From a22f97bd1354c9a479f06f164315d0ed98db149a Mon Sep 17 00:00:00 2001 From: dwertent Date: Mon, 7 Feb 2022 10:56:39 +0200 Subject: [PATCH 1/5] fixed python build --- build.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build.py b/build.py index 42d0ac8a..fc8a19d3 100644 --- a/build.py +++ b/build.py @@ -56,7 +56,7 @@ def main(): os.makedirs(buildDir) # Build kubescape - ldflags = "-w -s -X %s=%s -X %s=%s -X %s=%s -X %s=%s" \ + ldflags = "-w -s -X %s=%s -X %s=%s -X %s=%s -X %s=%s -X %s=%s" \ % (buildUrl, releaseVersion, BE_SERVER_CONST, ArmoBEServer, ER_SERVER_CONST, ArmoERServer, WEBSITE_CONST, ArmoWebsite, AUTH_SERVER_CONST, ArmoAuthServer) From 22e94c5a29e028e35c4a664f2f1889e0332a13b0 Mon Sep 17 00:00:00 2001 From: dwertent Date: Mon, 7 Feb 2022 15:37:30 +0200 Subject: [PATCH 2/5] typo --- cautils/logger/helpers/level.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/cautils/logger/helpers/level.go b/cautils/logger/helpers/level.go index 4afe639b..c4d46730 100644 --- a/cautils/logger/helpers/level.go +++ b/cautils/logger/helpers/level.go @@ -28,7 +28,7 @@ func ToLevel(level string) Level { return InfoLevel case "success": return SuccessLevel - case "warnign", "warn": + case "warning", "warn": return WarningLevel case "error": return ErrorLevel @@ -47,7 +47,7 @@ func (l Level) String() string { case SuccessLevel: return "success" case WarningLevel: - return "warnign" + return "warning" case ErrorLevel: return "error" case FatalLevel: From 7bc32776347fabffd643340baa66c95ceded78fa Mon Sep 17 00:00:00 2001 From: dwertent Date: Mon, 7 Feb 2022 15:37:57 +0200 Subject: [PATCH 3/5] support scanning all with yaml files --- clihandler/cmd/scan.go | 17 +++++++++-------- smoke_testing/test_scan.py | 10 +++++++++- 2 files changed, 18 insertions(+), 9 deletions(-) diff --git a/clihandler/cmd/scan.go b/clihandler/cmd/scan.go index 4fb2f32e..4df31735 100644 --- a/clihandler/cmd/scan.go +++ b/clihandler/cmd/scan.go @@ -1,9 +1,6 @@ package cmd import ( - "fmt" - "strings" - "github.com/armosec/k8s-interface/k8sinterface" "github.com/armosec/kubescape/cautils" "github.com/spf13/cobra" @@ -13,22 +10,24 @@ var scanInfo cautils.ScanInfo // scanCmd represents the scan command var scanCmd = &cobra.Command{ - Use: "scan ", + Use: "scan [command]", Short: "Scan the current running cluster or yaml files", Long: `The action you want to perform`, Args: func(cmd *cobra.Command, args []string) error { if len(args) > 0 { - if !strings.EqualFold(args[0], "framework") && !strings.EqualFold(args[0], "control") { - return fmt.Errorf("invalid parameter '%s'. Supported parameters: framework, control", args[0]) + if args[0] != "framework" && args[0] != "control" { + scanInfo.ScanAll = true + return frameworkCmd.RunE(cmd, args) } } return nil }, - Run: func(cmd *cobra.Command, args []string) { + RunE: func(cmd *cobra.Command, args []string) error { if len(args) == 0 { scanInfo.ScanAll = true - frameworkCmd.RunE(cmd, []string{"all"}) + return frameworkCmd.RunE(cmd, []string{"all"}) } + return nil }, } @@ -37,6 +36,7 @@ func frameworkInitConfig() { } func init() { + cobra.OnInitialize(frameworkInitConfig) rootCmd.AddCommand(scanCmd) @@ -61,4 +61,5 @@ func init() { hostF := scanCmd.PersistentFlags().VarPF(&scanInfo.HostSensor, "enable-host-scan", "", "Deploy ARMO K8s host-sensor daemonset in the scanned cluster. Deleting it right after we collecting the data. Required to collect valueable data from cluster nodes for certain controls") hostF.NoOptDefVal = "true" hostF.DefValue = "false, for no TTY in stdin" + } diff --git a/smoke_testing/test_scan.py b/smoke_testing/test_scan.py index f8d2afad..0a48663a 100644 --- a/smoke_testing/test_scan.py +++ b/smoke_testing/test_scan.py @@ -29,7 +29,11 @@ def scan_framework(kubescape_exec: str): def scan_frameworks(kubescape_exec: str): - return smoke_utils.run_command(command=[kubescape_exec, "scan", "framework", "nsa,mitre,armobest", all_files, "--enable-host-scan=false"]) + return smoke_utils.run_command(command=[kubescape_exec, "scan", "framework", "nsa,mitre", all_files, "--enable-host-scan=false"]) + + +def scan_all(kubescape_exec: str): + return smoke_utils.run_command(command=[kubescape_exec, "scan", all_files, "--enable-host-scan=false"]) def scan_from_stdin(kubescape_exec: str): @@ -64,6 +68,10 @@ def run(kubescape_exec: str): msg = scan_frameworks(kubescape_exec=kubescape_exec) smoke_utils.assertion(msg) + print("Testing scan all") + msg = scan_all(kubescape_exec=kubescape_exec) + smoke_utils.assertion(msg) + # TODO - fix test # print("Testing scan from stdin") # msg = scan_from_stdin(kubescape_exec=kubescape_exec) From fe1d2646bd7123b88d5af58615fd7ddf8796d77e Mon Sep 17 00:00:00 2001 From: dwertent Date: Mon, 7 Feb 2022 16:08:57 +0200 Subject: [PATCH 4/5] fixed glob files --- cautils/customerloader.go | 12 ++++++------ cautils/getter/armoapi.go | 12 ++++++------ cautils/getter/getpolicies.go | 4 ++-- clihandler/cliobjects/set.go | 2 +- clihandler/cliset.go | 4 ++-- clihandler/cmd/config.go | 4 ++-- clihandler/cmd/scan.go | 2 +- registryadaptors/README.md | 8 ++++---- resourcehandler/filesloader.go | 25 ++----------------------- resourcehandler/filesloader_test.go | 25 ++++++++++--------------- resourcehandler/registrydata.go | 2 +- 11 files changed, 37 insertions(+), 63 deletions(-) diff --git a/cautils/customerloader.go b/cautils/customerloader.go index fa97bd7a..adec4e65 100644 --- a/cautils/customerloader.go +++ b/cautils/customerloader.go @@ -26,7 +26,7 @@ func ConfigFileFullPath() string { return getter.GetDefaultPath(configFileName + type ConfigObj struct { AccountID string `json:"accountID,omitempty"` ClientID string `json:"clientID,omitempty"` - AccessKey string `json:"accessKey,omitempty"` + SecretKey string `json:"secretKey,omitempty"` CustomerGUID string `json:"customerGUID,omitempty"` // Deprecated Token string `json:"invitationParam,omitempty"` CustomerAdminEMail string `json:"adminMail,omitempty"` @@ -111,7 +111,7 @@ func NewLocalConfig(backendAPI getter.IBackend, customerGUID, clusterName string lc.backendAPI.SetAccountID(lc.configObj.AccountID) lc.backendAPI.SetClientID(lc.configObj.ClientID) - lc.backendAPI.SetAccessKey(lc.configObj.AccessKey) + lc.backendAPI.SetSecretKey(lc.configObj.SecretKey) if lc.configObj.AccountID != "" { if err := lc.SetTenant(); err != nil { @@ -177,7 +177,7 @@ KS_DEFAULT_CONFIGMAP_NAMESPACE // configmap namespace, if not set default is ' KS_ACCOUNT_ID KS_CLIENT_ID -KS_ACCESS_KEY +KS_SECRET_KEY TODO - supprot: KS_CACHE // path to cached files @@ -226,7 +226,7 @@ func NewClusterConfig(k8s *k8sinterface.KubernetesApi, backendAPI getter.IBacken c.backendAPI.SetAccountID(c.configObj.AccountID) c.backendAPI.SetClientID(c.configObj.ClientID) - c.backendAPI.SetAccessKey(c.configObj.AccessKey) + c.backendAPI.SetSecretKey(c.configObj.SecretKey) if c.configObj.AccountID != "" { if err := c.SetTenant(); err != nil { @@ -513,7 +513,7 @@ func getAccountFromEnv(configObj *ConfigObj) { if clientID := os.Getenv("KS_CLIENT_ID"); clientID != "" { configObj.ClientID = clientID } - if accessKey := os.Getenv("KS_ACCESS_KEY"); accessKey != "" { - configObj.AccessKey = accessKey + if secretKey := os.Getenv("KS_SECRET_KEY"); secretKey != "" { + configObj.SecretKey = secretKey } } diff --git a/cautils/getter/armoapi.go b/cautils/getter/armoapi.go index d807de39..2445ea1d 100644 --- a/cautils/getter/armoapi.go +++ b/cautils/getter/armoapi.go @@ -41,7 +41,7 @@ type ArmoAPI struct { feURL string accountID string clientID string - accessKey string + secretKey string feToken FeLoginResponse authCookie string loggedIn bool @@ -119,13 +119,13 @@ func (armoAPI *ArmoAPI) Get(fullURL string, headers map[string]string) (string, func (armoAPI *ArmoAPI) GetAccountID() string { return armoAPI.accountID } func (armoAPI *ArmoAPI) IsLoggedIn() bool { return armoAPI.loggedIn } func (armoAPI *ArmoAPI) GetClientID() string { return armoAPI.clientID } -func (armoAPI *ArmoAPI) GetAccessKey() string { return armoAPI.accessKey } +func (armoAPI *ArmoAPI) GetSecretKey() string { return armoAPI.secretKey } func (armoAPI *ArmoAPI) GetFrontendURL() string { return armoAPI.feURL } func (armoAPI *ArmoAPI) GetAPIURL() string { return armoAPI.apiURL } func (armoAPI *ArmoAPI) GetReportReceiverURL() string { return armoAPI.erURL } func (armoAPI *ArmoAPI) SetAccountID(accountID string) { armoAPI.accountID = accountID } func (armoAPI *ArmoAPI) SetClientID(clientID string) { armoAPI.clientID = clientID } -func (armoAPI *ArmoAPI) SetAccessKey(accessKey string) { armoAPI.accessKey = accessKey } +func (armoAPI *ArmoAPI) SetSecretKey(secretKey string) { armoAPI.secretKey = secretKey } func (armoAPI *ArmoAPI) GetFramework(name string) (*reporthandling.Framework, error) { respStr, err := armoAPI.Get(armoAPI.getFrameworkURL(name), nil) @@ -290,12 +290,12 @@ func (armoAPI *ArmoAPI) Login() error { if armoAPI.clientID == "" { return fmt.Errorf("failed to login, missing clientID") } - if armoAPI.accessKey == "" { - return fmt.Errorf("failed to login, missing accessKey") + if armoAPI.secretKey == "" { + return fmt.Errorf("failed to login, missing secretKey") } // init URLs - feLoginData := FeLoginData{ClientId: armoAPI.clientID, Secret: armoAPI.accessKey} + feLoginData := FeLoginData{ClientId: armoAPI.clientID, Secret: armoAPI.secretKey} body, _ := json.Marshal(feLoginData) resp, err := http.Post(armoAPI.getApiToken(), "application/json", bytes.NewBuffer(body)) diff --git a/cautils/getter/getpolicies.go b/cautils/getter/getpolicies.go index 572aed32..8a8d8219 100644 --- a/cautils/getter/getpolicies.go +++ b/cautils/getter/getpolicies.go @@ -26,11 +26,11 @@ type IExceptionsGetter interface { type IBackend interface { GetAccountID() string GetClientID() string - GetAccessKey() string + GetSecretKey() string SetAccountID(accountID string) SetClientID(clientID string) - SetAccessKey(accessKey string) + SetSecretKey(secretKey string) GetTenant() (*TenantResponse, error) } diff --git a/clihandler/cliobjects/set.go b/clihandler/cliobjects/set.go index 53ab2940..79706239 100644 --- a/clihandler/cliobjects/set.go +++ b/clihandler/cliobjects/set.go @@ -3,5 +3,5 @@ package cliobjects type SetConfig struct { Account string ClientID string - AccessKey string + SecretKey string } diff --git a/clihandler/cliset.go b/clihandler/cliset.go index 3ff6d3da..a8e96325 100644 --- a/clihandler/cliset.go +++ b/clihandler/cliset.go @@ -11,8 +11,8 @@ func CliSetConfig(setConfig *cliobjects.SetConfig) error { if setConfig.Account != "" { tenant.GetConfigObj().AccountID = setConfig.Account } - if setConfig.AccessKey != "" { - tenant.GetConfigObj().AccessKey = setConfig.AccessKey + if setConfig.SecretKey != "" { + tenant.GetConfigObj().SecretKey = setConfig.SecretKey } if setConfig.ClientID != "" { tenant.GetConfigObj().ClientID = setConfig.ClientID diff --git a/clihandler/cmd/config.go b/clihandler/cmd/config.go index f11f1954..bd759f4f 100644 --- a/clihandler/cmd/config.go +++ b/clihandler/cmd/config.go @@ -29,7 +29,7 @@ var ( kubescape config set clientID # Set access key - kubescape config set accessKey + kubescape config set secretKey ` ) @@ -63,7 +63,7 @@ var configSetCmd = &cobra.Command{ var supportConfigSet = map[string]func(*cliobjects.SetConfig, string){ "accountID": func(s *cliobjects.SetConfig, account string) { s.Account = account }, "clientID": func(s *cliobjects.SetConfig, clientID string) { s.ClientID = clientID }, - "accessKey": func(s *cliobjects.SetConfig, accessKey string) { s.AccessKey = accessKey }, + "secretKey": func(s *cliobjects.SetConfig, secretKey string) { s.SecretKey = secretKey }, } func stringKeysToSlice(m map[string]func(*cliobjects.SetConfig, string)) []string { diff --git a/clihandler/cmd/scan.go b/clihandler/cmd/scan.go index 4df31735..cdb62449 100644 --- a/clihandler/cmd/scan.go +++ b/clihandler/cmd/scan.go @@ -17,7 +17,7 @@ var scanCmd = &cobra.Command{ if len(args) > 0 { if args[0] != "framework" && args[0] != "control" { scanInfo.ScanAll = true - return frameworkCmd.RunE(cmd, args) + return frameworkCmd.RunE(cmd, append([]string{"all"}, args...)) } } return nil diff --git a/registryadaptors/README.md b/registryadaptors/README.md index ebb90565..f0de4892 100644 --- a/registryadaptors/README.md +++ b/registryadaptors/README.md @@ -9,12 +9,12 @@ For these controls to work properly, it is necasery to 1. Navigate to the [armosec.io](https://portal.armo.cloud/) 2. Click Profile(top right icon)->"User Management"->"API Tokens" and Generate a token -3. Copy the clientID and accessKey and run: +3. Copy the clientID and secretKey and run: ``` kubescape config set clientID <> ``` ``` -kubescape config set accessKey <> +kubescape config set secretKey <> ``` 4. Confirm the keys are set ``` @@ -25,7 +25,7 @@ Expecting: { "accountID": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", "clientID": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", - "accessKey": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" + "secretKey": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" } ``` > If you are missing the `accountID` field, set it by running `kubescape config set accountID <>` @@ -34,5 +34,5 @@ For CICD, set environments variables as following: ``` KS_ACCOUNT_ID // account id KS_CLIENT_ID // client id -KS_ACCESS_KEY // access key +KS_SECRET_KEY // access key ``` \ No newline at end of file diff --git a/resourcehandler/filesloader.go b/resourcehandler/filesloader.go index 93510912..2cd18fa5 100644 --- a/resourcehandler/filesloader.go +++ b/resourcehandler/filesloader.go @@ -195,7 +195,7 @@ func listFiles(patterns []string) ([]string, []error) { o, _ := os.Getwd() patterns[i] = filepath.Join(o, patterns[i]) } - f, err := glob(filepath.Split(patterns[i])) //filepath.Glob(patterns[i]) + f, err := filepath.Glob(patterns[i]) if err != nil { errs = append(errs, err) } else { @@ -276,33 +276,12 @@ func convertYamlToJson(i interface{}) interface{} { return i } -func glob(root, pattern string) ([]string, error) { - var matches []string - err := filepath.Walk(root, func(path string, info os.FileInfo, err error) error { - if err != nil { - return err - } - if info.IsDir() { - return nil - } - if matched, err := filepath.Match(pattern, filepath.Base(path)); err != nil { - return err - } else if matched { - matches = append(matches, path) - } - return nil - }) - if err != nil { - return nil, err - } - return matches, nil -} func isYaml(filePath string) bool { return cautils.StringInSlice(YAML_PREFIX, filepath.Ext(filePath)) != cautils.ValueNotFound } func isJson(filePath string) bool { - return cautils.StringInSlice(YAML_PREFIX, filepath.Ext(filePath)) != cautils.ValueNotFound + return cautils.StringInSlice(JSON_PREFIX, filepath.Ext(filePath)) != cautils.ValueNotFound } func getFileFormat(filePath string) FileFormat { diff --git a/resourcehandler/filesloader_test.go b/resourcehandler/filesloader_test.go index 6ff81e08..5d2006c5 100644 --- a/resourcehandler/filesloader_test.go +++ b/resourcehandler/filesloader_test.go @@ -1,11 +1,12 @@ package resourcehandler import ( - "fmt" "os" "path/filepath" "strings" "testing" + + "github.com/stretchr/testify/assert" ) func onlineBoutiquePath() string { @@ -14,32 +15,26 @@ func onlineBoutiquePath() string { } func TestListFiles(t *testing.T) { - workDir, err := os.Getwd() - fmt.Printf("\n------------------\n%s,%v\n--------------\n", workDir, err) + filesPath := onlineBoutiquePath() - fmt.Printf("\n------------------\n%s\n--------------\n", filesPath) files, errs := listFiles([]string{filesPath}) - if len(errs) > 0 { - t.Error(errs) - } - expected := 12 - if len(files) != expected { - t.Errorf("wrong number of files, expected: %d, found: %d", expected, len(files)) - } + assert.Equal(t, 0, len(errs)) + assert.Equal(t, 12, len(files)) } func TestLoadFiles(t *testing.T) { files, _ := listFiles([]string{onlineBoutiquePath()}) - loadFiles(files) + _, err := loadFiles(files) + assert.Equal(t, 0, len(err)) } func TestLoadFile(t *testing.T) { files, _ := listFiles([]string{strings.Replace(onlineBoutiquePath(), "*", "adservice.yaml", 1)}) + assert.Equal(t, 1, len(files)) + _, err := loadFile(files[0]) - if err != nil { - t.Errorf("%v", err) - } + assert.NoError(t, err) } func TestMapResources(t *testing.T) { // policyHandler := &PolicyHandler{} diff --git a/resourcehandler/registrydata.go b/resourcehandler/registrydata.go index c08e270b..10503a18 100644 --- a/resourcehandler/registrydata.go +++ b/resourcehandler/registrydata.go @@ -141,7 +141,7 @@ func listAdaptores() ([]registryvulnerabilities.IContainerImageVulnerabilityAdap armoAPI := getter.GetArmoAPIConnector() if armoAPI != nil { - if armoAPI.GetAccessKey() != "" && armoAPI.GetClientID() != "" && armoAPI.GetAccountID() != "" { + if armoAPI.GetSecretKey() != "" && armoAPI.GetClientID() != "" && armoAPI.GetAccountID() != "" { adaptors = append(adaptors, armosecadaptorv1.NewArmoAdaptor(getter.GetArmoAPIConnector())) } } From e399012f73eef3457ffd3f821f2a5dcfbe6fd6d3 Mon Sep 17 00:00:00 2001 From: dwertent Date: Mon, 7 Feb 2022 17:36:47 +0200 Subject: [PATCH 5/5] fixed glob files --- resourcehandler/filesloader.go | 43 ++++++++++++++++++++++++++++++---- 1 file changed, 39 insertions(+), 4 deletions(-) diff --git a/resourcehandler/filesloader.go b/resourcehandler/filesloader.go index 2cd18fa5..28b0540c 100644 --- a/resourcehandler/filesloader.go +++ b/resourcehandler/filesloader.go @@ -195,11 +195,15 @@ func listFiles(patterns []string) ([]string, []error) { o, _ := os.Getwd() patterns[i] = filepath.Join(o, patterns[i]) } - f, err := filepath.Glob(patterns[i]) - if err != nil { - errs = append(errs, err) + if isFile(patterns[i]) { + files = append(files, patterns[i]) } else { - files = append(files, f...) + f, err := glob(filepath.Split(patterns[i])) //filepath.Glob(patterns[i]) + if err != nil { + errs = append(errs, err) + } else { + files = append(files, f...) + } } } return files, errs @@ -284,6 +288,37 @@ func isJson(filePath string) bool { return cautils.StringInSlice(JSON_PREFIX, filepath.Ext(filePath)) != cautils.ValueNotFound } +func glob(root, pattern string) ([]string, error) { + var matches []string + + err := filepath.Walk(root, func(path string, info os.FileInfo, err error) error { + if err != nil { + return err + } + if info.IsDir() { + return nil + } + if matched, err := filepath.Match(pattern, filepath.Base(path)); err != nil { + return err + } else if matched { + matches = append(matches, path) + } + return nil + }) + if err != nil { + return nil, err + } + return matches, nil +} +func isFile(name string) bool { + if fi, err := os.Stat(name); err == nil { + if fi.Mode().IsRegular() { + return true + } + } + return false +} + func getFileFormat(filePath string) FileFormat { if isYaml(filePath) { return YAML_FILE_FORMAT