From fb7cc4284ef1ef253332fdc9e77568be5a7afae5 Mon Sep 17 00:00:00 2001 From: yiscah Date: Thu, 3 Feb 2022 12:29:28 +0200 Subject: [PATCH 1/2] support fixPaths --- cautils/reportv2tov1.go | 6 +++++- clihandler/initcli.go | 12 +++++++----- go.mod | 7 +++---- go.sum | 10 ++++------ opaprocessor/processorhandler.go | 6 +++++- 5 files changed, 24 insertions(+), 17 deletions(-) diff --git a/cautils/reportv2tov1.go b/cautils/reportv2tov1.go index 5b1562ed..7c7b1b3a 100644 --- a/cautils/reportv2tov1.go +++ b/cautils/reportv2tov1.go @@ -120,7 +120,11 @@ func controlReportV2ToV1(opaSessionObj *OPASessionObj, frameworkName string, con ruleResponse := reporthandling.RuleResponse{} ruleResponse.Rulename = rulev2.GetName() for i := range rulev2.Paths { - ruleResponse.FailedPaths = append(ruleResponse.FailedPaths, rulev2.Paths[i].FailedPath) + if rulev2.Paths[i].FailedPath != "" { + ruleResponse.FailedPaths = append(ruleResponse.FailedPaths, rulev2.Paths[i].FailedPath) + } else if rulev2.Paths[i].FixPath.Path != "" { + ruleResponse.FixPaths = append(ruleResponse.FixPaths, rulev2.Paths[i].FixPath) + } } ruleResponse.RuleStatus = string(status.Status()) if len(rulev2.Exception) > 0 { diff --git a/clihandler/initcli.go b/clihandler/initcli.go index 429cb854..067b93f6 100644 --- a/clihandler/initcli.go +++ b/clihandler/initcli.go @@ -154,18 +154,20 @@ func ScanCliSetup(scanInfo *cautils.ScanInfo) error { func Scan(policyHandler *policyhandler.PolicyHandler, scanInfo *cautils.ScanInfo) error { policyNotification := &reporthandling.PolicyNotification{ - NotificationType: reporthandling.TypeExecPostureScan, - Rules: scanInfo.PolicyIdentifier, - Designators: armotypes.PortalDesignator{}, + Rules: scanInfo.PolicyIdentifier, + KubescapeNotification: reporthandling.KubescapeNotification{ + Designators: armotypes.PortalDesignator{}, + NotificationType: reporthandling.TypeExecPostureScan, + }, } - switch policyNotification.NotificationType { + switch policyNotification.KubescapeNotification.NotificationType { case reporthandling.TypeExecPostureScan: if err := policyHandler.HandleNotificationRequest(policyNotification, scanInfo); err != nil { return err } default: - return fmt.Errorf("notification type '%s' Unknown", policyNotification.NotificationType) + return fmt.Errorf("notification type '%s' Unknown", policyNotification.KubescapeNotification.NotificationType) } return nil } diff --git a/go.mod b/go.mod index 63ab33b1..6339e6b3 100644 --- a/go.mod +++ b/go.mod @@ -3,9 +3,9 @@ module github.com/armosec/kubescape go 1.17 require ( - github.com/armosec/armoapi-go v0.0.41 + github.com/armosec/armoapi-go v0.0.49 github.com/armosec/k8s-interface v0.0.56 - github.com/armosec/opa-utils v0.0.99 + github.com/armosec/opa-utils v0.0.106 github.com/armosec/rbac-utils v0.0.12 github.com/armosec/utils-go v0.0.3 github.com/briandowns/spinner v1.18.0 @@ -19,7 +19,6 @@ require ( github.com/satori/go.uuid v1.2.0 github.com/spf13/cobra v1.2.1 github.com/stretchr/testify v1.7.0 - go.uber.org/zap v1.19.1 gopkg.in/yaml.v2 v2.4.0 k8s.io/api v0.22.2 k8s.io/apimachinery v0.22.2 @@ -36,7 +35,6 @@ require ( github.com/Azure/go-autorest/logger v0.2.1 // indirect github.com/Azure/go-autorest/tracing v0.6.0 // indirect github.com/OneOfOne/xxhash v1.2.8 // indirect - github.com/armosec/armo-interfaces v0.0.3 // indirect github.com/armosec/utils-k8s-go v0.0.1 // indirect github.com/aws/aws-sdk-go v1.41.11 // indirect github.com/coreos/go-oidc v2.2.1+incompatible // indirect @@ -78,6 +76,7 @@ require ( go.opencensus.io v0.23.0 // indirect go.uber.org/atomic v1.7.0 // indirect go.uber.org/multierr v1.6.0 // indirect + go.uber.org/zap v1.19.1 // indirect golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97 // indirect golang.org/x/net v0.0.0-20210825183410-e898025ed96a // indirect golang.org/x/oauth2 v0.0.0-20211005180243-6b3c2da341f1 // indirect diff --git a/go.sum b/go.sum index c2c78393..63b03775 100644 --- a/go.sum +++ b/go.sum @@ -83,20 +83,18 @@ github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hC github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8= github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY= github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8= -github.com/armosec/armo-interfaces v0.0.3 h1:kG4mJIPgWBJvQFDDy8JzdqX3ASbyl8t32IuJYqB31Pk= -github.com/armosec/armo-interfaces v0.0.3/go.mod h1:7XYefhcBCFYoF5LflCZHWuUHu+JrSJbmzk0zoNv2WlU= github.com/armosec/armoapi-go v0.0.2/go.mod h1:vIK17yoKbJRQyZXWWLe3AqfqCRITxW8qmSkApyq5xFs= github.com/armosec/armoapi-go v0.0.23/go.mod h1:iaVVGyc23QGGzAdv4n+szGQg3Rbpixn9yQTU3qWRpaw= -github.com/armosec/armoapi-go v0.0.41 h1:iMkaCsME+zhE6vnCOMaqfqc0cp7pste8QFHojeGKfGg= -github.com/armosec/armoapi-go v0.0.41/go.mod h1:exk1O3rK6V+X8SSyxc06lwb0j9ILQuKAoIdz9hs6Ndw= +github.com/armosec/armoapi-go v0.0.49 h1:b3gvZ5YB5DSEfk8pt7x0705b4Pcuahd3wI/ZmGYmB3Y= +github.com/armosec/armoapi-go v0.0.49/go.mod h1:iaVVGyc23QGGzAdv4n+szGQg3Rbpixn9yQTU3qWRpaw= github.com/armosec/k8s-interface v0.0.8/go.mod h1:xxS+V5QT3gVQTwZyAMMDrYLWGrfKOpiJ7Jfhfa0w9sM= github.com/armosec/k8s-interface v0.0.37/go.mod h1:vHxGWqD/uh6+GQb9Sqv7OGMs+Rvc2dsFVc0XtgRh1ZU= github.com/armosec/k8s-interface v0.0.50/go.mod h1:vHxGWqD/uh6+GQb9Sqv7OGMs+Rvc2dsFVc0XtgRh1ZU= github.com/armosec/k8s-interface v0.0.56 h1:7dOgc3qZaI7ReLRZcJa2JZKk0rliyYi05l1vuHc6gcE= github.com/armosec/k8s-interface v0.0.56/go.mod h1:vHxGWqD/uh6+GQb9Sqv7OGMs+Rvc2dsFVc0XtgRh1ZU= github.com/armosec/opa-utils v0.0.64/go.mod h1:6tQP8UDq2EvEfSqh8vrUdr/9QVSCG4sJfju1SXQOn4c= -github.com/armosec/opa-utils v0.0.99 h1:ZuoIPg6vbgO4J09xJZDO/yIRD59odwmK2Bm55uTvkU8= -github.com/armosec/opa-utils v0.0.99/go.mod h1:BNTjeianyXlflJMz3bZM0GimBWqmzirUf1whWR6Os04= +github.com/armosec/opa-utils v0.0.106 h1:YRKJ3hSwpAdTFbj2MUyo8MT9w6pDdzWYYTmov67Z8Bc= +github.com/armosec/opa-utils v0.0.106/go.mod h1:Wc1P4gkB6UQeGW8I76zCuitGGl15Omp0bKw7N0tR9dk= github.com/armosec/rbac-utils v0.0.1/go.mod h1:pQ8CBiij8kSKV7aeZm9FMvtZN28VgA7LZcYyTWimq40= github.com/armosec/rbac-utils v0.0.12 h1:uJpMGDyLAX129PrKHp6NPNB6lVRhE0OZIwV6ywzSDrs= github.com/armosec/rbac-utils v0.0.12/go.mod h1:Ex/IdGWhGv9HZq6Hs8N/ApzCKSIvpNe/ETqDfnuyah0= diff --git a/opaprocessor/processorhandler.go b/opaprocessor/processorhandler.go index e1a4d73c..599a4644 100644 --- a/opaprocessor/processorhandler.go +++ b/opaprocessor/processorhandler.go @@ -5,6 +5,7 @@ import ( "fmt" "time" + "github.com/armosec/armoapi-go/armotypes" "github.com/armosec/kubescape/cautils" ksscore "github.com/armosec/kubescape/score" "github.com/armosec/opa-utils/objectsenvelopes" @@ -204,7 +205,10 @@ func (opap *OPAProcessor) processRule(rule *reporthandling.PolicyRule) (map[stri ruleResult.Status = apis.StatusFailed for j := range ruleResponses[i].FailedPaths { - ruleResult.Paths = append(ruleResult.Paths, resourcesresults.Path{FailedPath: ruleResponses[i].FailedPaths[j]}) + ruleResult.Paths = append(ruleResult.Paths, armotypes.PosturePaths{FailedPath: ruleResponses[i].FailedPaths[j]}) + } + for j := range ruleResponses[i].FixPaths { + ruleResult.Paths = append(ruleResult.Paths, armotypes.PosturePaths{FixPath: ruleResponses[i].FixPaths[j]}) } resources[failedResources[j].GetID()] = ruleResult } From c93ee646300f0a3f83b977ea90474a83280ca9c7 Mon Sep 17 00:00:00 2001 From: yiscah Date: Thu, 3 Feb 2022 13:13:18 +0200 Subject: [PATCH 2/2] allow case of both failpath and fixpath exist --- cautils/reportv2tov1.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/cautils/reportv2tov1.go b/cautils/reportv2tov1.go index 7c7b1b3a..9b006339 100644 --- a/cautils/reportv2tov1.go +++ b/cautils/reportv2tov1.go @@ -122,7 +122,8 @@ func controlReportV2ToV1(opaSessionObj *OPASessionObj, frameworkName string, con for i := range rulev2.Paths { if rulev2.Paths[i].FailedPath != "" { ruleResponse.FailedPaths = append(ruleResponse.FailedPaths, rulev2.Paths[i].FailedPath) - } else if rulev2.Paths[i].FixPath.Path != "" { + } + if rulev2.Paths[i].FixPath.Path != "" { ruleResponse.FixPaths = append(ruleResponse.FixPaths, rulev2.Paths[i].FixPath) } }