github/kubescape
1
0
Fork 0
mirror of https://github.com/kubescape/kubescape.git synced 2026-04-15 06:58:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

begin download config + download exceptions

Browse Source
This commit is contained in:
yiscah
2022-01-05 15:56:24 +02:00
parent 8f38c2f627
commit a4c88edfca
4 changed files with 101 additions and 109 deletions
Download Patch File Download Diff File Expand all files Collapse all files
clihandler/clidownload.go
+85
View File
@@ -0,0 +1,85 @@
package clihandler
import (
"fmt"
"strings"
"github.com/armosec/k8s-interface/k8sinterface"
"github.com/armosec/kubescape/cautils"
"github.com/armosec/kubescape/cautils/getter"
)
var downloadInfo cautils.DownloadInfo
func CliDownload(args []string) error {
switch strings.ToLower(args[0]) {
case "framework":
return downloadFramework(args[1])
case "control":
return downloadControl(args[1])
case "exceptions":
return downloadExceptions(args[1])
case "configinputs":
return downloadConfigInputs(args[1])
// case "artifacts":
default:
return fmt.Errorf("unknown command to download")
}
}
func downloadConfigInputs(controlsInputs string) error {
tenant := getTenantConfig("", &k8sinterface.KubernetesApi{}) // change k8sinterface
downloadReleasedPolicy := getter.NewDownloadReleasedPolicy() // download config inputs from github release
controlsInputsGetter := getConfigInputsGetter(controlsInputs, tenant.GetCustomerGUID(), downloadReleasedPolicy)
controlInputs, err := controlsInputsGetter.GetControlsInputs(tenant.GetCustomerGUID(), tenant.GetClusterName())
if err != nil {
return err
}
// save in file
return nil
}
func downloadExceptions(frameworkName string) error {
return nil
}
func downloadFramework(frameworkName string) error {
downloadInfo.FrameworkName = strings.ToLower(frameworkName)
g := getter.NewDownloadReleasedPolicy()
if err := g.SetRegoObjects(); err != nil {
return err
}
if downloadInfo.Path == "" {
downloadInfo.Path = getter.GetDefaultPath(downloadInfo.FrameworkName + ".json")
}
frameworks, err := g.GetFramework(downloadInfo.FrameworkName)
if err != nil {
return err
}
err = getter.SaveFrameworkInFile(frameworks, downloadInfo.Path)
if err != nil {
return err
}
return nil
}
func downloadControl(controlName string) error {
downloadInfo.ControlName = strings.ToLower(controlName)
g := getter.NewDownloadReleasedPolicy()
if err := g.SetRegoObjects(); err != nil {
return err
}
if downloadInfo.Path == "" {
downloadInfo.Path = getter.GetDefaultPath(downloadInfo.ControlName + ".json")
}
controls, err := g.GetControl(downloadInfo.ControlName)
if err != nil {
return err
}
err = getter.SaveControlInFile(controls, downloadInfo.Path)
if err != nil {
return err
}
return nil
}
clihandler/cmd/download.go
-94
View File
@@ -1,95 +1 @@
package cmd
import (
"fmt"
"os"
"strings"
"github.com/armosec/kubescape/cautils"
"github.com/armosec/kubescape/cautils/getter"
"github.com/spf13/cobra"
)
var downloadInfo cautils.DownloadInfo
var downloadCmd = &cobra.Command{
Use: fmt.Sprintf("download framework/control <framework-name>/<control-name> [flags]\nSupported frameworks: %s", getter.NativeFrameworks),
Short: "Download framework/control",
Long: ``,
Args: func(cmd *cobra.Command, args []string) error {
if len(args) != 2 {
return fmt.Errorf("requires two arguments : framework/control <framework-name>/<control-name>")
}
if !strings.EqualFold(args[0], "framework") && !strings.EqualFold(args[0], "control") {
return fmt.Errorf("invalid parameter '%s'. Supported parameters: framework, control", args[0])
}
return nil
},
RunE: func(cmd *cobra.Command, args []string) error {
if err := download(args); err != nil {
fmt.Fprintf(os.Stderr, "error: %v\n", err)
os.Exit(1)
}
return nil
},
}
func init() {
rootCmd.AddCommand(downloadCmd)
downloadInfo = cautils.DownloadInfo{}
downloadCmd.Flags().StringVarP(&downloadInfo.Path, "output", "o", "", "Output file. If specified, will store save to `~/.kubescape/<framework name>.json`")
}
func download(args []string) error {
switch strings.ToLower(args[0]) {
case "framework":
return downloadFramework(args[1])
case "control":
return downloadControl(args[1])
// case "exceptions":
// case "artifacts":
default:
return fmt.Errorf("unknown command to download")
}
}
func downloadFramework(frameworkName string) error {
downloadInfo.FrameworkName = strings.ToLower(frameworkName)
g := getter.NewDownloadReleasedPolicy()
if err := g.SetRegoObjects(); err != nil {
return err
}
if downloadInfo.Path == "" {
downloadInfo.Path = getter.GetDefaultPath(downloadInfo.FrameworkName + ".json")
}
frameworks, err := g.GetFramework(downloadInfo.FrameworkName)
if err != nil {
return err
}
err = getter.SaveFrameworkInFile(frameworks, downloadInfo.Path)
if err != nil {
return err
}
return nil
}
func downloadControl(controlName string) error {
downloadInfo.ControlName = strings.ToLower(controlName)
g := getter.NewDownloadReleasedPolicy()
if err := g.SetRegoObjects(); err != nil {
return err
}
if downloadInfo.Path == "" {
downloadInfo.Path = getter.GetDefaultPath(downloadInfo.ControlName + ".json")
}
controls, err := g.GetControl(downloadInfo.ControlName)
if err != nil {
return err
}
err = getter.SaveControlInFile(controls, downloadInfo.Path)
if err != nil {
return err
}
return nil
}
clihandler/initcli.go
+2 -2
View File
@@ -32,7 +32,7 @@ func getInterfaces(scanInfo *cautils.ScanInfo) componentInterfaces {
k8s := getKubernetesApi(scanInfo)
tenantConfig := getTenantConfig(scanInfo, k8s)
tenantConfig := getTenantConfig(scanInfo.Account, k8s)
// Set submit behavior AFTER loading tenant config
setSubmitBehavior(scanInfo, tenantConfig)
@@ -89,7 +89,7 @@ func ScanCliSetup(scanInfo *cautils.ScanInfo) error {
downloadReleasedPolicy := getter.NewDownloadReleasedPolicy() // download config inputs from github release
// set policy getter only after setting the customerGUID
setPolicyGetter(scanInfo, interfaces.tenantConfig.GetCustomerGUID(), downloadReleasedPolicy)
setConfigInputsGetter(scanInfo, interfaces.tenantConfig.GetCustomerGUID(), downloadReleasedPolicy)
scanInfo.Getters.ControlsInputsGetter = getConfigInputsGetter(scanInfo.ControlsInputs, interfaces.tenantConfig.GetCustomerGUID(), downloadReleasedPolicy)
defer func() {
if err := interfaces.hostSensorHandler.TearDown(); err != nil {
clihandler/initcliutils.go
+14 -13
View File
@@ -21,11 +21,11 @@ func getKubernetesApi(scanInfo *cautils.ScanInfo) *k8sinterface.KubernetesApi {
}
return k8sinterface.NewKubernetesApi()
}
func getTenantConfig(scanInfo *cautils.ScanInfo, k8s *k8sinterface.KubernetesApi) cautils.ITenantConfig {
if scanInfo.GetScanningEnvironment() == cautils.ScanLocalFiles {
return cautils.NewLocalConfig(getter.GetArmoAPIConnector(), scanInfo.Account)
func getTenantConfig(Account string, k8s *k8sinterface.KubernetesApi) cautils.ITenantConfig {
if !k8sinterface.IsConnectedToCluster() {
return cautils.NewLocalConfig(getter.GetArmoAPIConnector(), Account)
}
return cautils.NewClusterConfig(k8s, getter.GetArmoAPIConnector(), scanInfo.Account)
return cautils.NewClusterConfig(k8s, getter.GetArmoAPIConnector(), Account)
}
func getRBACHandler(tenantConfig cautils.ITenantConfig, k8s *k8sinterface.KubernetesApi, submit bool) *cautils.RBACObjects {
@@ -142,7 +142,7 @@ func setPolicyGetter(scanInfo *cautils.ScanInfo, customerGUID string, downloadRe
scanInfo.PolicyGetter = getter.NewLoadPolicy(scanInfo.UseFrom)
} else {
if customerGUID == "" || !scanInfo.FrameworkScan {
setDownloadReleasedPolicy(scanInfo, downloadReleasedPolicy)
scanInfo.PolicyGetter = getDownloadReleasedPolicy(downloadReleasedPolicy)
} else {
setGetArmoAPIConnector(scanInfo, customerGUID)
}
@@ -150,29 +150,30 @@ func setPolicyGetter(scanInfo *cautils.ScanInfo, customerGUID string, downloadRe
}
// setConfigInputsGetter sets the config input getter - local file/github release/ArmoAPI
func setConfigInputsGetter(scanInfo *cautils.ScanInfo, customerGUID string, downloadReleasedPolicy *getter.DownloadReleasedPolicy) {
if len(scanInfo.ControlsInputs) > 0 {
scanInfo.Getters.ControlsInputsGetter = getter.NewLoadPolicy([]string{scanInfo.ControlsInputs})
func getConfigInputsGetter(ControlsInputs string, customerGUID string, downloadReleasedPolicy *getter.DownloadReleasedPolicy) getter.IControlsInputsGetter {
if len(ControlsInputs) > 0 {
return getter.NewLoadPolicy([]string{ControlsInputs})
} else {
if customerGUID != "" {
scanInfo.Getters.ControlsInputsGetter = getter.GetArmoAPIConnector()
return getter.GetArmoAPIConnector()
} else {
if err := downloadReleasedPolicy.SetRegoObjects(); err != nil { // if failed to pull config inputs, fallback to BE
cautils.WarningDisplay(os.Stderr, "Warning: failed to get config inputs from github release, this may affect the scanning results\n")
}
scanInfo.Getters.ControlsInputsGetter = downloadReleasedPolicy
return downloadReleasedPolicy
}
}
}
func setDownloadReleasedPolicy(scanInfo *cautils.ScanInfo, downloadReleasedPolicy *getter.DownloadReleasedPolicy) {
func getDownloadReleasedPolicy(downloadReleasedPolicy *getter.DownloadReleasedPolicy) getter.IPolicyGetter {
if err := downloadReleasedPolicy.SetRegoObjects(); err != nil { // if failed to pull policy, fallback to cache
cautils.WarningDisplay(os.Stderr, "Warning: failed to get policies from github release, loading policies from cache\n")
scanInfo.PolicyGetter = getter.NewLoadPolicy(getDefaultFrameworksPaths())
return getter.NewLoadPolicy(getDefaultFrameworksPaths())
} else {
scanInfo.PolicyGetter = downloadReleasedPolicy
return downloadReleasedPolicy
}
}
func setGetArmoAPIConnector(scanInfo *cautils.ScanInfo, customerGUID string) {
g := getter.GetArmoAPIConnector() // download policy from ARMO backend
g.SetCustomerGUID(customerGUID)