From 8f9b46cdbea6fdeda1818b8ecdb854a09c4ff82a Mon Sep 17 00:00:00 2001 From: dwertent Date: Wed, 16 Mar 2022 09:25:45 +0200 Subject: [PATCH] update prometheus format --- build/Dockerfile | 1 + .../printer/v2/prometheusutils.go | 60 +++++++++---------- httphandler/examples/prometheus/README.md | 4 +- httphandler/handlerequests/v1/prometheus.go | 28 +++------ .../handlerequests/v1/requestshandlerutils.go | 33 ++++++++++ httphandler/listener/setup.go | 3 + 6 files changed, 77 insertions(+), 52 deletions(-) diff --git a/build/Dockerfile b/build/Dockerfile index 9e1668de..d72180d0 100644 --- a/build/Dockerfile +++ b/build/Dockerfile @@ -33,6 +33,7 @@ FROM alpine RUN addgroup -S ks && adduser -S ks -G ks USER ks +WORKDIR /home/ks/ COPY --from=builder /work/httphandler/build/ubuntu-latest/kubescape /usr/bin/kubescape COPY --from=builder /work/build/ubuntu-latest/kubescape /usr/bin/kscli diff --git a/core/pkg/resultshandling/printer/v2/prometheusutils.go b/core/pkg/resultshandling/printer/v2/prometheusutils.go index 0d1537e4..11a44dbc 100644 --- a/core/pkg/resultshandling/printer/v2/prometheusutils.go +++ b/core/pkg/resultshandling/printer/v2/prometheusutils.go @@ -21,13 +21,13 @@ const ( ) func (mrs *mRiskScore) string() string { - r := fmt.Sprintf("resourcesCountFailed: \"%d\"", mrs.resourcesCountFailed) + ", " - r += fmt.Sprintf("resourcesCountExcluded: \"%d\"", mrs.resourcesCountExcluded) + ", " - r += fmt.Sprintf("resourcesCountPassed: \"%d\"", mrs.resourcesCountPassed) + ", " - r += fmt.Sprintf("controlsCountFailed: \"%d\"", mrs.controlsCountFailed) + ", " - r += fmt.Sprintf("controlsCountExcluded: \"%d\"", mrs.controlsCountExcluded) + ", " - r += fmt.Sprintf("controlsCountPassed: \"%d\"", mrs.controlsCountPassed) + ", " - r += fmt.Sprintf("controlsCountSkipped: \"%d\"", mrs.controlsCountSkipped) + ", " + r := fmt.Sprintf("resourcesCountFailed=\"%d\"", mrs.resourcesCountFailed) + "," + r += fmt.Sprintf("resourcesCountExcluded=\"%d\"", mrs.resourcesCountExcluded) + "," + r += fmt.Sprintf("resourcesCountPassed=\"%d\"", mrs.resourcesCountPassed) + "," + r += fmt.Sprintf("controlsCountFailed=\"%d\"", mrs.controlsCountFailed) + "," + r += fmt.Sprintf("controlsCountExcluded=\"%d\"", mrs.controlsCountExcluded) + "," + r += fmt.Sprintf("controlsCountPassed=\"%d\"", mrs.controlsCountPassed) + "," + r += fmt.Sprintf("controlsCountSkipped=\"%d\"", mrs.controlsCountSkipped) return r } func (mrs *mRiskScore) value() int { @@ -35,14 +35,14 @@ func (mrs *mRiskScore) value() int { } func (mcrs *mControlRiskScore) string() string { - r := fmt.Sprintf("controlName: \"%s\"", mcrs.controlName) + ", " - r += fmt.Sprintf("controlID: \"%s\"", mcrs.controlID) + ", " - r += fmt.Sprintf("severity: \"%s\"", mcrs.severity) + ", " - r += fmt.Sprintf("resourcesCountFailed: \"%d\"", mcrs.resourcesCountFailed) + ", " - r += fmt.Sprintf("resourcesCountExcluded: \"%d\"", mcrs.resourcesCountExcluded) + ", " - r += fmt.Sprintf("resourcesCountPassed: \"%d\"", mcrs.resourcesCountPassed) + ", " - r += fmt.Sprintf("link: \"%s\"", mcrs.link) + ", " - r += fmt.Sprintf("remediation: \"%s\"", mcrs.remediation) + r := fmt.Sprintf("controlName=\"%s\"", mcrs.controlName) + "," + r += fmt.Sprintf("controlID=\"%s\"", mcrs.controlID) + "," + r += fmt.Sprintf("severity=\"%s\"", mcrs.severity) + "," + r += fmt.Sprintf("resourcesCountFailed=\"%d\"", mcrs.resourcesCountFailed) + "," + r += fmt.Sprintf("resourcesCountExcluded=\"%d\"", mcrs.resourcesCountExcluded) + "," + r += fmt.Sprintf("resourcesCountPassed=\"%d\"", mcrs.resourcesCountPassed) + "," + r += fmt.Sprintf("link=\"%s\"", mcrs.link) + "," + r += fmt.Sprintf("remediation=\"%s\"", mcrs.remediation) return r } func (mcrs *mControlRiskScore) value() int { @@ -50,24 +50,24 @@ func (mcrs *mControlRiskScore) value() int { } func (mfrs *mFrameworkRiskScore) string() string { - r := fmt.Sprintf("frameworkName: \"%s\"", mfrs.frameworkName) + ", " - r += fmt.Sprintf("resourcesCountFailed: \"%d\"", mfrs.resourcesCountFailed) + ", " - r += fmt.Sprintf("resourcesCountExcluded: \"%d\"", mfrs.resourcesCountExcluded) + ", " - r += fmt.Sprintf("resourcesCountPassed: \"%d\"", mfrs.resourcesCountPassed) + ", " - r += fmt.Sprintf("controlsCountFailed: \"%d\"", mfrs.controlsCountFailed) - r += fmt.Sprintf("controlsCountExcluded: \"%d\"", mfrs.controlsCountExcluded) + ", " - r += fmt.Sprintf("controlsCountPassed: \"%d\"", mfrs.controlsCountPassed) + ", " - r += fmt.Sprintf("controlsCountSkipped: \"%d\"", mfrs.controlsCountSkipped) + ", " + r := fmt.Sprintf("frameworkName=\"%s\"", mfrs.frameworkName) + "," + r += fmt.Sprintf("resourcesCountFailed=\"%d\"", mfrs.resourcesCountFailed) + "," + r += fmt.Sprintf("resourcesCountExcluded=\"%d\"", mfrs.resourcesCountExcluded) + "," + r += fmt.Sprintf("resourcesCountPassed=\"%d\"", mfrs.resourcesCountPassed) + "," + r += fmt.Sprintf("controlsCountFailed=\"%d\"", mfrs.controlsCountFailed) + "," + r += fmt.Sprintf("controlsCountExcluded=\"%d\"", mfrs.controlsCountExcluded) + "," + r += fmt.Sprintf("controlsCountPassed=\"%d\"", mfrs.controlsCountPassed) + "," + r += fmt.Sprintf("controlsCountSkipped=\"%d\"", mfrs.controlsCountSkipped) return r } func (mfrs *mFrameworkRiskScore) value() int { return mfrs.riskScore } func (mrc *mResourceControls) string() string { - r := fmt.Sprintf("apiVersion: \"%s\"", mrc.apiVersion) + ", " - r += fmt.Sprintf("kind: \"%s\"", mrc.kind) + ", " - r += fmt.Sprintf("namespace: \"%s\"", mrc.namespace) + ", " - r += fmt.Sprintf("name: \"%s\"", mrc.name) + r := fmt.Sprintf("apiVersion=\"%s\"", mrc.apiVersion) + "," + r += fmt.Sprintf("kind=\"%s\"", mrc.kind) + "," + r += fmt.Sprintf("namespace=\"%s\"", mrc.namespace) + "," + r += fmt.Sprintf("name=\"%s\"", mrc.name) return r } func (mrc *mResourceControls) value() int { @@ -80,12 +80,12 @@ func toRowInMetrics(name metricsName, row string, value int) string { func (m *Metrics) String() string { r := toRowInMetrics(metricsScore, m.rs.string(), m.rs.value()) - for i := range m.listControls { - r += toRowInMetrics(metricsControlScore, m.listControls[i].string(), m.listControls[i].value()) - } for i := range m.listFrameworks { r += toRowInMetrics(metricsFrameworkScore, m.listFrameworks[i].string(), m.listFrameworks[i].value()) } + for i := range m.listControls { + r += toRowInMetrics(metricsControlScore, m.listControls[i].string(), m.listControls[i].value()) + } for i := range m.listResourcesControlsFiled { r += toRowInMetrics(metricsresourceFailed, m.listResourcesControlsFiled[i].string(), m.listResourcesControlsFiled[i].value()) } diff --git a/httphandler/examples/prometheus/README.md b/httphandler/examples/prometheus/README.md index 0b44de39..655ef3e6 100644 --- a/httphandler/examples/prometheus/README.md +++ b/httphandler/examples/prometheus/README.md @@ -10,11 +10,11 @@ ```bash helm repo add prometheus-community https://prometheus-community.github.io/helm-charts helm repo update - kubectl create namescape prometheus + kubectl create namespace prometheus helm install -n prometheus kube-prometheus-stack prometheus-community/kube-prometheus-stack --set prometheus.prometheusSpec.podMonitorSelectorNilUsesHelmValues=false,prometheus.prometheusSpec.serviceMonitorSelectorNilUsesHelmValues=false ``` 3. Deploy pod monitor ```bash kubectl apply -f podmonitor.yaml ``` - + \ No newline at end of file diff --git a/httphandler/handlerequests/v1/prometheus.go b/httphandler/handlerequests/v1/prometheus.go index 60fb2a4b..fc75bbc3 100644 --- a/httphandler/handlerequests/v1/prometheus.go +++ b/httphandler/handlerequests/v1/prometheus.go @@ -6,11 +6,9 @@ import ( "os" "github.com/armosec/kubescape/core/cautils" - "github.com/armosec/kubescape/core/cautils/getter" "github.com/armosec/kubescape/core/cautils/logger" "github.com/armosec/kubescape/core/cautils/logger/helpers" "github.com/armosec/kubescape/core/core" - pkgcautils "github.com/armosec/utils-go/utils" "github.com/google/uuid" ) @@ -56,23 +54,13 @@ func (handler *HTTPHandler) Metrics(w http.ResponseWriter, r *http.Request) { } func getPrometheusDefaultScanCommand(scanID string) *cautils.ScanInfo { - scanInfo := cautils.ScanInfo{} + scanInfo := defaultScanInfo() scanInfo.FrameworkScan = true - scanInfo.ScanAll = true // scan all frameworks - scanInfo.ReportID = scanID // scan ID - scanInfo.HostSensorEnabled.Set(os.Getenv("KS_ENABLE_HOST_SCANNER")) // enable host scanner - scanInfo.FailThreshold = 100 // Do not fail scanning - scanInfo.Format = "prometheus" // results format - scanInfo.Output = scanID // results output - scanInfo.Local = true // Do not publish results to Kubescape SaaS - if !downloadArtifactsEveryScan() { - scanInfo.UseArtifactsFrom = getter.DefaultLocalStore // Load files from cache (this will prevent kubescape fom downloading the artifacts every time) - } - return &scanInfo -} -func downloadArtifactsEveryScan() bool { - if d, ok := os.LookupEnv("KS_DOWNLOAD_ARTIFACTS"); ok { - return pkgcautils.StringToBool(d) - } - return false + scanInfo.ScanAll = true // scan all frameworks + scanInfo.ReportID = scanID // scan ID + scanInfo.FailThreshold = 100 // Do not fail scanning + scanInfo.Output = scanID // results output + scanInfo.Format = envToString("KS_FORMAT", "prometheus") // default output should be json + scanInfo.HostSensorEnabled.SetBool(envToBool("KS_ENABLE_HOST_SCANNER", false)) // enable host scanner + return scanInfo } diff --git a/httphandler/handlerequests/v1/requestshandlerutils.go b/httphandler/handlerequests/v1/requestshandlerutils.go index a90fce47..9e23ee78 100644 --- a/httphandler/handlerequests/v1/requestshandlerutils.go +++ b/httphandler/handlerequests/v1/requestshandlerutils.go @@ -5,7 +5,10 @@ import ( "os" "path/filepath" + pkgcautils "github.com/armosec/utils-go/utils" + "github.com/armosec/kubescape/core/cautils" + "github.com/armosec/kubescape/core/cautils/getter" "github.com/armosec/kubescape/core/core" ) @@ -97,3 +100,33 @@ func getScanCommand(scanRequest *PostScanRequest, scanID string) *cautils.ScanIn return scanInfo } + +func defaultScanInfo() *cautils.ScanInfo { + scanInfo := &cautils.ScanInfo{} + scanInfo.Account = envToString("KS_ACCOUNT", "") // publish results to Kubescape SaaS + scanInfo.ExcludedNamespaces = envToString("KS_EXCLUDE_NAMESPACES", "") // namespace to exclude + scanInfo.IncludeNamespaces = envToString("KS_INCLUDE_NAMESPACES", "") // namespace to include + scanInfo.FormatVersion = envToString("KS_FORMAT_VERSION", "v2") // output format version + scanInfo.Format = envToString("KS_FORMAT", "json") // default output should be json + scanInfo.Submit = envToBool("KS_SUBMIT", false) // publish results to Kubescape SaaS + scanInfo.HostSensorEnabled.SetBool(envToBool("KS_ENABLE_HOST_SCANNER", true)) // enable host scanner + scanInfo.Local = envToBool("KS_KEEP_LOCAL", false) // do not publish results to Kubescape SaaS + if !envToBool("KS_DOWNLOAD_ARTIFACTS", false) { + scanInfo.UseArtifactsFrom = getter.DefaultLocalStore // Load files from cache (this will prevent kubescape fom downloading the artifacts every time) + } + return scanInfo +} + +func envToBool(env string, defaultValue bool) bool { + if d, ok := os.LookupEnv(env); ok { + return pkgcautils.StringToBool(d) + } + return defaultValue +} + +func envToString(env string, defaultValue string) string { + if d, ok := os.LookupEnv(env); ok { + return d + } + return defaultValue +} diff --git a/httphandler/listener/setup.go b/httphandler/listener/setup.go index 1689d72f..8f8ae7b8 100644 --- a/httphandler/listener/setup.go +++ b/httphandler/listener/setup.go @@ -9,6 +9,7 @@ import ( "github.com/armosec/kubescape/core/cautils" "github.com/armosec/kubescape/core/cautils/logger" "github.com/armosec/kubescape/core/cautils/logger/helpers" + "github.com/armosec/kubescape/core/cautils/logger/zaplogger" handlerequestsv1 "github.com/armosec/kubescape/httphandler/handlerequests/v1" "github.com/gorilla/mux" ) @@ -23,6 +24,8 @@ const ( // SetupHTTPListener set up listening http servers func SetupHTTPListener() error { + logger.InitLogger(zaplogger.LoggerName) + keyPair, err := loadTLSKey("", "") // TODO - support key and crt files if err != nil { return err