From 21cb4dae2947abe1e2de426cf8ba3a721be7395a Mon Sep 17 00:00:00 2001 From: DanielGrunbergerCA Date: Wed, 13 Apr 2022 11:30:51 +0300 Subject: [PATCH 1/4] fix skipped for controlsd which use both armo and k8s resources --- core/pkg/opaprocessor/processorhandlerutils.go | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/core/pkg/opaprocessor/processorhandlerutils.go b/core/pkg/opaprocessor/processorhandlerutils.go index 500c64f3..f101930d 100644 --- a/core/pkg/opaprocessor/processorhandlerutils.go +++ b/core/pkg/opaprocessor/processorhandlerutils.go @@ -8,6 +8,7 @@ import ( "github.com/armosec/k8s-interface/workloadinterface" "github.com/armosec/opa-utils/reporthandling" "github.com/armosec/opa-utils/reporthandling/apis" + "github.com/armosec/opa-utils/reporthandling/results/v1/reportsummary" resources "github.com/armosec/opa-utils/resources" ) @@ -46,7 +47,7 @@ func (opap *OPAProcessor) updateResults() { // set result summary // map control to error - controlToInfoMap := mapControlToInfo(opap.ResourceToControlsMap, opap.InfoMap) + controlToInfoMap := mapControlToInfo(opap.ResourceToControlsMap, opap.InfoMap, opap.Report.SummaryDetails.Controls) opap.Report.SummaryDetails.InitResourcesSummary(controlToInfoMap) // for f := range opap.PostureReport.FrameworkReports { // // set exceptions @@ -60,17 +61,23 @@ func (opap *OPAProcessor) updateResults() { // } } -func mapControlToInfo(mapResourceToControls map[string][]string, infoMap map[string]apis.StatusInfo) map[string]apis.StatusInfo { +func mapControlToInfo(mapResourceToControls map[string][]string, infoMap map[string]apis.StatusInfo, controlSummary reportsummary.ControlSummaries) map[string]apis.StatusInfo { controlToInfoMap := make(map[string]apis.StatusInfo) for resource, statusInfo := range infoMap { controls := mapResourceToControls[resource] for _, control := range controls { - controlToInfoMap[control] = statusInfo + if isEmptyResources(controlSummary[control].ResourceCounters) { + controlToInfoMap[control] = statusInfo + } } } return controlToInfoMap } +func isEmptyResources(counters reportsummary.ResourceCounters) bool { + return counters.FailedResources == 0 && counters.ExcludedResources == 0 && counters.PassedResources == 0 +} + func getAllSupportedObjects(k8sResources *cautils.K8SResources, armoResources *cautils.ArmoResources, allResources map[string]workloadinterface.IMetadata, rule *reporthandling.PolicyRule) []workloadinterface.IMetadata { k8sObjects := []workloadinterface.IMetadata{} k8sObjects = append(k8sObjects, getKubernetesObjects(k8sResources, allResources, rule.Match)...) From 847b597d0fbe01956acd5f530cb217c0d182b04d Mon Sep 17 00:00:00 2001 From: DanielGrunbergerCA Date: Mon, 25 Apr 2022 09:32:28 +0300 Subject: [PATCH 2/4] use iface --- core/pkg/opaprocessor/processorhandlerutils.go | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/core/pkg/opaprocessor/processorhandlerutils.go b/core/pkg/opaprocessor/processorhandlerutils.go index f101930d..8587b637 100644 --- a/core/pkg/opaprocessor/processorhandlerutils.go +++ b/core/pkg/opaprocessor/processorhandlerutils.go @@ -66,7 +66,8 @@ func mapControlToInfo(mapResourceToControls map[string][]string, infoMap map[str for resource, statusInfo := range infoMap { controls := mapResourceToControls[resource] for _, control := range controls { - if isEmptyResources(controlSummary[control].ResourceCounters) { + counters := controlSummary[control].ResourceCounters + if isEmptyResources(&counters) { controlToInfoMap[control] = statusInfo } } @@ -74,8 +75,8 @@ func mapControlToInfo(mapResourceToControls map[string][]string, infoMap map[str return controlToInfoMap } -func isEmptyResources(counters reportsummary.ResourceCounters) bool { - return counters.FailedResources == 0 && counters.ExcludedResources == 0 && counters.PassedResources == 0 +func isEmptyResources(counters reportsummary.ICounters) bool { + return counters.Failed() == 0 && counters.Excluded() == 0 && counters.Passed() == 0 } func getAllSupportedObjects(k8sResources *cautils.K8SResources, armoResources *cautils.ArmoResources, allResources map[string]workloadinterface.IMetadata, rule *reporthandling.PolicyRule) []workloadinterface.IMetadata { From 8d4bae06bc0d673fc91d448b73f36fd7ab9ae0f9 Mon Sep 17 00:00:00 2001 From: DanielGrunbergerCA Date: Mon, 25 Apr 2022 12:11:05 +0300 Subject: [PATCH 3/4] check that control is present --- core/pkg/opaprocessor/processorhandlerutils.go | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/core/pkg/opaprocessor/processorhandlerutils.go b/core/pkg/opaprocessor/processorhandlerutils.go index 8587b637..b2e569d7 100644 --- a/core/pkg/opaprocessor/processorhandlerutils.go +++ b/core/pkg/opaprocessor/processorhandlerutils.go @@ -64,11 +64,14 @@ func (opap *OPAProcessor) updateResults() { func mapControlToInfo(mapResourceToControls map[string][]string, infoMap map[string]apis.StatusInfo, controlSummary reportsummary.ControlSummaries) map[string]apis.StatusInfo { controlToInfoMap := make(map[string]apis.StatusInfo) for resource, statusInfo := range infoMap { - controls := mapResourceToControls[resource] - for _, control := range controls { - counters := controlSummary[control].ResourceCounters - if isEmptyResources(&counters) { - controlToInfoMap[control] = statusInfo + controlIDs := mapResourceToControls[resource] + for _, controlID := range controlIDs { + resources := controlSummary.GetControl(reportsummary.EControlCriteriaID, controlID).NumberOfResources() + if resources != nil { + // Check that there are no K8s resources too + if isEmptyResources(resources) { + controlToInfoMap[controlID] = statusInfo + } } } } From b72e2610ca7bde6ad959906c2385df2ff8850b4e Mon Sep 17 00:00:00 2001 From: DanielGrunbergerCA Date: Mon, 25 Apr 2022 12:14:48 +0300 Subject: [PATCH 4/4] check tat control is not nil --- core/pkg/opaprocessor/processorhandlerutils.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/core/pkg/opaprocessor/processorhandlerutils.go b/core/pkg/opaprocessor/processorhandlerutils.go index b2e569d7..8526bded 100644 --- a/core/pkg/opaprocessor/processorhandlerutils.go +++ b/core/pkg/opaprocessor/processorhandlerutils.go @@ -66,13 +66,15 @@ func mapControlToInfo(mapResourceToControls map[string][]string, infoMap map[str for resource, statusInfo := range infoMap { controlIDs := mapResourceToControls[resource] for _, controlID := range controlIDs { - resources := controlSummary.GetControl(reportsummary.EControlCriteriaID, controlID).NumberOfResources() - if resources != nil { + ctrl := controlSummary.GetControl(reportsummary.EControlCriteriaID, controlID) + if ctrl != nil { + resources := ctrl.NumberOfResources() // Check that there are no K8s resources too if isEmptyResources(resources) { controlToInfoMap[controlID] = statusInfo } } + } } return controlToInfoMap