mirror of
https://github.com/kubescape/kubescape.git
synced 2026-04-15 06:58:11 +00:00
Merge branch 'dev' into dev
This commit is contained in:
@@ -96,10 +96,6 @@ jobs:
|
||||
env:
|
||||
RELEASE: v2.0.${{ github.run_number }}
|
||||
CLIENT: release
|
||||
ArmoBEServer: api.armo.cloud
|
||||
ArmoAuthServer: auth.armo.cloud
|
||||
ArmoERServer: report.armo.cloud
|
||||
ArmoWebsite: portal.armo.cloud
|
||||
CGO_ENABLED: 1
|
||||
run: python3 --version && python3 build.py
|
||||
|
||||
@@ -134,7 +130,7 @@ jobs:
|
||||
name: Build docker container, tag and upload to registry
|
||||
needs: build
|
||||
runs-on: ubuntu-latest
|
||||
if: ${{ github.repository == 'armosec/kubescape' }} # TODO
|
||||
if: ${{ github.repository == 'kubescape/kubescape' }} # TODO
|
||||
permissions:
|
||||
id-token: write
|
||||
packages: write
|
||||
|
||||
@@ -88,10 +88,6 @@ jobs:
|
||||
env:
|
||||
RELEASE: v2.0.${{ github.run_number }}
|
||||
CLIENT: release-dev
|
||||
ArmoBEServer: api.armo.cloud
|
||||
ArmoAuthServer: auth.armo.cloud
|
||||
ArmoERServer: report.armo.cloud
|
||||
ArmoWebsite: portal.armo.cloud
|
||||
CGO_ENABLED: 1
|
||||
run: python3 --version && python3 build.py
|
||||
|
||||
@@ -110,7 +106,7 @@ jobs:
|
||||
build-docker:
|
||||
name: Build docker container, tag and upload to registry
|
||||
needs: build
|
||||
if: ${{ github.repository == 'armosec/kubescape' }} # TODO
|
||||
if: ${{ github.repository == 'kubescape/kubescape' }} # TODO
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
id-token: write
|
||||
|
||||
@@ -81,10 +81,6 @@ jobs:
|
||||
env:
|
||||
RELEASE: v2.0.${{ github.run_number }}
|
||||
CLIENT: test
|
||||
ArmoBEServer: api.armo.cloud
|
||||
ArmoAuthServer: auth.armo.cloud
|
||||
ArmoERServer: report.armo.cloud
|
||||
ArmoWebsite: portal.armo.cloud
|
||||
CGO_ENABLED: 1
|
||||
run: python3 --version && python3 build.py
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
<img src="docs/kubescape.png" width="300" alt="logo" align="center">
|
||||
|
||||
[](https://github.com/armosec/kubescape/actions/workflows/build.yaml)
|
||||
[](https://goreportcard.com/report/github.com/armosec/kubescape)
|
||||
[](https://github.com/kubescape/kubescape/actions/workflows/build.yaml)
|
||||
[](https://goreportcard.com/report/github.com/kubescape/kubescape)
|
||||
|
||||
|
||||
|
||||
@@ -29,7 +29,7 @@ Kubescape integrates natively with other DevOps tools, including Jenkins, Circle
|
||||
# TL;DR
|
||||
## Install:
|
||||
```sh
|
||||
curl -s https://raw.githubusercontent.com/armosec/kubescape/master/install.sh | /bin/bash
|
||||
curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | /bin/bash
|
||||
```
|
||||
|
||||
[Install on windows](#install-on-windows)
|
||||
@@ -53,7 +53,7 @@ kubescape scan --submit --enable-host-scan --verbose
|
||||
|
||||
</br>
|
||||
|
||||
### Click [👍](https://github.com/armosec/kubescape/stargazers) if you want us to continue to develop and improve Kubescape 😀
|
||||
### Click [👍](https://github.com/kubescape/kubescape/stargazers) if you want us to continue to develop and improve Kubescape 😀
|
||||
|
||||
</br>
|
||||
|
||||
@@ -96,7 +96,7 @@ Want to contribute? Want to discuss something? Have an issue?
|
||||
**Requires powershell v5.0+**
|
||||
|
||||
``` powershell
|
||||
iwr -useb https://raw.githubusercontent.com/armosec/kubescape/master/install.ps1 | iex
|
||||
iwr -useb https://raw.githubusercontent.com/kubescape/kubescape/master/install.ps1 | iex
|
||||
```
|
||||
|
||||
Note: if you get an error you might need to change the execution policy (i.e. enable Powershell) with
|
||||
@@ -200,7 +200,7 @@ kubescape scan *.yaml --submit
|
||||
|
||||
#### Scan kubernetes manifest files from a git repository [and submit the results](https://hub.armosec.io/docs/repository-scanning?utm_source=github&utm_medium=repository)
|
||||
```
|
||||
kubescape scan https://github.com/armosec/kubescape --submit
|
||||
kubescape scan https://github.com/kubescape/kubescape --submit
|
||||
```
|
||||
|
||||
#### Display all scanned resources (including the resources who passed)
|
||||
@@ -411,7 +411,7 @@ The results by default printed in a pretty "console friendly" manner, but they c
|
||||
Kubescape is an open source project, we welcome your feedback and ideas for improvement. We’re also aiming to collaborate with the Kubernetes community to help make the tests themselves more robust and complete as Kubernetes develops.
|
||||
|
||||
## Thanks to all the contributors ❤️
|
||||
<a href = "https://github.com/armosec/kubescape/graphs/contributors">
|
||||
<img src = "https://contrib.rocks/image?repo=armosec/kubescape"/>
|
||||
<a href = "https://github.com/kubescape/kubescape/graphs/contributors">
|
||||
<img src = "https://contrib.rocks/image?repo=kubescape/kubescape"/>
|
||||
</a>
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@ import hashlib
|
||||
import platform
|
||||
import subprocess
|
||||
|
||||
BASE_GETTER_CONST = "github.com/armosec/kubescape/v2/core/cautils/getter"
|
||||
BASE_GETTER_CONST = "github.com/kubescape/kubescape/v2/core/cautils/getter"
|
||||
|
||||
def check_status(status, msg):
|
||||
if status != 0:
|
||||
@@ -35,10 +35,10 @@ def main():
|
||||
|
||||
# Set some variables
|
||||
package_name = get_package_name()
|
||||
build_url = "github.com/armosec/kubescape/v2/core/cautils.BuildNumber"
|
||||
build_url = "github.com/kubescape/kubescape/v2/core/cautils.BuildNumber"
|
||||
release_version = os.getenv("RELEASE")
|
||||
|
||||
client_var = "github.com/armosec/kubescape/v2/core/cautils.Client"
|
||||
client_var = "github.com/kubescape/kubescape/v2/core/cautils.Client"
|
||||
client_name = os.getenv("CLIENT")
|
||||
|
||||
# Create build directory
|
||||
|
||||
+1
-1
@@ -4,7 +4,7 @@
|
||||
|
||||
1. Clone Project
|
||||
```
|
||||
git clone https://github.com/armosec/kubescape.git kubescape && cd "$_"
|
||||
git clone https://github.com/kubescape/kubescape.git kubescape && cd "$_"
|
||||
```
|
||||
|
||||
2. Build
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
package config
|
||||
|
||||
import (
|
||||
"github.com/armosec/kubescape/v2/core/meta"
|
||||
"github.com/kubescape/kubescape/v2/core/meta"
|
||||
"github.com/spf13/cobra"
|
||||
)
|
||||
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
package config
|
||||
|
||||
import (
|
||||
"github.com/armosec/kubescape/v2/core/meta"
|
||||
v1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/kubescape/v2/core/meta"
|
||||
v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
|
||||
"github.com/spf13/cobra"
|
||||
)
|
||||
|
||||
|
||||
+2
-2
@@ -4,9 +4,9 @@ import (
|
||||
"fmt"
|
||||
"strings"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/meta"
|
||||
metav1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/kubescape/v2/core/meta"
|
||||
metav1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
|
||||
"github.com/spf13/cobra"
|
||||
)
|
||||
|
||||
|
||||
+2
-2
@@ -3,9 +3,9 @@ package config
|
||||
import (
|
||||
"os"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/meta"
|
||||
v1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/kubescape/v2/core/meta"
|
||||
v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
|
||||
"github.com/spf13/cobra"
|
||||
)
|
||||
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
package delete
|
||||
|
||||
import (
|
||||
"github.com/armosec/kubescape/v2/core/meta"
|
||||
v1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
|
||||
"github.com/kubescape/kubescape/v2/core/meta"
|
||||
v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
|
||||
"github.com/spf13/cobra"
|
||||
)
|
||||
|
||||
|
||||
@@ -4,9 +4,9 @@ import (
|
||||
"fmt"
|
||||
"strings"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/meta"
|
||||
v1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/kubescape/v2/core/meta"
|
||||
v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
|
||||
"github.com/spf13/cobra"
|
||||
)
|
||||
|
||||
|
||||
@@ -5,11 +5,11 @@ import (
|
||||
"path/filepath"
|
||||
"strings"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/armosec/kubescape/v2/core/core"
|
||||
"github.com/armosec/kubescape/v2/core/meta"
|
||||
v1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/core"
|
||||
"github.com/kubescape/kubescape/v2/core/meta"
|
||||
v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
|
||||
"github.com/spf13/cobra"
|
||||
)
|
||||
|
||||
|
||||
+4
-4
@@ -4,11 +4,11 @@ import (
|
||||
"fmt"
|
||||
"strings"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/armosec/kubescape/v2/core/core"
|
||||
"github.com/armosec/kubescape/v2/core/meta"
|
||||
v1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/core"
|
||||
"github.com/kubescape/kubescape/v2/core/meta"
|
||||
v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
|
||||
"github.com/spf13/cobra"
|
||||
)
|
||||
|
||||
|
||||
+12
-12
@@ -4,20 +4,20 @@ import (
|
||||
"fmt"
|
||||
"strings"
|
||||
|
||||
"github.com/armosec/kubescape/v2/cmd/completion"
|
||||
"github.com/armosec/kubescape/v2/cmd/config"
|
||||
"github.com/armosec/kubescape/v2/cmd/delete"
|
||||
"github.com/armosec/kubescape/v2/cmd/download"
|
||||
"github.com/armosec/kubescape/v2/cmd/list"
|
||||
"github.com/armosec/kubescape/v2/cmd/scan"
|
||||
"github.com/armosec/kubescape/v2/cmd/submit"
|
||||
"github.com/armosec/kubescape/v2/cmd/version"
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/armosec/kubescape/v2/core/cautils/getter"
|
||||
"github.com/armosec/kubescape/v2/core/core"
|
||||
"github.com/armosec/kubescape/v2/core/meta"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/go-logger/helpers"
|
||||
"github.com/kubescape/kubescape/v2/cmd/completion"
|
||||
"github.com/kubescape/kubescape/v2/cmd/config"
|
||||
"github.com/kubescape/kubescape/v2/cmd/delete"
|
||||
"github.com/kubescape/kubescape/v2/cmd/download"
|
||||
"github.com/kubescape/kubescape/v2/cmd/list"
|
||||
"github.com/kubescape/kubescape/v2/cmd/scan"
|
||||
"github.com/kubescape/kubescape/v2/cmd/submit"
|
||||
"github.com/kubescape/kubescape/v2/cmd/version"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils/getter"
|
||||
"github.com/kubescape/kubescape/v2/core/core"
|
||||
"github.com/kubescape/kubescape/v2/core/meta"
|
||||
|
||||
"github.com/spf13/cobra"
|
||||
)
|
||||
|
||||
+1
-1
@@ -5,9 +5,9 @@ import (
|
||||
"os"
|
||||
"strings"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils/getter"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/go-logger/helpers"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils/getter"
|
||||
|
||||
"github.com/mattn/go-isatty"
|
||||
)
|
||||
|
||||
+2
-2
@@ -8,10 +8,10 @@ import (
|
||||
|
||||
apisv1 "github.com/kubescape/opa-utils/httpserver/apis/v1"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/armosec/kubescape/v2/core/meta"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/go-logger/helpers"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/meta"
|
||||
|
||||
"github.com/enescakir/emoji"
|
||||
"github.com/spf13/cobra"
|
||||
|
||||
@@ -8,10 +8,10 @@ import (
|
||||
|
||||
apisv1 "github.com/kubescape/opa-utils/httpserver/apis/v1"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/armosec/kubescape/v2/core/meta"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/go-logger/helpers"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/meta"
|
||||
|
||||
"github.com/enescakir/emoji"
|
||||
"github.com/spf13/cobra"
|
||||
|
||||
+3
-3
@@ -3,9 +3,9 @@ package scan
|
||||
import (
|
||||
"fmt"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/armosec/kubescape/v2/core/meta"
|
||||
"github.com/kubescape/k8s-interface/k8sinterface"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/meta"
|
||||
"github.com/spf13/cobra"
|
||||
)
|
||||
|
||||
@@ -93,7 +93,7 @@ func GetScanCommand(ks meta.IKubescape) *cobra.Command {
|
||||
scanCmd.PersistentFlags().MarkHidden("silent") // this flag should be deprecated since we added the --logger support
|
||||
// scanCmd.PersistentFlags().MarkHidden("format-version") // meant for testing different output approaches and not for common use
|
||||
|
||||
hostF := scanCmd.PersistentFlags().VarPF(&scanInfo.HostSensorEnabled, "enable-host-scan", "", "Deploy ARMO K8s host-sensor daemonset in the scanned cluster. Deleting it right after we collecting the data. Required to collect valuable data from cluster nodes for certain controls. Yaml file: https://github.com/armosec/kubescape/blob/master/core/pkg/hostsensorutils/hostsensor.yaml")
|
||||
hostF := scanCmd.PersistentFlags().VarPF(&scanInfo.HostSensorEnabled, "enable-host-scan", "", "Deploy ARMO K8s host-sensor daemonset in the scanned cluster. Deleting it right after we collecting the data. Required to collect valuable data from cluster nodes for certain controls. Yaml file: https://github.com/kubescape/kubescape/blob/master/core/pkg/hostsensorutils/hostsensor.yaml")
|
||||
hostF.NoOptDefVal = "true"
|
||||
hostF.DefValue = "false, for no TTY in stdin"
|
||||
|
||||
|
||||
@@ -3,9 +3,9 @@ package submit
|
||||
import (
|
||||
"fmt"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/meta"
|
||||
metav1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/kubescape/v2/core/meta"
|
||||
metav1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
|
||||
|
||||
"github.com/spf13/cobra"
|
||||
)
|
||||
|
||||
+6
-6
@@ -3,16 +3,16 @@ package submit
|
||||
import (
|
||||
"fmt"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/armosec/kubescape/v2/core/cautils/getter"
|
||||
"github.com/armosec/kubescape/v2/core/meta"
|
||||
"github.com/armosec/kubescape/v2/core/meta/cliinterfaces"
|
||||
v1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
|
||||
reporterv2 "github.com/armosec/kubescape/v2/core/pkg/resultshandling/reporter/v2"
|
||||
"github.com/google/uuid"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/go-logger/helpers"
|
||||
"github.com/kubescape/k8s-interface/k8sinterface"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils/getter"
|
||||
"github.com/kubescape/kubescape/v2/core/meta"
|
||||
"github.com/kubescape/kubescape/v2/core/meta/cliinterfaces"
|
||||
v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
|
||||
reporterv2 "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/reporter/v2"
|
||||
|
||||
"github.com/kubescape/rbac-utils/rbacscanner"
|
||||
"github.com/spf13/cobra"
|
||||
|
||||
@@ -8,13 +8,13 @@ import (
|
||||
"github.com/google/uuid"
|
||||
reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/meta"
|
||||
"github.com/armosec/kubescape/v2/core/meta/cliinterfaces"
|
||||
v1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
|
||||
reporterv2 "github.com/armosec/kubescape/v2/core/pkg/resultshandling/reporter/v2"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/go-logger/helpers"
|
||||
"github.com/kubescape/k8s-interface/workloadinterface"
|
||||
"github.com/kubescape/kubescape/v2/core/meta"
|
||||
"github.com/kubescape/kubescape/v2/core/meta/cliinterfaces"
|
||||
v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
|
||||
reporterv2 "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/reporter/v2"
|
||||
|
||||
"github.com/spf13/cobra"
|
||||
)
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
package submit
|
||||
|
||||
import (
|
||||
"github.com/armosec/kubescape/v2/core/meta"
|
||||
metav1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
|
||||
"github.com/kubescape/kubescape/v2/core/meta"
|
||||
metav1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
|
||||
"github.com/spf13/cobra"
|
||||
)
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@ import (
|
||||
"fmt"
|
||||
"os"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/spf13/cobra"
|
||||
)
|
||||
|
||||
|
||||
@@ -9,9 +9,9 @@ import (
|
||||
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils/getter"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/k8s-interface/k8sinterface"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils/getter"
|
||||
corev1 "k8s.io/api/core/v1"
|
||||
)
|
||||
|
||||
|
||||
@@ -44,6 +44,23 @@ func NewOPASessionObj(frameworks []reporthandling.Framework, k8sResources *K8SRe
|
||||
}
|
||||
}
|
||||
|
||||
func (sessionObj *OPASessionObj) SetMapNamespaceToNumberOfResources(mapNamespaceToNumberOfResources map[string]int) {
|
||||
if sessionObj.Metadata.ContextMetadata.ClusterContextMetadata == nil {
|
||||
sessionObj.Metadata.ContextMetadata.ClusterContextMetadata = &reporthandlingv2.ClusterMetadata{}
|
||||
}
|
||||
if sessionObj.Metadata.ContextMetadata.ClusterContextMetadata.MapNamespaceToNumberOfResources == nil {
|
||||
sessionObj.Metadata.ContextMetadata.ClusterContextMetadata.MapNamespaceToNumberOfResources = make(map[string]int)
|
||||
}
|
||||
sessionObj.Metadata.ContextMetadata.ClusterContextMetadata.MapNamespaceToNumberOfResources = mapNamespaceToNumberOfResources
|
||||
}
|
||||
|
||||
func (sessionObj *OPASessionObj) SetNumberOfWorkerNodes(n int) {
|
||||
if sessionObj.Metadata.ContextMetadata.ClusterContextMetadata == nil {
|
||||
sessionObj.Metadata.ContextMetadata.ClusterContextMetadata = &reporthandlingv2.ClusterMetadata{}
|
||||
}
|
||||
sessionObj.Metadata.ContextMetadata.ClusterContextMetadata.NumberOfWorkerNodes = n
|
||||
}
|
||||
|
||||
func NewOPASessionObjMock() *OPASessionObj {
|
||||
return &OPASessionObj{
|
||||
Policies: nil,
|
||||
|
||||
@@ -12,10 +12,10 @@ import (
|
||||
apisv1 "github.com/kubescape/opa-utils/httpserver/apis/v1"
|
||||
|
||||
giturl "github.com/armosec/go-git-url"
|
||||
"github.com/armosec/kubescape/v2/core/cautils/getter"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/go-logger/helpers"
|
||||
"github.com/kubescape/k8s-interface/k8sinterface"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils/getter"
|
||||
"github.com/kubescape/opa-utils/reporthandling"
|
||||
reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2"
|
||||
|
||||
|
||||
@@ -20,7 +20,7 @@ func TestSetContextMetadata(t *testing.T) {
|
||||
}
|
||||
{
|
||||
ctx := reporthandlingv2.ContextMetadata{}
|
||||
setContextMetadata(&ctx, "https://github.com/armosec/kubescape")
|
||||
setContextMetadata(&ctx, "https://github.com/kubescape/kubescape")
|
||||
|
||||
assert.Nil(t, ctx.ClusterContextMetadata)
|
||||
assert.Nil(t, ctx.DirectoryContextMetadata)
|
||||
@@ -29,7 +29,7 @@ func TestSetContextMetadata(t *testing.T) {
|
||||
assert.NotNil(t, ctx.RepoContextMetadata)
|
||||
|
||||
assert.Equal(t, "kubescape", ctx.RepoContextMetadata.Repo)
|
||||
assert.Equal(t, "armosec", ctx.RepoContextMetadata.Owner)
|
||||
assert.Equal(t, "kubescape", ctx.RepoContextMetadata.Owner)
|
||||
assert.Equal(t, "master", ctx.RepoContextMetadata.Branch)
|
||||
}
|
||||
}
|
||||
@@ -40,5 +40,5 @@ func TestGetHostname(t *testing.T) {
|
||||
|
||||
func TestGetScanningContext(t *testing.T) {
|
||||
assert.Equal(t, ContextCluster, GetScanningContext(""))
|
||||
assert.Equal(t, ContextGitURL, GetScanningContext("https://github.com/armosec/kubescape"))
|
||||
assert.Equal(t, ContextGitURL, GetScanningContext("https://github.com/kubescape/kubescape"))
|
||||
}
|
||||
|
||||
@@ -6,10 +6,10 @@ import (
|
||||
"net/http"
|
||||
"os"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils/getter"
|
||||
"github.com/armosec/utils-go/boolutils"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/go-logger/helpers"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils/getter"
|
||||
|
||||
"golang.org/x/mod/semver"
|
||||
)
|
||||
|
||||
@@ -3,7 +3,7 @@ package core
|
||||
import (
|
||||
"fmt"
|
||||
|
||||
metav1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
|
||||
metav1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
|
||||
)
|
||||
|
||||
func (ks *Kubescape) SetCachedConfig(setConfig *metav1.SetConfig) error {
|
||||
|
||||
+2
-2
@@ -3,10 +3,10 @@ package core
|
||||
import (
|
||||
"fmt"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils/getter"
|
||||
v1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/go-logger/helpers"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils/getter"
|
||||
v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
|
||||
)
|
||||
|
||||
func (ks *Kubescape) DeleteExceptions(delExceptions *v1.DeleteExceptions) error {
|
||||
|
||||
@@ -7,10 +7,10 @@ import (
|
||||
"strings"
|
||||
|
||||
"github.com/armosec/armoapi-go/armotypes"
|
||||
"github.com/armosec/kubescape/v2/core/cautils/getter"
|
||||
metav1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/go-logger/helpers"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils/getter"
|
||||
metav1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
|
||||
)
|
||||
|
||||
var downloadFunc = map[string]func(*metav1.DownloadInfo) error{
|
||||
|
||||
@@ -3,15 +3,15 @@ package core
|
||||
import (
|
||||
"fmt"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/armosec/kubescape/v2/core/cautils/getter"
|
||||
"github.com/armosec/kubescape/v2/core/pkg/hostsensorutils"
|
||||
"github.com/armosec/kubescape/v2/core/pkg/resourcehandler"
|
||||
"github.com/armosec/kubescape/v2/core/pkg/resultshandling/reporter"
|
||||
reporterv2 "github.com/armosec/kubescape/v2/core/pkg/resultshandling/reporter/v2"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/go-logger/helpers"
|
||||
"github.com/kubescape/k8s-interface/k8sinterface"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils/getter"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/hostsensorutils"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/resourcehandler"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling/reporter"
|
||||
reporterv2 "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/reporter/v2"
|
||||
|
||||
"github.com/google/uuid"
|
||||
|
||||
|
||||
+2
-2
@@ -6,8 +6,8 @@ import (
|
||||
"sort"
|
||||
"strings"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils/getter"
|
||||
metav1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils/getter"
|
||||
metav1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
|
||||
)
|
||||
|
||||
var listFunc = map[string]func(*metav1.ListPolicies) ([]string, error){
|
||||
|
||||
+9
-9
@@ -7,17 +7,17 @@ import (
|
||||
|
||||
"github.com/kubescape/k8s-interface/k8sinterface"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/armosec/kubescape/v2/core/cautils/getter"
|
||||
"github.com/armosec/kubescape/v2/core/pkg/hostsensorutils"
|
||||
"github.com/armosec/kubescape/v2/core/pkg/opaprocessor"
|
||||
"github.com/armosec/kubescape/v2/core/pkg/policyhandler"
|
||||
"github.com/armosec/kubescape/v2/core/pkg/resourcehandler"
|
||||
"github.com/armosec/kubescape/v2/core/pkg/resultshandling"
|
||||
"github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer"
|
||||
"github.com/armosec/kubescape/v2/core/pkg/resultshandling/reporter"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/go-logger/helpers"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils/getter"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/hostsensorutils"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/opaprocessor"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/policyhandler"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/resourcehandler"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling/reporter"
|
||||
|
||||
"github.com/kubescape/opa-utils/resources"
|
||||
)
|
||||
|
||||
+3
-3
@@ -1,9 +1,9 @@
|
||||
package core
|
||||
|
||||
import (
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/armosec/kubescape/v2/core/cautils/getter"
|
||||
"github.com/armosec/kubescape/v2/core/meta/cliinterfaces"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils/getter"
|
||||
"github.com/kubescape/kubescape/v2/core/meta/cliinterfaces"
|
||||
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/go-logger/helpers"
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
package cliinterfaces
|
||||
|
||||
import (
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/armosec/kubescape/v2/core/pkg/resultshandling/reporter"
|
||||
"github.com/kubescape/k8s-interface/workloadinterface"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling/reporter"
|
||||
reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2"
|
||||
)
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
package v1
|
||||
|
||||
import "github.com/armosec/kubescape/v2/core/cautils"
|
||||
import "github.com/kubescape/kubescape/v2/core/cautils"
|
||||
|
||||
type DeleteExceptions struct {
|
||||
Credentials cautils.Credentials
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
package v1
|
||||
|
||||
import "github.com/armosec/kubescape/v2/core/cautils"
|
||||
import "github.com/kubescape/kubescape/v2/core/cautils"
|
||||
|
||||
type DownloadInfo struct {
|
||||
Path string // directory to save artifact. Default is "~/.kubescape/"
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
package v1
|
||||
|
||||
import "github.com/armosec/kubescape/v2/core/cautils"
|
||||
import "github.com/kubescape/kubescape/v2/core/cautils"
|
||||
|
||||
type ListPolicies struct {
|
||||
Target string
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
package v1
|
||||
|
||||
import "github.com/armosec/kubescape/v2/core/cautils"
|
||||
import "github.com/kubescape/kubescape/v2/core/cautils"
|
||||
|
||||
type Submit struct {
|
||||
Credentials cautils.Credentials
|
||||
|
||||
@@ -1,10 +1,10 @@
|
||||
package meta
|
||||
|
||||
import (
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/armosec/kubescape/v2/core/meta/cliinterfaces"
|
||||
metav1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1"
|
||||
"github.com/armosec/kubescape/v2/core/pkg/resultshandling"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/meta/cliinterfaces"
|
||||
metav1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling"
|
||||
)
|
||||
|
||||
type IKubescape interface {
|
||||
|
||||
@@ -8,11 +8,11 @@ import (
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/go-logger/helpers"
|
||||
"github.com/kubescape/k8s-interface/k8sinterface"
|
||||
"github.com/kubescape/k8s-interface/workloadinterface"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
|
||||
appsv1 "k8s.io/api/apps/v1"
|
||||
corev1 "k8s.io/api/core/v1"
|
||||
|
||||
@@ -6,10 +6,10 @@ import (
|
||||
"time"
|
||||
|
||||
"github.com/armosec/armoapi-go/armotypes"
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/armosec/kubescape/v2/core/pkg/score"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/go-logger/helpers"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/score"
|
||||
"github.com/kubescape/opa-utils/objectsenvelopes"
|
||||
"github.com/kubescape/opa-utils/reporthandling"
|
||||
"github.com/kubescape/opa-utils/reporthandling/apis"
|
||||
|
||||
@@ -4,8 +4,8 @@ import (
|
||||
"testing"
|
||||
|
||||
"github.com/armosec/armoapi-go/armotypes"
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/armosec/kubescape/v2/core/mocks"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/mocks"
|
||||
"github.com/kubescape/opa-utils/reporthandling"
|
||||
"github.com/kubescape/opa-utils/resources"
|
||||
"github.com/stretchr/testify/assert"
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
package opaprocessor
|
||||
|
||||
import (
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
|
||||
"github.com/kubescape/k8s-interface/k8sinterface"
|
||||
"github.com/kubescape/k8s-interface/workloadinterface"
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
package opaprocessor
|
||||
|
||||
import (
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/opa-utils/reporthandling"
|
||||
"github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary"
|
||||
)
|
||||
|
||||
@@ -5,7 +5,7 @@ import (
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/mocks"
|
||||
"github.com/kubescape/kubescape/v2/core/mocks"
|
||||
"github.com/kubescape/opa-utils/reporthandling"
|
||||
"github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary"
|
||||
)
|
||||
|
||||
@@ -4,8 +4,8 @@ import (
|
||||
"fmt"
|
||||
|
||||
"github.com/armosec/armoapi-go/armotypes"
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/armosec/kubescape/v2/core/pkg/resourcehandler"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/resourcehandler"
|
||||
)
|
||||
|
||||
// PolicyHandler -
|
||||
|
||||
@@ -6,10 +6,10 @@ import (
|
||||
|
||||
apisv1 "github.com/kubescape/opa-utils/httpserver/apis/v1"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/armosec/kubescape/v2/core/cautils/getter"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/go-logger/helpers"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils/getter"
|
||||
"github.com/kubescape/opa-utils/reporthandling"
|
||||
)
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@ import (
|
||||
|
||||
apisv1 "github.com/kubescape/opa-utils/httpserver/apis/v1"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
)
|
||||
|
||||
func getScanKind(policyIdentifier []cautils.PolicyIdentifier) apisv1.NotificationPolicyKind {
|
||||
|
||||
@@ -4,11 +4,11 @@ import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils/getter"
|
||||
"github.com/armosec/kubescape/v2/core/pkg/containerscan"
|
||||
"github.com/armosec/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/go-logger/helpers"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils/getter"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/containerscan"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities"
|
||||
)
|
||||
|
||||
func NewKSAdaptor(api *getter.KSCloudAPI) *KSCivAdaptor {
|
||||
|
||||
@@ -3,7 +3,7 @@ package v1
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities"
|
||||
"github.com/stretchr/testify/assert"
|
||||
)
|
||||
|
||||
|
||||
@@ -3,8 +3,8 @@ package v1
|
||||
import (
|
||||
"encoding/json"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/pkg/containerscan"
|
||||
"github.com/armosec/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/containerscan"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities"
|
||||
)
|
||||
|
||||
type ArmoCivAdaptorMock struct {
|
||||
|
||||
@@ -4,8 +4,8 @@ import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/pkg/containerscan"
|
||||
"github.com/armosec/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/containerscan"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities"
|
||||
)
|
||||
|
||||
func (armoCivAdaptor *KSCivAdaptor) getImageLastScanId(imageID *registryvulnerabilities.ContainerImageIdentifier) (string, error) {
|
||||
|
||||
@@ -3,7 +3,7 @@ package v1
|
||||
import (
|
||||
"time"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils/getter"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils/getter"
|
||||
)
|
||||
|
||||
type V2ListRequest struct {
|
||||
|
||||
@@ -10,10 +10,10 @@ import (
|
||||
"github.com/kubescape/opa-utils/reporthandling"
|
||||
"k8s.io/apimachinery/pkg/version"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/go-logger/helpers"
|
||||
"github.com/kubescape/k8s-interface/k8sinterface"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
)
|
||||
|
||||
// FileResourceHandler handle resources from files and URLs
|
||||
|
||||
@@ -5,11 +5,11 @@ import (
|
||||
"path/filepath"
|
||||
|
||||
giturl "github.com/armosec/go-git-url"
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/go-logger/helpers"
|
||||
"github.com/kubescape/k8s-interface/k8sinterface"
|
||||
"github.com/kubescape/k8s-interface/workloadinterface"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/opa-utils/reporthandling"
|
||||
)
|
||||
|
||||
|
||||
@@ -5,10 +5,10 @@ import (
|
||||
"fmt"
|
||||
"strings"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/armosec/kubescape/v2/core/pkg/hostsensorutils"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/go-logger/helpers"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/hostsensorutils"
|
||||
"github.com/kubescape/opa-utils/objectsenvelopes"
|
||||
"github.com/kubescape/opa-utils/reporthandling/apis"
|
||||
|
||||
@@ -76,9 +76,7 @@ func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessio
|
||||
if err != nil {
|
||||
logger.L().Debug("failed to collect worker nodes number", helpers.Error(err))
|
||||
} else {
|
||||
if sessionObj.Metadata != nil && sessionObj.Metadata.ContextMetadata.ClusterContextMetadata != nil {
|
||||
sessionObj.Metadata.ContextMetadata.ClusterContextMetadata.NumberOfWorkerNodes = numberOfWorkerNodes
|
||||
}
|
||||
sessionObj.SetNumberOfWorkerNodes(numberOfWorkerNodes)
|
||||
}
|
||||
|
||||
imgVulnResources := cautils.MapImageVulnResources(ksResourceMap)
|
||||
@@ -118,6 +116,9 @@ func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessio
|
||||
}
|
||||
|
||||
cloudResources := cautils.MapCloudResources(ksResourceMap)
|
||||
|
||||
setMapNamespaceToNumOfResources(allResources, sessionObj)
|
||||
|
||||
// check that controls use cloud resources
|
||||
if len(cloudResources) > 0 {
|
||||
provider, err := getCloudProviderDescription(allResources, ksResourceMap)
|
||||
@@ -147,6 +148,30 @@ func (k8sHandler *K8sResourceHandler) GetClusterAPIServerInfo() *version.Info {
|
||||
return clusterAPIServerInfo
|
||||
}
|
||||
|
||||
// set namespaceToNumOfResources map in report
|
||||
func setMapNamespaceToNumOfResources(allResources map[string]workloadinterface.IMetadata, sessionObj *cautils.OPASessionObj) {
|
||||
|
||||
mapNamespaceToNumberOfResources := make(map[string]int)
|
||||
for _, resource := range allResources {
|
||||
if obj := workloadinterface.NewWorkloadObj(resource.GetObject()); obj != nil {
|
||||
ownerReferences, err := obj.GetOwnerReferences()
|
||||
if err == nil {
|
||||
// Add an object to the map if the object does not have a parent but is contained within a namespace (except Job)
|
||||
if len(ownerReferences) == 0 {
|
||||
if ns := resource.GetNamespace(); ns != "" {
|
||||
if obj.GetKind() != "Job" {
|
||||
mapNamespaceToNumberOfResources[ns]++
|
||||
}
|
||||
}
|
||||
}
|
||||
} else {
|
||||
logger.L().Warning(fmt.Sprintf("failed to get owner references. Resource %s will not be counted", obj.GetName()), helpers.Error(err))
|
||||
}
|
||||
}
|
||||
}
|
||||
sessionObj.SetMapNamespaceToNumberOfResources(mapNamespaceToNumberOfResources)
|
||||
}
|
||||
|
||||
func (k8sHandler *K8sResourceHandler) pullResources(k8sResources *cautils.K8SResources, allResources map[string]workloadinterface.IMetadata, namespace string, labels map[string]string) error {
|
||||
|
||||
var errs error
|
||||
|
||||
File diff suppressed because one or more lines are too long
@@ -3,7 +3,7 @@ package resourcehandler
|
||||
import (
|
||||
"strings"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/opa-utils/reporthandling"
|
||||
"k8s.io/utils/strings/slices"
|
||||
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
package resourcehandler
|
||||
|
||||
import (
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/k8s-interface/k8sinterface"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/opa-utils/reporthandling"
|
||||
"github.com/stretchr/testify/assert"
|
||||
|
||||
|
||||
@@ -3,13 +3,13 @@ package resourcehandler
|
||||
import (
|
||||
"fmt"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/armosec/kubescape/v2/core/cautils/getter"
|
||||
armosecadaptorv1 "github.com/armosec/kubescape/v2/core/pkg/registryadaptors/armosec/v1"
|
||||
"github.com/armosec/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/k8s-interface/k8sinterface"
|
||||
"github.com/kubescape/k8s-interface/workloadinterface"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils/getter"
|
||||
armosecadaptorv1 "github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/armosec/v1"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities"
|
||||
|
||||
"github.com/kubescape/opa-utils/shared"
|
||||
)
|
||||
|
||||
@@ -8,7 +8,7 @@ import (
|
||||
"path/filepath"
|
||||
"strings"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils/getter"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils/getter"
|
||||
giturls "github.com/whilp/git-urls"
|
||||
"k8s.io/utils/strings/slices"
|
||||
)
|
||||
|
||||
@@ -7,10 +7,10 @@ import (
|
||||
)
|
||||
|
||||
var (
|
||||
urlA = "https://github.com/armosec/kubescape"
|
||||
urlB = "https://github.com/armosec/kubescape/blob/master/examples/online-boutique/adservice.yaml"
|
||||
urlC = "https://github.com/armosec/kubescape/tree/master/examples/online-boutique"
|
||||
urlD = "https://raw.githubusercontent.com/armosec/kubescape/master/examples/online-boutique/adservice.yaml"
|
||||
urlA = "https://github.com/kubescape/kubescape"
|
||||
urlB = "https://github.com/kubescape/kubescape/blob/master/examples/online-boutique/adservice.yaml"
|
||||
urlC = "https://github.com/kubescape/kubescape/tree/master/examples/online-boutique"
|
||||
urlD = "https://raw.githubusercontent.com/kubescape/kubescape/master/examples/online-boutique/adservice.yaml"
|
||||
)
|
||||
|
||||
func TestScanRepository(t *testing.T) {
|
||||
@@ -117,12 +117,12 @@ func TestGithubParse(t *testing.T) {
|
||||
{
|
||||
gh := NewGitHubRepository()
|
||||
assert.NoError(t, gh.parse(urlA))
|
||||
assert.Equal(t, "armosec/kubescape", joinOwnerNRepo(gh.owner, gh.repo))
|
||||
assert.Equal(t, "kubescape/kubescape", joinOwnerNRepo(gh.owner, gh.repo))
|
||||
}
|
||||
{
|
||||
gh := NewGitHubRepository()
|
||||
assert.NoError(t, gh.parse(urlB))
|
||||
assert.Equal(t, "armosec/kubescape", joinOwnerNRepo(gh.owner, gh.repo))
|
||||
assert.Equal(t, "kubescape/kubescape", joinOwnerNRepo(gh.owner, gh.repo))
|
||||
assert.Equal(t, "master", gh.branch)
|
||||
assert.Equal(t, "examples/online-boutique/adservice.yaml", gh.path)
|
||||
assert.True(t, gh.isFile)
|
||||
@@ -132,7 +132,7 @@ func TestGithubParse(t *testing.T) {
|
||||
{
|
||||
gh := NewGitHubRepository()
|
||||
assert.NoError(t, gh.parse(urlC))
|
||||
assert.Equal(t, "armosec/kubescape", joinOwnerNRepo(gh.owner, gh.repo))
|
||||
assert.Equal(t, "kubescape/kubescape", joinOwnerNRepo(gh.owner, gh.repo))
|
||||
assert.Equal(t, "master", gh.branch)
|
||||
assert.Equal(t, "examples/online-boutique", gh.path)
|
||||
assert.False(t, gh.isFile)
|
||||
|
||||
@@ -2,8 +2,8 @@ package resourcehandler
|
||||
|
||||
import (
|
||||
"github.com/armosec/armoapi-go/armotypes"
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/k8s-interface/workloadinterface"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"k8s.io/apimachinery/pkg/version"
|
||||
)
|
||||
|
||||
|
||||
@@ -2,10 +2,10 @@ package resourcehandler
|
||||
|
||||
import (
|
||||
giturl "github.com/armosec/go-git-url"
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/go-logger/helpers"
|
||||
"github.com/kubescape/k8s-interface/workloadinterface"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
)
|
||||
|
||||
func loadResourcesFromUrl(inputPatterns []string) (map[string][]workloadinterface.IMetadata, error) {
|
||||
|
||||
@@ -8,13 +8,13 @@ import (
|
||||
|
||||
func TestLoadResourcesFromUrl(t *testing.T) {
|
||||
{
|
||||
workloads, err := loadResourcesFromUrl([]string{"https://github.com/armosec/kubescape/tree/master/examples/online-boutique"})
|
||||
workloads, err := loadResourcesFromUrl([]string{"https://github.com/kubescape/kubescape/tree/master/examples/online-boutique"})
|
||||
assert.NoError(t, err)
|
||||
assert.Equal(t, 12, len(workloads))
|
||||
|
||||
for i, w := range workloads {
|
||||
switch i {
|
||||
case "https://raw.githubusercontent.com/armosec/kubescape/master/examples/online-boutique/adservice.yaml":
|
||||
case "https://raw.githubusercontent.com/kubescape/kubescape/master/examples/online-boutique/adservice.yaml":
|
||||
assert.Equal(t, 2, len(w))
|
||||
assert.Equal(t, "apps/v1//Deployment/adservice", w[0].GetID())
|
||||
assert.Equal(t, "/v1//Service/adservice", w[1].GetID())
|
||||
@@ -22,13 +22,13 @@ func TestLoadResourcesFromUrl(t *testing.T) {
|
||||
}
|
||||
}
|
||||
{
|
||||
workloads, err := loadResourcesFromUrl([]string{"https://github.com/armosec/kubescape"})
|
||||
workloads, err := loadResourcesFromUrl([]string{"https://github.com/kubescape/kubescape"})
|
||||
assert.NoError(t, err)
|
||||
assert.Less(t, 12, len(workloads))
|
||||
|
||||
for i, w := range workloads {
|
||||
switch i {
|
||||
case "https://raw.githubusercontent.com/armosec/kubescape/master/examples/online-boutique/adservice.yaml":
|
||||
case "https://raw.githubusercontent.com/kubescape/kubescape/master/examples/online-boutique/adservice.yaml":
|
||||
assert.Equal(t, 2, len(w))
|
||||
assert.Equal(t, "apps/v1//Deployment/adservice", w[0].GetID())
|
||||
assert.Equal(t, "/v1//Service/adservice", w[1].GetID())
|
||||
@@ -36,13 +36,13 @@ func TestLoadResourcesFromUrl(t *testing.T) {
|
||||
}
|
||||
}
|
||||
{
|
||||
workloads, err := loadResourcesFromUrl([]string{"https://github.com/armosec/kubescape/blob/master/examples/online-boutique/adservice.yaml"})
|
||||
workloads, err := loadResourcesFromUrl([]string{"https://github.com/kubescape/kubescape/blob/master/examples/online-boutique/adservice.yaml"})
|
||||
assert.NoError(t, err)
|
||||
assert.Equal(t, 1, len(workloads))
|
||||
|
||||
for i, w := range workloads {
|
||||
switch i {
|
||||
case "https://raw.githubusercontent.com/armosec/kubescape/master/examples/online-boutique/adservice.yaml":
|
||||
case "https://raw.githubusercontent.com/kubescape/kubescape/master/examples/online-boutique/adservice.yaml":
|
||||
assert.Equal(t, 2, len(w))
|
||||
assert.Equal(t, "apps/v1//Deployment/adservice", w[0].GetID())
|
||||
assert.Equal(t, "/v1//Service/adservice", w[1].GetID())
|
||||
@@ -50,13 +50,13 @@ func TestLoadResourcesFromUrl(t *testing.T) {
|
||||
}
|
||||
}
|
||||
{
|
||||
workloads, err := loadResourcesFromUrl([]string{"https://raw.githubusercontent.com/armosec/kubescape/master/examples/online-boutique/adservice.yaml"})
|
||||
workloads, err := loadResourcesFromUrl([]string{"https://raw.githubusercontent.com/kubescape/kubescape/master/examples/online-boutique/adservice.yaml"})
|
||||
assert.NoError(t, err)
|
||||
assert.Equal(t, 1, len(workloads))
|
||||
|
||||
for i, w := range workloads {
|
||||
switch i {
|
||||
case "https://raw.githubusercontent.com/armosec/kubescape/master/examples/online-boutique/adservice.yaml":
|
||||
case "https://raw.githubusercontent.com/kubescape/kubescape/master/examples/online-boutique/adservice.yaml":
|
||||
assert.Equal(t, 2, len(w))
|
||||
assert.Equal(t, "apps/v1//Deployment/adservice", w[0].GetID())
|
||||
assert.Equal(t, "/v1//Service/adservice", w[1].GetID())
|
||||
|
||||
@@ -5,8 +5,8 @@ import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
)
|
||||
|
||||
var INDENT = " "
|
||||
|
||||
@@ -5,9 +5,9 @@ import (
|
||||
"fmt"
|
||||
"os"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer"
|
||||
)
|
||||
|
||||
type JsonPrinter struct {
|
||||
|
||||
@@ -4,10 +4,10 @@ import (
|
||||
"fmt"
|
||||
"os"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/k8s-interface/workloadinterface"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer"
|
||||
"github.com/kubescape/opa-utils/reporthandling"
|
||||
)
|
||||
|
||||
|
||||
@@ -4,8 +4,8 @@ import (
|
||||
"fmt"
|
||||
"sort"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/fatih/color"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/opa-utils/reporthandling/apis"
|
||||
"github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary"
|
||||
"github.com/olekukonko/tablewriter"
|
||||
|
||||
@@ -69,7 +69,7 @@
|
||||
}
|
||||
</style>
|
||||
<body>
|
||||
<img class="logo" src="https://raw.githubusercontent.com/armosec/kubescape/master/core/pkg/resultshandling/printer/v2/pdf/logo.png">
|
||||
<img class="logo" src="https://raw.githubusercontent.com/kubescape/kubescape/master/core/pkg/resultshandling/printer/v2/pdf/logo.png">
|
||||
<h1>Kubescape Scan Report</h1>
|
||||
{{ with .OPASessionObj.Report.SummaryDetails }}
|
||||
<h2>By Controls</h2>
|
||||
|
||||
@@ -8,10 +8,10 @@ import (
|
||||
"sort"
|
||||
"strings"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/go-logger/helpers"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer"
|
||||
"github.com/kubescape/opa-utils/reporthandling/apis"
|
||||
"github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary"
|
||||
"github.com/kubescape/opa-utils/reporthandling/results/v1/resourcesresults"
|
||||
|
||||
@@ -5,10 +5,10 @@ import (
|
||||
"fmt"
|
||||
"os"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/go-logger/helpers"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer"
|
||||
)
|
||||
|
||||
type JsonPrinter struct {
|
||||
|
||||
@@ -7,11 +7,11 @@ import (
|
||||
"sort"
|
||||
"strings"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/go-logger/helpers"
|
||||
"github.com/kubescape/k8s-interface/workloadinterface"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer"
|
||||
"github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary"
|
||||
"github.com/kubescape/opa-utils/shared"
|
||||
)
|
||||
@@ -19,7 +19,6 @@ import (
|
||||
/*
|
||||
riskScore
|
||||
status
|
||||
|
||||
*/
|
||||
type JunitPrinter struct {
|
||||
writer *os.File
|
||||
|
||||
@@ -9,10 +9,10 @@ import (
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/go-logger/helpers"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer"
|
||||
"github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary"
|
||||
|
||||
"github.com/johnfercher/maroto/pkg/color"
|
||||
|
||||
@@ -6,10 +6,10 @@ import (
|
||||
"sort"
|
||||
"strings"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer"
|
||||
"github.com/enescakir/emoji"
|
||||
"github.com/kubescape/k8s-interface/workloadinterface"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer"
|
||||
"github.com/kubescape/opa-utils/objectsenvelopes"
|
||||
"github.com/kubescape/opa-utils/reporthandling/apis"
|
||||
helpersv1 "github.com/kubescape/opa-utils/reporthandling/helpers/v1"
|
||||
|
||||
@@ -4,11 +4,11 @@ import (
|
||||
"fmt"
|
||||
"os"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/go-logger/helpers"
|
||||
"github.com/kubescape/k8s-interface/workloadinterface"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer"
|
||||
"github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary"
|
||||
"github.com/kubescape/opa-utils/reporthandling/results/v1/resourcesresults"
|
||||
)
|
||||
|
||||
@@ -4,8 +4,8 @@ import (
|
||||
"fmt"
|
||||
"strings"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/k8s-interface/workloadinterface"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/opa-utils/reporthandling/apis"
|
||||
"github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary"
|
||||
"github.com/kubescape/opa-utils/reporthandling/results/v1/resourcesresults"
|
||||
|
||||
@@ -5,7 +5,7 @@ import (
|
||||
"sort"
|
||||
"strings"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary"
|
||||
"github.com/kubescape/opa-utils/reporthandling/results/v1/resourcesresults"
|
||||
"github.com/olekukonko/tablewriter"
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
package v2
|
||||
|
||||
import (
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
)
|
||||
|
||||
type SilentPrinter struct {
|
||||
|
||||
@@ -1,10 +1,10 @@
|
||||
package v2
|
||||
|
||||
import (
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/go-logger/helpers"
|
||||
"github.com/kubescape/k8s-interface/workloadinterface"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/opa-utils/reporthandling"
|
||||
"github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary"
|
||||
"github.com/kubescape/opa-utils/reporthandling/results/v1/resourcesresults"
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
package reporter
|
||||
|
||||
import "github.com/armosec/kubescape/v2/core/cautils"
|
||||
import "github.com/kubescape/kubescape/v2/core/cautils"
|
||||
|
||||
type IReport interface {
|
||||
Submit(opaSessionObj *cautils.OPASessionObj) error
|
||||
|
||||
@@ -4,8 +4,8 @@ import (
|
||||
"fmt"
|
||||
"os"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/armosec/kubescape/v2/core/cautils/getter"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils/getter"
|
||||
)
|
||||
|
||||
const NO_SUBMIT_QUERY = "utm_source=GitHub&utm_medium=CLI&utm_campaign=no_submit"
|
||||
|
||||
@@ -8,11 +8,11 @@ import (
|
||||
"os"
|
||||
|
||||
"github.com/armosec/armoapi-go/apis"
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/armosec/kubescape/v2/core/cautils/getter"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/go-logger/helpers"
|
||||
"github.com/kubescape/k8s-interface/workloadinterface"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils/getter"
|
||||
"github.com/kubescape/opa-utils/reporthandling"
|
||||
"github.com/kubescape/opa-utils/reporthandling/results/v1/resourcesresults"
|
||||
reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2"
|
||||
|
||||
@@ -4,7 +4,7 @@ import (
|
||||
"net/url"
|
||||
"testing"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/stretchr/testify/assert"
|
||||
)
|
||||
|
||||
|
||||
@@ -3,9 +3,9 @@ package v2
|
||||
import (
|
||||
"net/url"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/armosec/kubescape/v2/core/cautils/getter"
|
||||
"github.com/google/uuid"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils/getter"
|
||||
reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2"
|
||||
)
|
||||
|
||||
|
||||
@@ -3,13 +3,13 @@ package resultshandling
|
||||
import (
|
||||
"encoding/json"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer"
|
||||
printerv1 "github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer/v1"
|
||||
printerv2 "github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer/v2"
|
||||
"github.com/armosec/kubescape/v2/core/pkg/resultshandling/reporter"
|
||||
logger "github.com/kubescape/go-logger"
|
||||
"github.com/kubescape/go-logger/helpers"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer"
|
||||
printerv1 "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer/v1"
|
||||
printerv2 "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer/v2"
|
||||
"github.com/kubescape/kubescape/v2/core/pkg/resultshandling/reporter"
|
||||
reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2"
|
||||
)
|
||||
|
||||
|
||||
@@ -5,11 +5,14 @@ import (
|
||||
|
||||
"github.com/kubescape/opa-utils/score"
|
||||
|
||||
"github.com/armosec/kubescape/v2/core/cautils"
|
||||
"github.com/kubescape/kubescape/v2/core/cautils"
|
||||
)
|
||||
|
||||
/* provides a wrapper for scoreUtils, since there's no common interface between postureReportV1 and PostureReportV2
|
||||
/*
|
||||
provides a wrapper for scoreUtils, since there's no common interface between postureReportV1 and PostureReportV2
|
||||
|
||||
and the need of concrete objects
|
||||
|
||||
I've decided to create scoreWrapper that will allow calculating score regardless (as long as opaSessionObj is there)
|
||||
*/
|
||||
type ScoreWrapper struct {
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
|
||||
# Set environment variables
|
||||
echo 'Set environment variables'
|
||||
export kubescape_namespace=armo-system
|
||||
export kubescape_namespace=kubescape
|
||||
export kubescape_serviceaccount=armo-kubescape-service-account
|
||||
|
||||
# Get current context
|
||||
@@ -65,4 +65,4 @@ eksctl create iamserviceaccount \
|
||||
|
||||
# Install/Upgrade Kubescape chart
|
||||
echo 'Install/Upgrade Kubescape chart'
|
||||
helm upgrade --install armo armo-components/ -n armo-system --create-namespace --set clusterName=$cluster_name --set cloud_provider_engine=eks --set createKubescapeServiceAccount=false --set cloudRegion=$cluster_region
|
||||
helm upgrade --install armo armo-components/ -n kubescape --create-namespace --set clusterName=$cluster_name --set cloud_provider_engine=eks --set createKubescapeServiceAccount=false --set cloudRegion=$cluster_region
|
||||
|
||||
@@ -17,7 +17,7 @@ gcloud iam service-accounts create kubescape --display-name=kubescape
|
||||
|
||||
# Set environment variables
|
||||
echo 'Set environment variables'
|
||||
export kubescape_namespace=armo-system
|
||||
export kubescape_namespace=kubescape
|
||||
export kubescape_serviceaccount=armo-kubescape-service-account
|
||||
|
||||
# Get current GCP project
|
||||
@@ -46,4 +46,4 @@ gcloud iam service-accounts add-iam-policy-binding $gcp_service_account --role r
|
||||
|
||||
# Install/Upgrade Kubescape chart
|
||||
echo 'Install/Upgrade Kubescape chart'
|
||||
helm upgrade --install armo armo-components/ -n armo-system --create-namespace --set cloud_provider_engine=gke --set gke_service_account=$gcp_service_account --set cloudRegion=$CLUSTER_REGION --set clusterName=$CLUSTER_NAME --set gkeProject=$gcp_project
|
||||
helm upgrade --install armo armo-components/ -n kubescape --create-namespace --set cloud_provider_engine=gke --set gke_service_account=$gcp_service_account --set cloudRegion=$CLUSTER_REGION --set clusterName=$CLUSTER_NAME --set gkeProject=$gcp_project
|
||||
|
||||
@@ -24,7 +24,7 @@ e.g. When a `kube-system` resource fails and it is ok, simply add the resource t
|
||||
* `controlID` - Control ID can be find [here](https://github.com/armosec/regolibrary/tree/master/controls) (regex supported)
|
||||
* `ruleName` - Rule names can be find [here](https://github.com/armosec/regolibrary/tree/master/rules) (regex supported)
|
||||
|
||||
You can find [here](https://github.com/armosec/kubescape/tree/master/examples/exceptions) some examples of exceptions files
|
||||
You can find [here](https://github.com/kubescape/kubescape/tree/master/examples/exceptions) some examples of exceptions files
|
||||
|
||||
## Usage
|
||||
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -17,9 +17,9 @@ kubescape_object_failed_count{framework="NSA",control="Immutable container files
|
||||
# Failed object from "NSA" control "Immutable container filesystem"
|
||||
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "NSA" control "Immutable container filesystem"
|
||||
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
|
||||
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "NSA" control "Immutable container filesystem"
|
||||
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
|
||||
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "NSA" control "Immutable container filesystem"
|
||||
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="cyberarmor-system",name="ca-dashboard-aggregator",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "NSA" control "Immutable container filesystem"
|
||||
@@ -43,9 +43,9 @@ kubescape_object_failed_count{framework="NSA",control="Immutable container files
|
||||
# Failed object from "NSA" control "Immutable container filesystem"
|
||||
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1
|
||||
# Failed object from "NSA" control "Immutable container filesystem"
|
||||
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
|
||||
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
|
||||
# Failed object from "NSA" control "Immutable container filesystem"
|
||||
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
|
||||
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
|
||||
# Number of resources found as part of NSA control Privileged container
|
||||
kubescape_resources_found_count{framework="NSA",control="Privileged container"} 22
|
||||
# Number of resources excluded as part of NSA control Privileged container
|
||||
@@ -67,7 +67,7 @@ kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespa
|
||||
# Failed object from "NSA" control "Allowed hostPath"
|
||||
kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1/Pod"} 1
|
||||
# Failed object from "NSA" control "Allowed hostPath"
|
||||
kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
|
||||
kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "NSA" control "Allowed hostPath"
|
||||
kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespace="cyberarmor-system",name="ca-websocket",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "NSA" control "Allowed hostPath"
|
||||
@@ -157,11 +157,11 @@ kubescape_object_failed_count{framework="NSA",control="Automatic mapping of serv
|
||||
# Failed object from "NSA" control "Automatic mapping of service account"
|
||||
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="v1/ServiceAccount"} 1
|
||||
# Failed object from "NSA" control "Automatic mapping of service account"
|
||||
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="armo-system",name="armo-kubescape-service-account",groupVersionKind="v1/ServiceAccount"} 1
|
||||
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kubescape",name="armo-kubescape-service-account",groupVersionKind="v1/ServiceAccount"} 1
|
||||
# Failed object from "NSA" control "Automatic mapping of service account"
|
||||
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="armo-system",name="armo-scanner-service-account",groupVersionKind="v1/ServiceAccount"} 1
|
||||
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kubescape",name="armo-scanner-service-account",groupVersionKind="v1/ServiceAccount"} 1
|
||||
# Failed object from "NSA" control "Automatic mapping of service account"
|
||||
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="armo-system",name="default",groupVersionKind="v1/ServiceAccount"} 1
|
||||
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kubescape",name="default",groupVersionKind="v1/ServiceAccount"} 1
|
||||
# Failed object from "NSA" control "Automatic mapping of service account"
|
||||
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="cyberarmor-system",name="ca-controller-service-account",groupVersionKind="v1/ServiceAccount"} 1
|
||||
# Failed object from "NSA" control "Automatic mapping of service account"
|
||||
@@ -199,9 +199,9 @@ kubescape_resources_excluded_count{framework="NSA",control="Resource policies"}
|
||||
# Number of resources failed as part of NSA control Resource policies
|
||||
kubescape_resources_failed_count{framework="NSA",control="Resource policies"} 9
|
||||
# Failed object from "NSA" control "Resource policies"
|
||||
kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
|
||||
kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
|
||||
# Failed object from "NSA" control "Resource policies"
|
||||
kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
|
||||
kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
|
||||
# Failed object from "NSA" control "Resource policies"
|
||||
kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="kube-system",name="kube-apiserver-david-virtualbox",groupVersionKind="v1/Pod"} 1
|
||||
# Failed object from "NSA" control "Resource policies"
|
||||
@@ -233,9 +233,9 @@ kubescape_object_failed_count{framework="NSA",control="Allow privilege escalatio
|
||||
# Failed object from "NSA" control "Allow privilege escalation"
|
||||
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kube-system",name="etcd-david-virtualbox",groupVersionKind="v1/Pod"} 1
|
||||
# Failed object from "NSA" control "Allow privilege escalation"
|
||||
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
|
||||
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "NSA" control "Allow privilege escalation"
|
||||
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
|
||||
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "NSA" control "Allow privilege escalation"
|
||||
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="cyberarmor-system",name="ca-audit",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "NSA" control "Allow privilege escalation"
|
||||
@@ -261,9 +261,9 @@ kubescape_object_failed_count{framework="NSA",control="Allow privilege escalatio
|
||||
# Failed object from "NSA" control "Allow privilege escalation"
|
||||
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1
|
||||
# Failed object from "NSA" control "Allow privilege escalation"
|
||||
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
|
||||
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
|
||||
# Failed object from "NSA" control "Allow privilege escalation"
|
||||
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
|
||||
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
|
||||
# Number of resources found as part of NSA control Applications credentials in configuration files
|
||||
kubescape_resources_found_count{framework="NSA",control="Applications credentials in configuration files"} 44
|
||||
# Number of resources excluded as part of NSA control Applications credentials in configuration files
|
||||
@@ -271,7 +271,7 @@ kubescape_resources_excluded_count{framework="NSA",control="Applications credent
|
||||
# Number of resources failed as part of NSA control Applications credentials in configuration files
|
||||
kubescape_resources_failed_count{framework="NSA",control="Applications credentials in configuration files"} 8
|
||||
# Failed object from "NSA" control "Applications credentials in configuration files"
|
||||
kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="armo-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1
|
||||
kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="kubescape",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1
|
||||
# Failed object from "NSA" control "Applications credentials in configuration files"
|
||||
kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="cyberarmor-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1
|
||||
# Failed object from "NSA" control "Applications credentials in configuration files"
|
||||
@@ -331,9 +331,9 @@ kubescape_resources_failed_count{framework="NSA",control="Linux hardening"} 17
|
||||
# Failed object from "NSA" control "Linux hardening"
|
||||
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1/Pod"} 1
|
||||
# Failed object from "NSA" control "Linux hardening"
|
||||
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
|
||||
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "NSA" control "Linux hardening"
|
||||
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
|
||||
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "NSA" control "Linux hardening"
|
||||
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="cyberarmor-system",name="ca-posture",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "NSA" control "Linux hardening"
|
||||
@@ -359,9 +359,9 @@ kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespac
|
||||
# Failed object from "NSA" control "Linux hardening"
|
||||
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1
|
||||
# Failed object from "NSA" control "Linux hardening"
|
||||
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
|
||||
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
|
||||
# Failed object from "NSA" control "Linux hardening"
|
||||
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
|
||||
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
|
||||
# Number of resources found as part of NSA control Ingress and Egress blocked
|
||||
kubescape_resources_found_count{framework="NSA",control="Ingress and Egress blocked"} 22
|
||||
# Number of resources excluded as part of NSA control Ingress and Egress blocked
|
||||
@@ -379,9 +379,9 @@ kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocke
|
||||
# Failed object from "NSA" control "Ingress and Egress blocked"
|
||||
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1/Pod"} 1
|
||||
# Failed object from "NSA" control "Ingress and Egress blocked"
|
||||
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
|
||||
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "NSA" control "Ingress and Egress blocked"
|
||||
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
|
||||
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "NSA" control "Ingress and Egress blocked"
|
||||
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="cyberarmor-system",name="ca-rbac",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "NSA" control "Ingress and Egress blocked"
|
||||
@@ -409,9 +409,9 @@ kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocke
|
||||
# Failed object from "NSA" control "Ingress and Egress blocked"
|
||||
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1
|
||||
# Failed object from "NSA" control "Ingress and Egress blocked"
|
||||
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
|
||||
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
|
||||
# Failed object from "NSA" control "Ingress and Egress blocked"
|
||||
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
|
||||
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
|
||||
# Number of resources found as part of NSA control Network policies
|
||||
kubescape_resources_found_count{framework="NSA",control="Network policies"} 7
|
||||
# Number of resources excluded as part of NSA control Network policies
|
||||
@@ -429,7 +429,7 @@ kubescape_object_failed_count{framework="NSA",control="Network policies",name="k
|
||||
# Failed object from "NSA" control "Network policies"
|
||||
kubescape_object_failed_count{framework="NSA",control="Network policies",name="nginx-ingress",groupVersionKind="v1/Namespace"} 1
|
||||
# Failed object from "NSA" control "Network policies"
|
||||
kubescape_object_failed_count{framework="NSA",control="Network policies",name="armo-system",groupVersionKind="v1/Namespace"} 1
|
||||
kubescape_object_failed_count{framework="NSA",control="Network policies",name="kubescape",groupVersionKind="v1/Namespace"} 1
|
||||
# Failed object from "NSA" control "Network policies"
|
||||
kubescape_object_failed_count{framework="NSA",control="Network policies",name="cyberarmor-system",groupVersionKind="v1/Namespace"} 1
|
||||
# Number of resources found as part of NSA control CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability
|
||||
@@ -449,7 +449,7 @@ kubescape_resources_failed_count{framework="MITRE",control="Access container ser
|
||||
# Failed object from "MITRE" control "Access container service account"
|
||||
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1
|
||||
# Failed object from "MITRE" control "Access container service account"
|
||||
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
|
||||
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
|
||||
# Failed object from "MITRE" control "Access container service account"
|
||||
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="kube-system",name="system:persistent-volume-provisioner",groupVersionKind="rbac.authorization.k8s.io/v1/RoleBinding"} 1
|
||||
# Failed object from "MITRE" control "Access container service account"
|
||||
@@ -505,9 +505,9 @@ kubescape_object_failed_count{framework="MITRE",control="Access container servic
|
||||
# Failed object from "MITRE" control "Access container service account"
|
||||
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "MITRE" control "Access container service account"
|
||||
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
|
||||
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "MITRE" control "Access container service account"
|
||||
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
|
||||
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Number of resources found as part of MITRE control Applications credentials in configuration files
|
||||
kubescape_resources_found_count{framework="MITRE",control="Applications credentials in configuration files"} 44
|
||||
# Number of resources excluded as part of MITRE control Applications credentials in configuration files
|
||||
@@ -521,7 +521,7 @@ kubescape_object_failed_count{framework="MITRE",control="Applications credential
|
||||
# Failed object from "MITRE" control "Applications credentials in configuration files"
|
||||
kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="kube-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1
|
||||
# Failed object from "MITRE" control "Applications credentials in configuration files"
|
||||
kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="armo-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1
|
||||
kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="kubescape",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1
|
||||
# Failed object from "MITRE" control "Applications credentials in configuration files"
|
||||
kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="cyberarmor-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1
|
||||
# Failed object from "MITRE" control "Applications credentials in configuration files"
|
||||
@@ -551,7 +551,7 @@ kubescape_resources_excluded_count{framework="MITRE",control="Cluster internal n
|
||||
# Number of resources failed as part of MITRE control Cluster internal networking
|
||||
kubescape_resources_failed_count{framework="MITRE",control="Cluster internal networking"} 7
|
||||
# Failed object from "MITRE" control "Cluster internal networking"
|
||||
kubescape_object_failed_count{framework="MITRE",control="Cluster internal networking",name="armo-system",groupVersionKind="v1/Namespace"} 1
|
||||
kubescape_object_failed_count{framework="MITRE",control="Cluster internal networking",name="kubescape",groupVersionKind="v1/Namespace"} 1
|
||||
# Failed object from "MITRE" control "Cluster internal networking"
|
||||
kubescape_object_failed_count{framework="MITRE",control="Cluster internal networking",name="cyberarmor-system",groupVersionKind="v1/Namespace"} 1
|
||||
# Failed object from "MITRE" control "Cluster internal networking"
|
||||
@@ -593,7 +593,7 @@ kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespa
|
||||
# Failed object from "MITRE" control "hostPath mount"
|
||||
kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="kube-system",name="kube-scheduler-david-virtualbox",groupVersionKind="v1/Pod"} 1
|
||||
# Failed object from "MITRE" control "hostPath mount"
|
||||
kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
|
||||
kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "MITRE" control "hostPath mount"
|
||||
kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="cyberarmor-system",name="ca-webhook",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "MITRE" control "hostPath mount"
|
||||
@@ -605,9 +605,9 @@ kubescape_resources_excluded_count{framework="MITRE",control="Kubernetes CronJob
|
||||
# Number of resources failed as part of MITRE control Kubernetes CronJob
|
||||
kubescape_resources_failed_count{framework="MITRE",control="Kubernetes CronJob"} 2
|
||||
# Failed object from "MITRE" control "Kubernetes CronJob"
|
||||
kubescape_object_failed_count{framework="MITRE",control="Kubernetes CronJob",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
|
||||
kubescape_object_failed_count{framework="MITRE",control="Kubernetes CronJob",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
|
||||
# Failed object from "MITRE" control "Kubernetes CronJob"
|
||||
kubescape_object_failed_count{framework="MITRE",control="Kubernetes CronJob",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
|
||||
kubescape_object_failed_count{framework="MITRE",control="Kubernetes CronJob",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
|
||||
# Number of resources found as part of MITRE control List Kubernetes secrets
|
||||
kubescape_resources_found_count{framework="MITRE",control="List Kubernetes secrets"} 74
|
||||
# Number of resources excluded as part of MITRE control List Kubernetes secrets
|
||||
@@ -617,9 +617,9 @@ kubescape_resources_failed_count{framework="MITRE",control="List Kubernetes secr
|
||||
# Failed object from "MITRE" control "List Kubernetes secrets"
|
||||
kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="/ServiceAccount"} 1
|
||||
# Failed object from "MITRE" control "List Kubernetes secrets"
|
||||
kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="armo-system",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1
|
||||
kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="kubescape",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1
|
||||
# Failed object from "MITRE" control "List Kubernetes secrets"
|
||||
kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="armo-system",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1
|
||||
kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="kubescape",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1
|
||||
# Failed object from "MITRE" control "List Kubernetes secrets"
|
||||
kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="cyberarmor-system",name="ca-controller-service-account",groupVersionKind="/ServiceAccount"} 1
|
||||
# Failed object from "MITRE" control "List Kubernetes secrets"
|
||||
@@ -661,7 +661,7 @@ kubescape_object_failed_count{framework="MITRE",control="Mount service principal
|
||||
# Failed object from "MITRE" control "Mount service principal"
|
||||
kubescape_object_failed_count{framework="MITRE",control="Mount service principal",namespace="cyberarmor-system",name="ca-websocket",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "MITRE" control "Mount service principal"
|
||||
kubescape_object_failed_count{framework="MITRE",control="Mount service principal",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
|
||||
kubescape_object_failed_count{framework="MITRE",control="Mount service principal",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Number of resources found as part of MITRE control Network mapping
|
||||
kubescape_resources_found_count{framework="MITRE",control="Network mapping"} 7
|
||||
# Number of resources excluded as part of MITRE control Network mapping
|
||||
@@ -669,7 +669,7 @@ kubescape_resources_excluded_count{framework="MITRE",control="Network mapping"}
|
||||
# Number of resources failed as part of MITRE control Network mapping
|
||||
kubescape_resources_failed_count{framework="MITRE",control="Network mapping"} 7
|
||||
# Failed object from "MITRE" control "Network mapping"
|
||||
kubescape_object_failed_count{framework="MITRE",control="Network mapping",name="armo-system",groupVersionKind="v1/Namespace"} 1
|
||||
kubescape_object_failed_count{framework="MITRE",control="Network mapping",name="kubescape",groupVersionKind="v1/Namespace"} 1
|
||||
# Failed object from "MITRE" control "Network mapping"
|
||||
kubescape_object_failed_count{framework="MITRE",control="Network mapping",name="cyberarmor-system",groupVersionKind="v1/Namespace"} 1
|
||||
# Failed object from "MITRE" control "Network mapping"
|
||||
@@ -705,7 +705,7 @@ kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount
|
||||
# Failed object from "MITRE" control "Writable hostPath mount"
|
||||
kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="kube-system",name="kube-controller-manager-david-virtualbox",groupVersionKind="v1/Pod"} 1
|
||||
# Failed object from "MITRE" control "Writable hostPath mount"
|
||||
kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
|
||||
kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "MITRE" control "Writable hostPath mount"
|
||||
kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="cyberarmor-system",name="ca-webhook",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "MITRE" control "Writable hostPath mount"
|
||||
@@ -855,15 +855,15 @@ kubescape_object_failed_count{framework="ArmoBest",control="Immutable container
|
||||
# Failed object from "ArmoBest" control "Immutable container filesystem"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "ArmoBest" control "Immutable container filesystem"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "ArmoBest" control "Immutable container filesystem"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "ArmoBest" control "Immutable container filesystem"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1
|
||||
# Failed object from "ArmoBest" control "Immutable container filesystem"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
|
||||
# Failed object from "ArmoBest" control "Immutable container filesystem"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
|
||||
# Number of resources found as part of ArmoBest control Privileged container
|
||||
kubescape_resources_found_count{framework="ArmoBest",control="Privileged container"} 22
|
||||
# Number of resources excluded as part of ArmoBest control Privileged container
|
||||
@@ -887,7 +887,7 @@ kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",na
|
||||
# Failed object from "ArmoBest" control "Allowed hostPath"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1/Pod"} 1
|
||||
# Failed object from "ArmoBest" control "Allowed hostPath"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "ArmoBest" control "Allowed hostPath"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",namespace="cyberarmor-system",name="ca-webhook",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "ArmoBest" control "Allowed hostPath"
|
||||
@@ -979,11 +979,11 @@ kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of
|
||||
# Failed object from "ArmoBest" control "Automatic mapping of service account"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="v1/ServiceAccount"} 1
|
||||
# Failed object from "ArmoBest" control "Automatic mapping of service account"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="armo-system",name="armo-kubescape-service-account",groupVersionKind="v1/ServiceAccount"} 1
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="kubescape",name="armo-kubescape-service-account",groupVersionKind="v1/ServiceAccount"} 1
|
||||
# Failed object from "ArmoBest" control "Automatic mapping of service account"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="armo-system",name="armo-scanner-service-account",groupVersionKind="v1/ServiceAccount"} 1
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="kubescape",name="armo-scanner-service-account",groupVersionKind="v1/ServiceAccount"} 1
|
||||
# Failed object from "ArmoBest" control "Automatic mapping of service account"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="armo-system",name="default",groupVersionKind="v1/ServiceAccount"} 1
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="kubescape",name="default",groupVersionKind="v1/ServiceAccount"} 1
|
||||
# Failed object from "ArmoBest" control "Automatic mapping of service account"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="cyberarmor-system",name="default",groupVersionKind="v1/ServiceAccount"} 1
|
||||
# Failed object from "ArmoBest" control "Automatic mapping of service account"
|
||||
@@ -1019,9 +1019,9 @@ kubescape_resources_failed_count{framework="ArmoBest",control="Resource policies
|
||||
# Failed object from "ArmoBest" control "Resource policies"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Resource policies",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1
|
||||
# Failed object from "ArmoBest" control "Resource policies"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Resource policies",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Resource policies",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
|
||||
# Failed object from "ArmoBest" control "Resource policies"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Resource policies",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Resource policies",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
|
||||
# Failed object from "ArmoBest" control "Resource policies"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Resource policies",namespace="kube-system",name="etcd-david-virtualbox",groupVersionKind="v1/Pod"} 1
|
||||
# Failed object from "ArmoBest" control "Resource policies"
|
||||
@@ -1051,9 +1051,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege esca
|
||||
# Failed object from "ArmoBest" control "Allow privilege escalation"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1/Pod"} 1
|
||||
# Failed object from "ArmoBest" control "Allow privilege escalation"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "ArmoBest" control "Allow privilege escalation"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "ArmoBest" control "Allow privilege escalation"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="cyberarmor-system",name="ca-webhook",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "ArmoBest" control "Allow privilege escalation"
|
||||
@@ -1079,9 +1079,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege esca
|
||||
# Failed object from "ArmoBest" control "Allow privilege escalation"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1
|
||||
# Failed object from "ArmoBest" control "Allow privilege escalation"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
|
||||
# Failed object from "ArmoBest" control "Allow privilege escalation"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
|
||||
# Number of resources found as part of ArmoBest control Applications credentials in configuration files
|
||||
kubescape_resources_found_count{framework="ArmoBest",control="Applications credentials in configuration files"} 44
|
||||
# Number of resources excluded as part of ArmoBest control Applications credentials in configuration files
|
||||
@@ -1089,7 +1089,7 @@ kubescape_resources_excluded_count{framework="ArmoBest",control="Applications cr
|
||||
# Number of resources failed as part of ArmoBest control Applications credentials in configuration files
|
||||
kubescape_resources_failed_count{framework="ArmoBest",control="Applications credentials in configuration files"} 8
|
||||
# Failed object from "ArmoBest" control "Applications credentials in configuration files"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="armo-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="kubescape",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1
|
||||
# Failed object from "ArmoBest" control "Applications credentials in configuration files"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="cyberarmor-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1
|
||||
# Failed object from "ArmoBest" control "Applications credentials in configuration files"
|
||||
@@ -1149,9 +1149,9 @@ kubescape_resources_failed_count{framework="ArmoBest",control="Linux hardening"}
|
||||
# Failed object from "ArmoBest" control "Linux hardening"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1/Pod"} 1
|
||||
# Failed object from "ArmoBest" control "Linux hardening"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "ArmoBest" control "Linux hardening"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "ArmoBest" control "Linux hardening"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="cyberarmor-system",name="ca-audit",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "ArmoBest" control "Linux hardening"
|
||||
@@ -1177,9 +1177,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",nam
|
||||
# Failed object from "ArmoBest" control "Linux hardening"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1
|
||||
# Failed object from "ArmoBest" control "Linux hardening"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
|
||||
# Failed object from "ArmoBest" control "Linux hardening"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
|
||||
# Number of resources found as part of ArmoBest control Ingress and Egress blocked
|
||||
kubescape_resources_found_count{framework="ArmoBest",control="Ingress and Egress blocked"} 22
|
||||
# Number of resources excluded as part of ArmoBest control Ingress and Egress blocked
|
||||
@@ -1187,9 +1187,9 @@ kubescape_resources_excluded_count{framework="ArmoBest",control="Ingress and Egr
|
||||
# Number of resources failed as part of ArmoBest control Ingress and Egress blocked
|
||||
kubescape_resources_failed_count{framework="ArmoBest",control="Ingress and Egress blocked"} 22
|
||||
# Failed object from "ArmoBest" control "Ingress and Egress blocked"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "ArmoBest" control "Ingress and Egress blocked"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "ArmoBest" control "Ingress and Egress blocked"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="cyberarmor-system",name="ca-notification-server",groupVersionKind="apps/v1/Deployment"} 1
|
||||
# Failed object from "ArmoBest" control "Ingress and Egress blocked"
|
||||
@@ -1217,9 +1217,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress b
|
||||
# Failed object from "ArmoBest" control "Ingress and Egress blocked"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1
|
||||
# Failed object from "ArmoBest" control "Ingress and Egress blocked"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
|
||||
# Failed object from "ArmoBest" control "Ingress and Egress blocked"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
|
||||
# Failed object from "ArmoBest" control "Ingress and Egress blocked"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="kube-system",name="kube-scheduler-david-virtualbox",groupVersionKind="v1/Pod"} 1
|
||||
# Failed object from "ArmoBest" control "Ingress and Egress blocked"
|
||||
@@ -1237,7 +1237,7 @@ kubescape_resources_excluded_count{framework="ArmoBest",control="Network policie
|
||||
# Number of resources failed as part of ArmoBest control Network policies
|
||||
kubescape_resources_failed_count{framework="ArmoBest",control="Network policies"} 7
|
||||
# Failed object from "ArmoBest" control "Network policies"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Network policies",name="armo-system",groupVersionKind="v1/Namespace"} 1
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Network policies",name="kubescape",groupVersionKind="v1/Namespace"} 1
|
||||
# Failed object from "ArmoBest" control "Network policies"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Network policies",name="cyberarmor-system",groupVersionKind="v1/Namespace"} 1
|
||||
# Failed object from "ArmoBest" control "Network policies"
|
||||
@@ -1289,9 +1289,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Portforwarding privi
|
||||
# Failed object from "ArmoBest" control "Portforwarding privileges"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Portforwarding privileges",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="/ServiceAccount"} 1
|
||||
# Failed object from "ArmoBest" control "Portforwarding privileges"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Portforwarding privileges",namespace="armo-system",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Portforwarding privileges",namespace="kubescape",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1
|
||||
# Failed object from "ArmoBest" control "Portforwarding privileges"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Portforwarding privileges",namespace="armo-system",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Portforwarding privileges",namespace="kubescape",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1
|
||||
# Failed object from "ArmoBest" control "Portforwarding privileges"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Portforwarding privileges",name="system:masters",groupVersionKind="rbac.authorization.k8s.io/Group"} 1
|
||||
# Number of resources found as part of ArmoBest control Image pull policy on latest image tag
|
||||
@@ -1301,9 +1301,9 @@ kubescape_resources_excluded_count{framework="ArmoBest",control="Image pull poli
|
||||
# Number of resources failed as part of ArmoBest control Image pull policy on latest image tag
|
||||
kubescape_resources_failed_count{framework="ArmoBest",control="Image pull policy on latest image tag"} 2
|
||||
# Failed object from "ArmoBest" control "Image pull policy on latest image tag"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Image pull policy on latest image tag",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Image pull policy on latest image tag",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1
|
||||
# Failed object from "ArmoBest" control "Image pull policy on latest image tag"
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Image pull policy on latest image tag",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
|
||||
kubescape_object_failed_count{framework="ArmoBest",control="Image pull policy on latest image tag",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1
|
||||
# Number of resources found as part of ArmoBest control Namespace without service accounts
|
||||
kubescape_resources_found_count{framework="ArmoBest",control="Namespace without service accounts"} 54
|
||||
# Number of resources excluded as part of ArmoBest control Namespace without service accounts
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
module github.com/armosec/kubescape/v2
|
||||
module github.com/kubescape/kubescape/v2
|
||||
|
||||
go 1.18
|
||||
|
||||
|
||||
@@ -149,7 +149,7 @@ curl --header "Content-Type: application/json" --request POST --data '{"hostScan
|
||||
```bash
|
||||
curl --header "Content-Type: application/json" \
|
||||
--request POST \
|
||||
--data '{"hostScanner":true, "submit":true, "includeNamespaces": ["ks-scanner"], "targetType": "framework", "targetNames": ["nsa"] }' \
|
||||
--data '{"hostScanner":true, "submit":true, "includeNamespaces": ["kubescape"], "targetType": "framework", "targetNames": ["nsa"] }' \
|
||||
http://127.0.0.1:8080/v1/scan
|
||||
```
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@ import hashlib
|
||||
import platform
|
||||
import subprocess
|
||||
|
||||
BASE_GETTER_CONST = "github.com/armosec/kubescape/v2/core/cautils/getter"
|
||||
BASE_GETTER_CONST = "github.com/kubescape/kubescape/v2/core/cautils/getter"
|
||||
|
||||
def checkStatus(status, msg):
|
||||
if status != 0:
|
||||
@@ -36,7 +36,7 @@ def main():
|
||||
|
||||
# Set some variables
|
||||
packageName = getPackageName()
|
||||
buildUrl = "github.com/armosec/kubescape/v2/core/cautils.BuildNumber"
|
||||
buildUrl = "github.com/kubescape/kubescape/v2/core/cautils.BuildNumber"
|
||||
releaseVersion = os.getenv("RELEASE")
|
||||
|
||||
# Create build directory
|
||||
|
||||
@@ -20,7 +20,7 @@ definitions:
|
||||
|
||||
Same as `kubescape scan --excluded-namespaces`.
|
||||
example:
|
||||
- armo-system
|
||||
- kubescape
|
||||
- kube-system
|
||||
items:
|
||||
type: string
|
||||
|
||||
@@ -4,7 +4,7 @@ kind: Namespace
|
||||
metadata:
|
||||
labels:
|
||||
app: kubescape
|
||||
name: ks-scanner
|
||||
name: kubescape
|
||||
---
|
||||
# ------------------- Kubescape Service Account ------------------- #
|
||||
apiVersion: v1
|
||||
@@ -13,7 +13,7 @@ metadata:
|
||||
labels:
|
||||
app: kubescape
|
||||
name: kubescape-discovery
|
||||
namespace: ks-scanner
|
||||
namespace: kubescape
|
||||
---
|
||||
# ------------------- Kubescape Cluster Role & Cluster Role Binding ------------------- #
|
||||
kind: ClusterRole
|
||||
@@ -38,13 +38,13 @@ roleRef:
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: kubescape-discovery
|
||||
namespace: ks-scanner
|
||||
namespace: kubescape
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: kubescape
|
||||
namespace: ks-scanner
|
||||
namespace: kubescape
|
||||
labels:
|
||||
app: kubescape
|
||||
spec:
|
||||
@@ -61,7 +61,7 @@ apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: kubescape
|
||||
namespace: ks-scanner
|
||||
namespace: kubescape
|
||||
labels:
|
||||
app: kubescape
|
||||
spec:
|
||||
@@ -89,7 +89,7 @@ spec:
|
||||
port: 8080
|
||||
initialDelaySeconds: 3
|
||||
periodSeconds: 3
|
||||
image: quay.io/armosec/kubescape:latest
|
||||
image: quay.io/kubescape/kubescape:latest
|
||||
imagePullPolicy: Always
|
||||
env:
|
||||
- name: KS_DEFAULT_CONFIGMAP_NAMESPACE
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user