From e3f70b6cd64494ff09e9e936f170ba5813906496 Mon Sep 17 00:00:00 2001 From: shm12 Date: Tue, 21 Jun 2022 17:55:18 +0300 Subject: [PATCH 1/2] Added host sensor new resources --- core/cautils/workloadmappingutils.go | 5 ++- .../hostsensorutils/hostsensorgetfrompod.go | 33 +++++++++++++++++++ core/pkg/hostsensorutils/utils.go | 4 +++ core/pkg/resourcehandler/k8sresourcesutils.go | 4 +++ 4 files changed, 45 insertions(+), 1 deletion(-) diff --git a/core/cautils/workloadmappingutils.go b/core/cautils/workloadmappingutils.go index 4fa94abe..8c1315c2 100644 --- a/core/cautils/workloadmappingutils.go +++ b/core/cautils/workloadmappingutils.go @@ -14,7 +14,10 @@ var ( "KernelVersion", "LinuxSecurityHardeningStatus", "OpenPortsList", - "LinuxKernelVariables"} + "LinuxKernelVariables", + "KubeletInfo", + "KubeProxyInfo", + } CloudResources = []string{"ClusterDescribe"} ) diff --git a/core/pkg/hostsensorutils/hostsensorgetfrompod.go b/core/pkg/hostsensorutils/hostsensorgetfrompod.go index 60801793..782a0924 100644 --- a/core/pkg/hostsensorutils/hostsensorgetfrompod.go +++ b/core/pkg/hostsensorutils/hostsensorgetfrompod.go @@ -109,6 +109,18 @@ func (hsh *HostSensorHandler) GetLinuxSecurityHardeningStatus() ([]hostsensor.Ho return hsh.sendAllPodsHTTPGETRequest("/linuxSecurityHardening", "LinuxSecurityHardeningStatus") } +// return list of KubeletInfo +func (hsh *HostSensorHandler) GetKubeletInfo() ([]hostsensor.HostSensorDataEnvelope, error) { + // loop over pods and port-forward it to each of them + return hsh.sendAllPodsHTTPGETRequest("/kubeletInfo", "KubeletInfo") +} + +// return list of KubeProxyInfo +func (hsh *HostSensorHandler) GetKubeProxyInfo() ([]hostsensor.HostSensorDataEnvelope, error) { + // loop over pods and port-forward it to each of them + return hsh.sendAllPodsHTTPGETRequest("/kubeProxyInfo", "KubeProxyInfo") +} + // return list of KubeletCommandLine func (hsh *HostSensorHandler) GetKubeletCommandLine() ([]hostsensor.HostSensorDataEnvelope, error) { // loop over pods and port-forward it to each of them @@ -228,6 +240,27 @@ func (hsh *HostSensorHandler) CollectResources() ([]hostsensor.HostSensorDataEnv if len(kcData) > 0 { res = append(res, kcData...) } + + // GetKubeletInfo + kcData, err = hsh.GetKubeletInfo() + if err != nil { + addInfoToMap(KubeletInfo, infoMap, err) + logger.L().Warning(err.Error()) + } + if len(kcData) > 0 { + res = append(res, kcData...) + } + + // GetKubeProxyInfo + kcData, err = hsh.GetKubeProxyInfo() + if err != nil { + addInfoToMap(KubeProxyInfo, infoMap, err) + logger.L().Warning(err.Error()) + } + if len(kcData) > 0 { + res = append(res, kcData...) + } + logger.L().Debug("Done reading information from host scanner") return res, infoMap, nil } diff --git a/core/pkg/hostsensorutils/utils.go b/core/pkg/hostsensorutils/utils.go index dd9f9c10..2de26f97 100644 --- a/core/pkg/hostsensorutils/utils.go +++ b/core/pkg/hostsensorutils/utils.go @@ -13,6 +13,8 @@ var ( OpenPortsList = "OpenPortsList" LinuxKernelVariables = "LinuxKernelVariables" KubeletCommandLine = "KubeletCommandLine" + KubeletInfo = "KubeletInfo" + KubeProxyInfo = "KubeProxyInfo" MapHostSensorResourceToApiGroup = map[string]string{ KubeletConfiguration: "hostdata.kubescape.cloud/v1beta0", @@ -22,6 +24,8 @@ var ( LinuxSecurityHardeningStatus: "hostdata.kubescape.cloud/v1beta0", OpenPortsList: "hostdata.kubescape.cloud/v1beta0", LinuxKernelVariables: "hostdata.kubescape.cloud/v1beta0", + KubeletInfo: "hostdata.kubescape.cloud/v1beta0", + KubeProxyInfo: "hostdata.kubescape.cloud/v1beta0", } ) diff --git a/core/pkg/resourcehandler/k8sresourcesutils.go b/core/pkg/resourcehandler/k8sresourcesutils.go index 91839727..443f9624 100644 --- a/core/pkg/resourcehandler/k8sresourcesutils.go +++ b/core/pkg/resourcehandler/k8sresourcesutils.go @@ -20,6 +20,8 @@ var ( LinuxKernelVariables = "LinuxKernelVariables" KubeletCommandLine = "KubeletCommandLine" ImageVulnerabilities = "ImageVulnerabilities" + KubeletInfo = "KubeletInfo" + KubeProxyInfo = "KubeProxyInfo" MapResourceToApiGroup = map[string]string{ KubeletConfiguration: "hostdata.kubescape.cloud/v1beta0", @@ -29,6 +31,8 @@ var ( LinuxSecurityHardeningStatus: "hostdata.kubescape.cloud/v1beta0", OpenPortsList: "hostdata.kubescape.cloud/v1beta0", LinuxKernelVariables: "hostdata.kubescape.cloud/v1beta0", + KubeletInfo: "hostdata.kubescape.cloud/v1beta0", + KubeProxyInfo: "hostdata.kubescape.cloud/v1beta0", } MapResourceToApiGroupVuln = map[string][]string{ ImageVulnerabilities: {"armo.vuln.images/v1", "image.vulnscan.com/v1"}} From ee4f4d8af1603fe2565b6082aa7d3dd4c0b3520f Mon Sep 17 00:00:00 2001 From: Amir Malka Date: Tue, 28 Jun 2022 11:31:11 +0300 Subject: [PATCH 2/2] remove error when reading yaml Remove an error if we try to read YAML file which is not a map[string]interface{} --- core/cautils/fileutils.go | 2 -- 1 file changed, 2 deletions(-) diff --git a/core/cautils/fileutils.go b/core/cautils/fileutils.go index 1def07c0..a782d040 100644 --- a/core/cautils/fileutils.go +++ b/core/cautils/fileutils.go @@ -148,8 +148,6 @@ func readYamlFile(yamlFile []byte) ([]workloadinterface.IMetadata, []error) { yamlObjs = append(yamlObjs, o) } } - } else { - errs = append(errs, fmt.Errorf("failed to convert yaml file to map[string]interface, file content: %v", j)) } }