diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 8c6721af..d5af1dd1 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -96,10 +96,6 @@ jobs: env: RELEASE: v2.0.${{ github.run_number }} CLIENT: release - ArmoBEServer: api.armo.cloud - ArmoAuthServer: auth.armo.cloud - ArmoERServer: report.armo.cloud - ArmoWebsite: portal.armo.cloud CGO_ENABLED: 1 run: python3 --version && python3 build.py @@ -134,7 +130,7 @@ jobs: name: Build docker container, tag and upload to registry needs: build runs-on: ubuntu-latest - if: ${{ github.repository == 'armosec/kubescape' }} # TODO + if: ${{ github.repository == 'kubescape/kubescape' }} # TODO permissions: id-token: write packages: write diff --git a/.github/workflows/build_dev.yaml b/.github/workflows/build_dev.yaml index 64888aa0..ad03b6d8 100644 --- a/.github/workflows/build_dev.yaml +++ b/.github/workflows/build_dev.yaml @@ -88,10 +88,6 @@ jobs: env: RELEASE: v2.0.${{ github.run_number }} CLIENT: release-dev - ArmoBEServer: api.armo.cloud - ArmoAuthServer: auth.armo.cloud - ArmoERServer: report.armo.cloud - ArmoWebsite: portal.armo.cloud CGO_ENABLED: 1 run: python3 --version && python3 build.py @@ -110,7 +106,7 @@ jobs: build-docker: name: Build docker container, tag and upload to registry needs: build - if: ${{ github.repository == 'armosec/kubescape' }} # TODO + if: ${{ github.repository == 'kubescape/kubescape' }} # TODO runs-on: ubuntu-latest permissions: id-token: write diff --git a/.github/workflows/pr_checks.yaml b/.github/workflows/pr_checks.yaml index b9e5aa5d..ca3c7b9d 100644 --- a/.github/workflows/pr_checks.yaml +++ b/.github/workflows/pr_checks.yaml @@ -81,10 +81,6 @@ jobs: env: RELEASE: v2.0.${{ github.run_number }} CLIENT: test - ArmoBEServer: api.armo.cloud - ArmoAuthServer: auth.armo.cloud - ArmoERServer: report.armo.cloud - ArmoWebsite: portal.armo.cloud CGO_ENABLED: 1 run: python3 --version && python3 build.py diff --git a/README.md b/README.md index f73f2bf0..4deb6bd6 100644 --- a/README.md +++ b/README.md @@ -1,9 +1,8 @@ logo -[![build](https://github.com/kubescape/kubescape/actions/workflows/build.yaml/badge.svg)](https://github.com/armosec/kubescape/actions/workflows/build.yaml) +[![build](https://github.com/kubescape/kubescape/actions/workflows/build.yaml/badge.svg)](https://github.com/kubescape/kubescape/actions/workflows/build.yaml) [![Go Report Card](https://goreportcard.com/badge/github.com/kubescape/kubescape)](https://goreportcard.com/report/github.com/kubescape/kubescape) - :sunglasses: [Want to contribute?](#being-a-part-of-the-team) :innocent: @@ -20,13 +19,10 @@ Kubescape integrates natively with other DevOps tools, including Jenkins, Circle
- - # TL;DR ## Install: ```sh -curl -s https://raw.githubusercontent.com/armosec/kubescape/master/install.sh | /bin/bash +curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | /bin/bash ``` [Install on windows](#install-on-windows) @@ -50,7 +46,7 @@ kubescape scan --submit --enable-host-scan --verbose
-### Click [πŸ‘](https://github.com/armosec/kubescape/stargazers) if you want us to continue to develop and improve Kubescape πŸ˜€ +### Click [πŸ‘](https://github.com/kubescape/kubescape/stargazers) if you want us to continue to develop and improve Kubescape πŸ˜€
@@ -86,14 +82,14 @@ Want to contribute? Want to discuss something? Have an issue? * [Configure and run customized frameworks](https://youtu.be/12Sanq_rEhs) * Customize control configurations. [Kubescape CLI](https://youtu.be/955psg6TVu4), [Kubescape SaaS](https://youtu.be/lIMVSVhH33o) -
Windows - ## Install on Windows +
Windows + **Requires powershell v5.0+** ``` powershell -iwr -useb https://raw.githubusercontent.com/armosec/kubescape/master/install.ps1 | iex +iwr -useb https://raw.githubusercontent.com/kubescape/kubescape/master/install.ps1 | iex ``` Note: if you get an error you might need to change the execution policy (i.e. enable Powershell) with @@ -103,10 +99,11 @@ Set-ExecutionPolicy RemoteSigned -scope CurrentUser ```
-
MacOS ## Install on macOS +
MacOS + 1. ```sh brew tap kubescape/tap ``` @@ -115,10 +112,10 @@ Set-ExecutionPolicy RemoteSigned -scope CurrentUser ```
-
Nix/NixOS - ## Install on NixOS or with nix (Community) +
Nix/NixOS + Direct issues installing `kubescape` via `nix` through the channels mentioned [here](https://nixos.wiki/wiki/Support) You can use `nix` on Linux or macOS and on other platforms unofficially. @@ -197,7 +194,7 @@ kubescape scan *.yaml --submit #### Scan kubernetes manifest files from a git repository [and submit the results](https://hub.armosec.io/docs/repository-scanning?utm_source=github&utm_medium=repository) ``` -kubescape scan https://github.com/armosec/kubescape --submit +kubescape scan https://github.com/kubescape/kubescape --submit ``` #### Display all scanned resources (including the resources which passed) @@ -295,9 +292,9 @@ View Kubescape scan results directly in [Lens IDE](https://k8slens.dev/) using k # Building Kubescape -
Windows +## Build on Windows -## Windows +
Windows 1. Install MSYS2 & build libgit _(needed only for the first time)_ @@ -320,9 +317,9 @@ View Kubescape scan results directly in [Lens IDE](https://k8slens.dev/) using k ```
-
Linux / MacOS +## Build on Linux/MacOS -## Linux / MacOS +
Linux / MacOS 1. Install libgit2 dependency _(needed only for the first time)_ @@ -408,7 +405,7 @@ The results by default are printed in a pretty "console friendly" manner, but th Kubescape is an open source project, we welcome your feedback and ideas for improvement. We’re also aiming to collaborate with the Kubernetes community to help make the tests more robust and complete as Kubernetes develops. ## Thanks to all the contributors ❀️ - - + + diff --git a/build.py b/build.py index 786edc1c..a1ad193b 100644 --- a/build.py +++ b/build.py @@ -4,7 +4,7 @@ import hashlib import platform import subprocess -BASE_GETTER_CONST = "github.com/armosec/kubescape/v2/core/cautils/getter" +BASE_GETTER_CONST = "github.com/kubescape/kubescape/v2/core/cautils/getter" def check_status(status, msg): if status != 0: @@ -35,10 +35,10 @@ def main(): # Set some variables package_name = get_package_name() - build_url = "github.com/armosec/kubescape/v2/core/cautils.BuildNumber" + build_url = "github.com/kubescape/kubescape/v2/core/cautils.BuildNumber" release_version = os.getenv("RELEASE") - client_var = "github.com/armosec/kubescape/v2/core/cautils.Client" + client_var = "github.com/kubescape/kubescape/v2/core/cautils.Client" client_name = os.getenv("CLIENT") # Create build directory diff --git a/build/README.md b/build/README.md index 581416f2..89cef4d2 100644 --- a/build/README.md +++ b/build/README.md @@ -4,7 +4,7 @@ 1. Clone Project ``` -git clone https://github.com/armosec/kubescape.git kubescape && cd "$_" +git clone https://github.com/kubescape/kubescape.git kubescape && cd "$_" ``` 2. Build diff --git a/cmd/config/config.go b/cmd/config/config.go index 9b48aee5..9259bc64 100644 --- a/cmd/config/config.go +++ b/cmd/config/config.go @@ -1,7 +1,7 @@ package config import ( - "github.com/armosec/kubescape/v2/core/meta" + "github.com/kubescape/kubescape/v2/core/meta" "github.com/spf13/cobra" ) diff --git a/cmd/config/delete.go b/cmd/config/delete.go index ded9f1a7..eb71db3f 100644 --- a/cmd/config/delete.go +++ b/cmd/config/delete.go @@ -1,9 +1,9 @@ package config import ( - "github.com/armosec/kubescape/v2/core/meta" - v1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1" - logger "github.com/dwertent/go-logger" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/kubescape/v2/core/meta" + v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1" "github.com/spf13/cobra" ) diff --git a/cmd/config/set.go b/cmd/config/set.go index 83a10023..4bcca3e6 100644 --- a/cmd/config/set.go +++ b/cmd/config/set.go @@ -4,9 +4,9 @@ import ( "fmt" "strings" - "github.com/armosec/kubescape/v2/core/meta" - metav1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1" - logger "github.com/dwertent/go-logger" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/kubescape/v2/core/meta" + metav1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1" "github.com/spf13/cobra" ) diff --git a/cmd/config/view.go b/cmd/config/view.go index f8322c34..cb46bf85 100644 --- a/cmd/config/view.go +++ b/cmd/config/view.go @@ -3,9 +3,9 @@ package config import ( "os" - "github.com/armosec/kubescape/v2/core/meta" - v1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1" - logger "github.com/dwertent/go-logger" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/kubescape/v2/core/meta" + v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1" "github.com/spf13/cobra" ) diff --git a/cmd/delete/delete.go b/cmd/delete/delete.go index 459bed1c..1967889c 100644 --- a/cmd/delete/delete.go +++ b/cmd/delete/delete.go @@ -1,8 +1,8 @@ package delete import ( - "github.com/armosec/kubescape/v2/core/meta" - v1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1" + "github.com/kubescape/kubescape/v2/core/meta" + v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1" "github.com/spf13/cobra" ) diff --git a/cmd/delete/exceptions.go b/cmd/delete/exceptions.go index 2efb518a..4d1787b3 100644 --- a/cmd/delete/exceptions.go +++ b/cmd/delete/exceptions.go @@ -4,9 +4,9 @@ import ( "fmt" "strings" - "github.com/armosec/kubescape/v2/core/meta" - v1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1" - logger "github.com/dwertent/go-logger" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/kubescape/v2/core/meta" + v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1" "github.com/spf13/cobra" ) diff --git a/cmd/download/download.go b/cmd/download/download.go index 2114c3cb..89106eed 100644 --- a/cmd/download/download.go +++ b/cmd/download/download.go @@ -5,11 +5,11 @@ import ( "path/filepath" "strings" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/core" - "github.com/armosec/kubescape/v2/core/meta" - v1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1" - logger "github.com/dwertent/go-logger" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/core" + "github.com/kubescape/kubescape/v2/core/meta" + v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1" "github.com/spf13/cobra" ) diff --git a/cmd/list/list.go b/cmd/list/list.go index 2798d6e9..f02235da 100644 --- a/cmd/list/list.go +++ b/cmd/list/list.go @@ -4,11 +4,11 @@ import ( "fmt" "strings" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/core" - "github.com/armosec/kubescape/v2/core/meta" - v1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1" - logger "github.com/dwertent/go-logger" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/core" + "github.com/kubescape/kubescape/v2/core/meta" + v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1" "github.com/spf13/cobra" ) diff --git a/cmd/root.go b/cmd/root.go index 11e906f3..a94c5f5e 100644 --- a/cmd/root.go +++ b/cmd/root.go @@ -4,20 +4,20 @@ import ( "fmt" "strings" - "github.com/armosec/kubescape/v2/cmd/completion" - "github.com/armosec/kubescape/v2/cmd/config" - "github.com/armosec/kubescape/v2/cmd/delete" - "github.com/armosec/kubescape/v2/cmd/download" - "github.com/armosec/kubescape/v2/cmd/list" - "github.com/armosec/kubescape/v2/cmd/scan" - "github.com/armosec/kubescape/v2/cmd/submit" - "github.com/armosec/kubescape/v2/cmd/version" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/cautils/getter" - "github.com/armosec/kubescape/v2/core/core" - "github.com/armosec/kubescape/v2/core/meta" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/kubescape/v2/cmd/completion" + "github.com/kubescape/kubescape/v2/cmd/config" + "github.com/kubescape/kubescape/v2/cmd/delete" + "github.com/kubescape/kubescape/v2/cmd/download" + "github.com/kubescape/kubescape/v2/cmd/list" + "github.com/kubescape/kubescape/v2/cmd/scan" + "github.com/kubescape/kubescape/v2/cmd/submit" + "github.com/kubescape/kubescape/v2/cmd/version" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/cautils/getter" + "github.com/kubescape/kubescape/v2/core/core" + "github.com/kubescape/kubescape/v2/core/meta" "github.com/spf13/cobra" ) @@ -51,8 +51,8 @@ func getRootCmd(ks meta.IKubescape) *cobra.Command { Example: ksExamples, } - rootCmd.PersistentFlags().StringVar(&rootInfo.ArmoBEURLsDep, "environment", "", envFlagUsage) - rootCmd.PersistentFlags().StringVar(&rootInfo.ArmoBEURLs, "env", "", envFlagUsage) + rootCmd.PersistentFlags().StringVar(&rootInfo.KSCloudBEURLsDep, "environment", "", envFlagUsage) + rootCmd.PersistentFlags().StringVar(&rootInfo.KSCloudBEURLs, "env", "", envFlagUsage) rootCmd.PersistentFlags().MarkDeprecated("environment", "use 'env' instead") rootCmd.PersistentFlags().MarkHidden("environment") rootCmd.PersistentFlags().MarkHidden("env") diff --git a/cmd/rootutils.go b/cmd/rootutils.go index 4cec8c4e..cf6e533f 100644 --- a/cmd/rootutils.go +++ b/cmd/rootutils.go @@ -5,9 +5,9 @@ import ( "os" "strings" - "github.com/armosec/kubescape/v2/core/cautils/getter" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/kubescape/v2/core/cautils/getter" "github.com/mattn/go-isatty" ) @@ -55,10 +55,10 @@ func initCacheDir() { logger.L().Debug("cache dir updated", helpers.String("path", getter.DefaultLocalStore)) } func initEnvironment() { - if rootInfo.ArmoBEURLs == "" { - rootInfo.ArmoBEURLs = rootInfo.ArmoBEURLsDep + if rootInfo.KSCloudBEURLs == "" { + rootInfo.KSCloudBEURLs = rootInfo.KSCloudBEURLsDep } - urlSlices := strings.Split(rootInfo.ArmoBEURLs, ",") + urlSlices := strings.Split(rootInfo.KSCloudBEURLs, ",") if len(urlSlices) != 1 && len(urlSlices) < 3 { logger.L().Fatal("expected at least 3 URLs (report, api, frontend, auth)") } @@ -66,24 +66,24 @@ func initEnvironment() { case 1: switch urlSlices[0] { case "dev", "development": - getter.SetARMOAPIConnector(getter.NewARMOAPIDev()) + getter.SetKSCloudAPIConnector(getter.NewKSCloudAPIDev()) case "stage", "staging": - getter.SetARMOAPIConnector(getter.NewARMOAPIStaging()) + getter.SetKSCloudAPIConnector(getter.NewKSCloudAPIStaging()) case "": - getter.SetARMOAPIConnector(getter.NewARMOAPIProd()) + getter.SetKSCloudAPIConnector(getter.NewKSCloudAPIProd()) default: logger.L().Fatal("--environment flag usage: " + envFlagUsage) } case 2: logger.L().Fatal("--environment flag usage: " + envFlagUsage) case 3, 4: - var armoAUTHURL string - armoERURL := urlSlices[0] // mandatory - armoBEURL := urlSlices[1] // mandatory - armoFEURL := urlSlices[2] // mandatory + var ksAuthURL string + ksEventReceiverURL := urlSlices[0] // mandatory + ksBackendURL := urlSlices[1] // mandatory + ksFrontendURL := urlSlices[2] // mandatory if len(urlSlices) >= 4 { - armoAUTHURL = urlSlices[3] + ksAuthURL = urlSlices[3] } - getter.SetARMOAPIConnector(getter.NewARMOAPICustomized(armoERURL, armoBEURL, armoFEURL, armoAUTHURL)) + getter.SetKSCloudAPIConnector(getter.NewKSCloudAPICustomized(ksEventReceiverURL, ksBackendURL, ksFrontendURL, ksAuthURL)) } } diff --git a/cmd/scan/control.go b/cmd/scan/control.go index fb9b84a9..8de9d66c 100644 --- a/cmd/scan/control.go +++ b/cmd/scan/control.go @@ -6,12 +6,12 @@ import ( "os" "strings" - apisv1 "github.com/armosec/opa-utils/httpserver/apis/v1" + apisv1 "github.com/kubescape/opa-utils/httpserver/apis/v1" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/meta" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/meta" "github.com/enescakir/emoji" "github.com/spf13/cobra" diff --git a/cmd/scan/framework.go b/cmd/scan/framework.go index 00399c0f..5a50b628 100644 --- a/cmd/scan/framework.go +++ b/cmd/scan/framework.go @@ -6,12 +6,12 @@ import ( "os" "strings" - apisv1 "github.com/armosec/opa-utils/httpserver/apis/v1" + apisv1 "github.com/kubescape/opa-utils/httpserver/apis/v1" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/meta" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/meta" "github.com/enescakir/emoji" "github.com/spf13/cobra" diff --git a/cmd/scan/scan.go b/cmd/scan/scan.go index 63bbe5ba..251bb769 100644 --- a/cmd/scan/scan.go +++ b/cmd/scan/scan.go @@ -3,9 +3,9 @@ package scan import ( "fmt" - "github.com/armosec/k8s-interface/k8sinterface" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/meta" + "github.com/kubescape/k8s-interface/k8sinterface" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/meta" "github.com/spf13/cobra" ) @@ -93,7 +93,7 @@ func GetScanCommand(ks meta.IKubescape) *cobra.Command { scanCmd.PersistentFlags().MarkHidden("silent") // this flag should be deprecated since we added the --logger support // scanCmd.PersistentFlags().MarkHidden("format-version") // meant for testing different output approaches and not for common use - hostF := scanCmd.PersistentFlags().VarPF(&scanInfo.HostSensorEnabled, "enable-host-scan", "", "Deploy ARMO K8s host-sensor daemonset in the scanned cluster. Deleting it right after we collecting the data. Required to collect valuable data from cluster nodes for certain controls. Yaml file: https://github.com/armosec/kubescape/blob/master/core/pkg/hostsensorutils/hostsensor.yaml") + hostF := scanCmd.PersistentFlags().VarPF(&scanInfo.HostSensorEnabled, "enable-host-scan", "", "Deploy ARMO K8s host-sensor daemonset in the scanned cluster. Deleting it right after we collecting the data. Required to collect valuable data from cluster nodes for certain controls. Yaml file: https://github.com/kubescape/kubescape/blob/master/core/pkg/hostsensorutils/hostsensor.yaml") hostF.NoOptDefVal = "true" hostF.DefValue = "false, for no TTY in stdin" diff --git a/cmd/submit/exceptions.go b/cmd/submit/exceptions.go index 266b87d1..fade70da 100644 --- a/cmd/submit/exceptions.go +++ b/cmd/submit/exceptions.go @@ -3,9 +3,9 @@ package submit import ( "fmt" - "github.com/armosec/kubescape/v2/core/meta" - metav1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1" - logger "github.com/dwertent/go-logger" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/kubescape/v2/core/meta" + metav1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1" "github.com/spf13/cobra" ) diff --git a/cmd/submit/rbac.go b/cmd/submit/rbac.go index c43995e1..b0f33a14 100644 --- a/cmd/submit/rbac.go +++ b/cmd/submit/rbac.go @@ -3,18 +3,18 @@ package submit import ( "fmt" - "github.com/armosec/k8s-interface/k8sinterface" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/cautils/getter" - "github.com/armosec/kubescape/v2/core/meta" - "github.com/armosec/kubescape/v2/core/meta/cliinterfaces" - v1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1" - reporterv2 "github.com/armosec/kubescape/v2/core/pkg/resultshandling/reporter/v2" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" "github.com/google/uuid" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/k8s-interface/k8sinterface" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/cautils/getter" + "github.com/kubescape/kubescape/v2/core/meta" + "github.com/kubescape/kubescape/v2/core/meta/cliinterfaces" + v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1" + reporterv2 "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/reporter/v2" - "github.com/armosec/rbac-utils/rbacscanner" + "github.com/kubescape/rbac-utils/rbacscanner" "github.com/spf13/cobra" ) @@ -79,7 +79,7 @@ func getKubernetesApi() *k8sinterface.KubernetesApi { } func getTenantConfig(credentials *cautils.Credentials, clusterName string, k8s *k8sinterface.KubernetesApi) cautils.ITenantConfig { if !k8sinterface.IsConnectedToCluster() || k8s == nil { - return cautils.NewLocalConfig(getter.GetArmoAPIConnector(), credentials, clusterName) + return cautils.NewLocalConfig(getter.GetKSCloudAPIConnector(), credentials, clusterName) } - return cautils.NewClusterConfig(k8s, getter.GetArmoAPIConnector(), credentials, clusterName) + return cautils.NewClusterConfig(k8s, getter.GetKSCloudAPIConnector(), credentials, clusterName) } diff --git a/cmd/submit/results.go b/cmd/submit/results.go index a4ed0607..c8aa2430 100644 --- a/cmd/submit/results.go +++ b/cmd/submit/results.go @@ -5,16 +5,16 @@ import ( "fmt" "os" - reporthandlingv2 "github.com/armosec/opa-utils/reporthandling/v2" "github.com/google/uuid" + reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2" - "github.com/armosec/k8s-interface/workloadinterface" - "github.com/armosec/kubescape/v2/core/meta" - "github.com/armosec/kubescape/v2/core/meta/cliinterfaces" - v1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1" - reporterv2 "github.com/armosec/kubescape/v2/core/pkg/resultshandling/reporter/v2" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/k8s-interface/workloadinterface" + "github.com/kubescape/kubescape/v2/core/meta" + "github.com/kubescape/kubescape/v2/core/meta/cliinterfaces" + v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1" + reporterv2 "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/reporter/v2" "github.com/spf13/cobra" ) diff --git a/cmd/submit/submit.go b/cmd/submit/submit.go index f0e4b7a6..158f9b37 100644 --- a/cmd/submit/submit.go +++ b/cmd/submit/submit.go @@ -1,8 +1,8 @@ package submit import ( - "github.com/armosec/kubescape/v2/core/meta" - metav1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1" + "github.com/kubescape/kubescape/v2/core/meta" + metav1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1" "github.com/spf13/cobra" ) diff --git a/cmd/version/version.go b/cmd/version/version.go index e6de3290..e5cc8b13 100644 --- a/cmd/version/version.go +++ b/cmd/version/version.go @@ -4,7 +4,7 @@ import ( "fmt" "os" - "github.com/armosec/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/cautils" "github.com/spf13/cobra" ) diff --git a/core/cautils/customerloader.go b/core/cautils/customerloader.go index 35b726f0..a7bbb0e9 100644 --- a/core/cautils/customerloader.go +++ b/core/cautils/customerloader.go @@ -9,9 +9,9 @@ import ( metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "github.com/armosec/k8s-interface/k8sinterface" - "github.com/armosec/kubescape/v2/core/cautils/getter" - logger "github.com/dwertent/go-logger" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/k8s-interface/k8sinterface" + "github.com/kubescape/kubescape/v2/core/cautils/getter" corev1 "k8s.io/api/core/v1" ) @@ -124,7 +124,7 @@ func (lc *LocalConfig) GetToken() string { return lc.configObj.Token } func (lc *LocalConfig) IsConfigFound() bool { return existsConfigFile() } func (lc *LocalConfig) SetTenant() error { - // ARMO tenant GUID + // Kubescape Cloud tenant GUID if err := getTenantConfigFromBE(lc.backendAPI, lc.configObj); err != nil { return err } @@ -145,7 +145,7 @@ func (lc *LocalConfig) DeleteCachedConfig() error { func getTenantConfigFromBE(backendAPI getter.IBackend, configObj *ConfigObj) error { - // get from armoBE + // get from Kubescape Cloud API tenantResponse, err := backendAPI.GetTenant() if err == nil && tenantResponse != nil { if tenantResponse.AdminMail != "" { // registered tenant diff --git a/core/cautils/datastructures.go b/core/cautils/datastructures.go index ed9e6d03..39946da8 100644 --- a/core/cautils/datastructures.go +++ b/core/cautils/datastructures.go @@ -2,20 +2,20 @@ package cautils import ( "github.com/armosec/armoapi-go/armotypes" - "github.com/armosec/k8s-interface/workloadinterface" - "github.com/armosec/opa-utils/reporthandling" - apis "github.com/armosec/opa-utils/reporthandling/apis" - "github.com/armosec/opa-utils/reporthandling/results/v1/resourcesresults" - reporthandlingv2 "github.com/armosec/opa-utils/reporthandling/v2" + "github.com/kubescape/k8s-interface/workloadinterface" + "github.com/kubescape/opa-utils/reporthandling" + apis "github.com/kubescape/opa-utils/reporthandling/apis" + "github.com/kubescape/opa-utils/reporthandling/results/v1/resourcesresults" + reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2" ) // K8SResources map[//][] type K8SResources map[string][]string -type ArmoResources map[string][]string +type KSResources map[string][]string type OPASessionObj struct { K8SResources *K8SResources // input k8s objects - ArmoResource *ArmoResources // input ARMO objects + ArmoResource *KSResources // input ARMO objects Policies []reporthandling.Framework // list of frameworks to scan AllResources map[string]workloadinterface.IMetadata // all scanned resources, map[] ResourcesResult map[string]resourcesresults.Result // resources scan results, map[] @@ -44,6 +44,23 @@ func NewOPASessionObj(frameworks []reporthandling.Framework, k8sResources *K8SRe } } +func (sessionObj *OPASessionObj) SetMapNamespaceToNumberOfResources(mapNamespaceToNumberOfResources map[string]int) { + if sessionObj.Metadata.ContextMetadata.ClusterContextMetadata == nil { + sessionObj.Metadata.ContextMetadata.ClusterContextMetadata = &reporthandlingv2.ClusterMetadata{} + } + if sessionObj.Metadata.ContextMetadata.ClusterContextMetadata.MapNamespaceToNumberOfResources == nil { + sessionObj.Metadata.ContextMetadata.ClusterContextMetadata.MapNamespaceToNumberOfResources = make(map[string]int) + } + sessionObj.Metadata.ContextMetadata.ClusterContextMetadata.MapNamespaceToNumberOfResources = mapNamespaceToNumberOfResources +} + +func (sessionObj *OPASessionObj) SetNumberOfWorkerNodes(n int) { + if sessionObj.Metadata.ContextMetadata.ClusterContextMetadata == nil { + sessionObj.Metadata.ContextMetadata.ClusterContextMetadata = &reporthandlingv2.ClusterMetadata{} + } + sessionObj.Metadata.ContextMetadata.ClusterContextMetadata.NumberOfWorkerNodes = n +} + func NewOPASessionObjMock() *OPASessionObj { return &OPASessionObj{ Policies: nil, diff --git a/core/cautils/datastructuresmethods.go b/core/cautils/datastructuresmethods.go index 481b231d..83f2e790 100644 --- a/core/cautils/datastructuresmethods.go +++ b/core/cautils/datastructuresmethods.go @@ -3,8 +3,8 @@ package cautils import ( "golang.org/x/mod/semver" - "github.com/armosec/opa-utils/reporthandling" "github.com/armosec/utils-go/boolutils" + "github.com/kubescape/opa-utils/reporthandling" ) func NewPolicies() *Policies { @@ -22,7 +22,7 @@ func (policies *Policies) Set(frameworks []reporthandling.Framework, version str for j := range frameworks[i].Controls { compatibleRules := []reporthandling.PolicyRule{} for r := range frameworks[i].Controls[j].Rules { - if !ruleWithArmoOpaDependency(frameworks[i].Controls[j].Rules[r].Attributes) && isRuleKubescapeVersionCompatible(frameworks[i].Controls[j].Rules[r].Attributes, version) { + if !ruleWithKSOpaDependency(frameworks[i].Controls[j].Rules[r].Attributes) && isRuleKubescapeVersionCompatible(frameworks[i].Controls[j].Rules[r].Attributes, version) { compatibleRules = append(compatibleRules, frameworks[i].Controls[j].Rules[r]) } } @@ -35,7 +35,7 @@ func (policies *Policies) Set(frameworks []reporthandling.Framework, version str } } -func ruleWithArmoOpaDependency(attributes map[string]interface{}) bool { +func ruleWithKSOpaDependency(attributes map[string]interface{}) bool { if attributes == nil { return false } diff --git a/core/cautils/environments.go b/core/cautils/environments.go index 44e904e3..29c74652 100644 --- a/core/cautils/environments.go +++ b/core/cautils/environments.go @@ -1,6 +1,6 @@ package cautils -// CA environment vars +// Kubescape Cloud environment vars var ( CustomerGUID = "" ClusterName = "" diff --git a/core/cautils/fileutils.go b/core/cautils/fileutils.go index d728346a..6d1fbc60 100644 --- a/core/cautils/fileutils.go +++ b/core/cautils/fileutils.go @@ -8,12 +8,12 @@ import ( "path/filepath" "strings" - "github.com/armosec/k8s-interface/workloadinterface" - "github.com/dwertent/go-logger/helpers" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/k8s-interface/workloadinterface" - "github.com/armosec/opa-utils/objectsenvelopes" - "github.com/armosec/opa-utils/objectsenvelopes/localworkload" - logger "github.com/dwertent/go-logger" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/opa-utils/objectsenvelopes" + "github.com/kubescape/opa-utils/objectsenvelopes/localworkload" "gopkg.in/yaml.v2" ) diff --git a/core/cautils/fileutils_test.go b/core/cautils/fileutils_test.go index 07647f96..4deb0107 100644 --- a/core/cautils/fileutils_test.go +++ b/core/cautils/fileutils_test.go @@ -6,7 +6,7 @@ import ( "strings" "testing" - "github.com/armosec/opa-utils/objectsenvelopes/localworkload" + "github.com/kubescape/opa-utils/objectsenvelopes/localworkload" "github.com/stretchr/testify/assert" ) diff --git a/core/cautils/getter/armoapi.go b/core/cautils/getter/armoapi.go deleted file mode 100644 index af55d3fe..00000000 --- a/core/cautils/getter/armoapi.go +++ /dev/null @@ -1,371 +0,0 @@ -package getter - -import ( - "bytes" - "encoding/json" - "fmt" - "io/ioutil" - "net/http" - "strings" - "time" - - "github.com/armosec/armoapi-go/armotypes" - "github.com/armosec/opa-utils/reporthandling" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" -) - -// ======================================================================================================================= -// =============================================== ArmoAPI =============================================================== -// ======================================================================================================================= - -var ( - // ATTENTION!!! - // Changes in this URLs variable names, or in the usage is affecting the build process! BE CAREFUL - armoERURL = "report.armo.cloud" - armoBEURL = "api.armosec.io" - armoFEURL = "cloud.armosec.io" - armoAUTHURL = "auth.armosec.io" - - armoStageERURL = "report-ks.eustage2.cyberarmorsoft.com" - armoStageBEURL = "api-stage.armosec.io" - armoStageFEURL = "armoui-stage.armosec.io" - armoStageAUTHURL = "eggauth-stage.armosec.io" - - armoDevERURL = "report.eudev3.cyberarmorsoft.com" - armoDevBEURL = "api-dev.armosec.io" - armoDevFEURL = "cloud-dev.armosec.io" - armoDevAUTHURL = "eggauth-dev.armosec.io" -) - -// Armo API for downloading policies -type ArmoAPI struct { - httpClient *http.Client - apiURL string - authURL string - erURL string - feURL string - accountID string - clientID string - secretKey string - feToken FeLoginResponse - authCookie string - loggedIn bool -} - -var globalArmoAPIConnector *ArmoAPI - -func SetARMOAPIConnector(armoAPI *ArmoAPI) { - logger.L().Debug("Armo URLs", helpers.String("api", armoAPI.apiURL), helpers.String("auth", armoAPI.authURL), helpers.String("report", armoAPI.erURL), helpers.String("UI", armoAPI.feURL)) - globalArmoAPIConnector = armoAPI -} - -func GetArmoAPIConnector() *ArmoAPI { - if globalArmoAPIConnector == nil { - // logger.L().Error("returning nil API connector") - SetARMOAPIConnector(NewARMOAPIProd()) - } - return globalArmoAPIConnector -} - -func NewARMOAPIDev() *ArmoAPI { - apiObj := newArmoAPI() - - apiObj.apiURL = armoDevBEURL - apiObj.authURL = armoDevAUTHURL - apiObj.erURL = armoDevERURL - apiObj.feURL = armoDevFEURL - - return apiObj -} - -func NewARMOAPIProd() *ArmoAPI { - apiObj := newArmoAPI() - - apiObj.apiURL = armoBEURL - apiObj.erURL = armoERURL - apiObj.feURL = armoFEURL - apiObj.authURL = armoAUTHURL - - return apiObj -} - -func NewARMOAPIStaging() *ArmoAPI { - apiObj := newArmoAPI() - - apiObj.apiURL = armoStageBEURL - apiObj.erURL = armoStageERURL - apiObj.feURL = armoStageFEURL - apiObj.authURL = armoStageAUTHURL - - return apiObj -} - -func NewARMOAPICustomized(armoERURL, armoBEURL, armoFEURL, armoAUTHURL string) *ArmoAPI { - apiObj := newArmoAPI() - - apiObj.erURL = armoERURL - apiObj.apiURL = armoBEURL - apiObj.feURL = armoFEURL - apiObj.authURL = armoAUTHURL - - return apiObj -} - -func newArmoAPI() *ArmoAPI { - return &ArmoAPI{ - httpClient: &http.Client{Timeout: time.Duration(61) * time.Second}, - loggedIn: false, - } -} - -func (armoAPI *ArmoAPI) Post(fullURL string, headers map[string]string, body []byte) (string, error) { - if headers == nil { - headers = make(map[string]string) - } - armoAPI.appendAuthHeaders(headers) - return HttpPost(armoAPI.httpClient, fullURL, headers, body) -} - -func (armoAPI *ArmoAPI) Delete(fullURL string, headers map[string]string) (string, error) { - if headers == nil { - headers = make(map[string]string) - } - armoAPI.appendAuthHeaders(headers) - return HttpDelete(armoAPI.httpClient, fullURL, headers) -} -func (armoAPI *ArmoAPI) Get(fullURL string, headers map[string]string) (string, error) { - if headers == nil { - headers = make(map[string]string) - } - armoAPI.appendAuthHeaders(headers) - return HttpGetter(armoAPI.httpClient, fullURL, headers) -} - -func (armoAPI *ArmoAPI) GetAccountID() string { return armoAPI.accountID } -func (armoAPI *ArmoAPI) IsLoggedIn() bool { return armoAPI.loggedIn } -func (armoAPI *ArmoAPI) GetClientID() string { return armoAPI.clientID } -func (armoAPI *ArmoAPI) GetSecretKey() string { return armoAPI.secretKey } -func (armoAPI *ArmoAPI) GetFrontendURL() string { return armoAPI.feURL } -func (armoAPI *ArmoAPI) GetApiURL() string { return armoAPI.apiURL } -func (armoAPI *ArmoAPI) GetAuthURL() string { return armoAPI.authURL } -func (armoAPI *ArmoAPI) GetReportReceiverURL() string { return armoAPI.erURL } -func (armoAPI *ArmoAPI) SetAccountID(accountID string) { armoAPI.accountID = accountID } -func (armoAPI *ArmoAPI) SetClientID(clientID string) { armoAPI.clientID = clientID } -func (armoAPI *ArmoAPI) SetSecretKey(secretKey string) { armoAPI.secretKey = secretKey } - -func (armoAPI *ArmoAPI) GetFramework(name string) (*reporthandling.Framework, error) { - respStr, err := armoAPI.Get(armoAPI.getFrameworkURL(name), nil) - if err != nil { - return nil, nil - } - - framework := &reporthandling.Framework{} - if err = JSONDecoder(respStr).Decode(framework); err != nil { - return nil, err - } - - return framework, err -} - -func (armoAPI *ArmoAPI) GetFrameworks() ([]reporthandling.Framework, error) { - respStr, err := armoAPI.Get(armoAPI.getListFrameworkURL(), nil) - if err != nil { - return nil, nil - } - - frameworks := []reporthandling.Framework{} - if err = JSONDecoder(respStr).Decode(&frameworks); err != nil { - return nil, err - } - // SaveInFile(framework, GetDefaultPath(name+".json")) - - return frameworks, err -} - -func (armoAPI *ArmoAPI) GetControl(policyName string) (*reporthandling.Control, error) { - return nil, fmt.Errorf("control api is not public") -} - -func (armoAPI *ArmoAPI) GetExceptions(clusterName string) ([]armotypes.PostureExceptionPolicy, error) { - exceptions := []armotypes.PostureExceptionPolicy{} - - respStr, err := armoAPI.Get(armoAPI.getExceptionsURL(clusterName), nil) - if err != nil { - return nil, err - } - - if err = JSONDecoder(respStr).Decode(&exceptions); err != nil { - return nil, err - } - - return exceptions, nil -} - -func (armoAPI *ArmoAPI) GetTenant() (*TenantResponse, error) { - url := armoAPI.getAccountURL() - if armoAPI.accountID != "" { - url = fmt.Sprintf("%s?customerGUID=%s", url, armoAPI.accountID) - } - respStr, err := armoAPI.Get(url, nil) - if err != nil { - return nil, err - } - tenant := &TenantResponse{} - if err = JSONDecoder(respStr).Decode(tenant); err != nil { - return nil, err - } - if tenant.TenantID != "" { - armoAPI.accountID = tenant.TenantID - } - return tenant, nil -} - -// ControlsInputs // map[][] -func (armoAPI *ArmoAPI) GetAccountConfig(clusterName string) (*armotypes.CustomerConfig, error) { - accountConfig := &armotypes.CustomerConfig{} - if armoAPI.accountID == "" { - return accountConfig, nil - } - respStr, err := armoAPI.Get(armoAPI.getAccountConfig(clusterName), nil) - if err != nil { - return nil, err - } - - if err = JSONDecoder(respStr).Decode(&accountConfig); err != nil { - // try with default scope - respStr, err = armoAPI.Get(armoAPI.getAccountConfigDefault(clusterName), nil) - if err != nil { - return nil, err - } - if err = JSONDecoder(respStr).Decode(&accountConfig); err != nil { - return nil, err - } - } - - return accountConfig, nil -} - -// ControlsInputs // map[][] -func (armoAPI *ArmoAPI) GetControlsInputs(clusterName string) (map[string][]string, error) { - accountConfig, err := armoAPI.GetAccountConfig(clusterName) - if err == nil { - return accountConfig.Settings.PostureControlInputs, nil - } - return nil, err -} - -func (armoAPI *ArmoAPI) ListCustomFrameworks() ([]string, error) { - respStr, err := armoAPI.Get(armoAPI.getListFrameworkURL(), nil) - if err != nil { - return nil, err - } - frs := []reporthandling.Framework{} - if err = json.Unmarshal([]byte(respStr), &frs); err != nil { - return nil, err - } - - frameworkList := []string{} - for _, fr := range frs { - if !isNativeFramework(fr.Name) { - frameworkList = append(frameworkList, fr.Name) - } - } - - return frameworkList, nil -} - -func (armoAPI *ArmoAPI) ListFrameworks() ([]string, error) { - respStr, err := armoAPI.Get(armoAPI.getListFrameworkURL(), nil) - if err != nil { - return nil, err - } - frs := []reporthandling.Framework{} - if err = json.Unmarshal([]byte(respStr), &frs); err != nil { - return nil, err - } - - frameworkList := []string{} - for _, fr := range frs { - if isNativeFramework(fr.Name) { - frameworkList = append(frameworkList, strings.ToLower(fr.Name)) - } else { - frameworkList = append(frameworkList, fr.Name) - } - } - - return frameworkList, nil -} - -func (armoAPI *ArmoAPI) ListControls(l ListType) ([]string, error) { - return nil, fmt.Errorf("control api is not public") -} - -func (armoAPI *ArmoAPI) PostExceptions(exceptions []armotypes.PostureExceptionPolicy) error { - - for i := range exceptions { - ex, err := json.Marshal(exceptions[i]) - if err != nil { - return err - } - _, err = armoAPI.Post(armoAPI.exceptionsURL(""), map[string]string{"Content-Type": "application/json"}, ex) - if err != nil { - return err - } - } - return nil -} - -func (armoAPI *ArmoAPI) DeleteException(exceptionName string) error { - - _, err := armoAPI.Delete(armoAPI.exceptionsURL(exceptionName), nil) - if err != nil { - return err - } - return nil -} -func (armoAPI *ArmoAPI) Login() error { - if armoAPI.accountID == "" { - return fmt.Errorf("failed to login, missing accountID") - } - if armoAPI.clientID == "" { - return fmt.Errorf("failed to login, missing clientID") - } - if armoAPI.secretKey == "" { - return fmt.Errorf("failed to login, missing secretKey") - } - - // init URLs - feLoginData := FeLoginData{ClientId: armoAPI.clientID, Secret: armoAPI.secretKey} - body, _ := json.Marshal(feLoginData) - - resp, err := http.Post(armoAPI.getApiToken(), "application/json", bytes.NewBuffer(body)) - if err != nil { - return err - } - defer resp.Body.Close() - - if resp.StatusCode != http.StatusOK { - return fmt.Errorf("error authenticating: %d", resp.StatusCode) - } - - responseBody, err := ioutil.ReadAll(resp.Body) - if err != nil { - return err - } - var feLoginResponse FeLoginResponse - - if err = json.Unmarshal(responseBody, &feLoginResponse); err != nil { - return err - } - armoAPI.feToken = feLoginResponse - - /* Now we have JWT */ - - armoAPI.authCookie, err = armoAPI.getAuthCookie() - if err != nil { - return err - } - armoAPI.loggedIn = true - return nil -} diff --git a/core/cautils/getter/datastructures.go b/core/cautils/getter/datastructures.go index 0dace967..47a06626 100644 --- a/core/cautils/getter/datastructures.go +++ b/core/cautils/getter/datastructures.go @@ -12,7 +12,7 @@ type FeLoginResponse struct { Expires string `json:"expires"` } -type ArmoSelectCustomer struct { +type KSCloudSelectCustomer struct { SelectedCustomerGuid string `json:"selectedCustomer"` } diff --git a/core/cautils/getter/downloadreleasedpolicy.go b/core/cautils/getter/downloadreleasedpolicy.go index e9745ef5..b1289add 100644 --- a/core/cautils/getter/downloadreleasedpolicy.go +++ b/core/cautils/getter/downloadreleasedpolicy.go @@ -3,8 +3,8 @@ package getter import ( "strings" - "github.com/armosec/opa-utils/gitregostore" - "github.com/armosec/opa-utils/reporthandling" + "github.com/kubescape/opa-utils/gitregostore" + "github.com/kubescape/opa-utils/reporthandling" ) // ======================================================================================================================= diff --git a/core/cautils/getter/getpolicies.go b/core/cautils/getter/getpolicies.go index 8a8d8219..679ad92a 100644 --- a/core/cautils/getter/getpolicies.go +++ b/core/cautils/getter/getpolicies.go @@ -2,7 +2,7 @@ package getter import ( "github.com/armosec/armoapi-go/armotypes" - "github.com/armosec/opa-utils/reporthandling" + "github.com/kubescape/opa-utils/reporthandling" ) // supported listing diff --git a/core/cautils/getter/kscloudapi.go b/core/cautils/getter/kscloudapi.go new file mode 100644 index 00000000..676b5129 --- /dev/null +++ b/core/cautils/getter/kscloudapi.go @@ -0,0 +1,363 @@ +package getter + +import ( + "bytes" + "encoding/json" + "fmt" + "io/ioutil" + "net/http" + "strings" + "time" + + "github.com/armosec/armoapi-go/armotypes" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/opa-utils/reporthandling" +) + +var ( + ksCloudERURL = "report.armo.cloud" + ksCloudBEURL = "api.armosec.io" + ksCloudFEURL = "cloud.armosec.io" + ksCloudAUTHURL = "auth.armosec.io" + + ksCloudStageERURL = "report-ks.eustage2.cyberarmorsoft.com" + ksCloudStageBEURL = "api-stage.armosec.io" + ksCloudStageFEURL = "armoui-stage.armosec.io" + ksCloudStageAUTHURL = "eggauth-stage.armosec.io" + + ksCloudDevERURL = "report.eudev3.cyberarmorsoft.com" + ksCloudDevBEURL = "api-dev.armosec.io" + ksCloudDevFEURL = "cloud-dev.armosec.io" + ksCloudDevAUTHURL = "eggauth-dev.armosec.io" +) + +// KSCloudAPI allows accessing the API of the Kubescape Cloud offering +type KSCloudAPI struct { + httpClient *http.Client + apiURL string + authURL string + erURL string + feURL string + accountID string + clientID string + secretKey string + feToken FeLoginResponse + authCookie string + loggedIn bool +} + +var globalKSCloudAPIConnector *KSCloudAPI + +func SetKSCloudAPIConnector(ksCloudAPI *KSCloudAPI) { + logger.L().Debug("Kubescape Cloud URLs", helpers.String("api", ksCloudAPI.apiURL), helpers.String("auth", ksCloudAPI.authURL), helpers.String("report", ksCloudAPI.erURL), helpers.String("UI", ksCloudAPI.feURL)) + globalKSCloudAPIConnector = ksCloudAPI +} + +func GetKSCloudAPIConnector() *KSCloudAPI { + if globalKSCloudAPIConnector == nil { + SetKSCloudAPIConnector(NewKSCloudAPIProd()) + } + return globalKSCloudAPIConnector +} + +func NewKSCloudAPIDev() *KSCloudAPI { + apiObj := newKSCloudAPI() + + apiObj.apiURL = ksCloudDevBEURL + apiObj.authURL = ksCloudDevAUTHURL + apiObj.erURL = ksCloudDevERURL + apiObj.feURL = ksCloudDevFEURL + + return apiObj +} + +func NewKSCloudAPIProd() *KSCloudAPI { + apiObj := newKSCloudAPI() + + apiObj.apiURL = ksCloudBEURL + apiObj.erURL = ksCloudERURL + apiObj.feURL = ksCloudFEURL + apiObj.authURL = ksCloudAUTHURL + + return apiObj +} + +func NewKSCloudAPIStaging() *KSCloudAPI { + apiObj := newKSCloudAPI() + + apiObj.apiURL = ksCloudStageBEURL + apiObj.erURL = ksCloudStageERURL + apiObj.feURL = ksCloudStageFEURL + apiObj.authURL = ksCloudStageAUTHURL + + return apiObj +} + +func NewKSCloudAPICustomized(ksCloudERURL, ksCloudBEURL, ksCloudFEURL, ksCloudAUTHURL string) *KSCloudAPI { + apiObj := newKSCloudAPI() + + apiObj.erURL = ksCloudERURL + apiObj.apiURL = ksCloudBEURL + apiObj.feURL = ksCloudFEURL + apiObj.authURL = ksCloudAUTHURL + + return apiObj +} + +func newKSCloudAPI() *KSCloudAPI { + return &KSCloudAPI{ + httpClient: &http.Client{Timeout: time.Duration(61) * time.Second}, + loggedIn: false, + } +} + +func (api *KSCloudAPI) Post(fullURL string, headers map[string]string, body []byte) (string, error) { + if headers == nil { + headers = make(map[string]string) + } + api.appendAuthHeaders(headers) + return HttpPost(api.httpClient, fullURL, headers, body) +} + +func (api *KSCloudAPI) Delete(fullURL string, headers map[string]string) (string, error) { + if headers == nil { + headers = make(map[string]string) + } + api.appendAuthHeaders(headers) + return HttpDelete(api.httpClient, fullURL, headers) +} +func (api *KSCloudAPI) Get(fullURL string, headers map[string]string) (string, error) { + if headers == nil { + headers = make(map[string]string) + } + api.appendAuthHeaders(headers) + return HttpGetter(api.httpClient, fullURL, headers) +} + +func (api *KSCloudAPI) GetAccountID() string { return api.accountID } +func (api *KSCloudAPI) IsLoggedIn() bool { return api.loggedIn } +func (api *KSCloudAPI) GetClientID() string { return api.clientID } +func (api *KSCloudAPI) GetSecretKey() string { return api.secretKey } +func (api *KSCloudAPI) GetFrontendURL() string { return api.feURL } +func (api *KSCloudAPI) GetApiURL() string { return api.apiURL } +func (api *KSCloudAPI) GetAuthURL() string { return api.authURL } +func (api *KSCloudAPI) GetReportReceiverURL() string { return api.erURL } +func (api *KSCloudAPI) SetAccountID(accountID string) { api.accountID = accountID } +func (api *KSCloudAPI) SetClientID(clientID string) { api.clientID = clientID } +func (api *KSCloudAPI) SetSecretKey(secretKey string) { api.secretKey = secretKey } + +func (api *KSCloudAPI) GetFramework(name string) (*reporthandling.Framework, error) { + respStr, err := api.Get(api.getFrameworkURL(name), nil) + if err != nil { + return nil, nil + } + + framework := &reporthandling.Framework{} + if err = JSONDecoder(respStr).Decode(framework); err != nil { + return nil, err + } + + return framework, err +} + +func (api *KSCloudAPI) GetFrameworks() ([]reporthandling.Framework, error) { + respStr, err := api.Get(api.getListFrameworkURL(), nil) + if err != nil { + return nil, nil + } + + frameworks := []reporthandling.Framework{} + if err = JSONDecoder(respStr).Decode(&frameworks); err != nil { + return nil, err + } + + return frameworks, err +} + +func (api *KSCloudAPI) GetControl(policyName string) (*reporthandling.Control, error) { + return nil, fmt.Errorf("control api is not public") +} + +func (api *KSCloudAPI) GetExceptions(clusterName string) ([]armotypes.PostureExceptionPolicy, error) { + exceptions := []armotypes.PostureExceptionPolicy{} + + respStr, err := api.Get(api.getExceptionsURL(clusterName), nil) + if err != nil { + return nil, err + } + + if err = JSONDecoder(respStr).Decode(&exceptions); err != nil { + return nil, err + } + + return exceptions, nil +} + +func (api *KSCloudAPI) GetTenant() (*TenantResponse, error) { + url := api.getAccountURL() + if api.accountID != "" { + url = fmt.Sprintf("%s?customerGUID=%s", url, api.accountID) + } + respStr, err := api.Get(url, nil) + if err != nil { + return nil, err + } + tenant := &TenantResponse{} + if err = JSONDecoder(respStr).Decode(tenant); err != nil { + return nil, err + } + if tenant.TenantID != "" { + api.accountID = tenant.TenantID + } + return tenant, nil +} + +// ControlsInputs // map[][] +func (api *KSCloudAPI) GetAccountConfig(clusterName string) (*armotypes.CustomerConfig, error) { + accountConfig := &armotypes.CustomerConfig{} + if api.accountID == "" { + return accountConfig, nil + } + respStr, err := api.Get(api.getAccountConfig(clusterName), nil) + if err != nil { + return nil, err + } + + if err = JSONDecoder(respStr).Decode(&accountConfig); err != nil { + // try with default scope + respStr, err = api.Get(api.getAccountConfigDefault(clusterName), nil) + if err != nil { + return nil, err + } + if err = JSONDecoder(respStr).Decode(&accountConfig); err != nil { + return nil, err + } + } + + return accountConfig, nil +} + +// ControlsInputs // map[][] +func (api *KSCloudAPI) GetControlsInputs(clusterName string) (map[string][]string, error) { + accountConfig, err := api.GetAccountConfig(clusterName) + if err == nil { + return accountConfig.Settings.PostureControlInputs, nil + } + return nil, err +} + +func (api *KSCloudAPI) ListCustomFrameworks() ([]string, error) { + respStr, err := api.Get(api.getListFrameworkURL(), nil) + if err != nil { + return nil, err + } + frs := []reporthandling.Framework{} + if err = json.Unmarshal([]byte(respStr), &frs); err != nil { + return nil, err + } + + frameworkList := []string{} + for _, fr := range frs { + if !isNativeFramework(fr.Name) { + frameworkList = append(frameworkList, fr.Name) + } + } + + return frameworkList, nil +} + +func (api *KSCloudAPI) ListFrameworks() ([]string, error) { + respStr, err := api.Get(api.getListFrameworkURL(), nil) + if err != nil { + return nil, err + } + frs := []reporthandling.Framework{} + if err = json.Unmarshal([]byte(respStr), &frs); err != nil { + return nil, err + } + + frameworkList := []string{} + for _, fr := range frs { + if isNativeFramework(fr.Name) { + frameworkList = append(frameworkList, strings.ToLower(fr.Name)) + } else { + frameworkList = append(frameworkList, fr.Name) + } + } + + return frameworkList, nil +} + +func (api *KSCloudAPI) ListControls(l ListType) ([]string, error) { + return nil, fmt.Errorf("control api is not public") +} + +func (api *KSCloudAPI) PostExceptions(exceptions []armotypes.PostureExceptionPolicy) error { + + for i := range exceptions { + ex, err := json.Marshal(exceptions[i]) + if err != nil { + return err + } + _, err = api.Post(api.exceptionsURL(""), map[string]string{"Content-Type": "application/json"}, ex) + if err != nil { + return err + } + } + return nil +} + +func (api *KSCloudAPI) DeleteException(exceptionName string) error { + + _, err := api.Delete(api.exceptionsURL(exceptionName), nil) + if err != nil { + return err + } + return nil +} +func (api *KSCloudAPI) Login() error { + if api.accountID == "" { + return fmt.Errorf("failed to login, missing accountID") + } + if api.clientID == "" { + return fmt.Errorf("failed to login, missing clientID") + } + if api.secretKey == "" { + return fmt.Errorf("failed to login, missing secretKey") + } + + // init URLs + feLoginData := FeLoginData{ClientId: api.clientID, Secret: api.secretKey} + body, _ := json.Marshal(feLoginData) + + resp, err := http.Post(api.getApiToken(), "application/json", bytes.NewBuffer(body)) + if err != nil { + return err + } + defer resp.Body.Close() + + if resp.StatusCode != http.StatusOK { + return fmt.Errorf("error authenticating: %d", resp.StatusCode) + } + + responseBody, err := ioutil.ReadAll(resp.Body) + if err != nil { + return err + } + var feLoginResponse FeLoginResponse + + if err = json.Unmarshal(responseBody, &feLoginResponse); err != nil { + return err + } + api.feToken = feLoginResponse + + /* Now we have JWT */ + + api.authCookie, err = api.getAuthCookie() + if err != nil { + return err + } + api.loggedIn = true + return nil +} diff --git a/core/cautils/getter/armoapiutils.go b/core/cautils/getter/kscloudapiutils.go similarity index 57% rename from core/cautils/getter/armoapiutils.go rename to core/cautils/getter/kscloudapiutils.go index 562dabfe..4aae02ab 100644 --- a/core/cautils/getter/armoapiutils.go +++ b/core/cautils/getter/kscloudapiutils.go @@ -11,12 +11,12 @@ import ( var NativeFrameworks = []string{"nsa", "mitre", "armobest", "devopsbest"} -func (armoAPI *ArmoAPI) getFrameworkURL(frameworkName string) string { +func (api *KSCloudAPI) getFrameworkURL(frameworkName string) string { u := url.URL{} - u.Scheme, u.Host = parseHost(armoAPI.GetApiURL()) + u.Scheme, u.Host = parseHost(api.GetApiURL()) u.Path = "api/v1/armoFrameworks" q := u.Query() - q.Add("customerGUID", armoAPI.getCustomerGUIDFallBack()) + q.Add("customerGUID", api.getCustomerGUIDFallBack()) if isNativeFramework(frameworkName) { q.Add("frameworkName", strings.ToUpper(frameworkName)) } else { @@ -28,23 +28,23 @@ func (armoAPI *ArmoAPI) getFrameworkURL(frameworkName string) string { return u.String() } -func (armoAPI *ArmoAPI) getListFrameworkURL() string { +func (api *KSCloudAPI) getListFrameworkURL() string { u := url.URL{} - u.Scheme, u.Host = parseHost(armoAPI.GetApiURL()) + u.Scheme, u.Host = parseHost(api.GetApiURL()) u.Path = "api/v1/armoFrameworks" q := u.Query() - q.Add("customerGUID", armoAPI.getCustomerGUIDFallBack()) + q.Add("customerGUID", api.getCustomerGUIDFallBack()) u.RawQuery = q.Encode() return u.String() } -func (armoAPI *ArmoAPI) getExceptionsURL(clusterName string) string { +func (api *KSCloudAPI) getExceptionsURL(clusterName string) string { u := url.URL{} - u.Scheme, u.Host = parseHost(armoAPI.GetApiURL()) + u.Scheme, u.Host = parseHost(api.GetApiURL()) u.Path = "api/v1/armoPostureExceptions" q := u.Query() - q.Add("customerGUID", armoAPI.getCustomerGUIDFallBack()) + q.Add("customerGUID", api.getCustomerGUIDFallBack()) // if clusterName != "" { // TODO - fix customer name support in Armo BE // q.Add("clusterName", clusterName) // } @@ -53,13 +53,13 @@ func (armoAPI *ArmoAPI) getExceptionsURL(clusterName string) string { return u.String() } -func (armoAPI *ArmoAPI) exceptionsURL(exceptionsPolicyName string) string { +func (api *KSCloudAPI) exceptionsURL(exceptionsPolicyName string) string { u := url.URL{} - u.Scheme, u.Host = parseHost(armoAPI.GetApiURL()) + u.Scheme, u.Host = parseHost(api.GetApiURL()) u.Path = "api/v1/postureExceptionPolicy" q := u.Query() - q.Add("customerGUID", armoAPI.getCustomerGUIDFallBack()) + q.Add("customerGUID", api.getCustomerGUIDFallBack()) if exceptionsPolicyName != "" { // for delete q.Add("policyName", exceptionsPolicyName) } @@ -69,19 +69,19 @@ func (armoAPI *ArmoAPI) exceptionsURL(exceptionsPolicyName string) string { return u.String() } -func (armoAPI *ArmoAPI) getAccountConfigDefault(clusterName string) string { - config := armoAPI.getAccountConfig(clusterName) +func (api *KSCloudAPI) getAccountConfigDefault(clusterName string) string { + config := api.getAccountConfig(clusterName) url := config + "&scope=customer" return url } -func (armoAPI *ArmoAPI) getAccountConfig(clusterName string) string { +func (api *KSCloudAPI) getAccountConfig(clusterName string) string { u := url.URL{} - u.Scheme, u.Host = parseHost(armoAPI.GetApiURL()) + u.Scheme, u.Host = parseHost(api.GetApiURL()) u.Path = "api/v1/armoCustomerConfiguration" q := u.Query() - q.Add("customerGUID", armoAPI.getCustomerGUIDFallBack()) + q.Add("customerGUID", api.getCustomerGUIDFallBack()) if clusterName != "" { // TODO - fix customer name support in Armo BE q.Add("clusterName", clusterName) } @@ -90,49 +90,49 @@ func (armoAPI *ArmoAPI) getAccountConfig(clusterName string) string { return u.String() } -func (armoAPI *ArmoAPI) getAccountURL() string { +func (api *KSCloudAPI) getAccountURL() string { u := url.URL{} - u.Scheme, u.Host = parseHost(armoAPI.GetApiURL()) + u.Scheme, u.Host = parseHost(api.GetApiURL()) u.Path = "api/v1/createTenant" return u.String() } -func (armoAPI *ArmoAPI) getApiToken() string { +func (api *KSCloudAPI) getApiToken() string { u := url.URL{} - u.Scheme, u.Host = parseHost(armoAPI.GetAuthURL()) + u.Scheme, u.Host = parseHost(api.GetAuthURL()) u.Path = "identity/resources/auth/v1/api-token" return u.String() } -func (armoAPI *ArmoAPI) getOpenidCustomers() string { +func (api *KSCloudAPI) getOpenidCustomers() string { u := url.URL{} - u.Scheme, u.Host = parseHost(armoAPI.GetApiURL()) + u.Scheme, u.Host = parseHost(api.GetApiURL()) u.Path = "api/v1/openid_customers" return u.String() } -func (armoAPI *ArmoAPI) getAuthCookie() (string, error) { - selectCustomer := ArmoSelectCustomer{SelectedCustomerGuid: armoAPI.accountID} +func (api *KSCloudAPI) getAuthCookie() (string, error) { + selectCustomer := KSCloudSelectCustomer{SelectedCustomerGuid: api.accountID} requestBody, _ := json.Marshal(selectCustomer) client := &http.Client{} - httpRequest, err := http.NewRequest(http.MethodPost, armoAPI.getOpenidCustomers(), bytes.NewBuffer(requestBody)) + httpRequest, err := http.NewRequest(http.MethodPost, api.getOpenidCustomers(), bytes.NewBuffer(requestBody)) if err != nil { return "", err } httpRequest.Header.Set("Content-Type", "application/json") - httpRequest.Header.Set("Authorization", fmt.Sprintf("Bearer %s", armoAPI.feToken.Token)) + httpRequest.Header.Set("Authorization", fmt.Sprintf("Bearer %s", api.feToken.Token)) httpResponse, err := client.Do(httpRequest) if err != nil { return "", err } defer httpResponse.Body.Close() if httpResponse.StatusCode != http.StatusOK { - return "", fmt.Errorf("failed to get cookie from %s: status %d", armoAPI.getOpenidCustomers(), httpResponse.StatusCode) + return "", fmt.Errorf("failed to get cookie from %s: status %d", api.getOpenidCustomers(), httpResponse.StatusCode) } cookies := httpResponse.Header.Get("set-cookie") if len(cookies) == 0 { - return "", fmt.Errorf("no cookie field in response from %s", armoAPI.getOpenidCustomers()) + return "", fmt.Errorf("no cookie field in response from %s", api.getOpenidCustomers()) } authCookie := "" @@ -144,24 +144,24 @@ func (armoAPI *ArmoAPI) getAuthCookie() (string, error) { } if len(authCookie) == 0 { - return "", fmt.Errorf("no auth cookie field in response from %s", armoAPI.getOpenidCustomers()) + return "", fmt.Errorf("no auth cookie field in response from %s", api.getOpenidCustomers()) } return authCookie, nil } -func (armoAPI *ArmoAPI) appendAuthHeaders(headers map[string]string) { +func (api *KSCloudAPI) appendAuthHeaders(headers map[string]string) { - if armoAPI.feToken.Token != "" { - headers["Authorization"] = fmt.Sprintf("Bearer %s", armoAPI.feToken.Token) + if api.feToken.Token != "" { + headers["Authorization"] = fmt.Sprintf("Bearer %s", api.feToken.Token) } - if armoAPI.authCookie != "" { - headers["Cookie"] = fmt.Sprintf("auth=%s", armoAPI.authCookie) + if api.authCookie != "" { + headers["Cookie"] = fmt.Sprintf("auth=%s", api.authCookie) } } -func (armoAPI *ArmoAPI) getCustomerGUIDFallBack() string { - if armoAPI.accountID != "" { - return armoAPI.accountID +func (api *KSCloudAPI) getCustomerGUIDFallBack() string { + if api.accountID != "" { + return api.accountID } return "11111111-1111-1111-1111-111111111111" } diff --git a/core/cautils/getter/loadpolicy.go b/core/cautils/getter/loadpolicy.go index 12d56555..42eaea8b 100644 --- a/core/cautils/getter/loadpolicy.go +++ b/core/cautils/getter/loadpolicy.go @@ -8,7 +8,7 @@ import ( "strings" "github.com/armosec/armoapi-go/armotypes" - "github.com/armosec/opa-utils/reporthandling" + "github.com/kubescape/opa-utils/reporthandling" ) // ======================================================================================================================= diff --git a/core/cautils/helmchart.go b/core/cautils/helmchart.go index 61abc3b5..92a3f2f6 100644 --- a/core/cautils/helmchart.go +++ b/core/cautils/helmchart.go @@ -4,10 +4,10 @@ import ( "path/filepath" "strings" - "github.com/armosec/k8s-interface/workloadinterface" - "github.com/armosec/opa-utils/objectsenvelopes/localworkload" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/k8s-interface/workloadinterface" + "github.com/kubescape/opa-utils/objectsenvelopes/localworkload" helmchart "helm.sh/helm/v3/pkg/chart" helmloader "helm.sh/helm/v3/pkg/chart/loader" diff --git a/core/cautils/helmchart_test.go b/core/cautils/helmchart_test.go index 5fa4b2c4..4f245a0e 100644 --- a/core/cautils/helmchart_test.go +++ b/core/cautils/helmchart_test.go @@ -9,7 +9,7 @@ import ( "strings" "testing" - "github.com/armosec/opa-utils/objectsenvelopes/localworkload" + "github.com/kubescape/opa-utils/objectsenvelopes/localworkload" "github.com/stretchr/testify/suite" ) diff --git a/core/cautils/rbac.go b/core/cautils/rbac.go index 407aa333..b44e766c 100644 --- a/core/cautils/rbac.go +++ b/core/cautils/rbac.go @@ -4,12 +4,12 @@ import ( "encoding/json" "time" - reporthandlingv2 "github.com/armosec/opa-utils/reporthandling/v2" + reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2" - "github.com/armosec/k8s-interface/workloadinterface" - "github.com/armosec/rbac-utils/rbacscanner" - "github.com/armosec/rbac-utils/rbacutils" "github.com/google/uuid" + "github.com/kubescape/k8s-interface/workloadinterface" + "github.com/kubescape/rbac-utils/rbacscanner" + "github.com/kubescape/rbac-utils/rbacutils" ) type RBACObjects struct { @@ -54,8 +54,8 @@ func (rbacObjects *RBACObjects) rbacObjectsToResources(resources *rbacutils.Rbac /* ************************************************************************************************************************ This code is adding a non valid ID -> - (github.com/armosec/rbac-utils v0.0.11): "//SA2WLIDmap/SA2WLIDmap" - (github.com/armosec/rbac-utils v0.0.12): "armo.rbac.com/v0beta1//SAID2WLIDmap/SAID2WLIDmap" + (github.com/kubescape/opa-utils v0.0.11): "//SA2WLIDmap/SA2WLIDmap" + (github.com/kubescape/opa-utils v0.0.12): "armo.rbac.com/v0beta1//SAID2WLIDmap/SAID2WLIDmap" Should be investigated ************************************************************************************************************************ @@ -63,17 +63,21 @@ func (rbacObjects *RBACObjects) rbacObjectsToResources(resources *rbacutils.Rbac // wrap rbac aggregated objects in IMetadata and add to AllResources // TODO - DEPRECATE SA2WLIDmap - SA2WLIDmapIMeta, err := rbacutils.SA2WLIDmapIMetadataWrapper(resources.SA2WLIDmap) + m, err := rbacutils.SA2WLIDmapIMetadataWrapper(resources.SA2WLIDmap) if err != nil { return nil, err } - allresources[SA2WLIDmapIMeta.GetID()] = SA2WLIDmapIMeta - SAID2WLIDmapIMeta, err := rbacutils.SAID2WLIDmapIMetadataWrapper(resources.SAID2WLIDmap) + sa2WLIDmapIMeta := workloadinterface.NewBaseObject(m) + allresources[sa2WLIDmapIMeta.GetID()] = sa2WLIDmapIMeta + + m2, err := rbacutils.SAID2WLIDmapIMetadataWrapper(resources.SAID2WLIDmap) if err != nil { return nil, err } - allresources[SAID2WLIDmapIMeta.GetID()] = SAID2WLIDmapIMeta + + saID2WLIDmapIMeta := workloadinterface.NewBaseObject(m2) + allresources[saID2WLIDmapIMeta.GetID()] = saID2WLIDmapIMeta // convert rbac k8s resources to IMetadata and add to allresources for _, cr := range resources.ClusterRoles.Items { diff --git a/core/cautils/reportv2tov1.go b/core/cautils/reportv2tov1.go index 45ae818d..7d202391 100644 --- a/core/cautils/reportv2tov1.go +++ b/core/cautils/reportv2tov1.go @@ -1,15 +1,14 @@ package cautils import ( - "github.com/armosec/k8s-interface/workloadinterface" - "github.com/armosec/opa-utils/reporthandling" - helpersv1 "github.com/armosec/opa-utils/reporthandling/helpers/v1" - "github.com/armosec/opa-utils/reporthandling/results/v1/reportsummary" + "github.com/kubescape/k8s-interface/workloadinterface" + "github.com/kubescape/opa-utils/reporthandling" + helpersv1 "github.com/kubescape/opa-utils/reporthandling/helpers/v1" + "github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary" ) func ReportV2ToV1(opaSessionObj *OPASessionObj) *reporthandling.PostureReport { report := &reporthandling.PostureReport{} - // opaSessionObj.PostureReport.ClusterCloudProvider = opaSessionObj.Report.ClusterCloudProvider frameworks := []reporthandling.FrameworkReport{} @@ -31,26 +30,12 @@ func ReportV2ToV1(opaSessionObj *OPASessionObj) *reporthandling.PostureReport { fwv1.Score = opaSessionObj.Report.SummaryDetails.Score } - // // remove unused data - // opaSessionObj.Report = nil - // opaSessionObj.ResourcesResult = nil - // setup counters and score for f := range frameworks { - // // set exceptions - // exceptions.SetFrameworkExceptions(frameworks, opap.Exceptions, cautils.ClusterName) - // set counters reporthandling.SetUniqueResourcesCounter(&frameworks[f]) - - // set default score - // reporthandling.SetDefaultScore(&frameworks[f]) } - // // update score - // scoreutil := score.NewScore(opaSessionObj.AllResources) - // scoreutil.Calculate(frameworks) - report.FrameworkReports = frameworks return report } @@ -64,7 +49,6 @@ func controlReportV2ToV1(opaSessionObj *OPASessionObj, frameworkName string, con crv1.Name = crv2.GetName() crv1.Score = crv2.GetScore() crv1.Control_ID = controlID - // crv1.Attributes = crv2. // TODO - add fields crv1.Description = crv2.Description diff --git a/core/cautils/rootinfo.go b/core/cautils/rootinfo.go index dc70e560..5b2c8a69 100644 --- a/core/cautils/rootinfo.go +++ b/core/cautils/rootinfo.go @@ -6,8 +6,8 @@ type RootInfo struct { CacheDir string // cached dir DisableColor bool // Disable Color - ArmoBEURLs string // armo url - ArmoBEURLsDep string // armo url + KSCloudBEURLs string // Kubescape Cloud URL + KSCloudBEURLsDep string // Kubescape Cloud URL } @@ -16,81 +16,3 @@ type Credentials struct { ClientID string SecretKey string } - -// func (rootInfo *RootInfo) InitLogger() { -// logger.DisableColor(rootInfo.DisableColor) - -// if rootInfo.LoggerName == "" { -// if l := os.Getenv("KS_LOGGER_NAME"); l != "" { -// rootInfo.LoggerName = l -// } else { -// if isatty.IsTerminal(os.Stdout.Fd()) { -// rootInfo.LoggerName = "pretty" -// } else { -// rootInfo.LoggerName = "zap" -// } -// } -// } - -// logger.InitLogger(rootInfo.LoggerName) - -// } -// func (rootInfo *RootInfo) InitLoggerLevel() error { -// if rootInfo.Logger == helpers.InfoLevel.String() { -// } else if l := os.Getenv("KS_LOGGER"); l != "" { -// rootInfo.Logger = l -// } - -// if err := logger.L().SetLevel(rootInfo.Logger); err != nil { -// return fmt.Errorf("supported levels: %s", strings.Join(helpers.SupportedLevels(), "/")) -// } -// return nil -// } - -// func (rootInfo *RootInfo) InitCacheDir() error { -// if rootInfo.CacheDir == getter.DefaultLocalStore { -// getter.DefaultLocalStore = rootInfo.CacheDir -// } else if cacheDir := os.Getenv("KS_CACHE_DIR"); cacheDir != "" { -// getter.DefaultLocalStore = cacheDir -// } else { -// return nil // using default cache dir location -// } - -// // TODO create dir if not found exist -// // logger.L().Debug("cache dir updated", helpers.String("path", getter.DefaultLocalStore)) -// return nil -// } -// func (rootInfo *RootInfo) InitEnvironment() error { - -// urlSlices := strings.Split(rootInfo.ArmoBEURLs, ",") -// if len(urlSlices) != 1 && len(urlSlices) < 3 { -// return fmt.Errorf("expected at least 2 URLs (report,api,frontend,auth)") -// } -// switch len(urlSlices) { -// case 1: -// switch urlSlices[0] { -// case "dev", "development": -// getter.SetARMOAPIConnector(getter.NewARMOAPIDev()) -// case "stage", "staging": -// getter.SetARMOAPIConnector(getter.NewARMOAPIStaging()) -// case "": -// getter.SetARMOAPIConnector(getter.NewARMOAPIProd()) -// default: -// return fmt.Errorf("unknown environment") -// } -// case 2: -// armoERURL := urlSlices[0] // mandatory -// armoBEURL := urlSlices[1] // mandatory -// getter.SetARMOAPIConnector(getter.NewARMOAPICustomized(armoERURL, armoBEURL, "", "")) -// case 3, 4: -// var armoAUTHURL string -// armoERURL := urlSlices[0] // mandatory -// armoBEURL := urlSlices[1] // mandatory -// armoFEURL := urlSlices[2] // mandatory -// if len(urlSlices) <= 4 { -// armoAUTHURL = urlSlices[3] -// } -// getter.SetARMOAPIConnector(getter.NewARMOAPICustomized(armoERURL, armoBEURL, armoFEURL, armoAUTHURL)) -// } -// return nil -// } diff --git a/core/cautils/scaninfo.go b/core/cautils/scaninfo.go index 449b8dfe..a40d58b4 100644 --- a/core/cautils/scaninfo.go +++ b/core/cautils/scaninfo.go @@ -9,15 +9,15 @@ import ( "strings" "github.com/armosec/armoapi-go/armotypes" - apisv1 "github.com/armosec/opa-utils/httpserver/apis/v1" + apisv1 "github.com/kubescape/opa-utils/httpserver/apis/v1" giturl "github.com/armosec/go-git-url" - "github.com/armosec/k8s-interface/k8sinterface" - "github.com/armosec/kubescape/v2/core/cautils/getter" - "github.com/armosec/opa-utils/reporthandling" - reporthandlingv2 "github.com/armosec/opa-utils/reporthandling/v2" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/k8s-interface/k8sinterface" + "github.com/kubescape/kubescape/v2/core/cautils/getter" + "github.com/kubescape/opa-utils/reporthandling" + reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2" "github.com/google/uuid" ) @@ -117,9 +117,9 @@ type ScanInfo struct { InputPatterns []string // Yaml files input patterns Silent bool // Silent mode - Do not print progress logs FailThreshold float32 // Failure score threshold - Submit bool // Submit results to Armo BE + Submit bool // Submit results to Kubescape Cloud BE ScanID string // Report id of the current scan - HostSensorEnabled BoolPtrFlag // Deploy ARMO K8s host scanner to collect data from certain controls + HostSensorEnabled BoolPtrFlag // Deploy Kubescape K8s host scanner to collect data from certain controls HostSensorYamlPath string // Path to hostsensor file Local bool // Do not submit results Credentials Credentials // account ID diff --git a/core/cautils/scaninfo_test.go b/core/cautils/scaninfo_test.go index d15100eb..c8705879 100644 --- a/core/cautils/scaninfo_test.go +++ b/core/cautils/scaninfo_test.go @@ -3,7 +3,7 @@ package cautils import ( "testing" - reporthandlingv2 "github.com/armosec/opa-utils/reporthandling/v2" + reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2" "github.com/stretchr/testify/assert" ) @@ -20,7 +20,7 @@ func TestSetContextMetadata(t *testing.T) { } { ctx := reporthandlingv2.ContextMetadata{} - setContextMetadata(&ctx, "https://github.com/armosec/kubescape") + setContextMetadata(&ctx, "https://github.com/kubescape/kubescape") assert.Nil(t, ctx.ClusterContextMetadata) assert.Nil(t, ctx.DirectoryContextMetadata) @@ -29,7 +29,7 @@ func TestSetContextMetadata(t *testing.T) { assert.NotNil(t, ctx.RepoContextMetadata) assert.Equal(t, "kubescape", ctx.RepoContextMetadata.Repo) - assert.Equal(t, "armosec", ctx.RepoContextMetadata.Owner) + assert.Equal(t, "kubescape", ctx.RepoContextMetadata.Owner) assert.Equal(t, "master", ctx.RepoContextMetadata.Branch) } } @@ -40,8 +40,5 @@ func TestGetHostname(t *testing.T) { func TestGetScanningContext(t *testing.T) { assert.Equal(t, ContextCluster, GetScanningContext("")) - // assert.Equal(t, ContextDir, GetScanningContext("/")) - assert.Equal(t, ContextGitURL, GetScanningContext("https://github.com/armosec/kubescape")) - // assert.Equal(t, ContextFile, GetScanningContext(path.Join(".", "testdata", "localrepo.git"))) - // assert.Equal(t, ContextGitLocal, GetScanningContext(path.Join(".", "testdata"))) + assert.Equal(t, ContextGitURL, GetScanningContext("https://github.com/kubescape/kubescape")) } diff --git a/core/cautils/versioncheck.go b/core/cautils/versioncheck.go index 23fc193b..2492d6f3 100644 --- a/core/cautils/versioncheck.go +++ b/core/cautils/versioncheck.go @@ -6,10 +6,10 @@ import ( "net/http" "os" - "github.com/armosec/kubescape/v2/core/cautils/getter" "github.com/armosec/utils-go/boolutils" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/kubescape/v2/core/cautils/getter" "golang.org/x/mod/semver" ) diff --git a/core/cautils/versioncheck_test.go b/core/cautils/versioncheck_test.go index 3d26e260..2be10e7e 100644 --- a/core/cautils/versioncheck_test.go +++ b/core/cautils/versioncheck_test.go @@ -4,7 +4,7 @@ import ( "testing" "github.com/armosec/armoapi-go/armotypes" - "github.com/armosec/opa-utils/reporthandling" + "github.com/kubescape/opa-utils/reporthandling" "github.com/stretchr/testify/assert" "golang.org/x/mod/semver" ) diff --git a/core/cautils/workloadmappingutils.go b/core/cautils/workloadmappingutils.go index 8c1315c2..23db6375 100644 --- a/core/cautils/workloadmappingutils.go +++ b/core/cautils/workloadmappingutils.go @@ -3,7 +3,7 @@ package cautils import ( "strings" - "github.com/armosec/opa-utils/reporthandling/apis" + "github.com/kubescape/opa-utils/reporthandling/apis" ) var ( @@ -21,9 +21,9 @@ var ( CloudResources = []string{"ClusterDescribe"} ) -func MapArmoResource(armoResourceMap *ArmoResources, resources []string) []string { +func MapKSResource(ksResourceMap *KSResources, resources []string) []string { var hostResources []string - for k := range *armoResourceMap { + for k := range *ksResourceMap { for _, resource := range resources { if strings.Contains(k, resource) { hostResources = append(hostResources, k) @@ -33,16 +33,16 @@ func MapArmoResource(armoResourceMap *ArmoResources, resources []string) []strin return hostResources } -func MapHostResources(armoResourceMap *ArmoResources) []string { - return MapArmoResource(armoResourceMap, HostSensorResources) +func MapHostResources(ksResourceMap *KSResources) []string { + return MapKSResource(ksResourceMap, HostSensorResources) } -func MapImageVulnResources(armoResourceMap *ArmoResources) []string { - return MapArmoResource(armoResourceMap, ImageVulnResources) +func MapImageVulnResources(ksResourceMap *KSResources) []string { + return MapKSResource(ksResourceMap, ImageVulnResources) } -func MapCloudResources(armoResourceMap *ArmoResources) []string { - return MapArmoResource(armoResourceMap, CloudResources) +func MapCloudResources(ksResourceMap *KSResources) []string { + return MapKSResource(ksResourceMap, CloudResources) } func SetInfoMapForResources(info string, resources []string, errorMap map[string]apis.StatusInfo) { diff --git a/core/core/cachedconfig.go b/core/core/cachedconfig.go index 7d0bebc4..b575eb9c 100644 --- a/core/core/cachedconfig.go +++ b/core/core/cachedconfig.go @@ -3,7 +3,7 @@ package core import ( "fmt" - metav1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1" + metav1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1" ) func (ks *Kubescape) SetCachedConfig(setConfig *metav1.SetConfig) error { diff --git a/core/core/delete.go b/core/core/delete.go index 34db60cf..0439db68 100644 --- a/core/core/delete.go +++ b/core/core/delete.go @@ -3,10 +3,10 @@ package core import ( "fmt" - "github.com/armosec/kubescape/v2/core/cautils/getter" - v1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/kubescape/v2/core/cautils/getter" + v1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1" ) func (ks *Kubescape) DeleteExceptions(delExceptions *v1.DeleteExceptions) error { @@ -15,8 +15,8 @@ func (ks *Kubescape) DeleteExceptions(delExceptions *v1.DeleteExceptions) error getTenantConfig(&delExceptions.Credentials, "", getKubernetesApi()) // login kubescape SaaS - armoAPI := getter.GetArmoAPIConnector() - if err := armoAPI.Login(); err != nil { + ksCloudAPI := getter.GetKSCloudAPIConnector() + if err := ksCloudAPI.Login(); err != nil { return err } @@ -26,7 +26,7 @@ func (ks *Kubescape) DeleteExceptions(delExceptions *v1.DeleteExceptions) error continue } logger.L().Info("Deleting exception", helpers.String("name", exceptionName)) - if err := armoAPI.DeleteException(exceptionName); err != nil { + if err := ksCloudAPI.DeleteException(exceptionName); err != nil { return fmt.Errorf("failed to delete exception '%s', reason: %s", exceptionName, err.Error()) } logger.L().Success("Exception deleted successfully") diff --git a/core/core/download.go b/core/core/download.go index 69013fc9..d5760a65 100644 --- a/core/core/download.go +++ b/core/core/download.go @@ -7,10 +7,10 @@ import ( "strings" "github.com/armosec/armoapi-go/armotypes" - "github.com/armosec/kubescape/v2/core/cautils/getter" - metav1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/kubescape/v2/core/cautils/getter" + metav1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1" ) var downloadFunc = map[string]func(*metav1.DownloadInfo) error{ diff --git a/core/core/initutils.go b/core/core/initutils.go index 786b08de..bb145b1a 100644 --- a/core/core/initutils.go +++ b/core/core/initutils.go @@ -3,19 +3,19 @@ package core import ( "fmt" - "github.com/armosec/k8s-interface/k8sinterface" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/cautils/getter" - "github.com/armosec/kubescape/v2/core/pkg/hostsensorutils" - "github.com/armosec/kubescape/v2/core/pkg/resourcehandler" - "github.com/armosec/kubescape/v2/core/pkg/resultshandling/reporter" - reporterv2 "github.com/armosec/kubescape/v2/core/pkg/resultshandling/reporter/v2" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/k8s-interface/k8sinterface" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/cautils/getter" + "github.com/kubescape/kubescape/v2/core/pkg/hostsensorutils" + "github.com/kubescape/kubescape/v2/core/pkg/resourcehandler" + "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/reporter" + reporterv2 "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/reporter/v2" "github.com/google/uuid" - "github.com/armosec/rbac-utils/rbacscanner" + "github.com/kubescape/rbac-utils/rbacscanner" ) // getKubernetesApi @@ -27,9 +27,9 @@ func getKubernetesApi() *k8sinterface.KubernetesApi { } func getTenantConfig(credentials *cautils.Credentials, clusterName string, k8s *k8sinterface.KubernetesApi) cautils.ITenantConfig { if !k8sinterface.IsConnectedToCluster() || k8s == nil { - return cautils.NewLocalConfig(getter.GetArmoAPIConnector(), credentials, clusterName) + return cautils.NewLocalConfig(getter.GetKSCloudAPIConnector(), credentials, clusterName) } - return cautils.NewClusterConfig(k8s, getter.GetArmoAPIConnector(), credentials, clusterName) + return cautils.NewClusterConfig(k8s, getter.GetKSCloudAPIConnector(), credentials, clusterName) } func getExceptionsGetter(useExceptions string) getter.IExceptionsGetter { @@ -37,7 +37,7 @@ func getExceptionsGetter(useExceptions string) getter.IExceptionsGetter { // load exceptions from file return getter.NewLoadPolicy([]string{useExceptions}) } else { - return getter.GetArmoAPIConnector() + return getter.GetKSCloudAPIConnector() } } @@ -73,7 +73,7 @@ func getResourceHandler(scanInfo *cautils.ScanInfo, tenantConfig cautils.ITenant // scanInfo.HostSensor.SetBool(false) return resourcehandler.NewFileResourceHandler(scanInfo.InputPatterns, registryAdaptors) } - getter.GetArmoAPIConnector() + getter.GetKSCloudAPIConnector() rbacObjects := getRBACHandler(tenantConfig, k8s, scanInfo.Submit) return resourcehandler.NewK8sResourceHandler(k8s, getFieldSelector(scanInfo), hostSensorHandler, rbacObjects, registryAdaptors) } @@ -124,7 +124,7 @@ func policyIdentifierNames(pi []cautils.PolicyIdentifier) string { return policiesNames } -// setSubmitBehavior - Setup the desired cluster behavior regarding submitting to the Armo BE +// setSubmitBehavior - Setup the desired cluster behavior regarding submitting to the Kubescape Cloud BE func setSubmitBehavior(scanInfo *cautils.ScanInfo, tenantConfig cautils.ITenantConfig) { /* @@ -165,13 +165,13 @@ func setSubmitBehavior(scanInfo *cautils.ScanInfo, tenantConfig cautils.ITenantC } -// setPolicyGetter set the policy getter - local file/github release/ArmoAPI +// setPolicyGetter set the policy getter - local file/github release/Kubescape Cloud API func getPolicyGetter(loadPoliciesFromFile []string, tennatEmail string, frameworkScope bool, downloadReleasedPolicy *getter.DownloadReleasedPolicy) getter.IPolicyGetter { if len(loadPoliciesFromFile) > 0 { return getter.NewLoadPolicy(loadPoliciesFromFile) } if tennatEmail != "" && frameworkScope { - g := getter.GetArmoAPIConnector() // download policy from ARMO backend + g := getter.GetKSCloudAPIConnector() // download policy from Kubescape Cloud backend return g } if downloadReleasedPolicy == nil { @@ -181,13 +181,13 @@ func getPolicyGetter(loadPoliciesFromFile []string, tennatEmail string, framewor } -// setConfigInputsGetter sets the config input getter - local file/github release/ArmoAPI +// setConfigInputsGetter sets the config input getter - local file/github release/Kubescape Cloud API func getConfigInputsGetter(ControlsInputs string, accountID string, downloadReleasedPolicy *getter.DownloadReleasedPolicy) getter.IControlsInputsGetter { if len(ControlsInputs) > 0 { return getter.NewLoadPolicy([]string{ControlsInputs}) } if accountID != "" { - g := getter.GetArmoAPIConnector() // download config from ARMO backend + g := getter.GetKSCloudAPIConnector() // download config from Kubescape Cloud backend return g } if downloadReleasedPolicy == nil { diff --git a/core/core/list.go b/core/core/list.go index 0f357bc3..a0383bf3 100644 --- a/core/core/list.go +++ b/core/core/list.go @@ -6,8 +6,8 @@ import ( "sort" "strings" - "github.com/armosec/kubescape/v2/core/cautils/getter" - metav1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1" + "github.com/kubescape/kubescape/v2/core/cautils/getter" + metav1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1" ) var listFunc = map[string]func(*metav1.ListPolicies) ([]string, error){ @@ -66,8 +66,8 @@ func listExceptions(listPolicies *metav1.ListPolicies) ([]string, error) { getTenantConfig(&listPolicies.Credentials, "", getKubernetesApi()) var exceptionsNames []string - armoAPI := getExceptionsGetter("") - exceptions, err := armoAPI.GetExceptions("") + ksCloudAPI := getExceptionsGetter("") + exceptions, err := ksCloudAPI.GetExceptions("") if err != nil { return exceptionsNames, err } diff --git a/core/core/scan.go b/core/core/scan.go index ace5d25b..3eac8071 100644 --- a/core/core/scan.go +++ b/core/core/scan.go @@ -3,23 +3,23 @@ package core import ( "fmt" - apisv1 "github.com/armosec/opa-utils/httpserver/apis/v1" + apisv1 "github.com/kubescape/opa-utils/httpserver/apis/v1" - "github.com/armosec/k8s-interface/k8sinterface" + "github.com/kubescape/k8s-interface/k8sinterface" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/cautils/getter" - "github.com/armosec/kubescape/v2/core/pkg/hostsensorutils" - "github.com/armosec/kubescape/v2/core/pkg/opaprocessor" - "github.com/armosec/kubescape/v2/core/pkg/policyhandler" - "github.com/armosec/kubescape/v2/core/pkg/resourcehandler" - "github.com/armosec/kubescape/v2/core/pkg/resultshandling" - "github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer" - "github.com/armosec/kubescape/v2/core/pkg/resultshandling/reporter" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/cautils/getter" + "github.com/kubescape/kubescape/v2/core/pkg/hostsensorutils" + "github.com/kubescape/kubescape/v2/core/pkg/opaprocessor" + "github.com/kubescape/kubescape/v2/core/pkg/policyhandler" + "github.com/kubescape/kubescape/v2/core/pkg/resourcehandler" + "github.com/kubescape/kubescape/v2/core/pkg/resultshandling" + "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer" + "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/reporter" - "github.com/armosec/opa-utils/resources" + "github.com/kubescape/opa-utils/resources" ) type componentInterfaces struct { @@ -104,7 +104,7 @@ func getInterfaces(scanInfo *cautils.ScanInfo) componentInterfaces { } func (ks *Kubescape) Scan(scanInfo *cautils.ScanInfo) (*resultshandling.ResultsHandler, error) { - logger.L().Info("ARMO security scanner starting") + logger.L().Info("Kubescape scanner starting") // ===================== Initialization ===================== scanInfo.Init() // initialize scan info diff --git a/core/core/submit.go b/core/core/submit.go index 9033396c..115fc00f 100644 --- a/core/core/submit.go +++ b/core/core/submit.go @@ -1,12 +1,12 @@ package core import ( - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/cautils/getter" - "github.com/armosec/kubescape/v2/core/meta/cliinterfaces" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/cautils/getter" + "github.com/kubescape/kubescape/v2/core/meta/cliinterfaces" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" ) func (ks *Kubescape) Submit(submitInterfaces cliinterfaces.SubmitInterfaces) error { @@ -52,12 +52,12 @@ func (ks *Kubescape) SubmitExceptions(credentials *cautils.Credentials, excPath } // login kubescape SaaS - armoAPI := getter.GetArmoAPIConnector() - if err := armoAPI.Login(); err != nil { + ksCloudAPI := getter.GetKSCloudAPIConnector() + if err := ksCloudAPI.Login(); err != nil { return err } - if err := armoAPI.PostExceptions(exceptions); err != nil { + if err := ksCloudAPI.PostExceptions(exceptions); err != nil { return err } logger.L().Success("Exceptions submitted successfully") diff --git a/core/meta/cliinterfaces/submit.go b/core/meta/cliinterfaces/submit.go index ef81279b..6463b23e 100644 --- a/core/meta/cliinterfaces/submit.go +++ b/core/meta/cliinterfaces/submit.go @@ -1,10 +1,10 @@ package cliinterfaces import ( - "github.com/armosec/k8s-interface/workloadinterface" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/pkg/resultshandling/reporter" - reporthandlingv2 "github.com/armosec/opa-utils/reporthandling/v2" + "github.com/kubescape/k8s-interface/workloadinterface" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/reporter" + reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2" ) type ISubmitObjects interface { diff --git a/core/meta/datastructures/v1/delete.go b/core/meta/datastructures/v1/delete.go index 68d1ac30..b3c72d9d 100644 --- a/core/meta/datastructures/v1/delete.go +++ b/core/meta/datastructures/v1/delete.go @@ -1,6 +1,6 @@ package v1 -import "github.com/armosec/kubescape/v2/core/cautils" +import "github.com/kubescape/kubescape/v2/core/cautils" type DeleteExceptions struct { Credentials cautils.Credentials diff --git a/core/meta/datastructures/v1/download.go b/core/meta/datastructures/v1/download.go index 10de6d8a..6b44c323 100644 --- a/core/meta/datastructures/v1/download.go +++ b/core/meta/datastructures/v1/download.go @@ -1,6 +1,6 @@ package v1 -import "github.com/armosec/kubescape/v2/core/cautils" +import "github.com/kubescape/kubescape/v2/core/cautils" type DownloadInfo struct { Path string // directory to save artifact. Default is "~/.kubescape/" diff --git a/core/meta/datastructures/v1/listpolicies.go b/core/meta/datastructures/v1/listpolicies.go index f3926a11..c1833278 100644 --- a/core/meta/datastructures/v1/listpolicies.go +++ b/core/meta/datastructures/v1/listpolicies.go @@ -1,6 +1,6 @@ package v1 -import "github.com/armosec/kubescape/v2/core/cautils" +import "github.com/kubescape/kubescape/v2/core/cautils" type ListPolicies struct { Target string diff --git a/core/meta/datastructures/v1/submit.go b/core/meta/datastructures/v1/submit.go index 21794a06..20ec27cd 100644 --- a/core/meta/datastructures/v1/submit.go +++ b/core/meta/datastructures/v1/submit.go @@ -1,6 +1,6 @@ package v1 -import "github.com/armosec/kubescape/v2/core/cautils" +import "github.com/kubescape/kubescape/v2/core/cautils" type Submit struct { Credentials cautils.Credentials diff --git a/core/meta/ksinterface.go b/core/meta/ksinterface.go index bb4f4a5e..199b1710 100644 --- a/core/meta/ksinterface.go +++ b/core/meta/ksinterface.go @@ -1,10 +1,10 @@ package meta import ( - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/meta/cliinterfaces" - metav1 "github.com/armosec/kubescape/v2/core/meta/datastructures/v1" - "github.com/armosec/kubescape/v2/core/pkg/resultshandling" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/meta/cliinterfaces" + metav1 "github.com/kubescape/kubescape/v2/core/meta/datastructures/v1" + "github.com/kubescape/kubescape/v2/core/pkg/resultshandling" ) type IKubescape interface { diff --git a/core/mocks/loadmocks.go b/core/mocks/loadmocks.go index 25304191..4c357716 100644 --- a/core/mocks/loadmocks.go +++ b/core/mocks/loadmocks.go @@ -4,8 +4,8 @@ import ( "encoding/json" "github.com/armosec/armoapi-go/armotypes" - "github.com/armosec/k8s-interface/workloadinterface" - "github.com/armosec/opa-utils/reporthandling" + "github.com/kubescape/k8s-interface/workloadinterface" + "github.com/kubescape/opa-utils/reporthandling" ) var mockControl_0006 = `{"guid":"","name":"Allowed hostPath","attributes":{"armoBuiltin":true},"id":"C-0006","controlID":"C-0006","creationTime":"","description":"Mounting host directory to the container can be abused to get access to sensitive data and gain persistence on the host machine.","remediation":"Refrain from using host path mount.","rules":[{"guid":"","name":"alert-rw-hostpath","attributes":{"armoBuiltin":true,"m$K8sThreatMatrix":"Persistence::Writable hostPath mount, Lateral Movement::Writable volume mounts on the host"},"creationTime":"","rule":"package armo_builtins\n\n# input: pod\n# apiversion: v1\n# does: returns hostPath volumes\n\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n volumes := pod.spec.volumes\n volume := volumes[_]\n volume.hostPath\n\tcontainer := pod.spec.containers[i]\n\tvolumeMount := container.volumeMounts[k]\n\tvolumeMount.name == volume.name\n\tbegginingOfPath := \"spec.\"\n\tresult := isRWMount(volumeMount, begginingOfPath, i, k)\n\n podname := pod.metadata.name\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"pod: %v has: %v as hostPath volume\", [podname, volume.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [result],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [pod]\n\t\t}\n\t}\n}\n\n#handles majority of workload resources\ndeny[msga] {\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n volumes := wl.spec.template.spec.volumes\n volume := volumes[_]\n volume.hostPath\n\tcontainer := wl.spec.template.spec.containers[i]\n\tvolumeMount := container.volumeMounts[k]\n\tvolumeMount.name == volume.name\n\tbegginingOfPath := \"spec.template.spec.\"\n\tresult := isRWMount(volumeMount, begginingOfPath, i, k)\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v has: %v as hostPath volume\", [wl.kind, wl.metadata.name, volume.name]),\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertScore\": 7,\n\t\t\"failedPaths\": [result],\n\t\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t\n\t}\n}\n\n#handles CronJobs\ndeny[msga] {\n\twl := input[_]\n\twl.kind == \"CronJob\"\n volumes := wl.spec.jobTemplate.spec.template.spec.volumes\n volume := volumes[_]\n volume.hostPath\n\n\tcontainer = wl.spec.jobTemplate.spec.template.spec.containers[i]\n\tvolumeMount := container.volumeMounts[k]\n\tvolumeMount.name == volume.name\n\tbegginingOfPath := \"spec.jobTemplate.spec.template.spec.\"\n\tresult := isRWMount(volumeMount, begginingOfPath, i, k)\n\n\tmsga := {\n\t\"alertMessage\": sprintf(\"%v: %v has: %v as hostPath volume\", [wl.kind, wl.metadata.name, volume.name]),\n\t\"packagename\": \"armo_builtins\",\n\t\"alertScore\": 7,\n\t\"failedPaths\": [result],\n\t\"alertObject\": {\n\t\t\t\"k8sApiObjects\": [wl]\n\t\t}\n\t}\n}\n\nisRWMount(mount, begginingOfPath, i, k) = path {\n not mount.readOnly == true\n not mount.readOnly == false\n path = \"\"\n}\nisRWMount(mount, begginingOfPath, i, k) = path {\n mount.readOnly == false\n path = sprintf(\"%vcontainers[%v].volumeMounts[%v].readOnly\", [begginingOfPath, format_int(i, 10), format_int(k, 10)])\n} ","resourceEnumerator":"","ruleLanguage":"Rego","match":[{"apiGroups":["*"],"apiVersions":["*"],"resources":["Deployment","ReplicaSet","DaemonSet","StatefulSet","Job","CronJob","Pod"]}],"ruleDependencies":[{"packageName":"cautils"},{"packageName":"kubernetes.api.client"}],"configInputs":null,"controlConfigInputs":null,"description":"determines if any workload contains a hostPath volume with rw permissions","remediation":"Set the readOnly field of the mount to true","ruleQuery":""}],"rulesIDs":[""],"baseScore":6}` diff --git a/core/pkg/hostsensorutils/hostsensordeploy.go b/core/pkg/hostsensorutils/hostsensordeploy.go index 598b87ab..faf21aa6 100644 --- a/core/pkg/hostsensorutils/hostsensordeploy.go +++ b/core/pkg/hostsensorutils/hostsensordeploy.go @@ -8,11 +8,11 @@ import ( "sync" "time" - "github.com/armosec/k8s-interface/k8sinterface" - "github.com/armosec/k8s-interface/workloadinterface" - "github.com/armosec/kubescape/v2/core/cautils" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/k8s-interface/k8sinterface" + "github.com/kubescape/k8s-interface/workloadinterface" + "github.com/kubescape/kubescape/v2/core/cautils" appsv1 "k8s.io/api/apps/v1" corev1 "k8s.io/api/core/v1" diff --git a/core/pkg/hostsensorutils/hostsensorgetfrompod.go b/core/pkg/hostsensorutils/hostsensorgetfrompod.go index 0f8c0ebf..43a0c95f 100644 --- a/core/pkg/hostsensorutils/hostsensorgetfrompod.go +++ b/core/pkg/hostsensorutils/hostsensorgetfrompod.go @@ -5,11 +5,11 @@ import ( "fmt" "sync" - "github.com/armosec/k8s-interface/k8sinterface" - "github.com/armosec/opa-utils/objectsenvelopes/hostsensor" - "github.com/armosec/opa-utils/reporthandling/apis" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/k8s-interface/k8sinterface" + "github.com/kubescape/opa-utils/objectsenvelopes/hostsensor" + "github.com/kubescape/opa-utils/reporthandling/apis" "sigs.k8s.io/yaml" ) diff --git a/core/pkg/hostsensorutils/hostsensorinterface.go b/core/pkg/hostsensorutils/hostsensorinterface.go index 71d5e6ef..9a8c7537 100644 --- a/core/pkg/hostsensorutils/hostsensorinterface.go +++ b/core/pkg/hostsensorutils/hostsensorinterface.go @@ -1,8 +1,8 @@ package hostsensorutils import ( - "github.com/armosec/opa-utils/objectsenvelopes/hostsensor" - "github.com/armosec/opa-utils/reporthandling/apis" + "github.com/kubescape/opa-utils/objectsenvelopes/hostsensor" + "github.com/kubescape/opa-utils/reporthandling/apis" ) type IHostSensor interface { diff --git a/core/pkg/hostsensorutils/hostsensormock.go b/core/pkg/hostsensorutils/hostsensormock.go index f6f22fa0..45e7e606 100644 --- a/core/pkg/hostsensorutils/hostsensormock.go +++ b/core/pkg/hostsensorutils/hostsensormock.go @@ -1,8 +1,8 @@ package hostsensorutils import ( - "github.com/armosec/opa-utils/objectsenvelopes/hostsensor" - "github.com/armosec/opa-utils/reporthandling/apis" + "github.com/kubescape/opa-utils/objectsenvelopes/hostsensor" + "github.com/kubescape/opa-utils/reporthandling/apis" ) type HostSensorHandlerMock struct { diff --git a/core/pkg/hostsensorutils/hostsensorworkerpool.go b/core/pkg/hostsensorutils/hostsensorworkerpool.go index 522d28e9..ded788e5 100644 --- a/core/pkg/hostsensorutils/hostsensorworkerpool.go +++ b/core/pkg/hostsensorutils/hostsensorworkerpool.go @@ -3,9 +3,9 @@ package hostsensorutils import ( "sync" - "github.com/armosec/opa-utils/objectsenvelopes/hostsensor" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/opa-utils/objectsenvelopes/hostsensor" ) const noOfWorkers int = 10 diff --git a/core/pkg/hostsensorutils/utils.go b/core/pkg/hostsensorutils/utils.go index 2de26f97..4b5ecb75 100644 --- a/core/pkg/hostsensorutils/utils.go +++ b/core/pkg/hostsensorutils/utils.go @@ -1,8 +1,8 @@ package hostsensorutils import ( - "github.com/armosec/k8s-interface/k8sinterface" - "github.com/armosec/opa-utils/reporthandling/apis" + "github.com/kubescape/k8s-interface/k8sinterface" + "github.com/kubescape/opa-utils/reporthandling/apis" ) var ( diff --git a/core/pkg/opaprocessor/processorhandler.go b/core/pkg/opaprocessor/processorhandler.go index e45f47bf..f7fcbd01 100644 --- a/core/pkg/opaprocessor/processorhandler.go +++ b/core/pkg/opaprocessor/processorhandler.go @@ -6,21 +6,21 @@ import ( "time" "github.com/armosec/armoapi-go/armotypes" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/pkg/score" - "github.com/armosec/opa-utils/objectsenvelopes" - "github.com/armosec/opa-utils/reporthandling" - "github.com/armosec/opa-utils/reporthandling/apis" - "github.com/armosec/opa-utils/reporthandling/results/v1/resourcesresults" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/pkg/score" + "github.com/kubescape/opa-utils/objectsenvelopes" + "github.com/kubescape/opa-utils/reporthandling" + "github.com/kubescape/opa-utils/reporthandling/apis" + "github.com/kubescape/opa-utils/reporthandling/results/v1/resourcesresults" "github.com/open-policy-agent/opa/storage" - "github.com/armosec/k8s-interface/workloadinterface" + "github.com/kubescape/k8s-interface/workloadinterface" - reporthandlingv2 "github.com/armosec/opa-utils/reporthandling/v2" - "github.com/armosec/opa-utils/resources" + reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2" + "github.com/kubescape/opa-utils/resources" "github.com/open-policy-agent/opa/ast" "github.com/open-policy-agent/opa/rego" ) diff --git a/core/pkg/opaprocessor/processorhandler_test.go b/core/pkg/opaprocessor/processorhandler_test.go index f1e86be8..65099d17 100644 --- a/core/pkg/opaprocessor/processorhandler_test.go +++ b/core/pkg/opaprocessor/processorhandler_test.go @@ -4,13 +4,13 @@ import ( "testing" "github.com/armosec/armoapi-go/armotypes" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/mocks" - "github.com/armosec/opa-utils/reporthandling" - "github.com/armosec/opa-utils/resources" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/mocks" + "github.com/kubescape/opa-utils/reporthandling" + "github.com/kubescape/opa-utils/resources" "github.com/stretchr/testify/assert" - "github.com/armosec/k8s-interface/workloadinterface" + "github.com/kubescape/k8s-interface/workloadinterface" // _ "k8s.io/client-go/plugin/pkg/client/auth" ) diff --git a/core/pkg/opaprocessor/processorhandlerutils.go b/core/pkg/opaprocessor/processorhandlerutils.go index 50338b27..ef796ae8 100644 --- a/core/pkg/opaprocessor/processorhandlerutils.go +++ b/core/pkg/opaprocessor/processorhandlerutils.go @@ -1,15 +1,15 @@ package opaprocessor import ( - "github.com/armosec/kubescape/v2/core/cautils" - logger "github.com/dwertent/go-logger" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/kubescape/v2/core/cautils" - "github.com/armosec/k8s-interface/k8sinterface" - "github.com/armosec/k8s-interface/workloadinterface" - "github.com/armosec/opa-utils/reporthandling" - "github.com/armosec/opa-utils/reporthandling/apis" - "github.com/armosec/opa-utils/reporthandling/results/v1/reportsummary" - resources "github.com/armosec/opa-utils/resources" + "github.com/kubescape/k8s-interface/k8sinterface" + "github.com/kubescape/k8s-interface/workloadinterface" + "github.com/kubescape/opa-utils/reporthandling" + "github.com/kubescape/opa-utils/reporthandling/apis" + "github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary" + resources "github.com/kubescape/opa-utils/resources" ) // updateResults update the results objects and report objects. This is a critical function - DO NOT CHANGE @@ -84,14 +84,14 @@ func isEmptyResources(counters reportsummary.ICounters) bool { return counters.Failed() == 0 && counters.Excluded() == 0 && counters.Passed() == 0 } -func getAllSupportedObjects(k8sResources *cautils.K8SResources, armoResources *cautils.ArmoResources, allResources map[string]workloadinterface.IMetadata, rule *reporthandling.PolicyRule) []workloadinterface.IMetadata { +func getAllSupportedObjects(k8sResources *cautils.K8SResources, ksResources *cautils.KSResources, allResources map[string]workloadinterface.IMetadata, rule *reporthandling.PolicyRule) []workloadinterface.IMetadata { k8sObjects := []workloadinterface.IMetadata{} k8sObjects = append(k8sObjects, getKubernetesObjects(k8sResources, allResources, rule.Match)...) - k8sObjects = append(k8sObjects, getArmoObjects(armoResources, allResources, rule.DynamicMatch)...) + k8sObjects = append(k8sObjects, getKSObjects(ksResources, allResources, rule.DynamicMatch)...) return k8sObjects } -func getArmoObjects(k8sResources *cautils.ArmoResources, allResources map[string]workloadinterface.IMetadata, match []reporthandling.RuleMatchObjects) []workloadinterface.IMetadata { +func getKSObjects(k8sResources *cautils.KSResources, allResources map[string]workloadinterface.IMetadata, match []reporthandling.RuleMatchObjects) []workloadinterface.IMetadata { k8sObjects := []workloadinterface.IMetadata{} for m := range match { diff --git a/core/pkg/opaprocessor/processorhandlerutils_test.go b/core/pkg/opaprocessor/processorhandlerutils_test.go index 3297e720..1cfe947c 100644 --- a/core/pkg/opaprocessor/processorhandlerutils_test.go +++ b/core/pkg/opaprocessor/processorhandlerutils_test.go @@ -5,7 +5,7 @@ import ( "github.com/stretchr/testify/assert" - "github.com/armosec/k8s-interface/workloadinterface" + "github.com/kubescape/k8s-interface/workloadinterface" ) func TestRemoveData(t *testing.T) { diff --git a/core/pkg/opaprocessor/utils.go b/core/pkg/opaprocessor/utils.go index 836bff1d..726ae3d6 100644 --- a/core/pkg/opaprocessor/utils.go +++ b/core/pkg/opaprocessor/utils.go @@ -1,9 +1,9 @@ package opaprocessor import ( - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/opa-utils/reporthandling" - "github.com/armosec/opa-utils/reporthandling/results/v1/reportsummary" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/opa-utils/reporthandling" + "github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary" ) // ConvertFrameworksToPolicies convert list of frameworks to list of policies diff --git a/core/pkg/opaprocessor/utils_test.go b/core/pkg/opaprocessor/utils_test.go index b9120259..aca866a1 100644 --- a/core/pkg/opaprocessor/utils_test.go +++ b/core/pkg/opaprocessor/utils_test.go @@ -5,9 +5,9 @@ import ( "github.com/stretchr/testify/assert" - "github.com/armosec/kubescape/v2/core/mocks" - "github.com/armosec/opa-utils/reporthandling" - "github.com/armosec/opa-utils/reporthandling/results/v1/reportsummary" + "github.com/kubescape/kubescape/v2/core/mocks" + "github.com/kubescape/opa-utils/reporthandling" + "github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary" ) func TestConvertFrameworksToPolicies(t *testing.T) { diff --git a/core/pkg/policyhandler/handlenotification.go b/core/pkg/policyhandler/handlenotification.go index 2955d838..cb86ae14 100644 --- a/core/pkg/policyhandler/handlenotification.go +++ b/core/pkg/policyhandler/handlenotification.go @@ -4,8 +4,8 @@ import ( "fmt" "github.com/armosec/armoapi-go/armotypes" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/pkg/resourcehandler" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/pkg/resourcehandler" ) // PolicyHandler - @@ -49,14 +49,14 @@ func (policyHandler *PolicyHandler) CollectResources(policyIdentifier []cautils. func (policyHandler *PolicyHandler) getResources(policyIdentifier []cautils.PolicyIdentifier, opaSessionObj *cautils.OPASessionObj, scanInfo *cautils.ScanInfo) error { opaSessionObj.Report.ClusterAPIServerInfo = policyHandler.resourceHandler.GetClusterAPIServerInfo() - resourcesMap, allResources, armoResources, err := policyHandler.resourceHandler.GetResources(opaSessionObj, &policyIdentifier[0].Designators) + resourcesMap, allResources, ksResources, err := policyHandler.resourceHandler.GetResources(opaSessionObj, &policyIdentifier[0].Designators) if err != nil { return err } opaSessionObj.K8SResources = resourcesMap opaSessionObj.AllResources = allResources - opaSessionObj.ArmoResource = armoResources + opaSessionObj.ArmoResource = ksResources return nil } diff --git a/core/pkg/policyhandler/handlepullpolicies.go b/core/pkg/policyhandler/handlepullpolicies.go index 433a8edc..3c1ec482 100644 --- a/core/pkg/policyhandler/handlepullpolicies.go +++ b/core/pkg/policyhandler/handlepullpolicies.go @@ -4,13 +4,13 @@ import ( "fmt" "strings" - apisv1 "github.com/armosec/opa-utils/httpserver/apis/v1" + apisv1 "github.com/kubescape/opa-utils/httpserver/apis/v1" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/cautils/getter" - "github.com/armosec/opa-utils/reporthandling" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/cautils/getter" + "github.com/kubescape/opa-utils/reporthandling" ) func (policyHandler *PolicyHandler) getPolicies(policyIdentifier []cautils.PolicyIdentifier, policiesAndResources *cautils.OPASessionObj) error { diff --git a/core/pkg/policyhandler/handlepullpoliciesutils.go b/core/pkg/policyhandler/handlepullpoliciesutils.go index ba15be3f..4e109e8a 100644 --- a/core/pkg/policyhandler/handlepullpoliciesutils.go +++ b/core/pkg/policyhandler/handlepullpoliciesutils.go @@ -4,9 +4,9 @@ import ( "fmt" "strings" - apisv1 "github.com/armosec/opa-utils/httpserver/apis/v1" + apisv1 "github.com/kubescape/opa-utils/httpserver/apis/v1" - "github.com/armosec/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/cautils" ) func getScanKind(policyIdentifier []cautils.PolicyIdentifier) apisv1.NotificationPolicyKind { diff --git a/core/pkg/registryadaptors/armosec/v1/civarmoadaptor.go b/core/pkg/registryadaptors/armosec/v1/civksadaptor.go similarity index 53% rename from core/pkg/registryadaptors/armosec/v1/civarmoadaptor.go rename to core/pkg/registryadaptors/armosec/v1/civksadaptor.go index 52d75470..885b3906 100644 --- a/core/pkg/registryadaptors/armosec/v1/civarmoadaptor.go +++ b/core/pkg/registryadaptors/armosec/v1/civksadaptor.go @@ -4,29 +4,29 @@ import ( "encoding/json" "fmt" - "github.com/armosec/kubescape/v2/core/cautils/getter" - "github.com/armosec/kubescape/v2/core/pkg/containerscan" - "github.com/armosec/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/kubescape/v2/core/cautils/getter" + "github.com/kubescape/kubescape/v2/core/pkg/containerscan" + "github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities" ) -func NewArmoAdaptor(armoAPI *getter.ArmoAPI) *ArmoCivAdaptor { - return &ArmoCivAdaptor{ - armoAPI: armoAPI, +func NewKSAdaptor(api *getter.KSCloudAPI) *KSCivAdaptor { + return &KSCivAdaptor{ + ksCloudAPI: api, } } -func (armoCivAdaptor *ArmoCivAdaptor) Login() error { - if armoCivAdaptor.armoAPI.IsLoggedIn() { +func (ksCivAdaptor *KSCivAdaptor) Login() error { + if ksCivAdaptor.ksCloudAPI.IsLoggedIn() { return nil } - return armoCivAdaptor.armoAPI.Login() + return ksCivAdaptor.ksCloudAPI.Login() } -func (armoCivAdaptor *ArmoCivAdaptor) GetImagesVulnerabilities(imageIDs []registryvulnerabilities.ContainerImageIdentifier) ([]registryvulnerabilities.ContainerImageVulnerabilityReport, error) { +func (ksCivAdaptor *KSCivAdaptor) GetImagesVulnerabilities(imageIDs []registryvulnerabilities.ContainerImageIdentifier) ([]registryvulnerabilities.ContainerImageVulnerabilityReport, error) { resultList := make([]registryvulnerabilities.ContainerImageVulnerabilityReport, 0) for _, imageID := range imageIDs { - result, err := armoCivAdaptor.GetImageVulnerability(&imageID) + result, err := ksCivAdaptor.GetImageVulnerability(&imageID) if err == nil { resultList = append(resultList, *result) } else { @@ -36,9 +36,9 @@ func (armoCivAdaptor *ArmoCivAdaptor) GetImagesVulnerabilities(imageIDs []regist return resultList, nil } -func (armoCivAdaptor *ArmoCivAdaptor) GetImageVulnerability(imageID *registryvulnerabilities.ContainerImageIdentifier) (*registryvulnerabilities.ContainerImageVulnerabilityReport, error) { +func (ksCivAdaptor *KSCivAdaptor) GetImageVulnerability(imageID *registryvulnerabilities.ContainerImageIdentifier) (*registryvulnerabilities.ContainerImageVulnerabilityReport, error) { // First - containerScanId, err := armoCivAdaptor.getImageLastScanId(imageID) + containerScanId, err := ksCivAdaptor.getImageLastScanId(imageID) if err != nil { return nil, err } @@ -51,9 +51,9 @@ func (armoCivAdaptor *ArmoCivAdaptor) GetImageVulnerability(imageID *registryvul pageNumber := 1 request := V2ListRequest{PageSize: &pageSize, PageNum: &pageNumber, InnerFilters: filter, OrderBy: "timestamp:desc"} requestBody, _ := json.Marshal(request) - requestUrl := fmt.Sprintf("https://%s/api/v1/vulnerability/scanResultsDetails?customerGUID=%s", armoCivAdaptor.armoAPI.GetApiURL(), armoCivAdaptor.armoAPI.GetAccountID()) + requestUrl := fmt.Sprintf("https://%s/api/v1/vulnerability/scanResultsDetails?customerGUID=%s", ksCivAdaptor.ksCloudAPI.GetApiURL(), ksCivAdaptor.ksCloudAPI.GetAccountID()) - resp, err := armoCivAdaptor.armoAPI.Post(requestUrl, map[string]string{"Content-Type": "application/json"}, requestBody) + resp, err := ksCivAdaptor.ksCloudAPI.Post(requestUrl, map[string]string{"Content-Type": "application/json"}, requestBody) if err != nil { return nil, err } @@ -82,16 +82,16 @@ func (armoCivAdaptor *ArmoCivAdaptor) GetImageVulnerability(imageID *registryvul return &resultImageVulnerabilityReport, nil } -func (armoCivAdaptor *ArmoCivAdaptor) DescribeAdaptor() string { +func (ksCivAdaptor *KSCivAdaptor) DescribeAdaptor() string { return "armo image vulnerabilities scanner, docs: https://hub.armosec.io/docs/configuration-of-image-vulnerabilities" } -func (armoCivAdaptor *ArmoCivAdaptor) GetImagesInformation(imageIDs []registryvulnerabilities.ContainerImageIdentifier) ([]registryvulnerabilities.ContainerImageInformation, error) { +func (ksCivAdaptor *KSCivAdaptor) GetImagesInformation(imageIDs []registryvulnerabilities.ContainerImageIdentifier) ([]registryvulnerabilities.ContainerImageInformation, error) { // TODO return []registryvulnerabilities.ContainerImageInformation{}, nil } -func (armoCivAdaptor *ArmoCivAdaptor) GetImagesScanStatus(imageIDs []registryvulnerabilities.ContainerImageIdentifier) ([]registryvulnerabilities.ContainerImageScanStatus, error) { +func (ksCivAdaptor *KSCivAdaptor) GetImagesScanStatus(imageIDs []registryvulnerabilities.ContainerImageIdentifier) ([]registryvulnerabilities.ContainerImageScanStatus, error) { // TODO return []registryvulnerabilities.ContainerImageScanStatus{}, nil } diff --git a/core/pkg/registryadaptors/armosec/v1/civarmoadaptor_test.go b/core/pkg/registryadaptors/armosec/v1/civksadaptor_test.go similarity index 86% rename from core/pkg/registryadaptors/armosec/v1/civarmoadaptor_test.go rename to core/pkg/registryadaptors/armosec/v1/civksadaptor_test.go index 03b87d6a..cd83a94f 100644 --- a/core/pkg/registryadaptors/armosec/v1/civarmoadaptor_test.go +++ b/core/pkg/registryadaptors/armosec/v1/civksadaptor_test.go @@ -3,7 +3,7 @@ package v1 import ( "testing" - "github.com/armosec/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities" + "github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities" "github.com/stretchr/testify/assert" ) diff --git a/core/pkg/registryadaptors/armosec/v1/civarmoadaptormock.go b/core/pkg/registryadaptors/armosec/v1/civksadaptormock.go similarity index 99% rename from core/pkg/registryadaptors/armosec/v1/civarmoadaptormock.go rename to core/pkg/registryadaptors/armosec/v1/civksadaptormock.go index 14747536..fcf598c1 100644 --- a/core/pkg/registryadaptors/armosec/v1/civarmoadaptormock.go +++ b/core/pkg/registryadaptors/armosec/v1/civksadaptormock.go @@ -3,8 +3,8 @@ package v1 import ( "encoding/json" - "github.com/armosec/kubescape/v2/core/pkg/containerscan" - "github.com/armosec/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities" + "github.com/kubescape/kubescape/v2/core/pkg/containerscan" + "github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities" ) type ArmoCivAdaptorMock struct { diff --git a/core/pkg/registryadaptors/armosec/v1/civarmoadaptorutils.go b/core/pkg/registryadaptors/armosec/v1/civksadaptorutils.go similarity index 82% rename from core/pkg/registryadaptors/armosec/v1/civarmoadaptorutils.go rename to core/pkg/registryadaptors/armosec/v1/civksadaptorutils.go index f70d9f7a..5aaf2d32 100644 --- a/core/pkg/registryadaptors/armosec/v1/civarmoadaptorutils.go +++ b/core/pkg/registryadaptors/armosec/v1/civksadaptorutils.go @@ -4,19 +4,19 @@ import ( "encoding/json" "fmt" - "github.com/armosec/kubescape/v2/core/pkg/containerscan" - "github.com/armosec/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities" + "github.com/kubescape/kubescape/v2/core/pkg/containerscan" + "github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities" ) -func (armoCivAdaptor *ArmoCivAdaptor) getImageLastScanId(imageID *registryvulnerabilities.ContainerImageIdentifier) (string, error) { +func (armoCivAdaptor *KSCivAdaptor) getImageLastScanId(imageID *registryvulnerabilities.ContainerImageIdentifier) (string, error) { filter := []map[string]string{{"imageTag": imageID.Tag, "status": "Success"}} pageSize := 1 pageNumber := 1 request := V2ListRequest{PageSize: &pageSize, PageNum: &pageNumber, InnerFilters: filter, OrderBy: "timestamp:desc"} requestBody, _ := json.Marshal(request) - requestUrl := fmt.Sprintf("https://%s/api/v1/vulnerability/scanResultsSumSummary?customerGUID=%s", armoCivAdaptor.armoAPI.GetApiURL(), armoCivAdaptor.armoAPI.GetAccountID()) + requestUrl := fmt.Sprintf("https://%s/api/v1/vulnerability/scanResultsSumSummary?customerGUID=%s", armoCivAdaptor.ksCloudAPI.GetApiURL(), armoCivAdaptor.ksCloudAPI.GetAccountID()) - resp, err := armoCivAdaptor.armoAPI.Post(requestUrl, map[string]string{"Content-Type": "application/json"}, requestBody) + resp, err := armoCivAdaptor.ksCloudAPI.Post(requestUrl, map[string]string{"Content-Type": "application/json"}, requestBody) if err != nil { return "", err } diff --git a/core/pkg/registryadaptors/armosec/v1/datastructures.go b/core/pkg/registryadaptors/armosec/v1/datastructures.go index 1a596807..5667f8e9 100644 --- a/core/pkg/registryadaptors/armosec/v1/datastructures.go +++ b/core/pkg/registryadaptors/armosec/v1/datastructures.go @@ -3,7 +3,7 @@ package v1 import ( "time" - "github.com/armosec/kubescape/v2/core/cautils/getter" + "github.com/kubescape/kubescape/v2/core/cautils/getter" ) type V2ListRequest struct { @@ -30,6 +30,7 @@ type V2ListRequest struct { FieldsList []string `json:"includeFields,omitempty"` FieldsReverseKeywordMap map[string]string `json:"-,omitempty"` } -type ArmoCivAdaptor struct { - armoAPI *getter.ArmoAPI + +type KSCivAdaptor struct { + ksCloudAPI *getter.KSCloudAPI } diff --git a/core/pkg/resourcehandler/fieldselector.go b/core/pkg/resourcehandler/fieldselector.go index 937d13f7..269e9f1b 100644 --- a/core/pkg/resourcehandler/fieldselector.go +++ b/core/pkg/resourcehandler/fieldselector.go @@ -4,7 +4,7 @@ import ( "fmt" "strings" - "github.com/armosec/k8s-interface/k8sinterface" + "github.com/kubescape/k8s-interface/k8sinterface" "k8s.io/apimachinery/pkg/runtime/schema" ) diff --git a/core/pkg/resourcehandler/fieldselector_test.go b/core/pkg/resourcehandler/fieldselector_test.go index 15e3e1ac..3ba54e48 100644 --- a/core/pkg/resourcehandler/fieldselector_test.go +++ b/core/pkg/resourcehandler/fieldselector_test.go @@ -3,7 +3,7 @@ package resourcehandler import ( "testing" - "github.com/armosec/k8s-interface/k8sinterface" + "github.com/kubescape/k8s-interface/k8sinterface" "github.com/stretchr/testify/assert" "k8s.io/apimachinery/pkg/runtime/schema" ) diff --git a/core/pkg/resourcehandler/filesloader.go b/core/pkg/resourcehandler/filesloader.go index 5c64acbc..44ec7a8d 100644 --- a/core/pkg/resourcehandler/filesloader.go +++ b/core/pkg/resourcehandler/filesloader.go @@ -6,14 +6,14 @@ import ( "path/filepath" "github.com/armosec/armoapi-go/armotypes" - "github.com/armosec/k8s-interface/workloadinterface" - "github.com/armosec/opa-utils/reporthandling" + "github.com/kubescape/k8s-interface/workloadinterface" + "github.com/kubescape/opa-utils/reporthandling" "k8s.io/apimachinery/pkg/version" - "github.com/armosec/k8s-interface/k8sinterface" - "github.com/armosec/kubescape/v2/core/cautils" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/k8s-interface/k8sinterface" + "github.com/kubescape/kubescape/v2/core/cautils" ) // FileResourceHandler handle resources from files and URLs @@ -30,7 +30,7 @@ func NewFileResourceHandler(inputPatterns []string, registryAdaptors *RegistryAd } } -func (fileHandler *FileResourceHandler) GetResources(sessionObj *cautils.OPASessionObj, designator *armotypes.PortalDesignator) (*cautils.K8SResources, map[string]workloadinterface.IMetadata, *cautils.ArmoResources, error) { +func (fileHandler *FileResourceHandler) GetResources(sessionObj *cautils.OPASessionObj, designator *armotypes.PortalDesignator) (*cautils.K8SResources, map[string]workloadinterface.IMetadata, *cautils.KSResources, error) { // // build resources map @@ -38,7 +38,7 @@ func (fileHandler *FileResourceHandler) GetResources(sessionObj *cautils.OPASess k8sResources := setK8sResourceMap(sessionObj.Policies) allResources := map[string]workloadinterface.IMetadata{} workloadIDToSource := make(map[string]reporthandling.Source, 0) - armoResources := &cautils.ArmoResources{} + ksResources := &cautils.KSResources{} workloads := []workloadinterface.IMetadata{} @@ -179,14 +179,14 @@ func (fileHandler *FileResourceHandler) GetResources(sessionObj *cautils.OPASess } } - if err := fileHandler.registryAdaptors.collectImagesVulnerabilities(k8sResources, allResources, armoResources); err != nil { + if err := fileHandler.registryAdaptors.collectImagesVulnerabilities(k8sResources, allResources, ksResources); err != nil { logger.L().Warning("failed to collect images vulnerabilities", helpers.Error(err)) } cautils.StopSpinner() logger.L().Success("Accessed to local objects") - return k8sResources, allResources, armoResources, nil + return k8sResources, allResources, ksResources, nil } func (fileHandler *FileResourceHandler) GetClusterAPIServerInfo() *version.Info { diff --git a/core/pkg/resourcehandler/filesloaderutils.go b/core/pkg/resourcehandler/filesloaderutils.go index 37d74acd..7f9ec407 100644 --- a/core/pkg/resourcehandler/filesloaderutils.go +++ b/core/pkg/resourcehandler/filesloaderutils.go @@ -5,12 +5,12 @@ import ( "path/filepath" giturl "github.com/armosec/go-git-url" - "github.com/armosec/k8s-interface/k8sinterface" - "github.com/armosec/k8s-interface/workloadinterface" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/opa-utils/reporthandling" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/k8s-interface/k8sinterface" + "github.com/kubescape/k8s-interface/workloadinterface" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/opa-utils/reporthandling" ) // Clone git repository diff --git a/core/pkg/resourcehandler/k8sresources.go b/core/pkg/resourcehandler/k8sresources.go index 75fa55f8..8035335e 100644 --- a/core/pkg/resourcehandler/k8sresources.go +++ b/core/pkg/resourcehandler/k8sresources.go @@ -5,16 +5,16 @@ import ( "fmt" "strings" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/pkg/hostsensorutils" - "github.com/armosec/opa-utils/objectsenvelopes" - "github.com/armosec/opa-utils/reporthandling/apis" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/pkg/hostsensorutils" + "github.com/kubescape/opa-utils/objectsenvelopes" + "github.com/kubescape/opa-utils/reporthandling/apis" - "github.com/armosec/k8s-interface/cloudsupport" - "github.com/armosec/k8s-interface/k8sinterface" - "github.com/armosec/k8s-interface/workloadinterface" + "github.com/kubescape/k8s-interface/cloudsupport" + "github.com/kubescape/k8s-interface/k8sinterface" + "github.com/kubescape/k8s-interface/workloadinterface" "github.com/armosec/armoapi-go/armotypes" @@ -45,7 +45,7 @@ func NewK8sResourceHandler(k8s *k8sinterface.KubernetesApi, fieldSelector IField } } -func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessionObj, designator *armotypes.PortalDesignator) (*cautils.K8SResources, map[string]workloadinterface.IMetadata, *cautils.ArmoResources, error) { +func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessionObj, designator *armotypes.PortalDesignator) (*cautils.K8SResources, map[string]workloadinterface.IMetadata, *cautils.KSResources, error) { allResources := map[string]workloadinterface.IMetadata{} // get k8s resources @@ -61,14 +61,14 @@ func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessio _, namespace, labels := armotypes.DigestPortalDesignator(designator) // pull k8s recourses - armoResourceMap := setArmoResourceMap(sessionObj.Policies, resourceToControl) + ksResourceMap := setKSResourceMap(sessionObj.Policies, resourceToControl) - // map of armo resources to control_ids + // map of Kubescape resources to control_ids sessionObj.ResourceToControlsMap = resourceToControl if err := k8sHandler.pullResources(k8sResourcesMap, allResources, namespace, labels); err != nil { cautils.StopSpinner() - return k8sResourcesMap, allResources, armoResourceMap, err + return k8sResourcesMap, allResources, ksResourceMap, err } numberOfWorkerNodes, err := k8sHandler.pullWorkerNodesNumber() @@ -76,29 +76,27 @@ func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessio if err != nil { logger.L().Debug("failed to collect worker nodes number", helpers.Error(err)) } else { - if sessionObj.Metadata != nil && sessionObj.Metadata.ContextMetadata.ClusterContextMetadata != nil { - sessionObj.Metadata.ContextMetadata.ClusterContextMetadata.NumberOfWorkerNodes = numberOfWorkerNodes - } + sessionObj.SetNumberOfWorkerNodes(numberOfWorkerNodes) } - imgVulnResources := cautils.MapImageVulnResources(armoResourceMap) + imgVulnResources := cautils.MapImageVulnResources(ksResourceMap) // check that controls use image vulnerability resources if len(imgVulnResources) > 0 { - if err := k8sHandler.registryAdaptors.collectImagesVulnerabilities(k8sResourcesMap, allResources, armoResourceMap); err != nil { + if err := k8sHandler.registryAdaptors.collectImagesVulnerabilities(k8sResourcesMap, allResources, ksResourceMap); err != nil { logger.L().Warning("failed to collect image vulnerabilities", helpers.Error(err)) cautils.SetInfoMapForResources(fmt.Sprintf("failed to pull image scanning data: %s. for more information: https://hub.armosec.io/docs/configuration-of-image-vulnerabilities", err.Error()), imgVulnResources, sessionObj.InfoMap) } else { - if isEmptyImgVulns(*armoResourceMap) { + if isEmptyImgVulns(*ksResourceMap) { cautils.SetInfoMapForResources("image scanning is not configured. for more information: https://hub.armosec.io/docs/configuration-of-image-vulnerabilities", imgVulnResources, sessionObj.InfoMap) } } } - hostResources := cautils.MapHostResources(armoResourceMap) + hostResources := cautils.MapHostResources(ksResourceMap) // check that controls use host sensor resources if len(hostResources) > 0 { if sessionObj.Metadata.ScanMetadata.HostScanner { - infoMap, err := k8sHandler.collectHostResources(allResources, armoResourceMap) + infoMap, err := k8sHandler.collectHostResources(allResources, ksResourceMap) if err != nil { logger.L().Warning("failed to collect host scanner resources", helpers.Error(err)) cautils.SetInfoMapForResources(err.Error(), hostResources, sessionObj.InfoMap) @@ -117,10 +115,13 @@ func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessio logger.L().Warning("failed to collect rbac resources", helpers.Error(err)) } - cloudResources := cautils.MapCloudResources(armoResourceMap) + cloudResources := cautils.MapCloudResources(ksResourceMap) + + setMapNamespaceToNumOfResources(allResources, sessionObj) + // check that controls use cloud resources if len(cloudResources) > 0 { - provider, err := getCloudProviderDescription(allResources, armoResourceMap) + provider, err := getCloudProviderDescription(allResources, ksResourceMap) if err != nil { cautils.SetInfoMapForResources(err.Error(), cloudResources, sessionObj.InfoMap) logger.L().Warning("failed to collect cloud data", helpers.Error(err)) @@ -135,7 +136,7 @@ func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessio cautils.StopSpinner() logger.L().Success("Accessed to Kubernetes objects") - return k8sResourcesMap, allResources, armoResourceMap, nil + return k8sResourcesMap, allResources, ksResourceMap, nil } func (k8sHandler *K8sResourceHandler) GetClusterAPIServerInfo() *version.Info { @@ -147,6 +148,30 @@ func (k8sHandler *K8sResourceHandler) GetClusterAPIServerInfo() *version.Info { return clusterAPIServerInfo } +// set namespaceToNumOfResources map in report +func setMapNamespaceToNumOfResources(allResources map[string]workloadinterface.IMetadata, sessionObj *cautils.OPASessionObj) { + + mapNamespaceToNumberOfResources := make(map[string]int) + for _, resource := range allResources { + if obj := workloadinterface.NewWorkloadObj(resource.GetObject()); obj != nil { + ownerReferences, err := obj.GetOwnerReferences() + if err == nil { + // Add an object to the map if the object does not have a parent but is contained within a namespace (except Job) + if len(ownerReferences) == 0 { + if ns := resource.GetNamespace(); ns != "" { + if obj.GetKind() != "Job" { + mapNamespaceToNumberOfResources[ns]++ + } + } + } + } else { + logger.L().Warning(fmt.Sprintf("failed to get owner references. Resource %s will not be counted", obj.GetName()), helpers.Error(err)) + } + } + } + sessionObj.SetMapNamespaceToNumberOfResources(mapNamespaceToNumberOfResources) +} + func (k8sHandler *K8sResourceHandler) pullResources(k8sResources *cautils.K8SResources, allResources map[string]workloadinterface.IMetadata, namespace string, labels map[string]string) error { var errs error @@ -220,19 +245,7 @@ func ConvertMapListToMeta(resourceMap []map[string]interface{}) []workloadinterf return workloads } -// func (k8sHandler *K8sResourceHandler) collectHostResourcesAPI(allResources map[string]workloadinterface.IMetadata, resourcesMap *cautils.K8SResources) error { - -// HostSensorAPI := map[string]string{ -// "bla/v1": "", -// } -// for apiVersion := range allResources { -// if HostSensorAPI == apiVersion { -// k8sHandler.collectHostResources() -// } -// } -// return nil -// } -func (k8sHandler *K8sResourceHandler) collectHostResources(allResources map[string]workloadinterface.IMetadata, armoResourceMap *cautils.ArmoResources) (map[string]apis.StatusInfo, error) { +func (k8sHandler *K8sResourceHandler) collectHostResources(allResources map[string]workloadinterface.IMetadata, ksResourceMap *cautils.KSResources) (map[string]apis.StatusInfo, error) { logger.L().Debug("Collecting host scanner resources") hostResources, infoMap, err := k8sHandler.hostSensorHandler.CollectResources() if err != nil { @@ -244,11 +257,11 @@ func (k8sHandler *K8sResourceHandler) collectHostResources(allResources map[stri groupResource := k8sinterface.JoinResourceTriplets(group, version, hostResources[rscIdx].GetKind()) allResources[hostResources[rscIdx].GetID()] = &hostResources[rscIdx] - grpResourceList, ok := (*armoResourceMap)[groupResource] + grpResourceList, ok := (*ksResourceMap)[groupResource] if !ok { grpResourceList = make([]string, 0) } - (*armoResourceMap)[groupResource] = append(grpResourceList, hostResources[rscIdx].GetID()) + (*ksResourceMap)[groupResource] = append(grpResourceList, hostResources[rscIdx].GetID()) } return infoMap, nil } @@ -269,7 +282,7 @@ func (k8sHandler *K8sResourceHandler) collectRbacResources(allResources map[stri return nil } -func getCloudProviderDescription(allResources map[string]workloadinterface.IMetadata, armoResourceMap *cautils.ArmoResources) (string, error) { +func getCloudProviderDescription(allResources map[string]workloadinterface.IMetadata, ksResourceMap *cautils.KSResources) (string, error) { logger.L().Debug("Collecting cloud data") clusterName := cautils.ClusterName @@ -286,7 +299,7 @@ func getCloudProviderDescription(allResources map[string]workloadinterface.IMeta return provider, fmt.Errorf("failed to get %s descriptive information. Read more: https://hub.armosec.io/docs/kubescape-integration-with-cloud-providers", strings.ToUpper(provider)) } allResources[wl.GetID()] = wl - (*armoResourceMap)[fmt.Sprintf("%s/%s", wl.GetApiVersion(), wl.GetKind())] = []string{wl.GetID()} + (*ksResourceMap)[fmt.Sprintf("%s/%s", wl.GetApiVersion(), wl.GetKind())] = []string{wl.GetID()} } return provider, nil diff --git a/core/pkg/resourcehandler/k8sresources_test.go b/core/pkg/resourcehandler/k8sresources_test.go index 326ddbbc..00025f4d 100644 --- a/core/pkg/resourcehandler/k8sresources_test.go +++ b/core/pkg/resourcehandler/k8sresources_test.go @@ -1,9 +1,13 @@ package resourcehandler import ( + _ "embed" "encoding/json" + "reflect" "testing" + "github.com/kubescape/k8s-interface/workloadinterface" + "github.com/kubescape/kubescape/v2/core/cautils" "github.com/stretchr/testify/assert" v1 "k8s.io/api/core/v1" ) @@ -158,8 +162,8 @@ func TestIsMasterNodeTaints(t *testing.T) { }, { "names": [ - "quay.io/armosec/kubescape@sha256:6196f766be50d94b45d903a911f5ee95ac99bc392a1324c3e063bec41efd98ba", - "quay.io/armosec/kubescape:v2.0.153" + "quay.io/kubescape/kubescape@sha256:6196f766be50d94b45d903a911f5ee95ac99bc392a1324c3e063bec41efd98ba", + "quay.io/kubescape/kubescape:v2.0.153" ], "sizeBytes": 110345054 }, @@ -423,8 +427,8 @@ func TestIsMasterNodeTaints(t *testing.T) { }, { "names": [ - "quay.io/armosec/kubescape@sha256:6196f766be50d94b45d903a911f5ee95ac99bc392a1324c3e063bec41efd98ba", - "quay.io/armosec/kubescape:v2.0.153" + "quay.io/kubescape/kubescape@sha256:6196f766be50d94b45d903a911f5ee95ac99bc392a1324c3e063bec41efd98ba", + "quay.io/kubescape/kubescape:v2.0.153" ], "sizeBytes": 110345054 }, @@ -530,3 +534,35 @@ func TestIsMasterNodeTaints(t *testing.T) { _ = json.Unmarshal([]byte(taintNode), &l) assert.True(t, isMasterNodeTaints(l.Spec.Taints)) } + +func TestSetMapNamespaceToNumOfResources(t *testing.T) { + allResources := make(map[string]workloadinterface.IMetadata) + mocks := map[string]string{ + "deployment1": `{ "apiVersion": "apps/v1", "kind": "Deployment", "metadata": { "annotations": { "deployment.kubernetes.io/revision": "1", "meta.helm.sh/release-name": "armo", "meta.helm.sh/release-namespace": "armo-system" }, "creationTimestamp": "2022-05-18T20:36:07Z", "generation": 1, "labels": { "app": "armo-web-socket", "app.kubernetes.io/managed-by": "Helm", "tier": "armo-system-control-plane" }, "name": "armo-web-socket", "namespace": "armo-system", "resourceVersion": "219521227", "uid": "55a36934-4b36-4f95-843a-1b0b503ea6bb" }, "spec": { "progressDeadlineSeconds": 600, "replicas": 1, "revisionHistoryLimit": 10, "selector": { "matchLabels": { "app.kubernetes.io/instance": "armo", "app.kubernetes.io/name": "armo-web-socket", "tier": "armo-system-control-plane" } }, "strategy": { "rollingUpdate": { "maxSurge": "25%", "maxUnavailable": "25%" }, "type": "RollingUpdate" }, "template": { "metadata": { "creationTimestamp": null, "labels": { "app": "armo-web-socket", "app.kubernetes.io/instance": "armo", "app.kubernetes.io/name": "armo-web-socket", "helm.sh/chart": "armo-cluster-components-1.7.6", "helm.sh/revision": "1", "tier": "armo-system-control-plane" } }, "spec": { "automountServiceAccountToken": true, "containers": [ { "args": [ "-alsologtostderr", "-v=4", "2\u003e\u00261" ], "env": [ { "name": "CA_NAMESPACE", "value": "armo-system" }, { "name": "CA_SYSTEM_MODE", "value": "SCAN" } ], "image": "quay.io/armosec/action-trigger:v0.0.5", "imagePullPolicy": "Always", "name": "armo-web-socket", "ports": [ { "containerPort": 4002, "name": "trigger-port", "protocol": "TCP" }, { "containerPort": 8000, "name": "readiness-port", "protocol": "TCP" } ], "readinessProbe": { "failureThreshold": 3, "httpGet": { "path": "/v1/readiness", "port": "readiness-port", "scheme": "HTTP" }, "initialDelaySeconds": 10, "periodSeconds": 5, "successThreshold": 1, "timeoutSeconds": 1 }, "resources": { "limits": { "cpu": "100m", "memory": "300Mi" }, "requests": { "cpu": "50m", "memory": "100Mi" } }, "terminationMessagePath": "/dev/termination-log", "terminationMessagePolicy": "File", "volumeMounts": [ { "mountPath": "/etc/config", "name": "armo-be-config", "readOnly": true } ] } ], "dnsPolicy": "ClusterFirst", "restartPolicy": "Always", "schedulerName": "default-scheduler", "securityContext": {}, "serviceAccount": "armo-scanner-service-account", "serviceAccountName": "armo-scanner-service-account", "terminationGracePeriodSeconds": 30, "volumes": [ { "configMap": { "defaultMode": 420, "items": [ { "key": "clusterData", "path": "clusterData.json" } ], "name": "armo-be-config" }, "name": "armo-be-config" } ] } } }, "status": { "conditions": [ { "lastTransitionTime": "2022-05-18T20:36:07Z", "lastUpdateTime": "2022-05-18T20:36:32Z", "message": "ReplicaSet \"armo-web-socket-7ccc76fc6b\" has successfully progressed.", "reason": "NewReplicaSetAvailable", "status": "True", "type": "Progressing" }, { "lastTransitionTime": "2022-07-27T13:47:46Z", "lastUpdateTime": "2022-07-27T13:47:46Z", "message": "Deployment does not have minimum availability.", "reason": "MinimumReplicasUnavailable", "status": "False", "type": "Available" } ], "observedGeneration": 1, "replicas": 1, "unavailableReplicas": 1, "updatedReplicas": 1 } }`, + "clusterrole": `{"apiVersion": "rbac.authorization.k8s.io/v1", "kind": "ClusterRole", "metadata": { "annotations": { "rbac.authorization.kubernetes.io/autoupdate": "true" }, "creationTimestamp": "2021-06-13T13:42:00Z", "labels": { "kubernetes.io/bootstrapping": "rbac-defaults" }, "name": "system:controller:disruption-controller", "resourceVersion": "76", "uid": "f6f2f2bf-4c39-4999-a143-591790249c4d" }, "rules": [ { "apiGroups": [ "apps", "extensions" ], "resources": [ "deployments" ], "verbs": [ "get", "list", "watch" ] }, { "apiGroups": [ "apps", "extensions" ], "resources": [ "replicasets" ], "verbs": [ "get", "list", "watch" ] }, { "apiGroups": [ "" ], "resources": [ "replicationcontrollers" ], "verbs": [ "get", "list", "watch" ] }, { "apiGroups": [ "policy" ], "resources": [ "poddisruptionbudgets" ], "verbs": [ "get", "list", "watch" ] }, { "apiGroups": [ "apps" ], "resources": [ "statefulsets" ], "verbs": [ "get", "list", "watch" ] }, { "apiGroups": [ "policy" ], "resources": [ "poddisruptionbudgets/status" ], "verbs": [ "update" ] }, { "apiGroups": [ "*" ], "resources": [ "*/scale" ], "verbs": [ "get" ] }, { "apiGroups": [ "", "events.k8s.io" ], "resources": [ "events" ], "verbs": [ "create", "patch", "update" ] } ] }`, + "job": `{"apiVersion": "batch/v1", "kind": "Job", "metadata": { "creationTimestamp": "2022-08-15T00:00:00Z", "generation": 1, "labels": { "controller-uid": "5188335d-ea13-4bad-b332-ebe215ee3af7", "job-name": "armo-scan-scheduler-27675360" }, "name": "armo-scan-scheduler-27675360", "namespace": "armo-system", "ownerReferences": [ { "apiVersion": "batch/v1", "blockOwnerDeletion": true, "controller": true, "kind": "CronJob", "name": "armo-scan-scheduler", "uid": "2f77e996-b2d8-45bd-a99e-4c16a353d4c4" } ], "resourceVersion": "229672794", "uid": "5188335d-ea13-4bad-b332-ebe215ee3af7" }, "spec": { "backoffLimit": 6, "completionMode": "NonIndexed", "completions": 1, "parallelism": 1, "selector": { "matchLabels": { "controller-uid": "5188335d-ea13-4bad-b332-ebe215ee3af7" } }, "suspend": false, "template": { "metadata": { "creationTimestamp": null, "labels": { "controller-uid": "5188335d-ea13-4bad-b332-ebe215ee3af7", "job-name": "armo-scan-scheduler-27675360" } }, "spec": { "automountServiceAccountToken": false, "containers": [ { "args": [ "echo Starting; ls -ltr /home/curl_user/; /bin/sh -x ./home/curl_user/trigger-script.sh; sleep 30; echo Done;" ], "command": [ "/bin/sh", "-c" ], "image": "curlimages/curl:latest", "imagePullPolicy": "IfNotPresent", "name": "armo-scan-scheduler", "resources": {}, "terminationMessagePath": "/dev/termination-log", "terminationMessagePolicy": "File", "volumeMounts": [ { "mountPath": "/home/curl_user/trigger-script.sh", "name": "armo-scan-scheduler-volume", "readOnly": true, "subPath": "trigger-script.sh" } ] } ], "dnsPolicy": "ClusterFirst", "restartPolicy": "Never", "schedulerName": "default-scheduler", "securityContext": {}, "terminationGracePeriodSeconds": 30, "volumes": [ { "configMap": { "defaultMode": 511, "name": "armo-scan-scheduler-config" }, "name": "armo-scan-scheduler-volume" } ] } } }, "status": { "active": 1, "startTime": "2022-08-15T00:00:00Z" } }`, + "deployment2": `{ "apiVersion": "apps/v1", "kind": "Deployment", "metadata": { "annotations": { "deployment.kubernetes.io/revision": "6", "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"apps/v1\",\"kind\":\"Deployment\",\"metadata\":{\"annotations\":{},\"labels\":{\"addonmanager.kubernetes.io/mode\":\"Reconcile\",\"k8s-app\":\"kube-dns\",\"kubernetes.io/cluster-service\":\"true\"},\"name\":\"kube-dns\",\"namespace\":\"kube-system\"},\"spec\":{\"selector\":{\"matchLabels\":{\"k8s-app\":\"kube-dns\"}},\"strategy\":{\"rollingUpdate\":{\"maxSurge\":\"10%\",\"maxUnavailable\":0}},\"template\":{\"metadata\":{\"annotations\":{\"components.gke.io/component-name\":\"kubedns\",\"prometheus.io/port\":\"10054\",\"prometheus.io/scrape\":\"true\",\"scheduler.alpha.kubernetes.io/critical-pod\":\"\",\"seccomp.security.alpha.kubernetes.io/pod\":\"runtime/default\"},\"labels\":{\"k8s-app\":\"kube-dns\"}},\"spec\":{\"affinity\":{\"podAntiAffinity\":{\"preferredDuringSchedulingIgnoredDuringExecution\":[{\"podAffinityTerm\":{\"labelSelector\":{\"matchExpressions\":[{\"key\":\"k8s-app\",\"operator\":\"In\",\"values\":[\"kube-dns\"]}]},\"topologyKey\":\"kubernetes.io/hostname\"},\"weight\":100}]}},\"containers\":[{\"args\":[\"--domain=cluster.local.\",\"--dns-port=10053\",\"--config-dir=/kube-dns-config\",\"--v=2\"],\"env\":[{\"name\":\"PROMETHEUS_PORT\",\"value\":\"10055\"}],\"image\":\"gke.gcr.io/k8s-dns-kube-dns:1.21.0-gke.0\",\"livenessProbe\":{\"failureThreshold\":5,\"httpGet\":{\"path\":\"/healthcheck/kubedns\",\"port\":10054,\"scheme\":\"HTTP\"},\"initialDelaySeconds\":60,\"successThreshold\":1,\"timeoutSeconds\":5},\"name\":\"kubedns\",\"ports\":[{\"containerPort\":10053,\"name\":\"dns-local\",\"protocol\":\"UDP\"},{\"containerPort\":10053,\"name\":\"dns-tcp-local\",\"protocol\":\"TCP\"},{\"containerPort\":10055,\"name\":\"metrics\",\"protocol\":\"TCP\"}],\"readinessProbe\":{\"httpGet\":{\"path\":\"/readiness\",\"port\":8081,\"scheme\":\"HTTP\"},\"initialDelaySeconds\":3,\"timeoutSeconds\":5},\"resources\":{\"limits\":{\"memory\":\"210Mi\"},\"requests\":{\"cpu\":\"100m\",\"memory\":\"70Mi\"}},\"securityContext\":{\"allowPrivilegeEscalation\":false,\"readOnlyRootFilesystem\":true,\"runAsGroup\":1001,\"runAsUser\":1001},\"volumeMounts\":[{\"mountPath\":\"/kube-dns-config\",\"name\":\"kube-dns-config\"}]},{\"args\":[\"-v=2\",\"-logtostderr\",\"-configDir=/etc/k8s/dns/dnsmasq-nanny\",\"-restartDnsmasq=true\",\"--\",\"-k\",\"--cache-size=1000\",\"--no-negcache\",\"--dns-forward-max=1500\",\"--log-facility=-\",\"--server=/cluster.local/127.0.0.1#10053\",\"--server=/in-addr.arpa/127.0.0.1#10053\",\"--server=/ip6.arpa/127.0.0.1#10053\"],\"image\":\"gke.gcr.io/k8s-dns-dnsmasq-nanny:1.21.0-gke.0\",\"livenessProbe\":{\"failureThreshold\":5,\"httpGet\":{\"path\":\"/healthcheck/dnsmasq\",\"port\":10054,\"scheme\":\"HTTP\"},\"initialDelaySeconds\":60,\"successThreshold\":1,\"timeoutSeconds\":5},\"name\":\"dnsmasq\",\"ports\":[{\"containerPort\":53,\"name\":\"dns\",\"protocol\":\"UDP\"},{\"containerPort\":53,\"name\":\"dns-tcp\",\"protocol\":\"TCP\"}],\"resources\":{\"requests\":{\"cpu\":\"150m\",\"memory\":\"20Mi\"}},\"securityContext\":{\"capabilities\":{\"add\":[\"NET_BIND_SERVICE\",\"SETGID\"],\"drop\":[\"all\"]}},\"volumeMounts\":[{\"mountPath\":\"/etc/k8s/dns/dnsmasq-nanny\",\"name\":\"kube-dns-config\"}]},{\"args\":[\"--v=2\",\"--logtostderr\",\"--probe=kubedns,127.0.0.1:10053,kubernetes.default.svc.cluster.local,5,SRV\",\"--probe=dnsmasq,127.0.0.1:53,kubernetes.default.svc.cluster.local,5,SRV\"],\"image\":\"gke.gcr.io/k8s-dns-sidecar:1.21.0-gke.0\",\"livenessProbe\":{\"failureThreshold\":5,\"httpGet\":{\"path\":\"/metrics\",\"port\":10054,\"scheme\":\"HTTP\"},\"initialDelaySeconds\":60,\"successThreshold\":1,\"timeoutSeconds\":5},\"name\":\"sidecar\",\"ports\":[{\"containerPort\":10054,\"name\":\"metrics\",\"protocol\":\"TCP\"}],\"resources\":{\"requests\":{\"cpu\":\"10m\",\"memory\":\"20Mi\"}},\"securityContext\":{\"allowPrivilegeEscalation\":false,\"readOnlyRootFilesystem\":true,\"runAsGroup\":1001,\"runAsUser\":1001}}],\"dnsPolicy\":\"Default\",\"nodeSelector\":{\"kubernetes.io/os\":\"linux\"},\"priorityClassName\":\"system-cluster-critical\",\"securityContext\":{\"fsGroup\":65534,\"supplementalGroups\":[65534]},\"serviceAccountName\":\"kube-dns\",\"tolerations\":[{\"key\":\"CriticalAddonsOnly\",\"operator\":\"Exists\"},{\"key\":\"components.gke.io/gke-managed-components\",\"operator\":\"Exists\"}],\"volumes\":[{\"configMap\":{\"name\":\"kube-dns\",\"optional\":true},\"name\":\"kube-dns-config\"}]}}}}\n" }, "creationTimestamp": "2021-06-13T13:42:19Z", "generation": 7, "labels": { "addonmanager.kubernetes.io/mode": "Reconcile", "k8s-app": "kube-dns", "kubernetes.io/cluster-service": "true" }, "name": "kube-dns", "namespace": "kube-system", "resourceVersion": "222203400", "uid": "cd5cca24-7cd2-4548-a5d3-d90beb79f9e8" }, "spec": { "progressDeadlineSeconds": 600, "replicas": 2, "revisionHistoryLimit": 10, "selector": { "matchLabels": { "k8s-app": "kube-dns" } }, "strategy": { "rollingUpdate": { "maxSurge": "10%", "maxUnavailable": 0 }, "type": "RollingUpdate" }, "template": { "metadata": { "annotations": { "components.gke.io/component-name": "kubedns", "prometheus.io/port": "10054", "prometheus.io/scrape": "true", "scheduler.alpha.kubernetes.io/critical-pod": "", "seccomp.security.alpha.kubernetes.io/pod": "runtime/default" }, "creationTimestamp": null, "labels": { "k8s-app": "kube-dns" } }, "spec": { "affinity": { "podAntiAffinity": { "preferredDuringSchedulingIgnoredDuringExecution": [ { "podAffinityTerm": { "labelSelector": { "matchExpressions": [ { "key": "k8s-app", "operator": "In", "values": [ "kube-dns" ] } ] }, "topologyKey": "kubernetes.io/hostname" }, "weight": 100 } ] } }, "containers": [ { "args": [ "--domain=cluster.local.", "--dns-port=10053", "--config-dir=/kube-dns-config", "--v=2" ], "env": [ { "name": "PROMETHEUS_PORT", "value": "10055" } ], "image": "gke.gcr.io/k8s-dns-kube-dns:1.22.2-gke.0", "imagePullPolicy": "IfNotPresent", "livenessProbe": { "failureThreshold": 5, "httpGet": { "path": "/healthcheck/kubedns", "port": 10054, "scheme": "HTTP" }, "initialDelaySeconds": 60, "periodSeconds": 10, "successThreshold": 1, "timeoutSeconds": 5 }, "name": "kubedns", "ports": [ { "containerPort": 10053, "name": "dns-local", "protocol": "UDP" }, { "containerPort": 10053, "name": "dns-tcp-local", "protocol": "TCP" }, { "containerPort": 10055, "name": "metrics", "protocol": "TCP" } ], "readinessProbe": { "failureThreshold": 3, "httpGet": { "path": "/readiness", "port": 8081, "scheme": "HTTP" }, "initialDelaySeconds": 3, "periodSeconds": 10, "successThreshold": 1, "timeoutSeconds": 5 }, "resources": { "limits": { "memory": "210Mi" }, "requests": { "cpu": "100m", "memory": "70Mi" } }, "securityContext": { "allowPrivilegeEscalation": false, "readOnlyRootFilesystem": true, "runAsGroup": 1001, "runAsUser": 1001 }, "terminationMessagePath": "/dev/termination-log", "terminationMessagePolicy": "File", "volumeMounts": [ { "mountPath": "/kube-dns-config", "name": "kube-dns-config" } ] }, { "args": [ "-v=2", "-logtostderr", "-configDir=/etc/k8s/dns/dnsmasq-nanny", "-restartDnsmasq=true", "--", "-k", "--cache-size=1000", "--no-negcache", "--dns-forward-max=1500", "--log-facility=-", "--server=/cluster.local/127.0.0.1#10053", "--server=/in-addr.arpa/127.0.0.1#10053", "--server=/ip6.arpa/127.0.0.1#10053" ], "image": "gke.gcr.io/k8s-dns-dnsmasq-nanny:1.22.2-gke.0", "imagePullPolicy": "IfNotPresent", "livenessProbe": { "failureThreshold": 5, "httpGet": { "path": "/healthcheck/dnsmasq", "port": 10054, "scheme": "HTTP" }, "initialDelaySeconds": 60, "periodSeconds": 10, "successThreshold": 1, "timeoutSeconds": 5 }, "name": "dnsmasq", "ports": [ { "containerPort": 53, "name": "dns", "protocol": "UDP" }, { "containerPort": 53, "name": "dns-tcp", "protocol": "TCP" } ], "resources": { "requests": { "cpu": "150m", "memory": "20Mi" } }, "securityContext": { "capabilities": { "add": [ "NET_BIND_SERVICE", "SETGID" ], "drop": [ "all" ] } }, "terminationMessagePath": "/dev/termination-log", "terminationMessagePolicy": "File", "volumeMounts": [ { "mountPath": "/etc/k8s/dns/dnsmasq-nanny", "name": "kube-dns-config" } ] }, { "args": [ "--v=2", "--logtostderr", "--probe=kubedns,127.0.0.1:10053,kubernetes.default.svc.cluster.local,5,SRV", "--probe=dnsmasq,127.0.0.1:53,kubernetes.default.svc.cluster.local,5,SRV" ], "image": "gke.gcr.io/k8s-dns-sidecar:1.22.2-gke.0", "imagePullPolicy": "IfNotPresent", "livenessProbe": { "failureThreshold": 5, "httpGet": { "path": "/metrics", "port": 10054, "scheme": "HTTP" }, "initialDelaySeconds": 60, "periodSeconds": 10, "successThreshold": 1, "timeoutSeconds": 5 }, "name": "sidecar", "ports": [ { "containerPort": 10054, "name": "metrics", "protocol": "TCP" } ], "resources": { "requests": { "cpu": "10m", "memory": "20Mi" } }, "securityContext": { "allowPrivilegeEscalation": false, "readOnlyRootFilesystem": true, "runAsGroup": 1001, "runAsUser": 1001 }, "terminationMessagePath": "/dev/termination-log", "terminationMessagePolicy": "File" } ], "dnsPolicy": "Default", "nodeSelector": { "kubernetes.io/os": "linux" }, "priorityClassName": "system-cluster-critical", "restartPolicy": "Always", "schedulerName": "default-scheduler", "securityContext": { "fsGroup": 65534, "supplementalGroups": [ 65534 ] }, "serviceAccount": "kube-dns", "serviceAccountName": "kube-dns", "terminationGracePeriodSeconds": 30, "tolerations": [ { "key": "CriticalAddonsOnly", "operator": "Exists" }, { "key": "components.gke.io/gke-managed-components", "operator": "Exists" } ], "volumes": [ { "configMap": { "defaultMode": 420, "name": "kube-dns", "optional": true }, "name": "kube-dns-config" } ] } } }, "status": { "conditions": [ { "lastTransitionTime": "2022-07-27T13:47:47Z", "lastUpdateTime": "2022-07-27T13:47:47Z", "message": "Deployment does not have minimum availability.", "reason": "MinimumReplicasUnavailable", "status": "False", + "type": "Available" }, { "lastTransitionTime": "2022-08-01T16:46:08Z", "lastUpdateTime": "2022-08-01T16:46:08Z", "message": "ReplicaSet \"kube-dns-7d774598cf\" has timed out progressing.", "reason": "ProgressDeadlineExceeded", "status": "False", "type": "Progressing" } ], "observedGeneration": 7, "replicas": 3, "unavailableReplicas": 3, "updatedReplicas": 1 } }`, + "replicaset": `{ "apiVersion": "apps/v1", "kind": "ReplicaSet", "metadata": { "annotations": { "deployment.kubernetes.io/desired-replicas": "1", "deployment.kubernetes.io/max-replicas": "2", "deployment.kubernetes.io/revision": "1", "meta.helm.sh/release-name": "armo", "meta.helm.sh/release-namespace": "armo-system" }, "creationTimestamp": "2022-05-18T20:36:07Z", "generation": 1, "labels": { "app": "armo-web-socket", "app.kubernetes.io/instance": "armo", "app.kubernetes.io/name": "armo-web-socket", "helm.sh/chart": "armo-cluster-components-1.7.6", "helm.sh/revision": "1", "pod-template-hash": "7ccc76fc6b", "tier": "armo-system-control-plane" }, "name": "armo-web-socket-7ccc76fc6b", "namespace": "armo-system", "ownerReferences": [ { "apiVersion": "apps/v1", "blockOwnerDeletion": true, "controller": true, "kind": "Deployment", "name": "armo-web-socket", "uid": "55a36934-4b36-4f95-843a-1b0b503ea6bb" } ], "resourceVersion": "219521226", "uid": "49b47eb7-5f4b-403a-a16d-a53cbc7451ba" }, "spec": { "replicas": 1, "selector": { "matchLabels": { "app.kubernetes.io/instance": "armo", "app.kubernetes.io/name": "armo-web-socket", "pod-template-hash": "7ccc76fc6b", "tier": "armo-system-control-plane" } }, "template": { "metadata": { "creationTimestamp": null, "labels": { "app": "armo-web-socket", "app.kubernetes.io/instance": "armo", "app.kubernetes.io/name": "armo-web-socket", "helm.sh/chart": "armo-cluster-components-1.7.6", "helm.sh/revision": "1", "pod-template-hash": "7ccc76fc6b", "tier": "armo-system-control-plane" } }, "spec": { "automountServiceAccountToken": true, "containers": [ { "args": [ "-alsologtostderr", "-v=4", "2\u003e\u00261" ], "env": [ { "name": "CA_NAMESPACE", "value": "armo-system" }, { "name": "CA_SYSTEM_MODE", "value": "SCAN" } ], "image": "quay.io/armosec/action-trigger:v0.0.5", "imagePullPolicy": "Always", "name": "armo-web-socket", "ports": [ { "containerPort": 4002, "name": "trigger-port", "protocol": "TCP" }, { "containerPort": 8000, "name": "readiness-port", "protocol": "TCP" } ], "readinessProbe": { "failureThreshold": 3, "httpGet": { "path": "/v1/readiness", "port": "readiness-port", "scheme": "HTTP" }, "initialDelaySeconds": 10, "periodSeconds": 5, "successThreshold": 1, "timeoutSeconds": 1 }, "resources": { "limits": { "cpu": "100m", "memory": "300Mi" }, "requests": { "cpu": "50m", "memory": "100Mi" } }, "terminationMessagePath": "/dev/termination-log", "terminationMessagePolicy": "File", "volumeMounts": [ { "mountPath": "/etc/config", "name": "armo-be-config", "readOnly": true } ] } ], "dnsPolicy": "ClusterFirst", "restartPolicy": "Always", "schedulerName": "default-scheduler", "securityContext": {}, "serviceAccount": "armo-scanner-service-account", "serviceAccountName": "armo-scanner-service-account", "terminationGracePeriodSeconds": 30, "volumes": [ { "configMap": { "defaultMode": 420, "items": [ { "key": "clusterData", "path": "clusterData.json" } ], "name": "armo-be-config" }, "name": "armo-be-config" } ] } } }, "status": { "fullyLabeledReplicas": 1, "observedGeneration": 1, "replicas": 1 } }`, + "service": ` { "apiVersion": "v1", "kind": "Service", "metadata": { "annotations": { "meta.helm.sh/release-name": "armo", "meta.helm.sh/release-namespace": "armo-system" }, "creationTimestamp": "2022-05-18T20:36:07Z", "labels": { "app": "armo-vuln-scan", "app.kubernetes.io/managed-by": "Helm" }, "name": "armo-vuln-scan", "namespace": "armo-system", "resourceVersion": "176011314", "uid": "e1ad4cc5-d437-44d0-88cf-a01b592ad931" }, "spec": { "clusterIP": "10.72.9.228", "clusterIPs": [ "10.72.9.228" ], "internalTrafficPolicy": "Cluster", "ipFamilies": [ "IPv4" ], "ipFamilyPolicy": "SingleStack", "ports": [ { "name": "vuln-scan-port", "port": 8080, "protocol": "TCP", "targetPort": 8080 }, { "name": "readiness-port", "port": 8000, "protocol": "TCP", "targetPort": 8000 } ], "selector": { "app": "armo-vuln-scan" }, "sessionAffinity": "None", "type": "ClusterIP" }, "status": { "loadBalancer": {} } }`, + "cronjob": ` { "apiVersion": "batch/v1", "kind": "CronJob", "metadata": { "annotations": { "meta.helm.sh/release-name": "armo", "meta.helm.sh/release-namespace": "armo-system" }, "creationTimestamp": "2022-05-18T20:36:07Z", "labels": { "app": "armo-scan-scheduler", "app.kubernetes.io/managed-by": "Helm", "tier": "armo-system-control-plane" }, "name": "armo-scan-scheduler", "namespace": "armo-system", "resourceVersion": "234167493", "uid": "2f77e996-b2d8-45bd-a99e-4c16a353d4c4" }, "spec": { "concurrencyPolicy": "Allow", "failedJobsHistoryLimit": 1, "jobTemplate": { "metadata": { "creationTimestamp": null }, "spec": { "template": { "metadata": { "creationTimestamp": null }, "spec": { "automountServiceAccountToken": false, "containers": [ { "args": [ "echo Starting; ls -ltr /home/curl_user/; /bin/sh -x ./home/curl_user/trigger-script.sh; sleep 30; echo Done;" ], "command": [ "/bin/sh", "-c" ], "image": "curlimages/curl:latest", "imagePullPolicy": "IfNotPresent", "name": "armo-scan-scheduler", "resources": {}, "terminationMessagePath": "/dev/termination-log", "terminationMessagePolicy": "File", "volumeMounts": [ { "mountPath": "/home/curl_user/trigger-script.sh", "name": "armo-scan-scheduler-volume", "readOnly": true, "subPath": "trigger-script.sh" } ] } ], "dnsPolicy": "ClusterFirst", "restartPolicy": "Never", "schedulerName": "default-scheduler", "securityContext": {}, "terminationGracePeriodSeconds": 30, "volumes": [ { "configMap": { "defaultMode": 511, "name": "armo-scan-scheduler-config" }, "name": "armo-scan-scheduler-volume" } ] } } } }, "schedule": "0 0 * * *", "successfulJobsHistoryLimit": 3, "suspend": false }, "status": { "active": [ { "apiVersion": "batch/v1", "kind": "Job", "name": "armo-scan-scheduler-27649440", "namespace": "armo-system", "resourceVersion": "219744472", "uid": "36f60d4f-2ec4-4c35-be2c-22efc1a6ec24" }, { "apiVersion": "batch/v1", "kind": "Job", "name": "armo-scan-scheduler-27650880", "namespace": "armo-system", "resourceVersion": "220268279", "uid": "9e0a08b3-4714-4268-bea2-ed1334a48ae8" }, { "apiVersion": "batch/v1", "kind": "Job", "name": "armo-scan-scheduler-27652320", "namespace": "armo-system", "resourceVersion": "220791853", "uid": "8d96de16-3c6d-4d76-b097-adae599b1e15" }, { "apiVersion": "batch/v1", "kind": "Job", "name": "armo-scan-scheduler-27653760", "namespace": "armo-system", "resourceVersion": "221315424", "uid": "bd4b9a5f-ce4d-4e3a-9074-910f4244b63e" }, { "apiVersion": "batch/v1", "kind": "Job", "name": "armo-scan-scheduler-27655200", "namespace": "armo-system", "resourceVersion": "221838997", "uid": "7ce282cf-f20f-4ee5-a5d6-073192fe4468" }, { "apiVersion": "batch/v1", "kind": "Job", "name": "armo-scan-scheduler-27656640", "namespace": "armo-system", "resourceVersion": "222372820", "uid": "9ed33ce8-239f-47bb-a099-4953392df459" }, { "apiVersion": "batch/v1", "kind": "Job", "name": "armo-scan-scheduler-27658080", "namespace": "armo-system", "resourceVersion": "222934799", "uid": "b6dea67e-32d1-4fa0-99a4-443ed98acf36" }, { "apiVersion": "batch/v1", "kind": "Job", "name": "armo-scan-scheduler-27659520", "namespace": "armo-system", "resourceVersion": "223496386", "uid": "1d94cc14-c14c-48ef-a143-a58ea3a813bc" }, { "apiVersion": "batch/v1", "kind": "Job", "name": "armo-scan-scheduler-27660960", "namespace": "armo-system", "resourceVersion": "224055857", "uid": "3431522d-4415-4182-91fc-a413f52f891b" }, { "apiVersion": "batch/v1", "kind": "Job", "name": "armo-scan-scheduler-27662400", "namespace": "armo-system", "resourceVersion": "224616616", "uid": "03de2e61-8aef-4903-bdb9-da07c5cb4eda" }, { "apiVersion": "batch/v1", "kind": "Job", "name": "armo-scan-scheduler-27663840", "namespace": "armo-system", "resourceVersion": "225177696", "uid": "ebd3b17a-0f9c-4265-b8bd-4d03d90ad037" }, { "apiVersion": "batch/v1", "kind": "Job", "name": "armo-scan-scheduler-27665280", "namespace": "armo-system", "resourceVersion": "225739409", "uid": "28cddb55-73e0-42d6-b5af-2029dd9e6224" }, { "apiVersion": "batch/v1", "kind": "Job", "name": "armo-scan-scheduler-27666720", "namespace": "armo-system", "resourceVersion": "226301092", "uid": "05931b5a-1664-4fb1-8761-1ccab0c9e617" }, { "apiVersion": "batch/v1", "kind": "Job", "name": "armo-scan-scheduler-27668160", "namespace": "armo-system", "resourceVersion": "226863002", "uid": "ebeb511f-b4f5-44e2-aff4-af12693158dd" }, { "apiVersion": "batch/v1", "kind": "Job", "name": "armo-scan-scheduler-27669600", "namespace": "armo-system", "resourceVersion": "227424963", "uid": "1cea66fc-251e-4325-a7e8-215ebf6a130d" }, { "apiVersion": "batch/v1", "kind": "Job", "name": "armo-scan-scheduler-27671040", "namespace": "armo-system", "resourceVersion": "227986904", "uid": "873bfc55-283d-423c-8b30-4a7486cc7a29" }, { "apiVersion": "batch/v1", "kind": "Job", "name": "armo-scan-scheduler-27672480", "namespace": "armo-system", "resourceVersion": "228548881", "uid": "55d74401-42b3-47f1-bf75-2f224ae08ee6" }, { "apiVersion": "batch/v1", "kind": "Job", "name": "armo-scan-scheduler-27673920", "namespace": "armo-system", "resourceVersion": "229110817", "uid": "84c6e444-fe2d-4032-8902-1666af52b70e" }, { "apiVersion": "batch/v1", "kind": "Job", "name": "armo-scan-scheduler-27675360", "namespace": "armo-system", "resourceVersion": "229672786", "uid": "5188335d-ea13-4bad-b332-ebe215ee3af7" }, { "apiVersion": "batch/v1", "kind": "Job", "name": "armo-scan-scheduler-27676800", "namespace": "armo-system", "resourceVersion": "230234728", "uid": "3bd848dd-4db4-464d-b257-e0b8034b7280" }, { "apiVersion": "batch/v1", "kind": "Job", "name": "armo-scan-scheduler-27678240", "namespace": "armo-system", "resourceVersion": "230795059", "uid": "b54c1443-9e9d-442e-a2b0-62f1ab2767a4" }, { "apiVersion": "batch/v1", "kind": "Job", "name": "armo-scan-scheduler-27679680", "namespace": "armo-system", "resourceVersion": "231358298", "uid": "acb05160-1b20-47df-b99b-aeac4ee08f1f" }, { "apiVersion": "batch/v1", "kind": "Job", "name": "armo-scan-scheduler-27681120", "namespace": "armo-system", "resourceVersion": "231921395", "uid": "e48c2617-7b65-4a60-82be-0a8819a16384" }, { "apiVersion": "batch/v1", "kind": "Job", "name": "armo-scan-scheduler-27682560", "namespace": "armo-system", "resourceVersion": "232480542", "uid": "03d79cbf-9e15-40f1-b007-260133148765" }, { "apiVersion": "batch/v1", "kind": "Job", "name": "armo-scan-scheduler-27684000", "namespace": "armo-system", "resourceVersion": "233041990", "uid": "64f53c6d-6fa0-4a7b-adb5-90632aecef04" }, { "apiVersion": "batch/v1", "kind": "Job", "name": "armo-scan-scheduler-27685440", "namespace": "armo-system", "resourceVersion": "233604167", "uid": "51ef6f1d-077c-4ed6-b86c-4fdee554e608" }, { "apiVersion": "batch/v1", "kind": "Job", "name": "armo-scan-scheduler-27686880", "namespace": "armo-system", "resourceVersion": "234167491", "uid": "98b9537e-7bad-40ed-8b45-adeaa0ed41cf" } ], "lastScheduleTime": "2022-08-23T00:00:00Z", "lastSuccessfulTime": "2022-07-27T00:00:34Z" } }`, + "pod": ` { "apiVersion": "v1", "kind": "Pod", "metadata": { "creationTimestamp": "2022-07-27T13:47:46Z", "generateName": "armo-web-socket-7ccc76fc6b-", "labels": { "app": "armo-web-socket", "app.kubernetes.io/instance": "armo", "app.kubernetes.io/name": "armo-web-socket", "helm.sh/chart": "armo-cluster-components-1.7.6", "helm.sh/revision": "1", "pod-template-hash": "7ccc76fc6b", "tier": "armo-system-control-plane" }, "name": "armo-web-socket-7ccc76fc6b-qfbvv", "namespace": "armo-system", "ownerReferences": [ { "apiVersion": "apps/v1", "blockOwnerDeletion": true, "controller": true, "kind": "ReplicaSet", "name": "armo-web-socket-7ccc76fc6b", "uid": "49b47eb7-5f4b-403a-a16d-a53cbc7451ba" } ], "resourceVersion": "219522666", "uid": "2fa36622-55ff-4f8d-8eeb-98779536035d" }, "spec": { "automountServiceAccountToken": true, "containers": [ { "args": [ "-alsologtostderr", "-v=4", "2\u003e\u00261" ], "env": [ { "name": "CA_NAMESPACE", "value": "armo-system" }, { "name": "CA_SYSTEM_MODE", "value": "SCAN" } ], "image": "quay.io/armosec/action-trigger:v0.0.5", "imagePullPolicy": "Always", "name": "armo-web-socket", "ports": [ { "containerPort": 4002, "name": "trigger-port", "protocol": "TCP" }, { "containerPort": 8000, "name": "readiness-port", "protocol": "TCP" } ], "readinessProbe": { "failureThreshold": 3, "httpGet": { "path": "/v1/readiness", "port": "readiness-port", "scheme": "HTTP" }, "initialDelaySeconds": 10, "periodSeconds": 5, "successThreshold": 1, "timeoutSeconds": 1 }, "resources": { "limits": { "cpu": "100m", "memory": "300Mi" }, "requests": { "cpu": "50m", "memory": "100Mi" } }, "terminationMessagePath": "/dev/termination-log", "terminationMessagePolicy": "File", "volumeMounts": [ { "mountPath": "/etc/config", "name": "armo-be-config", "readOnly": true }, { "mountPath": "/var/run/secrets/kubernetes.io/serviceaccount", "name": "kube-api-access-cp5cf", "readOnly": true } ] } ], "dnsPolicy": "ClusterFirst", "enableServiceLinks": true, "preemptionPolicy": "PreemptLowerPriority", "priority": 0, "restartPolicy": "Always", "schedulerName": "default-scheduler", "securityContext": {}, "serviceAccount": "armo-scanner-service-account", "serviceAccountName": "armo-scanner-service-account", "terminationGracePeriodSeconds": 30, "tolerations": [ { "effect": "NoExecute", "key": "node.kubernetes.io/not-ready", "operator": "Exists", "tolerationSeconds": 300 }, { "effect": "NoExecute", "key": "node.kubernetes.io/unreachable", "operator": "Exists", "tolerationSeconds": 300 } ], "volumes": [ { "configMap": { "defaultMode": 420, "items": [ { "key": "clusterData", "path": "clusterData.json" } ], "name": "armo-be-config" }, "name": "armo-be-config" }, { "name": "kube-api-access-cp5cf", "projected": { "defaultMode": 420, "sources": [ { "serviceAccountToken": { "expirationSeconds": 3607, "path": "token" } }, { "configMap": { "items": [ { "key": "ca.crt", "path": "ca.crt" } ], "name": "kube-root-ca.crt" } }, { "downwardAPI": { "items": [ { "fieldRef": { "apiVersion": "v1", "fieldPath": "metadata.namespace" }, "path": "namespace" } ] } } ] } } ] }, "status": { "conditions": [ { "lastProbeTime": null, "lastTransitionTime": "2022-07-27T13:47:46Z", "message": "no nodes available to schedule pods", "reason": "Unschedulable", "status": "False", "type": "PodScheduled" } ], "phase": "Pending", "qosClass": "Burstable" } }`, + } + for mock, data := range mocks { + w, err := workloadinterface.NewWorkload([]byte(data)) + assert.NoError(t, err) + allResources[mock] = w + } + + sessionObj := cautils.NewOPASessionObjMock() + setMapNamespaceToNumOfResources(allResources, sessionObj) + expected := map[string]int{ + "kube-system": 1, + "armo-system": 3, + } + assert.True(t, reflect.DeepEqual(expected, sessionObj.Metadata.ContextMetadata.ClusterContextMetadata.MapNamespaceToNumberOfResources)) + assert.NotContains(t, sessionObj.Metadata.ContextMetadata.ClusterContextMetadata.MapNamespaceToNumberOfResources, "job") + assert.NotContains(t, sessionObj.Metadata.ContextMetadata.ClusterContextMetadata.MapNamespaceToNumberOfResources, "replicaset") + assert.NotContains(t, sessionObj.Metadata.ContextMetadata.ClusterContextMetadata.MapNamespaceToNumberOfResources, "clusterrole") + assert.NotContains(t, sessionObj.Metadata.ContextMetadata.ClusterContextMetadata.MapNamespaceToNumberOfResources, "pod") +} diff --git a/core/pkg/resourcehandler/k8sresourcesutils.go b/core/pkg/resourcehandler/k8sresourcesutils.go index 443f9624..045c53c4 100644 --- a/core/pkg/resourcehandler/k8sresourcesutils.go +++ b/core/pkg/resourcehandler/k8sresourcesutils.go @@ -3,11 +3,11 @@ package resourcehandler import ( "strings" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/opa-utils/reporthandling" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/opa-utils/reporthandling" "k8s.io/utils/strings/slices" - "github.com/armosec/k8s-interface/k8sinterface" + "github.com/kubescape/k8s-interface/k8sinterface" ) var ( @@ -40,10 +40,10 @@ var ( ClusterDescribe: {"container.googleapis.com/v1", "eks.amazonaws.com/v1", "management.azure.com/v1"}} ) -func isEmptyImgVulns(armoResourcesMap cautils.ArmoResources) bool { - imgVulnResources := cautils.MapImageVulnResources(&armoResourcesMap) +func isEmptyImgVulns(ksResourcesMap cautils.KSResources) bool { + imgVulnResources := cautils.MapImageVulnResources(&ksResourcesMap) for _, resource := range imgVulnResources { - if val, ok := armoResourcesMap[resource]; ok { + if val, ok := ksResourcesMap[resource]; ok { if len(val) > 0 { return false } @@ -68,20 +68,20 @@ func setK8sResourceMap(frameworks []reporthandling.Framework) *cautils.K8SResour return &k8sResources } -func setArmoResourceMap(frameworks []reporthandling.Framework, resourceToControl map[string][]string) *cautils.ArmoResources { - armoResources := make(cautils.ArmoResources) - complexMap := setComplexArmoResourceMap(frameworks, resourceToControl) +func setKSResourceMap(frameworks []reporthandling.Framework, resourceToControl map[string][]string) *cautils.KSResources { + ksResources := make(cautils.KSResources) + complexMap := setComplexKSResourceMap(frameworks, resourceToControl) for group := range complexMap { for version := range complexMap[group] { for resource := range complexMap[group][version] { groupResources := k8sinterface.ResourceGroupToString(group, version, resource) for _, groupResource := range groupResources { - armoResources[groupResource] = nil + ksResources[groupResource] = nil } } } } - return &armoResources + return &ksResources } func setComplexK8sResourceMap(frameworks []reporthandling.Framework) map[string]map[string]map[string]interface{} { @@ -99,13 +99,13 @@ func setComplexK8sResourceMap(frameworks []reporthandling.Framework) map[string] } // [group][versionn][resource] -func setComplexArmoResourceMap(frameworks []reporthandling.Framework, resourceToControls map[string][]string) map[string]map[string]map[string]interface{} { +func setComplexKSResourceMap(frameworks []reporthandling.Framework, resourceToControls map[string][]string) map[string]map[string]map[string]interface{} { k8sResources := make(map[string]map[string]map[string]interface{}) for _, framework := range frameworks { for _, control := range framework.Controls { for _, rule := range control.Rules { for _, match := range rule.DynamicMatch { - insertArmoResourcesAndControls(k8sResources, match, resourceToControls, control) + insertKSResourcesAndControls(k8sResources, match, resourceToControls, control) } } } @@ -113,7 +113,7 @@ func setComplexArmoResourceMap(frameworks []reporthandling.Framework, resourceTo return k8sResources } -func mapArmoResourceToApiGroup(resource string) []string { +func mapKSResourceToApiGroup(resource string) []string { if val, ok := MapResourceToApiGroup[resource]; ok { return []string{val} } @@ -127,9 +127,9 @@ func mapArmoResourceToApiGroup(resource string) []string { } func insertControls(resource string, resourceToControl map[string][]string, control reporthandling.Control) { - armoResources := mapArmoResourceToApiGroup(resource) - for _, armoResource := range armoResources { - group, version := k8sinterface.SplitApiVersion(armoResource) + ksResources := mapKSResourceToApiGroup(resource) + for _, ksResource := range ksResources { + group, version := k8sinterface.SplitApiVersion(ksResource) r := k8sinterface.JoinResourceTriplets(group, version, resource) if _, ok := resourceToControl[r]; !ok { resourceToControl[r] = append(resourceToControl[r], control.ControlID) @@ -159,7 +159,7 @@ func insertResources(k8sResources map[string]map[string]map[string]interface{}, } } -func insertArmoResourcesAndControls(k8sResources map[string]map[string]map[string]interface{}, match reporthandling.RuleMatchObjects, resourceToControl map[string][]string, control reporthandling.Control) { +func insertKSResourcesAndControls(k8sResources map[string]map[string]map[string]interface{}, match reporthandling.RuleMatchObjects, resourceToControl map[string][]string, control reporthandling.Control) { for _, apiGroup := range match.APIGroups { if v, ok := k8sResources[apiGroup]; !ok || v == nil { k8sResources[apiGroup] = make(map[string]map[string]interface{}) diff --git a/core/pkg/resourcehandler/k8sresourcesutils_test.go b/core/pkg/resourcehandler/k8sresourcesutils_test.go index 367b787c..6b667755 100644 --- a/core/pkg/resourcehandler/k8sresourcesutils_test.go +++ b/core/pkg/resourcehandler/k8sresourcesutils_test.go @@ -1,9 +1,9 @@ package resourcehandler import ( - "github.com/armosec/k8s-interface/k8sinterface" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/opa-utils/reporthandling" + "github.com/kubescape/k8s-interface/k8sinterface" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/opa-utils/reporthandling" "github.com/stretchr/testify/assert" "testing" @@ -27,16 +27,16 @@ func TestSetResourceMap(t *testing.T) { } func TestSsEmptyImgVulns(t *testing.T) { - armoResourcesMap := make(cautils.ArmoResources, 0) - armoResourcesMap["container.googleapis.com/v1"] = []string{"fsdfds"} - assert.Equal(t, true, isEmptyImgVulns(armoResourcesMap)) + ksResourcesMap := make(cautils.KSResources, 0) + ksResourcesMap["container.googleapis.com/v1"] = []string{"fsdfds"} + assert.Equal(t, true, isEmptyImgVulns(ksResourcesMap)) - armoResourcesMap["armo.vuln.images/v1/ImageVulnerabilities"] = []string{"dada"} - assert.Equal(t, false, isEmptyImgVulns(armoResourcesMap)) + ksResourcesMap["armo.vuln.images/v1/ImageVulnerabilities"] = []string{"dada"} + assert.Equal(t, false, isEmptyImgVulns(ksResourcesMap)) - armoResourcesMap["armo.vuln.images/v1/ImageVulnerabilities"] = []string{} - armoResourcesMap["bla"] = []string{"blu"} - assert.Equal(t, true, isEmptyImgVulns(armoResourcesMap)) + ksResourcesMap["armo.vuln.images/v1/ImageVulnerabilities"] = []string{} + ksResourcesMap["bla"] = []string{"blu"} + assert.Equal(t, true, isEmptyImgVulns(ksResourcesMap)) } func TestInsertK8sResources(t *testing.T) { diff --git a/core/pkg/resourcehandler/registrydata.go b/core/pkg/resourcehandler/registrydata.go index 847e2ea4..9160124c 100644 --- a/core/pkg/resourcehandler/registrydata.go +++ b/core/pkg/resourcehandler/registrydata.go @@ -3,15 +3,15 @@ package resourcehandler import ( "fmt" - "github.com/armosec/k8s-interface/k8sinterface" - "github.com/armosec/k8s-interface/workloadinterface" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/cautils/getter" - armosecadaptorv1 "github.com/armosec/kubescape/v2/core/pkg/registryadaptors/armosec/v1" - "github.com/armosec/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities" - logger "github.com/dwertent/go-logger" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/k8s-interface/k8sinterface" + "github.com/kubescape/k8s-interface/workloadinterface" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/cautils/getter" + armosecadaptorv1 "github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/armosec/v1" + "github.com/kubescape/kubescape/v2/core/pkg/registryadaptors/registryvulnerabilities" - "github.com/armosec/opa-utils/shared" + "github.com/kubescape/opa-utils/shared" ) const ( @@ -35,7 +35,7 @@ func NewRegistryAdaptors() (*RegistryAdaptors, error) { return registryAdaptors, nil } -func (registryAdaptors *RegistryAdaptors) collectImagesVulnerabilities(k8sResourcesMap *cautils.K8SResources, allResources map[string]workloadinterface.IMetadata, armoResourceMap *cautils.ArmoResources) error { +func (registryAdaptors *RegistryAdaptors) collectImagesVulnerabilities(k8sResourcesMap *cautils.K8SResources, allResources map[string]workloadinterface.IMetadata, ksResourceMap *cautils.KSResources) error { logger.L().Debug("Collecting images vulnerabilities") if len(registryAdaptors.adaptors) == 0 { @@ -75,7 +75,7 @@ func (registryAdaptors *RegistryAdaptors) collectImagesVulnerabilities(k8sResour for i := range metaObjs { allResources[metaObjs[i].GetID()] = metaObjs[i] } - (*armoResourceMap)[k8sinterface.JoinResourceTriplets(ImagevulnerabilitiesObjectGroup, ImagevulnerabilitiesObjectVersion, ImagevulnerabilitiesObjectKind)] = workloadinterface.ListMetaIDs(metaObjs) + (*ksResourceMap)[k8sinterface.JoinResourceTriplets(ImagevulnerabilitiesObjectGroup, ImagevulnerabilitiesObjectVersion, ImagevulnerabilitiesObjectKind)] = workloadinterface.ListMetaIDs(metaObjs) return nil } @@ -151,10 +151,10 @@ func listAdaptores() ([]registryvulnerabilities.IContainerImageVulnerabilityAdap adaptors := []registryvulnerabilities.IContainerImageVulnerabilityAdaptor{} - armoAPI := getter.GetArmoAPIConnector() - if armoAPI != nil { - if armoAPI.GetSecretKey() != "" && armoAPI.GetClientID() != "" && armoAPI.GetAccountID() != "" { - adaptors = append(adaptors, armosecadaptorv1.NewArmoAdaptor(getter.GetArmoAPIConnector())) + ksCloudAPI := getter.GetKSCloudAPIConnector() + if ksCloudAPI != nil { + if ksCloudAPI.GetSecretKey() != "" && ksCloudAPI.GetClientID() != "" && ksCloudAPI.GetAccountID() != "" { + adaptors = append(adaptors, armosecadaptorv1.NewKSAdaptor(getter.GetKSCloudAPIConnector())) } } diff --git a/core/pkg/resourcehandler/repositoryscanner.go b/core/pkg/resourcehandler/repositoryscanner.go index 50688a53..4e92cb28 100644 --- a/core/pkg/resourcehandler/repositoryscanner.go +++ b/core/pkg/resourcehandler/repositoryscanner.go @@ -8,7 +8,7 @@ import ( "path/filepath" "strings" - "github.com/armosec/kubescape/v2/core/cautils/getter" + "github.com/kubescape/kubescape/v2/core/cautils/getter" giturls "github.com/whilp/git-urls" "k8s.io/utils/strings/slices" ) diff --git a/core/pkg/resourcehandler/repositoryscanner_test.go b/core/pkg/resourcehandler/repositoryscanner_test.go index e5275560..8470f92d 100644 --- a/core/pkg/resourcehandler/repositoryscanner_test.go +++ b/core/pkg/resourcehandler/repositoryscanner_test.go @@ -7,10 +7,10 @@ import ( ) var ( - urlA = "https://github.com/armosec/kubescape" - urlB = "https://github.com/armosec/kubescape/blob/master/examples/online-boutique/adservice.yaml" - urlC = "https://github.com/armosec/kubescape/tree/master/examples/online-boutique" - urlD = "https://raw.githubusercontent.com/armosec/kubescape/master/examples/online-boutique/adservice.yaml" + urlA = "https://github.com/kubescape/kubescape" + urlB = "https://github.com/kubescape/kubescape/blob/master/examples/online-boutique/adservice.yaml" + urlC = "https://github.com/kubescape/kubescape/tree/master/examples/online-boutique" + urlD = "https://raw.githubusercontent.com/kubescape/kubescape/master/examples/online-boutique/adservice.yaml" ) func TestScanRepository(t *testing.T) { @@ -117,12 +117,12 @@ func TestGithubParse(t *testing.T) { { gh := NewGitHubRepository() assert.NoError(t, gh.parse(urlA)) - assert.Equal(t, "armosec/kubescape", joinOwnerNRepo(gh.owner, gh.repo)) + assert.Equal(t, "kubescape/kubescape", joinOwnerNRepo(gh.owner, gh.repo)) } { gh := NewGitHubRepository() assert.NoError(t, gh.parse(urlB)) - assert.Equal(t, "armosec/kubescape", joinOwnerNRepo(gh.owner, gh.repo)) + assert.Equal(t, "kubescape/kubescape", joinOwnerNRepo(gh.owner, gh.repo)) assert.Equal(t, "master", gh.branch) assert.Equal(t, "examples/online-boutique/adservice.yaml", gh.path) assert.True(t, gh.isFile) @@ -132,7 +132,7 @@ func TestGithubParse(t *testing.T) { { gh := NewGitHubRepository() assert.NoError(t, gh.parse(urlC)) - assert.Equal(t, "armosec/kubescape", joinOwnerNRepo(gh.owner, gh.repo)) + assert.Equal(t, "kubescape/kubescape", joinOwnerNRepo(gh.owner, gh.repo)) assert.Equal(t, "master", gh.branch) assert.Equal(t, "examples/online-boutique", gh.path) assert.False(t, gh.isFile) diff --git a/core/pkg/resourcehandler/resourceshandler.go b/core/pkg/resourcehandler/resourceshandler.go index f890e0e2..f68e43bc 100644 --- a/core/pkg/resourcehandler/resourceshandler.go +++ b/core/pkg/resourcehandler/resourceshandler.go @@ -2,12 +2,12 @@ package resourcehandler import ( "github.com/armosec/armoapi-go/armotypes" - "github.com/armosec/k8s-interface/workloadinterface" - "github.com/armosec/kubescape/v2/core/cautils" + "github.com/kubescape/k8s-interface/workloadinterface" + "github.com/kubescape/kubescape/v2/core/cautils" "k8s.io/apimachinery/pkg/version" ) type IResourceHandler interface { - GetResources(*cautils.OPASessionObj, *armotypes.PortalDesignator) (*cautils.K8SResources, map[string]workloadinterface.IMetadata, *cautils.ArmoResources, error) + GetResources(*cautils.OPASessionObj, *armotypes.PortalDesignator) (*cautils.K8SResources, map[string]workloadinterface.IMetadata, *cautils.KSResources, error) GetClusterAPIServerInfo() *version.Info } diff --git a/core/pkg/resourcehandler/urlloader.go b/core/pkg/resourcehandler/urlloader.go index 05b82331..d93b3bf1 100644 --- a/core/pkg/resourcehandler/urlloader.go +++ b/core/pkg/resourcehandler/urlloader.go @@ -2,10 +2,10 @@ package resourcehandler import ( giturl "github.com/armosec/go-git-url" - "github.com/armosec/k8s-interface/workloadinterface" - "github.com/armosec/kubescape/v2/core/cautils" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/k8s-interface/workloadinterface" + "github.com/kubescape/kubescape/v2/core/cautils" ) func loadResourcesFromUrl(inputPatterns []string) (map[string][]workloadinterface.IMetadata, error) { diff --git a/core/pkg/resourcehandler/urlloader_test.go b/core/pkg/resourcehandler/urlloader_test.go index 21eeea39..aa7356c8 100644 --- a/core/pkg/resourcehandler/urlloader_test.go +++ b/core/pkg/resourcehandler/urlloader_test.go @@ -8,13 +8,13 @@ import ( func TestLoadResourcesFromUrl(t *testing.T) { { - workloads, err := loadResourcesFromUrl([]string{"https://github.com/armosec/kubescape/tree/master/examples/online-boutique"}) + workloads, err := loadResourcesFromUrl([]string{"https://github.com/kubescape/kubescape/tree/master/examples/online-boutique"}) assert.NoError(t, err) assert.Equal(t, 12, len(workloads)) for i, w := range workloads { switch i { - case "https://raw.githubusercontent.com/armosec/kubescape/master/examples/online-boutique/adservice.yaml": + case "https://raw.githubusercontent.com/kubescape/kubescape/master/examples/online-boutique/adservice.yaml": assert.Equal(t, 2, len(w)) assert.Equal(t, "apps/v1//Deployment/adservice", w[0].GetID()) assert.Equal(t, "/v1//Service/adservice", w[1].GetID()) @@ -22,13 +22,13 @@ func TestLoadResourcesFromUrl(t *testing.T) { } } { - workloads, err := loadResourcesFromUrl([]string{"https://github.com/armosec/kubescape"}) + workloads, err := loadResourcesFromUrl([]string{"https://github.com/kubescape/kubescape"}) assert.NoError(t, err) assert.Less(t, 12, len(workloads)) for i, w := range workloads { switch i { - case "https://raw.githubusercontent.com/armosec/kubescape/master/examples/online-boutique/adservice.yaml": + case "https://raw.githubusercontent.com/kubescape/kubescape/master/examples/online-boutique/adservice.yaml": assert.Equal(t, 2, len(w)) assert.Equal(t, "apps/v1//Deployment/adservice", w[0].GetID()) assert.Equal(t, "/v1//Service/adservice", w[1].GetID()) @@ -36,13 +36,13 @@ func TestLoadResourcesFromUrl(t *testing.T) { } } { - workloads, err := loadResourcesFromUrl([]string{"https://github.com/armosec/kubescape/blob/master/examples/online-boutique/adservice.yaml"}) + workloads, err := loadResourcesFromUrl([]string{"https://github.com/kubescape/kubescape/blob/master/examples/online-boutique/adservice.yaml"}) assert.NoError(t, err) assert.Equal(t, 1, len(workloads)) for i, w := range workloads { switch i { - case "https://raw.githubusercontent.com/armosec/kubescape/master/examples/online-boutique/adservice.yaml": + case "https://raw.githubusercontent.com/kubescape/kubescape/master/examples/online-boutique/adservice.yaml": assert.Equal(t, 2, len(w)) assert.Equal(t, "apps/v1//Deployment/adservice", w[0].GetID()) assert.Equal(t, "/v1//Service/adservice", w[1].GetID()) @@ -50,13 +50,13 @@ func TestLoadResourcesFromUrl(t *testing.T) { } } { - workloads, err := loadResourcesFromUrl([]string{"https://raw.githubusercontent.com/armosec/kubescape/master/examples/online-boutique/adservice.yaml"}) + workloads, err := loadResourcesFromUrl([]string{"https://raw.githubusercontent.com/kubescape/kubescape/master/examples/online-boutique/adservice.yaml"}) assert.NoError(t, err) assert.Equal(t, 1, len(workloads)) for i, w := range workloads { switch i { - case "https://raw.githubusercontent.com/armosec/kubescape/master/examples/online-boutique/adservice.yaml": + case "https://raw.githubusercontent.com/kubescape/kubescape/master/examples/online-boutique/adservice.yaml": assert.Equal(t, 2, len(w)) assert.Equal(t, "apps/v1//Deployment/adservice", w[0].GetID()) assert.Equal(t, "/v1//Service/adservice", w[1].GetID()) diff --git a/core/pkg/resultshandling/printer/printresults.go b/core/pkg/resultshandling/printer/printresults.go index a0c2be61..0b922cc9 100644 --- a/core/pkg/resultshandling/printer/printresults.go +++ b/core/pkg/resultshandling/printer/printresults.go @@ -5,8 +5,8 @@ import ( "os" "path/filepath" - "github.com/armosec/kubescape/v2/core/cautils" - logger "github.com/dwertent/go-logger" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/kubescape/v2/core/cautils" ) var INDENT = " " diff --git a/core/pkg/resultshandling/printer/v1/jsonprinter.go b/core/pkg/resultshandling/printer/v1/jsonprinter.go index d5f231bd..c90722bd 100644 --- a/core/pkg/resultshandling/printer/v1/jsonprinter.go +++ b/core/pkg/resultshandling/printer/v1/jsonprinter.go @@ -5,9 +5,9 @@ import ( "fmt" "os" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer" - logger "github.com/dwertent/go-logger" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer" ) type JsonPrinter struct { diff --git a/core/pkg/resultshandling/printer/v1/prometheusprinter.go b/core/pkg/resultshandling/printer/v1/prometheusprinter.go index 6947c26c..3ef81a6d 100644 --- a/core/pkg/resultshandling/printer/v1/prometheusprinter.go +++ b/core/pkg/resultshandling/printer/v1/prometheusprinter.go @@ -4,11 +4,11 @@ import ( "fmt" "os" - "github.com/armosec/k8s-interface/workloadinterface" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer" - "github.com/armosec/opa-utils/reporthandling" - logger "github.com/dwertent/go-logger" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/k8s-interface/workloadinterface" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer" + "github.com/kubescape/opa-utils/reporthandling" ) type PrometheusPrinter struct { diff --git a/core/pkg/resultshandling/printer/v2/controltable.go b/core/pkg/resultshandling/printer/v2/controltable.go index 27a8ee9c..e78288fb 100644 --- a/core/pkg/resultshandling/printer/v2/controltable.go +++ b/core/pkg/resultshandling/printer/v2/controltable.go @@ -4,10 +4,10 @@ import ( "fmt" "sort" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/opa-utils/reporthandling/apis" - "github.com/armosec/opa-utils/reporthandling/results/v1/reportsummary" "github.com/fatih/color" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/opa-utils/reporthandling/apis" + "github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary" "github.com/olekukonko/tablewriter" ) diff --git a/core/pkg/resultshandling/printer/v2/html/report.gohtml b/core/pkg/resultshandling/printer/v2/html/report.gohtml index 890dd579..2c51d34a 100644 --- a/core/pkg/resultshandling/printer/v2/html/report.gohtml +++ b/core/pkg/resultshandling/printer/v2/html/report.gohtml @@ -69,7 +69,7 @@ } - +

Kubescape Scan Report

{{ with .OPASessionObj.Report.SummaryDetails }}

By Controls

diff --git a/core/pkg/resultshandling/printer/v2/htmlprinter.go b/core/pkg/resultshandling/printer/v2/htmlprinter.go index c79fd627..5e0dfe13 100644 --- a/core/pkg/resultshandling/printer/v2/htmlprinter.go +++ b/core/pkg/resultshandling/printer/v2/htmlprinter.go @@ -8,13 +8,13 @@ import ( "sort" "strings" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer" - "github.com/armosec/opa-utils/reporthandling/apis" - "github.com/armosec/opa-utils/reporthandling/results/v1/reportsummary" - "github.com/armosec/opa-utils/reporthandling/results/v1/resourcesresults" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer" + "github.com/kubescape/opa-utils/reporthandling/apis" + "github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary" + "github.com/kubescape/opa-utils/reporthandling/results/v1/resourcesresults" ) const ( diff --git a/core/pkg/resultshandling/printer/v2/jsonprinter.go b/core/pkg/resultshandling/printer/v2/jsonprinter.go index bb760cf9..7d123126 100644 --- a/core/pkg/resultshandling/printer/v2/jsonprinter.go +++ b/core/pkg/resultshandling/printer/v2/jsonprinter.go @@ -5,10 +5,10 @@ import ( "fmt" "os" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer" ) type JsonPrinter struct { diff --git a/core/pkg/resultshandling/printer/v2/junit.go b/core/pkg/resultshandling/printer/v2/junit.go index 71ee51b3..e73df0ad 100644 --- a/core/pkg/resultshandling/printer/v2/junit.go +++ b/core/pkg/resultshandling/printer/v2/junit.go @@ -7,19 +7,18 @@ import ( "sort" "strings" - "github.com/armosec/k8s-interface/workloadinterface" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer" - "github.com/armosec/opa-utils/reporthandling/results/v1/reportsummary" - "github.com/armosec/opa-utils/shared" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/k8s-interface/workloadinterface" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer" + "github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary" + "github.com/kubescape/opa-utils/shared" ) /* riskScore status - */ type JunitPrinter struct { writer *os.File diff --git a/core/pkg/resultshandling/printer/v2/pdf.go b/core/pkg/resultshandling/printer/v2/pdf.go index e1c4f511..cffdd1f4 100644 --- a/core/pkg/resultshandling/printer/v2/pdf.go +++ b/core/pkg/resultshandling/printer/v2/pdf.go @@ -9,11 +9,11 @@ import ( "strings" "time" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer" - "github.com/armosec/opa-utils/reporthandling/results/v1/reportsummary" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer" + "github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary" "github.com/johnfercher/maroto/pkg/color" "github.com/johnfercher/maroto/pkg/consts" diff --git a/core/pkg/resultshandling/printer/v2/prettyprinter.go b/core/pkg/resultshandling/printer/v2/prettyprinter.go index 4d1d8c57..80e0cccf 100644 --- a/core/pkg/resultshandling/printer/v2/prettyprinter.go +++ b/core/pkg/resultshandling/printer/v2/prettyprinter.go @@ -6,14 +6,14 @@ import ( "sort" "strings" - "github.com/armosec/k8s-interface/workloadinterface" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer" - "github.com/armosec/opa-utils/objectsenvelopes" - "github.com/armosec/opa-utils/reporthandling/apis" - helpersv1 "github.com/armosec/opa-utils/reporthandling/helpers/v1" - "github.com/armosec/opa-utils/reporthandling/results/v1/reportsummary" "github.com/enescakir/emoji" + "github.com/kubescape/k8s-interface/workloadinterface" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer" + "github.com/kubescape/opa-utils/objectsenvelopes" + "github.com/kubescape/opa-utils/reporthandling/apis" + helpersv1 "github.com/kubescape/opa-utils/reporthandling/helpers/v1" + "github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary" "github.com/olekukonko/tablewriter" ) diff --git a/core/pkg/resultshandling/printer/v2/prometheus.go b/core/pkg/resultshandling/printer/v2/prometheus.go index 18fd25fc..3c7f0384 100644 --- a/core/pkg/resultshandling/printer/v2/prometheus.go +++ b/core/pkg/resultshandling/printer/v2/prometheus.go @@ -4,13 +4,13 @@ import ( "fmt" "os" - "github.com/armosec/k8s-interface/workloadinterface" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer" - "github.com/armosec/opa-utils/reporthandling/results/v1/reportsummary" - "github.com/armosec/opa-utils/reporthandling/results/v1/resourcesresults" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/k8s-interface/workloadinterface" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer" + "github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary" + "github.com/kubescape/opa-utils/reporthandling/results/v1/resourcesresults" ) type PrometheusPrinter struct { diff --git a/core/pkg/resultshandling/printer/v2/prometheusutils.go b/core/pkg/resultshandling/printer/v2/prometheusutils.go index 2b318ab5..6ec997b8 100644 --- a/core/pkg/resultshandling/printer/v2/prometheusutils.go +++ b/core/pkg/resultshandling/printer/v2/prometheusutils.go @@ -4,11 +4,11 @@ import ( "fmt" "strings" - "github.com/armosec/k8s-interface/workloadinterface" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/opa-utils/reporthandling/apis" - "github.com/armosec/opa-utils/reporthandling/results/v1/reportsummary" - "github.com/armosec/opa-utils/reporthandling/results/v1/resourcesresults" + "github.com/kubescape/k8s-interface/workloadinterface" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/opa-utils/reporthandling/apis" + "github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary" + "github.com/kubescape/opa-utils/reporthandling/results/v1/resourcesresults" ) type metricsName string diff --git a/core/pkg/resultshandling/printer/v2/reportingstructs.go b/core/pkg/resultshandling/printer/v2/reportingstructs.go index 052d1110..a4c2f408 100644 --- a/core/pkg/resultshandling/printer/v2/reportingstructs.go +++ b/core/pkg/resultshandling/printer/v2/reportingstructs.go @@ -1,7 +1,7 @@ package v2 import ( - "github.com/armosec/k8s-interface/workloadinterface" + "github.com/kubescape/k8s-interface/workloadinterface" ) type ResourceTableView []ResourceResult diff --git a/core/pkg/resultshandling/printer/v2/resourcetable.go b/core/pkg/resultshandling/printer/v2/resourcetable.go index 707474ed..28951ec0 100644 --- a/core/pkg/resultshandling/printer/v2/resourcetable.go +++ b/core/pkg/resultshandling/printer/v2/resourcetable.go @@ -5,9 +5,9 @@ import ( "sort" "strings" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/opa-utils/reporthandling/results/v1/reportsummary" - "github.com/armosec/opa-utils/reporthandling/results/v1/resourcesresults" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary" + "github.com/kubescape/opa-utils/reporthandling/results/v1/resourcesresults" "github.com/olekukonko/tablewriter" ) diff --git a/core/pkg/resultshandling/printer/v2/silentprinter.go b/core/pkg/resultshandling/printer/v2/silentprinter.go index f2524d8a..421cd85d 100644 --- a/core/pkg/resultshandling/printer/v2/silentprinter.go +++ b/core/pkg/resultshandling/printer/v2/silentprinter.go @@ -1,7 +1,7 @@ package v2 import ( - "github.com/armosec/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/cautils" ) type SilentPrinter struct { diff --git a/core/pkg/resultshandling/printer/v2/summeryhelpers.go b/core/pkg/resultshandling/printer/v2/summaryhelpers.go similarity index 91% rename from core/pkg/resultshandling/printer/v2/summeryhelpers.go rename to core/pkg/resultshandling/printer/v2/summaryhelpers.go index 09d0f2e8..a992079a 100644 --- a/core/pkg/resultshandling/printer/v2/summeryhelpers.go +++ b/core/pkg/resultshandling/printer/v2/summaryhelpers.go @@ -1,11 +1,11 @@ package v2 import ( - "github.com/armosec/k8s-interface/k8sinterface" - "github.com/armosec/k8s-interface/workloadinterface" - "github.com/armosec/opa-utils/objectsenvelopes" - "github.com/armosec/opa-utils/reporthandling/apis" - "github.com/armosec/opa-utils/reporthandling/results/v1/reportsummary" + "github.com/kubescape/k8s-interface/k8sinterface" + "github.com/kubescape/k8s-interface/workloadinterface" + "github.com/kubescape/opa-utils/objectsenvelopes" + "github.com/kubescape/opa-utils/reporthandling/apis" + "github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary" ) type WorkloadSummary struct { diff --git a/core/pkg/resultshandling/printer/v2/utils.go b/core/pkg/resultshandling/printer/v2/utils.go index b2c9d3f2..78f20594 100644 --- a/core/pkg/resultshandling/printer/v2/utils.go +++ b/core/pkg/resultshandling/printer/v2/utils.go @@ -1,14 +1,14 @@ package v2 import ( - "github.com/armosec/k8s-interface/workloadinterface" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/opa-utils/reporthandling" - "github.com/armosec/opa-utils/reporthandling/results/v1/reportsummary" - "github.com/armosec/opa-utils/reporthandling/results/v1/resourcesresults" - reporthandlingv2 "github.com/armosec/opa-utils/reporthandling/v2" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/k8s-interface/workloadinterface" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/opa-utils/reporthandling" + "github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary" + "github.com/kubescape/opa-utils/reporthandling/results/v1/resourcesresults" + reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2" ) // finalizeV2Report finalize the results objects by copying data from map to lists diff --git a/core/pkg/resultshandling/reporter/interface.go b/core/pkg/resultshandling/reporter/interface.go index 4a9d1d72..56ded5f6 100644 --- a/core/pkg/resultshandling/reporter/interface.go +++ b/core/pkg/resultshandling/reporter/interface.go @@ -1,6 +1,6 @@ package reporter -import "github.com/armosec/kubescape/v2/core/cautils" +import "github.com/kubescape/kubescape/v2/core/cautils" type IReport interface { Submit(opaSessionObj *cautils.OPASessionObj) error diff --git a/core/pkg/resultshandling/reporter/v2/mockreporter.go b/core/pkg/resultshandling/reporter/v2/mockreporter.go index d4d0b74c..570757bd 100644 --- a/core/pkg/resultshandling/reporter/v2/mockreporter.go +++ b/core/pkg/resultshandling/reporter/v2/mockreporter.go @@ -4,8 +4,8 @@ import ( "fmt" "os" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/cautils/getter" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/cautils/getter" ) const NO_SUBMIT_QUERY = "utm_source=GitHub&utm_medium=CLI&utm_campaign=no_submit" @@ -32,7 +32,7 @@ func (reportMock *ReportMock) SetClusterName(clusterName string) { } func (reportMock *ReportMock) GetURL() string { - u := fmt.Sprintf("https://%s/account/sign-up", getter.GetArmoAPIConnector().GetFrontendURL()) + u := fmt.Sprintf("https://%s/account/sign-up", getter.GetKSCloudAPIConnector().GetFrontendURL()) if reportMock.query != "" { u += fmt.Sprintf("?%s", reportMock.query) } diff --git a/core/pkg/resultshandling/reporter/v2/reporteventreceiver.go b/core/pkg/resultshandling/reporter/v2/reporteventreceiver.go index 26e8158e..00a0d5de 100644 --- a/core/pkg/resultshandling/reporter/v2/reporteventreceiver.go +++ b/core/pkg/resultshandling/reporter/v2/reporteventreceiver.go @@ -8,14 +8,14 @@ import ( "os" "github.com/armosec/armoapi-go/apis" - "github.com/armosec/k8s-interface/workloadinterface" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/cautils/getter" - "github.com/armosec/opa-utils/reporthandling" - "github.com/armosec/opa-utils/reporthandling/results/v1/resourcesresults" - reporthandlingv2 "github.com/armosec/opa-utils/reporthandling/v2" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/k8s-interface/workloadinterface" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/cautils/getter" + "github.com/kubescape/opa-utils/reporthandling" + "github.com/kubescape/opa-utils/reporthandling/results/v1/resourcesresults" + reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2" ) const MAX_REPORT_SIZE = 2097152 // 2 MB @@ -104,7 +104,7 @@ func (report *ReportEventReceiver) prepareReport(opaSessionObj *cautils.OPASessi func (report *ReportEventReceiver) GetURL() string { u := url.URL{} - u.Host = getter.GetArmoAPIConnector().GetFrontendURL() + u.Host = getter.GetKSCloudAPIConnector().GetFrontendURL() parseHost(&u) report.addPathURL(&u) diff --git a/core/pkg/resultshandling/reporter/v2/reporteventreceiver_test.go b/core/pkg/resultshandling/reporter/v2/reporteventreceiver_test.go index 24ea9fdf..d64a4f13 100644 --- a/core/pkg/resultshandling/reporter/v2/reporteventreceiver_test.go +++ b/core/pkg/resultshandling/reporter/v2/reporteventreceiver_test.go @@ -4,7 +4,7 @@ import ( "net/url" "testing" - "github.com/armosec/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/cautils" "github.com/stretchr/testify/assert" ) diff --git a/core/pkg/resultshandling/reporter/v2/reporteventreceiverutils.go b/core/pkg/resultshandling/reporter/v2/reporteventreceiverutils.go index d67b6e98..f3a4d19f 100644 --- a/core/pkg/resultshandling/reporter/v2/reporteventreceiverutils.go +++ b/core/pkg/resultshandling/reporter/v2/reporteventreceiverutils.go @@ -3,15 +3,15 @@ package v2 import ( "net/url" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/cautils/getter" - reporthandlingv2 "github.com/armosec/opa-utils/reporthandling/v2" "github.com/google/uuid" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/cautils/getter" + reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2" ) func (report *ReportEventReceiver) initEventReceiverURL() { urlObj := url.URL{} - urlObj.Host = getter.GetArmoAPIConnector().GetReportReceiverURL() + urlObj.Host = getter.GetKSCloudAPIConnector().GetReportReceiverURL() parseHost(&urlObj) urlObj.Path = "/k8s/v2/postureReport" diff --git a/core/pkg/resultshandling/results.go b/core/pkg/resultshandling/results.go index 2fe409df..5545b397 100644 --- a/core/pkg/resultshandling/results.go +++ b/core/pkg/resultshandling/results.go @@ -3,14 +3,14 @@ package resultshandling import ( "encoding/json" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer" - printerv1 "github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer/v1" - printerv2 "github.com/armosec/kubescape/v2/core/pkg/resultshandling/printer/v2" - "github.com/armosec/kubescape/v2/core/pkg/resultshandling/reporter" - reporthandlingv2 "github.com/armosec/opa-utils/reporthandling/v2" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer" + printerv1 "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer/v1" + printerv2 "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/printer/v2" + "github.com/kubescape/kubescape/v2/core/pkg/resultshandling/reporter" + reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2" ) type ResultsHandler struct { diff --git a/core/pkg/score/score.go b/core/pkg/score/score.go index b313e965..e36b1c1b 100644 --- a/core/pkg/score/score.go +++ b/core/pkg/score/score.go @@ -3,13 +3,16 @@ package score import ( "fmt" - "github.com/armosec/opa-utils/score" + "github.com/kubescape/opa-utils/score" - "github.com/armosec/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/cautils" ) -/* provides a wrapper for scoreUtils, since there's no common interface between postureReportV1 and PostureReportV2 +/* + provides a wrapper for scoreUtils, since there's no common interface between postureReportV1 and PostureReportV2 + and the need of concrete objects + I've decided to create scoreWrapper that will allow calculating score regardless (as long as opaSessionObj is there) */ type ScoreWrapper struct { diff --git a/docs/roadmap.md b/docs/roadmap.md index 8143fef4..f2398d5c 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -67,7 +67,7 @@ The items in the Kubescape roadmap are split into 3 major groups based on the fe * Image vulnerability scanning based controls * Assisted remediation (telling where/what to fix) * Integration with Prometheus -* Confiugration of controls (customizing rules for a given environment) +* Configuration of controls (customizing rules for a given environment) * Installation in the cluster for continuous monitoring * Host scanner * Cloud vendor API integration diff --git a/examples/cloud-vendor-integration/aws.sh b/examples/cloud-vendor-integration/aws.sh index 67f36bfe..58bbcad9 100755 --- a/examples/cloud-vendor-integration/aws.sh +++ b/examples/cloud-vendor-integration/aws.sh @@ -8,7 +8,7 @@ # Set environment variables echo 'Set environment variables' -export kubescape_namespace=armo-system +export kubescape_namespace=kubescape export kubescape_serviceaccount=armo-kubescape-service-account # Get current context @@ -65,4 +65,4 @@ eksctl create iamserviceaccount \ # Install/Upgrade Kubescape chart echo 'Install/Upgrade Kubescape chart' -helm upgrade --install armo armo-components/ -n armo-system --create-namespace --set clusterName=$cluster_name --set cloud_provider_engine=eks --set createKubescapeServiceAccount=false --set cloudRegion=$cluster_region +helm upgrade --install armo armo-components/ -n kubescape --create-namespace --set clusterName=$cluster_name --set cloud_provider_engine=eks --set createKubescapeServiceAccount=false --set cloudRegion=$cluster_region diff --git a/examples/cloud-vendor-integration/gcp.sh b/examples/cloud-vendor-integration/gcp.sh index 0f33cb15..794e5d03 100755 --- a/examples/cloud-vendor-integration/gcp.sh +++ b/examples/cloud-vendor-integration/gcp.sh @@ -17,7 +17,7 @@ gcloud iam service-accounts create kubescape --display-name=kubescape # Set environment variables echo 'Set environment variables' -export kubescape_namespace=armo-system +export kubescape_namespace=kubescape export kubescape_serviceaccount=armo-kubescape-service-account # Get current GCP project @@ -46,4 +46,4 @@ gcloud iam service-accounts add-iam-policy-binding $gcp_service_account --role r # Install/Upgrade Kubescape chart echo 'Install/Upgrade Kubescape chart' -helm upgrade --install armo armo-components/ -n armo-system --create-namespace --set cloud_provider_engine=gke --set gke_service_account=$gcp_service_account --set cloudRegion=$CLUSTER_REGION --set clusterName=$CLUSTER_NAME --set gkeProject=$gcp_project +helm upgrade --install armo armo-components/ -n kubescape --create-namespace --set cloud_provider_engine=gke --set gke_service_account=$gcp_service_account --set cloudRegion=$CLUSTER_REGION --set clusterName=$CLUSTER_NAME --set gkeProject=$gcp_project diff --git a/examples/exceptions/README.md b/examples/exceptions/README.md index 2edb3d29..a92e7d6f 100644 --- a/examples/exceptions/README.md +++ b/examples/exceptions/README.md @@ -24,7 +24,7 @@ e.g. When a `kube-system` resource fails and it is ok, simply add the resource t * `controlID` - Control ID can be find [here](https://github.com/armosec/regolibrary/tree/master/controls) (regex supported) * `ruleName` - Rule names can be find [here](https://github.com/armosec/regolibrary/tree/master/rules) (regex supported) -You can find [here](https://github.com/armosec/kubescape/tree/master/examples/exceptions) some examples of exceptions files +You can find [here](https://github.com/kubescape/kubescape/tree/master/examples/exceptions) some examples of exceptions files ## Usage diff --git a/examples/output_mocks/prometheus-verbose-flag.txt b/examples/output_mocks/prometheus-verbose-flag.txt index f77adaff..b798d4ec 100644 --- a/examples/output_mocks/prometheus-verbose-flag.txt +++ b/examples/output_mocks/prometheus-verbose-flag.txt @@ -15,9 +15,9 @@ kubescape_object_failed_count{framework="NSA",control="Immutable container files # Failed object from "NSA" control "Immutable container filesystem" kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1/Pod"} 1 # Failed object from "NSA" control "Immutable container filesystem" -kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Immutable container filesystem" -kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Immutable container filesystem" kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="cyberarmor-system",name="ca-dashboard-aggregator",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Immutable container filesystem" @@ -43,9 +43,9 @@ kubescape_object_failed_count{framework="NSA",control="Immutable container files # Failed object from "NSA" control "Immutable container filesystem" kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1 # Failed object from "NSA" control "Immutable container filesystem" -kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "NSA" control "Immutable container filesystem" -kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "NSA" control "Immutable container filesystem" kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="kube-system",name="coredns",groupVersionKind="apps/v1/Deployment"} 1 # Number of resources found as part of NSA control Privileged container @@ -57,9 +57,9 @@ kubescape_resources_failed_count{framework="NSA",control="Privileged container"} # Failed object from "NSA" control "Privileged container" kubescape_object_failed_count{framework="NSA",control="Privileged container",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1 # Failed object from "NSA" control "Privileged container" -kubescape_object_failed_count{framework="NSA",control="Privileged container",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="Privileged container",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Privileged container" -kubescape_object_failed_count{framework="NSA",control="Privileged container",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="Privileged container",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Privileged container" kubescape_object_failed_count{framework="NSA",control="Privileged container",namespace="cyberarmor-system",name="ca-audit",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Privileged container" @@ -95,9 +95,9 @@ kubescape_object_failed_count{framework="NSA",control="Privileged container",nam # Failed object from "NSA" control "Privileged container" kubescape_object_failed_count{framework="NSA",control="Privileged container",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1/Pod"} 1 # Failed object from "NSA" control "Privileged container" -kubescape_object_failed_count{framework="NSA",control="Privileged container",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="NSA",control="Privileged container",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "NSA" control "Privileged container" -kubescape_object_failed_count{framework="NSA",control="Privileged container",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="NSA",control="Privileged container",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Number of resources found as part of NSA control Allowed hostPath kubescape_resources_found_count{framework="NSA",control="Allowed hostPath"} 22 # Number of resources excluded as part of NSA control Allowed hostPath @@ -117,9 +117,9 @@ kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespa # Failed object from "NSA" control "Allowed hostPath" kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespace="cyberarmor-system",name="ca-websocket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Allowed hostPath" -kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Allowed hostPath" -kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Allowed hostPath" kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespace="cyberarmor-system",name="ca-oracle",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Allowed hostPath" @@ -141,9 +141,9 @@ kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespa # Failed object from "NSA" control "Allowed hostPath" kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Allowed hostPath" -kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "NSA" control "Allowed hostPath" -kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "NSA" control "Allowed hostPath" kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespace="kube-system",name="kube-apiserver-david-virtualbox",groupVersionKind="v1/Pod"} 1 # Failed object from "NSA" control "Allowed hostPath" @@ -155,11 +155,11 @@ kubescape_resources_excluded_count{framework="NSA",control="Automatic mapping of # Number of resources failed as part of NSA control Automatic mapping of service account kubescape_resources_failed_count{framework="NSA",control="Automatic mapping of service account"} 47 # Failed object from "NSA" control "Automatic mapping of service account" -kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="armo-system",name="armo-kubescape-service-account",groupVersionKind="v1/ServiceAccount"} 1 +kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kubescape",name="armo-kubescape-service-account",groupVersionKind="v1/ServiceAccount"} 1 # Failed object from "NSA" control "Automatic mapping of service account" -kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="armo-system",name="armo-scanner-service-account",groupVersionKind="v1/ServiceAccount"} 1 +kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kubescape",name="armo-scanner-service-account",groupVersionKind="v1/ServiceAccount"} 1 # Failed object from "NSA" control "Automatic mapping of service account" -kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="armo-system",name="default",groupVersionKind="v1/ServiceAccount"} 1 +kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kubescape",name="default",groupVersionKind="v1/ServiceAccount"} 1 # Failed object from "NSA" control "Automatic mapping of service account" kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="cyberarmor-system",name="ca-audit",groupVersionKind="v1/ServiceAccount"} 1 # Failed object from "NSA" control "Automatic mapping of service account" @@ -267,9 +267,9 @@ kubescape_object_failed_count{framework="NSA",control="hostNetwork access",names # Failed object from "NSA" control "hostNetwork access" kubescape_object_failed_count{framework="NSA",control="hostNetwork access",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1 # Failed object from "NSA" control "hostNetwork access" -kubescape_object_failed_count{framework="NSA",control="hostNetwork access",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="hostNetwork access",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "hostNetwork access" -kubescape_object_failed_count{framework="NSA",control="hostNetwork access",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="hostNetwork access",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "hostNetwork access" kubescape_object_failed_count{framework="NSA",control="hostNetwork access",namespace="cyberarmor-system",name="ca-audit",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "hostNetwork access" @@ -295,9 +295,9 @@ kubescape_object_failed_count{framework="NSA",control="hostNetwork access",names # Failed object from "NSA" control "hostNetwork access" kubescape_object_failed_count{framework="NSA",control="hostNetwork access",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "hostNetwork access" -kubescape_object_failed_count{framework="NSA",control="hostNetwork access",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="NSA",control="hostNetwork access",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "NSA" control "hostNetwork access" -kubescape_object_failed_count{framework="NSA",control="hostNetwork access",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="NSA",control="hostNetwork access",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Number of resources found as part of NSA control Resource policies kubescape_resources_found_count{framework="NSA",control="Resource policies"} 22 # Number of resources excluded as part of NSA control Resource policies @@ -319,13 +319,13 @@ kubescape_object_failed_count{framework="NSA",control="Resource policies",namesp # Failed object from "NSA" control "Resource policies" kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1 # Failed object from "NSA" control "Resource policies" -kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "NSA" control "Resource policies" -kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "NSA" control "Resource policies" -kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Resource policies" -kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Resource policies" kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="cyberarmor-system",name="ca-audit",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Resource policies" @@ -365,9 +365,9 @@ kubescape_object_failed_count{framework="NSA",control="Allow privilege escalatio # Failed object from "NSA" control "Allow privilege escalation" kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1/Pod"} 1 # Failed object from "NSA" control "Allow privilege escalation" -kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Allow privilege escalation" -kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Allow privilege escalation" kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="cyberarmor-system",name="ca-dashboard-aggregator",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Allow privilege escalation" @@ -393,9 +393,9 @@ kubescape_object_failed_count{framework="NSA",control="Allow privilege escalatio # Failed object from "NSA" control "Allow privilege escalation" kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1 # Failed object from "NSA" control "Allow privilege escalation" -kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "NSA" control "Allow privilege escalation" -kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "NSA" control "Allow privilege escalation" kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kube-system",name="coredns",groupVersionKind="apps/v1/Deployment"} 1 # Number of resources found as part of NSA control Applications credentials in configuration files @@ -405,7 +405,7 @@ kubescape_resources_excluded_count{framework="NSA",control="Applications credent # Number of resources failed as part of NSA control Applications credentials in configuration files kubescape_resources_failed_count{framework="NSA",control="Applications credentials in configuration files"} 8 # Failed object from "NSA" control "Applications credentials in configuration files" -kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="armo-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="kubescape",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "NSA" control "Applications credentials in configuration files" kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="cyberarmor-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "NSA" control "Applications credentials in configuration files" @@ -431,15 +431,15 @@ kubescape_object_failed_count{framework="NSA",control="Applications credentials # Failed object from "NSA" control "Applications credentials in configuration files" kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1/Pod"} 1 # Failed object from "NSA" control "Applications credentials in configuration files" -kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "NSA" control "Applications credentials in configuration files" -kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "NSA" control "Applications credentials in configuration files" -kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="armo-system",name="armo-be-config",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="kubescape",name="armo-be-config",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "NSA" control "Applications credentials in configuration files" -kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="armo-system",name="armo-kubescape-config",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="kubescape",name="armo-kubescape-config",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "NSA" control "Applications credentials in configuration files" -kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="armo-system",name="armo-scan-scheduler-config",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="kubescape",name="armo-scan-scheduler-config",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "NSA" control "Applications credentials in configuration files" kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="cyberarmor-system",name="armo-be-config",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "NSA" control "Applications credentials in configuration files" @@ -465,9 +465,9 @@ kubescape_object_failed_count{framework="NSA",control="Applications credentials # Failed object from "NSA" control "Applications credentials in configuration files" kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Applications credentials in configuration files" -kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Applications credentials in configuration files" -kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Applications credentials in configuration files" kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="cyberarmor-system",name="ca-notification-server",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Applications credentials in configuration files" @@ -527,9 +527,9 @@ kubescape_object_failed_count{framework="NSA",control="Cluster-admin binding",na # Failed object from "NSA" control "Cluster-admin binding" kubescape_object_failed_count{framework="NSA",control="Cluster-admin binding",name="system:anonymous",groupVersionKind="rbac.authorization.k8s.io/User"} 1 # Failed object from "NSA" control "Cluster-admin binding" -kubescape_object_failed_count{framework="NSA",control="Cluster-admin binding",namespace="armo-system",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1 +kubescape_object_failed_count{framework="NSA",control="Cluster-admin binding",namespace="kubescape",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "NSA" control "Cluster-admin binding" -kubescape_object_failed_count{framework="NSA",control="Cluster-admin binding",namespace="armo-system",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1 +kubescape_object_failed_count{framework="NSA",control="Cluster-admin binding",namespace="kubescape",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "NSA" control "Cluster-admin binding" kubescape_object_failed_count{framework="NSA",control="Cluster-admin binding",namespace="kube-system",name="daemon-set-controller",groupVersionKind="/ServiceAccount"} 1 # Failed object from "NSA" control "Cluster-admin binding" @@ -625,9 +625,9 @@ kubescape_object_failed_count{framework="NSA",control="Exec into container",name # Failed object from "NSA" control "Exec into container" kubescape_object_failed_count{framework="NSA",control="Exec into container",name="system:masters",groupVersionKind="rbac.authorization.k8s.io/Group"} 1 # Failed object from "NSA" control "Exec into container" -kubescape_object_failed_count{framework="NSA",control="Exec into container",namespace="armo-system",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1 +kubescape_object_failed_count{framework="NSA",control="Exec into container",namespace="kubescape",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "NSA" control "Exec into container" -kubescape_object_failed_count{framework="NSA",control="Exec into container",namespace="armo-system",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1 +kubescape_object_failed_count{framework="NSA",control="Exec into container",namespace="kubescape",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "NSA" control "Exec into container" kubescape_object_failed_count{framework="NSA",control="Exec into container",namespace="kube-system",name="replication-controller",groupVersionKind="/ServiceAccount"} 1 # Failed object from "NSA" control "Exec into container" @@ -737,13 +737,13 @@ kubescape_resources_failed_count{framework="NSA",control="Insecure capabilities" # Failed object from "NSA" control "Insecure capabilities" kubescape_object_failed_count{framework="NSA",control="Insecure capabilities",namespace="kube-system",name="coredns",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Insecure capabilities" -kubescape_object_failed_count{framework="NSA",control="Insecure capabilities",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="NSA",control="Insecure capabilities",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "NSA" control "Insecure capabilities" -kubescape_object_failed_count{framework="NSA",control="Insecure capabilities",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="NSA",control="Insecure capabilities",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "NSA" control "Insecure capabilities" -kubescape_object_failed_count{framework="NSA",control="Insecure capabilities",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="Insecure capabilities",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Insecure capabilities" -kubescape_object_failed_count{framework="NSA",control="Insecure capabilities",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="Insecure capabilities",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Insecure capabilities" kubescape_object_failed_count{framework="NSA",control="Insecure capabilities",namespace="cyberarmor-system",name="ca-websocket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Insecure capabilities" @@ -787,9 +787,9 @@ kubescape_resources_failed_count{framework="NSA",control="Linux hardening"} 17 # Failed object from "NSA" control "Linux hardening" kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1/Pod"} 1 # Failed object from "NSA" control "Linux hardening" -kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Linux hardening" -kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Linux hardening" kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="cyberarmor-system",name="ca-audit",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Linux hardening" @@ -815,9 +815,9 @@ kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespac # Failed object from "NSA" control "Linux hardening" kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1 # Failed object from "NSA" control "Linux hardening" -kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "NSA" control "Linux hardening" -kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "NSA" control "Linux hardening" kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="kube-system",name="coredns",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Linux hardening" @@ -835,9 +835,9 @@ kubescape_resources_excluded_count{framework="NSA",control="Ingress and Egress b # Number of resources failed as part of NSA control Ingress and Egress blocked kubescape_resources_failed_count{framework="NSA",control="Ingress and Egress blocked"} 22 # Failed object from "NSA" control "Ingress and Egress blocked" -kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Ingress and Egress blocked" -kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Ingress and Egress blocked" kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="cyberarmor-system",name="ca-ocimage",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Ingress and Egress blocked" @@ -865,9 +865,9 @@ kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocke # Failed object from "NSA" control "Ingress and Egress blocked" kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1 # Failed object from "NSA" control "Ingress and Egress blocked" -kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "NSA" control "Ingress and Egress blocked" -kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "NSA" control "Ingress and Egress blocked" kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kube-system",name="etcd-david-virtualbox",groupVersionKind="v1/Pod"} 1 # Failed object from "NSA" control "Ingress and Egress blocked" @@ -885,7 +885,7 @@ kubescape_resources_excluded_count{framework="NSA",control="Network policies"} 0 # Number of resources failed as part of NSA control Network policies kubescape_resources_failed_count{framework="NSA",control="Network policies"} 7 # Failed object from "NSA" control "Network policies" -kubescape_object_failed_count{framework="NSA",control="Network policies",name="armo-system",groupVersionKind="v1/Namespace"} 1 +kubescape_object_failed_count{framework="NSA",control="Network policies",name="kubescape",groupVersionKind="v1/Namespace"} 1 # Failed object from "NSA" control "Network policies" kubescape_object_failed_count{framework="NSA",control="Network policies",name="cyberarmor-system",groupVersionKind="v1/Namespace"} 1 # Failed object from "NSA" control "Network policies" @@ -907,9 +907,9 @@ kubescape_resources_failed_count{framework="NSA",control="CVE-2021-25742-nginx-i # Failed object from "NSA" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" kubescape_object_failed_count{framework="NSA",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" -kubescape_object_failed_count{framework="NSA",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" -kubescape_object_failed_count{framework="NSA",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" kubescape_object_failed_count{framework="NSA",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="cyberarmor-system",name="ca-dashboard-aggregator",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" @@ -949,13 +949,13 @@ kubescape_object_failed_count{framework="NSA",control="CVE-2021-25742-nginx-ingr # Failed object from "NSA" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" kubescape_object_failed_count{framework="NSA",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="nginx-ingress",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "NSA" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" -kubescape_object_failed_count{framework="NSA",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="armo-system",name="armo-be-config",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="NSA",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="kubescape",name="armo-be-config",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "NSA" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" -kubescape_object_failed_count{framework="NSA",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="armo-system",name="armo-kubescape-config",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="NSA",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="kubescape",name="armo-kubescape-config",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "NSA" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" -kubescape_object_failed_count{framework="NSA",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="armo-system",name="armo-scan-scheduler-config",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="NSA",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="kubescape",name="armo-scan-scheduler-config",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "NSA" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" -kubescape_object_failed_count{framework="NSA",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="armo-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="NSA",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="kubescape",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "NSA" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" kubescape_object_failed_count{framework="NSA",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="cyberarmor-system",name="armo-be-config",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "NSA" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" @@ -983,7 +983,7 @@ kubescape_resources_excluded_count{framework="MITRE",control="Access container s # Number of resources failed as part of MITRE control Access container service account kubescape_resources_failed_count{framework="MITRE",control="Access container service account"} 31 # Failed object from "MITRE" control "Access container service account" -kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "MITRE" control "Access container service account" kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="kube-system",name="system:persistent-volume-provisioner",groupVersionKind="rbac.authorization.k8s.io/v1/RoleBinding"} 1 # Failed object from "MITRE" control "Access container service account" @@ -1019,9 +1019,9 @@ kubescape_object_failed_count{framework="MITRE",control="Access container servic # Failed object from "MITRE" control "Access container service account" kubescape_object_failed_count{framework="MITRE",control="Access container service account",name="nginx-ingress-roles-binding",groupVersionKind="rbac.authorization.k8s.io/v1/ClusterRoleBinding"} 1 # Failed object from "MITRE" control "Access container service account" -kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "Access container service account" -kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "Access container service account" kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="cyberarmor-system",name="ca-rbac",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "Access container service account" @@ -1179,13 +1179,13 @@ kubescape_object_failed_count{framework="MITRE",control="Access container servic # Failed object from "MITRE" control "Access container service account" kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="kube-system",name="kube-scheduler-david-virtualbox",groupVersionKind="v1/Pod"} 1 # Failed object from "MITRE" control "Access container service account" -kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "MITRE" control "Access container service account" -kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="armo-system",name="armo-kubescape-service-account",groupVersionKind="v1/ServiceAccount"} 1 +kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="kubescape",name="armo-kubescape-service-account",groupVersionKind="v1/ServiceAccount"} 1 # Failed object from "MITRE" control "Access container service account" -kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="armo-system",name="armo-scanner-service-account",groupVersionKind="v1/ServiceAccount"} 1 +kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="kubescape",name="armo-scanner-service-account",groupVersionKind="v1/ServiceAccount"} 1 # Failed object from "MITRE" control "Access container service account" -kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="armo-system",name="default",groupVersionKind="v1/ServiceAccount"} 1 +kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="kubescape",name="default",groupVersionKind="v1/ServiceAccount"} 1 # Failed object from "MITRE" control "Access container service account" kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="cyberarmor-system",name="default",groupVersionKind="v1/ServiceAccount"} 1 # Failed object from "MITRE" control "Access container service account" @@ -1421,7 +1421,7 @@ kubescape_resources_excluded_count{framework="MITRE",control="Applications crede # Number of resources failed as part of MITRE control Applications credentials in configuration files kubescape_resources_failed_count{framework="MITRE",control="Applications credentials in configuration files"} 8 # Failed object from "MITRE" control "Applications credentials in configuration files" -kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="armo-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="kubescape",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "MITRE" control "Applications credentials in configuration files" kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="cyberarmor-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "MITRE" control "Applications credentials in configuration files" @@ -1437,9 +1437,9 @@ kubescape_object_failed_count{framework="MITRE",control="Applications credential # Failed object from "MITRE" control "Applications credentials in configuration files" kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="kube-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "MITRE" control "Applications credentials in configuration files" -kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "Applications credentials in configuration files" -kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "Applications credentials in configuration files" kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="cyberarmor-system",name="ca-audit",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "Applications credentials in configuration files" @@ -1477,9 +1477,9 @@ kubescape_object_failed_count{framework="MITRE",control="Applications credential # Failed object from "MITRE" control "Applications credentials in configuration files" kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="kube-system",name="etcd-david-virtualbox",groupVersionKind="v1/Pod"} 1 # Failed object from "MITRE" control "Applications credentials in configuration files" -kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "MITRE" control "Applications credentials in configuration files" -kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "MITRE" control "Applications credentials in configuration files" kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="kube-system",name="kubelet-config-1.22",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "MITRE" control "Applications credentials in configuration files" @@ -1491,11 +1491,11 @@ kubescape_object_failed_count{framework="MITRE",control="Applications credential # Failed object from "MITRE" control "Applications credentials in configuration files" kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="nginx-ingress",name="ingress-controller-leader-nginx",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "MITRE" control "Applications credentials in configuration files" -kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="armo-system",name="armo-kubescape-config",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="kubescape",name="armo-kubescape-config",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "MITRE" control "Applications credentials in configuration files" -kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="armo-system",name="armo-scan-scheduler-config",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="kubescape",name="armo-scan-scheduler-config",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "MITRE" control "Applications credentials in configuration files" -kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="armo-system",name="armo-be-config",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="kubescape",name="armo-be-config",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "MITRE" control "Applications credentials in configuration files" kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="cyberarmor-system",name="armo-be-config",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "MITRE" control "Applications credentials in configuration files" @@ -1523,9 +1523,9 @@ kubescape_object_failed_count{framework="MITRE",control="Cluster-admin binding", # Failed object from "MITRE" control "Cluster-admin binding" kubescape_object_failed_count{framework="MITRE",control="Cluster-admin binding",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="/ServiceAccount"} 1 # Failed object from "MITRE" control "Cluster-admin binding" -kubescape_object_failed_count{framework="MITRE",control="Cluster-admin binding",namespace="armo-system",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1 +kubescape_object_failed_count{framework="MITRE",control="Cluster-admin binding",namespace="kubescape",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "MITRE" control "Cluster-admin binding" -kubescape_object_failed_count{framework="MITRE",control="Cluster-admin binding",namespace="armo-system",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1 +kubescape_object_failed_count{framework="MITRE",control="Cluster-admin binding",namespace="kubescape",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "MITRE" control "Cluster-admin binding" kubescape_object_failed_count{framework="MITRE",control="Cluster-admin binding",namespace="kube-system",name="kube-scheduler",groupVersionKind="/ServiceAccount"} 1 # Failed object from "MITRE" control "Cluster-admin binding" @@ -1641,7 +1641,7 @@ kubescape_object_failed_count{framework="MITRE",control="Cluster internal networ # Failed object from "MITRE" control "Cluster internal networking" kubescape_object_failed_count{framework="MITRE",control="Cluster internal networking",name="nginx-ingress",groupVersionKind="v1/Namespace"} 1 # Failed object from "MITRE" control "Cluster internal networking" -kubescape_object_failed_count{framework="MITRE",control="Cluster internal networking",name="armo-system",groupVersionKind="v1/Namespace"} 1 +kubescape_object_failed_count{framework="MITRE",control="Cluster internal networking",name="kubescape",groupVersionKind="v1/Namespace"} 1 # Failed object from "MITRE" control "Cluster internal networking" kubescape_object_failed_count{framework="MITRE",control="Cluster internal networking",name="cyberarmor-system",groupVersionKind="v1/Namespace"} 1 # Failed object from "MITRE" control "Cluster internal networking" @@ -1661,9 +1661,9 @@ kubescape_object_failed_count{framework="MITRE",control="Exec into container",na # Failed object from "MITRE" control "Exec into container" kubescape_object_failed_count{framework="MITRE",control="Exec into container",name="system:masters",groupVersionKind="rbac.authorization.k8s.io/Group"} 1 # Failed object from "MITRE" control "Exec into container" -kubescape_object_failed_count{framework="MITRE",control="Exec into container",namespace="armo-system",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1 +kubescape_object_failed_count{framework="MITRE",control="Exec into container",namespace="kubescape",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "MITRE" control "Exec into container" -kubescape_object_failed_count{framework="MITRE",control="Exec into container",namespace="armo-system",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1 +kubescape_object_failed_count{framework="MITRE",control="Exec into container",namespace="kubescape",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "MITRE" control "Exec into container" kubescape_object_failed_count{framework="MITRE",control="Exec into container",namespace="kube-system",name="endpointslice-controller",groupVersionKind="/ServiceAccount"} 1 # Failed object from "MITRE" control "Exec into container" @@ -1779,19 +1779,19 @@ kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespa # Failed object from "MITRE" control "hostPath mount" kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="kube-system",name="kube-apiserver-david-virtualbox",groupVersionKind="v1/Pod"} 1 # Failed object from "MITRE" control "hostPath mount" -kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "hostPath mount" kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="cyberarmor-system",name="ca-webhook",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "hostPath mount" kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="cyberarmor-system",name="ca-websocket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "hostPath mount" -kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "MITRE" control "hostPath mount" -kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "MITRE" control "hostPath mount" kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1/Pod"} 1 # Failed object from "MITRE" control "hostPath mount" -kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "hostPath mount" kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="cyberarmor-system",name="ca-ocimage",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "hostPath mount" @@ -1821,9 +1821,9 @@ kubescape_resources_excluded_count{framework="MITRE",control="Kubernetes CronJob # Number of resources failed as part of MITRE control Kubernetes CronJob kubescape_resources_failed_count{framework="MITRE",control="Kubernetes CronJob"} 2 # Failed object from "MITRE" control "Kubernetes CronJob" -kubescape_object_failed_count{framework="MITRE",control="Kubernetes CronJob",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="MITRE",control="Kubernetes CronJob",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "MITRE" control "Kubernetes CronJob" -kubescape_object_failed_count{framework="MITRE",control="Kubernetes CronJob",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="MITRE",control="Kubernetes CronJob",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Number of resources found as part of MITRE control List Kubernetes secrets kubescape_resources_found_count{framework="MITRE",control="List Kubernetes secrets"} 74 # Number of resources excluded as part of MITRE control List Kubernetes secrets @@ -1831,9 +1831,9 @@ kubescape_resources_excluded_count{framework="MITRE",control="List Kubernetes se # Number of resources failed as part of MITRE control List Kubernetes secrets kubescape_resources_failed_count{framework="MITRE",control="List Kubernetes secrets"} 15 # Failed object from "MITRE" control "List Kubernetes secrets" -kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="armo-system",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1 +kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="kubescape",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "MITRE" control "List Kubernetes secrets" -kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="armo-system",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1 +kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="kubescape",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "MITRE" control "List Kubernetes secrets" kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="cyberarmor-system",name="ca-controller-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "MITRE" control "List Kubernetes secrets" @@ -1961,13 +1961,13 @@ kubescape_object_failed_count{framework="MITRE",control="Mount service principal # Failed object from "MITRE" control "Mount service principal" kubescape_object_failed_count{framework="MITRE",control="Mount service principal",namespace="kube-system",name="kube-scheduler-david-virtualbox",groupVersionKind="v1/Pod"} 1 # Failed object from "MITRE" control "Mount service principal" -kubescape_object_failed_count{framework="MITRE",control="Mount service principal",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="MITRE",control="Mount service principal",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "Mount service principal" kubescape_object_failed_count{framework="MITRE",control="Mount service principal",namespace="cyberarmor-system",name="ca-webhook",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "Mount service principal" kubescape_object_failed_count{framework="MITRE",control="Mount service principal",namespace="cyberarmor-system",name="ca-websocket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "Mount service principal" -kubescape_object_failed_count{framework="MITRE",control="Mount service principal",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="MITRE",control="Mount service principal",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "Mount service principal" kubescape_object_failed_count{framework="MITRE",control="Mount service principal",namespace="cyberarmor-system",name="ca-posture",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "Mount service principal" @@ -1991,9 +1991,9 @@ kubescape_object_failed_count{framework="MITRE",control="Mount service principal # Failed object from "MITRE" control "Mount service principal" kubescape_object_failed_count{framework="MITRE",control="Mount service principal",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1 # Failed object from "MITRE" control "Mount service principal" -kubescape_object_failed_count{framework="MITRE",control="Mount service principal",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="MITRE",control="Mount service principal",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "MITRE" control "Mount service principal" -kubescape_object_failed_count{framework="MITRE",control="Mount service principal",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="MITRE",control="Mount service principal",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "MITRE" control "Mount service principal" kubescape_object_failed_count{framework="MITRE",control="Mount service principal",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1/Pod"} 1 # Number of resources found as part of MITRE control Network mapping @@ -2003,7 +2003,7 @@ kubescape_resources_excluded_count{framework="MITRE",control="Network mapping"} # Number of resources failed as part of MITRE control Network mapping kubescape_resources_failed_count{framework="MITRE",control="Network mapping"} 7 # Failed object from "MITRE" control "Network mapping" -kubescape_object_failed_count{framework="MITRE",control="Network mapping",name="armo-system",groupVersionKind="v1/Namespace"} 1 +kubescape_object_failed_count{framework="MITRE",control="Network mapping",name="kubescape",groupVersionKind="v1/Namespace"} 1 # Failed object from "MITRE" control "Network mapping" kubescape_object_failed_count{framework="MITRE",control="Network mapping",name="cyberarmor-system",groupVersionKind="v1/Namespace"} 1 # Failed object from "MITRE" control "Network mapping" @@ -2029,9 +2029,9 @@ kubescape_object_failed_count{framework="MITRE",control="Privileged container",n # Failed object from "MITRE" control "Privileged container" kubescape_object_failed_count{framework="MITRE",control="Privileged container",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "Privileged container" -kubescape_object_failed_count{framework="MITRE",control="Privileged container",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="MITRE",control="Privileged container",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "Privileged container" -kubescape_object_failed_count{framework="MITRE",control="Privileged container",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="MITRE",control="Privileged container",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "Privileged container" kubescape_object_failed_count{framework="MITRE",control="Privileged container",namespace="cyberarmor-system",name="ca-dashboard-aggregator",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "Privileged container" @@ -2063,9 +2063,9 @@ kubescape_object_failed_count{framework="MITRE",control="Privileged container",n # Failed object from "MITRE" control "Privileged container" kubescape_object_failed_count{framework="MITRE",control="Privileged container",namespace="kube-system",name="kube-apiserver-david-virtualbox",groupVersionKind="v1/Pod"} 1 # Failed object from "MITRE" control "Privileged container" -kubescape_object_failed_count{framework="MITRE",control="Privileged container",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="MITRE",control="Privileged container",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "MITRE" control "Privileged container" -kubescape_object_failed_count{framework="MITRE",control="Privileged container",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="MITRE",control="Privileged container",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Number of resources found as part of MITRE control Writable hostPath mount kubescape_resources_found_count{framework="MITRE",control="Writable hostPath mount"} 22 # Number of resources excluded as part of MITRE control Writable hostPath mount @@ -2077,7 +2077,7 @@ kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount # Failed object from "MITRE" control "Writable hostPath mount" kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="cyberarmor-system",name="ca-websocket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "Writable hostPath mount" -kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "Writable hostPath mount" kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1 # Failed object from "MITRE" control "Writable hostPath mount" @@ -2093,7 +2093,7 @@ kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount # Failed object from "MITRE" control "Writable hostPath mount" kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "Writable hostPath mount" -kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "Writable hostPath mount" kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="cyberarmor-system",name="ca-rbac",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "Writable hostPath mount" @@ -2113,9 +2113,9 @@ kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount # Failed object from "MITRE" control "Writable hostPath mount" kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="kube-system",name="coredns",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "Writable hostPath mount" -kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "MITRE" control "Writable hostPath mount" -kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Number of resources found as part of MITRE control Malicious admission controller (mutating) kubescape_resources_found_count{framework="MITRE",control="Malicious admission controller (mutating)"} 1 # Number of resources excluded as part of MITRE control Malicious admission controller (mutating) @@ -2151,9 +2151,9 @@ kubescape_object_failed_count{framework="MITRE",control="Delete Kubernetes event # Failed object from "MITRE" control "Delete Kubernetes events" kubescape_object_failed_count{framework="MITRE",control="Delete Kubernetes events",name="system:masters",groupVersionKind="rbac.authorization.k8s.io/Group"} 1 # Failed object from "MITRE" control "Delete Kubernetes events" -kubescape_object_failed_count{framework="MITRE",control="Delete Kubernetes events",namespace="armo-system",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1 +kubescape_object_failed_count{framework="MITRE",control="Delete Kubernetes events",namespace="kubescape",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "MITRE" control "Delete Kubernetes events" -kubescape_object_failed_count{framework="MITRE",control="Delete Kubernetes events",namespace="armo-system",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1 +kubescape_object_failed_count{framework="MITRE",control="Delete Kubernetes events",namespace="kubescape",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "MITRE" control "Delete Kubernetes events" kubescape_object_failed_count{framework="MITRE",control="Delete Kubernetes events",namespace="kube-system",name="deployment-controller",groupVersionKind="/ServiceAccount"} 1 # Failed object from "MITRE" control "Delete Kubernetes events" @@ -2277,9 +2277,9 @@ kubescape_object_failed_count{framework="MITRE",control="CoreDNS poisoning",name # Failed object from "MITRE" control "CoreDNS poisoning" kubescape_object_failed_count{framework="MITRE",control="CoreDNS poisoning",name="system:anonymous",groupVersionKind="rbac.authorization.k8s.io/User"} 1 # Failed object from "MITRE" control "CoreDNS poisoning" -kubescape_object_failed_count{framework="MITRE",control="CoreDNS poisoning",namespace="armo-system",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1 +kubescape_object_failed_count{framework="MITRE",control="CoreDNS poisoning",namespace="kubescape",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "MITRE" control "CoreDNS poisoning" -kubescape_object_failed_count{framework="MITRE",control="CoreDNS poisoning",namespace="armo-system",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1 +kubescape_object_failed_count{framework="MITRE",control="CoreDNS poisoning",namespace="kubescape",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "MITRE" control "CoreDNS poisoning" kubescape_object_failed_count{framework="MITRE",control="CoreDNS poisoning",namespace="kube-system",name="namespace-controller",groupVersionKind="/ServiceAccount"} 1 # Failed object from "MITRE" control "CoreDNS poisoning" @@ -2415,9 +2415,9 @@ kubescape_object_failed_count{framework="MITRE",control="Data Destruction",names # Failed object from "MITRE" control "Data Destruction" kubescape_object_failed_count{framework="MITRE",control="Data Destruction",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="/ServiceAccount"} 1 # Failed object from "MITRE" control "Data Destruction" -kubescape_object_failed_count{framework="MITRE",control="Data Destruction",namespace="armo-system",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1 +kubescape_object_failed_count{framework="MITRE",control="Data Destruction",namespace="kubescape",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "MITRE" control "Data Destruction" -kubescape_object_failed_count{framework="MITRE",control="Data Destruction",namespace="armo-system",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1 +kubescape_object_failed_count{framework="MITRE",control="Data Destruction",namespace="kubescape",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "MITRE" control "Data Destruction" kubescape_object_failed_count{framework="MITRE",control="Data Destruction",namespace="kube-system",name="pv-protection-controller",groupVersionKind="/ServiceAccount"} 1 # Failed object from "MITRE" control "Data Destruction" @@ -2501,9 +2501,9 @@ kubescape_object_failed_count{framework="MITRE",control="CVE-2021-25742-nginx-in # Failed object from "MITRE" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" kubescape_object_failed_count{framework="MITRE",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="kube-system",name="coredns",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" -kubescape_object_failed_count{framework="MITRE",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="MITRE",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" -kubescape_object_failed_count{framework="MITRE",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="MITRE",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" kubescape_object_failed_count{framework="MITRE",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="cyberarmor-system",name="ca-webhook",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" @@ -2561,13 +2561,13 @@ kubescape_object_failed_count{framework="MITRE",control="CVE-2021-25742-nginx-in # Failed object from "MITRE" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" kubescape_object_failed_count{framework="MITRE",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="nginx-ingress",name="ingress-controller-leader-nginx",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "MITRE" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" -kubescape_object_failed_count{framework="MITRE",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="armo-system",name="armo-scan-scheduler-config",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="MITRE",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="kubescape",name="armo-scan-scheduler-config",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "MITRE" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" -kubescape_object_failed_count{framework="MITRE",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="armo-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="MITRE",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="kubescape",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "MITRE" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" -kubescape_object_failed_count{framework="MITRE",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="armo-system",name="armo-be-config",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="MITRE",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="kubescape",name="armo-be-config",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "MITRE" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" -kubescape_object_failed_count{framework="MITRE",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="armo-system",name="armo-kubescape-config",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="MITRE",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="kubescape",name="armo-kubescape-config",groupVersionKind="v1/ConfigMap"} 1 # Number of resources found as part of ArmoBest control Immutable container filesystem kubescape_resources_found_count{framework="ArmoBest",control="Immutable container filesystem"} 22 # Number of resources excluded as part of ArmoBest control Immutable container filesystem @@ -2585,9 +2585,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Immutable container # Failed object from "ArmoBest" control "Immutable container filesystem" kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1/Pod"} 1 # Failed object from "ArmoBest" control "Immutable container filesystem" -kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Immutable container filesystem" -kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Immutable container filesystem" kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="cyberarmor-system",name="ca-audit",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Immutable container filesystem" @@ -2613,9 +2613,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Immutable container # Failed object from "ArmoBest" control "Immutable container filesystem" kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1 # Failed object from "ArmoBest" control "Immutable container filesystem" -kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "ArmoBest" control "Immutable container filesystem" -kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "ArmoBest" control "Immutable container filesystem" kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="kube-system",name="coredns",groupVersionKind="apps/v1/Deployment"} 1 # Number of resources found as part of ArmoBest control Privileged container @@ -2627,9 +2627,9 @@ kubescape_resources_failed_count{framework="ArmoBest",control="Privileged contai # Failed object from "ArmoBest" control "Privileged container" kubescape_object_failed_count{framework="ArmoBest",control="Privileged container",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1 # Failed object from "ArmoBest" control "Privileged container" -kubescape_object_failed_count{framework="ArmoBest",control="Privileged container",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Privileged container",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Privileged container" -kubescape_object_failed_count{framework="ArmoBest",control="Privileged container",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Privileged container",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Privileged container" kubescape_object_failed_count{framework="ArmoBest",control="Privileged container",namespace="cyberarmor-system",name="ca-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Privileged container" @@ -2665,9 +2665,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Privileged container # Failed object from "ArmoBest" control "Privileged container" kubescape_object_failed_count{framework="ArmoBest",control="Privileged container",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1/Pod"} 1 # Failed object from "ArmoBest" control "Privileged container" -kubescape_object_failed_count{framework="ArmoBest",control="Privileged container",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Privileged container",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "ArmoBest" control "Privileged container" -kubescape_object_failed_count{framework="ArmoBest",control="Privileged container",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Privileged container",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Number of resources found as part of ArmoBest control Allowed hostPath kubescape_resources_found_count{framework="ArmoBest",control="Allowed hostPath"} 22 # Number of resources excluded as part of ArmoBest control Allowed hostPath @@ -2683,7 +2683,7 @@ kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",na # Failed object from "ArmoBest" control "Allowed hostPath" kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",namespace="kube-system",name="etcd-david-virtualbox",groupVersionKind="v1/Pod"} 1 # Failed object from "ArmoBest" control "Allowed hostPath" -kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Allowed hostPath" kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",namespace="cyberarmor-system",name="ca-webhook",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Allowed hostPath" @@ -2693,7 +2693,7 @@ kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",na # Failed object from "ArmoBest" control "Allowed hostPath" kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Allowed hostPath" -kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Allowed hostPath" kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",namespace="cyberarmor-system",name="ca-oracle",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Allowed hostPath" @@ -2711,9 +2711,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",na # Failed object from "ArmoBest" control "Allowed hostPath" kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",namespace="cyberarmor-system",name="ca-ocimage",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Allowed hostPath" -kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "ArmoBest" control "Allowed hostPath" -kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "ArmoBest" control "Allowed hostPath" kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",namespace="kube-system",name="kube-apiserver-david-virtualbox",groupVersionKind="v1/Pod"} 1 # Failed object from "ArmoBest" control "Allowed hostPath" @@ -2729,11 +2729,11 @@ kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of # Failed object from "ArmoBest" control "Automatic mapping of service account" kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="v1/ServiceAccount"} 1 # Failed object from "ArmoBest" control "Automatic mapping of service account" -kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="armo-system",name="armo-kubescape-service-account",groupVersionKind="v1/ServiceAccount"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="kubescape",name="armo-kubescape-service-account",groupVersionKind="v1/ServiceAccount"} 1 # Failed object from "ArmoBest" control "Automatic mapping of service account" -kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="armo-system",name="armo-scanner-service-account",groupVersionKind="v1/ServiceAccount"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="kubescape",name="armo-scanner-service-account",groupVersionKind="v1/ServiceAccount"} 1 # Failed object from "ArmoBest" control "Automatic mapping of service account" -kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="armo-system",name="default",groupVersionKind="v1/ServiceAccount"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="kubescape",name="default",groupVersionKind="v1/ServiceAccount"} 1 # Failed object from "ArmoBest" control "Automatic mapping of service account" kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="cyberarmor-system",name="ca-audit",groupVersionKind="v1/ServiceAccount"} 1 # Failed object from "ArmoBest" control "Automatic mapping of service account" @@ -2837,9 +2837,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="hostNetwork access", # Failed object from "ArmoBest" control "hostNetwork access" kubescape_object_failed_count{framework="ArmoBest",control="hostNetwork access",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1 # Failed object from "ArmoBest" control "hostNetwork access" -kubescape_object_failed_count{framework="ArmoBest",control="hostNetwork access",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="hostNetwork access",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "hostNetwork access" -kubescape_object_failed_count{framework="ArmoBest",control="hostNetwork access",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="hostNetwork access",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "hostNetwork access" kubescape_object_failed_count{framework="ArmoBest",control="hostNetwork access",namespace="cyberarmor-system",name="ca-posture",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "hostNetwork access" @@ -2865,9 +2865,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="hostNetwork access", # Failed object from "ArmoBest" control "hostNetwork access" kubescape_object_failed_count{framework="ArmoBest",control="hostNetwork access",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "hostNetwork access" -kubescape_object_failed_count{framework="ArmoBest",control="hostNetwork access",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="hostNetwork access",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "ArmoBest" control "hostNetwork access" -kubescape_object_failed_count{framework="ArmoBest",control="hostNetwork access",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="hostNetwork access",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Number of resources found as part of ArmoBest control Resource policies kubescape_resources_found_count{framework="ArmoBest",control="Resource policies"} 22 # Number of resources excluded as part of ArmoBest control Resource policies @@ -2889,15 +2889,15 @@ kubescape_object_failed_count{framework="ArmoBest",control="Resource policies",n # Failed object from "ArmoBest" control "Resource policies" kubescape_object_failed_count{framework="ArmoBest",control="Resource policies",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1 # Failed object from "ArmoBest" control "Resource policies" -kubescape_object_failed_count{framework="ArmoBest",control="Resource policies",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Resource policies",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "ArmoBest" control "Resource policies" -kubescape_object_failed_count{framework="ArmoBest",control="Resource policies",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Resource policies",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "ArmoBest" control "Resource policies" kubescape_object_failed_count{framework="ArmoBest",control="Resource policies",namespace="kube-system",name="coredns",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Resource policies" -kubescape_object_failed_count{framework="ArmoBest",control="Resource policies",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Resource policies",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Resource policies" -kubescape_object_failed_count{framework="ArmoBest",control="Resource policies",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Resource policies",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Resource policies" kubescape_object_failed_count{framework="ArmoBest",control="Resource policies",namespace="cyberarmor-system",name="ca-notification-server",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Resource policies" @@ -2935,9 +2935,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege esca # Failed object from "ArmoBest" control "Allow privilege escalation" kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1/Pod"} 1 # Failed object from "ArmoBest" control "Allow privilege escalation" -kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Allow privilege escalation" -kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Allow privilege escalation" kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="cyberarmor-system",name="ca-rbac",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Allow privilege escalation" @@ -2963,9 +2963,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege esca # Failed object from "ArmoBest" control "Allow privilege escalation" kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1 # Failed object from "ArmoBest" control "Allow privilege escalation" -kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "ArmoBest" control "Allow privilege escalation" -kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "ArmoBest" control "Allow privilege escalation" kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="kube-system",name="coredns",groupVersionKind="apps/v1/Deployment"} 1 # Number of resources found as part of ArmoBest control Applications credentials in configuration files @@ -2975,7 +2975,7 @@ kubescape_resources_excluded_count{framework="ArmoBest",control="Applications cr # Number of resources failed as part of ArmoBest control Applications credentials in configuration files kubescape_resources_failed_count{framework="ArmoBest",control="Applications credentials in configuration files"} 8 # Failed object from "ArmoBest" control "Applications credentials in configuration files" -kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="armo-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="kubescape",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "ArmoBest" control "Applications credentials in configuration files" kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="cyberarmor-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "ArmoBest" control "Applications credentials in configuration files" @@ -2991,9 +2991,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Applications credent # Failed object from "ArmoBest" control "Applications credentials in configuration files" kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="kube-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "ArmoBest" control "Applications credentials in configuration files" -kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "ArmoBest" control "Applications credentials in configuration files" -kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "ArmoBest" control "Applications credentials in configuration files" kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="kube-public",name="cluster-info",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "ArmoBest" control "Applications credentials in configuration files" @@ -3007,11 +3007,11 @@ kubescape_object_failed_count{framework="ArmoBest",control="Applications credent # Failed object from "ArmoBest" control "Applications credentials in configuration files" kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="nginx-ingress",name="ingress-controller-leader-nginx",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "ArmoBest" control "Applications credentials in configuration files" -kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="armo-system",name="armo-scan-scheduler-config",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="kubescape",name="armo-scan-scheduler-config",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "ArmoBest" control "Applications credentials in configuration files" -kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="armo-system",name="armo-be-config",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="kubescape",name="armo-be-config",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "ArmoBest" control "Applications credentials in configuration files" -kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="armo-system",name="armo-kubescape-config",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="kubescape",name="armo-kubescape-config",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "ArmoBest" control "Applications credentials in configuration files" kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="cyberarmor-system",name="armo-be-config",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "ArmoBest" control "Applications credentials in configuration files" @@ -3023,9 +3023,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Applications credent # Failed object from "ArmoBest" control "Applications credentials in configuration files" kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="default",name="kubescape",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "ArmoBest" control "Applications credentials in configuration files" -kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Applications credentials in configuration files" -kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Applications credentials in configuration files" kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="cyberarmor-system",name="ca-webhook",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Applications credentials in configuration files" @@ -3077,9 +3077,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Cluster-admin bindin # Failed object from "ArmoBest" control "Cluster-admin binding" kubescape_object_failed_count{framework="ArmoBest",control="Cluster-admin binding",name="system:masters",groupVersionKind="rbac.authorization.k8s.io/Group"} 1 # Failed object from "ArmoBest" control "Cluster-admin binding" -kubescape_object_failed_count{framework="ArmoBest",control="Cluster-admin binding",namespace="armo-system",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Cluster-admin binding",namespace="kubescape",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "ArmoBest" control "Cluster-admin binding" -kubescape_object_failed_count{framework="ArmoBest",control="Cluster-admin binding",namespace="armo-system",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Cluster-admin binding",namespace="kubescape",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "ArmoBest" control "Cluster-admin binding" kubescape_object_failed_count{framework="ArmoBest",control="Cluster-admin binding",namespace="kube-system",name="daemon-set-controller",groupVersionKind="/ServiceAccount"} 1 # Failed object from "ArmoBest" control "Cluster-admin binding" @@ -3275,9 +3275,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Exec into container" # Failed object from "ArmoBest" control "Exec into container" kubescape_object_failed_count{framework="ArmoBest",control="Exec into container",namespace="kube-system",name="service-controller",groupVersionKind="/ServiceAccount"} 1 # Failed object from "ArmoBest" control "Exec into container" -kubescape_object_failed_count{framework="ArmoBest",control="Exec into container",namespace="armo-system",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Exec into container",namespace="kubescape",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "ArmoBest" control "Exec into container" -kubescape_object_failed_count{framework="ArmoBest",control="Exec into container",namespace="armo-system",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Exec into container",namespace="kubescape",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "ArmoBest" control "Exec into container" kubescape_object_failed_count{framework="ArmoBest",control="Exec into container",name="system:bootstrappers:kubeadm:default-node-token",groupVersionKind="rbac.authorization.k8s.io/Group"} 6 # Failed object from "ArmoBest" control "Exec into container" @@ -3307,9 +3307,9 @@ kubescape_resources_failed_count{framework="ArmoBest",control="Insecure capabili # Failed object from "ArmoBest" control "Insecure capabilities" kubescape_object_failed_count{framework="ArmoBest",control="Insecure capabilities",namespace="kube-system",name="coredns",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Insecure capabilities" -kubescape_object_failed_count{framework="ArmoBest",control="Insecure capabilities",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Insecure capabilities",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Insecure capabilities" -kubescape_object_failed_count{framework="ArmoBest",control="Insecure capabilities",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Insecure capabilities",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Insecure capabilities" kubescape_object_failed_count{framework="ArmoBest",control="Insecure capabilities",namespace="cyberarmor-system",name="ca-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Insecure capabilities" @@ -3345,9 +3345,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Insecure capabilitie # Failed object from "ArmoBest" control "Insecure capabilities" kubescape_object_failed_count{framework="ArmoBest",control="Insecure capabilities",namespace="kube-system",name="kube-controller-manager-david-virtualbox",groupVersionKind="v1/Pod"} 1 # Failed object from "ArmoBest" control "Insecure capabilities" -kubescape_object_failed_count{framework="ArmoBest",control="Insecure capabilities",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Insecure capabilities",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "ArmoBest" control "Insecure capabilities" -kubescape_object_failed_count{framework="ArmoBest",control="Insecure capabilities",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Insecure capabilities",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Number of resources found as part of ArmoBest control Linux hardening kubescape_resources_found_count{framework="ArmoBest",control="Linux hardening"} 22 # Number of resources excluded as part of ArmoBest control Linux hardening @@ -3359,9 +3359,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",nam # Failed object from "ArmoBest" control "Linux hardening" kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Linux hardening" -kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Linux hardening" -kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Linux hardening" kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="cyberarmor-system",name="ca-oracle",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Linux hardening" @@ -3385,9 +3385,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",nam # Failed object from "ArmoBest" control "Linux hardening" kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1 # Failed object from "ArmoBest" control "Linux hardening" -kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "ArmoBest" control "Linux hardening" -kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "ArmoBest" control "Linux hardening" kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="kube-system",name="kube-apiserver-david-virtualbox",groupVersionKind="v1/Pod"} 1 # Failed object from "ArmoBest" control "Linux hardening" @@ -3417,9 +3417,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress b # Failed object from "ArmoBest" control "Ingress and Egress blocked" kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Ingress and Egress blocked" -kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Ingress and Egress blocked" -kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Ingress and Egress blocked" kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="cyberarmor-system",name="ca-oracle",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Ingress and Egress blocked" @@ -3445,9 +3445,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress b # Failed object from "ArmoBest" control "Ingress and Egress blocked" kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1 # Failed object from "ArmoBest" control "Ingress and Egress blocked" -kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "ArmoBest" control "Ingress and Egress blocked" -kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Number of resources found as part of ArmoBest control Network policies kubescape_resources_found_count{framework="ArmoBest",control="Network policies"} 7 # Number of resources excluded as part of ArmoBest control Network policies @@ -3455,7 +3455,7 @@ kubescape_resources_excluded_count{framework="ArmoBest",control="Network policie # Number of resources failed as part of ArmoBest control Network policies kubescape_resources_failed_count{framework="ArmoBest",control="Network policies"} 7 # Failed object from "ArmoBest" control "Network policies" -kubescape_object_failed_count{framework="ArmoBest",control="Network policies",name="armo-system",groupVersionKind="v1/Namespace"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Network policies",name="kubescape",groupVersionKind="v1/Namespace"} 1 # Failed object from "ArmoBest" control "Network policies" kubescape_object_failed_count{framework="ArmoBest",control="Network policies",name="cyberarmor-system",groupVersionKind="v1/Namespace"} 1 # Failed object from "ArmoBest" control "Network policies" @@ -3481,13 +3481,13 @@ kubescape_object_failed_count{framework="ArmoBest",control="CVE-2021-25742-nginx # Failed object from "ArmoBest" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" kubescape_object_failed_count{framework="ArmoBest",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="nginx-ingress",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "ArmoBest" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" -kubescape_object_failed_count{framework="ArmoBest",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="armo-system",name="armo-kubescape-config",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="kubescape",name="armo-kubescape-config",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "ArmoBest" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" -kubescape_object_failed_count{framework="ArmoBest",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="armo-system",name="armo-scan-scheduler-config",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="kubescape",name="armo-scan-scheduler-config",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "ArmoBest" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" -kubescape_object_failed_count{framework="ArmoBest",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="armo-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="kubescape",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "ArmoBest" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" -kubescape_object_failed_count{framework="ArmoBest",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="armo-system",name="armo-be-config",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="kubescape",name="armo-be-config",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "ArmoBest" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" kubescape_object_failed_count{framework="ArmoBest",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="cyberarmor-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "ArmoBest" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" @@ -3521,9 +3521,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="CVE-2021-25742-nginx # Failed object from "ArmoBest" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" kubescape_object_failed_count{framework="ArmoBest",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="kube-system",name="kube-proxy",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "ArmoBest" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" -kubescape_object_failed_count{framework="ArmoBest",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" -kubescape_object_failed_count{framework="ArmoBest",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" kubescape_object_failed_count{framework="ArmoBest",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="cyberarmor-system",name="ca-ocimage",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" @@ -3561,9 +3561,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="No impersonation",na # Failed object from "ArmoBest" control "No impersonation" kubescape_object_failed_count{framework="ArmoBest",control="No impersonation",name="system:masters",groupVersionKind="rbac.authorization.k8s.io/Group"} 1 # Failed object from "ArmoBest" control "No impersonation" -kubescape_object_failed_count{framework="ArmoBest",control="No impersonation",namespace="armo-system",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="No impersonation",namespace="kubescape",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "ArmoBest" control "No impersonation" -kubescape_object_failed_count{framework="ArmoBest",control="No impersonation",namespace="armo-system",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="No impersonation",namespace="kubescape",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "ArmoBest" control "No impersonation" kubescape_object_failed_count{framework="ArmoBest",control="No impersonation",namespace="kube-system",name="root-ca-cert-publisher",groupVersionKind="/ServiceAccount"} 1 # Failed object from "ArmoBest" control "No impersonation" @@ -3675,9 +3675,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Portforwarding privi # Failed object from "ArmoBest" control "Portforwarding privileges" kubescape_object_failed_count{framework="ArmoBest",control="Portforwarding privileges",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="/ServiceAccount"} 1 # Failed object from "ArmoBest" control "Portforwarding privileges" -kubescape_object_failed_count{framework="ArmoBest",control="Portforwarding privileges",namespace="armo-system",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Portforwarding privileges",namespace="kubescape",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "ArmoBest" control "Portforwarding privileges" -kubescape_object_failed_count{framework="ArmoBest",control="Portforwarding privileges",namespace="armo-system",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Portforwarding privileges",namespace="kubescape",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "ArmoBest" control "Portforwarding privileges" kubescape_object_failed_count{framework="ArmoBest",control="Portforwarding privileges",namespace="cyberarmor-system",name="ca-controller-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "ArmoBest" control "Portforwarding privileges" @@ -3789,9 +3789,9 @@ kubescape_resources_excluded_count{framework="ArmoBest",control="Image pull poli # Number of resources failed as part of ArmoBest control Image pull policy on latest image tag kubescape_resources_failed_count{framework="ArmoBest",control="Image pull policy on latest image tag"} 2 # Failed object from "ArmoBest" control "Image pull policy on latest image tag" -kubescape_object_failed_count{framework="ArmoBest",control="Image pull policy on latest image tag",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Image pull policy on latest image tag",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "ArmoBest" control "Image pull policy on latest image tag" -kubescape_object_failed_count{framework="ArmoBest",control="Image pull policy on latest image tag",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Image pull policy on latest image tag",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "ArmoBest" control "Image pull policy on latest image tag" kubescape_object_failed_count{framework="ArmoBest",control="Image pull policy on latest image tag",namespace="cyberarmor-system",name="ca-posture",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Image pull policy on latest image tag" @@ -3817,9 +3817,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Image pull policy on # Failed object from "ArmoBest" control "Image pull policy on latest image tag" kubescape_object_failed_count{framework="ArmoBest",control="Image pull policy on latest image tag",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Image pull policy on latest image tag" -kubescape_object_failed_count{framework="ArmoBest",control="Image pull policy on latest image tag",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Image pull policy on latest image tag",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Image pull policy on latest image tag" -kubescape_object_failed_count{framework="ArmoBest",control="Image pull policy on latest image tag",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Image pull policy on latest image tag",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Image pull policy on latest image tag" kubescape_object_failed_count{framework="ArmoBest",control="Image pull policy on latest image tag",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1 # Failed object from "ArmoBest" control "Image pull policy on latest image tag" @@ -3845,7 +3845,7 @@ kubescape_object_failed_count{framework="ArmoBest",control="Namespace without se # Failed object from "ArmoBest" control "Namespace without service accounts" kubescape_object_failed_count{framework="ArmoBest",control="Namespace without service accounts",name="kube-node-lease",groupVersionKind="v1/Namespace"} 1 # Failed object from "ArmoBest" control "Namespace without service accounts" -kubescape_object_failed_count{framework="ArmoBest",control="Namespace without service accounts",name="armo-system",groupVersionKind="v1/Namespace"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Namespace without service accounts",name="kubescape",groupVersionKind="v1/Namespace"} 1 # Failed object from "ArmoBest" control "Namespace without service accounts" kubescape_object_failed_count{framework="ArmoBest",control="Namespace without service accounts",name="cyberarmor-system",groupVersionKind="v1/Namespace"} 1 # Failed object from "ArmoBest" control "Namespace without service accounts" @@ -3941,11 +3941,11 @@ kubescape_object_failed_count{framework="ArmoBest",control="Namespace without se # Failed object from "ArmoBest" control "Namespace without service accounts" kubescape_object_failed_count{framework="ArmoBest",control="Namespace without service accounts",namespace="nginx-ingress",name="default",groupVersionKind="v1/ServiceAccount"} 1 # Failed object from "ArmoBest" control "Namespace without service accounts" -kubescape_object_failed_count{framework="ArmoBest",control="Namespace without service accounts",namespace="armo-system",name="armo-kubescape-service-account",groupVersionKind="v1/ServiceAccount"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Namespace without service accounts",namespace="kubescape",name="armo-kubescape-service-account",groupVersionKind="v1/ServiceAccount"} 1 # Failed object from "ArmoBest" control "Namespace without service accounts" -kubescape_object_failed_count{framework="ArmoBest",control="Namespace without service accounts",namespace="armo-system",name="armo-scanner-service-account",groupVersionKind="v1/ServiceAccount"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Namespace without service accounts",namespace="kubescape",name="armo-scanner-service-account",groupVersionKind="v1/ServiceAccount"} 1 # Failed object from "ArmoBest" control "Namespace without service accounts" -kubescape_object_failed_count{framework="ArmoBest",control="Namespace without service accounts",namespace="armo-system",name="default",groupVersionKind="v1/ServiceAccount"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Namespace without service accounts",namespace="kubescape",name="default",groupVersionKind="v1/ServiceAccount"} 1 # Number of resources found as part of cve-scanning control CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability kubescape_resources_found_count{framework="cve-scanning",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability"} 36 # Number of resources excluded as part of cve-scanning control CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability @@ -3975,13 +3975,13 @@ kubescape_object_failed_count{framework="cve-scanning",control="CVE-2021-25742-n # Failed object from "cve-scanning" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" kubescape_object_failed_count{framework="cve-scanning",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="nginx-ingress",name="ingress-controller-leader-nginx",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "cve-scanning" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" -kubescape_object_failed_count{framework="cve-scanning",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="armo-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="cve-scanning",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="kubescape",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "cve-scanning" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" -kubescape_object_failed_count{framework="cve-scanning",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="armo-system",name="armo-be-config",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="cve-scanning",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="kubescape",name="armo-be-config",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "cve-scanning" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" -kubescape_object_failed_count{framework="cve-scanning",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="armo-system",name="armo-kubescape-config",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="cve-scanning",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="kubescape",name="armo-kubescape-config",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "cve-scanning" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" -kubescape_object_failed_count{framework="cve-scanning",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="armo-system",name="armo-scan-scheduler-config",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="cve-scanning",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="kubescape",name="armo-scan-scheduler-config",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "cve-scanning" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" kubescape_object_failed_count{framework="cve-scanning",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="cyberarmor-system",name="ca-audit",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "cve-scanning" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" @@ -3999,9 +3999,9 @@ kubescape_object_failed_count{framework="cve-scanning",control="CVE-2021-25742-n # Failed object from "cve-scanning" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" kubescape_object_failed_count{framework="cve-scanning",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="kube-node-lease",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "cve-scanning" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" -kubescape_object_failed_count{framework="cve-scanning",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="cve-scanning",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "cve-scanning" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" -kubescape_object_failed_count{framework="cve-scanning",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="cve-scanning",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "cve-scanning" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" kubescape_object_failed_count{framework="cve-scanning",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="cyberarmor-system",name="ca-audit",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "cve-scanning" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability" diff --git a/examples/output_mocks/prometheus.txt b/examples/output_mocks/prometheus.txt index 51a594bb..51822bf8 100644 --- a/examples/output_mocks/prometheus.txt +++ b/examples/output_mocks/prometheus.txt @@ -17,9 +17,9 @@ kubescape_object_failed_count{framework="NSA",control="Immutable container files # Failed object from "NSA" control "Immutable container filesystem" kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Immutable container filesystem" -kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Immutable container filesystem" -kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Immutable container filesystem" kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="cyberarmor-system",name="ca-dashboard-aggregator",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Immutable container filesystem" @@ -43,9 +43,9 @@ kubescape_object_failed_count{framework="NSA",control="Immutable container files # Failed object from "NSA" control "Immutable container filesystem" kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1 # Failed object from "NSA" control "Immutable container filesystem" -kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "NSA" control "Immutable container filesystem" -kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Number of resources found as part of NSA control Privileged container kubescape_resources_found_count{framework="NSA",control="Privileged container"} 22 # Number of resources excluded as part of NSA control Privileged container @@ -67,7 +67,7 @@ kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespa # Failed object from "NSA" control "Allowed hostPath" kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1/Pod"} 1 # Failed object from "NSA" control "Allowed hostPath" -kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Allowed hostPath" kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespace="cyberarmor-system",name="ca-websocket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Allowed hostPath" @@ -157,11 +157,11 @@ kubescape_object_failed_count{framework="NSA",control="Automatic mapping of serv # Failed object from "NSA" control "Automatic mapping of service account" kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="v1/ServiceAccount"} 1 # Failed object from "NSA" control "Automatic mapping of service account" -kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="armo-system",name="armo-kubescape-service-account",groupVersionKind="v1/ServiceAccount"} 1 +kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kubescape",name="armo-kubescape-service-account",groupVersionKind="v1/ServiceAccount"} 1 # Failed object from "NSA" control "Automatic mapping of service account" -kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="armo-system",name="armo-scanner-service-account",groupVersionKind="v1/ServiceAccount"} 1 +kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kubescape",name="armo-scanner-service-account",groupVersionKind="v1/ServiceAccount"} 1 # Failed object from "NSA" control "Automatic mapping of service account" -kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="armo-system",name="default",groupVersionKind="v1/ServiceAccount"} 1 +kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kubescape",name="default",groupVersionKind="v1/ServiceAccount"} 1 # Failed object from "NSA" control "Automatic mapping of service account" kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="cyberarmor-system",name="ca-controller-service-account",groupVersionKind="v1/ServiceAccount"} 1 # Failed object from "NSA" control "Automatic mapping of service account" @@ -199,9 +199,9 @@ kubescape_resources_excluded_count{framework="NSA",control="Resource policies"} # Number of resources failed as part of NSA control Resource policies kubescape_resources_failed_count{framework="NSA",control="Resource policies"} 9 # Failed object from "NSA" control "Resource policies" -kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "NSA" control "Resource policies" -kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "NSA" control "Resource policies" kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="kube-system",name="kube-apiserver-david-virtualbox",groupVersionKind="v1/Pod"} 1 # Failed object from "NSA" control "Resource policies" @@ -233,9 +233,9 @@ kubescape_object_failed_count{framework="NSA",control="Allow privilege escalatio # Failed object from "NSA" control "Allow privilege escalation" kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kube-system",name="etcd-david-virtualbox",groupVersionKind="v1/Pod"} 1 # Failed object from "NSA" control "Allow privilege escalation" -kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Allow privilege escalation" -kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Allow privilege escalation" kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="cyberarmor-system",name="ca-audit",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Allow privilege escalation" @@ -261,9 +261,9 @@ kubescape_object_failed_count{framework="NSA",control="Allow privilege escalatio # Failed object from "NSA" control "Allow privilege escalation" kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1 # Failed object from "NSA" control "Allow privilege escalation" -kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "NSA" control "Allow privilege escalation" -kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Number of resources found as part of NSA control Applications credentials in configuration files kubescape_resources_found_count{framework="NSA",control="Applications credentials in configuration files"} 44 # Number of resources excluded as part of NSA control Applications credentials in configuration files @@ -271,7 +271,7 @@ kubescape_resources_excluded_count{framework="NSA",control="Applications credent # Number of resources failed as part of NSA control Applications credentials in configuration files kubescape_resources_failed_count{framework="NSA",control="Applications credentials in configuration files"} 8 # Failed object from "NSA" control "Applications credentials in configuration files" -kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="armo-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="kubescape",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "NSA" control "Applications credentials in configuration files" kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="cyberarmor-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "NSA" control "Applications credentials in configuration files" @@ -331,9 +331,9 @@ kubescape_resources_failed_count{framework="NSA",control="Linux hardening"} 17 # Failed object from "NSA" control "Linux hardening" kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1/Pod"} 1 # Failed object from "NSA" control "Linux hardening" -kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Linux hardening" -kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Linux hardening" kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="cyberarmor-system",name="ca-posture",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Linux hardening" @@ -359,9 +359,9 @@ kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespac # Failed object from "NSA" control "Linux hardening" kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1 # Failed object from "NSA" control "Linux hardening" -kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "NSA" control "Linux hardening" -kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Number of resources found as part of NSA control Ingress and Egress blocked kubescape_resources_found_count{framework="NSA",control="Ingress and Egress blocked"} 22 # Number of resources excluded as part of NSA control Ingress and Egress blocked @@ -379,9 +379,9 @@ kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocke # Failed object from "NSA" control "Ingress and Egress blocked" kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1/Pod"} 1 # Failed object from "NSA" control "Ingress and Egress blocked" -kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Ingress and Egress blocked" -kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Ingress and Egress blocked" kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="cyberarmor-system",name="ca-rbac",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "NSA" control "Ingress and Egress blocked" @@ -409,9 +409,9 @@ kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocke # Failed object from "NSA" control "Ingress and Egress blocked" kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1 # Failed object from "NSA" control "Ingress and Egress blocked" -kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "NSA" control "Ingress and Egress blocked" -kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Number of resources found as part of NSA control Network policies kubescape_resources_found_count{framework="NSA",control="Network policies"} 7 # Number of resources excluded as part of NSA control Network policies @@ -429,7 +429,7 @@ kubescape_object_failed_count{framework="NSA",control="Network policies",name="k # Failed object from "NSA" control "Network policies" kubescape_object_failed_count{framework="NSA",control="Network policies",name="nginx-ingress",groupVersionKind="v1/Namespace"} 1 # Failed object from "NSA" control "Network policies" -kubescape_object_failed_count{framework="NSA",control="Network policies",name="armo-system",groupVersionKind="v1/Namespace"} 1 +kubescape_object_failed_count{framework="NSA",control="Network policies",name="kubescape",groupVersionKind="v1/Namespace"} 1 # Failed object from "NSA" control "Network policies" kubescape_object_failed_count{framework="NSA",control="Network policies",name="cyberarmor-system",groupVersionKind="v1/Namespace"} 1 # Number of resources found as part of NSA control CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability @@ -449,7 +449,7 @@ kubescape_resources_failed_count{framework="MITRE",control="Access container ser # Failed object from "MITRE" control "Access container service account" kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1 # Failed object from "MITRE" control "Access container service account" -kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "MITRE" control "Access container service account" kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="kube-system",name="system:persistent-volume-provisioner",groupVersionKind="rbac.authorization.k8s.io/v1/RoleBinding"} 1 # Failed object from "MITRE" control "Access container service account" @@ -505,9 +505,9 @@ kubescape_object_failed_count{framework="MITRE",control="Access container servic # Failed object from "MITRE" control "Access container service account" kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "Access container service account" -kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "Access container service account" -kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Number of resources found as part of MITRE control Applications credentials in configuration files kubescape_resources_found_count{framework="MITRE",control="Applications credentials in configuration files"} 44 # Number of resources excluded as part of MITRE control Applications credentials in configuration files @@ -521,7 +521,7 @@ kubescape_object_failed_count{framework="MITRE",control="Applications credential # Failed object from "MITRE" control "Applications credentials in configuration files" kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="kube-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "MITRE" control "Applications credentials in configuration files" -kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="armo-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="kubescape",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "MITRE" control "Applications credentials in configuration files" kubescape_object_failed_count{framework="MITRE",control="Applications credentials in configuration files",namespace="cyberarmor-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "MITRE" control "Applications credentials in configuration files" @@ -551,7 +551,7 @@ kubescape_resources_excluded_count{framework="MITRE",control="Cluster internal n # Number of resources failed as part of MITRE control Cluster internal networking kubescape_resources_failed_count{framework="MITRE",control="Cluster internal networking"} 7 # Failed object from "MITRE" control "Cluster internal networking" -kubescape_object_failed_count{framework="MITRE",control="Cluster internal networking",name="armo-system",groupVersionKind="v1/Namespace"} 1 +kubescape_object_failed_count{framework="MITRE",control="Cluster internal networking",name="kubescape",groupVersionKind="v1/Namespace"} 1 # Failed object from "MITRE" control "Cluster internal networking" kubescape_object_failed_count{framework="MITRE",control="Cluster internal networking",name="cyberarmor-system",groupVersionKind="v1/Namespace"} 1 # Failed object from "MITRE" control "Cluster internal networking" @@ -593,7 +593,7 @@ kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespa # Failed object from "MITRE" control "hostPath mount" kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="kube-system",name="kube-scheduler-david-virtualbox",groupVersionKind="v1/Pod"} 1 # Failed object from "MITRE" control "hostPath mount" -kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "hostPath mount" kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="cyberarmor-system",name="ca-webhook",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "hostPath mount" @@ -605,9 +605,9 @@ kubescape_resources_excluded_count{framework="MITRE",control="Kubernetes CronJob # Number of resources failed as part of MITRE control Kubernetes CronJob kubescape_resources_failed_count{framework="MITRE",control="Kubernetes CronJob"} 2 # Failed object from "MITRE" control "Kubernetes CronJob" -kubescape_object_failed_count{framework="MITRE",control="Kubernetes CronJob",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="MITRE",control="Kubernetes CronJob",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "MITRE" control "Kubernetes CronJob" -kubescape_object_failed_count{framework="MITRE",control="Kubernetes CronJob",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="MITRE",control="Kubernetes CronJob",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Number of resources found as part of MITRE control List Kubernetes secrets kubescape_resources_found_count{framework="MITRE",control="List Kubernetes secrets"} 74 # Number of resources excluded as part of MITRE control List Kubernetes secrets @@ -617,9 +617,9 @@ kubescape_resources_failed_count{framework="MITRE",control="List Kubernetes secr # Failed object from "MITRE" control "List Kubernetes secrets" kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="/ServiceAccount"} 1 # Failed object from "MITRE" control "List Kubernetes secrets" -kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="armo-system",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1 +kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="kubescape",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "MITRE" control "List Kubernetes secrets" -kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="armo-system",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1 +kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="kubescape",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "MITRE" control "List Kubernetes secrets" kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="cyberarmor-system",name="ca-controller-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "MITRE" control "List Kubernetes secrets" @@ -661,7 +661,7 @@ kubescape_object_failed_count{framework="MITRE",control="Mount service principal # Failed object from "MITRE" control "Mount service principal" kubescape_object_failed_count{framework="MITRE",control="Mount service principal",namespace="cyberarmor-system",name="ca-websocket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "Mount service principal" -kubescape_object_failed_count{framework="MITRE",control="Mount service principal",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="MITRE",control="Mount service principal",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Number of resources found as part of MITRE control Network mapping kubescape_resources_found_count{framework="MITRE",control="Network mapping"} 7 # Number of resources excluded as part of MITRE control Network mapping @@ -669,7 +669,7 @@ kubescape_resources_excluded_count{framework="MITRE",control="Network mapping"} # Number of resources failed as part of MITRE control Network mapping kubescape_resources_failed_count{framework="MITRE",control="Network mapping"} 7 # Failed object from "MITRE" control "Network mapping" -kubescape_object_failed_count{framework="MITRE",control="Network mapping",name="armo-system",groupVersionKind="v1/Namespace"} 1 +kubescape_object_failed_count{framework="MITRE",control="Network mapping",name="kubescape",groupVersionKind="v1/Namespace"} 1 # Failed object from "MITRE" control "Network mapping" kubescape_object_failed_count{framework="MITRE",control="Network mapping",name="cyberarmor-system",groupVersionKind="v1/Namespace"} 1 # Failed object from "MITRE" control "Network mapping" @@ -705,7 +705,7 @@ kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount # Failed object from "MITRE" control "Writable hostPath mount" kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="kube-system",name="kube-controller-manager-david-virtualbox",groupVersionKind="v1/Pod"} 1 # Failed object from "MITRE" control "Writable hostPath mount" -kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "Writable hostPath mount" kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="cyberarmor-system",name="ca-webhook",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "MITRE" control "Writable hostPath mount" @@ -855,15 +855,15 @@ kubescape_object_failed_count{framework="ArmoBest",control="Immutable container # Failed object from "ArmoBest" control "Immutable container filesystem" kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Immutable container filesystem" -kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Immutable container filesystem" -kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Immutable container filesystem" kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1 # Failed object from "ArmoBest" control "Immutable container filesystem" -kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "ArmoBest" control "Immutable container filesystem" -kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Immutable container filesystem",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Number of resources found as part of ArmoBest control Privileged container kubescape_resources_found_count{framework="ArmoBest",control="Privileged container"} 22 # Number of resources excluded as part of ArmoBest control Privileged container @@ -887,7 +887,7 @@ kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",na # Failed object from "ArmoBest" control "Allowed hostPath" kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1/Pod"} 1 # Failed object from "ArmoBest" control "Allowed hostPath" -kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Allowed hostPath" kubescape_object_failed_count{framework="ArmoBest",control="Allowed hostPath",namespace="cyberarmor-system",name="ca-webhook",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Allowed hostPath" @@ -979,11 +979,11 @@ kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of # Failed object from "ArmoBest" control "Automatic mapping of service account" kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="v1/ServiceAccount"} 1 # Failed object from "ArmoBest" control "Automatic mapping of service account" -kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="armo-system",name="armo-kubescape-service-account",groupVersionKind="v1/ServiceAccount"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="kubescape",name="armo-kubescape-service-account",groupVersionKind="v1/ServiceAccount"} 1 # Failed object from "ArmoBest" control "Automatic mapping of service account" -kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="armo-system",name="armo-scanner-service-account",groupVersionKind="v1/ServiceAccount"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="kubescape",name="armo-scanner-service-account",groupVersionKind="v1/ServiceAccount"} 1 # Failed object from "ArmoBest" control "Automatic mapping of service account" -kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="armo-system",name="default",groupVersionKind="v1/ServiceAccount"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="kubescape",name="default",groupVersionKind="v1/ServiceAccount"} 1 # Failed object from "ArmoBest" control "Automatic mapping of service account" kubescape_object_failed_count{framework="ArmoBest",control="Automatic mapping of service account",namespace="cyberarmor-system",name="default",groupVersionKind="v1/ServiceAccount"} 1 # Failed object from "ArmoBest" control "Automatic mapping of service account" @@ -1019,9 +1019,9 @@ kubescape_resources_failed_count{framework="ArmoBest",control="Resource policies # Failed object from "ArmoBest" control "Resource policies" kubescape_object_failed_count{framework="ArmoBest",control="Resource policies",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1 # Failed object from "ArmoBest" control "Resource policies" -kubescape_object_failed_count{framework="ArmoBest",control="Resource policies",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Resource policies",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "ArmoBest" control "Resource policies" -kubescape_object_failed_count{framework="ArmoBest",control="Resource policies",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Resource policies",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "ArmoBest" control "Resource policies" kubescape_object_failed_count{framework="ArmoBest",control="Resource policies",namespace="kube-system",name="etcd-david-virtualbox",groupVersionKind="v1/Pod"} 1 # Failed object from "ArmoBest" control "Resource policies" @@ -1051,9 +1051,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege esca # Failed object from "ArmoBest" control "Allow privilege escalation" kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1/Pod"} 1 # Failed object from "ArmoBest" control "Allow privilege escalation" -kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Allow privilege escalation" -kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Allow privilege escalation" kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="cyberarmor-system",name="ca-webhook",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Allow privilege escalation" @@ -1079,9 +1079,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege esca # Failed object from "ArmoBest" control "Allow privilege escalation" kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1 # Failed object from "ArmoBest" control "Allow privilege escalation" -kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "ArmoBest" control "Allow privilege escalation" -kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Allow privilege escalation",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Number of resources found as part of ArmoBest control Applications credentials in configuration files kubescape_resources_found_count{framework="ArmoBest",control="Applications credentials in configuration files"} 44 # Number of resources excluded as part of ArmoBest control Applications credentials in configuration files @@ -1089,7 +1089,7 @@ kubescape_resources_excluded_count{framework="ArmoBest",control="Applications cr # Number of resources failed as part of ArmoBest control Applications credentials in configuration files kubescape_resources_failed_count{framework="ArmoBest",control="Applications credentials in configuration files"} 8 # Failed object from "ArmoBest" control "Applications credentials in configuration files" -kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="armo-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="kubescape",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "ArmoBest" control "Applications credentials in configuration files" kubescape_object_failed_count{framework="ArmoBest",control="Applications credentials in configuration files",namespace="cyberarmor-system",name="kube-root-ca.crt",groupVersionKind="v1/ConfigMap"} 1 # Failed object from "ArmoBest" control "Applications credentials in configuration files" @@ -1149,9 +1149,9 @@ kubescape_resources_failed_count{framework="ArmoBest",control="Linux hardening"} # Failed object from "ArmoBest" control "Linux hardening" kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1/Pod"} 1 # Failed object from "ArmoBest" control "Linux hardening" -kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Linux hardening" -kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Linux hardening" kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="cyberarmor-system",name="ca-audit",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Linux hardening" @@ -1177,9 +1177,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",nam # Failed object from "ArmoBest" control "Linux hardening" kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1 # Failed object from "ArmoBest" control "Linux hardening" -kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "ArmoBest" control "Linux hardening" -kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Linux hardening",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Number of resources found as part of ArmoBest control Ingress and Egress blocked kubescape_resources_found_count{framework="ArmoBest",control="Ingress and Egress blocked"} 22 # Number of resources excluded as part of ArmoBest control Ingress and Egress blocked @@ -1187,9 +1187,9 @@ kubescape_resources_excluded_count{framework="ArmoBest",control="Ingress and Egr # Number of resources failed as part of ArmoBest control Ingress and Egress blocked kubescape_resources_failed_count{framework="ArmoBest",control="Ingress and Egress blocked"} 22 # Failed object from "ArmoBest" control "Ingress and Egress blocked" -kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="armo-system",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="kubescape",name="armo-vuln-scan",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Ingress and Egress blocked" -kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="armo-system",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="kubescape",name="armo-web-socket",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Ingress and Egress blocked" kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="cyberarmor-system",name="ca-notification-server",groupVersionKind="apps/v1/Deployment"} 1 # Failed object from "ArmoBest" control "Ingress and Egress blocked" @@ -1217,9 +1217,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress b # Failed object from "ArmoBest" control "Ingress and Egress blocked" kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1/DaemonSet"} 1 # Failed object from "ArmoBest" control "Ingress and Egress blocked" -kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "ArmoBest" control "Ingress and Egress blocked" -kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "ArmoBest" control "Ingress and Egress blocked" kubescape_object_failed_count{framework="ArmoBest",control="Ingress and Egress blocked",namespace="kube-system",name="kube-scheduler-david-virtualbox",groupVersionKind="v1/Pod"} 1 # Failed object from "ArmoBest" control "Ingress and Egress blocked" @@ -1237,7 +1237,7 @@ kubescape_resources_excluded_count{framework="ArmoBest",control="Network policie # Number of resources failed as part of ArmoBest control Network policies kubescape_resources_failed_count{framework="ArmoBest",control="Network policies"} 7 # Failed object from "ArmoBest" control "Network policies" -kubescape_object_failed_count{framework="ArmoBest",control="Network policies",name="armo-system",groupVersionKind="v1/Namespace"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Network policies",name="kubescape",groupVersionKind="v1/Namespace"} 1 # Failed object from "ArmoBest" control "Network policies" kubescape_object_failed_count{framework="ArmoBest",control="Network policies",name="cyberarmor-system",groupVersionKind="v1/Namespace"} 1 # Failed object from "ArmoBest" control "Network policies" @@ -1289,9 +1289,9 @@ kubescape_object_failed_count{framework="ArmoBest",control="Portforwarding privi # Failed object from "ArmoBest" control "Portforwarding privileges" kubescape_object_failed_count{framework="ArmoBest",control="Portforwarding privileges",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="/ServiceAccount"} 1 # Failed object from "ArmoBest" control "Portforwarding privileges" -kubescape_object_failed_count{framework="ArmoBest",control="Portforwarding privileges",namespace="armo-system",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Portforwarding privileges",namespace="kubescape",name="armo-kubescape-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "ArmoBest" control "Portforwarding privileges" -kubescape_object_failed_count{framework="ArmoBest",control="Portforwarding privileges",namespace="armo-system",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Portforwarding privileges",namespace="kubescape",name="armo-scanner-service-account",groupVersionKind="/ServiceAccount"} 1 # Failed object from "ArmoBest" control "Portforwarding privileges" kubescape_object_failed_count{framework="ArmoBest",control="Portforwarding privileges",name="system:masters",groupVersionKind="rbac.authorization.k8s.io/Group"} 1 # Number of resources found as part of ArmoBest control Image pull policy on latest image tag @@ -1301,9 +1301,9 @@ kubescape_resources_excluded_count{framework="ArmoBest",control="Image pull poli # Number of resources failed as part of ArmoBest control Image pull policy on latest image tag kubescape_resources_failed_count{framework="ArmoBest",control="Image pull policy on latest image tag"} 2 # Failed object from "ArmoBest" control "Image pull policy on latest image tag" -kubescape_object_failed_count{framework="ArmoBest",control="Image pull policy on latest image tag",namespace="armo-system",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Image pull policy on latest image tag",namespace="kubescape",name="armo-kubescape",groupVersionKind="batch/v1/CronJob"} 1 # Failed object from "ArmoBest" control "Image pull policy on latest image tag" -kubescape_object_failed_count{framework="ArmoBest",control="Image pull policy on latest image tag",namespace="armo-system",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 +kubescape_object_failed_count{framework="ArmoBest",control="Image pull policy on latest image tag",namespace="kubescape",name="armo-scan-scheduler",groupVersionKind="batch/v1/CronJob"} 1 # Number of resources found as part of ArmoBest control Namespace without service accounts kubescape_resources_found_count{framework="ArmoBest",control="Namespace without service accounts"} 54 # Number of resources excluded as part of ArmoBest control Namespace without service accounts diff --git a/go.mod b/go.mod index 4e6f7736..86df4bf1 100644 --- a/go.mod +++ b/go.mod @@ -1,23 +1,23 @@ -module github.com/armosec/kubescape/v2 +module github.com/kubescape/kubescape/v2 go 1.18 require ( - github.com/armosec/armoapi-go v0.0.98 + github.com/armosec/armoapi-go v0.0.115 github.com/armosec/go-git-url v0.0.15 - github.com/armosec/k8s-interface v0.0.79 - github.com/armosec/opa-utils v0.0.166 - github.com/armosec/rbac-utils v0.0.14 - github.com/armosec/utils-go v0.0.9 - github.com/armosec/utils-k8s-go v0.0.7 + github.com/armosec/utils-go v0.0.12 + github.com/armosec/utils-k8s-go v0.0.12 github.com/briandowns/spinner v1.18.1 - github.com/dwertent/go-logger v0.0.2 github.com/enescakir/emoji v1.0.0 github.com/fatih/color v1.13.0 github.com/francoispqt/gojay v1.2.13 github.com/go-git/go-git/v5 v5.4.2 github.com/google/uuid v1.3.0 github.com/johnfercher/maroto v0.37.0 + github.com/kubescape/go-logger v0.0.5 + github.com/kubescape/k8s-interface v0.0.82 + github.com/kubescape/opa-utils v0.0.172 + github.com/kubescape/rbac-utils v0.0.17 github.com/libgit2/git2go/v33 v33.0.9 github.com/mattn/go-isatty v0.0.14 github.com/olekukonko/tablewriter v0.0.5 @@ -28,9 +28,9 @@ require ( golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3 gopkg.in/yaml.v2 v2.4.0 helm.sh/helm/v3 v3.9.0 - k8s.io/api v0.24.2 - k8s.io/apimachinery v0.24.2 - k8s.io/client-go v0.24.2 + k8s.io/api v0.24.3 + k8s.io/apimachinery v0.24.3 + k8s.io/client-go v0.24.3 k8s.io/utils v0.0.0-20220706174534-f6158b442e7c sigs.k8s.io/yaml v1.3.0 ) @@ -94,7 +94,6 @@ require ( github.com/gobwas/glob v0.2.3 // indirect github.com/gogo/protobuf v1.3.2 // indirect github.com/golang-jwt/jwt/v4 v4.2.0 // indirect - github.com/golang/glog v1.0.0 // indirect github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect github.com/golang/protobuf v1.5.2 // indirect github.com/google/gnostic v0.5.7-v3refs // indirect @@ -140,7 +139,7 @@ require ( go.opencensus.io v0.23.0 // indirect go.uber.org/atomic v1.7.0 // indirect go.uber.org/multierr v1.6.0 // indirect - go.uber.org/zap v1.21.0 // indirect + go.uber.org/zap v1.22.0 // indirect golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e // indirect golang.org/x/net v0.0.0-20220624214902-1bab6f366d9e // indirect golang.org/x/oauth2 v0.0.0-20220630143837-2104d58473e0 // indirect diff --git a/go.sum b/go.sum index 443019e5..23d4d55a 100644 --- a/go.sum +++ b/go.sum @@ -179,20 +179,14 @@ github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmV github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs= -github.com/armosec/armoapi-go v0.0.98 h1:sOBYW1QHmtLrxMz7Fmu+uLRc85YJrUa79fDSGLDjDHg= -github.com/armosec/armoapi-go v0.0.98/go.mod h1:v7rUl9eo5qL3kHxiP8tFCyRYERUGPgm2rwTIqkVOouw= +github.com/armosec/armoapi-go v0.0.115 h1:KpxcACULFwX0BScYSS2u7DLO3D5Rlea3WNUKQpdCfJw= +github.com/armosec/armoapi-go v0.0.115/go.mod h1:2zoNzb3Fy9ZByeczJZ47ftDRLRzTykVdTISS3GTc/JU= github.com/armosec/go-git-url v0.0.15 h1:sDtu0WNvAhrDJ2begTyWP8T4tE1j1K6D0ZJ6t3Cx8k4= github.com/armosec/go-git-url v0.0.15/go.mod h1:GzfssG3IW9KiURSpK7c/bySBRTlghpObQ7NQ1O4hcMI= -github.com/armosec/k8s-interface v0.0.79 h1:K26itoRg1pCnBk+FR5UHF6sJTOvuJ/vP76I/9Yi/6eU= -github.com/armosec/k8s-interface v0.0.79/go.mod h1:JeaT4OTwXp8HhTHPIF3KJuY8H5lDZ+o4FGFy77J49xY= -github.com/armosec/opa-utils v0.0.166 h1:g3gKpLf2YsGuQxSTTHQLb0k4+UHVC3NArv0lEtqpmbg= -github.com/armosec/opa-utils v0.0.166/go.mod h1:dFTUgba55U+P7E91g+UOOzfQ2deiKM5PP18XKlBkcCo= -github.com/armosec/rbac-utils v0.0.14 h1:CKYKcgqJEXWF2Hen/B1pVGtS3nDAG1wp9dDv6oNtq90= -github.com/armosec/rbac-utils v0.0.14/go.mod h1:Ex/IdGWhGv9HZq6Hs8N/ApzCKSIvpNe/ETqDfnuyah0= -github.com/armosec/utils-go v0.0.9 h1:Ri7SjCFHfORN1dBH4NYKYfVEEkt6Af4iFgbRskFeyac= -github.com/armosec/utils-go v0.0.9/go.mod h1:F/K1mI/qcj7fNuJl7xktoCeHM83azOF0Zq6eC2WuPyU= -github.com/armosec/utils-k8s-go v0.0.7 h1:g68GQ9Vm5LgVp/czcu2ZV1igm2azYLf9vNapyoXBfYI= -github.com/armosec/utils-k8s-go v0.0.7/go.mod h1:YFdWi3rEQQLbN6mZO21TSdoda8kGQYRV4rs5CRp8Kjs= +github.com/armosec/utils-go v0.0.12 h1:NXkG/BhbSVAmTVXr0qqsK02CmxEiXuJyPmdTRcZ4jAo= +github.com/armosec/utils-go v0.0.12/go.mod h1:F/K1mI/qcj7fNuJl7xktoCeHM83azOF0Zq6eC2WuPyU= +github.com/armosec/utils-k8s-go v0.0.12 h1:u7kHSUp4PpvPP3hEaRXMbM0Vw23IyLhAzzE+2TW6Jkk= +github.com/armosec/utils-k8s-go v0.0.12/go.mod h1:rPHiOaHefWa9ujspwvYYAp0uEbqGGyAMiNrFa/Gpp/8= github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY= github.com/aws/aws-sdk-go v1.15.11/go.mod h1:mFuSZ37Z9YOHbQEwBWztmVzqXrEkub65tZoCYDt7FT0= github.com/aws/aws-sdk-go v1.43.16/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo= @@ -471,8 +465,6 @@ github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3 github.com/dustin/go-humanize v0.0.0-20171111073723-bb3d318650d4/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk= github.com/dustin/go-humanize v1.0.0 h1:VSnTsYCnlFHaM2/igO1h6X3HA71jcobQuxemgkq4zYo= github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk= -github.com/dwertent/go-logger v0.0.2 h1:ds0llvSj4p9PG7/eK8d7iSHHVq92/GJjRH2QQ2xCMMk= -github.com/dwertent/go-logger v0.0.2/go.mod h1:6q+xZIwVGJNt2XnV98d8Lksf2cUz7qfK7G9wVq3wuVg= github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc= github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs= github.com/emicklei/go-restful v2.9.5+incompatible h1:spTtZBk5DYEvbxMVutUuTyh1Ao2r4iyvLdACqsl/Ljk= @@ -843,6 +835,14 @@ github.com/kr/pty v1.1.5/go.mod h1:9r2w37qlBe7rQ6e1fg1S/9xpWHSnaqNdHD3WcMdbPDA= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= +github.com/kubescape/go-logger v0.0.5 h1:lA25XvI4LT4JqwnNkIDUtwdYS4KVmnbWrVB7SRte2Es= +github.com/kubescape/go-logger v0.0.5/go.mod h1:DnVWEvC90LFY1nNMaNo6nBVOcqkLMK3S0qzXP1fzRvI= +github.com/kubescape/k8s-interface v0.0.82 h1:Gu09lQDG+Mw81OxA9MK1BSaqxV/FBRaMYX9jzVqOzzw= +github.com/kubescape/k8s-interface v0.0.82/go.mod h1:ihX96yqar+xogHl45mFE8zT9DLI06iy7XQPAP+j5KJE= +github.com/kubescape/opa-utils v0.0.172 h1:9BPN9phA9zQxhlYS+Nf4nQ0Y/gRRHfsKjMJnIwTLLLE= +github.com/kubescape/opa-utils v0.0.172/go.mod h1:aU4s1y+BWWxNwYw447TmHmNaKHxOWtYsFhZe5GyvOuE= +github.com/kubescape/rbac-utils v0.0.17 h1:B78kjlTKqjYK/PXwmi4GPysHsFxIwVz1KFb4+IGT29w= +github.com/kubescape/rbac-utils v0.0.17/go.mod h1:pBwjpcrVeuH/no+DiCZWvlhYtCDzd3U0o/hEZKi+eM8= github.com/linuxkit/virtsock v0.0.0-20201010232012-f8cee7dfc7a3/go.mod h1:3r6x7q95whyfWQpmGZTu3gk3v2YkMi05HEzl7Tf7YEo= github.com/lunixbochs/vtclean v1.0.0/go.mod h1:pHhQNgMf3btfWnGBVipUOjRYhoOsdGqdm/+2c2E2WMI= github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ= @@ -1294,7 +1294,6 @@ go.uber.org/atomic v1.7.0 h1:ADUqmZGgLDDfbSL9ZmPxKTybcoEYHgpYfELNoN+7hsw= go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc= go.uber.org/automaxprocs v1.5.1/go.mod h1:BF4eumQw0P9GtnuxxovUd06vwm1o18oMzFtK66vU6XU= go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A= -go.uber.org/goleak v1.1.11/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ= go.uber.org/goleak v1.1.12 h1:gZAh5/EyT/HQwlpkCy6wTpqfH9H8Lz8zbm3dZh+OyzA= go.uber.org/goleak v1.1.12/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ= go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0= @@ -1303,8 +1302,8 @@ go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9i go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q= go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo= go.uber.org/zap v1.19.0/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI= -go.uber.org/zap v1.21.0 h1:WefMeulhovoZ2sYXz7st6K0sLj7bBhpiFaud4r4zST8= -go.uber.org/zap v1.21.0/go.mod h1:wjWOCqI0f2ZZrJF/UufIOkiC8ii6tm1iqIsLo76RfJw= +go.uber.org/zap v1.22.0 h1:Zcye5DUgBloQ9BaT4qc9BnjOFog5TvBSAGkJ3Nf70c0= +go.uber.org/zap v1.22.0/go.mod h1:H4siCOZOrAolnUPJEkfaSjDqyP+BDS0DdDWzwcgt3+U= go4.org v0.0.0-20180809161055-417644f6feb5/go.mod h1:MkTOUMDaeVYJUOUsaDXIhWPZYa1yOyC1qaOBpL57BhE= golang.org/x/build v0.0.0-20190111050920-041ab4dc3f9d/go.mod h1:OWs+y06UdEOHN4y+MfF/py+xQ/tYqIWW03b70/CG9Rw= golang.org/x/crypto v0.0.0-20171113213409-9f005a07e0d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= @@ -2007,8 +2006,9 @@ k8s.io/api v0.20.1/go.mod h1:KqwcCVogGxQY3nBlRpwt+wpAMF/KjaCc7RpywacvqUo= k8s.io/api v0.20.4/go.mod h1:++lNL1AJMkDymriNniQsWRkMDzRaX2Y/POTUi8yvqYQ= k8s.io/api v0.20.6/go.mod h1:X9e8Qag6JV/bL5G6bU8sdVRltWKmdHsFUGS3eVndqE8= k8s.io/api v0.22.5/go.mod h1:mEhXyLaSD1qTOf40rRiKXkc+2iCem09rWLlFwhCEiAs= -k8s.io/api v0.24.2 h1:g518dPU/L7VRLxWfcadQn2OnsiGWVOadTLpdnqgY2OI= k8s.io/api v0.24.2/go.mod h1:AHqbSkTm6YrQ0ObxjO3Pmp/ubFF/KuM7jU+3khoBsOg= +k8s.io/api v0.24.3 h1:tt55QEmKd6L2k5DP6G/ZzdMQKvG5ro4H4teClqm0sTY= +k8s.io/api v0.24.3/go.mod h1:elGR/XSZrS7z7cSZPzVWaycpJuGIw57j9b95/1PdJNI= k8s.io/apiextensions-apiserver v0.24.2 h1:/4NEQHKlEz1MlaK/wHT5KMKC9UKYz6NZz6JE6ov4G6k= k8s.io/apiextensions-apiserver v0.24.2/go.mod h1:e5t2GMFVngUEHUd0wuCJzw8YDwZoqZfJiGOW6mm2hLQ= k8s.io/apimachinery v0.20.1/go.mod h1:WlLqWAHZGg07AeltaI0MV5uk1Omp8xaN0JGLY6gkRpU= @@ -2016,8 +2016,9 @@ k8s.io/apimachinery v0.20.4/go.mod h1:WlLqWAHZGg07AeltaI0MV5uk1Omp8xaN0JGLY6gkRp k8s.io/apimachinery v0.20.6/go.mod h1:ejZXtW1Ra6V1O5H8xPBGz+T3+4gfkTCeExAHKU57MAc= k8s.io/apimachinery v0.22.1/go.mod h1:O3oNtNadZdeOMxHFVxOreoznohCpy0z6mocxbZr7oJ0= k8s.io/apimachinery v0.22.5/go.mod h1:xziclGKwuuJ2RM5/rSFQSYAj0zdbci3DH8kj+WvyN0U= -k8s.io/apimachinery v0.24.2 h1:5QlH9SL2C8KMcrNJPor+LbXVTaZRReml7svPEh4OKDM= k8s.io/apimachinery v0.24.2/go.mod h1:82Bi4sCzVBdpYjyI4jY6aHX+YCUchUIrZrXKedjd2UM= +k8s.io/apimachinery v0.24.3 h1:hrFiNSA2cBZqllakVYyH/VyEh4B581bQRmqATJSeQTg= +k8s.io/apimachinery v0.24.3/go.mod h1:82Bi4sCzVBdpYjyI4jY6aHX+YCUchUIrZrXKedjd2UM= k8s.io/apiserver v0.20.1/go.mod h1:ro5QHeQkgMS7ZGpvf4tSMx6bBOgPfE+f52KwvXfScaU= k8s.io/apiserver v0.20.4/go.mod h1:Mc80thBKOyy7tbvFtB4kJv1kbdD0eIH8k8vianJcbFM= k8s.io/apiserver v0.20.6/go.mod h1:QIJXNt6i6JB+0YQRNcS0hdRHJlMhflFmsBDeSgT1r8Q= @@ -2027,8 +2028,9 @@ k8s.io/client-go v0.20.1/go.mod h1:/zcHdt1TeWSd5HoUe6elJmHSQ6uLLgp4bIJHVEuy+/Y= k8s.io/client-go v0.20.4/go.mod h1:LiMv25ND1gLUdBeYxBIwKpkSC5IsozMMmOOeSJboP+k= k8s.io/client-go v0.20.6/go.mod h1:nNQMnOvEUEsOzRRFIIkdmYOjAZrC8bgq0ExboWSU1I0= k8s.io/client-go v0.22.5/go.mod h1:cs6yf/61q2T1SdQL5Rdcjg9J1ElXSwbjSrW2vFImM4Y= -k8s.io/client-go v0.24.2 h1:CoXFSf8if+bLEbinDqN9ePIDGzcLtqhfd6jpfnwGOFA= k8s.io/client-go v0.24.2/go.mod h1:zg4Xaoo+umDsfCWr4fCnmLEtQXyCNXCvJuSsglNcV30= +k8s.io/client-go v0.24.3 h1:Nl1840+6p4JqkFWEW2LnMKU667BUxw03REfLAVhuKQY= +k8s.io/client-go v0.24.3/go.mod h1:AAovolf5Z9bY1wIg2FZ8LPQlEdKHjLI7ZD4rw920BJw= k8s.io/code-generator v0.19.7/go.mod h1:lwEq3YnLYb/7uVXLorOJfxg+cUu2oihFhHZ0n9NIla0= k8s.io/code-generator v0.24.2/go.mod h1:dpVhs00hTuTdTY6jvVxvTFCk6gSMrtfRydbhZwHI15w= k8s.io/component-base v0.20.1/go.mod h1:guxkoJnNoh8LNrbtiQOlyp2Y2XFCZQmrcg2n/DeYNLk= diff --git a/httphandler/README.md b/httphandler/README.md index 28201936..b40a9ec7 100644 --- a/httphandler/README.md +++ b/httphandler/README.md @@ -149,7 +149,7 @@ curl --header "Content-Type: application/json" --request POST --data '{"hostScan ```bash curl --header "Content-Type: application/json" \ --request POST \ - --data '{"hostScanner":true, "submit":true, "includeNamespaces": ["ks-scanner"], "targetType": "framework", "targetNames": ["nsa"] }' \ + --data '{"hostScanner":true, "submit":true, "includeNamespaces": ["kubescape"], "targetType": "framework", "targetNames": ["nsa"] }' \ http://127.0.0.1:8080/v1/scan ``` diff --git a/httphandler/build.py b/httphandler/build.py index 44c74815..317993a0 100644 --- a/httphandler/build.py +++ b/httphandler/build.py @@ -4,7 +4,7 @@ import hashlib import platform import subprocess -BASE_GETTER_CONST = "github.com/armosec/kubescape/v2/core/cautils/getter" +BASE_GETTER_CONST = "github.com/kubescape/kubescape/v2/core/cautils/getter" def checkStatus(status, msg): if status != 0: @@ -36,7 +36,7 @@ def main(): # Set some variables packageName = getPackageName() - buildUrl = "github.com/armosec/kubescape/v2/core/cautils.BuildNumber" + buildUrl = "github.com/kubescape/kubescape/v2/core/cautils.BuildNumber" releaseVersion = os.getenv("RELEASE") # Create build directory diff --git a/httphandler/docs/server.go b/httphandler/docs/server.go index 76882f8f..729c8ae8 100644 --- a/httphandler/docs/server.go +++ b/httphandler/docs/server.go @@ -6,8 +6,8 @@ import ( _ "embed" - logger "github.com/dwertent/go-logger" "github.com/go-openapi/runtime/middleware" + logger "github.com/kubescape/go-logger" ) const ( diff --git a/httphandler/docs/swagger.yaml b/httphandler/docs/swagger.yaml index 08200f30..1d83789a 100644 --- a/httphandler/docs/swagger.yaml +++ b/httphandler/docs/swagger.yaml @@ -20,7 +20,7 @@ definitions: Same as `kubescape scan --excluded-namespaces`. example: - - armo-system + - kubescape - kube-system items: type: string @@ -116,7 +116,7 @@ definitions: type: boolean x-go-name: UseCachedArtifacts type: object - x-go-package: github.com/armosec/opa-utils/httpserver/meta/v1 + x-go-package: github.com/kubescape/opa-utils/httpserver/meta/v1 Response: description: A Scan Response object properties: @@ -158,7 +158,7 @@ definitions: ready ReadyScanResponseType ReadyScanResponseType indicates that a server has successfully completed a request x-go-name: Type type: object - x-go-package: github.com/armosec/opa-utils/httpserver/meta/v1 + x-go-package: github.com/kubescape/opa-utils/httpserver/meta/v1 info: description: 'The Kubescape Microservice API allows clients to interact with a Kubescape instance running in a Kubernetes cluster: trigger scans, retrieve and delete their diff --git a/httphandler/examples/microservice/ks-deployment.yaml b/httphandler/examples/microservice/ks-deployment.yaml index 6382e47e..83356e05 100644 --- a/httphandler/examples/microservice/ks-deployment.yaml +++ b/httphandler/examples/microservice/ks-deployment.yaml @@ -4,7 +4,7 @@ kind: Namespace metadata: labels: app: kubescape - name: ks-scanner + name: kubescape --- # ------------------- Kubescape Service Account ------------------- # apiVersion: v1 @@ -13,7 +13,7 @@ metadata: labels: app: kubescape name: kubescape-discovery - namespace: ks-scanner + namespace: kubescape --- # ------------------- Kubescape Cluster Role & Cluster Role Binding ------------------- # kind: ClusterRole @@ -38,13 +38,13 @@ roleRef: subjects: - kind: ServiceAccount name: kubescape-discovery - namespace: ks-scanner + namespace: kubescape --- apiVersion: v1 kind: Service metadata: name: kubescape - namespace: ks-scanner + namespace: kubescape labels: app: kubescape spec: @@ -61,7 +61,7 @@ apiVersion: apps/v1 kind: Deployment metadata: name: kubescape - namespace: ks-scanner + namespace: kubescape labels: app: kubescape spec: @@ -89,7 +89,7 @@ spec: port: 8080 initialDelaySeconds: 3 periodSeconds: 3 - image: quay.io/armosec/kubescape:latest + image: quay.io/kubescape/kubescape:latest imagePullPolicy: Always env: - name: KS_DEFAULT_CONFIGMAP_NAMESPACE diff --git a/httphandler/examples/prometheus/README.md b/httphandler/examples/prometheus/README.md index d97da1ee..6d785c20 100644 --- a/httphandler/examples/prometheus/README.md +++ b/httphandler/examples/prometheus/README.md @@ -23,7 +23,7 @@ All kubescape related metrics begin with `kubescape` -> `riskScore` is the output of an algorithm calculating the risk of the vulinrability. `0` indicates there is no risk and `100` indicates highest risk. +> `riskScore` is the output of an algorithm calculating the risk of the vulnerability. `0` indicates there is no risk and `100` indicates highest risk. #### Cluster scope metrics diff --git a/httphandler/examples/prometheus/ks-deployment.yaml b/httphandler/examples/prometheus/ks-deployment.yaml index 7755af14..53d2c077 100644 --- a/httphandler/examples/prometheus/ks-deployment.yaml +++ b/httphandler/examples/prometheus/ks-deployment.yaml @@ -4,7 +4,7 @@ kind: Namespace metadata: labels: app: kubescape - name: ks-scanner + name: kubescape --- # ------------------- Kubescape Service Account ------------------- # apiVersion: v1 @@ -13,7 +13,7 @@ metadata: labels: app: kubescape name: kubescape-discovery - namespace: ks-scanner + namespace: kubescape --- # ------------------- Kubescape Cluster Role & Cluster Role Binding ------------------- # kind: ClusterRole @@ -38,13 +38,13 @@ roleRef: subjects: - kind: ServiceAccount name: kubescape-discovery - namespace: ks-scanner + namespace: kubescape --- apiVersion: v1 kind: Service metadata: name: kubescape - namespace: ks-scanner + namespace: kubescape labels: app: kubescape spec: @@ -61,7 +61,7 @@ apiVersion: apps/v1 kind: Deployment metadata: name: kubescape - namespace: ks-scanner + namespace: kubescape labels: app: kubescape spec: @@ -89,7 +89,7 @@ spec: port: 8080 initialDelaySeconds: 3 periodSeconds: 3 - image: quay.io/armosec/kubescape:latest + image: quay.io/kubescape/kubescape:latest imagePullPolicy: Always env: - name: KS_DEFAULT_CONFIGMAP_NAMESPACE diff --git a/httphandler/examples/prometheus/podmonitor.yaml b/httphandler/examples/prometheus/podmonitor.yaml index 5810dccb..2741f933 100644 --- a/httphandler/examples/prometheus/podmonitor.yaml +++ b/httphandler/examples/prometheus/podmonitor.yaml @@ -2,7 +2,7 @@ apiVersion: monitoring.coreos.com/v1 kind: PodMonitor metadata: name: kubescape - namespace: ks-scanner + namespace: kubescape labels: app: kubescape spec: diff --git a/httphandler/go.mod b/httphandler/go.mod index 37c87abc..c5a53a3a 100644 --- a/httphandler/go.mod +++ b/httphandler/go.mod @@ -1,18 +1,18 @@ -module github.com/armosec/kubescape/v2/httphandler +module github.com/kubescape/kubescape/v2/httphandler go 1.18 -replace github.com/armosec/kubescape/v2 => ../ +replace github.com/kubescape/kubescape/v2 => ../ require ( - github.com/armosec/kubescape/v2 v2.0.0-00010101000000-000000000000 - github.com/armosec/opa-utils v0.0.166 - github.com/armosec/utils-go v0.0.9 - github.com/dwertent/go-logger v0.0.2 + github.com/kubescape/kubescape/v2 v2.0.0-00010101000000-000000000000 + github.com/armosec/utils-go v0.0.12 github.com/go-openapi/runtime v0.24.1 github.com/google/uuid v1.3.0 github.com/gorilla/mux v1.8.0 github.com/gorilla/schema v1.2.0 + github.com/kubescape/go-logger v0.0.5 + github.com/kubescape/opa-utils v0.0.172 github.com/stretchr/testify v1.8.0 k8s.io/utils v0.0.0-20220706174534-f6158b442e7c ) @@ -42,11 +42,9 @@ require ( github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect github.com/acomagu/bufpipe v1.0.3 // indirect github.com/agnivade/levenshtein v1.0.1 // indirect - github.com/armosec/armoapi-go v0.0.98 // indirect + github.com/armosec/armoapi-go v0.0.115 // indirect github.com/armosec/go-git-url v0.0.15 // indirect - github.com/armosec/k8s-interface v0.0.79 // indirect - github.com/armosec/rbac-utils v0.0.14 // indirect - github.com/armosec/utils-k8s-go v0.0.7 // indirect + github.com/armosec/utils-k8s-go v0.0.12 // indirect github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect github.com/aws/aws-sdk-go v1.44.51 // indirect github.com/aws/aws-sdk-go-v2 v1.16.7 // indirect @@ -94,7 +92,6 @@ require ( github.com/gobwas/glob v0.2.3 // indirect github.com/gogo/protobuf v1.3.2 // indirect github.com/golang-jwt/jwt/v4 v4.2.0 // indirect - github.com/golang/glog v1.0.0 // indirect github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect github.com/golang/protobuf v1.5.2 // indirect github.com/google/gnostic v0.5.7-v3refs // indirect @@ -110,7 +107,9 @@ require ( github.com/josharian/intern v1.0.0 // indirect github.com/json-iterator/go v1.1.12 // indirect github.com/jung-kurt/gofpdf v1.16.2 // indirect - github.com/kevinburke/ssh_config v1.2.0 // indirect + github.com/kevinburke/ssh_config v0.0.0-20201106050909-4977a11b4351 // indirect + github.com/kubescape/k8s-interface v0.0.82 // indirect + github.com/kubescape/rbac-utils v0.0.17 // indirect github.com/libgit2/git2go/v33 v33.0.9 // indirect github.com/mailru/easyjson v0.7.7 // indirect github.com/mattn/go-colorable v0.1.12 // indirect @@ -148,7 +147,7 @@ require ( go.opencensus.io v0.23.0 // indirect go.uber.org/atomic v1.7.0 // indirect go.uber.org/multierr v1.6.0 // indirect - go.uber.org/zap v1.21.0 // indirect + go.uber.org/zap v1.22.0 // indirect golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e // indirect golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3 // indirect golang.org/x/net v0.0.0-20220624214902-1bab6f366d9e // indirect @@ -169,10 +168,10 @@ require ( gopkg.in/yaml.v2 v2.4.0 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect helm.sh/helm/v3 v3.9.0 // indirect - k8s.io/api v0.24.2 // indirect + k8s.io/api v0.24.3 // indirect k8s.io/apiextensions-apiserver v0.24.2 // indirect - k8s.io/apimachinery v0.24.2 // indirect - k8s.io/client-go v0.24.2 // indirect + k8s.io/apimachinery v0.24.3 // indirect + k8s.io/client-go v0.24.3 // indirect k8s.io/klog/v2 v2.60.1 // indirect k8s.io/kube-openapi v0.0.0-20220328201542-3ee0da9b0b42 // indirect sigs.k8s.io/controller-runtime v0.12.3 // indirect diff --git a/httphandler/go.sum b/httphandler/go.sum index 323eca1f..b5f3ded6 100644 --- a/httphandler/go.sum +++ b/httphandler/go.sum @@ -179,20 +179,14 @@ github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmV github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs= -github.com/armosec/armoapi-go v0.0.98 h1:sOBYW1QHmtLrxMz7Fmu+uLRc85YJrUa79fDSGLDjDHg= -github.com/armosec/armoapi-go v0.0.98/go.mod h1:v7rUl9eo5qL3kHxiP8tFCyRYERUGPgm2rwTIqkVOouw= +github.com/armosec/armoapi-go v0.0.115 h1:KpxcACULFwX0BScYSS2u7DLO3D5Rlea3WNUKQpdCfJw= +github.com/armosec/armoapi-go v0.0.115/go.mod h1:2zoNzb3Fy9ZByeczJZ47ftDRLRzTykVdTISS3GTc/JU= github.com/armosec/go-git-url v0.0.15 h1:sDtu0WNvAhrDJ2begTyWP8T4tE1j1K6D0ZJ6t3Cx8k4= github.com/armosec/go-git-url v0.0.15/go.mod h1:GzfssG3IW9KiURSpK7c/bySBRTlghpObQ7NQ1O4hcMI= -github.com/armosec/k8s-interface v0.0.79 h1:K26itoRg1pCnBk+FR5UHF6sJTOvuJ/vP76I/9Yi/6eU= -github.com/armosec/k8s-interface v0.0.79/go.mod h1:JeaT4OTwXp8HhTHPIF3KJuY8H5lDZ+o4FGFy77J49xY= -github.com/armosec/opa-utils v0.0.166 h1:g3gKpLf2YsGuQxSTTHQLb0k4+UHVC3NArv0lEtqpmbg= -github.com/armosec/opa-utils v0.0.166/go.mod h1:dFTUgba55U+P7E91g+UOOzfQ2deiKM5PP18XKlBkcCo= -github.com/armosec/rbac-utils v0.0.14 h1:CKYKcgqJEXWF2Hen/B1pVGtS3nDAG1wp9dDv6oNtq90= -github.com/armosec/rbac-utils v0.0.14/go.mod h1:Ex/IdGWhGv9HZq6Hs8N/ApzCKSIvpNe/ETqDfnuyah0= -github.com/armosec/utils-go v0.0.9 h1:Ri7SjCFHfORN1dBH4NYKYfVEEkt6Af4iFgbRskFeyac= -github.com/armosec/utils-go v0.0.9/go.mod h1:F/K1mI/qcj7fNuJl7xktoCeHM83azOF0Zq6eC2WuPyU= -github.com/armosec/utils-k8s-go v0.0.7 h1:g68GQ9Vm5LgVp/czcu2ZV1igm2azYLf9vNapyoXBfYI= -github.com/armosec/utils-k8s-go v0.0.7/go.mod h1:YFdWi3rEQQLbN6mZO21TSdoda8kGQYRV4rs5CRp8Kjs= +github.com/armosec/utils-go v0.0.12 h1:NXkG/BhbSVAmTVXr0qqsK02CmxEiXuJyPmdTRcZ4jAo= +github.com/armosec/utils-go v0.0.12/go.mod h1:F/K1mI/qcj7fNuJl7xktoCeHM83azOF0Zq6eC2WuPyU= +github.com/armosec/utils-k8s-go v0.0.12 h1:u7kHSUp4PpvPP3hEaRXMbM0Vw23IyLhAzzE+2TW6Jkk= +github.com/armosec/utils-k8s-go v0.0.12/go.mod h1:rPHiOaHefWa9ujspwvYYAp0uEbqGGyAMiNrFa/Gpp/8= github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY= github.com/asaskevich/govalidator v0.0.0-20200907205600-7a23bdc65eef/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw= github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d h1:Byv0BzEl3/e6D5CLfI0j/7hiIEtvGVFPCZ7Ei2oq8iQ= @@ -474,8 +468,6 @@ github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3 github.com/dustin/go-humanize v0.0.0-20171111073723-bb3d318650d4/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk= github.com/dustin/go-humanize v1.0.0 h1:VSnTsYCnlFHaM2/igO1h6X3HA71jcobQuxemgkq4zYo= github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk= -github.com/dwertent/go-logger v0.0.2 h1:ds0llvSj4p9PG7/eK8d7iSHHVq92/GJjRH2QQ2xCMMk= -github.com/dwertent/go-logger v0.0.2/go.mod h1:6q+xZIwVGJNt2XnV98d8Lksf2cUz7qfK7G9wVq3wuVg= github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc= github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs= github.com/emicklei/go-restful v2.9.5+incompatible h1:spTtZBk5DYEvbxMVutUuTyh1Ao2r4iyvLdACqsl/Ljk= @@ -873,9 +865,8 @@ github.com/jung-kurt/gofpdf v1.16.2 h1:jgbatWHfRlPYiK85qgevsZTHviWXKwB1TTiKdz5Pt github.com/jung-kurt/gofpdf v1.16.2/go.mod h1:1hl7y57EsiPAkLbOwzpzqgx1A30nQCk/YmFV8S2vmK0= github.com/karrick/godirwalk v1.8.0/go.mod h1:H5KPZjojv4lE+QYImBI8xVtrBRgYrIVsaRPx4tDPEn4= github.com/karrick/godirwalk v1.10.3/go.mod h1:RoGL9dQei4vP9ilrpETWE8CLOZ1kiN0LhBygSwrAsHA= +github.com/kevinburke/ssh_config v0.0.0-20201106050909-4977a11b4351 h1:DowS9hvgyYSX4TO5NpyC606/Z4SxnNYbT+WX27or6Ck= github.com/kevinburke/ssh_config v0.0.0-20201106050909-4977a11b4351/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM= -github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4= -github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM= github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q= github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= @@ -900,6 +891,14 @@ github.com/kr/pty v1.1.5/go.mod h1:9r2w37qlBe7rQ6e1fg1S/9xpWHSnaqNdHD3WcMdbPDA= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= +github.com/kubescape/go-logger v0.0.5 h1:lA25XvI4LT4JqwnNkIDUtwdYS4KVmnbWrVB7SRte2Es= +github.com/kubescape/go-logger v0.0.5/go.mod h1:DnVWEvC90LFY1nNMaNo6nBVOcqkLMK3S0qzXP1fzRvI= +github.com/kubescape/k8s-interface v0.0.82 h1:Gu09lQDG+Mw81OxA9MK1BSaqxV/FBRaMYX9jzVqOzzw= +github.com/kubescape/k8s-interface v0.0.82/go.mod h1:ihX96yqar+xogHl45mFE8zT9DLI06iy7XQPAP+j5KJE= +github.com/kubescape/opa-utils v0.0.172 h1:9BPN9phA9zQxhlYS+Nf4nQ0Y/gRRHfsKjMJnIwTLLLE= +github.com/kubescape/opa-utils v0.0.172/go.mod h1:aU4s1y+BWWxNwYw447TmHmNaKHxOWtYsFhZe5GyvOuE= +github.com/kubescape/rbac-utils v0.0.17 h1:B78kjlTKqjYK/PXwmi4GPysHsFxIwVz1KFb4+IGT29w= +github.com/kubescape/rbac-utils v0.0.17/go.mod h1:pBwjpcrVeuH/no+DiCZWvlhYtCDzd3U0o/hEZKi+eM8= github.com/linuxkit/virtsock v0.0.0-20201010232012-f8cee7dfc7a3/go.mod h1:3r6x7q95whyfWQpmGZTu3gk3v2YkMi05HEzl7Tf7YEo= github.com/lunixbochs/vtclean v1.0.0/go.mod h1:pHhQNgMf3btfWnGBVipUOjRYhoOsdGqdm/+2c2E2WMI= github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ= @@ -1373,7 +1372,6 @@ go.uber.org/atomic v1.7.0 h1:ADUqmZGgLDDfbSL9ZmPxKTybcoEYHgpYfELNoN+7hsw= go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc= go.uber.org/automaxprocs v1.5.1/go.mod h1:BF4eumQw0P9GtnuxxovUd06vwm1o18oMzFtK66vU6XU= go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A= -go.uber.org/goleak v1.1.11/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ= go.uber.org/goleak v1.1.12 h1:gZAh5/EyT/HQwlpkCy6wTpqfH9H8Lz8zbm3dZh+OyzA= go.uber.org/goleak v1.1.12/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ= go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0= @@ -1382,8 +1380,8 @@ go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9i go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q= go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo= go.uber.org/zap v1.19.0/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI= -go.uber.org/zap v1.21.0 h1:WefMeulhovoZ2sYXz7st6K0sLj7bBhpiFaud4r4zST8= -go.uber.org/zap v1.21.0/go.mod h1:wjWOCqI0f2ZZrJF/UufIOkiC8ii6tm1iqIsLo76RfJw= +go.uber.org/zap v1.22.0 h1:Zcye5DUgBloQ9BaT4qc9BnjOFog5TvBSAGkJ3Nf70c0= +go.uber.org/zap v1.22.0/go.mod h1:H4siCOZOrAolnUPJEkfaSjDqyP+BDS0DdDWzwcgt3+U= go4.org v0.0.0-20180809161055-417644f6feb5/go.mod h1:MkTOUMDaeVYJUOUsaDXIhWPZYa1yOyC1qaOBpL57BhE= golang.org/x/build v0.0.0-20190111050920-041ab4dc3f9d/go.mod h1:OWs+y06UdEOHN4y+MfF/py+xQ/tYqIWW03b70/CG9Rw= golang.org/x/crypto v0.0.0-20171113213409-9f005a07e0d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= @@ -2100,8 +2098,9 @@ k8s.io/api v0.20.1/go.mod h1:KqwcCVogGxQY3nBlRpwt+wpAMF/KjaCc7RpywacvqUo= k8s.io/api v0.20.4/go.mod h1:++lNL1AJMkDymriNniQsWRkMDzRaX2Y/POTUi8yvqYQ= k8s.io/api v0.20.6/go.mod h1:X9e8Qag6JV/bL5G6bU8sdVRltWKmdHsFUGS3eVndqE8= k8s.io/api v0.22.5/go.mod h1:mEhXyLaSD1qTOf40rRiKXkc+2iCem09rWLlFwhCEiAs= -k8s.io/api v0.24.2 h1:g518dPU/L7VRLxWfcadQn2OnsiGWVOadTLpdnqgY2OI= k8s.io/api v0.24.2/go.mod h1:AHqbSkTm6YrQ0ObxjO3Pmp/ubFF/KuM7jU+3khoBsOg= +k8s.io/api v0.24.3 h1:tt55QEmKd6L2k5DP6G/ZzdMQKvG5ro4H4teClqm0sTY= +k8s.io/api v0.24.3/go.mod h1:elGR/XSZrS7z7cSZPzVWaycpJuGIw57j9b95/1PdJNI= k8s.io/apiextensions-apiserver v0.24.2 h1:/4NEQHKlEz1MlaK/wHT5KMKC9UKYz6NZz6JE6ov4G6k= k8s.io/apiextensions-apiserver v0.24.2/go.mod h1:e5t2GMFVngUEHUd0wuCJzw8YDwZoqZfJiGOW6mm2hLQ= k8s.io/apimachinery v0.20.1/go.mod h1:WlLqWAHZGg07AeltaI0MV5uk1Omp8xaN0JGLY6gkRpU= @@ -2109,8 +2108,9 @@ k8s.io/apimachinery v0.20.4/go.mod h1:WlLqWAHZGg07AeltaI0MV5uk1Omp8xaN0JGLY6gkRp k8s.io/apimachinery v0.20.6/go.mod h1:ejZXtW1Ra6V1O5H8xPBGz+T3+4gfkTCeExAHKU57MAc= k8s.io/apimachinery v0.22.1/go.mod h1:O3oNtNadZdeOMxHFVxOreoznohCpy0z6mocxbZr7oJ0= k8s.io/apimachinery v0.22.5/go.mod h1:xziclGKwuuJ2RM5/rSFQSYAj0zdbci3DH8kj+WvyN0U= -k8s.io/apimachinery v0.24.2 h1:5QlH9SL2C8KMcrNJPor+LbXVTaZRReml7svPEh4OKDM= k8s.io/apimachinery v0.24.2/go.mod h1:82Bi4sCzVBdpYjyI4jY6aHX+YCUchUIrZrXKedjd2UM= +k8s.io/apimachinery v0.24.3 h1:hrFiNSA2cBZqllakVYyH/VyEh4B581bQRmqATJSeQTg= +k8s.io/apimachinery v0.24.3/go.mod h1:82Bi4sCzVBdpYjyI4jY6aHX+YCUchUIrZrXKedjd2UM= k8s.io/apiserver v0.20.1/go.mod h1:ro5QHeQkgMS7ZGpvf4tSMx6bBOgPfE+f52KwvXfScaU= k8s.io/apiserver v0.20.4/go.mod h1:Mc80thBKOyy7tbvFtB4kJv1kbdD0eIH8k8vianJcbFM= k8s.io/apiserver v0.20.6/go.mod h1:QIJXNt6i6JB+0YQRNcS0hdRHJlMhflFmsBDeSgT1r8Q= @@ -2120,8 +2120,9 @@ k8s.io/client-go v0.20.1/go.mod h1:/zcHdt1TeWSd5HoUe6elJmHSQ6uLLgp4bIJHVEuy+/Y= k8s.io/client-go v0.20.4/go.mod h1:LiMv25ND1gLUdBeYxBIwKpkSC5IsozMMmOOeSJboP+k= k8s.io/client-go v0.20.6/go.mod h1:nNQMnOvEUEsOzRRFIIkdmYOjAZrC8bgq0ExboWSU1I0= k8s.io/client-go v0.22.5/go.mod h1:cs6yf/61q2T1SdQL5Rdcjg9J1ElXSwbjSrW2vFImM4Y= -k8s.io/client-go v0.24.2 h1:CoXFSf8if+bLEbinDqN9ePIDGzcLtqhfd6jpfnwGOFA= k8s.io/client-go v0.24.2/go.mod h1:zg4Xaoo+umDsfCWr4fCnmLEtQXyCNXCvJuSsglNcV30= +k8s.io/client-go v0.24.3 h1:Nl1840+6p4JqkFWEW2LnMKU667BUxw03REfLAVhuKQY= +k8s.io/client-go v0.24.3/go.mod h1:AAovolf5Z9bY1wIg2FZ8LPQlEdKHjLI7ZD4rw920BJw= k8s.io/code-generator v0.19.7/go.mod h1:lwEq3YnLYb/7uVXLorOJfxg+cUu2oihFhHZ0n9NIla0= k8s.io/code-generator v0.24.2/go.mod h1:dpVhs00hTuTdTY6jvVxvTFCk6gSMrtfRydbhZwHI15w= k8s.io/component-base v0.20.1/go.mod h1:guxkoJnNoh8LNrbtiQOlyp2Y2XFCZQmrcg2n/DeYNLk= diff --git a/httphandler/handlerequests/v1/datastructuremethods.go b/httphandler/handlerequests/v1/datastructuremethods.go index 8eab9af3..83c01132 100644 --- a/httphandler/handlerequests/v1/datastructuremethods.go +++ b/httphandler/handlerequests/v1/datastructuremethods.go @@ -3,12 +3,12 @@ package v1 import ( "strings" - apisv1 "github.com/armosec/opa-utils/httpserver/apis/v1" - utilsmetav1 "github.com/armosec/opa-utils/httpserver/meta/v1" + apisv1 "github.com/kubescape/opa-utils/httpserver/apis/v1" + utilsmetav1 "github.com/kubescape/opa-utils/httpserver/meta/v1" "k8s.io/utils/strings/slices" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/cautils/getter" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/cautils/getter" ) func ToScanInfo(scanRequest *utilsmetav1.PostScanRequest) *cautils.ScanInfo { diff --git a/httphandler/handlerequests/v1/datastructuremethods_test.go b/httphandler/handlerequests/v1/datastructuremethods_test.go index 10af3905..05386650 100644 --- a/httphandler/handlerequests/v1/datastructuremethods_test.go +++ b/httphandler/handlerequests/v1/datastructuremethods_test.go @@ -3,9 +3,9 @@ package v1 import ( "testing" - "github.com/armosec/kubescape/v2/core/cautils" - apisv1 "github.com/armosec/opa-utils/httpserver/apis/v1" - utilsmetav1 "github.com/armosec/opa-utils/httpserver/meta/v1" + "github.com/kubescape/kubescape/v2/core/cautils" + apisv1 "github.com/kubescape/opa-utils/httpserver/apis/v1" + utilsmetav1 "github.com/kubescape/opa-utils/httpserver/meta/v1" "github.com/stretchr/testify/assert" ) diff --git a/httphandler/handlerequests/v1/prometheus.go b/httphandler/handlerequests/v1/prometheus.go index ddf171f4..80edd1f9 100644 --- a/httphandler/handlerequests/v1/prometheus.go +++ b/httphandler/handlerequests/v1/prometheus.go @@ -6,10 +6,10 @@ import ( "os" "path/filepath" - "github.com/armosec/kubescape/v2/core/cautils" - utilsapisv1 "github.com/armosec/opa-utils/httpserver/apis/v1" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/kubescape/v2/core/cautils" + utilsapisv1 "github.com/kubescape/opa-utils/httpserver/apis/v1" "github.com/google/uuid" ) diff --git a/httphandler/handlerequests/v1/prometheus_test.go b/httphandler/handlerequests/v1/prometheus_test.go index e7378cd1..a39aa81e 100644 --- a/httphandler/handlerequests/v1/prometheus_test.go +++ b/httphandler/handlerequests/v1/prometheus_test.go @@ -4,7 +4,7 @@ import ( "path/filepath" "testing" - "github.com/armosec/kubescape/v2/core/cautils/getter" + "github.com/kubescape/kubescape/v2/core/cautils/getter" "github.com/stretchr/testify/assert" ) diff --git a/httphandler/handlerequests/v1/requestparser.go b/httphandler/handlerequests/v1/requestparser.go index c896af09..78737b8d 100644 --- a/httphandler/handlerequests/v1/requestparser.go +++ b/httphandler/handlerequests/v1/requestparser.go @@ -7,10 +7,10 @@ import ( "net/http" "sync" - "github.com/armosec/kubescape/v2/core/cautils" - utilsmetav1 "github.com/armosec/opa-utils/httpserver/meta/v1" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/kubescape/v2/core/cautils" + utilsmetav1 "github.com/kubescape/opa-utils/httpserver/meta/v1" "github.com/gorilla/schema" ) @@ -65,7 +65,6 @@ type ScanQueryParams struct { KeepResults bool `schema:"keep" json:"keep"` } - // swagger:parameters getScanResults type GetResultsQueryParams struct { // ID of the requested scan. If empty or not provided, defaults to the latest scan. @@ -79,7 +78,6 @@ type GetResultsQueryParams struct { // in: query // default: false KeepResults bool `schema:"keep" json:"keep"` - } // swagger:parameters deleteScanResults diff --git a/httphandler/handlerequests/v1/requestparser_test.go b/httphandler/handlerequests/v1/requestparser_test.go index bae44f1e..d448dc42 100644 --- a/httphandler/handlerequests/v1/requestparser_test.go +++ b/httphandler/handlerequests/v1/requestparser_test.go @@ -7,8 +7,8 @@ import ( "net/url" "testing" - utilsmetav1 "github.com/armosec/opa-utils/httpserver/meta/v1" "github.com/armosec/utils-go/boolutils" + utilsmetav1 "github.com/kubescape/opa-utils/httpserver/meta/v1" "github.com/stretchr/testify/assert" ) diff --git a/httphandler/handlerequests/v1/requestshandler.go b/httphandler/handlerequests/v1/requestshandler.go index 49b2d7ee..bcc9feda 100644 --- a/httphandler/handlerequests/v1/requestshandler.go +++ b/httphandler/handlerequests/v1/requestshandler.go @@ -5,13 +5,13 @@ import ( "net/http" _ "net/http/pprof" - utilsapisv1 "github.com/armosec/opa-utils/httpserver/apis/v1" - utilsmetav1 "github.com/armosec/opa-utils/httpserver/meta/v1" - "github.com/dwertent/go-logger/helpers" + "github.com/kubescape/go-logger/helpers" + utilsapisv1 "github.com/kubescape/opa-utils/httpserver/apis/v1" + utilsmetav1 "github.com/kubescape/opa-utils/httpserver/meta/v1" "github.com/gorilla/schema" - logger "github.com/dwertent/go-logger" + logger "github.com/kubescape/go-logger" "github.com/google/uuid" ) diff --git a/httphandler/handlerequests/v1/requestshandlerutil_test.go b/httphandler/handlerequests/v1/requestshandlerutil_test.go index 0a70ea05..7212ef42 100644 --- a/httphandler/handlerequests/v1/requestshandlerutil_test.go +++ b/httphandler/handlerequests/v1/requestshandlerutil_test.go @@ -3,8 +3,8 @@ package v1 import ( "testing" - apisv1 "github.com/armosec/opa-utils/httpserver/apis/v1" - utilsmetav1 "github.com/armosec/opa-utils/httpserver/meta/v1" + apisv1 "github.com/kubescape/opa-utils/httpserver/apis/v1" + utilsmetav1 "github.com/kubescape/opa-utils/httpserver/meta/v1" "github.com/stretchr/testify/assert" ) diff --git a/httphandler/handlerequests/v1/requestshandlerutils.go b/httphandler/handlerequests/v1/requestshandlerutils.go index d7f75915..c823825d 100644 --- a/httphandler/handlerequests/v1/requestshandlerutils.go +++ b/httphandler/handlerequests/v1/requestshandlerutils.go @@ -7,15 +7,15 @@ import ( "path/filepath" "strings" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/cautils/getter" - "github.com/armosec/kubescape/v2/core/core" - utilsapisv1 "github.com/armosec/opa-utils/httpserver/apis/v1" - utilsmetav1 "github.com/armosec/opa-utils/httpserver/meta/v1" - reporthandlingv2 "github.com/armosec/opa-utils/reporthandling/v2" "github.com/armosec/utils-go/boolutils" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/core/cautils/getter" + "github.com/kubescape/kubescape/v2/core/core" + utilsapisv1 "github.com/kubescape/opa-utils/httpserver/apis/v1" + utilsmetav1 "github.com/kubescape/opa-utils/httpserver/meta/v1" + reporthandlingv2 "github.com/kubescape/opa-utils/reporthandling/v2" ) // executeScan execute the scan request passed in the channel diff --git a/httphandler/httphandler b/httphandler/httphandler new file mode 100755 index 00000000..e907f510 Binary files /dev/null and b/httphandler/httphandler differ diff --git a/httphandler/listener/helpers.go b/httphandler/listener/helpers.go index 00e59ff0..b0fdea21 100644 --- a/httphandler/listener/helpers.go +++ b/httphandler/listener/helpers.go @@ -5,8 +5,8 @@ import ( "fmt" "net/http" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" ) // RecoverFunc recover function for http requests diff --git a/httphandler/listener/init.go b/httphandler/listener/init.go index 5b1d2bad..172338ea 100644 --- a/httphandler/listener/init.go +++ b/httphandler/listener/init.go @@ -3,10 +3,10 @@ package listener import ( "os" - "github.com/armosec/kubescape/v2/core/cautils/getter" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" - "github.com/dwertent/go-logger/zaplogger" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/go-logger/zaplogger" + "github.com/kubescape/kubescape/v2/core/cautils/getter" ) func initialize() error { @@ -44,12 +44,12 @@ func initializeSaaSEnv() { switch saasEnv { case "dev", "development": logger.L().Debug("setting dev env") - getter.SetARMOAPIConnector(getter.NewARMOAPIDev()) + getter.SetKSCloudAPIConnector(getter.NewKSCloudAPIDev()) case "stage", "staging": logger.L().Debug("setting staging env") - getter.SetARMOAPIConnector(getter.NewARMOAPIStaging()) + getter.SetKSCloudAPIConnector(getter.NewKSCloudAPIStaging()) default: logger.L().Debug("setting prod env") - getter.SetARMOAPIConnector(getter.NewARMOAPIProd()) + getter.SetKSCloudAPIConnector(getter.NewKSCloudAPIProd()) } } diff --git a/httphandler/listener/setup.go b/httphandler/listener/setup.go index 2d98153f..57616657 100644 --- a/httphandler/listener/setup.go +++ b/httphandler/listener/setup.go @@ -6,11 +6,11 @@ import ( "net/http" "os" - "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/httphandler/docs" - handlerequestsv1 "github.com/armosec/kubescape/v2/httphandler/handlerequests/v1" - logger "github.com/dwertent/go-logger" - "github.com/dwertent/go-logger/helpers" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/go-logger/helpers" + "github.com/kubescape/kubescape/v2/core/cautils" + "github.com/kubescape/kubescape/v2/httphandler/docs" + handlerequestsv1 "github.com/kubescape/kubescape/v2/httphandler/handlerequests/v1" "github.com/gorilla/mux" ) diff --git a/httphandler/main.go b/httphandler/main.go index 6fa1d25d..40bf386e 100644 --- a/httphandler/main.go +++ b/httphandler/main.go @@ -1,9 +1,9 @@ package main import ( - _ "github.com/armosec/kubescape/v2/httphandler/docs" - "github.com/armosec/kubescape/v2/httphandler/listener" - logger "github.com/dwertent/go-logger" + logger "github.com/kubescape/go-logger" + _ "github.com/kubescape/kubescape/v2/httphandler/docs" + "github.com/kubescape/kubescape/v2/httphandler/listener" ) func main() { diff --git a/install.ps1 b/install.ps1 index 0bbcf61b..08434c74 100644 --- a/install.ps1 +++ b/install.ps1 @@ -4,7 +4,7 @@ $BASE_DIR=$env:USERPROFILE + "\.kubescape" $packageName = "/kubescape-windows-latest" # Get latest release url -$config = Invoke-WebRequest "https://api.github.com/repos/armosec/kubescape/releases/latest" | ConvertFrom-Json +$config = Invoke-WebRequest "https://api.github.com/repos/kubescape/kubescape/releases/latest" | ConvertFrom-Json $url = $config.html_url.Replace("/tag/","/download/") $fullUrl = $url + $packageName diff --git a/install.sh b/install.sh index 5b7f4b81..a465b3e7 100755 --- a/install.sh +++ b/install.sh @@ -31,7 +31,7 @@ fi mkdir -p $BASE_DIR OUTPUT=$BASE_DIR/$KUBESCAPE_EXEC -DOWNLOAD_URL="https://github.com/armosec/kubescape/releases/${RELEASE}/kubescape-${osName}-latest" +DOWNLOAD_URL="https://github.com/kubescape/kubescape/releases/${RELEASE}/kubescape-${osName}-latest" curl --progress-bar -L $DOWNLOAD_URL -o $OUTPUT diff --git a/main.go b/main.go index 66b2225f..38b861c7 100644 --- a/main.go +++ b/main.go @@ -1,8 +1,8 @@ package main import ( - "github.com/armosec/kubescape/v2/cmd" - logger "github.com/dwertent/go-logger" + logger "github.com/kubescape/go-logger" + "github.com/kubescape/kubescape/v2/cmd" ) func main() {