From aa18be17faf83dec67491731c148b4cab2553628 Mon Sep 17 00:00:00 2001 From: dwertent Date: Thu, 9 Dec 2021 11:54:25 +0200 Subject: [PATCH] remove rego from armo, support release fallback --- cautils/getter/armoapi.go | 15 +----------- cautils/versioncheck.go | 9 ++++++-- clihandler/cmd/version.go | 2 +- clihandler/initcliutils.go | 47 +++++++++++++++++++++++++++----------- 4 files changed, 43 insertions(+), 30 deletions(-) diff --git a/cautils/getter/armoapi.go b/cautils/getter/armoapi.go index 87e04395..bdb37d5c 100644 --- a/cautils/getter/armoapi.go +++ b/cautils/getter/armoapi.go @@ -8,7 +8,6 @@ import ( "time" "github.com/armosec/armoapi-go/armotypes" - "github.com/armosec/opa-utils/gitregostore" "github.com/armosec/opa-utils/reporthandling" "github.com/golang/glog" ) @@ -36,7 +35,6 @@ type ArmoAPI struct { erURL string feURL string customerGUID string - gs *gitregostore.GitRegoStore } var globalArmoAPIConnecctor *ArmoAPI @@ -85,7 +83,6 @@ func NewARMOAPICustomized(armoERURL, armoBEURL, armoFEURL string) *ArmoAPI { func newArmoAPI() *ArmoAPI { return &ArmoAPI{ httpClient: &http.Client{Timeout: time.Duration(61) * time.Second}, - gs: gitregostore.InitDefaultGitRegoStore(-1), } } func (armoAPI *ArmoAPI) SetCustomerGUID(customerGUID string) { @@ -116,17 +113,7 @@ func (armoAPI *ArmoAPI) GetFramework(name string) (*reporthandling.Framework, er } func (armoAPI *ArmoAPI) GetControl(policyName string) (*reporthandling.Control, error) { - var control *reporthandling.Control - var err error - if strings.HasPrefix(policyName, "C-") || strings.HasPrefix(policyName, "c-") { - control, err = armoAPI.gs.GetOPAControlByID(policyName) - } else { - control, err = armoAPI.gs.GetOPAControlByName(policyName) - } - if err != nil { - return nil, err - } - return control, nil + return nil, fmt.Errorf("control api is not public") } func (armoAPI *ArmoAPI) GetExceptions(customerGUID, clusterName string) ([]armotypes.PostureExceptionPolicy, error) { diff --git a/cautils/versioncheck.go b/cautils/versioncheck.go index 63f61677..ab5d4217 100644 --- a/cautils/versioncheck.go +++ b/cautils/versioncheck.go @@ -80,14 +80,19 @@ func (v *VersionCheckHandlerMock) CheckLatestVersion(versionData *VersionCheckRe } func (v *VersionCheckHandler) CheckLatestVersion(versionData *VersionCheckRequest) error { + defer func() { + if err := recover(); err != nil { + fmt.Println("failed to get latest version") + } + }() latestVersion, err := v.getLatestVersion(versionData) if err != nil || latestVersion == nil { - return fmt.Errorf("failed to get latest version: %v", err) + return fmt.Errorf("failed to get latest version") } if latestVersion.ClientUpdate != "" { - if BuildNumber != "" { + if BuildNumber != "" && BuildNumber < latestVersion.ClientUpdate { fmt.Println(warningMessage(latestVersion.Client, latestVersion.ClientUpdate)) } } diff --git a/clihandler/cmd/version.go b/clihandler/cmd/version.go index aa47b0cb..7b016884 100644 --- a/clihandler/cmd/version.go +++ b/clihandler/cmd/version.go @@ -13,7 +13,7 @@ var versionCmd = &cobra.Command{ Long: ``, RunE: func(cmd *cobra.Command, args []string) error { v := cautils.NewIVersionCheckHandler() - v.CheckLatestVersion(cautils.NewVersionCheckRequest(cautils.BuildNumber, "", "", "")) + v.CheckLatestVersion(cautils.NewVersionCheckRequest(cautils.BuildNumber, "", "", "version")) fmt.Println("Your current version is: " + cautils.BuildNumber) return nil }, diff --git a/clihandler/initcliutils.go b/clihandler/initcliutils.go index fbede3b7..e9abc6ba 100644 --- a/clihandler/initcliutils.go +++ b/clihandler/initcliutils.go @@ -2,6 +2,7 @@ package clihandler import ( "fmt" + "os" "github.com/armosec/kubescape/cautils" "github.com/armosec/kubescape/cautils/getter" @@ -76,25 +77,45 @@ func setSubmitBehavior(scanInfo *cautils.ScanInfo, tenantConfig cautils.ITenantC } } +// setPolicyGetter set the policy getter - local file/github release/ArmoAPI func setPolicyGetter(scanInfo *cautils.ScanInfo, customerGUID string) { if len(scanInfo.UseFrom) > 0 { - //load from file scanInfo.PolicyGetter = getter.NewLoadPolicy(scanInfo.UseFrom) } else { if customerGUID == "" || !scanInfo.FrameworkScan { - scanInfo.PolicyGetter = getter.NewDownloadReleasedPolicy() // download policy from github release + setDownloadReleasedPolicy(scanInfo) } else { - g := getter.GetArmoAPIConnector() // download policy from ARMO backend - g.SetCustomerGUID(customerGUID) - scanInfo.PolicyGetter = g - if scanInfo.ScanAll { - frameworks, err := g.ListCustomFrameworks(customerGUID) - if err != nil { - glog.Error("failed to get custom frameworks") // handle error - return - } - scanInfo.SetPolicyIdentifiers(frameworks, reporthandling.KindFramework) - } + setGetArmoAPIConnector(scanInfo, customerGUID) } } } + +func setDownloadReleasedPolicy(scanInfo *cautils.ScanInfo) { + g := getter.NewDownloadReleasedPolicy() // download policy from github release + if err := g.SetRegoObjects(); err != nil { // if failed to pull policy, fallback to cache + cautils.WarningDisplay(os.Stdout, "Warning: failed to get policies from github release, loading policies from cache\n") + scanInfo.PolicyGetter = getter.NewLoadPolicy(getDefaultFrameworksPaths()) + } else { + scanInfo.PolicyGetter = g + } +} +func setGetArmoAPIConnector(scanInfo *cautils.ScanInfo, customerGUID string) { + g := getter.GetArmoAPIConnector() // download policy from ARMO backend + g.SetCustomerGUID(customerGUID) + scanInfo.PolicyGetter = g + if scanInfo.ScanAll { + frameworks, err := g.ListCustomFrameworks(customerGUID) + if err != nil { + glog.Error("failed to get custom frameworks") // handle error + return + } + scanInfo.SetPolicyIdentifiers(frameworks, reporthandling.KindFramework) + } +} +func getDefaultFrameworksPaths() []string { + fwPaths := []string{} + for i := range getter.NativeFrameworks { + fwPaths = append(fwPaths, getter.GetDefaultPath(getter.NativeFrameworks[i])) + } + return fwPaths +}