diff --git a/cautils/customerloader.go b/cautils/customerloader.go index fa97bd7a..adec4e65 100644 --- a/cautils/customerloader.go +++ b/cautils/customerloader.go @@ -26,7 +26,7 @@ func ConfigFileFullPath() string { return getter.GetDefaultPath(configFileName + type ConfigObj struct { AccountID string `json:"accountID,omitempty"` ClientID string `json:"clientID,omitempty"` - AccessKey string `json:"accessKey,omitempty"` + SecretKey string `json:"secretKey,omitempty"` CustomerGUID string `json:"customerGUID,omitempty"` // Deprecated Token string `json:"invitationParam,omitempty"` CustomerAdminEMail string `json:"adminMail,omitempty"` @@ -111,7 +111,7 @@ func NewLocalConfig(backendAPI getter.IBackend, customerGUID, clusterName string lc.backendAPI.SetAccountID(lc.configObj.AccountID) lc.backendAPI.SetClientID(lc.configObj.ClientID) - lc.backendAPI.SetAccessKey(lc.configObj.AccessKey) + lc.backendAPI.SetSecretKey(lc.configObj.SecretKey) if lc.configObj.AccountID != "" { if err := lc.SetTenant(); err != nil { @@ -177,7 +177,7 @@ KS_DEFAULT_CONFIGMAP_NAMESPACE // configmap namespace, if not set default is ' KS_ACCOUNT_ID KS_CLIENT_ID -KS_ACCESS_KEY +KS_SECRET_KEY TODO - supprot: KS_CACHE // path to cached files @@ -226,7 +226,7 @@ func NewClusterConfig(k8s *k8sinterface.KubernetesApi, backendAPI getter.IBacken c.backendAPI.SetAccountID(c.configObj.AccountID) c.backendAPI.SetClientID(c.configObj.ClientID) - c.backendAPI.SetAccessKey(c.configObj.AccessKey) + c.backendAPI.SetSecretKey(c.configObj.SecretKey) if c.configObj.AccountID != "" { if err := c.SetTenant(); err != nil { @@ -513,7 +513,7 @@ func getAccountFromEnv(configObj *ConfigObj) { if clientID := os.Getenv("KS_CLIENT_ID"); clientID != "" { configObj.ClientID = clientID } - if accessKey := os.Getenv("KS_ACCESS_KEY"); accessKey != "" { - configObj.AccessKey = accessKey + if secretKey := os.Getenv("KS_SECRET_KEY"); secretKey != "" { + configObj.SecretKey = secretKey } } diff --git a/cautils/getter/armoapi.go b/cautils/getter/armoapi.go index d807de39..2445ea1d 100644 --- a/cautils/getter/armoapi.go +++ b/cautils/getter/armoapi.go @@ -41,7 +41,7 @@ type ArmoAPI struct { feURL string accountID string clientID string - accessKey string + secretKey string feToken FeLoginResponse authCookie string loggedIn bool @@ -119,13 +119,13 @@ func (armoAPI *ArmoAPI) Get(fullURL string, headers map[string]string) (string, func (armoAPI *ArmoAPI) GetAccountID() string { return armoAPI.accountID } func (armoAPI *ArmoAPI) IsLoggedIn() bool { return armoAPI.loggedIn } func (armoAPI *ArmoAPI) GetClientID() string { return armoAPI.clientID } -func (armoAPI *ArmoAPI) GetAccessKey() string { return armoAPI.accessKey } +func (armoAPI *ArmoAPI) GetSecretKey() string { return armoAPI.secretKey } func (armoAPI *ArmoAPI) GetFrontendURL() string { return armoAPI.feURL } func (armoAPI *ArmoAPI) GetAPIURL() string { return armoAPI.apiURL } func (armoAPI *ArmoAPI) GetReportReceiverURL() string { return armoAPI.erURL } func (armoAPI *ArmoAPI) SetAccountID(accountID string) { armoAPI.accountID = accountID } func (armoAPI *ArmoAPI) SetClientID(clientID string) { armoAPI.clientID = clientID } -func (armoAPI *ArmoAPI) SetAccessKey(accessKey string) { armoAPI.accessKey = accessKey } +func (armoAPI *ArmoAPI) SetSecretKey(secretKey string) { armoAPI.secretKey = secretKey } func (armoAPI *ArmoAPI) GetFramework(name string) (*reporthandling.Framework, error) { respStr, err := armoAPI.Get(armoAPI.getFrameworkURL(name), nil) @@ -290,12 +290,12 @@ func (armoAPI *ArmoAPI) Login() error { if armoAPI.clientID == "" { return fmt.Errorf("failed to login, missing clientID") } - if armoAPI.accessKey == "" { - return fmt.Errorf("failed to login, missing accessKey") + if armoAPI.secretKey == "" { + return fmt.Errorf("failed to login, missing secretKey") } // init URLs - feLoginData := FeLoginData{ClientId: armoAPI.clientID, Secret: armoAPI.accessKey} + feLoginData := FeLoginData{ClientId: armoAPI.clientID, Secret: armoAPI.secretKey} body, _ := json.Marshal(feLoginData) resp, err := http.Post(armoAPI.getApiToken(), "application/json", bytes.NewBuffer(body)) diff --git a/cautils/getter/getpolicies.go b/cautils/getter/getpolicies.go index 572aed32..8a8d8219 100644 --- a/cautils/getter/getpolicies.go +++ b/cautils/getter/getpolicies.go @@ -26,11 +26,11 @@ type IExceptionsGetter interface { type IBackend interface { GetAccountID() string GetClientID() string - GetAccessKey() string + GetSecretKey() string SetAccountID(accountID string) SetClientID(clientID string) - SetAccessKey(accessKey string) + SetSecretKey(secretKey string) GetTenant() (*TenantResponse, error) } diff --git a/cautils/logger/helpers/level.go b/cautils/logger/helpers/level.go index 4afe639b..c4d46730 100644 --- a/cautils/logger/helpers/level.go +++ b/cautils/logger/helpers/level.go @@ -28,7 +28,7 @@ func ToLevel(level string) Level { return InfoLevel case "success": return SuccessLevel - case "warnign", "warn": + case "warning", "warn": return WarningLevel case "error": return ErrorLevel @@ -47,7 +47,7 @@ func (l Level) String() string { case SuccessLevel: return "success" case WarningLevel: - return "warnign" + return "warning" case ErrorLevel: return "error" case FatalLevel: diff --git a/clihandler/cliobjects/set.go b/clihandler/cliobjects/set.go index 53ab2940..79706239 100644 --- a/clihandler/cliobjects/set.go +++ b/clihandler/cliobjects/set.go @@ -3,5 +3,5 @@ package cliobjects type SetConfig struct { Account string ClientID string - AccessKey string + SecretKey string } diff --git a/clihandler/cliset.go b/clihandler/cliset.go index 3ff6d3da..a8e96325 100644 --- a/clihandler/cliset.go +++ b/clihandler/cliset.go @@ -11,8 +11,8 @@ func CliSetConfig(setConfig *cliobjects.SetConfig) error { if setConfig.Account != "" { tenant.GetConfigObj().AccountID = setConfig.Account } - if setConfig.AccessKey != "" { - tenant.GetConfigObj().AccessKey = setConfig.AccessKey + if setConfig.SecretKey != "" { + tenant.GetConfigObj().SecretKey = setConfig.SecretKey } if setConfig.ClientID != "" { tenant.GetConfigObj().ClientID = setConfig.ClientID diff --git a/clihandler/cmd/config.go b/clihandler/cmd/config.go index f11f1954..bd759f4f 100644 --- a/clihandler/cmd/config.go +++ b/clihandler/cmd/config.go @@ -29,7 +29,7 @@ var ( kubescape config set clientID # Set access key - kubescape config set accessKey + kubescape config set secretKey ` ) @@ -63,7 +63,7 @@ var configSetCmd = &cobra.Command{ var supportConfigSet = map[string]func(*cliobjects.SetConfig, string){ "accountID": func(s *cliobjects.SetConfig, account string) { s.Account = account }, "clientID": func(s *cliobjects.SetConfig, clientID string) { s.ClientID = clientID }, - "accessKey": func(s *cliobjects.SetConfig, accessKey string) { s.AccessKey = accessKey }, + "secretKey": func(s *cliobjects.SetConfig, secretKey string) { s.SecretKey = secretKey }, } func stringKeysToSlice(m map[string]func(*cliobjects.SetConfig, string)) []string { diff --git a/clihandler/cmd/scan.go b/clihandler/cmd/scan.go index 4fb2f32e..cdb62449 100644 --- a/clihandler/cmd/scan.go +++ b/clihandler/cmd/scan.go @@ -1,9 +1,6 @@ package cmd import ( - "fmt" - "strings" - "github.com/armosec/k8s-interface/k8sinterface" "github.com/armosec/kubescape/cautils" "github.com/spf13/cobra" @@ -13,22 +10,24 @@ var scanInfo cautils.ScanInfo // scanCmd represents the scan command var scanCmd = &cobra.Command{ - Use: "scan ", + Use: "scan [command]", Short: "Scan the current running cluster or yaml files", Long: `The action you want to perform`, Args: func(cmd *cobra.Command, args []string) error { if len(args) > 0 { - if !strings.EqualFold(args[0], "framework") && !strings.EqualFold(args[0], "control") { - return fmt.Errorf("invalid parameter '%s'. Supported parameters: framework, control", args[0]) + if args[0] != "framework" && args[0] != "control" { + scanInfo.ScanAll = true + return frameworkCmd.RunE(cmd, append([]string{"all"}, args...)) } } return nil }, - Run: func(cmd *cobra.Command, args []string) { + RunE: func(cmd *cobra.Command, args []string) error { if len(args) == 0 { scanInfo.ScanAll = true - frameworkCmd.RunE(cmd, []string{"all"}) + return frameworkCmd.RunE(cmd, []string{"all"}) } + return nil }, } @@ -37,6 +36,7 @@ func frameworkInitConfig() { } func init() { + cobra.OnInitialize(frameworkInitConfig) rootCmd.AddCommand(scanCmd) @@ -61,4 +61,5 @@ func init() { hostF := scanCmd.PersistentFlags().VarPF(&scanInfo.HostSensor, "enable-host-scan", "", "Deploy ARMO K8s host-sensor daemonset in the scanned cluster. Deleting it right after we collecting the data. Required to collect valueable data from cluster nodes for certain controls") hostF.NoOptDefVal = "true" hostF.DefValue = "false, for no TTY in stdin" + } diff --git a/registryadaptors/README.md b/registryadaptors/README.md index ebb90565..f0de4892 100644 --- a/registryadaptors/README.md +++ b/registryadaptors/README.md @@ -9,12 +9,12 @@ For these controls to work properly, it is necasery to 1. Navigate to the [armosec.io](https://portal.armo.cloud/) 2. Click Profile(top right icon)->"User Management"->"API Tokens" and Generate a token -3. Copy the clientID and accessKey and run: +3. Copy the clientID and secretKey and run: ``` kubescape config set clientID <> ``` ``` -kubescape config set accessKey <> +kubescape config set secretKey <> ``` 4. Confirm the keys are set ``` @@ -25,7 +25,7 @@ Expecting: { "accountID": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", "clientID": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", - "accessKey": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" + "secretKey": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" } ``` > If you are missing the `accountID` field, set it by running `kubescape config set accountID <>` @@ -34,5 +34,5 @@ For CICD, set environments variables as following: ``` KS_ACCOUNT_ID // account id KS_CLIENT_ID // client id -KS_ACCESS_KEY // access key +KS_SECRET_KEY // access key ``` \ No newline at end of file diff --git a/resourcehandler/filesloader.go b/resourcehandler/filesloader.go index 93510912..28b0540c 100644 --- a/resourcehandler/filesloader.go +++ b/resourcehandler/filesloader.go @@ -195,11 +195,15 @@ func listFiles(patterns []string) ([]string, []error) { o, _ := os.Getwd() patterns[i] = filepath.Join(o, patterns[i]) } - f, err := glob(filepath.Split(patterns[i])) //filepath.Glob(patterns[i]) - if err != nil { - errs = append(errs, err) + if isFile(patterns[i]) { + files = append(files, patterns[i]) } else { - files = append(files, f...) + f, err := glob(filepath.Split(patterns[i])) //filepath.Glob(patterns[i]) + if err != nil { + errs = append(errs, err) + } else { + files = append(files, f...) + } } } return files, errs @@ -276,8 +280,17 @@ func convertYamlToJson(i interface{}) interface{} { return i } +func isYaml(filePath string) bool { + return cautils.StringInSlice(YAML_PREFIX, filepath.Ext(filePath)) != cautils.ValueNotFound +} + +func isJson(filePath string) bool { + return cautils.StringInSlice(JSON_PREFIX, filepath.Ext(filePath)) != cautils.ValueNotFound +} + func glob(root, pattern string) ([]string, error) { var matches []string + err := filepath.Walk(root, func(path string, info os.FileInfo, err error) error { if err != nil { return err @@ -297,12 +310,13 @@ func glob(root, pattern string) ([]string, error) { } return matches, nil } -func isYaml(filePath string) bool { - return cautils.StringInSlice(YAML_PREFIX, filepath.Ext(filePath)) != cautils.ValueNotFound -} - -func isJson(filePath string) bool { - return cautils.StringInSlice(YAML_PREFIX, filepath.Ext(filePath)) != cautils.ValueNotFound +func isFile(name string) bool { + if fi, err := os.Stat(name); err == nil { + if fi.Mode().IsRegular() { + return true + } + } + return false } func getFileFormat(filePath string) FileFormat { diff --git a/resourcehandler/filesloader_test.go b/resourcehandler/filesloader_test.go index 6ff81e08..5d2006c5 100644 --- a/resourcehandler/filesloader_test.go +++ b/resourcehandler/filesloader_test.go @@ -1,11 +1,12 @@ package resourcehandler import ( - "fmt" "os" "path/filepath" "strings" "testing" + + "github.com/stretchr/testify/assert" ) func onlineBoutiquePath() string { @@ -14,32 +15,26 @@ func onlineBoutiquePath() string { } func TestListFiles(t *testing.T) { - workDir, err := os.Getwd() - fmt.Printf("\n------------------\n%s,%v\n--------------\n", workDir, err) + filesPath := onlineBoutiquePath() - fmt.Printf("\n------------------\n%s\n--------------\n", filesPath) files, errs := listFiles([]string{filesPath}) - if len(errs) > 0 { - t.Error(errs) - } - expected := 12 - if len(files) != expected { - t.Errorf("wrong number of files, expected: %d, found: %d", expected, len(files)) - } + assert.Equal(t, 0, len(errs)) + assert.Equal(t, 12, len(files)) } func TestLoadFiles(t *testing.T) { files, _ := listFiles([]string{onlineBoutiquePath()}) - loadFiles(files) + _, err := loadFiles(files) + assert.Equal(t, 0, len(err)) } func TestLoadFile(t *testing.T) { files, _ := listFiles([]string{strings.Replace(onlineBoutiquePath(), "*", "adservice.yaml", 1)}) + assert.Equal(t, 1, len(files)) + _, err := loadFile(files[0]) - if err != nil { - t.Errorf("%v", err) - } + assert.NoError(t, err) } func TestMapResources(t *testing.T) { // policyHandler := &PolicyHandler{} diff --git a/resourcehandler/registrydata.go b/resourcehandler/registrydata.go index c08e270b..10503a18 100644 --- a/resourcehandler/registrydata.go +++ b/resourcehandler/registrydata.go @@ -141,7 +141,7 @@ func listAdaptores() ([]registryvulnerabilities.IContainerImageVulnerabilityAdap armoAPI := getter.GetArmoAPIConnector() if armoAPI != nil { - if armoAPI.GetAccessKey() != "" && armoAPI.GetClientID() != "" && armoAPI.GetAccountID() != "" { + if armoAPI.GetSecretKey() != "" && armoAPI.GetClientID() != "" && armoAPI.GetAccountID() != "" { adaptors = append(adaptors, armosecadaptorv1.NewArmoAdaptor(getter.GetArmoAPIConnector())) } } diff --git a/smoke_testing/test_scan.py b/smoke_testing/test_scan.py index f8d2afad..0a48663a 100644 --- a/smoke_testing/test_scan.py +++ b/smoke_testing/test_scan.py @@ -29,7 +29,11 @@ def scan_framework(kubescape_exec: str): def scan_frameworks(kubescape_exec: str): - return smoke_utils.run_command(command=[kubescape_exec, "scan", "framework", "nsa,mitre,armobest", all_files, "--enable-host-scan=false"]) + return smoke_utils.run_command(command=[kubescape_exec, "scan", "framework", "nsa,mitre", all_files, "--enable-host-scan=false"]) + + +def scan_all(kubescape_exec: str): + return smoke_utils.run_command(command=[kubescape_exec, "scan", all_files, "--enable-host-scan=false"]) def scan_from_stdin(kubescape_exec: str): @@ -64,6 +68,10 @@ def run(kubescape_exec: str): msg = scan_frameworks(kubescape_exec=kubescape_exec) smoke_utils.assertion(msg) + print("Testing scan all") + msg = scan_all(kubescape_exec=kubescape_exec) + smoke_utils.assertion(msg) + # TODO - fix test # print("Testing scan from stdin") # msg = scan_from_stdin(kubescape_exec=kubescape_exec)