From 3a4c06a8181060566336d39a378fd08c235ba21b Mon Sep 17 00:00:00 2001 From: dwertent Date: Sun, 3 Oct 2021 17:22:50 +0300 Subject: [PATCH 1/4] fixed issue #95 --- opaprocessor/processorhandler.go | 7 ++++++- policyhandler/handlepullpolicies.go | 5 ++--- policyhandler/k8sresources.go | 22 +++++++++++++++++----- 3 files changed, 25 insertions(+), 9 deletions(-) diff --git a/opaprocessor/processorhandler.go b/opaprocessor/processorhandler.go index b2546ab8..78c2f6a4 100644 --- a/opaprocessor/processorhandler.go +++ b/opaprocessor/processorhandler.go @@ -112,7 +112,9 @@ func (opap *OPAProcessor) processFramework(framework *opapolicy.Framework) (*opa if err != nil { errs = fmt.Errorf("%v\n%s", errs, err.Error()) } - controlReports = append(controlReports, *controlReport) + if controlReport != nil { + controlReports = append(controlReports, *controlReport) + } } frameworkReport.ControlReports = controlReports return &frameworkReport, errs @@ -139,6 +141,9 @@ func (opap *OPAProcessor) processControl(control *opapolicy.Control) (*opapolicy ruleReports = append(ruleReports, *ruleReport) } } + if len(ruleReports) == 0 { + return nil, nil + } controlReport.RuleReports = ruleReports return &controlReport, errs } diff --git a/policyhandler/handlepullpolicies.go b/policyhandler/handlepullpolicies.go index 5d335ac2..858ea5d9 100644 --- a/policyhandler/handlepullpolicies.go +++ b/policyhandler/handlepullpolicies.go @@ -18,14 +18,13 @@ func (policyHandler *PolicyHandler) GetPoliciesFromBackend(notification *opapoli switch rule.Kind { case opapolicy.KindFramework: receivedFramework, recExceptionPolicies, err := policyHandler.getFrameworkPolicies(rule.Name) - if err != nil { - return nil, nil, fmt.Errorf("kind: %v, name: %s, error: %s", rule.Kind, rule.Name, err.Error()) - } if receivedFramework != nil { frameworks = append(frameworks, *receivedFramework) if recExceptionPolicies != nil { exceptionPolicies = append(exceptionPolicies, recExceptionPolicies...) } + } else if err != nil { + return nil, nil, fmt.Errorf("kind: %v, name: %s, error: %s", rule.Kind, rule.Name, err.Error()) } default: diff --git a/policyhandler/k8sresources.go b/policyhandler/k8sresources.go index 082790de..f94a4252 100644 --- a/policyhandler/k8sresources.go +++ b/policyhandler/k8sresources.go @@ -65,11 +65,8 @@ func (policyHandler *PolicyHandler) pullSingleResource(resource *schema.GroupVer // set labels listOptions := metav1.ListOptions{} - if excludedNamespaces != "" && k8sinterface.IsNamespaceScope(resource.Group, resource.Resource) { - excludedNamespacesSlice := strings.Split(excludedNamespaces, ",") - for _, excludedNamespace := range excludedNamespacesSlice { - listOptions.FieldSelector += "metadata.namespace!=" + excludedNamespace + "," - } + if excludedNamespaces != "" { + setFieldSelector(&listOptions, resource, excludedNamespaces) } if len(labels) > 0 { set := k8slabels.Set(labels) @@ -93,3 +90,18 @@ func (policyHandler *PolicyHandler) pullSingleResource(resource *schema.GroupVer return result.Items, nil } + +func setFieldSelector(listOptions *metav1.ListOptions, resource *schema.GroupVersionResource, excludedNamespaces string) { + fieldSelector := "metadata." + if resource.Resource == "namespaces" { + fieldSelector += "name" + } else if k8sinterface.IsNamespaceScope(resource.Group, resource.Resource) { + fieldSelector += "namespace" + } else { + return + } + excludedNamespacesSlice := strings.Split(excludedNamespaces, ",") + for _, excludedNamespace := range excludedNamespacesSlice { + listOptions.FieldSelector += fmt.Sprintf("%s!=%s,", fieldSelector, excludedNamespace) + } +} From f0cd1965b40cccdb35306e2c8917d702664c2e34 Mon Sep 17 00:00:00 2001 From: Avner Tzur Date: Mon, 4 Oct 2021 13:51:47 +0300 Subject: [PATCH 2/4] update git repo URL using https --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 5e4bd782..701c1bf5 100644 --- a/README.md +++ b/README.md @@ -123,7 +123,7 @@ Note: development (and the release process) is done with Go `1.16` 1. Clone Project ``` -git clone git@github.com:armosec/kubescape.git kubescape && cd "$_" +git clone https://github.com/armosec/kubescape.git kubescape && cd "$_" ``` 2. Build @@ -142,7 +142,7 @@ go mod tidy && go build -o kubescape . 1. Clone Project ``` -git clone git@github.com:armosec/kubescape.git kubescape && cd "$_" +git clone https://github.com/armosec/kubescape.git kubescape && cd "$_" ``` 2. Build From 27d00b58d7945c84f6070581db9e75627131fd1d Mon Sep 17 00:00:00 2001 From: dwertent Date: Mon, 4 Oct 2021 15:15:18 +0300 Subject: [PATCH 3/4] Adding star to readme, support wild labels --- README.md | 2 ++ scapepkg/exceptions/exceptionprocessor.go | 17 ++++++++++++----- 2 files changed, 14 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 5e4bd782..8451864d 100644 --- a/README.md +++ b/README.md @@ -24,6 +24,8 @@ If you wish to scan all namespaces in your cluster, remove the `--exclude-namesp +### Click [👍](https://github.com/armosec/kubescape/stargazers) if you want us to continue to develop and improve Kubescape 😀 + # Being part of the team We invite you to our team! We are excited about this project and want to return the love we get. diff --git a/scapepkg/exceptions/exceptionprocessor.go b/scapepkg/exceptions/exceptionprocessor.go index 6e4bdef1..eb0528b0 100644 --- a/scapepkg/exceptions/exceptionprocessor.go +++ b/scapepkg/exceptions/exceptionprocessor.go @@ -1,6 +1,8 @@ package exceptions import ( + "regexp" + "github.com/armosec/kubescape/cautils" "github.com/armosec/kubescape/cautils/k8sinterface" @@ -96,7 +98,7 @@ func hasException(designator *armotypes.PortalDesignator, workload k8sinterface. return false // if designators are empty } - if cluster != "" && cautils.ClusterName != "" && cluster != cautils.ClusterName { // TODO - where do we receive cluster name from? + if cluster != "" && cautils.ClusterName != "" && regexCompare(cluster, cautils.ClusterName) { // TODO - where do we receive cluster name from? return false // cluster name does not match } @@ -120,17 +122,17 @@ func hasException(designator *armotypes.PortalDesignator, workload k8sinterface. func compareNamespace(workload k8sinterface.IWorkload, namespace string) bool { if workload.GetKind() == "Namespace" { - return namespace == workload.GetName() + return regexCompare(namespace, workload.GetName()) } - return namespace == workload.GetNamespace() + return regexCompare(namespace, workload.GetNamespace()) } func compareKind(workload k8sinterface.IWorkload, kind string) bool { - return kind == workload.GetKind() + return regexCompare(kind, workload.GetKind()) } func compareName(workload k8sinterface.IWorkload, name string) bool { - return name == workload.GetName() + return regexCompare(workload.GetName(), name) } func compareLabels(workload k8sinterface.IWorkload, attributes map[string]string) bool { @@ -139,3 +141,8 @@ func compareLabels(workload k8sinterface.IWorkload, attributes map[string]string return designators.Matches(workloadLabels) } + +func regexCompare(reg, name string) bool { + r, _ := regexp.MatchString(reg, name) + return r +} From 25247491eeed6c8d9b3c7343b3c74137022f4e4b Mon Sep 17 00:00:00 2001 From: yiscah Date: Mon, 4 Oct 2021 16:56:18 +0300 Subject: [PATCH 4/4] add mitre to supportedFrameworks, accept upper/lowercase "MITRE" --- cmd/framework.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/cmd/framework.go b/cmd/framework.go index 1487e0fa..e247e183 100644 --- a/cmd/framework.go +++ b/cmd/framework.go @@ -23,7 +23,7 @@ import ( ) var scanInfo cautils.ScanInfo -var supportedFrameworks = []string{"nsa"} +var supportedFrameworks = []string{"nsa", "mitre"} type CLIHandler struct { policyHandler *policyhandler.PolicyHandler @@ -39,7 +39,7 @@ var frameworkCmd = &cobra.Command{ if len(args) < 1 && !(cmd.Flags().Lookup("use-from").Changed) { return fmt.Errorf("requires at least one argument") } else if len(args) > 0 { - if !isValidFramework(args[0]) { + if !isValidFramework(strings.ToLower(args[0])) { return fmt.Errorf(fmt.Sprintf("supported frameworks: %s", strings.Join(supportedFrameworks, ", "))) } } @@ -50,7 +50,7 @@ var frameworkCmd = &cobra.Command{ scanInfo.PolicyIdentifier.Kind = opapolicy.KindFramework if !(cmd.Flags().Lookup("use-from").Changed) { - scanInfo.PolicyIdentifier.Name = args[0] + scanInfo.PolicyIdentifier.Name = strings.ToLower(args[0]) } if len(args) > 0 { if len(args[1:]) == 0 || args[1] != "-" {