diff --git a/core/cautils/workloadmappingutils.go b/core/cautils/workloadmappingutils.go index 12e493d0..0871b554 100644 --- a/core/cautils/workloadmappingutils.go +++ b/core/cautils/workloadmappingutils.go @@ -25,6 +25,7 @@ var ( CloudResources = []string{ cloudapis.CloudProviderDescribeKind, cloudapis.CloudProviderDescribeRepositoriesKind, + cloudapis.CloudProviderListEntitiesForPoliciesKind, string(cloudsupport.TypeApiServerInfo), } ) diff --git a/core/pkg/resourcehandler/k8sresources.go b/core/pkg/resourcehandler/k8sresources.go index 4520856a..062e75ea 100644 --- a/core/pkg/resourcehandler/k8sresources.go +++ b/core/pkg/resourcehandler/k8sresources.go @@ -14,6 +14,7 @@ import ( "github.com/kubescape/k8s-interface/cloudsupport" cloudapis "github.com/kubescape/k8s-interface/cloudsupport/apis" + cloudv1 "github.com/kubescape/k8s-interface/cloudsupport/v1" "github.com/kubescape/k8s-interface/k8sinterface" "github.com/kubescape/k8s-interface/workloadinterface" @@ -28,12 +29,12 @@ import ( "k8s.io/client-go/dynamic" ) -// cloudsupport.GetDescribeRepositoriesFromCloudProvider(clusterName, provider) type cloudResourceGetter func(string, string) (workloadinterface.IMetadata, error) var cloudResourceGetterMapping = map[string]cloudResourceGetter{ - cloudapis.CloudProviderDescribeKind: cloudsupport.GetDescriptiveInfoFromCloudProvider, - cloudapis.CloudProviderDescribeRepositoriesKind: cloudsupport.GetDescribeRepositoriesFromCloudProvider, + cloudapis.CloudProviderDescribeKind: cloudsupport.GetDescriptiveInfoFromCloudProvider, + cloudapis.CloudProviderDescribeRepositoriesKind: cloudsupport.GetDescribeRepositoriesFromCloudProvider, + cloudapis.CloudProviderListEntitiesForPoliciesKind: cloudsupport.GetListEntitiesForPoliciesFromCloudProvider, } type K8sResourceHandler struct { @@ -168,8 +169,7 @@ func (k8sHandler *K8sResourceHandler) collectCloudResources(sessionObj *cautils. logger.L().Debug("Collecting cloud data ", helpers.String("resourceKind", resourceKind)) wl, err := resourceGetter(clusterName, provider) if err != nil { - // can be removed when GKE and AKS are supported - if !strings.Contains(err.Error(), "not supported") { + if !strings.Contains(err.Error(), cloudv1.NotSupportedMsg) { // Return error with useful info on how to configure credentials for getting cloud provider info logger.L().Debug("failed to get cloud data", helpers.String("resourceKind", resourceKind), helpers.Error(err)) err = fmt.Errorf("failed to get %s descriptive information. Read more: https://hub.armosec.io/docs/kubescape-integration-with-cloud-providers", strings.ToUpper(provider)) diff --git a/core/pkg/resourcehandler/k8sresourcesutils.go b/core/pkg/resourcehandler/k8sresourcesutils.go index 253dc0cb..a3f8c6cb 100644 --- a/core/pkg/resourcehandler/k8sresourcesutils.go +++ b/core/pkg/resourcehandler/k8sresourcesutils.go @@ -13,6 +13,7 @@ import ( var ( ClusterDescribe = "ClusterDescribe" DescribeRepositories = "DescribeRepositories" + ListEntitiesForPolicies = "ListEntitiesForPolicies" KubeletConfiguration = "KubeletConfiguration" OsReleaseFile = "OsReleaseFile" KernelVersion = "KernelVersion" @@ -42,8 +43,9 @@ var ( MapResourceToApiGroupVuln = map[string][]string{ ImageVulnerabilities: {"armo.vuln.images/v1", "image.vulnscan.com/v1"}} MapResourceToApiGroupCloud = map[string][]string{ - ClusterDescribe: {"container.googleapis.com/v1", "eks.amazonaws.com/v1", "management.azure.com/v1"}, - DescribeRepositories: {"eks.amazonaws.com/v1"}, //TODO - add google and azure when they are supported + ClusterDescribe: {"container.googleapis.com/v1", "eks.amazonaws.com/v1", "management.azure.com/v1"}, + DescribeRepositories: {"eks.amazonaws.com/v1"}, //TODO - add google and azure when they are supported + ListEntitiesForPolicies: {"eks.amazonaws.com/v1"}, //TODO - add google and azure when they are supported } ) diff --git a/go.mod b/go.mod index 4acdfb8d..0cead4c2 100644 --- a/go.mod +++ b/go.mod @@ -18,7 +18,7 @@ require ( github.com/json-iterator/go v1.1.12 github.com/kubescape/go-git-url v0.0.23 github.com/kubescape/go-logger v0.0.6 - github.com/kubescape/k8s-interface v0.0.95 + github.com/kubescape/k8s-interface v0.0.97 github.com/kubescape/opa-utils v0.0.223 github.com/kubescape/rbac-utils v0.0.19 github.com/libgit2/git2go/v33 v33.0.9 @@ -105,6 +105,7 @@ require ( github.com/aws/aws-sdk-go-v2/service/ecr v1.18.0 // indirect github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.12.0 // indirect github.com/aws/aws-sdk-go-v2/service/eks v1.21.4 // indirect + github.com/aws/aws-sdk-go-v2/service/iam v1.19.0 // indirect github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.17 // indirect github.com/aws/aws-sdk-go-v2/service/sso v1.11.23 // indirect github.com/aws/aws-sdk-go-v2/service/ssooidc v1.13.6 // indirect @@ -304,7 +305,7 @@ require ( go.etcd.io/etcd/server/v3 v3.6.0-alpha.0 // indirect go.etcd.io/etcd/tests/v3 v3.6.0-alpha.0 // indirect go.etcd.io/etcd/v3 v3.6.0-alpha.0 // indirect - go.mongodb.org/mongo-driver v1.10.0 // indirect + go.mongodb.org/mongo-driver v1.11.1 // indirect go.opencensus.io v0.24.0 // indirect go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.28.0 // indirect go.opentelemetry.io/otel v1.7.0 // indirect diff --git a/go.sum b/go.sum index a49fbffe..050d3b9c 100644 --- a/go.sum +++ b/go.sum @@ -333,6 +333,8 @@ github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.12.0 h1:LsqBpyRofMG6eDs6YGud6F github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.12.0/go.mod h1:IArQ3IBR00FkuraKwudKZZU32OxJfdTdwV+W5iZh3Y4= github.com/aws/aws-sdk-go-v2/service/eks v1.21.4 h1:qmKWieiIiYwD46GRD6nxFc1KsyR0ChGRid8emb7rDEY= github.com/aws/aws-sdk-go-v2/service/eks v1.21.4/go.mod h1:Th2+t6mwi0bZayXUOFOTuyWR2nwRUVcadDy4WGE8C2E= +github.com/aws/aws-sdk-go-v2/service/iam v1.19.0 h1:9vCynoqC+dgxZKrsjvAniyIopsv3RZFsZ6wkQ+yxtj8= +github.com/aws/aws-sdk-go-v2/service/iam v1.19.0/go.mod h1:OyAuvpFeSVNppcSsp1hFOVQcaTRc1LE24YIR7pMbbAA= github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.2.1/go.mod h1:zceowr5Z1Nh2WVP8bf/3ikB41IZW59E4yIYbg+pC6mw= github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.17 h1:Jrd/oMh0PKQc6+BowB+pLEwLIgaQF29eYbe7E1Av9Ug= github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.17/go.mod h1:4nYOrY41Lrbk2170/BGkcJKBhws9Pfn8MG3aGqjjeFI= @@ -1081,8 +1083,8 @@ github.com/kubescape/go-git-url v0.0.23 h1:Xj4IPYGeqiTuIRpZf6TcRgn+T38tJE+LBQg6S github.com/kubescape/go-git-url v0.0.23/go.mod h1:IbVT7Wsxlghsa+YxI5KOx4k9VQJaa3z0kTaQz5D3nKM= github.com/kubescape/go-logger v0.0.6 h1:ynhAmwrz0O7Jtqq1CdmCZUrKveji25hVP+B/FAb3QrA= github.com/kubescape/go-logger v0.0.6/go.mod h1:DnVWEvC90LFY1nNMaNo6nBVOcqkLMK3S0qzXP1fzRvI= -github.com/kubescape/k8s-interface v0.0.95 h1:IadQg7pPxqmA5BM970Rr/ragoM2plR3sb+5WUlrVs54= -github.com/kubescape/k8s-interface v0.0.95/go.mod h1:KOKSl9hrrMApXkMTEzv4yVF2MyUlTjtr/6cH5to2OxQ= +github.com/kubescape/k8s-interface v0.0.97 h1:tXs4NTmCudmRdx4JijnvUD9myC3vjUo40qPJPzXgxIQ= +github.com/kubescape/k8s-interface v0.0.97/go.mod h1:UO8puAwFZ3XVMlKWJj0GcdFJZI22Q7iwV+5FO6mw5FE= github.com/kubescape/opa-utils v0.0.223 h1:t39+P5eW1nsmt55Sx7NZU3Tv9IDBo0ljEYbOi9nlgVc= github.com/kubescape/opa-utils v0.0.223/go.mod h1:cKWsKl2t2XP7Mc3t1c3hNdf8Kg0sxikUcqATfq09vzU= github.com/kubescape/rbac-utils v0.0.19 h1:7iydgVxlMLW15MgHORfMBMqNj9jHtFGACd744fdtrFs= @@ -1685,8 +1687,9 @@ go.etcd.io/etcd/v3 v3.6.0-alpha.0/go.mod h1:9ERPHHuSr8Ho66trD/4f3+vSeqI/hk4loUSF go.mongodb.org/mongo-driver v1.7.3/go.mod h1:NqaYOwnXWr5Pm7AOpO5QFxKJ503nbMse/R79oO62zWg= go.mongodb.org/mongo-driver v1.7.5/go.mod h1:VXEWRZ6URJIkUq2SCAyapmhH0ZLRBP+FT4xhp5Zvxng= go.mongodb.org/mongo-driver v1.8.3/go.mod h1:0sQWfOeY63QTntERDJJ/0SuKK0T1uVSgKCuAROlKEPY= -go.mongodb.org/mongo-driver v1.10.0 h1:UtV6N5k14upNp4LTduX0QCufG124fSu25Wz9tu94GLg= go.mongodb.org/mongo-driver v1.10.0/go.mod h1:wsihk0Kdgv8Kqu1Anit4sfK+22vSFbUrAVEYRhCXrA8= +go.mongodb.org/mongo-driver v1.11.1 h1:QP0znIRTuL0jf1oBQoAoM0C6ZJfBK4kx0Uumtv1A7w8= +go.mongodb.org/mongo-driver v1.11.1/go.mod h1:s7p5vEtfbeR1gYi6pnj3c3/urpbLv2T5Sfd6Rp2HBB8= go.opencensus.io v0.15.0/go.mod h1:UffZAU+4sDEINUGP/B7UfBBkq4fqLu9zXAX7ke6CHW0= go.opencensus.io v0.18.0/go.mod h1:vKdFvxhtzZ9onBp9VKHK8z/sRpBMnKAsufL7wlDrCOA= go.opencensus.io v0.20.1/go.mod h1:6WKK9ahsWS3RSO+PY9ZHZUfv2irvY6gN279GOPZjmmk=