diff --git a/core/pkg/hostsensorutils/utils.go b/core/pkg/hostsensorutils/utils.go index 055387b9..dd9f9c10 100644 --- a/core/pkg/hostsensorutils/utils.go +++ b/core/pkg/hostsensorutils/utils.go @@ -14,7 +14,7 @@ var ( LinuxKernelVariables = "LinuxKernelVariables" KubeletCommandLine = "KubeletCommandLine" - MapResourceToApiGroup = map[string]string{ + MapHostSensorResourceToApiGroup = map[string]string{ KubeletConfiguration: "hostdata.kubescape.cloud/v1beta0", OsReleaseFile: "hostdata.kubescape.cloud/v1beta0", KubeletCommandLine: "hostdata.kubescape.cloud/v1beta0", @@ -26,7 +26,7 @@ var ( ) func addInfoToMap(resource string, infoMap map[string]apis.StatusInfo, err error) { - group, version := k8sinterface.SplitApiVersion(MapResourceToApiGroup[resource]) + group, version := k8sinterface.SplitApiVersion(MapHostSensorResourceToApiGroup[resource]) r := k8sinterface.JoinResourceTriplets(group, version, resource) infoMap[r] = apis.StatusInfo{ InnerStatus: apis.StatusSkipped, diff --git a/core/pkg/resourcehandler/k8sresources.go b/core/pkg/resourcehandler/k8sresources.go index 8e1074a3..918ce4da 100644 --- a/core/pkg/resourcehandler/k8sresources.go +++ b/core/pkg/resourcehandler/k8sresources.go @@ -87,6 +87,9 @@ func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessio if err := k8sHandler.registryAdaptors.collectImagesVulnerabilities(k8sResourcesMap, allResources, armoResourceMap); err != nil { logger.L().Warning("failed to collect image vulnerabilities", helpers.Error(err)) } + if isEmptyImgVulns(*armoResourceMap) { + cautils.SetInfoMapForResources("image scanning not configured. For more information: https://hub.armo.cloud/docs/cluster-vulnerability-scanning", imgVulnResources, sessionObj.InfoMap) + } } hostResources := cautils.MapHostResources(armoResourceMap) @@ -104,7 +107,7 @@ func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessio sessionObj.InfoMap = infoMap } } else { - cautils.SetInfoMapForResources("enable-host-scan flag not used", hostResources, sessionObj.InfoMap) + cautils.SetInfoMapForResources("enable-host-scan flag not used. For more information: https://hub.armo.cloud/docs/host-sensor", hostResources, sessionObj.InfoMap) } } diff --git a/core/pkg/resourcehandler/k8sresourcesutils.go b/core/pkg/resourcehandler/k8sresourcesutils.go index baaa187e..d847186f 100644 --- a/core/pkg/resourcehandler/k8sresourcesutils.go +++ b/core/pkg/resourcehandler/k8sresourcesutils.go @@ -4,7 +4,6 @@ import ( "strings" "github.com/armosec/kubescape/v2/core/cautils" - "github.com/armosec/kubescape/v2/core/pkg/hostsensorutils" "github.com/armosec/opa-utils/reporthandling" "k8s.io/utils/strings/slices" @@ -12,12 +11,41 @@ import ( ) var ( - ClusterDescribe = "ClusterDescribe" + ClusterDescribe = "ClusterDescribe" + KubeletConfiguration = "KubeletConfiguration" + OsReleaseFile = "OsReleaseFile" + KernelVersion = "KernelVersion" + LinuxSecurityHardeningStatus = "LinuxSecurityHardeningStatus" + OpenPortsList = "OpenPortsList" + LinuxKernelVariables = "LinuxKernelVariables" + KubeletCommandLine = "KubeletCommandLine" + ImageVulnerabilities = "ImageVulnerabilities" + MapResourceToApiGroup = map[string]string{ + KubeletConfiguration: "hostdata.kubescape.cloud/v1beta0", + OsReleaseFile: "hostdata.kubescape.cloud/v1beta0", + KubeletCommandLine: "hostdata.kubescape.cloud/v1beta0", + KernelVersion: "hostdata.kubescape.cloud/v1beta0", + LinuxSecurityHardeningStatus: "hostdata.kubescape.cloud/v1beta0", + OpenPortsList: "hostdata.kubescape.cloud/v1beta0", + LinuxKernelVariables: "hostdata.kubescape.cloud/v1beta0", + } + MapResourceToApiGroupVuln = map[string][]string{ + ImageVulnerabilities: {"armo.vuln.images/v1", "image.vulnscan.com/v1"}} MapResourceToApiGroupCloud = map[string][]string{ ClusterDescribe: {"container.googleapis.com/v1", "eks.amazonaws.com/v1", "management.azure.com/v1"}} ) +func isEmptyImgVulns(armoResourcesMap cautils.ArmoResources) bool { + imgVulnResources := cautils.MapImageVulnResources(&armoResourcesMap) + for _, resource := range imgVulnResources { + if _, val := armoResourcesMap[resource]; val { + return true + } + } + return false +} + func setK8sResourceMap(frameworks []reporthandling.Framework) *cautils.K8SResources { k8sResources := make(cautils.K8SResources) complexMap := setComplexK8sResourceMap(frameworks) @@ -80,10 +108,16 @@ func setComplexArmoResourceMap(frameworks []reporthandling.Framework, resourceTo } func mapArmoResourceToApiGroup(resource string) []string { - if val, ok := hostsensorutils.MapResourceToApiGroup[resource]; ok { + if val, ok := MapResourceToApiGroup[resource]; ok { return []string{val} } - return MapResourceToApiGroupCloud[resource] + if val, ok := MapResourceToApiGroupCloud[resource]; ok { + return val + } + if val, ok := MapResourceToApiGroupVuln[resource]; ok { + return val + } + return []string{} } func insertControls(resource string, resourceToControl map[string][]string, control reporthandling.Control) {