit
#### Scan kubernetes manifest files from a git repository [and submit the results](https://hub.armosec.io/docs/repository-scanning?utm_source=github&utm_medium=repository)
```
kubescape scan https://github.com/armosec/kubescape --submit
kubescape scan https://github.com/kubescape/kubescape --submit
```
#### Display all scanned resources (including the resources who passed)
@@ -411,7 +411,7 @@ The results by default printed in a pretty "console friendly" manner, but they c
Kubescape is an open source project, we welcome your feedback and ideas for improvement. Were also aiming to collaborate with the Kubernetes community to help make the tests themselves more robust and complete as Kubernetes develops.
## Thanks to all the contributors ❤️
<a href = "https://github.com/armosec/kubescape/graphs/contributors">
<img src = "https://contrib.rocks/image?repo=armosec/kubescape"/>
<a href = "https://github.com/kubescape/kubescape/graphs/contributors">
<img src = "https://contrib.rocks/image?repo=kubescape/kubescape"/>
</a>
+3 -3
View File
@@ -4,7 +4,7 @@ import hashlib
import platform
import subprocess
BASE_GETTER_CONST = "github.com/armosec/kubescape/v2/core/cautils/getter"
BASE_GETTER_CONST = "github.com/kubescape/kubescape/v2/core/cautils/getter"
def check_status(status, msg):
if status != 0:
@@ -35,10 +35,10 @@ def main():
# Set some variables
package_name = get_package_name()
build_url = "github.com/armosec/kubescape/v2/core/cautils.BuildNumber"
build_url = "github.com/kubescape/kubescape/v2/core/cautils.BuildNumber"
release_version = os.getenv("RELEASE")
client_var = "github.com/armosec/kubescape/v2/core/cautils.Client"
client_var = "github.com/kubescape/kubescape/v2/core/cautils.Client"
client_name = os.getenv("CLIENT")
# Create build directory
+1 -1
View File
@@ -4,7 +4,7 @@
1. Clone Project
```
git clone https://github.com/armosec/kubescape.git kubescape && cd "$_"
git clone https://github.com/kubescape/kubescape.git kubescape && cd "$_"
```
2. Build
+1 -1
View File
@@ -1,7 +1,7 @@
package config
import (
"github.com/armosec/kubescape/v2/core/meta"
"github.com/kubescape/kubescape/v2/core/meta"
"github.com/spf13/cobra"
)
+2 -2
View File
@@ -1,9 +1,9 @@
package config
import (
"github.com/armosec/kubescape/v2/core/meta"
v1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/kubescape/v2/core/meta"
v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
"github.com/spf13/cobra"
)
+2 -2
View File
@@ -4,9 +4,9 @@ import (
"fmt"
"strings"
"github.com/armosec/kubescape/v2/core/meta"
metav1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/kubescape/v2/core/meta"
metav1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
"github.com/spf13/cobra"
)
+2 -2
View File
@@ -3,9 +3,9 @@ package config
import (
"os"
"github.com/armosec/kubescape/v2/core/meta"
v1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/kubescape/v2/core/meta"
v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
"github.com/spf13/cobra"
)
+2 -2
View File
@@ -1,8 +1,8 @@
package delete
import (
"github.com/armosec/kubescape/v2/core/meta"
v1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
"github.com/kubescape/kubescape/v2/core/meta"
v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
"github.com/spf13/cobra"
)
+2 -2
View File
@@ -4,9 +4,9 @@ import (
"fmt"
"strings"
"github.com/armosec/kubescape/v2/core/meta"
v1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/kubescape/v2/core/meta"
v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
"github.com/spf13/cobra"
)
+4 -4
View File
@@ -5,11 +5,11 @@ import (
"path/filepath"
"strings"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/armosec/kubescape/v2/core/core"
"github.com/armosec/kubescape/v2/core/meta"
v1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/core"
"github.com/kubescape/kubescape/v2/core/meta"
v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
"github.com/spf13/cobra"
)
+4 -4
View File
@@ -4,11 +4,11 @@ import (
"fmt"
"strings"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/armosec/kubescape/v2/core/core"
"github.com/armosec/kubescape/v2/core/meta"
v1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/core"
"github.com/kubescape/kubescape/v2/core/meta"
v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
"github.com/spf13/cobra"
)
+12 -12
View File
@@ -4,20 +4,20 @@ import (
"fmt"
"strings"
"github.com/armosec/kubescape/v2/cmd/completion"
"github.com/armosec/kubescape/v2/cmd/config"
"github.com/armosec/kubescape/v2/cmd/delete"
"github.com/armosec/kubescape/v2/cmd/download"
"github.com/armosec/kubescape/v2/cmd/list"
"github.com/armosec/kubescape/v2/cmd/scan"
"github.com/armosec/kubescape/v2/cmd/submit"
"github.com/armosec/kubescape/v2/cmd/version"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/armosec/kubescape/v2/core/cautils/getter"
"github.com/armosec/kubescape/v2/core/core"
"github.com/armosec/kubescape/v2/core/meta"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/kubescape/v2/cmd/completion"
"github.com/kubescape/kubescape/v2/cmd/config"
"github.com/kubescape/kubescape/v2/cmd/delete"
"github.com/kubescape/kubescape/v2/cmd/download"
"github.com/kubescape/kubescape/v2/cmd/list"
"github.com/kubescape/kubescape/v2/cmd/scan"
"github.com/kubescape/kubescape/v2/cmd/submit"
"github.com/kubescape/kubescape/v2/cmd/version"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/cautils/getter"
"github.com/kubescape/kubescape/v2/core/core"
"github.com/kubescape/kubescape/v2/core/meta"
"github.com/spf13/cobra"
)
+1 -1
View File
@@ -5,9 +5,9 @@ import (
"os"
"strings"
"github.com/armosec/kubescape/v2/core/cautils/getter"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/kubescape/v2/core/cautils/getter"
"github.com/mattn/go-isatty"
)
+2 -2
View File
@@ -8,10 +8,10 @@ import (
apisv1 "github.com/kubescape/opa-utils/httpserver/apis/v1"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/armosec/kubescape/v2/core/meta"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/meta"
"github.com/enescakir/emoji"
"github.com/spf13/cobra"
+2 -2
View File
@@ -8,10 +8,10 @@ import (
apisv1 "github.com/kubescape/opa-utils/httpserver/apis/v1"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/armosec/kubescape/v2/core/meta"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/meta"
"github.com/enescakir/emoji"
"github.com/spf13/cobra"
+3 -3
View File
@@ -3,9 +3,9 @@ package scan
import (
"fmt"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/armosec/kubescape/v2/core/meta"
"github.com/kubescape/k8s-interface/k8sinterface"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/meta"
"github.com/spf13/cobra"
)
@@ -93,7 +93,7 @@ func GetScanCommand(ks meta.IKubescape) *cobra.Command {
scanCmd.PersistentFlags().MarkHidden("silent") // this flag should be deprecated since we added the --logger support
// scanCmd.PersistentFlags().MarkHidden("format-version") // meant for testing different output approaches and not for common use
hostF := scanCmd.PersistentFlags().VarPF(&scanInfo.HostSensorEnabled, "enable-host-scan", "", "Deploy ARMO K8s host-sensor daemonset in the scanned cluster. Deleting it right after we collecting the data. Required to collect valuable data from cluster nodes for certain controls. Yaml file: https://github.com/armosec/kubescape/blob/master/core/pkg/hostsensorutils/hostsensor.yaml")
hostF := scanCmd.PersistentFlags().VarPF(&scanInfo.HostSensorEnabled, "enable-host-scan", "", "Deploy ARMO K8s host-sensor daemonset in the scanned cluster. Deleting it right after we collecting the data. Required to collect valuable data from cluster nodes for certain controls. Yaml file: https://github.com/kubescape/kubescape/blob/master/core/pkg/hostsensorutils/hostsensor.yaml")
hostF.NoOptDefVal = "true"
hostF.DefValue = "false, for no TTY in stdin"
+2 -2
View File
@@ -3,9 +3,9 @@ package submit
import (
"fmt"
"github.com/armosec/kubescape/v2/core/meta"
metav1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/kubescape/v2/core/meta"
metav1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
"github.com/spf13/cobra"
)
+6 -6
View File
@@ -3,16 +3,16 @@ package submit
import (
"fmt"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/armosec/kubescape/v2/core/cautils/getter"
"github.com/armosec/kubescape/v2/core/meta"
"github.com/armosec/kubescape/v2/core/meta/cliinterfaces"
v1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
reporterv2 "github.com/armosec/kubescape/v2/core/pkg/resultshandling/reporter/v2"
"github.com/google/uuid"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/k8s-interface/k8sinterface"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/cautils/getter"
"github.com/kubescape/kubescape/v2/core/meta"
"github.com/kubescape/kubescape/v2/core/meta/cliinterfaces"
v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
reporterv2 "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/reporter/v2"
"github.com/kubescape/rbac-utils/rbacscanner"
"github.com/spf13/cobra"
+4 -4
View File
@@ -8,13 +8,13 @@ import (
"github.com/google/uuid"
reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2"
"github.com/armosec/kubescape/v2/core/meta"
"github.com/armosec/kubescape/v2/core/meta/cliinterfaces"
v1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
reporterv2 "github.com/armosec/kubescape/v2/core/pkg/resultshandling/reporter/v2"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/k8s-interface/workloadinterface"
"github.com/kubescape/kubescape/v2/core/meta"
"github.com/kubescape/kubescape/v2/core/meta/cliinterfaces"
v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
reporterv2 "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/reporter/v2"
"github.com/spf13/cobra"
)
+2 -2
View File
@@ -1,8 +1,8 @@
package submit
import (
"github.com/armosec/kubescape/v2/core/meta"
metav1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
"github.com/kubescape/kubescape/v2/core/meta"
metav1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
"github.com/spf13/cobra"
)
+1 -1
View File
@@ -4,7 +4,7 @@ import (
"fmt"
"os"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/spf13/cobra"
)
+1 -1
View File
@@ -9,9 +9,9 @@ import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"github.com/armosec/kubescape/v2/core/cautils/getter"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/k8s-interface/k8sinterface"
"github.com/kubescape/kubescape/v2/core/cautils/getter"
corev1 "k8s.io/api/core/v1"
)
+17
View File
@@ -44,6 +44,23 @@ func NewOPASessionObj(frameworks []reporthandling.Framework, k8sResources *K8SRe
}
}
func (sessionObj *OPASessionObj) SetMapNamespaceToNumberOfResources(mapNamespaceToNumberOfResources map[string]int) {
if sessionObj.Metadata.ContextMetadata.ClusterContextMetadata == nil {
sessionObj.Metadata.ContextMetadata.ClusterContextMetadata = &reporthandlingv2.ClusterMetadata{}
}
if sessionObj.Metadata.ContextMetadata.ClusterContextMetadata.MapNamespaceToNumberOfResources == nil {
sessionObj.Metadata.ContextMetadata.ClusterContextMetadata.MapNamespaceToNumberOfResources = make(map[string]int)
}
sessionObj.Metadata.ContextMetadata.ClusterContextMetadata.MapNamespaceToNumberOfResources = mapNamespaceToNumberOfResources
}
func (sessionObj *OPASessionObj) SetNumberOfWorkerNodes(n int) {
if sessionObj.Metadata.ContextMetadata.ClusterContextMetadata == nil {
sessionObj.Metadata.ContextMetadata.ClusterContextMetadata = &reporthandlingv2.ClusterMetadata{}
}
sessionObj.Metadata.ContextMetadata.ClusterContextMetadata.NumberOfWorkerNodes = n
}
func NewOPASessionObjMock() *OPASessionObj {
return &OPASessionObj{
Policies: nil,
+1 -1
View File
@@ -12,10 +12,10 @@ import (
apisv1 "github.com/kubescape/opa-utils/httpserver/apis/v1"
giturl "github.com/armosec/go-git-url"
"github.com/armosec/kubescape/v2/core/cautils/getter"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/k8s-interface/k8sinterface"
"github.com/kubescape/kubescape/v2/core/cautils/getter"
"github.com/kubescape/opa-utils/reporthandling"
reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2"
+3 -3
View File
@@ -20,7 +20,7 @@ func TestSetContextMetadata(t *testing.T) {
}
{
ctx := reporthandlingv2.ContextMetadata{}
setContextMetadata(&ctx, "https://github.com/armosec/kubescape")
setContextMetadata(&ctx, "https://github.com/kubescape/kubescape")
assert.Nil(t, ctx.ClusterContextMetadata)
assert.Nil(t, ctx.DirectoryContextMetadata)
@@ -29,7 +29,7 @@ func TestSetContextMetadata(t *testing.T) {
assert.NotNil(t, ctx.RepoContextMetadata)
assert.Equal(t, "kubescape", ctx.RepoContextMetadata.Repo)
assert.Equal(t, "armosec", ctx.RepoContextMetadata.Owner)
assert.Equal(t, "kubescape", ctx.RepoContextMetadata.Owner)
assert.Equal(t, "master", ctx.RepoContextMetadata.Branch)
}
}
@@ -40,5 +40,5 @@ func TestGetHostname(t *testing.T) {
func TestGetScanningContext(t *testing.T) {
assert.Equal(t, ContextCluster, GetScanningContext(""))
assert.Equal(t, ContextGitURL, GetScanningContext("https://github.com/armosec/kubescape"))
assert.Equal(t, ContextGitURL, GetScanningContext("https://github.com/kubescape/kubescape"))
}
+1 -1
View File
@@ -6,10 +6,10 @@ import (
"net/http"
"os"
"github.com/armosec/kubescape/v2/core/cautils/getter"
"github.com/armosec/utils-go/boolutils"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/kubescape/v2/core/cautils/getter"
"golang.org/x/mod/semver"
)
+1 -1
View File
@@ -3,7 +3,7 @@ package core
import (
"fmt"
metav1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
metav1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
)
func (ks *Kubescape) SetCachedConfig(setConfig *metav1.SetConfig) error {
+2 -2
View File
@@ -3,10 +3,10 @@ package core
import (
"fmt"
"github.com/armosec/kubescape/v2/core/cautils/getter"
v1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/kubescape/v2/core/cautils/getter"
v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
)
func (ks *Kubescape) DeleteExceptions(delExceptions *v1.DeleteExceptions) error {
+2 -2
View File
@@ -7,10 +7,10 @@ import (
"strings"
"github.com/armosec/armoapi-go/armotypes"
"github.com/armosec/kubescape/v2/core/cautils/getter"
metav1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/kubescape/v2/core/cautils/getter"
metav1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
)
var downloadFunc = map[string]func(*metav1.DownloadInfo) error{
+6 -6
View File
@@ -3,15 +3,15 @@ package core
import (
"fmt"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/armosec/kubescape/v2/core/cautils/getter"
"github.com/armosec/kubescape/v2/core/pkg/hostsensorutils"
"github.com/armosec/kubescape/v2/core/pkg/resourcehandler"
"github.com/armosec/kubescape/v2/core/pkg/resultshandling/reporter"
reporterv2 "github.com/armosec/kubescape/v2/core/pkg/resultshandling/reporter/v2"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/k8s-interface/k8sinterface"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/cautils/getter"
"github.com/kubescape/kubescape/v2/core/pkg/hostsensorutils"
"github.com/kubescape/kubescape/v2/core/pkg/resourcehandler"
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling/reporter"
reporterv2 "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/reporter/v2"
"github.com/google/uuid"
+2 -2
View File
@@ -6,8 +6,8 @@ import (
"sort"
"strings"
"github.com/armosec/kubescape/v2/core/cautils/getter"
metav1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
"github.com/kubescape/kubescape/v2/core/cautils/getter"
metav1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
)
var listFunc = map[string]func(*metav1.ListPolicies) ([]string, error){
+9 -9
View File
@@ -7,17 +7,17 @@ import (
"github.com/kubescape/k8s-interface/k8sinterface"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/armosec/kubescape/v2/core/cautils/getter"
"github.com/armosec/kubescape/v2/core/pkg/hostsensorutils"
"github.com/armosec/kubescape/v2/core/pkg/opaprocessor"
"github.com/armosec/kubescape/v2/core/pkg/policyhandler"
"github.com/armosec/kubescape/v2/core/pkg/resourcehandler"
"github.com/armosec/kubescape/v2/core/pkg/resultshandling"
"github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer"
"github.com/armosec/kubescape/v2/core/pkg/resultshandling/reporter"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/cautils/getter"
"github.com/kubescape/kubescape/v2/core/pkg/hostsensorutils"
"github.com/kubescape/kubescape/v2/core/pkg/opaprocessor"
"github.com/kubescape/kubescape/v2/core/pkg/policyhandler"
"github.com/kubescape/kubescape/v2/core/pkg/resourcehandler"
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling"
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer"
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling/reporter"
"github.com/kubescape/opa-utils/resources"
)
+3 -3
View File
@@ -1,9 +1,9 @@
package core
import (
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/armosec/kubescape/v2/core/cautils/getter"
"github.com/armosec/kubescape/v2/core/meta/cliinterfaces"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/cautils/getter"
"github.com/kubescape/kubescape/v2/core/meta/cliinterfaces"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
+2 -2
View File
@@ -1,9 +1,9 @@
package cliinterfaces
import (
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/armosec/kubescape/v2/core/pkg/resultshandling/reporter"
"github.com/kubescape/k8s-interface/workloadinterface"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling/reporter"
reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2"
)
+1 -1
View File
@@ -1,6 +1,6 @@
package v1
import "github.com/armosec/kubescape/v2/core/cautils"
import "github.com/kubescape/kubescape/v2/core/cautils"
type DeleteExceptions struct {
Credentials cautils.Credentials
+1 -1
View File
@@ -1,6 +1,6 @@
package v1
import "github.com/armosec/kubescape/v2/core/cautils"
import "github.com/kubescape/kubescape/v2/core/cautils"
type DownloadInfo struct {
Path string // directory to save artifact. Default is "~/.kubescape/"
+1 -1
View File
@@ -1,6 +1,6 @@
package v1
import "github.com/armosec/kubescape/v2/core/cautils"
import "github.com/kubescape/kubescape/v2/core/cautils"
type ListPolicies struct {
Target string
+1 -1
View File
@@ -1,6 +1,6 @@
package v1
import "github.com/armosec/kubescape/v2/core/cautils"
import "github.com/kubescape/kubescape/v2/core/cautils"
type Submit struct {
Credentials cautils.Credentials
+4 -4
View File
@@ -1,10 +1,10 @@
package meta
import (
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/armosec/kubescape/v2/core/meta/cliinterfaces"
metav1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
"github.com/armosec/kubescape/v2/core/pkg/resultshandling"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/meta/cliinterfaces"
metav1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling"
)
type IKubescape interface {
+1 -1
View File
@@ -8,11 +8,11 @@ import (
"sync"
"time"
"github.com/armosec/kubescape/v2/core/cautils"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/k8s-interface/k8sinterface"
"github.com/kubescape/k8s-interface/workloadinterface"
"github.com/kubescape/kubescape/v2/core/cautils"
appsv1 "k8s.io/api/apps/v1"
corev1 "k8s.io/api/core/v1"
+2 -2
View File
@@ -6,10 +6,10 @@ import (
"time"
"github.com/armosec/armoapi-go/armotypes"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/armosec/kubescape/v2/core/pkg/score"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/pkg/score"
"github.com/kubescape/opa-utils/objectsenvelopes"
"github.com/kubescape/opa-utils/reporthandling"
"github.com/kubescape/opa-utils/reporthandling/apis"
@@ -4,8 +4,8 @@ import (
"testing"
"github.com/armosec/armoapi-go/armotypes"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/armosec/kubescape/v2/core/mocks"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/mocks"
"github.com/kubescape/opa-utils/reporthandling"
"github.com/kubescape/opa-utils/resources"
"github.com/stretchr/testify/assert"
@@ -1,8 +1,8 @@
package opaprocessor
import (
"github.com/armosec/kubescape/v2/core/cautils"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/k8s-interface/k8sinterface"
"github.com/kubescape/k8s-interface/workloadinterface"
+1 -1
View File
@@ -1,7 +1,7 @@
package opaprocessor
import (
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/opa-utils/reporthandling"
"github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary"
)
+1 -1
View File
@@ -5,7 +5,7 @@ import (
"github.com/stretchr/testify/assert"
"github.com/armosec/kubescape/v2/core/mocks"
"github.com/kubescape/kubescape/v2/core/mocks"
"github.com/kubescape/opa-utils/reporthandling"
"github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary"
)
+2 -2
View File
@@ -4,8 +4,8 @@ import (
"fmt"
"github.com/armosec/armoapi-go/armotypes"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/armosec/kubescape/v2/core/pkg/resourcehandler"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/pkg/resourcehandler"
)
// PolicyHandler -
+2 -2
View File
@@ -6,10 +6,10 @@ import (
apisv1 "github.com/kubescape/opa-utils/httpserver/apis/v1"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/armosec/kubescape/v2/core/cautils/getter"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/cautils/getter"
"github.com/kubescape/opa-utils/reporthandling"
)
@@ -6,7 +6,7 @@ import (
apisv1 "github.com/kubescape/opa-utils/httpserver/apis/v1"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/cautils"
)
func getScanKind(policyIdentifier []cautils.PolicyIdentifier) apisv1.NotificationPolicyKind {
@@ -4,11 +4,11 @@ import (
"encoding/json"
"fmt"
"github.com/armosec/kubescape/v2/core/cautils/getter"
"github.com/armosec/kubescape/v2/core/pkg/containerscan"
"github.com/armosec/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/kubescape/v2/core/cautils/getter"
"github.com/kubescape/kubescape/v2/core/pkg/containerscan"
"github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities"
)
func NewKSAdaptor(api *getter.KSCloudAPI) *KSCivAdaptor {
@@ -3,7 +3,7 @@ package v1
import (
"testing"
"github.com/armosec/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities"
"github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities"
"github.com/stretchr/testify/assert"
)
@@ -3,8 +3,8 @@ package v1
import (
"encoding/json"
"github.com/armosec/kubescape/v2/core/pkg/containerscan"
"github.com/armosec/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities"
"github.com/kubescape/kubescape/v2/core/pkg/containerscan"
"github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities"
)
type ArmoCivAdaptorMock struct {
@@ -4,8 +4,8 @@ import (
"encoding/json"
"fmt"
"github.com/armosec/kubescape/v2/core/pkg/containerscan"
"github.com/armosec/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities"
"github.com/kubescape/kubescape/v2/core/pkg/containerscan"
"github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities"
)
func (armoCivAdaptor *KSCivAdaptor) getImageLastScanId(imageID *registryvulnerabilities.ContainerImageIdentifier) (string, error) {
@@ -3,7 +3,7 @@ package v1
import (
"time"
"github.com/armosec/kubescape/v2/core/cautils/getter"
"github.com/kubescape/kubescape/v2/core/cautils/getter"
)
type V2ListRequest struct {
+1 -1
View File
@@ -10,10 +10,10 @@ import (
"github.com/kubescape/opa-utils/reporthandling"
"k8s.io/apimachinery/pkg/version"
"github.com/armosec/kubescape/v2/core/cautils"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/k8s-interface/k8sinterface"
"github.com/kubescape/kubescape/v2/core/cautils"
)
// FileResourceHandler handle resources from files and URLs
+1 -1
View File
@@ -5,11 +5,11 @@ import (
"path/filepath"
giturl "github.com/armosec/go-git-url"
"github.com/armosec/kubescape/v2/core/cautils"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/k8s-interface/k8sinterface"
"github.com/kubescape/k8s-interface/workloadinterface"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/opa-utils/reporthandling"
)
+30 -5
View File
@@ -5,10 +5,10 @@ import (
"fmt"
"strings"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/armosec/kubescape/v2/core/pkg/hostsensorutils"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/pkg/hostsensorutils"
"github.com/kubescape/opa-utils/objectsenvelopes"
"github.com/kubescape/opa-utils/reporthandling/apis"
@@ -76,9 +76,7 @@ func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessio
if err != nil {
logger.L().Debug("failed to collect worker nodes number", helpers.Error(err))
} else {
if sessionObj.Metadata != nil && sessionObj.Metadata.ContextMetadata.ClusterContextMetadata != nil {
sessionObj.Metadata.ContextMetadata.ClusterContextMetadata.NumberOfWorkerNodes = numberOfWorkerNodes
}
sessionObj.SetNumberOfWorkerNodes(numberOfWorkerNodes)
}
imgVulnResources := cautils.MapImageVulnResources(ksResourceMap)
@@ -118,6 +116,9 @@ func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessio
}
cloudResources := cautils.MapCloudResources(ksResourceMap)
setMapNamespaceToNumOfResources(allResources, sessionObj)
// check that controls use cloud resources
if len(cloudResources) > 0 {
provider, err := getCloudProviderDescription(allResources, ksResourceMap)
@@ -147,6 +148,30 @@ func (k8sHandler *K8sResourceHandler) GetClusterAPIServerInfo() *version.Info {
return clusterAPIServerInfo
}
// set namespaceToNumOfResources map in report
func setMapNamespaceToNumOfResources(allResources map[string]workloadinterface.IMetadata, sessionObj *cautils.OPASessionObj) {
mapNamespaceToNumberOfResources := make(map[string]int)
for _, resource := range allResources {
if obj := workloadinterface.NewWorkloadObj(resource.GetObject()); obj != nil {
ownerReferences, err := obj.GetOwnerReferences()
if err == nil {
// Add an object to the map if the object does not have a parent but is contained within a namespace (except Job)
if len(ownerReferences) == 0 {
if ns := resource.GetNamespace(); ns != "" {
if obj.GetKind() != "Job" {
mapNamespaceToNumberOfResources[ns]++
}
}
}
} else {
logger.L().Warning(fmt.Sprintf("failed to get owner references. Resource %s will not be counted", obj.GetName()), helpers.Error(err))
}
}
}
sessionObj.SetMapNamespaceToNumberOfResources(mapNamespaceToNumberOfResources)
}
func (k8sHandler *K8sResourceHandler) pullResources(k8sResources *cautils.K8SResources, allResources map[string]workloadinterface.IMetadata, namespace string, labels map[string]string) error {
var errs error
File diff suppressed because one or more lines are too long
@@ -3,7 +3,7 @@ package resourcehandler
import (
"strings"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/opa-utils/reporthandling"
"k8s.io/utils/strings/slices"
@@ -1,8 +1,8 @@
package resourcehandler
import (
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/kubescape/k8s-interface/k8sinterface"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/opa-utils/reporthandling"
"github.com/stretchr/testify/assert"
+4 -4
View File
@@ -3,13 +3,13 @@ package resourcehandler
import (
"fmt"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/armosec/kubescape/v2/core/cautils/getter"
armosecadaptorv1 "github.com/armosec/kubescape/v2/core/pkg/registryadaptors/armosec/v1"
"github.com/armosec/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/k8s-interface/k8sinterface"
"github.com/kubescape/k8s-interface/workloadinterface"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/cautils/getter"
armosecadaptorv1 "github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/armosec/v1"
"github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities"
"github.com/kubescape/opa-utils/shared"
)
@@ -8,7 +8,7 @@ import (
"path/filepath"
"strings"
"github.com/armosec/kubescape/v2/core/cautils/getter"
"github.com/kubescape/kubescape/v2/core/cautils/getter"
giturls "github.com/whilp/git-urls"
"k8s.io/utils/strings/slices"
)
@@ -7,10 +7,10 @@ import (
)
var (
urlA = "https://github.com/armosec/kubescape"
urlB = "https://github.com/armosec/kubescape/blob/master/examples/online-boutique/adservice.yaml"
urlC = "https://github.com/armosec/kubescape/tree/master/examples/online-boutique"
urlD = "https://raw.githubusercontent.com/armosec/kubescape/master/examples/online-boutique/adservice.yaml"
urlA = "https://github.com/kubescape/kubescape"
urlB = "https://github.com/kubescape/kubescape/blob/master/examples/online-boutique/adservice.yaml"
urlC = "https://github.com/kubescape/kubescape/tree/master/examples/online-boutique"
urlD = "https://raw.githubusercontent.com/kubescape/kubescape/master/examples/online-boutique/adservice.yaml"
)
func TestScanRepository(t *testing.T) {
@@ -117,12 +117,12 @@ func TestGithubParse(t *testing.T) {
{
gh := NewGitHubRepository()
assert.NoError(t, gh.parse(urlA))
assert.Equal(t, "armosec/kubescape", joinOwnerNRepo(gh.owner, gh.repo))
assert.Equal(t, "kubescape/kubescape", joinOwnerNRepo(gh.owner, gh.repo))
}
{
gh := NewGitHubRepository()
assert.NoError(t, gh.parse(urlB))
assert.Equal(t, "armosec/kubescape", joinOwnerNRepo(gh.owner, gh.repo))
assert.Equal(t, "kubescape/kubescape", joinOwnerNRepo(gh.owner, gh.repo))
assert.Equal(t, "master", gh.branch)
assert.Equal(t, "examples/online-boutique/adservice.yaml", gh.path)
assert.True(t, gh.isFile)
@@ -132,7 +132,7 @@ func TestGithubParse(t *testing.T) {
{
gh := NewGitHubRepository()
assert.NoError(t, gh.parse(urlC))
assert.Equal(t, "armosec/kubescape", joinOwnerNRepo(gh.owner, gh.repo))
assert.Equal(t, "kubescape/kubescape", joinOwnerNRepo(gh.owner, gh.repo))
assert.Equal(t, "master", gh.branch)
assert.Equal(t, "examples/online-boutique", gh.path)
assert.False(t, gh.isFile)
+1 -1
View File
@@ -2,8 +2,8 @@ package resourcehandler
import (
"github.com/armosec/armoapi-go/armotypes"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/kubescape/k8s-interface/workloadinterface"
"github.com/kubescape/kubescape/v2/core/cautils"
"k8s.io/apimachinery/pkg/version"
)
+1 -1
View File
@@ -2,10 +2,10 @@ package resourcehandler
import (
giturl "github.com/armosec/go-git-url"
"github.com/armosec/kubescape/v2/core/cautils"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/k8s-interface/workloadinterface"
"github.com/kubescape/kubescape/v2/core/cautils"
)
func loadResourcesFromUrl(inputPatterns []string) (map[string][]workloadinterface.IMetadata, error) {
+8 -8
View File
@@ -8,13 +8,13 @@ import (
func TestLoadResourcesFromUrl(t *testing.T) {
{
workloads, err := loadResourcesFromUrl([]string{"https://github.com/armosec/kubescape/tree/master/examples/online-boutique"})
workloads, err := loadResourcesFromUrl([]string{"https://github.com/kubescape/kubescape/tree/master/examples/online-boutique"})
assert.NoError(t, err)
assert.Equal(t, 12, len(workloads))
for i, w := range workloads {
switch i {
case "https://raw.githubusercontent.com/armosec/kubescape/master/examples/online-boutique/adservice.yaml":
case "https://raw.githubusercontent.com/kubescape/kubescape/master/examples/online-boutique/adservice.yaml":
assert.Equal(t, 2, len(w))
assert.Equal(t, "apps/v1//Deployment/adservice", w[0].GetID())
assert.Equal(t, "/v1//Service/adservice", w[1].GetID())
@@ -22,13 +22,13 @@ func TestLoadResourcesFromUrl(t *testing.T) {
}
}
{
workloads, err := loadResourcesFromUrl([]string{"https://github.com/armosec/kubescape"})
workloads, err := loadResourcesFromUrl([]string{"https://github.com/kubescape/kubescape"})
assert.NoError(t, err)
assert.Less(t, 12, len(workloads))
for i, w := range workloads {
switch i {
case "https://raw.githubusercontent.com/armosec/kubescape/master/examples/online-boutique/adservice.yaml":
case "https://raw.githubusercontent.com/kubescape/kubescape/master/examples/online-boutique/adservice.yaml":
assert.Equal(t, 2, len(w))
assert.Equal(t, "apps/v1//Deployment/adservice", w[0].GetID())
assert.Equal(t, "/v1//Service/adservice", w[1].GetID())
@@ -36,13 +36,13 @@ func TestLoadResourcesFromUrl(t *testing.T) {
}
}
{
workloads, err := loadResourcesFromUrl([]string{"https://github.com/armosec/kubescape/blob/master/examples/online-boutique/adservice.yaml"})
workloads, err := loadResourcesFromUrl([]string{"https://github.com/kubescape/kubescape/blob/master/examples/online-boutique/adservice.yaml"})
assert.NoError(t, err)
assert.Equal(t, 1, len(workloads))
for i, w := range workloads {
switch i {
case "https://raw.githubusercontent.com/armosec/kubescape/master/examples/online-boutique/adservice.yaml":
case "https://raw.githubusercontent.com/kubescape/kubescape/master/examples/online-boutique/adservice.yaml":
assert.Equal(t, 2, len(w))
assert.Equal(t, "apps/v1//Deployment/adservice", w[0].GetID())
assert.Equal(t, "/v1//Service/adservice", w[1].GetID())
@@ -50,13 +50,13 @@ func TestLoadResourcesFromUrl(t *testing.T) {
}
}
{
workloads, err := loadResourcesFromUrl([]string{"https://raw.githubusercontent.com/armosec/kubescape/master/examples/online-boutique/adservice.yaml"})
workloads, err := loadResourcesFromUrl([]string{"https://raw.githubusercontent.com/kubescape/kubescape/master/examples/online-boutique/adservice.yaml"})
assert.NoError(t, err)
assert.Equal(t, 1, len(workloads))
for i, w := range workloads {
switch i {
case "https://raw.githubusercontent.com/armosec/kubescape/master/examples/online-boutique/adservice.yaml":
case "https://raw.githubusercontent.com/kubescape/kubescape/master/examples/online-boutique/adservice.yaml":
assert.Equal(t, 2, len(w))
assert.Equal(t, "apps/v1//Deployment/adservice", w[0].GetID())
assert.Equal(t, "/v1//Service/adservice", w[1].GetID())
@@ -5,8 +5,8 @@ import (
"os"
"path/filepath"
"github.com/armosec/kubescape/v2/core/cautils"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/kubescape/v2/core/cautils"
)
var INDENT = " "
@@ -5,9 +5,9 @@ import (
"fmt"
"os"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer"
)
type JsonPrinter struct {
@@ -4,10 +4,10 @@ import (
"fmt"
"os"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/k8s-interface/workloadinterface"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer"
"github.com/kubescape/opa-utils/reporthandling"
)
@@ -4,8 +4,8 @@ import (
"fmt"
"sort"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/fatih/color"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/opa-utils/reporthandling/apis"
"github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary"
"github.com/olekukonko/tablewriter"
@@ -69,7 +69,7 @@
}
</style>
<body>
<img class="logo" src="https://raw.githubusercontent.com/armosec/kubescape/master/core/pkg/resultshandling/printer/v2/pdf/logo.png">
<img class="logo" src="https://raw.githubusercontent.com/kubescape/kubescape/master/core/pkg/resultshandling/printer/v2/pdf/logo.png">
<h1>Kubescape Scan Report</h1>
{{ with .OPASessionObj.Report.SummaryDetails }}
<h2>By Controls</h2>
@@ -8,10 +8,10 @@ import (
"sort"
"strings"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer"
"github.com/kubescape/opa-utils/reporthandling/apis"
"github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary"
"github.com/kubescape/opa-utils/reporthandling/results/v1/resourcesresults"
@@ -5,10 +5,10 @@ import (
"fmt"
"os"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer"
)
type JsonPrinter struct {
+2 -3
View File
@@ -7,11 +7,11 @@ import (
"sort"
"strings"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/k8s-interface/workloadinterface"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer"
"github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary"
"github.com/kubescape/opa-utils/shared"
)
@@ -19,7 +19,6 @@ import (
/*
riskScore
status
*/
type JunitPrinter struct {
writer *os.File
+2 -2
View File
@@ -9,10 +9,10 @@ import (
"strings"
"time"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer"
"github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary"
"github.com/johnfercher/maroto/pkg/color"
@@ -6,10 +6,10 @@ import (
"sort"
"strings"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer"
"github.com/enescakir/emoji"
"github.com/kubescape/k8s-interface/workloadinterface"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer"
"github.com/kubescape/opa-utils/objectsenvelopes"
"github.com/kubescape/opa-utils/reporthandling/apis"
helpersv1 "github.com/kubescape/opa-utils/reporthandling/helpers/v1"
@@ -4,11 +4,11 @@ import (
"fmt"
"os"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/k8s-interface/workloadinterface"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer"
"github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary"
"github.com/kubescape/opa-utils/reporthandling/results/v1/resourcesresults"
)
@@ -4,8 +4,8 @@ import (
"fmt"
"strings"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/kubescape/k8s-interface/workloadinterface"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/opa-utils/reporthandling/apis"
"github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary"
"github.com/kubescape/opa-utils/reporthandling/results/v1/resourcesresults"
@@ -5,7 +5,7 @@ import (
"sort"
"strings"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary"
"github.com/kubescape/opa-utils/reporthandling/results/v1/resourcesresults"
"github.com/olekukonko/tablewriter"
@@ -1,7 +1,7 @@
package v2
import (
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/cautils"
)
type SilentPrinter struct {
+1 -1
View File
@@ -1,10 +1,10 @@
package v2
import (
"github.com/armosec/kubescape/v2/core/cautils"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/k8s-interface/workloadinterface"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/opa-utils/reporthandling"
"github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary"
"github.com/kubescape/opa-utils/reporthandling/results/v1/resourcesresults"
@@ -1,6 +1,6 @@
package reporter
import "github.com/armosec/kubescape/v2/core/cautils"
import "github.com/kubescape/kubescape/v2/core/cautils"
type IReport interface {
Submit(opaSessionObj *cautils.OPASessionObj) error
@@ -4,8 +4,8 @@ import (
"fmt"
"os"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/armosec/kubescape/v2/core/cautils/getter"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/cautils/getter"
)
const NO_SUBMIT_QUERY = "utm_source=GitHub&utm_medium=CLI&utm_campaign=no_submit"
@@ -8,11 +8,11 @@ import (
"os"
"github.com/armosec/armoapi-go/apis"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/armosec/kubescape/v2/core/cautils/getter"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/k8s-interface/workloadinterface"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/cautils/getter"
"github.com/kubescape/opa-utils/reporthandling"
"github.com/kubescape/opa-utils/reporthandling/results/v1/resourcesresults"
reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2"
@@ -4,7 +4,7 @@ import (
"net/url"
"testing"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/stretchr/testify/assert"
)
@@ -3,9 +3,9 @@ package v2
import (
"net/url"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/armosec/kubescape/v2/core/cautils/getter"
"github.com/google/uuid"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/cautils/getter"
reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2"
)
+5 -5
View File
@@ -3,13 +3,13 @@ package resultshandling
import (
"encoding/json"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer"
printerv1 "github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer/v1"
printerv2 "github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer/v2"
"github.com/armosec/kubescape/v2/core/pkg/resultshandling/reporter"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer"
printerv1 "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer/v1"
printerv2 "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer/v2"
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling/reporter"
reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2"
)
+5 -2
View File
@@ -5,11 +5,14 @@ import (
"github.com/kubescape/opa-utils/score"
"github.com/armosec/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/cautils"
)
/* provides a wrapper for scoreUtils, since there's no common interface between postureReportV1 and PostureReportV2
/*
provides a wrapper for scoreUtils, since there's no common interface between postureReportV1 and PostureReportV2
and the need of concrete objects
I've decided to create scoreWrapper that will allow calculating score regardless (as long as opaSessionObj is there)
*/
type ScoreWrapper struct {
+2 -2
View File
@@ -8,7 +8,7 @@
# Set environment variables
echo 'Set environment variables'
export kubescape_namespace=armo-system
export kubescape_namespace=kubescape
export kubescape_serviceaccount=armo-kubescape-service-account
# Get current context
@@ -65,4 +65,4 @@ eksctl create iamserviceaccount \
# Install/Upgrade Kubescape chart
echo 'Install/Upgrade Kubescape chart'
helm upgrade --install armo armo-components/ -n armo-system --create-namespace --set clusterName=$cluster_name --set cloud_provider_engine=eks --set createKubescapeServiceAccount=false --set cloudRegion=$cluster_region
helm upgrade --install armo armo-components/ -n kubescape --create-namespace --set clusterName=$cluster_name --set cloud_provider_engine=eks --set createKubescapeServiceAccount=false --set cloudRegion=$cluster_region
+2 -2
View File
@@ -17,7 +17,7 @@ gcloud iam service-accounts create kubescape --display-name=kubescape
# Set environment variables
echo 'Set environment variables'
export kubescape_namespace=armo-system
export kubescape_namespace=kubescape
export kubescape_serviceaccount=armo-kubescape-service-account
# Get current GCP project
@@ -46,4 +46,4 @@ gcloud iam service-accounts add-iam-policy-binding $gcp_service_account --role r
# Install/Upgrade Kubescape chart
echo 'Install/Upgrade Kubescape chart'
helm upgrade --install armo armo-components/ -n armo-system --create-namespace --set cloud_provider_engine=gke --set gke_service_account=$gcp_service_account --set cloudRegion=$CLUSTER_REGION --set clusterName=$CLUSTER_NAME --set gkeProject=$gcp_project
helm upgrade --install armo armo-components/ -n kubescape --create-namespace --set cloud_provider_engine=gke --set gke_service_account=$gcp_service_account --set cloudRegion=$CLUSTER_REGION --set clusterName=$CLUSTER_NAME --set gkeProject=$gcp_project
+1 -1
View File
@@ -24,7 +24,7 @@ e.g. When a `kube-system` resource fails and it is ok, simply add the resource t
* `controlID` - Control ID can be find [here](https://github.com/armosec/regolibrary/tree/master/controls) (regex supported)
* `ruleName` - Rule names can be find [here](https://github.com/armosec/regolibrary/tree/master/rules) (regex supported)
You can find [here](https://github.com/armosec/kubescape/tree/master/examples/exceptions) some examples of exceptions files
You can find [here](https://github.com/kubescape/kubescape/tree/master/examples/exceptions) some examples of exceptions files
## Usage
File diff suppressed because it is too large Load Diff
+65 -65
View File
@@ -17,9 +17,9 @@ kubescape_object_failed_count{framework="NSA",control="Immutable container files
# Failed object from "NSA" control "Immutable container filesystem"
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "NSA" control "Immutable container filesystem"
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "NSA" control "Immutable container filesystem"
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "NSA" control "Immutable container filesystem"
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="cyberarmor-system",name="ca-dashboard-aggregator",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "NSA" control "Immutable container filesystem"
@@ -43,9 +43,9 @@ kubescape_object_failed_count{framework="NSA",control="Immutable container files
# Failed object from "NSA" control "Immutable container filesystem"
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1
# Failed object from "NSA" control "Immutable container filesystem"
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
# Failed object from "NSA" control "Immutable container filesystem"
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
# Number of resources found as part of NSA control Privileged container
kubescape_resources_found_count{framework="NSA",control="Privileged container"} 22
# Number of resources excluded as part of NSA control Privileged container
@@ -67,7 +67,7 @@ kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespa
# Failed object from "NSA" control "Allowed hostPath"
kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1/Pod"} 1
# Failed object from "NSA" control "Allowed hostPath"
kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "NSA" control "Allowed hostPath"
kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespace="cyberarmor-system",name="ca-websocket",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "NSA" control "Allowed hostPath"
@@ -157,11 +157,11 @@ kubescape_object_failed_count{framework="NSA",control="Automatic mapping of serv
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="v1/ServiceAccount"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="armo-system",name="armo-kubescape-service-account",groupVersionKind="v1/ServiceAccount"} 1
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kubescape",name="armo-kubescape-service-account",groupVersionKind="v1/ServiceAccount"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="armo-system",name="armo-scanner-service-account",groupVersionKind="v1/ServiceAccount"} 1
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kubescape",name="armo-scanner-service-account",groupVersionKind="v1/ServiceAccount"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="armo-system",name="default",groupVersionKind="v1/ServiceAccount"} 1
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kubescape",name="default",groupVersionKind="v1/ServiceAccount"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="cyberarmor-system",name="ca-controller-service-account",groupVersionKind="v1/ServiceAccount"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
@@ -199,9 +199,9 @@ kubescape_resources_excluded_count{framework="NSA",control="Resource policies"}
# Number of resources failed as part of NSA control Resource policies
kubescape_resources_failed_count{framework="NSA",control="Resource policies"} 9
# Failed object from "NSA" control "Resource policies"
kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
# Failed object from "NSA" control "Resource policies"
kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
# Failed object from "NSA" control "Resource policies"
kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="kube-system",name="kube-apiserver-david-virtualbox",groupVersionKind="v1/Pod"} 1
# Failed object from "NSA" control "Resource policies"
@@ -233,9 +233,9 @@ kubescape_object_failed_count{framework="NSA",control="Allow privilege escalatio
# Failed object from "NSA" control "Allow privilege escalation"
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kube-system",name="etcd-david-virtualbox",groupVersionKind="v1/Pod"} 1
# Failed object from "NSA" control "Allow privilege escalation"
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "NSA" control "Allow privilege escalation"
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "NSA" control "Allow privilege escalation"
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="cyberarmor-system",name="ca-audit",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "NSA" control "Allow privilege escalation"
@@ -261,9 +261,9 @@ kubescape_object_failed_count{framework="NSA",control="Allow privilege escalatio
# Failed object from "NSA" control "Allow privilege escalation"
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1
# Failed object from "NSA" control "Allow privilege escalation"
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
# Failed object from "NSA" control "Allow privilege escalation"
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
# Number of resources found as part of NSA control Applications credentials in configuration files
kubescape_resources_found_count{framework="NSA",control="Applications credentials in configuration files"} 44
# Number of resources excluded as part of NSA control Applications credentials in configuration files
@@ -271,7 +271,7 @@ kubescape_resources_excluded_count{framework="NSA",control="Applications credent
# Number of resources failed as part of NSA control Applications credentials in configuration files
kubescape_resources_failed_count{framework="NSA",control="Applications credentials in configuration files"} 8
# Failed object from "NSA" control "Applications credentials in configuration files"
kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="armo-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1
kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="kubescape",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1
# Failed object from "NSA" control "Applications credentials in configuration files"
kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="cyberarmor-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1
# Failed object from "NSA" control "Applications credentials in configuration files"
@@ -331,9 +331,9 @@ kubescape_resources_failed_count{framework="NSA",control="Linux hardening"} 17
# Failed object from "NSA" control "Linux hardening"
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1/Pod"} 1
# Failed object from "NSA" control "Linux hardening"
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "NSA" control "Linux hardening"
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "NSA" control "Linux hardening"
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="cyberarmor-system",name="ca-posture",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "NSA" control "Linux hardening"
@@ -359,9 +359,9 @@ kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespac
# Failed object from "NSA" control "Linux hardening"
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1
# Failed object from "NSA" control "Linux hardening"
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
# Failed object from "NSA" control "Linux hardening"
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
# Number of resources found as part of NSA control Ingress and Egress blocked
kubescape_resources_found_count{framework="NSA",control="Ingress and Egress blocked"} 22
# Number of resources excluded as part of NSA control Ingress and Egress blocked
@@ -379,9 +379,9 @@ kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocke
# Failed object from "NSA" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1/Pod"} 1
# Failed object from "NSA" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "NSA" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "NSA" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="cyberarmor-system",name="ca-rbac",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "NSA" control "Ingress and Egress blocked"
@@ -409,9 +409,9 @@ kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocke
# Failed object from "NSA" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1
# Failed object from "NSA" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
# Failed object from "NSA" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
# Number of resources found as part of NSA control Network policies
kubescape_resources_found_count{framework="NSA",control="Network policies"} 7
# Number of resources excluded as part of NSA control Network policies
@@ -429,7 +429,7 @@ kubescape_object_failed_count{framework="NSA",control="Network policies",name="k
# Failed object from "NSA" control "Network policies"
kubescape_object_failed_count{framework="NSA",control="Network policies",name="nginx-ingress",groupVersionKind="v1/Namespace"} 1
# Failed object from "NSA" control "Network policies"
kubescape_object_failed_count{framework="NSA",control="Network policies",name="armo-system",groupVersionKind="v1/Namespace"} 1
kubescape_object_failed_count{framework="NSA",control="Network policies",name="kubescape",groupVersionKind="v1/Namespace"} 1
# Failed object from "NSA" control "Network policies"
kubescape_object_failed_count{framework="NSA",control="Network policies",name="cyberarmor-system",groupVersionKind="v1/Namespace"} 1
# Number of resources found as part of NSA control CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability
@@ -449,7 +449,7 @@ kubescape_resources_failed_count{framework="MITRE",control="Access container ser
# Failed object from "MITRE" control "Access container service account"
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1
# Failed object from "MITRE" control "Access container service account"
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
# Failed object from "MITRE" control "Access container service account"
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="kube-system",name="system:persistent-volume-provisioner",groupVersionKind="rbac.authorization.k8s.io/v1/RoleBinding"} 1
# Failed object from "MITRE" control "Access container service account"
@@ -505,9 +505,9 @@ kubescape_object_failed_count{framework="MITRE",control="Access container servic
# Failed object from "MITRE" control "Access container service account"
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "MITRE" control "Access container service account"
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "MITRE" control "Access container service account"
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
# Number of resources found as part of MITRE control Applications credentials in configuration files
kubescape_resources_found_count{framework="MITRE",control="Applications credentials in configuration files"} 44
# Number of resources excluded as part of MITRE control Applications credentials in configuration files
@@ -521,7 +521,7 @@ kubescape_object_failed_count{framework="MITRE",control="Applications credential
# Failed object from "MITRE" control "Applications credentials in configuration files"
kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="kube-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1
# Failed object from "MITRE" control "Applications credentials in configuration files"
kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="armo-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1
kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="kubescape",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1
# Failed object from "MITRE" control "Applications credentials in configuration files"
kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="cyberarmor-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1
# Failed object from "MITRE" control "Applications credentials in configuration files"
@@ -551,7 +551,7 @@ kubescape_resources_excluded_count{framework="MITRE",control="Cluster internal n
# Number of resources failed as part of MITRE control Cluster internal networking
kubescape_resources_failed_count{framework="MITRE",control="Cluster internal networking"} 7
# Failed object from "MITRE" control "Cluster internal networking"
kubescape_object_failed_count{framework="MITRE",control="Cluster internal networking",name="armo-system",groupVersionKind="v1/Namespace"} 1
kubescape_object_failed_count{framework="MITRE",control="Cluster internal networking",name="kubescape",groupVersionKind="v1/Namespace"} 1
# Failed object from "MITRE" control "Cluster internal networking"
kubescape_object_failed_count{framework="MITRE",control="Cluster internal networking",name="cyberarmor-system",groupVersionKind="v1/Namespace"} 1
# Failed object from "MITRE" control "Cluster internal networking"
@@ -593,7 +593,7 @@ kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespa
# Failed object from "MITRE" control "hostPath mount"
kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="kube-system",name="kube-scheduler-david-virtualbox",groupVersionKind="v1/Pod"} 1
# Failed object from "MITRE" control "hostPath mount"
kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "MITRE" control "hostPath mount"
kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="cyberarmor-system",name="ca-webhook",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "MITRE" control "hostPath mount"
@@ -605,9 +605,9 @@ kubescape_resources_excluded_count{framework="MITRE",control="Kubernetes CronJob
# Number of resources failed as part of MITRE control Kubernetes CronJob
kubescape_resources_failed_count{framework="MITRE",control="Kubernetes CronJob"} 2
# Failed object from "MITRE" control "Kubernetes CronJob"
kubescape_object_failed_count{framework="MITRE",control="Kubernetes CronJob",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
kubescape_object_failed_count{framework="MITRE",control="Kubernetes CronJob",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
# Failed object from "MITRE" control "Kubernetes CronJob"
kubescape_object_failed_count{framework="MITRE",control="Kubernetes CronJob",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
kubescape_object_failed_count{framework="MITRE",control="Kubernetes CronJob",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
# Number of resources found as part of MITRE control List Kubernetes secrets
kubescape_resources_found_count{framework="MITRE",control="List Kubernetes secrets"} 74
# Number of resources excluded as part of MITRE control List Kubernetes secrets
@@ -617,9 +617,9 @@ kubescape_resources_failed_count{framework="MITRE",control="List Kubernetes secr
# Failed object from "MITRE" control "List Kubernetes secrets"
kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="/ServiceAccount"} 1
# Failed object from "MITRE" control "List Kubernetes secrets"
kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="armo-system",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1
kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="kubescape",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1
# Failed object from "MITRE" control "List Kubernetes secrets"
kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="armo-system",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1
kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="kubescape",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1
# Failed object from "MITRE" control "List Kubernetes secrets"
kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="cyberarmor-system",name="ca-controller-service-account",groupVersionKind="/ServiceAccount"} 1
# Failed object from "MITRE" control "List Kubernetes secrets"
@@ -661,7 +661,7 @@ kubescape_object_failed_count{framework="MITRE",control="Mount service principal
# Failed object from "MITRE" control "Mount service principal"
kubescape_object_failed_count{framework="MITRE",control="Mount service principal",namespace="cyberarmor-system",name="ca-websocket",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "MITRE" control "Mount service principal"
kubescape_object_failed_count{framework="MITRE",control="Mount service principal",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
kubescape_object_failed_count{framework="MITRE",control="Mount service principal",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
# Number of resources found as part of MITRE control Network mapping
kubescape_resources_found_count{framework="MITRE",control="Network mapping"} 7
# Number of resources excluded as part of MITRE control Network mapping
@@ -669,7 +669,7 @@ kubescape_resources_excluded_count{framework="MITRE",control="Network mapping"}
# Number of resources failed as part of MITRE control Network mapping
kubescape_resources_failed_count{framework="MITRE",control="Network mapping"} 7
# Failed object from "MITRE" control "Network mapping"
kubescape_object_failed_count{framework="MITRE",control="Network mapping",name="armo-system",groupVersionKind="v1/Namespace"} 1
kubescape_object_failed_count{framework="MITRE",control="Network mapping",name="kubescape",groupVersionKind="v1/Namespace"} 1
# Failed object from "MITRE" control "Network mapping"
kubescape_object_failed_count{framework="MITRE",control="Network mapping",name="cyberarmor-system",groupVersionKind="v1/Namespace"} 1
# Failed object from "MITRE" control "Network mapping"
@@ -705,7 +705,7 @@ kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount
# Failed object from "MITRE" control "Writable hostPath mount"
kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="kube-system",name="kube-controller-manager-david-virtualbox",groupVersionKind="v1/Pod"} 1
# Failed object from "MITRE" control "Writable hostPath mount"
kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "MITRE" control "Writable hostPath mount"
kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="cyberarmor-system",name="ca-webhook",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "MITRE" control "Writable hostPath mount"
@@ -855,15 +855,15 @@ kubescape_object_failed_count{framework="ArmoBest",control="Immutable container
# Failed object from "ArmoBest" control "Immutable container filesystem"
kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "ArmoBest" control "Immutable container filesystem"
kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "ArmoBest" control "Immutable container filesystem"
kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "ArmoBest" control "Immutable container filesystem"
kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1
# Failed object from "ArmoBest" control "Immutable container filesystem"
kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
# Failed object from "ArmoBest" control "Immutable container filesystem"
kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
# Number of resources found as part of ArmoBest control Privileged container
kubescape_resources_found_count{framework="ArmoBest",control="Privileged container"} 22
# Number of resources excluded as part of ArmoBest control Privileged container
@@ -887,7 +887,7 @@ kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",na
# Failed object from "ArmoBest" control "Allowed hostPath"
kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1/Pod"} 1
# Failed object from "ArmoBest" control "Allowed hostPath"
kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "ArmoBest" control "Allowed hostPath"
kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",namespace="cyberarmor-system",name="ca-webhook",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "ArmoBest" control "Allowed hostPath"
@@ -979,11 +979,11 @@ kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of
# Failed object from "ArmoBest" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="v1/ServiceAccount"} 1
# Failed object from "ArmoBest" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="armo-system",name="armo-kubescape-service-account",groupVersionKind="v1/ServiceAccount"} 1
kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="kubescape",name="armo-kubescape-service-account",groupVersionKind="v1/ServiceAccount"} 1
# Failed object from "ArmoBest" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="armo-system",name="armo-scanner-service-account",groupVersionKind="v1/ServiceAccount"} 1
kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="kubescape",name="armo-scanner-service-account",groupVersionKind="v1/ServiceAccount"} 1
# Failed object from "ArmoBest" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="armo-system",name="default",groupVersionKind="v1/ServiceAccount"} 1
kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="kubescape",name="default",groupVersionKind="v1/ServiceAccount"} 1
# Failed object from "ArmoBest" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="cyberarmor-system",name="default",groupVersionKind="v1/ServiceAccount"} 1
# Failed object from "ArmoBest" control "Automatic mapping of service account"
@@ -1019,9 +1019,9 @@ kubescape_resources_failed_count{framework="ArmoBest",control="Resource policies
# Failed object from "ArmoBest" control "Resource policies"
kubescape_object_failed_count{framework="ArmoBest",control="Resource policies",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1
# Failed object from "ArmoBest" control "Resource policies"
kubescape_object_failed_count{framework="ArmoBest",control="Resource policies",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
kubescape_object_failed_count{framework="ArmoBest",control="Resource policies",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
# Failed object from "ArmoBest" control "Resource policies"
kubescape_object_failed_count{framework="ArmoBest",control="Resource policies",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
kubescape_object_failed_count{framework="ArmoBest",control="Resource policies",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
# Failed object from "ArmoBest" control "Resource policies"
kubescape_object_failed_count{framework="ArmoBest",control="Resource policies",namespace="kube-system",name="etcd-david-virtualbox",groupVersionKind="v1/Pod"} 1
# Failed object from "ArmoBest" control "Resource policies"
@@ -1051,9 +1051,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege esca
# Failed object from "ArmoBest" control "Allow privilege escalation"
kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1/Pod"} 1
# Failed object from "ArmoBest" control "Allow privilege escalation"
kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "ArmoBest" control "Allow privilege escalation"
kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "ArmoBest" control "Allow privilege escalation"
kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="cyberarmor-system",name="ca-webhook",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "ArmoBest" control "Allow privilege escalation"
@@ -1079,9 +1079,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege esca
# Failed object from "ArmoBest" control "Allow privilege escalation"
kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1
# Failed object from "ArmoBest" control "Allow privilege escalation"
kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
# Failed object from "ArmoBest" control "Allow privilege escalation"
kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
# Number of resources found as part of ArmoBest control Applications credentials in configuration files
kubescape_resources_found_count{framework="ArmoBest",control="Applications credentials in configuration files"} 44
# Number of resources excluded as part of ArmoBest control Applications credentials in configuration files
@@ -1089,7 +1089,7 @@ kubescape_resources_excluded_count{framework="ArmoBest",control="Applications cr
# Number of resources failed as part of ArmoBest control Applications credentials in configuration files
kubescape_resources_failed_count{framework="ArmoBest",control="Applications credentials in configuration files"} 8
# Failed object from "ArmoBest" control "Applications credentials in configuration files"
kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="armo-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1
kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="kubescape",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1
# Failed object from "ArmoBest" control "Applications credentials in configuration files"
kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="cyberarmor-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1
# Failed object from "ArmoBest" control "Applications credentials in configuration files"
@@ -1149,9 +1149,9 @@ kubescape_resources_failed_count{framework="ArmoBest",control="Linux hardening"}
# Failed object from "ArmoBest" control "Linux hardening"
kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1/Pod"} 1
# Failed object from "ArmoBest" control "Linux hardening"
kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "ArmoBest" control "Linux hardening"
kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "ArmoBest" control "Linux hardening"
kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="cyberarmor-system",name="ca-audit",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "ArmoBest" control "Linux hardening"
@@ -1177,9 +1177,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",nam
# Failed object from "ArmoBest" control "Linux hardening"
kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1
# Failed object from "ArmoBest" control "Linux hardening"
kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
# Failed object from "ArmoBest" control "Linux hardening"
kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
# Number of resources found as part of ArmoBest control Ingress and Egress blocked
kubescape_resources_found_count{framework="ArmoBest",control="Ingress and Egress blocked"} 22
# Number of resources excluded as part of ArmoBest control Ingress and Egress blocked
@@ -1187,9 +1187,9 @@ kubescape_resources_excluded_count{framework="ArmoBest",control="Ingress and Egr
# Number of resources failed as part of ArmoBest control Ingress and Egress blocked
kubescape_resources_failed_count{framework="ArmoBest",control="Ingress and Egress blocked"} 22
# Failed object from "ArmoBest" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "ArmoBest" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "ArmoBest" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="cyberarmor-system",name="ca-notification-server",groupVersionKind="apps/v1/Deployment"} 1
# Failed object from "ArmoBest" control "Ingress and Egress blocked"
@@ -1217,9 +1217,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress b
# Failed object from "ArmoBest" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1
# Failed object from "ArmoBest" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
# Failed object from "ArmoBest" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
# Failed object from "ArmoBest" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="kube-system",name="kube-scheduler-david-virtualbox",groupVersionKind="v1/Pod"} 1
# Failed object from "ArmoBest" control "Ingress and Egress blocked"
@@ -1237,7 +1237,7 @@ kubescape_resources_excluded_count{framework="ArmoBest",control="Network policie
# Number of resources failed as part of ArmoBest control Network policies
kubescape_resources_failed_count{framework="ArmoBest",control="Network policies"} 7
# Failed object from "ArmoBest" control "Network policies"
kubescape_object_failed_count{framework="ArmoBest",control="Network policies",name="armo-system",groupVersionKind="v1/Namespace"} 1
kubescape_object_failed_count{framework="ArmoBest",control="Network policies",name="kubescape",groupVersionKind="v1/Namespace"} 1
# Failed object from "ArmoBest" control "Network policies"
kubescape_object_failed_count{framework="ArmoBest",control="Network policies",name="cyberarmor-system",groupVersionKind="v1/Namespace"} 1
# Failed object from "ArmoBest" control "Network policies"
@@ -1289,9 +1289,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Portforwarding privi
# Failed object from "ArmoBest" control "Portforwarding privileges"
kubescape_object_failed_count{framework="ArmoBest",control="Portforwarding privileges",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="/ServiceAccount"} 1
# Failed object from "ArmoBest" control "Portforwarding privileges"
kubescape_object_failed_count{framework="ArmoBest",control="Portforwarding privileges",namespace="armo-system",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1
kubescape_object_failed_count{framework="ArmoBest",control="Portforwarding privileges",namespace="kubescape",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1
# Failed object from "ArmoBest" control "Portforwarding privileges"
kubescape_object_failed_count{framework="ArmoBest",control="Portforwarding privileges",namespace="armo-system",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1
kubescape_object_failed_count{framework="ArmoBest",control="Portforwarding privileges",namespace="kubescape",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1
# Failed object from "ArmoBest" control "Portforwarding privileges"
kubescape_object_failed_count{framework="ArmoBest",control="Portforwarding privileges",name="system:masters",groupVersionKind="rbac.authorization.k8s.io/Group"} 1
# Number of resources found as part of ArmoBest control Image pull policy on latest image tag
@@ -1301,9 +1301,9 @@ kubescape_resources_excluded_count{framework="ArmoBest",control="Image pull poli
# Number of resources failed as part of ArmoBest control Image pull policy on latest image tag
kubescape_resources_failed_count{framework="ArmoBest",control="Image pull policy on latest image tag"} 2
# Failed object from "ArmoBest" control "Image pull policy on latest image tag"
kubescape_object_failed_count{framework="ArmoBest",control="Image pull policy on latest image tag",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
kubescape_object_failed_count{framework="ArmoBest",control="Image pull policy on latest image tag",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
# Failed object from "ArmoBest" control "Image pull policy on latest image tag"
kubescape_object_failed_count{framework="ArmoBest",control="Image pull policy on latest image tag",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
kubescape_object_failed_count{framework="ArmoBest",control="Image pull policy on latest image tag",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
# Number of resources found as part of ArmoBest control Namespace without service accounts
kubescape_resources_found_count{framework="ArmoBest",control="Namespace without service accounts"} 54
# Number of resources excluded as part of ArmoBest control Namespace without service accounts
+1 -1
View File
@@ -1,4 +1,4 @@
module github.com/armosec/kubescape/v2
module github.com/kubescape/kubescape/v2
go 1.18
+1 -1
View File
@@ -149,7 +149,7 @@ curl --header "Content-Type: application/json" --request POST --data '{"hostScan
```bash
curl --header "Content-Type: application/json" \
--request POST \
--data '{"hostScanner":true, "submit":true, "includeNamespaces": ["ks-scanner"], "targetType": "framework", "targetNames": ["nsa"] }' \
--data '{"hostScanner":true, "submit":true, "includeNamespaces": ["kubescape"], "targetType": "framework", "targetNames": ["nsa"] }' \
http://127.0.0.1:8080/v1/scan
```
+2 -2
View File
@@ -4,7 +4,7 @@ import hashlib
import platform
import subprocess
BASE_GETTER_CONST = "github.com/armosec/kubescape/v2/core/cautils/getter"
BASE_GETTER_CONST = "github.com/kubescape/kubescape/v2/core/cautils/getter"
def checkStatus(status, msg):
if status != 0:
@@ -36,7 +36,7 @@ def main():
# Set some variables
packageName = getPackageName()
buildUrl = "github.com/armosec/kubescape/v2/core/cautils.BuildNumber"
buildUrl = "github.com/kubescape/kubescape/v2/core/cautils.BuildNumber"
releaseVersion = os.getenv("RELEASE")
# Create build directory
+1 -1
View File
@@ -20,7 +20,7 @@ definitions:
Same as `kubescape scan --excluded-namespaces`.
example:
- armo-system
- kubescape
- kube-system
items:
type: string
@@ -4,7 +4,7 @@ kind: Namespace
metadata:
labels:
app: kubescape
name: ks-scanner
name: kubescape
---
# ------------------- Kubescape Service Account ------------------- #
apiVersion: v1
@@ -13,7 +13,7 @@ metadata:
labels:
app: kubescape
name: kubescape-discovery
namespace: ks-scanner
namespace: kubescape
---
# ------------------- Kubescape Cluster Role & Cluster Role Binding ------------------- #
kind: ClusterRole
@@ -38,13 +38,13 @@ roleRef:
subjects:
- kind: ServiceAccount
name: kubescape-discovery
namespace: ks-scanner
namespace: kubescape
---
apiVersion: v1
kind: Service
metadata:
name: kubescape
namespace: ks-scanner
namespace: kubescape
labels:
app: kubescape
spec:
@@ -61,7 +61,7 @@ apiVersion: apps/v1
kind: Deployment
metadata:
name: kubescape
namespace: ks-scanner
namespace: kubescape
labels:
app: kubescape
spec:
@@ -89,7 +89,7 @@ spec:
port: 8080
initialDelaySeconds: 3
periodSeconds: 3
image: quay.io/armosec/kubescape:latest
image: quay.io/kubescape/kubescape:latest
imagePullPolicy: Always
env:
- name: KS_DEFAULT_CONFIGMAP_NAMESPACE

Some files were not shown because too many files have changed in this diff Show More