From b053b84197286fcc5a04dabbca67efe6f02017ba Mon Sep 17 00:00:00 2001 From: dwertent Date: Wed, 13 Oct 2021 15:56:43 +0300 Subject: [PATCH] use packets --- cautils/apis/backendconnector.go | 101 - cautils/apis/backendconnectormethods.go | 128 -- cautils/apis/clusterapis.go | 25 - cautils/apis/datastructures.go | 78 - cautils/apis/datastructures_test.go | 26 - cautils/apis/interfaces.go | 27 - cautils/apis/login.go | 255 --- cautils/apis/logindatastructures.go | 38 - cautils/apis/websocketdatastructures.go | 132 -- cautils/armotypes/executionpolicytypes.go | 16 - cautils/armotypes/portaltypes.go | 66 - cautils/armotypes/portaltypes_mock.go | 18 - cautils/armotypes/portaltypesutils.go | 113 - .../armotypes/postureexceptionpolicytypes.go | 42 - .../postureexceptionpolicytypesutils.go | 1 - cautils/cautils/armometadata.go | 196 -- cautils/cautils/cautils_test.go | 29 - cautils/cautils/genericutils.go | 118 - cautils/cautils/k8sutils.go | 52 - cautils/cautils/wlid.go | 238 -- cautils/customerloader.go | 2 +- cautils/datastructures.go | 4 +- cautils/getter/armoapi.go | 4 +- cautils/getter/downloadreleasedpolicy.go | 2 +- cautils/getter/getpolicies.go | 4 +- cautils/getter/getpoliciesutils.go | 2 +- cautils/getter/loadpolicy.go | 4 +- .../k8sinterface/cloudvendorregistrycreds.go | 265 --- cautils/k8sinterface/k8sconfig.go | 121 - cautils/k8sinterface/k8sconfig_test.go | 34 - cautils/k8sinterface/k8sdynamic.go | 145 -- cautils/k8sinterface/k8sdynamic_test.go | 43 - cautils/k8sinterface/k8sdynamicutils.go | 66 - cautils/k8sinterface/k8sdynamicutils_test.go | 10 - cautils/k8sinterface/k8sstatic.go | 71 - cautils/k8sinterface/mockdynamicobjects.go | 1963 ----------------- cautils/k8sinterface/resourcegroupmapping.go | 142 -- .../k8sinterface/resourcegroupmapping_test.go | 22 - cautils/k8sinterface/workload.go | 161 -- cautils/k8sinterface/workloadmethods.go | 642 ------ cautils/k8sinterface/workloadmethods_test.go | 155 -- cautils/k8sinterface/workloadmethodsutils.go | 23 - cautils/opapolicy/apis.go | 7 - cautils/opapolicy/datastructures.go | 163 -- cautils/opapolicy/datastructures_mock.go | 301 --- cautils/opapolicy/datastructures_test.go | 42 - cautils/opapolicy/datastructuresmethods.go | 236 -- cautils/opapolicy/gojayunmarshaller.go | 47 - cautils/opapolicy/resources/dependencies.go | 219 -- .../resources/rego/modules/cronJob.reg | 20 - .../resources/rego/modules/externalfacing.reg | 44 - .../resources/rego/modules/hostpath.reg | 57 - .../resources/rego/modules/privileged.reg | 56 - .../resources/rego/modules/rbacsecrets.reg | 98 - .../resources/rego/modules/rwhostpath.reg | 64 - .../rego/modules/sshableworkload.reg | 57 - .../rego/regorulesjsons/access2secrets.json | 33 - .../rego/regorulesjsons/cansshtopod.json | 34 - .../regorulesjsons/compromisedregistries.json | 33 - .../externalfacingservicesbypod.json | 31 - .../rego/regorulesjsons/hostpath.json | 31 - .../regorulesjsons/instancemetadataapi.json | 27 - .../rego/regorulesjsons/iscronjob.json | 30 - .../regorulesjsons/privilegedworkload.json | 29 - .../rego/regorulesjsons/rwhostpath.json | 31 - cautils/opapolicy/resources/resourcesutils.go | 118 - .../resources/resourcesutils_test.go | 1 - cautils/scaninfo.go | 2 +- cmd/cluster_get.go | 2 +- cmd/cluster_set.go | 2 +- cmd/framework.go | 6 +- go.mod | 46 +- go.sum | 233 +- opaprocessor/processorhandler.go | 8 +- opaprocessor/processorhandler_test.go | 4 +- opaprocessor/processorhandlerutils.go | 8 +- policyhandler/filesloader.go | 4 +- policyhandler/handlenotification.go | 6 +- policyhandler/handlepullpolicies.go | 4 +- policyhandler/k8sresources.go | 6 +- policyhandler/k8sresourcesutils.go | 4 +- policyhandler/k8sresourcesutils_test.go | 4 +- policyhandler/urlloader.go | 2 +- resultshandling/printer/junit.go | 2 +- resultshandling/printer/printresults.go | 2 +- resultshandling/printer/summary.go | 2 +- resultshandling/printer/summeryhelpers.go | 4 +- .../reporter/reporteventreceiver.go | 9 +- scapepkg/exceptions/exceptionprocessor.go | 6 +- .../exceptions/exceptionprocessor_test.go | 2 +- scapepkg/score/score.go | 4 +- scapepkg/score/score_mocks.go | 4 +- 92 files changed, 227 insertions(+), 7542 deletions(-) delete mode 100644 cautils/apis/backendconnector.go delete mode 100644 cautils/apis/backendconnectormethods.go delete mode 100644 cautils/apis/clusterapis.go delete mode 100644 cautils/apis/datastructures.go delete mode 100644 cautils/apis/datastructures_test.go delete mode 100644 cautils/apis/interfaces.go delete mode 100644 cautils/apis/login.go delete mode 100644 cautils/apis/logindatastructures.go delete mode 100644 cautils/apis/websocketdatastructures.go delete mode 100644 cautils/armotypes/executionpolicytypes.go delete mode 100644 cautils/armotypes/portaltypes.go delete mode 100644 cautils/armotypes/portaltypes_mock.go delete mode 100644 cautils/armotypes/portaltypesutils.go delete mode 100644 cautils/armotypes/postureexceptionpolicytypes.go delete mode 100644 cautils/armotypes/postureexceptionpolicytypesutils.go delete mode 100644 cautils/cautils/armometadata.go delete mode 100644 cautils/cautils/cautils_test.go delete mode 100644 cautils/cautils/genericutils.go delete mode 100644 cautils/cautils/k8sutils.go delete mode 100644 cautils/cautils/wlid.go delete mode 100644 cautils/k8sinterface/cloudvendorregistrycreds.go delete mode 100644 cautils/k8sinterface/k8sconfig.go delete mode 100644 cautils/k8sinterface/k8sconfig_test.go delete mode 100644 cautils/k8sinterface/k8sdynamic.go delete mode 100644 cautils/k8sinterface/k8sdynamic_test.go delete mode 100644 cautils/k8sinterface/k8sdynamicutils.go delete mode 100644 cautils/k8sinterface/k8sdynamicutils_test.go delete mode 100644 cautils/k8sinterface/k8sstatic.go delete mode 100644 cautils/k8sinterface/mockdynamicobjects.go delete mode 100644 cautils/k8sinterface/resourcegroupmapping.go delete mode 100644 cautils/k8sinterface/resourcegroupmapping_test.go delete mode 100644 cautils/k8sinterface/workload.go delete mode 100644 cautils/k8sinterface/workloadmethods.go delete mode 100644 cautils/k8sinterface/workloadmethods_test.go delete mode 100644 cautils/k8sinterface/workloadmethodsutils.go delete mode 100644 cautils/opapolicy/apis.go delete mode 100644 cautils/opapolicy/datastructures.go delete mode 100644 cautils/opapolicy/datastructures_mock.go delete mode 100644 cautils/opapolicy/datastructures_test.go delete mode 100644 cautils/opapolicy/datastructuresmethods.go delete mode 100644 cautils/opapolicy/gojayunmarshaller.go delete mode 100644 cautils/opapolicy/resources/dependencies.go delete mode 100755 cautils/opapolicy/resources/rego/modules/cronJob.reg delete mode 100755 cautils/opapolicy/resources/rego/modules/externalfacing.reg delete mode 100755 cautils/opapolicy/resources/rego/modules/hostpath.reg delete mode 100755 cautils/opapolicy/resources/rego/modules/privileged.reg delete mode 100755 cautils/opapolicy/resources/rego/modules/rbacsecrets.reg delete mode 100755 cautils/opapolicy/resources/rego/modules/rwhostpath.reg delete mode 100755 cautils/opapolicy/resources/rego/modules/sshableworkload.reg delete mode 100755 cautils/opapolicy/resources/rego/regorulesjsons/access2secrets.json delete mode 100755 cautils/opapolicy/resources/rego/regorulesjsons/cansshtopod.json delete mode 100755 cautils/opapolicy/resources/rego/regorulesjsons/compromisedregistries.json delete mode 100755 cautils/opapolicy/resources/rego/regorulesjsons/externalfacingservicesbypod.json delete mode 100755 cautils/opapolicy/resources/rego/regorulesjsons/hostpath.json delete mode 100644 cautils/opapolicy/resources/rego/regorulesjsons/instancemetadataapi.json delete mode 100755 cautils/opapolicy/resources/rego/regorulesjsons/iscronjob.json delete mode 100755 cautils/opapolicy/resources/rego/regorulesjsons/privilegedworkload.json delete mode 100755 cautils/opapolicy/resources/rego/regorulesjsons/rwhostpath.json delete mode 100644 cautils/opapolicy/resources/resourcesutils.go delete mode 100644 cautils/opapolicy/resources/resourcesutils_test.go diff --git a/cautils/apis/backendconnector.go b/cautils/apis/backendconnector.go deleted file mode 100644 index 58a7a506..00000000 --- a/cautils/apis/backendconnector.go +++ /dev/null @@ -1,101 +0,0 @@ -package apis - -import ( - "bytes" - "fmt" - "io" - "net/http" -) - -// HTTPReqFunc allows you to insert query params and more to aggregation message while using update aggregator -type HTTPReqFunc func(req *http.Request, qryData interface{}) - -func BasicBEQuery(req *http.Request, qryData interface{}) { - - q := req.URL.Query() - - if notificationData, isok := qryData.(*LoginObject); isok { - q.Add("customerGUID", notificationData.GUID) - } - - req.URL.RawQuery = q.Encode() -} - -func EmptyQuery(req *http.Request, qryData interface{}) { - q := req.URL.Query() - req.URL.RawQuery = q.Encode() -} - -func MapQuery(req *http.Request, qryData interface{}) { - q := req.URL.Query() - if qryMap, isok := qryData.(map[string]string); isok { - for k, v := range qryMap { - q.Add(k, v) - } - - } - req.URL.RawQuery = q.Encode() -} - -func BEHttpRequest(loginobj *LoginObject, beURL, - httpverb string, - endpoint string, - payload []byte, - f HTTPReqFunc, - qryData interface{}) ([]byte, error) { - client := &http.Client{} - - beURL = fmt.Sprintf("%v/%v", beURL, endpoint) - req, err := http.NewRequest(httpverb, beURL, bytes.NewReader(payload)) - if err != nil { - return nil, err - } - - req.Header.Set("Authorization", loginobj.Authorization) - f(req, qryData) - - for _, cookie := range loginobj.Cookies { - req.AddCookie(cookie) - } - resp, err := client.Do(req) - if err != nil { - return nil, err - } - if resp.StatusCode < 200 || resp.StatusCode >= 300 { - fmt.Printf("req:\n%v\nresp:%v\n", req, resp) - return nil, fmt.Errorf("Error #%v Due to: %v", resp.StatusCode, resp.Status) - } - defer resp.Body.Close() - body, err := io.ReadAll(resp.Body) - if err != nil { - return nil, err - } - return body, nil -} - -type BELoginResponse struct { - Name string `json:"name"` - PreferredUsername string `json:"preferred_username"` - Email string `json:"email"` - CustomerGuid string `json:"customerGuid"` - Expires string `json:"expires"` - Authorization string `json:"authorization"` - Cookies []*http.Cookie -} - -func (r *BELoginResponse) ToLoginObject() *LoginObject { - l := &LoginObject{} - l.Authorization = r.Authorization - l.Cookies = r.Cookies - l.Expires = r.Expires - l.GUID = r.CustomerGuid - - return l -} - -type BackendConnector struct { - BaseURL string - BELoginResponse *BELoginResponse - Credentials *CustomerLoginDetails - HTTPClient *http.Client -} diff --git a/cautils/apis/backendconnectormethods.go b/cautils/apis/backendconnectormethods.go deleted file mode 100644 index 26c195c6..00000000 --- a/cautils/apis/backendconnectormethods.go +++ /dev/null @@ -1,128 +0,0 @@ -package apis - -import ( - "bytes" - "encoding/json" - "fmt" - "io" - "net/http" - "strings" -) - -func MakeBackendConnector(client *http.Client, baseURL string, loginDetails *CustomerLoginDetails) (*BackendConnector, error) { - if err := ValidateBEConnectorMakerInput(client, baseURL, loginDetails); err != nil { - return nil, err - } - conn := &BackendConnector{BaseURL: baseURL, Credentials: loginDetails, HTTPClient: client} - err := conn.Login() - - return conn, err -} - -func ValidateBEConnectorMakerInput(client *http.Client, baseURL string, loginDetails *CustomerLoginDetails) error { - if client == nil { - fmt.Errorf("You must provide an initialized httpclient") - } - if len(baseURL) == 0 { - return fmt.Errorf("you must provide a valid backend url") - } - - if loginDetails == nil || (len(loginDetails.Email) == 0 && len(loginDetails.Password) == 0) { - return fmt.Errorf("you must provide valid login details") - } - return nil - -} - -func (r *BackendConnector) Login() error { - if !r.IsExpired() { - return nil - } - - loginInfoBytes, err := json.Marshal(r.Credentials) - if err != nil { - return fmt.Errorf("unable to marshal credentials properly") - } - - beURL := fmt.Sprintf("%v/%v", r.BaseURL, "login") - - req, err := http.NewRequest("POST", beURL, bytes.NewReader(loginInfoBytes)) - if err != nil { - return err - } - - req.Header.Set("Referer", strings.Replace(beURL, "dashbe", "cpanel", 1)) - resp, err := r.HTTPClient.Do(req) - if err != nil { - return err - } - defer resp.Body.Close() - body, err := io.ReadAll(resp.Body) - if err != nil { - return fmt.Errorf("unable to read login response") - } - - loginS := &BELoginResponse{} - json.Unmarshal(body, &loginS) - - loginS.Cookies = resp.Cookies() - r.BELoginResponse = loginS - - return nil -} - -func (r *BackendConnector) IsExpired() bool { - return r.BELoginResponse == nil || r.BELoginResponse.ToLoginObject().IsExpired() -} - -func (r *BackendConnector) GetBaseURL() string { - return r.BaseURL -} -func (r *BackendConnector) GetLoginObj() *LoginObject { - return r.BELoginResponse.ToLoginObject() -} -func (r *BackendConnector) GetClient() *http.Client { - return r.HTTPClient -} - -func (r *BackendConnector) HTTPSend(httpverb string, - endpoint string, - payload []byte, - f HTTPReqFunc, - qryData interface{}) ([]byte, error) { - - beURL := fmt.Sprintf("%v/%v", r.GetBaseURL(), endpoint) - req, err := http.NewRequest(httpverb, beURL, bytes.NewReader(payload)) - if err != nil { - return nil, err - } - - if r.IsExpired() { - r.Login() - } - - loginobj := r.GetLoginObj() - req.Header.Set("Authorization", loginobj.Authorization) - f(req, qryData) - q := req.URL.Query() - q.Set("customerGUID", loginobj.GUID) - req.URL.RawQuery = q.Encode() - - for _, cookie := range loginobj.Cookies { - req.AddCookie(cookie) - } - resp, err := r.GetClient().Do(req) - if err != nil { - return nil, err - } - if resp.StatusCode < 200 || resp.StatusCode >= 300 { - fmt.Printf("req:\n%v\nresp:%v\n", req, resp) - return nil, fmt.Errorf("Error #%v Due to: %v", resp.StatusCode, resp.Status) - } - defer resp.Body.Close() - body, err := io.ReadAll(resp.Body) - if err != nil { - return nil, err - } - return body, nil -} diff --git a/cautils/apis/clusterapis.go b/cautils/apis/clusterapis.go deleted file mode 100644 index 38dcf6bb..00000000 --- a/cautils/apis/clusterapis.go +++ /dev/null @@ -1,25 +0,0 @@ -package apis - -// WebsocketScanCommand api -const ( - WebsocketScanCommandVersion string = "v1" - WebsocketScanCommandPath string = "scanImage" -) - -// commands send via websocket -const ( - UPDATE string = "update" - ATTACH string = "Attach" - REMOVE string = "remove" - DETACH string = "Detach" - INCOMPATIBLE string = "Incompatible" - REPLACE_HEADERS string = "ReplaceHeaders" - IMAGE_UNREACHABLE string = "ImageUnreachable" - SIGN string = "sign" - UNREGISTERED string = "unregistered" - INJECT string = "inject" - RESTART string = "restart" - ENCRYPT string = "encryptSecret" - DECRYPT string = "decryptSecret" - SCAN string = "scan" -) diff --git a/cautils/apis/datastructures.go b/cautils/apis/datastructures.go deleted file mode 100644 index 012ec8dc..00000000 --- a/cautils/apis/datastructures.go +++ /dev/null @@ -1,78 +0,0 @@ -package apis - -import ( - "encoding/json" - "fmt" - "net/http" - - "github.com/docker/docker/api/types" -) - -// WebsocketScanCommand trigger scan thru the websocket -type WebsocketScanCommand struct { - // CustomerGUID string `json:"customerGUID"` - ImageTag string `json:"imageTag"` - Wlid string `json:"wlid"` - IsScanned bool `json:"isScanned"` - ContainerName string `json:"containerName"` - JobID string `json:"jobID,omitempty"` - LastAction int `json:"actionIDN"` - // ImageHash string `json:"imageHash"` - Credentials *types.AuthConfig `json:"credentials,omitempty"` -} - -//taken from BE -// ElasticRespTotal holds the total struct in Elastic array response -type ElasticRespTotal struct { - Value int `json:"value"` - Relation string `json:"relation"` -} - -// V2ListResponse holds the response of some list request with some metadata -type V2ListResponse struct { - Total ElasticRespTotal `json:"total"` - Response interface{} `json:"response"` - // Cursor for quick access to the next page. Not supported yet - Cursor string `json:"cursor"` -} - -// Oauth2Customer returns inside the "ca_groups" field in claims section of -// Oauth2 verification process -type Oauth2Customer struct { - CustomerName string `json:"customerName"` - CustomerGUID string `json:"customerGUID"` -} - -type LoginObject struct { - Authorization string `json:"authorization"` - GUID string - Cookies []*http.Cookie - Expires string -} - -type SafeMode struct { - Reporter string `json:"reporter"` // "Agent" - Action string `json:"action,omitempty"` // "action" - Wlid string `json:"wlid"` // CAA_WLID - PodName string `json:"podName"` // CAA_POD_NAME - InstanceID string `json:"instanceID"` // CAA_POD_NAME - ContainerName string `json:"containerName,omitempty"` // CAA_CONTAINER_NAME - ProcessName string `json:"processName,omitempty"` - ProcessID int `json:"processID,omitempty"` - ProcessCMD string `json:"processCMD,omitempty"` - ComponentGUID string `json:"componentGUID,omitempty"` // CAA_GUID - StatusCode int `json:"statusCode"` // 0/1/2 - ProcessExitCode int `json:"processExitCode"` // 0 + - Timestamp int64 `json:"timestamp"` - Message string `json:"message,omitempty"` // any string - JobID string `json:"jobID,omitempty"` // any string - Compatible *bool `json:"compatible,omitempty"` -} - -func (safeMode *SafeMode) Json() string { - b, err := json.Marshal(*safeMode) - if err != nil { - return "" - } - return fmt.Sprintf("%s", b) -} diff --git a/cautils/apis/datastructures_test.go b/cautils/apis/datastructures_test.go deleted file mode 100644 index 15a252aa..00000000 --- a/cautils/apis/datastructures_test.go +++ /dev/null @@ -1,26 +0,0 @@ -package apis - -// import ( -// "fmt" -// "net/http" -// "testing" -// ) - -// func TestAuditStructure(t *testing.T) { -// c := http.Client{} -// be, err := MakeBackendConnector(&c, "https://dashbe.eudev3.cyberarmorsoft.com", &CustomerLoginDetails{Email: "lalafi@cyberarmor.io", Password: "*", CustomerName: "CyberArmorTests"}) -// if err != nil { -// t.Errorf("sad1") - -// } - -// b, err := be.HTTPSend("GET", "v1/microservicesOverview", nil, MapQuery, map[string]string{"wlid": "wlid://cluster-childrenofbodom/namespace-default/deployment-pos"}) -// if err != nil { -// t.Errorf("sad2") - -// } -// fmt.Printf("%v", string(b)) - -// t.Errorf("sad") - -// } diff --git a/cautils/apis/interfaces.go b/cautils/apis/interfaces.go deleted file mode 100644 index ff1ff996..00000000 --- a/cautils/apis/interfaces.go +++ /dev/null @@ -1,27 +0,0 @@ -package apis - -import ( - "net/http" -) - -// type Dashboard interface { -// OPAFRAMEWORKGet(string, bool) ([]opapolicy.Framework, error) -// } - -// Connector - interface for any connector (BE/Portal and so on) -type Connector interface { - - //may used for a more generic httpsend interface based method - GetBaseURL() string - GetLoginObj() *LoginObject - GetClient() *http.Client - - Login() error - IsExpired() bool - - HTTPSend(httpverb string, - endpoint string, - payload []byte, - f HTTPReqFunc, - qryData interface{}) ([]byte, error) -} diff --git a/cautils/apis/login.go b/cautils/apis/login.go deleted file mode 100644 index 458f7068..00000000 --- a/cautils/apis/login.go +++ /dev/null @@ -1,255 +0,0 @@ -package apis - -import ( - "bytes" - "io" - "net/http" - "time" - - oidc "github.com/coreos/go-oidc" - uuid "github.com/satori/go.uuid" - - // "go.uber.org/zap" - "context" - "encoding/json" - "fmt" - "strings" - - "golang.org/x/oauth2" -) - -func GetOauth2TokenURL() string { - return "https://idens.eudev3.cyberarmorsoft.com/auth/realms/CyberArmorSites" -} - -func GetLoginStruct() (LoginAux, error) { - - return LoginAux{Referer: "https://cpanel.eudev3.cyberarmorsoft.com/login", Url: "https://cpanel.eudev3.cyberarmorsoft.com/login"}, nil -} - -func LoginWithKeycloak(loginDetails CustomerLoginDetails) ([]uuid.UUID, *oidc.IDToken, error) { - // var custGUID uuid.UUID - // config.Oauth2TokenURL - if GetOauth2TokenURL() == "" { - return nil, nil, fmt.Errorf("missing oauth2 token URL") - } - urlaux, _ := GetLoginStruct() - conf, err := getOauth2Config(urlaux) - if err != nil { - return nil, nil, err - } - ctx := context.Background() - provider, err := oidc.NewProvider(ctx, GetOauth2TokenURL()) - if err != nil { - return nil, nil, err - } - - // "Oauth2ClientID": "golang-client" - oidcConfig := &oidc.Config{ - ClientID: "golang-client", - SkipClientIDCheck: true, - } - - verifier := provider.Verifier(oidcConfig) - ouToken, err := conf.PasswordCredentialsToken(ctx, loginDetails.Email, loginDetails.Password) - if err != nil { - return nil, nil, err - } - // "Authorization", - authorization := fmt.Sprintf("%s %s", ouToken.Type(), ouToken.AccessToken) - // oidc.IDTokenVerifier - tkn, err := verifier.Verify(ctx, ouToken.AccessToken) - if err != nil { - return nil, tkn, err - } - tkn.Nonce = authorization - if loginDetails.CustomerName == "" { - customers, err := getCustomersNames(tkn) - if err != nil { - return nil, tkn, err - } - if len(customers) == 1 { - loginDetails.CustomerName = customers[0] - } else { - return nil, tkn, fmt.Errorf("login with one of the following customers: %v", customers) - } - } - custGUID, err := getCustomerGUID(tkn, &loginDetails) - if err != nil { - return nil, tkn, err - } - return []uuid.UUID{custGUID}, tkn, nil -} - -func getOauth2Config(urlaux LoginAux) (*oauth2.Config, error) { - reURLSlices := strings.Split(urlaux.Referer, "/") - if len(reURLSlices) == 0 { - reURLSlices = strings.Split(urlaux.Url, "/") - } - // zapLogger.With(zap.Strings("referer", reURLSlices)).Info("Searching oauth2Config for") - if len(reURLSlices) < 3 { - reURLSlices = []string{reURLSlices[0], reURLSlices[0], reURLSlices[0]} - } - lg, _ := GetLoginStruct() - provider, _ := oidc.NewProvider(context.Background(), GetOauth2TokenURL()) - //provider.Endpoint {"AuthURL":"https://idens.eudev3.cyberarmorsoft.com/auth/realms/CyberArmorSites/protocol/openid-connect/auth","TokenURL":"https://idens.eudev3.cyberarmorsoft.com/auth/realms/CyberArmorSites/protocol/openid-connect/token","AuthStyle":0} - conf := oauth2.Config{ - ClientID: "golang-client", - ClientSecret: "4e33bad2-3491-41a6-b486-93c492cfb4a2", - RedirectURL: lg.Referer, - // Discovery returns the OAuth2 endpoints. - Endpoint: provider.Endpoint(), - // "openid" is a required scope for OpenID Connect flows. - Scopes: []string{oidc.ScopeOpenID, "profile", "email"}, - } - return &conf, nil - // return nil, fmt.Errorf("canno't find oauth2Config for referer '%+v'.\nPlease set referer or origin headers", reURLSlices) -} - -func getCustomersNames(oauth2Details *oidc.IDToken) ([]string, error) { - var claimsJSON Oauth2Claims - if err := oauth2Details.Claims(&claimsJSON); err != nil { - return nil, err - } - - customersList := make([]string, 0, len(claimsJSON.CAGroups)) - for _, v := range claimsJSON.CAGroups { - var caCustomer Oauth2Customer - if err := json.Unmarshal([]byte(v), &caCustomer); err == nil { - customersList = append(customersList, caCustomer.CustomerName) - } - } - return customersList, nil -} - -func getCustomerGUID(tkn *oidc.IDToken, loginDetails *CustomerLoginDetails) (uuid.UUID, error) { - - customers, err := getCustomersList(tkn) - if err != nil { - return uuid.UUID{}, err - } - - // if customer name not provided - use default customer - if loginDetails.CustomerName == "" && len(customers) > 0 { - return uuid.FromString(customers[0].CustomerGUID) - } - - for _, i := range customers { - if i.CustomerName == loginDetails.CustomerName { - return uuid.FromString(i.CustomerGUID) - } - } - return uuid.UUID{}, fmt.Errorf("customer name not found in customer list") -} - -func getCustomersList(oauth2Details *oidc.IDToken) ([]Oauth2Customer, error) { - var claimsJSON Oauth2Claims - if err := oauth2Details.Claims(&claimsJSON); err != nil { - return nil, err - } - - customersList := make([]Oauth2Customer, 0, len(claimsJSON.CAGroups)) - for _, v := range claimsJSON.CAGroups { - var caCustomer Oauth2Customer - if err := json.Unmarshal([]byte(v), &caCustomer); err == nil { - customersList = append(customersList, caCustomer) - } - } - return customersList, nil -} - -// func MakeAuthCookies(custGUID uuid.UUID, ouToken *oidc.IDToken) (*http.Cookie, error) { -// var ccc http.Cookie -// var responseData AuthenticationCookie -// expireDate := time.Now().UTC().Add(time.Duration(config.CookieExpirationHours) * time.Hour) -// if ouToken != nil { -// expireDate = ouToken.Expiry -// } -// ccc.Expires = expireDate -// responseData.CustomerGUID = custGUID -// responseData.Expires = ccc.Expires -// responseData.Version = 0 -// authorizationStr := "" -// if ouToken != nil { -// authorizationStr = ouToken.Nonce -// if err := ouToken.Claims(&responseData.Oauth2Claims); err != nil { -// errStr := fmt.Sprintf("failed to get claims from JWT") -// return nil, fmt.Errorf("%v", errStr) -// } -// } -// jsonBytes, err := json.Marshal(responseData) -// if err != nil { -// errStr := fmt.Sprintf("failed to get claims from JWT") -// return nil, fmt.Errorf("%v", errStr) -// } -// ccc.Name = "auth" -// ccc.Value = hex.EncodeToString(jsonBytes) + "." + cacheaccess.CalcHmac256(jsonBytes) -// // TODO: HttpOnly for security... -// ccc.HttpOnly = false -// ccc.Path = "/" -// ccc.Secure = true -// ccc.SameSite = http.SameSiteNoneMode -// http.SetCookie(w, &ccc) -// responseData.Authorization = authorizationStr -// jsonBytes, err = json.Marshal(responseData) -// if err != nil { -// w.WriteHeader(http.StatusInternalServerError) -// fmt.Fprintf(w, "error while marshaling response(2) %s", err) -// return -// } -// w.Write(jsonBytes) -// } - -func Login(loginDetails CustomerLoginDetails) (*LoginObject, error) { - - return nil, nil -} - -func GetBEInfo(cfgFile string) string { - return "https://dashbe.eudev3.cyberarmorsoft.com" -} - -func BELogin(loginDetails *CustomerLoginDetails, login string, cfg string) (*BELoginResponse, error) { - client := &http.Client{} - - basebeURL := GetBEInfo(cfg) - beURL := fmt.Sprintf("%v/%v", basebeURL, login) - - loginInfoBytes, err := json.Marshal(loginDetails) - if err != nil { - return nil, err - } - req, err := http.NewRequest("POST", beURL, bytes.NewReader(loginInfoBytes)) - if err != nil { - return nil, err - } - - req.Header.Set("Referer", strings.Replace(beURL, "dashbe", "cpanel", 1)) - resp, err := client.Do(req) - if err != nil { - return nil, err - } - defer resp.Body.Close() - body, err := io.ReadAll(resp.Body) - if err != nil { - return nil, err - } - - loginS := &BELoginResponse{} - json.Unmarshal(body, &loginS) - - loginS.Cookies = resp.Cookies() - return loginS, nil -} - -func (r *LoginObject) IsExpired() bool { - if r == nil { - return true - } - t, err := time.Parse(time.RFC3339, r.Expires) - if err != nil { - return true - } - - return t.UTC().Before(time.Now().UTC()) -} diff --git a/cautils/apis/logindatastructures.go b/cautils/apis/logindatastructures.go deleted file mode 100644 index 49dae06e..00000000 --- a/cautils/apis/logindatastructures.go +++ /dev/null @@ -1,38 +0,0 @@ -package apis - -import ( - "time" - - "github.com/gofrs/uuid" -) - -// AuthenticationCookie is what it is -type AuthenticationCookie struct { - Oauth2Claims `json:",inline"` - CustomerGUID uuid.UUID `json:"customerGuid"` - Expires time.Time `json:"expires"` - Version int `json:"version"` - Authorization string `json:"authorization,omitempty"` -} - -type LoginAux struct { - Referer string - Url string -} - -// CustomerLoginDetails is what it is -type CustomerLoginDetails struct { - Email string `json:"email"` - Password string `json:"password"` - CustomerName string `json:"customer,omitempty"` - CustomerGUID uuid.UUID `json:"customerGuid,omitempty"` -} - -// Oauth2Claims returns in claims section of Oauth2 verification process -type Oauth2Claims struct { - Sub string `json:"sub"` - Name string `json:"name"` - PreferredUserName string `json:"preferred_username"` - CAGroups []string `json:"ca_groups"` - Email string `json:"email"` -} diff --git a/cautils/apis/websocketdatastructures.go b/cautils/apis/websocketdatastructures.go deleted file mode 100644 index 0fc825a2..00000000 --- a/cautils/apis/websocketdatastructures.go +++ /dev/null @@ -1,132 +0,0 @@ -package apis - -import ( - "encoding/json" - "fmt" -) - -// Commands list of commands received from websocket -type Commands struct { - Commands []Command `json:"commands"` -} - -// Command structure of command received from websocket -type Command struct { - CommandName string `json:"commandName"` - ResponseID string `json:"responseID"` - Wlid string `json:"wlid,omitempty"` - WildWlid string `json:"wildWlid,omitempty"` - Sid string `json:"sid,omitempty"` - WildSid string `json:"wildSid,omitempty"` - JobTracking JobTracking `json:"jobTracking"` - Args map[string]interface{} `json:"args,omitempty"` -} - -type JobTracking struct { - JobID string `json:"jobID,omitempty"` - ParentID string `json:"parentAction,omitempty"` - LastActionNumber int `json:"numSeq,omitempty"` -} - -func (c *Command) DeepCopy() *Command { - newCommand := &Command{} - newCommand.CommandName = c.CommandName - newCommand.ResponseID = c.ResponseID - newCommand.Wlid = c.Wlid - newCommand.WildWlid = c.WildWlid - if c.Args != nil { - newCommand.Args = make(map[string]interface{}) - for i, j := range c.Args { - newCommand.Args[i] = j - } - } - return newCommand -} - -func (c *Command) GetLabels() map[string]string { - if c.Args != nil { - if ilabels, ok := c.Args["labels"]; ok { - labels := map[string]string{} - if b, e := json.Marshal(ilabels); e == nil { - if e = json.Unmarshal(b, &labels); e == nil { - return labels - } - } - } - } - return map[string]string{} -} - -func (c *Command) SetLabels(labels map[string]string) { - if c.Args == nil { - c.Args = make(map[string]interface{}) - } - c.Args["labels"] = labels -} - -func (c *Command) GetFieldSelector() map[string]string { - if c.Args != nil { - if ilabels, ok := c.Args["fieldSelector"]; ok { - labels := map[string]string{} - if b, e := json.Marshal(ilabels); e == nil { - if e = json.Unmarshal(b, &labels); e == nil { - return labels - } - } - } - } - return map[string]string{} -} - -func (c *Command) SetFieldSelector(labels map[string]string) { - if c.Args == nil { - c.Args = make(map[string]interface{}) - } - c.Args["fieldSelector"] = labels -} - -func (c *Command) GetID() string { - if c.WildWlid != "" { - return c.WildWlid - } - if c.WildSid != "" { - return c.WildSid - } - if c.Wlid != "" { - return c.Wlid - } - if c.Sid != "" { - return c.Sid - } - return "" -} - -func (c *Command) Json() string { - b, _ := json.Marshal(*c) - return fmt.Sprintf("%s", b) -} - -func SIDFallback(c *Command) { - if c.GetID() == "" { - sid, err := getSIDFromArgs(c.Args) - if err != nil || sid == "" { - return - } - c.Sid = sid - } -} - -func getSIDFromArgs(args map[string]interface{}) (string, error) { - sidInterface, ok := args["sid"] - if !ok { - return "", nil - } - sid, ok := sidInterface.(string) - if !ok || sid == "" { - return "", fmt.Errorf("sid found in args but empty") - } - // if _, err := secrethandling.SplitSecretID(sid); err != nil { - // return "", err - // } - return sid, nil -} diff --git a/cautils/armotypes/executionpolicytypes.go b/cautils/armotypes/executionpolicytypes.go deleted file mode 100644 index a4b08658..00000000 --- a/cautils/armotypes/executionpolicytypes.go +++ /dev/null @@ -1,16 +0,0 @@ -package armotypes - -type EnforcementsRule struct { - MonitoredObject []string `json:"monitoredObject"` - MonitoredObjectExistence []string `json:"objectExistence"` - MonitoredObjectEvent []string `json:"event"` - Action []string `json:"action"` -} - -type ExecutionPolicy struct { - PortalBase `json:",inline"` - Designators []PortalDesignator `json:"designators"` - PolicyType string `json:"policyType"` - CreationTime string `json:"creation_time"` - ExecutionEnforcementsRule []EnforcementsRule `json:"enforcementRules"` -} diff --git a/cautils/armotypes/portaltypes.go b/cautils/armotypes/portaltypes.go deleted file mode 100644 index 015f8363..00000000 --- a/cautils/armotypes/portaltypes.go +++ /dev/null @@ -1,66 +0,0 @@ -package armotypes - -import "strings" - -const ( - CostumerGuidQuery = "costumerGUID" - ClusterNameQuery = "cluster" - DatacenterNameQuery = "datacenter" - NamespaceQuery = "namespace" - ProjectQuery = "project" - WlidQuery = "wlid" - SidQuery = "sid" -) - -// PortalBase holds basic items data from portal BE -type PortalBase struct { - GUID string `json:"guid"` - Name string `json:"name"` - Attributes map[string]interface{} `json:"attributes,omitempty"` // could be string -} - -type DesignatorType string - -// Supported designators -const ( - DesignatorAttributes DesignatorType = "Attributes" - DesignatorAttribute DesignatorType = "Attribute" // Deprecated - /* - WorkloadID format. - k8s format: wlid://cluster-/namespace-/- - native format: wlid://datacenter-/project-/native- - */ - DesignatorWlid DesignatorType = "Wlid" - /* - Wild card - subset of wlid. e.g. - 1. Include cluster: - wlid://cluster-/ - 2. Include cluster and namespace (filter out all other namespaces): - wlid://cluster-/namespace-/ - */ - DesignatorWildWlid DesignatorType = "WildWlid" - DesignatorWlidContainer DesignatorType = "WlidContainer" - DesignatorWlidProcess DesignatorType = "WlidProcess" - DesignatorSid DesignatorType = "Sid" // secret id -) - -func (dt DesignatorType) ToLower() DesignatorType { - return DesignatorType(strings.ToLower(string(dt))) -} - -// attributes -const ( - AttributeCluster = "cluster" - AttributeNamespace = "namespace" - AttributeKind = "kind" - AttributeName = "name" -) - -// PortalDesignator represented single designation options -type PortalDesignator struct { - DesignatorType DesignatorType `json:"designatorType"` - WLID string `json:"wlid"` - WildWLID string `json:"wildwlid"` - SID string `json:"sid"` - Attributes map[string]string `json:"attributes"` -} diff --git a/cautils/armotypes/portaltypes_mock.go b/cautils/armotypes/portaltypes_mock.go deleted file mode 100644 index 3b860bec..00000000 --- a/cautils/armotypes/portaltypes_mock.go +++ /dev/null @@ -1,18 +0,0 @@ -package armotypes - -func MockPortalBase(customerGUID, name string, attributes map[string]interface{}) *PortalBase { - if customerGUID == "" { - customerGUID = "36b6f9e1-3b63-4628-994d-cbe16f81e9c7" - } - if name == "" { - name = "portalbase-a" - } - if attributes == nil { - attributes = make(map[string]interface{}) - } - return &PortalBase{ - GUID: customerGUID, - Name: name, - Attributes: attributes, - } -} diff --git a/cautils/armotypes/portaltypesutils.go b/cautils/armotypes/portaltypesutils.go deleted file mode 100644 index 8075bc4a..00000000 --- a/cautils/armotypes/portaltypesutils.go +++ /dev/null @@ -1,113 +0,0 @@ -package armotypes - -import ( - "github.com/armosec/kubescape/cautils/cautils" - "github.com/golang/glog" -) - -var IgnoreLabels = []string{AttributeCluster, AttributeNamespace} - -func (designator *PortalDesignator) GetCluster() string { - cluster, _, _, _, _ := designator.DigestPortalDesignator() - return cluster -} - -func (designator *PortalDesignator) GetNamespace() string { - _, namespace, _, _, _ := designator.DigestPortalDesignator() - return namespace -} - -func (designator *PortalDesignator) GetKind() string { - _, _, kind, _, _ := designator.DigestPortalDesignator() - return kind -} - -func (designator *PortalDesignator) GetName() string { - _, _, _, name, _ := designator.DigestPortalDesignator() - return name -} -func (designator *PortalDesignator) GetLabels() map[string]string { - _, _, _, _, labels := designator.DigestPortalDesignator() - return labels -} - -// DigestPortalDesignator - get cluster namespace and labels from designator -func (designator *PortalDesignator) DigestPortalDesignator() (string, string, string, string, map[string]string) { - switch designator.DesignatorType.ToLower() { - case DesignatorAttributes.ToLower(), DesignatorAttribute.ToLower(): - return designator.DigestAttributesDesignator() - case DesignatorWlid.ToLower(), DesignatorWildWlid.ToLower(): - return cautils.GetClusterFromWlid(designator.WLID), cautils.GetNamespaceFromWlid(designator.WLID), cautils.GetKindFromWlid(designator.WLID), cautils.GetNameFromWlid(designator.WLID), map[string]string{} - // case DesignatorSid: // TODO - default: - glog.Warningf("in 'digestPortalDesignator' designator type: '%v' not yet supported. please contact Armo team", designator.DesignatorType) - } - return "", "", "", "", nil -} - -func (designator *PortalDesignator) DigestAttributesDesignator() (string, string, string, string, map[string]string) { - cluster := "" - namespace := "" - kind := "" - name := "" - labels := map[string]string{} - attributes := designator.Attributes - if attributes == nil { - return cluster, namespace, kind, name, labels - } - for k, v := range attributes { - labels[k] = v - } - if v, ok := attributes[AttributeNamespace]; ok { - namespace = v - delete(labels, AttributeNamespace) - } - if v, ok := attributes[AttributeCluster]; ok { - cluster = v - delete(labels, AttributeCluster) - } - if v, ok := attributes[AttributeKind]; ok { - kind = v - delete(labels, AttributeKind) - } - if v, ok := attributes[AttributeName]; ok { - name = v - delete(labels, AttributeName) - } - return cluster, namespace, kind, name, labels -} - -// DigestPortalDesignator DEPRECATED. use designator.DigestPortalDesignator() - get cluster namespace and labels from designator -func DigestPortalDesignator(designator *PortalDesignator) (string, string, map[string]string) { - switch designator.DesignatorType { - case DesignatorAttributes, DesignatorAttribute: - return DigestAttributesDesignator(designator.Attributes) - case DesignatorWlid, DesignatorWildWlid: - return cautils.GetClusterFromWlid(designator.WLID), cautils.GetNamespaceFromWlid(designator.WLID), map[string]string{} - // case DesignatorSid: // TODO - default: - glog.Warningf("in 'digestPortalDesignator' designator type: '%v' not yet supported. please contact Armo team", designator.DesignatorType) - } - return "", "", nil -} -func DigestAttributesDesignator(attributes map[string]string) (string, string, map[string]string) { - cluster := "" - namespace := "" - labels := map[string]string{} - if attributes == nil { - return cluster, namespace, labels - } - for k, v := range attributes { - labels[k] = v - } - if v, ok := attributes[AttributeNamespace]; ok { - namespace = v - delete(labels, AttributeNamespace) - } - if v, ok := attributes[AttributeCluster]; ok { - cluster = v - delete(labels, AttributeCluster) - } - - return cluster, namespace, labels -} diff --git a/cautils/armotypes/postureexceptionpolicytypes.go b/cautils/armotypes/postureexceptionpolicytypes.go deleted file mode 100644 index 81603b97..00000000 --- a/cautils/armotypes/postureexceptionpolicytypes.go +++ /dev/null @@ -1,42 +0,0 @@ -package armotypes - -type PostureExceptionPolicyActions string - -const AlertOnly PostureExceptionPolicyActions = "alertOnly" -const Disable PostureExceptionPolicyActions = "disable" - -type PostureExceptionPolicy struct { - PortalBase `json:",inline"` - PolicyType string `json:"policyType"` - CreationTime string `json:"creationTime"` - Actions []PostureExceptionPolicyActions `json:"actions"` - Resources []PortalDesignator `json:"resources"` - PosturePolicies []PosturePolicy `json:"posturePolicies"` -} - -type PosturePolicy struct { - FrameworkName string `json:"frameworkName"` - ControlName string `json:"controlName"` - RuleName string `json:"ruleName"` -} - -func (exceptionPolicy *PostureExceptionPolicy) IsAlertOnly() bool { - if exceptionPolicy.IsDisable() { - return false - } - - for i := range exceptionPolicy.Actions { - if exceptionPolicy.Actions[i] == AlertOnly { - return true - } - } - return false -} -func (exceptionPolicy *PostureExceptionPolicy) IsDisable() bool { - for i := range exceptionPolicy.Actions { - if exceptionPolicy.Actions[i] == Disable { - return true - } - } - return false -} diff --git a/cautils/armotypes/postureexceptionpolicytypesutils.go b/cautils/armotypes/postureexceptionpolicytypesutils.go deleted file mode 100644 index c373357e..00000000 --- a/cautils/armotypes/postureexceptionpolicytypesutils.go +++ /dev/null @@ -1 +0,0 @@ -package armotypes diff --git a/cautils/cautils/armometadata.go b/cautils/cautils/armometadata.go deleted file mode 100644 index b685d153..00000000 --- a/cautils/cautils/armometadata.go +++ /dev/null @@ -1,196 +0,0 @@ -package cautils - -import ( - "encoding/json" - "fmt" - "os" - "strings" - - "github.com/golang/glog" -) - -// labels added to the workload -const ( - ArmoPrefix string = "armo" - ArmoAttach string = ArmoPrefix + ".attach" - ArmoInitialSecret string = ArmoPrefix + ".initial" - ArmoSecretStatus string = ArmoPrefix + ".secret" - ArmoCompatibleLabel string = ArmoPrefix + ".compatible" - - ArmoSecretProtectStatus string = "protect" - ArmoSecretClearStatus string = "clear" -) - -// annotations added to the workload -const ( - ArmoUpdate string = ArmoPrefix + ".last-update" - ArmoWlid string = ArmoPrefix + ".wlid" - ArmoSid string = ArmoPrefix + ".sid" - ArmoJobID string = ArmoPrefix + ".job" - ArmoJobIDPath string = ArmoJobID + "/id" - ArmoJobParentPath string = ArmoJobID + "/parent" - ArmoJobActionPath string = ArmoJobID + "/action" - ArmoCompatibleAnnotation string = ArmoAttach + "/compatible" - ArmoReplaceheaders string = ArmoAttach + "/replaceheaders" -) - -const ( // DEPRECATED - - CAAttachLabel string = "cyberarmor" - Patched string = "Patched" - Done string = "Done" - Encrypted string = "Protected" - - CAInjectOld = "injectCyberArmor" - - CAPrefix string = "cyberarmor" - CAProtectedSecret string = CAPrefix + ".secret" - CAInitialSecret string = CAPrefix + ".initial" - CAInject string = CAPrefix + ".inject" - CAIgnore string = CAPrefix + ".ignore" - CAReplaceHeaders string = CAPrefix + ".removeSecurityHeaders" -) - -const ( // DEPRECATED - CAUpdate string = CAPrefix + ".last-update" - CAStatus string = CAPrefix + ".status" - CAWlid string = CAPrefix + ".wlid" -) - -type ClusterConfig struct { - EventReceiverREST string `json:"eventReceiverREST"` - EventReceiverWS string `json:"eventReceiverWS"` - MaserNotificationServer string `json:"maserNotificationServer"` - Postman string `json:"postman"` - Dashboard string `json:"dashboard"` - Portal string `json:"portal"` - CustomerGUID string `json:"customerGUID"` - ClusterGUID string `json:"clusterGUID"` - ClusterName string `json:"clusterName"` - OciImageURL string `json:"ociImageURL"` - NotificationWSURL string `json:"notificationWSURL"` - NotificationRestURL string `json:"notificationRestURL"` - VulnScanURL string `json:"vulnScanURL"` - OracleURL string `json:"oracleURL"` - ClairURL string `json:"clairURL"` -} - -// represents workload basic info -type SpiffeBasicInfo struct { - //cluster/datacenter - Level0 string `json:"level0"` - Level0Type string `json:"level0Type"` - - //namespace/project - Level1 string `json:"level0"` - Level1Type string `json:"level0Type"` - - Kind string `json:"kind"` - Name string `json:"name"` -} - -type ImageInfo struct { - Registry string `json:"registry"` - VersionImage string `json:"versionImage"` -} - -func IsAttached(labels map[string]string) *bool { - attach := false - if labels == nil { - return nil - } - if attached, ok := labels[ArmoAttach]; ok { - if strings.ToLower(attached) == "true" { - attach = true - return &attach - } else { - return &attach - } - } - - // deprecated - if _, ok := labels[CAAttachLabel]; ok { - attach = true - return &attach - } - - // deprecated - if inject, ok := labels[CAInject]; ok { - if strings.ToLower(inject) == "true" { - attach = true - return &attach - } - } - - // deprecated - if ignore, ok := labels[CAIgnore]; ok { - if strings.ToLower(ignore) == "true" { - return &attach - } - } - - return nil -} - -func IsSecretProtected(labels map[string]string) *bool { - protect := false - if labels == nil { - return nil - } - if protected, ok := labels[ArmoSecretStatus]; ok { - if strings.ToLower(protected) == ArmoSecretProtectStatus { - protect = true - return &protect - } else { - return &protect - } - } - return nil -} - -func LoadConfig(configPath string, loadToEnv bool) (*ClusterConfig, error) { - if configPath == "" { - configPath = "/etc/config/clusterData.json" - } - - dat, err := os.ReadFile(configPath) - if err != nil || len(dat) == 0 { - return nil, fmt.Errorf("Config empty or not found. path: %s", configPath) - } - componentConfig := &ClusterConfig{} - if err := json.Unmarshal(dat, componentConfig); err != nil { - return componentConfig, fmt.Errorf("Failed to read component config, path: %s, reason: %s", configPath, err.Error()) - } - if loadToEnv { - componentConfig.LoadConfigToEnv() - } - return componentConfig, nil -} - -func (clusterConfig *ClusterConfig) LoadConfigToEnv() { - - SetEnv("CA_CLUSTER_NAME", clusterConfig.ClusterName) - SetEnv("CA_CLUSTER_GUID", clusterConfig.ClusterGUID) - SetEnv("CA_ORACLE_SERVER", clusterConfig.OracleURL) - SetEnv("CA_CUSTOMER_GUID", clusterConfig.CustomerGUID) - SetEnv("CA_DASHBOARD_BACKEND", clusterConfig.Dashboard) - SetEnv("CA_NOTIFICATION_SERVER_REST", clusterConfig.NotificationWSURL) - SetEnv("CA_NOTIFICATION_SERVER_WS", clusterConfig.NotificationWSURL) - SetEnv("CA_NOTIFICATION_SERVER_REST", clusterConfig.NotificationRestURL) - SetEnv("CA_OCIMAGE_URL", clusterConfig.OciImageURL) - SetEnv("CA_K8S_REPORT_URL", clusterConfig.EventReceiverWS) - SetEnv("CA_EVENT_RECEIVER_HTTP", clusterConfig.EventReceiverREST) - SetEnv("CA_VULNSCAN", clusterConfig.VulnScanURL) - SetEnv("CA_POSTMAN", clusterConfig.Postman) - SetEnv("MASTER_NOTIFICATION_SERVER_HOST", clusterConfig.MaserNotificationServer) - SetEnv("CLAIR_URL", clusterConfig.ClairURL) - -} - -func SetEnv(key, value string) { - if e := os.Getenv(key); e == "" { - if err := os.Setenv(key, value); err != nil { - glog.Warningf("%s: %s", key, err.Error()) - } - } -} diff --git a/cautils/cautils/cautils_test.go b/cautils/cautils/cautils_test.go deleted file mode 100644 index f7728e7d..00000000 --- a/cautils/cautils/cautils_test.go +++ /dev/null @@ -1,29 +0,0 @@ -package cautils - -import ( - "testing" -) - -// tests wlid parse - -func TestSpiffeWLIDToInfoSuccess(t *testing.T) { - - WLID := "wlid://cluster-HipsterShopCluster2/namespace-prod/deployment-cartservice" - ms, er := SpiffeToSpiffeInfo(WLID) - - if er != nil || ms.Level0 != "HipsterShopCluster2" || ms.Level0Type != "cluster" || ms.Level1 != "prod" || ms.Level1Type != "namespace" || - ms.Kind != "deployment" || ms.Name != "cartservice" { - t.Errorf("TestSpiffeWLIDToInfoSuccess failed to parse %v", WLID) - } -} - -func TestSpiffeSIDInfoSuccess(t *testing.T) { - - SID := "sid://cluster-HipsterShopCluster2/namespace-dev/secret-caregcred" - ms, er := SpiffeToSpiffeInfo(SID) - - if er != nil || ms.Level0 != "HipsterShopCluster2" || ms.Level0Type != "cluster" || ms.Level1 != "dev" || ms.Level1Type != "namespace" || - ms.Kind != "secret" || ms.Name != "caregcred" { - t.Errorf("TestSpiffeSIDInfoSuccess failed to parse %v", SID) - } -} diff --git a/cautils/cautils/genericutils.go b/cautils/cautils/genericutils.go deleted file mode 100644 index ae1487ba..00000000 --- a/cautils/cautils/genericutils.go +++ /dev/null @@ -1,118 +0,0 @@ -package cautils - -import ( - "crypto/sha256" - "fmt" - "strings" -) - -// wlid/ sid utils -const ( - SpiffePrefix = "://" -) - -// wlid/ sid utils -const ( - PackagePath = "vendor/github.com/armosec/capacketsgo" -) - -//AsSHA256 takes anything turns it into string :) https://blog.8bitzen.com/posts/22-08-2019-how-to-hash-a-struct-in-go -func AsSHA256(v interface{}) string { - h := sha256.New() - h.Write([]byte(fmt.Sprintf("%v", v))) - - return fmt.Sprintf("%x", h.Sum(nil)) -} - -func SpiffeToSpiffeInfo(spiffe string) (*SpiffeBasicInfo, error) { - basicInfo := &SpiffeBasicInfo{} - - pos := strings.Index(spiffe, SpiffePrefix) - if pos < 0 { - return nil, fmt.Errorf("invalid spiffe %s", spiffe) - } - - pos += len(SpiffePrefix) - spiffeNoPrefix := spiffe[pos:] - splits := strings.Split(spiffeNoPrefix, "/") - if len(splits) < 3 { - return nil, fmt.Errorf("invalid spiffe %s", spiffe) - } - - p0 := strings.Index(splits[0], "-") - p1 := strings.Index(splits[1], "-") - p2 := strings.Index(splits[2], "-") - if p0 == -1 || p1 == -1 || p2 == -1 { - return nil, fmt.Errorf("invalid spiffe %s", spiffe) - } - basicInfo.Level0Type = splits[0][:p0] - basicInfo.Level0 = splits[0][p0+1:] - basicInfo.Level1Type = splits[1][:p1] - basicInfo.Level1 = splits[1][p1+1:] - basicInfo.Kind = splits[2][:p2] - basicInfo.Name = splits[2][p2+1:] - - return basicInfo, nil -} - -func ImageTagToImageInfo(imageTag string) (*ImageInfo, error) { - ImageInfo := &ImageInfo{} - spDelimiter := "/" - pos := strings.Index(imageTag, spDelimiter) - if pos < 0 { - ImageInfo.Registry = "" - ImageInfo.VersionImage = imageTag - return ImageInfo, nil - } - - splits := strings.Split(imageTag, spDelimiter) - if len(splits) == 0 { - - return nil, fmt.Errorf("Invalid image info %s", imageTag) - } - - ImageInfo.Registry = splits[0] - if len(splits) > 1 { - ImageInfo.VersionImage = splits[len(splits)-1] - } else { - ImageInfo.VersionImage = "" - } - - return ImageInfo, nil -} - -func BoolPointer(b bool) *bool { return &b } - -func BoolToString(b bool) string { - if b { - return "true" - } - return "false" -} - -func BoolPointerToString(b *bool) string { - if b == nil { - return "" - } - if *b { - return "true" - } - return "false" -} - -func StringToBool(s string) bool { - if strings.ToLower(s) == "true" || strings.ToLower(s) == "1" { - return true - } - return false -} - -func StringToBoolPointer(s string) *bool { - if strings.ToLower(s) == "true" || strings.ToLower(s) == "1" { - return BoolPointer(true) - } - if strings.ToLower(s) == "false" || strings.ToLower(s) == "0" { - return BoolPointer(false) - } - return nil -} diff --git a/cautils/cautils/k8sutils.go b/cautils/cautils/k8sutils.go deleted file mode 100644 index bbb2013a..00000000 --- a/cautils/cautils/k8sutils.go +++ /dev/null @@ -1,52 +0,0 @@ -package cautils - -import ( - "fmt" - "hash/fnv" - "strings" - - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" -) - -var NamespacesListToIgnore = make([]string, 0) -var KubeNamespaces = []string{metav1.NamespaceSystem, metav1.NamespacePublic} - -// NamespacesListToIgnore namespaces to ignore if a pod -func InitNamespacesListToIgnore(caNamespace string) { - if len(NamespacesListToIgnore) > 0 { - return - } - NamespacesListToIgnore = append(NamespacesListToIgnore, KubeNamespaces...) - NamespacesListToIgnore = append(NamespacesListToIgnore, caNamespace) -} - -func IfIgnoreNamespace(ns string) bool { - for i := range NamespacesListToIgnore { - if NamespacesListToIgnore[i] == ns { - return true - } - } - return false -} - -func IfKubeNamespace(ns string) bool { - for i := range KubeNamespaces { - if NamespacesListToIgnore[i] == ns { - return true - } - } - return false -} - -func hash(s string) string { - h := fnv.New32a() - h.Write([]byte(s)) - return fmt.Sprintf("%d", h.Sum32()) -} -func GenarateConfigMapName(wlid string) string { - name := strings.ToLower(fmt.Sprintf("ca-%s-%s-%s", GetNamespaceFromWlid(wlid), GetKindFromWlid(wlid), GetNameFromWlid(wlid))) - if len(name) >= 63 { - name = hash(name) - } - return name -} diff --git a/cautils/cautils/wlid.go b/cautils/cautils/wlid.go deleted file mode 100644 index c44a89c6..00000000 --- a/cautils/cautils/wlid.go +++ /dev/null @@ -1,238 +0,0 @@ -package cautils - -import ( - "fmt" - "strings" -) - -// API fields -var ( - WlidPrefix = "wlid://" - SidPrefix = "sid://" - ClusterWlidPrefix = "cluster-" - NamespaceWlidPrefix = "namespace-" - DataCenterWlidPrefix = "datacenter-" - ProjectWlidPrefix = "project-" - SecretSIDPrefix = "secret-" - SubSecretSIDPrefix = "subsecret-" - K8SKindsList = []string{"ComponentStatus", "ConfigMap", "ControllerRevision", "CronJob", - "CustomResourceDefinition", "DaemonSet", "Deployment", "Endpoints", "Event", "HorizontalPodAutoscaler", - "Ingress", "Job", "Lease", "LimitRange", "LocalSubjectAccessReview", "MutatingWebhookConfiguration", - "Namespace", "NetworkPolicy", "Node", "PersistentVolume", "PersistentVolumeClaim", "Pod", - "PodDisruptionBudget", "PodSecurityPolicy", "PodTemplate", "PriorityClass", "ReplicaSet", - "ReplicationController", "ResourceQuota", "Role", "RoleBinding", "Secret", "SelfSubjectAccessReview", - "SelfSubjectRulesReview", "Service", "ServiceAccount", "StatefulSet", "StorageClass", - "SubjectAccessReview", "TokenReview", "ValidatingWebhookConfiguration", "VolumeAttachment"} - NativeKindsList = []string{"Dockerized", "Native"} - KindReverseMap = map[string]string{} - dataImagesList = []string{} -) - -func IsWlid(id string) bool { - return strings.HasPrefix(id, WlidPrefix) -} - -func IsSid(id string) bool { - return strings.HasPrefix(id, SidPrefix) -} - -// GetK8SKindFronList get the calculated wlid -func GetK8SKindFronList(kind string) string { // TODO GetK8SKindFromList - for i := range K8SKindsList { - if strings.ToLower(kind) == strings.ToLower(K8SKindsList[i]) { - return K8SKindsList[i] - } - } - return kind -} - -// IsK8SKindInList Check if the kind is a known kind -func IsK8SKindInList(kind string) bool { - for i := range K8SKindsList { - if strings.ToLower(kind) == strings.ToLower(K8SKindsList[i]) { - return true - } - } - return false -} - -// generateWLID -func generateWLID(pLevel0, level0, pLevel1, level1, k, name string) string { - kind := strings.ToLower(k) - kind = strings.Replace(kind, "-", "", -1) - - wlid := WlidPrefix - wlid += fmt.Sprintf("%s%s", pLevel0, level0) - if level1 == "" { - return wlid - } - wlid += fmt.Sprintf("/%s%s", pLevel1, level1) - - if kind == "" { - return wlid - } - wlid += fmt.Sprintf("/%s", kind) - - if name == "" { - return wlid - } - wlid += fmt.Sprintf("-%s", name) - - return wlid -} - -// GetWLID get the calculated wlid -func GetWLID(level0, level1, k, name string) string { - return generateWLID(ClusterWlidPrefix, level0, NamespaceWlidPrefix, level1, k, name) -} - -// GetK8sWLID get the k8s calculated wlid -func GetK8sWLID(level0, level1, k, name string) string { - return generateWLID(ClusterWlidPrefix, level0, NamespaceWlidPrefix, level1, k, name) -} - -// GetNativeWLID get the native calculated wlid -func GetNativeWLID(level0, level1, k, name string) string { - return generateWLID(DataCenterWlidPrefix, level0, ProjectWlidPrefix, level1, k, name) -} - -// WildWlidContainsWlid does WildWlid contains Wlid -func WildWlidContainsWlid(wildWlid, wlid string) bool { // TODO- test - if wildWlid == wlid { - return true - } - wildWlidR, _ := RestoreMicroserviceIDsFromSpiffe(wildWlid) - wlidR, _ := RestoreMicroserviceIDsFromSpiffe(wlid) - if len(wildWlidR) > len(wildWlidR) { - // invalid wlid - return false - } - - for i := range wildWlidR { - if wildWlidR[i] != wlidR[i] { - return false - } - } - return true -} - -func restoreInnerIdentifiersFromID(spiffeSlices []string) []string { - if len(spiffeSlices) >= 1 && strings.HasPrefix(spiffeSlices[0], ClusterWlidPrefix) { - spiffeSlices[0] = spiffeSlices[0][len(ClusterWlidPrefix):] - } - if len(spiffeSlices) >= 2 && strings.HasPrefix(spiffeSlices[1], NamespaceWlidPrefix) { - spiffeSlices[1] = spiffeSlices[1][len(NamespaceWlidPrefix):] - } - if len(spiffeSlices) >= 3 && strings.Contains(spiffeSlices[2], "-") { - dashIdx := strings.Index(spiffeSlices[2], "-") - spiffeSlices = append(spiffeSlices, spiffeSlices[2][dashIdx+1:]) - spiffeSlices[2] = spiffeSlices[2][:dashIdx] - if val, ok := KindReverseMap[spiffeSlices[2]]; ok { - spiffeSlices[2] = val - } - } - return spiffeSlices -} - -// RestoreMicroserviceIDsFromSpiffe - -func RestoreMicroserviceIDsFromSpiffe(spiffe string) ([]string, error) { - if spiffe == "" { - return nil, fmt.Errorf("in RestoreMicroserviceIDsFromSpiffe, expecting valid wlid recieved empty string") - } - - if StringHasWhitespace(spiffe) { - return nil, fmt.Errorf("wlid %s invalid. whitespace found", spiffe) - } - - if strings.HasPrefix(spiffe, WlidPrefix) { - spiffe = spiffe[len(WlidPrefix):] - } else if strings.HasPrefix(spiffe, SidPrefix) { - spiffe = spiffe[len(SidPrefix):] - } - spiffeSlices := strings.Split(spiffe, "/") - // The documented WLID format (https://cyberarmorio.sharepoint.com/sites/development2/Shared%20Documents/kubernetes_design1.docx?web=1) - if len(spiffeSlices) <= 3 { - spiffeSlices = restoreInnerIdentifiersFromID(spiffeSlices) - } - if len(spiffeSlices) != 4 { // first used WLID, deprecated since 24.10.2019 - return spiffeSlices, fmt.Errorf("invalid WLID format. format received: %v", spiffeSlices) - } - - for i := range spiffeSlices { - if spiffeSlices[i] == "" { - return spiffeSlices, fmt.Errorf("one or more entities are empty, spiffeSlices: %v", spiffeSlices) - } - } - - return spiffeSlices, nil -} - -// RestoreMicroserviceIDsFromSpiffe - -func RestoreMicroserviceIDs(spiffe string) []string { - if spiffe == "" { - return []string{} - } - - if StringHasWhitespace(spiffe) { - return []string{} - } - - if strings.HasPrefix(spiffe, WlidPrefix) { - spiffe = spiffe[len(WlidPrefix):] - } else if strings.HasPrefix(spiffe, SidPrefix) { - spiffe = spiffe[len(SidPrefix):] - } - spiffeSlices := strings.Split(spiffe, "/") - - return restoreInnerIdentifiersFromID(spiffeSlices) -} - -// GetClusterFromWlid parse wlid and get cluster -func GetClusterFromWlid(wlid string) string { - r := RestoreMicroserviceIDs(wlid) - if len(r) >= 1 { - return r[0] - } - return "" -} - -// GetNamespaceFromWlid parse wlid and get Namespace -func GetNamespaceFromWlid(wlid string) string { - r := RestoreMicroserviceIDs(wlid) - if len(r) >= 2 { - return r[1] - } - return "" -} - -// GetKindFromWlid parse wlid and get kind -func GetKindFromWlid(wlid string) string { - r := RestoreMicroserviceIDs(wlid) - if len(r) >= 3 { - return GetK8SKindFronList(r[2]) - } - return "" -} - -// GetNameFromWlid parse wlid and get name -func GetNameFromWlid(wlid string) string { - r := RestoreMicroserviceIDs(wlid) - if len(r) >= 4 { - return GetK8SKindFronList(r[3]) - } - return "" -} - -// IsWlidValid test if wlid is a valid wlid -func IsWlidValid(wlid string) error { - _, err := RestoreMicroserviceIDsFromSpiffe(wlid) - return err -} - -// StringHasWhitespace check if a string has whitespace -func StringHasWhitespace(str string) bool { - if whitespace := strings.Index(str, " "); whitespace != -1 { - return true - } - return false -} diff --git a/cautils/customerloader.go b/cautils/customerloader.go index 0eef7348..a7a336d0 100644 --- a/cautils/customerloader.go +++ b/cautils/customerloader.go @@ -11,7 +11,7 @@ import ( "github.com/armosec/kubescape/cautils/getter" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "github.com/armosec/kubescape/cautils/k8sinterface" + "github.com/armosec/k8s-interface/k8sinterface" corev1 "k8s.io/api/core/v1" ) diff --git a/cautils/datastructures.go b/cautils/datastructures.go index 6aa70e1f..78843378 100644 --- a/cautils/datastructures.go +++ b/cautils/datastructures.go @@ -1,8 +1,8 @@ package cautils import ( - "github.com/armosec/kubescape/cautils/armotypes" - "github.com/armosec/kubescape/cautils/opapolicy" + "github.com/armosec/armoapi-go/armotypes" + "github.com/armosec/armoapi-go/opapolicy" ) // K8SResources map[//] diff --git a/cautils/getter/armoapi.go b/cautils/getter/armoapi.go index dd06be4c..9cd3496d 100644 --- a/cautils/getter/armoapi.go +++ b/cautils/getter/armoapi.go @@ -4,8 +4,8 @@ import ( "fmt" "net/http" - "github.com/armosec/kubescape/cautils/armotypes" - "github.com/armosec/kubescape/cautils/opapolicy" + "github.com/armosec/armoapi-go/armotypes" + "github.com/armosec/armoapi-go/opapolicy" ) // ======================================================================================================================= diff --git a/cautils/getter/downloadreleasedpolicy.go b/cautils/getter/downloadreleasedpolicy.go index 1740888a..eec1b2d0 100644 --- a/cautils/getter/downloadreleasedpolicy.go +++ b/cautils/getter/downloadreleasedpolicy.go @@ -6,7 +6,7 @@ import ( "io" "net/http" - "github.com/armosec/kubescape/cautils/opapolicy" + "github.com/armosec/armoapi-go/opapolicy" ) // ======================================================================================================================= diff --git a/cautils/getter/getpolicies.go b/cautils/getter/getpolicies.go index 59974d38..dbf22ac3 100644 --- a/cautils/getter/getpolicies.go +++ b/cautils/getter/getpolicies.go @@ -1,8 +1,8 @@ package getter import ( - "github.com/armosec/kubescape/cautils/armotypes" - "github.com/armosec/kubescape/cautils/opapolicy" + "github.com/armosec/armoapi-go/armotypes" + "github.com/armosec/armoapi-go/opapolicy" ) type IPolicyGetter interface { diff --git a/cautils/getter/getpoliciesutils.go b/cautils/getter/getpoliciesutils.go index 8eba7a87..528b9845 100644 --- a/cautils/getter/getpoliciesutils.go +++ b/cautils/getter/getpoliciesutils.go @@ -10,7 +10,7 @@ import ( "path/filepath" "strings" - "github.com/armosec/kubescape/cautils/opapolicy" + "github.com/armosec/armoapi-go/opapolicy" ) func GetDefaultPath(name string) string { diff --git a/cautils/getter/loadpolicy.go b/cautils/getter/loadpolicy.go index 127073cd..1371cafd 100644 --- a/cautils/getter/loadpolicy.go +++ b/cautils/getter/loadpolicy.go @@ -6,8 +6,8 @@ import ( "os" "strings" - "github.com/armosec/kubescape/cautils/armotypes" - "github.com/armosec/kubescape/cautils/opapolicy" + "github.com/armosec/armoapi-go/armotypes" + "github.com/armosec/armoapi-go/opapolicy" ) // ======================================================================================================================= diff --git a/cautils/k8sinterface/cloudvendorregistrycreds.go b/cautils/k8sinterface/cloudvendorregistrycreds.go deleted file mode 100644 index 06996ade..00000000 --- a/cautils/k8sinterface/cloudvendorregistrycreds.go +++ /dev/null @@ -1,265 +0,0 @@ -package k8sinterface - -import ( - "bytes" - "encoding/base64" - "encoding/json" - "fmt" - "io" - "net/http" - "net/url" - "strings" - "time" - - "github.com/aws/aws-sdk-go/aws" - "github.com/aws/aws-sdk-go/aws/session" - "github.com/aws/aws-sdk-go/service/ecr" - "github.com/docker/docker/api/types" -) - -// For GCR there are some permissions one need to assign in order to allow ARMO to pull images: -// https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity -// gcloud iam service-accounts create armo-controller-sa -// gcloud projects add-iam-policy-binding --role roles/storage.objectViewer --member "serviceAccount:armo-controller-sa@.iam.gserviceaccount.com" -// gcloud iam service-accounts add-iam-policy-binding --role roles/iam.workloadIdentityUser --member "serviceAccount:.svc.id.goog[cyberarmor-system/ca-controller-service-account]" armo-controller-sa@.iam.gserviceaccount.com -// kubectl annotate serviceaccount --overwrite --namespace cyberarmor-system ca-controller-service-account iam.gke.io/gcp-service-account=armo-controller-sa@.iam.gserviceaccount.com - -const ( - gcrDefaultServiceAccountName = "default" - // armoServiceAccountName = "ca-controller-service-account" -) - -var ( - httpClient = http.Client{Timeout: 5 * time.Second} -) - -// CheckIsECRImage check if this image is suspected as ECR hosted image -func CheckIsECRImage(imageTag string) bool { - return strings.Contains(imageTag, "dkr.ecr") -} - -// GetLoginDetailsForECR return user name + password using the default iam-role OR ~/.aws/config of the machine -func GetLoginDetailsForECR(imageTag string) (string, string, error) { - // imageTag := "015253967648.dkr.ecr.eu-central-1.amazonaws.com/armo:1" - imageTagSlices := strings.Split(imageTag, ".") - repo := imageTagSlices[0] - region := imageTagSlices[3] - mySession := session.Must(session.NewSession()) - ecrClient := ecr.New(mySession, aws.NewConfig().WithRegion(region)) - input := &ecr.GetAuthorizationTokenInput{ - RegistryIds: []*string{&repo}, - } - res, err := ecrClient.GetAuthorizationToken(input) - if err != nil { - return "", "", fmt.Errorf("in PullFromECR, failed to GetAuthorizationToken: %v", err) - } - res64 := (*res.AuthorizationData[0].AuthorizationToken) - resB, err := base64.StdEncoding.DecodeString(res64) - if err != nil { - return "", "", fmt.Errorf("in PullFromECR, failed to DecodeString: %v", err) - } - delimiterIdx := bytes.IndexByte(resB, ':') - // userName := resB[:delimiterIdx] - // resB = resB[delimiterIdx+1:] - // resB, err = base64.StdEncoding.DecodeString(string(resB)) - // if err != nil { - // t.Errorf("failed to DecodeString #2: %v\n\n", err) - // } - return string(resB[:delimiterIdx]), string(resB[delimiterIdx+1:]), nil -} - -func CheckIsACRImage(imageTag string) bool { - // atest1.azurecr.io/go-inf:1 - return strings.Contains(imageTag, ".azurecr.io/") -} - -type azureADDResponseJson struct { - AccessToken string `json:"access_token"` - RefreshToken string `json:"refresh_token"` - ExpiresIn string `json:"expires_in"` - ExpiresOn string `json:"expires_on"` - NotBefore string `json:"not_before"` - Resource string `json:"resource"` - TokenType string `json:"token_type"` -} - -func getAzureAADAccessToken() (string, error) { - msi_endpoint, err := url.Parse("http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01") - if err != nil { - return "", fmt.Errorf("creating URL : %v", err) - } - msi_parameters := url.Values{} - msi_parameters.Add("resource", "https://management.azure.com/") - msi_parameters.Add("api-version", "2018-02-01") - msi_endpoint.RawQuery = msi_parameters.Encode() - req, err := http.NewRequest("GET", msi_endpoint.String(), nil) - if err != nil { - return "", fmt.Errorf("creating HTTP request : %v", err) - } - req.Header.Add("Metadata", "true") - - // Call managed services for Azure resources token endpoint - resp, err := httpClient.Do(req) - if err != nil { - return "", fmt.Errorf("calling token endpoint : %v", err) - } - - // Pull out response body - responseBytes, err := io.ReadAll(resp.Body) - defer resp.Body.Close() - if err != nil { - return "", fmt.Errorf("reading response body : %v", err) - } - if resp.StatusCode < 200 || resp.StatusCode >= 300 { - return "", fmt.Errorf("azure ActiveDirectory AT resp: %v, %v", resp.Status, string(responseBytes)) - } - - // Unmarshall response body into struct - var r azureADDResponseJson - err = json.Unmarshal(responseBytes, &r) - if err != nil { - return "", fmt.Errorf("unmarshalling the response: %v", err) - } - return r.AccessToken, nil -} - -// GetLoginDetailsForAzurCR return user name + password to use -func GetLoginDetailsForAzurCR(imageTag string) (string, string, error) { - // imageTag := "atest1.azurecr.io/go-inf:1" - imageTagSlices := strings.Split(imageTag, "/") - azureIdensAT, err := getAzureAADAccessToken() - if err != nil { - return "", "", err - } - atMap := make(map[string]interface{}) - azureIdensATSlices := strings.Split(azureIdensAT, ".") - if len(azureIdensATSlices) < 2 { - return "", "", fmt.Errorf("len(azureIdensATSlices) < 2") - } - resB, err := base64.RawStdEncoding.DecodeString(azureIdensATSlices[1]) - if err != nil { - return "", "", fmt.Errorf("in GetLoginDetailsForAzurCR, failed to DecodeString: %v, %s", err, azureIdensATSlices[1]) - } - if err := json.Unmarshal(resB, &atMap); err != nil { - return "", "", fmt.Errorf("failed to unmarshal azureIdensAT: %v, %s", err, string(resB)) - } - // excahnging AAD for ACR refresh token - refreshToken, err := excahngeAzureAADAccessTokenForACRRefreshToken(imageTagSlices[0], fmt.Sprintf("%v", atMap["tid"]), azureIdensAT) - if err != nil { - return "", "", fmt.Errorf("failed to excahngeAzureAADAccessTokenForACRRefreshToken: %v, registry: %s, tenantID: %s, azureAADAT: %s", err, imageTagSlices[0], fmt.Sprintf("%v", atMap["tid"]), azureIdensAT) - } - - return "00000000-0000-0000-0000-000000000000", refreshToken, nil -} - -func excahngeAzureAADAccessTokenForACRRefreshToken(registry, tenantID, azureAADAT string) (string, error) { - msi_parameters := url.Values{} - msi_parameters.Add("service", registry) - msi_parameters.Add("grant_type", "access_token") - msi_parameters.Add("tenant", tenantID) - msi_parameters.Add("access_token", azureAADAT) - postBodyStr := msi_parameters.Encode() - req, err := http.NewRequest("POST", fmt.Sprintf("https://%v/oauth2/exchange", registry), strings.NewReader(postBodyStr)) - if err != nil { - return "", fmt.Errorf("creating HTTP request : %v", err) - } - req.Header.Add("Metadata", "true") - req.Header.Add("Content-Type", "application/x-www-form-urlencoded") - - // Call managed services for Azure resources token endpoint - resp, err := httpClient.Do(req) - if err != nil { - return "", fmt.Errorf("calling token endpoint : %v", err) - } - - // Pull out response body - responseBytes, err := io.ReadAll(resp.Body) - defer resp.Body.Close() - if err != nil { - return "", fmt.Errorf("reading response body : %v", err) - } - if resp.StatusCode < 200 || resp.StatusCode >= 300 { - return "", fmt.Errorf("azure exchange AT resp: %v, %v", resp.Status, string(responseBytes)) - } - resultMap := make(map[string]string) - err = json.Unmarshal(responseBytes, &resultMap) - if err != nil { - return "", fmt.Errorf("unmarshalling the response: %v", err) - } - return resultMap["refresh_token"], nil -} - -func CheckIsGCRImage(imageTag string) bool { - // gcr.io/elated-pottery-310110/golang-inf:2 - return strings.Contains(imageTag, "gcr.io/") -} - -// GetLoginDetailsForGCR return user name + password to use -func GetLoginDetailsForGCR(imageTag string) (string, string, error) { - msi_endpoint, err := url.Parse(fmt.Sprintf("http://169.254.169.254/computeMetadata/v1/instance/service-accounts/%s/token", gcrDefaultServiceAccountName)) - if err != nil { - return "", "", fmt.Errorf("creating URL : %v", err) - } - req, err := http.NewRequest("GET", msi_endpoint.String(), nil) - if err != nil { - return "", "", fmt.Errorf("creating HTTP request : %v", err) - } - req.Header.Add("Metadata-Flavor", "Google") - - // Call managed services for Azure resources token endpoint - resp, err := httpClient.Do(req) - if err != nil { - return "", "", fmt.Errorf("calling token endpoint : %v", err) - } - if resp.StatusCode < 200 || resp.StatusCode >= 300 { - return "", "", fmt.Errorf("HTTP Status : %v, make sure the '%s' service account is configured for ARMO pod", resp.Status, gcrDefaultServiceAccountName) - } - defer resp.Body.Close() - respMap := make(map[string]interface{}) - if err := json.NewDecoder(resp.Body).Decode(&respMap); err != nil { - return "", "", fmt.Errorf("json Decode : %v", err) - } - return "oauth2accesstoken", fmt.Sprintf("%v", respMap["access_token"]), nil -} - -func GetCloudVendorRegistryCredentials(imageTag string) (map[string]types.AuthConfig, error) { - secrets := map[string]types.AuthConfig{} - var errRes error - if CheckIsACRImage(imageTag) { - userName, password, err := GetLoginDetailsForAzurCR(imageTag) - if err != nil { - errRes = fmt.Errorf("failed to GetLoginDetailsForACR(%s): %v", imageTag, err) - } else { - secrets[imageTag] = types.AuthConfig{ - Username: userName, - Password: password, - } - } - } - - if CheckIsECRImage(imageTag) { - userName, password, err := GetLoginDetailsForECR(imageTag) - if err != nil { - errRes = fmt.Errorf("failed to GetLoginDetailsForECR(%s): %v", imageTag, err) - } else { - secrets[imageTag] = types.AuthConfig{ - Username: userName, - Password: password, - } - } - } - - if CheckIsGCRImage(imageTag) { - userName, password, err := GetLoginDetailsForGCR(imageTag) - if err != nil { - errRes = fmt.Errorf("failed to GetLoginDetailsForGCR(%s): %v", imageTag, err) - } else { - secrets[imageTag] = types.AuthConfig{ - Username: userName, - Password: password, - } - } - } - - return secrets, errRes -} diff --git a/cautils/k8sinterface/k8sconfig.go b/cautils/k8sinterface/k8sconfig.go deleted file mode 100644 index bc1804ac..00000000 --- a/cautils/k8sinterface/k8sconfig.go +++ /dev/null @@ -1,121 +0,0 @@ -package k8sinterface - -import ( - "context" - "fmt" - "os" - "strings" - - "k8s.io/client-go/dynamic" - "k8s.io/client-go/kubernetes" - restclient "k8s.io/client-go/rest" - "k8s.io/client-go/tools/clientcmd" - - // DO NOT REMOVE - load cloud providers auth - _ "k8s.io/client-go/plugin/pkg/client/auth" - "sigs.k8s.io/controller-runtime/pkg/client/config" -) - -var ConnectedToCluster = true - -// K8SConfig pointer to k8s config -var K8SConfig *restclient.Config - -// KubernetesApi - -type KubernetesApi struct { - KubernetesClient kubernetes.Interface - DynamicClient dynamic.Interface - Context context.Context -} - -// NewKubernetesApi - -func NewKubernetesApi() *KubernetesApi { - var kubernetesClient *kubernetes.Clientset - var err error - - if !IsConnectedToCluster() { - fmt.Println(fmt.Errorf("failed to load kubernetes config: no configuration has been provided, try setting KUBECONFIG environment variable")) - os.Exit(1) - } - - kubernetesClient, err = kubernetes.NewForConfig(GetK8sConfig()) - if err != nil { - fmt.Printf("Failed to load config file, reason: %s", err.Error()) - os.Exit(1) - } - dynamicClient, err := dynamic.NewForConfig(K8SConfig) - if err != nil { - fmt.Printf("Failed to load config file, reason: %s", err.Error()) - os.Exit(1) - } - - return &KubernetesApi{ - KubernetesClient: kubernetesClient, - DynamicClient: dynamicClient, - Context: context.Background(), - } -} - -// RunningIncluster whether running in cluster -var RunningIncluster bool - -// LoadK8sConfig load config from local file or from cluster -func LoadK8sConfig() error { - kubeconfig, err := config.GetConfig() - if err != nil { - return fmt.Errorf("failed to load kubernetes config: %s", strings.ReplaceAll(err.Error(), "KUBERNETES_MASTER", "KUBECONFIG")) - } - if _, err := restclient.InClusterConfig(); err == nil { - RunningIncluster = true - } - - K8SConfig = kubeconfig - return nil -} - -// GetK8sConfig get config. load if not loaded yet -func GetK8sConfig() *restclient.Config { - if !IsConnectedToCluster() { - return nil - } - return K8SConfig -} - -func IsConnectedToCluster() bool { - if K8SConfig == nil { - if err := LoadK8sConfig(); err != nil { - ConnectedToCluster = false - } - } - return ConnectedToCluster -} -func GetClusterName() string { - if !ConnectedToCluster { - return "" - } - - kubeConfig := clientcmd.NewNonInteractiveDeferredLoadingClientConfig(clientcmd.NewDefaultClientConfigLoadingRules(), &clientcmd.ConfigOverrides{}) - config, err := kubeConfig.RawConfig() - if err != nil { - return "" - } - // TODO - Handle if empty - return config.CurrentContext -} - -func GetDefaultNamespace() string { - defaultNamespace := "default" - clientCfg, err := clientcmd.NewDefaultClientConfigLoadingRules().Load() - if err != nil { - return defaultNamespace - } - apiContext, ok := clientCfg.Contexts[clientCfg.CurrentContext] - if !ok || apiContext == nil { - return defaultNamespace - } - namespace := apiContext.Namespace - if apiContext.Namespace == "" { - namespace = defaultNamespace - } - return namespace -} diff --git a/cautils/k8sinterface/k8sconfig_test.go b/cautils/k8sinterface/k8sconfig_test.go deleted file mode 100644 index ab4be81e..00000000 --- a/cautils/k8sinterface/k8sconfig_test.go +++ /dev/null @@ -1,34 +0,0 @@ -package k8sinterface - -import ( - "testing" - - "github.com/armosec/kubescape/cautils/cautils" -) - -func TestGetGroupVersionResource(t *testing.T) { - wlid := "wlid://cluster-david-v1/namespace-default/deployment-nginx-deployment" - r, err := GetGroupVersionResource(cautils.GetKindFromWlid(wlid)) - if err != nil { - t.Error(err) - return - } - if r.Group != "apps" { - t.Errorf("wrong group") - } - if r.Version != "v1" { - t.Errorf("wrong Version") - } - if r.Resource != "deployments" { - t.Errorf("wrong Resource") - } - - r2, err := GetGroupVersionResource("NetworkPolicy") - if err != nil { - t.Error(err) - return - } - if r2.Resource != "networkpolicies" { - t.Errorf("wrong Resource") - } -} diff --git a/cautils/k8sinterface/k8sdynamic.go b/cautils/k8sinterface/k8sdynamic.go deleted file mode 100644 index f1cd93f5..00000000 --- a/cautils/k8sinterface/k8sdynamic.go +++ /dev/null @@ -1,145 +0,0 @@ -package k8sinterface - -import ( - "fmt" - "strings" - - "github.com/armosec/kubescape/cautils/cautils" - - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/labels" - "k8s.io/apimachinery/pkg/runtime/schema" - "k8s.io/client-go/dynamic" - // - // Uncomment to load all auth plugins - // _ "k8s.io/client-go/plugin/pkg/client/auth - // - // Or uncomment to load specific auth plugins - // _ "k8s.io/client-go/plugin/pkg/client/auth/azure" - // _ "k8s.io/client-go/plugin/pkg/client/auth/gcp" - // _ "k8s.io/client-go/plugin/pkg/client/auth/oidc" - // _ "k8s.io/client-go/plugin/pkg/client/auth/openstack" -) - -func (k8sAPI *KubernetesApi) GetWorkloadByWlid(wlid string) (*Workload, error) { - return k8sAPI.GetWorkload(cautils.GetNamespaceFromWlid(wlid), cautils.GetKindFromWlid(wlid), cautils.GetNameFromWlid(wlid)) -} - -func (k8sAPI *KubernetesApi) GetWorkload(namespace, kind, name string) (*Workload, error) { - groupVersionResource, err := GetGroupVersionResource(kind) - if err != nil { - return nil, err - } - - w, err := k8sAPI.ResourceInterface(&groupVersionResource, namespace).Get(k8sAPI.Context, name, metav1.GetOptions{}) - if err != nil { - return nil, fmt.Errorf("failed to GET resource, kind: '%s', namespace: '%s', name: '%s', reason: %s", kind, namespace, name, err.Error()) - } - return NewWorkloadObj(w.Object), nil -} - -func (k8sAPI *KubernetesApi) ListWorkloads(groupVersionResource *schema.GroupVersionResource, namespace string, podLabels, fieldSelector map[string]string) ([]Workload, error) { - listOptions := metav1.ListOptions{} - if podLabels != nil && len(podLabels) > 0 { - set := labels.Set(podLabels) - listOptions.LabelSelector = SelectorToString(set) - } - if fieldSelector != nil && len(fieldSelector) > 0 { - set := labels.Set(fieldSelector) - listOptions.FieldSelector = SelectorToString(set) - } - uList, err := k8sAPI.ResourceInterface(groupVersionResource, namespace).List(k8sAPI.Context, listOptions) - if err != nil { - return nil, fmt.Errorf("failed to LIST resources, reason: %s", err.Error()) - } - workloads := make([]Workload, len(uList.Items)) - for i := range uList.Items { - workloads[i] = *NewWorkloadObj(uList.Items[i].Object) - } - return workloads, nil -} - -func (k8sAPI *KubernetesApi) DeleteWorkloadByWlid(wlid string) error { - groupVersionResource, err := GetGroupVersionResource(cautils.GetKindFromWlid(wlid)) - if err != nil { - return err - } - err = k8sAPI.ResourceInterface(&groupVersionResource, cautils.GetNamespaceFromWlid(wlid)).Delete(k8sAPI.Context, cautils.GetNameFromWlid(wlid), metav1.DeleteOptions{}) - if err != nil { - return fmt.Errorf("failed to DELETE resource, workloadID: '%s', reason: %s", wlid, err.Error()) - } - return nil -} - -func (k8sAPI *KubernetesApi) CreateWorkload(workload *Workload) (*Workload, error) { - groupVersionResource, err := GetGroupVersionResource(workload.GetKind()) - if err != nil { - return nil, err - } - obj, err := workload.ToUnstructured() - if err != nil { - return nil, err - } - w, err := k8sAPI.ResourceInterface(&groupVersionResource, workload.GetNamespace()).Create(k8sAPI.Context, obj, metav1.CreateOptions{}) - if err != nil { - return nil, fmt.Errorf("failed to CREATE resource, workload: '%s', reason: %s", workload.Json(), err.Error()) - } - return NewWorkloadObj(w.Object), nil -} - -func (k8sAPI *KubernetesApi) UpdateWorkload(workload *Workload) (*Workload, error) { - groupVersionResource, err := GetGroupVersionResource(workload.GetKind()) - if err != nil { - return nil, err - } - - obj, err := workload.ToUnstructured() - if err != nil { - return nil, err - } - - w, err := k8sAPI.ResourceInterface(&groupVersionResource, workload.GetNamespace()).Update(k8sAPI.Context, obj, metav1.UpdateOptions{}) - if err != nil { - return nil, fmt.Errorf("failed to UPDATE resource, workload: '%s', reason: %s", workload.Json(), err.Error()) - } - return NewWorkloadObj(w.Object), nil -} - -func (k8sAPI *KubernetesApi) GetNamespace(ns string) (*Workload, error) { - groupVersionResource, err := GetGroupVersionResource("namespace") - if err != nil { - return nil, err - } - w, err := k8sAPI.DynamicClient.Resource(groupVersionResource).Get(k8sAPI.Context, ns, metav1.GetOptions{}) - if err != nil { - return nil, fmt.Errorf("failed to get namespace: '%s', reason: %s", ns, err.Error()) - } - return NewWorkloadObj(w.Object), nil -} - -func (k8sAPI *KubernetesApi) ResourceInterface(resource *schema.GroupVersionResource, namespace string) dynamic.ResourceInterface { - if IsNamespaceScope(resource.Group, resource.Resource) { - return k8sAPI.DynamicClient.Resource(*resource).Namespace(namespace) - } - return k8sAPI.DynamicClient.Resource(*resource) -} - -func (k8sAPI *KubernetesApi) CalculateWorkloadParentRecursive(workload *Workload) (string, string, error) { - ownerReferences, err := workload.GetOwnerReferences() // OwnerReferences in workload - if err != nil { - return workload.GetKind(), workload.GetName(), err - } - if len(ownerReferences) == 0 { - return workload.GetKind(), workload.GetName(), nil // parent found - } - ownerReference := ownerReferences[0] - - parentWorkload, err := k8sAPI.GetWorkload(workload.GetNamespace(), ownerReference.Kind, ownerReference.Name) - if err != nil { - if strings.Contains(err.Error(), "not found in resourceMap") { // if parent is RCD - return workload.GetKind(), workload.GetName(), nil // parent found - } - return workload.GetKind(), workload.GetName(), err - } - return k8sAPI.CalculateWorkloadParentRecursive(parentWorkload) -} diff --git a/cautils/k8sinterface/k8sdynamic_test.go b/cautils/k8sinterface/k8sdynamic_test.go deleted file mode 100644 index 38276444..00000000 --- a/cautils/k8sinterface/k8sdynamic_test.go +++ /dev/null @@ -1,43 +0,0 @@ -package k8sinterface - -import ( - "context" - - "k8s.io/apimachinery/pkg/runtime" - dynamicfake "k8s.io/client-go/dynamic/fake" - kubernetesfake "k8s.io/client-go/kubernetes/fake" - // - // metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - // Uncomment to load all auth plugins - // _ "k8s.io/client-go/plugin/pkg/client/auth - // - // Or uncomment to load specific auth plugins - // _ "k8s.io/client-go/plugin/pkg/client/auth/azure" - // _ "k8s.io/client-go/plugin/pkg/client/auth/gcp" - // _ "k8s.io/client-go/plugin/pkg/client/auth/oidc" - // _ "k8s.io/client-go/plugin/pkg/client/auth/openstack" -) - -// NewKubernetesApi - -func NewKubernetesApiMock() *KubernetesApi { - - return &KubernetesApi{ - KubernetesClient: kubernetesfake.NewSimpleClientset(), - DynamicClient: dynamicfake.NewSimpleDynamicClient(&runtime.Scheme{}), - Context: context.Background(), - } -} - -// func TestListDynamic(t *testing.T) { -// k8s := NewKubernetesApi() -// resource := schema.GroupVersionResource{Group: "", Version: "v1", Resource: "pods"} -// clientResource, err := k8s.DynamicClient.Resource(resource).Namespace("default").List(k8s.Context, metav1.ListOptions{}) -// if err != nil { -// t.Errorf("err: %v", err) -// } else { -// bla, _ := json.Marshal(clientResource) -// // t.Errorf("BearerToken: %v", *K8SConfig) -// // os.WriteFile("bla.json", bla, 777) -// t.Errorf("clientResource: %s", string(bla)) -// } -// } diff --git a/cautils/k8sinterface/k8sdynamicutils.go b/cautils/k8sinterface/k8sdynamicutils.go deleted file mode 100644 index 25f099ac..00000000 --- a/cautils/k8sinterface/k8sdynamicutils.go +++ /dev/null @@ -1,66 +0,0 @@ -package k8sinterface - -import ( - "sort" - "strings" - - "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" - "k8s.io/apimachinery/pkg/labels" -) - -// -// Uncomment to load all auth plugins -// _ "k8s.io/client-go/plugin/pkg/client/auth -// -// Or uncomment to load specific auth plugins -// _ "k8s.io/client-go/plugin/pkg/client/auth/azure" -// _ "k8s.io/client-go/plugin/pkg/client/auth/gcp" -// _ "k8s.io/client-go/plugin/pkg/client/auth/oidc" -// _ "k8s.io/client-go/plugin/pkg/client/auth/openstack" - -func ConvertUnstructuredSliceToMap(unstructuredSlice []unstructured.Unstructured) []map[string]interface{} { - converted := make([]map[string]interface{}, len(unstructuredSlice)) - for i := range unstructuredSlice { - converted[i] = unstructuredSlice[i].Object - } - return converted -} - -func FilterOutOwneredResources(result []unstructured.Unstructured) []unstructured.Unstructured { - response := []unstructured.Unstructured{} - recognizedOwners := []string{"Deployment", "ReplicaSet", "DaemonSet", "StatefulSet", "Job", "CronJob"} - for i := range result { - ownerReferences := result[i].GetOwnerReferences() - if len(ownerReferences) == 0 { - response = append(response, result[i]) - } else if !IsStringInSlice(recognizedOwners, ownerReferences[0].Kind) { - response = append(response, result[i]) - } - } - return response -} - -func IsStringInSlice(slice []string, val string) bool { - for _, item := range slice { - if item == val { - return true - } - } - return false -} - -// String returns all labels listed as a human readable string. -// Conveniently, exactly the format that ParseSelector takes. -func SelectorToString(ls labels.Set) string { - selector := make([]string, 0, len(ls)) - for key, value := range ls { - if value != "" { - selector = append(selector, key+"="+value) - } else { - selector = append(selector, key) - } - } - // Sort for determinism. - sort.StringSlice(selector).Sort() - return strings.Join(selector, ",") -} diff --git a/cautils/k8sinterface/k8sdynamicutils_test.go b/cautils/k8sinterface/k8sdynamicutils_test.go deleted file mode 100644 index 97dc9048..00000000 --- a/cautils/k8sinterface/k8sdynamicutils_test.go +++ /dev/null @@ -1,10 +0,0 @@ -package k8sinterface - -import "testing" - -func TestConvertUnstructuredSliceToMap(t *testing.T) { - converted := ConvertUnstructuredSliceToMap(V1KubeSystemNamespaceMock().Items) - if len(converted) == 0 { // != 7 - t.Errorf("len(converted) == 0") - } -} diff --git a/cautils/k8sinterface/k8sstatic.go b/cautils/k8sinterface/k8sstatic.go deleted file mode 100644 index 5317e66c..00000000 --- a/cautils/k8sinterface/k8sstatic.go +++ /dev/null @@ -1,71 +0,0 @@ -package k8sinterface - -import ( - "context" - - "github.com/armosec/kubescape/cautils/cautils" - - corev1 "k8s.io/api/core/v1" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/labels" -) - -func IsAttached(labels map[string]string) *bool { - return IsLabel(labels, cautils.ArmoAttach) -} - -func IsAgentCompatibleLabel(labels map[string]string) *bool { - return IsLabel(labels, cautils.ArmoCompatibleLabel) -} -func IsAgentCompatibleAnnotation(annotations map[string]string) *bool { - return IsLabel(annotations, cautils.ArmoCompatibleAnnotation) -} -func SetAgentCompatibleLabel(labels map[string]string, val bool) { - SetLabel(labels, cautils.ArmoCompatibleLabel, val) -} -func SetAgentCompatibleAnnotation(annotations map[string]string, val bool) { - SetLabel(annotations, cautils.ArmoCompatibleAnnotation, val) -} -func IsLabel(labels map[string]string, key string) *bool { - if labels == nil || len(labels) == 0 { - return nil - } - var k bool - if l, ok := labels[key]; ok { - if l == "true" { - k = true - } else if l == "false" { - k = false - } - return &k - } - return nil -} -func SetLabel(labels map[string]string, key string, val bool) { - if labels == nil { - return - } - v := "" - if val { - v = "true" - } else { - v = "false" - } - labels[key] = v -} -func (k8sAPI *KubernetesApi) ListAttachedPods(namespace string) ([]corev1.Pod, error) { - return k8sAPI.ListPods(namespace, map[string]string{cautils.ArmoAttach: cautils.BoolToString(true)}) -} - -func (k8sAPI *KubernetesApi) ListPods(namespace string, podLabels map[string]string) ([]corev1.Pod, error) { - listOptions := metav1.ListOptions{} - if podLabels != nil && len(podLabels) > 0 { - set := labels.Set(podLabels) - listOptions.LabelSelector = set.AsSelector().String() - } - pods, err := k8sAPI.KubernetesClient.CoreV1().Pods(namespace).List(context.Background(), listOptions) - if err != nil { - return []corev1.Pod{}, err - } - return pods.Items, nil -} diff --git a/cautils/k8sinterface/mockdynamicobjects.go b/cautils/k8sinterface/mockdynamicobjects.go deleted file mode 100644 index 658c4fcc..00000000 --- a/cautils/k8sinterface/mockdynamicobjects.go +++ /dev/null @@ -1,1963 +0,0 @@ -package k8sinterface - -import ( - "encoding/json" - - "github.com/golang/glog" - "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" -) - -func V1KubeSystemNamespaceMock() *unstructured.UnstructuredList { - podsList := ` - {"apiVersion":"v1","items":[{"apiVersion":"v1","kind":"Pod","metadata":{"annotations":{"cyberarmor.jobs":"{\"jobID\":\"\",\"parentJobID\":\"\",\"actionID\":\"4\"}","cyberarmor.last-update":"07-04-2021 19:17:56","cyberarmor.status":"Patched","cyberarmor.wlid":"wlid://cluster-openrasty_seal-7fvz/namespace-default/deployment-nginx-deployment","wlid":"wlid://cluster-openrasty_seal-7fvz/namespace-default/deployment-nginx-deployment"},"creationTimestamp":"2021-04-08T06:18:15Z","generateName":"nginx-deployment-dd485bc9-","labels":{"app":"nginx","cyberarmor":"Patched","pod-template-hash":"dd485bc9"},"managedFields":[{"apiVersion":"v1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:cyberarmor.jobs":{},"f:cyberarmor.last-update":{},"f:cyberarmor.status":{},"f:cyberarmor.wlid":{},"f:wlid":{}},"f:generateName":{},"f:labels":{".":{},"f:app":{},"f:cyberarmor":{},"f:pod-template-hash":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"b223826d-3aa9-4a9d-b057-2736a8800d71\"}":{".":{},"f:apiVersion":{},"f:blockOwnerDeletion":{},"f:controller":{},"f:kind":{},"f:name":{},"f:uid":{}}}},"f:spec":{"f:containers":{"k:{\"name\":\"nginx\"}":{".":{},"f:env":{".":{},"k:{\"name\":\"CAA_CONTAINER_IMAGE_NAME\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"CAA_CONTAINER_NAME\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"CAA_ENABLE_DISCOVERY\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"CAA_HOME\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"CAA_LOADNAMES\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"CAA_NOTIFICATION_SERVER\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"CAA_ORACLE_SERVER\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"CAA_POD_NAME\"}":{".":{},"f:name":{},"f:valueFrom":{".":{},"f:fieldRef":{".":{},"f:apiVersion":{},"f:fieldPath":{}}}},"k:{\"name\":\"CAA_POD_NAMESPACE\"}":{".":{},"f:name":{},"f:valueFrom":{".":{},"f:fieldRef":{".":{},"f:apiVersion":{},"f:fieldPath":{}}}},"k:{\"name\":\"LD_PRELOAD\"}":{".":{},"f:name":{},"f:value":{}}},"f:image":{},"f:imagePullPolicy":{},"f:name":{},"f:ports":{".":{},"k:{\"containerPort\":80,\"protocol\":\"TCP\"}":{".":{},"f:containerPort":{},"f:protocol":{}}},"f:resources":{},"f:terminationMessagePath":{},"f:terminationMessagePolicy":{}}},"f:dnsPolicy":{},"f:enableServiceLinks":{},"f:restartPolicy":{},"f:schedulerName":{},"f:securityContext":{},"f:terminationGracePeriodSeconds":{},"f:volumes":{".":{},"k:{\"name\":\"caa-home-vol\"}":{".":{},"f:emptyDir":{},"f:name":{}}}}},"manager":"kube-controller-manager","operation":"Update","time":"2021-04-09T09:29:24Z"},{"apiVersion":"v1","fieldsType":"FieldsV1","fieldsV1":{"f:status":{"f:conditions":{"k:{\"type\":\"ContainersReady\"}":{".":{},"f:lastProbeTime":{},"f:lastTransitionTime":{},"f:status":{},"f:type":{}},"k:{\"type\":\"Initialized\"}":{".":{},"f:lastProbeTime":{},"f:lastTransitionTime":{},"f:status":{},"f:type":{}},"k:{\"type\":\"Ready\"}":{".":{},"f:lastProbeTime":{},"f:lastTransitionTime":{},"f:status":{},"f:type":{}}},"f:containerStatuses":{},"f:hostIP":{},"f:initContainerStatuses":{},"f:phase":{},"f:podIP":{},"f:podIPs":{".":{},"k:{\"ip\":\"172.17.0.13\"}":{".":{},"f:ip":{}}},"f:startTime":{}}},"manager":"kubelet","operation":"Update","time":"2021-04-12T04:44:06Z"}],"name":"nginx-deployment-dd485bc9-bfgnh","namespace":"default","ownerReferences":[{"apiVersion":"apps/v1","blockOwnerDeletion":true,"controller":true,"kind":"ReplicaSet","name":"nginx-deployment-dd485bc9","uid":"b223826d-3aa9-4a9d-b057-2736a8800d71"}],"resourceVersion":"612143","uid":"8966bf5a-80e8-4b3a-9c0b-ab9091d3f478"},"spec":{"containers":[{"env":[{"name":"CAA_NOTIFICATION_SERVER","value":"http://10.110.208.9:8001"},{"name":"CAA_CONTAINER_NAME","value":"nginx"},{"name":"LD_PRELOAD","value":"/etc/cyberarmor/libcaa.so"},{"name":"CAA_POD_NAME","valueFrom":{"fieldRef":{"apiVersion":"v1","fieldPath":"metadata.name"}}},{"name":"CAA_HOME","value":"/etc/cyberarmor"},{"name":"CAA_ORACLE_SERVER","value":"http://10.102.233.40:4000"},{"name":"CAA_ENABLE_DISCOVERY","value":"true"},{"name":"CAA_CONTAINER_IMAGE_NAME","value":"nginx:1.14.2"},{"name":"CAA_POD_NAMESPACE","valueFrom":{"fieldRef":{"apiVersion":"v1","fieldPath":"metadata.namespace"}}},{"name":"CAA_LOADNAMES","value":"*"},{"name":"CAA_GUID","value":"37ad7bc4-dbdf-48fc-86b5-6d4fdae784ad"}],"image":"debian:10.9","imagePullPolicy":"IfNotPresent","name":"nginx","ports":[{"containerPort":80,"protocol":"TCP"}],"resources":{},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","volumeMounts":[{"mountPath":"/var/run/secrets/kubernetes.io/serviceaccount","name":"default-token-gpl5r","readOnly":true},{"mountPath":"/etc/cyberarmor","name":"caa-home-vol","subPath":"nginx"},{"mountPath":"/etc/ld.so.preload","name":"caa-home-vol","subPath":"ld.so.preload"}]}],"dnsPolicy":"ClusterFirst","enableServiceLinks":true,"initContainers":[{"args":["-c","set -e; wget --tries=2 --no-check-certificate https://10.97.200.72:443/cazips/4394352308852781232 -O /etc/cyberarmor/1617862695.zip; unzip -o /etc/cyberarmor/1617862695.zip -d /etc/cyberarmor; rm -rf /etc/cyberarmor/1617862695.zip; echo \"/etc/cyberarmor/libcaa.so\" \u003e\u003e/etc/cyberarmor/ld.so.preload; env | grep \"CAA_\"\u003e\u003e/etc/cyberarmor/nginx/caa_envs; chmod -R 777 /etc/cyberarmor/*; set +e; wget -O/dev/null http://10.102.233.40:4000/v1/getiptable?name=pod.${CAA_POD_NAMESPACE}.${CAA_POD_NAME}"],"command":["/bin/sh"],"env":[{"name":"CAA_NOTIFICATION_SERVER","value":"http://10.110.208.9:8001"},{"name":"CAA_POD_NAME","valueFrom":{"fieldRef":{"apiVersion":"v1","fieldPath":"metadata.name"}}},{"name":"CAA_HOME","value":"/etc/cyberarmor"},{"name":"CAA_ORACLE_SERVER","value":"http://10.102.233.40:4000"},{"name":"CAA_POD_NAMESPACE","valueFrom":{"fieldRef":{"apiVersion":"v1","fieldPath":"metadata.namespace"}}}],"image":"alpine:3.9.4","imagePullPolicy":"IfNotPresent","name":"ca-init-container","resources":{},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","volumeMounts":[{"mountPath":"/etc/cyberarmor","name":"caa-home-vol"},{"mountPath":"/var/run/secrets/kubernetes.io/serviceaccount","name":"default-token-gpl5r","readOnly":true}]}],"nodeName":"david-virtualbox","preemptionPolicy":"PreemptLowerPriority","priority":0,"restartPolicy":"Always","schedulerName":"default-scheduler","securityContext":{},"serviceAccount":"default","serviceAccountName":"default","terminationGracePeriodSeconds":30,"tolerations":[{"effect":"NoExecute","key":"node.kubernetes.io/not-ready","operator":"Exists","tolerationSeconds":300},{"effect":"NoExecute","key":"node.kubernetes.io/unreachable","operator":"Exists","tolerationSeconds":300}],"volumes":[{"emptyDir":{},"name":"caa-home-vol"},{"name":"default-token-gpl5r","secret":{"defaultMode":420,"secretName":"default-token-gpl5r"}}]},"status":{"conditions":[{"lastProbeTime":null,"lastTransitionTime":"2021-04-12T04:44:05Z","status":"True","type":"Initialized"},{"lastProbeTime":null,"lastTransitionTime":"2021-04-12T04:44:06Z","status":"True","type":"Ready"},{"lastProbeTime":null,"lastTransitionTime":"2021-04-12T04:44:06Z","status":"True","type":"ContainersReady"},{"lastProbeTime":null,"lastTransitionTime":"2021-04-08T06:18:15Z","status":"True","type":"PodScheduled"}],"containerStatuses":[{"containerID":"docker://eee0a1d5c21fd3cad86a397de785c22c41b0a7cefd696a0eaba46ee135ce2212","image":"nginx:1.14.2","imageID":"docker-pullable://nginx@sha256:f7988fb6c02e0ce69257d9bd9cf37ae20a60f1df7563c3a2a6abe24160306b8d","lastState":{"terminated":{"containerID":"docker://a969c4d02d5f54749e1496519437e851b86c7b88f73af970a396bfa5bcf55def","exitCode":0,"finishedAt":"2021-04-11T17:58:57Z","reason":"Completed","startedAt":"2021-04-11T10:54:49Z"}},"name":"nginx","ready":true,"restartCount":3,"started":true,"state":{"running":{"startedAt":"2021-04-12T04:44:06Z"}}}],"hostIP":"10.0.2.15","initContainerStatuses":[{"containerID":"docker://f5a678979671ec4dcc7768322239186c69ae5d5ff04e980603deb514e590a3ef","image":"alpine:3.9.4","imageID":"docker-pullable://alpine@sha256:7746df395af22f04212cd25a92c1d6dbc5a06a0ca9579a229ef43008d4d1302a","lastState":{},"name":"ca-init-container","ready":true,"restartCount":11,"state":{"terminated":{"containerID":"docker://f5a678979671ec4dcc7768322239186c69ae5d5ff04e980603deb514e590a3ef","exitCode":0,"finishedAt":"2021-04-12T04:44:05Z","reason":"Completed","startedAt":"2021-04-12T04:44:04Z"}}}],"phase":"Running","podIP":"172.17.0.13","podIPs":[{"ip":"172.17.0.13"}],"qosClass":"BestEffort","startTime":"2021-04-08T06:18:15Z"}},{"apiVersion":"v1","kind":"Pod","metadata":{"creationTimestamp":"2021-04-08T10:59:58Z","generateName":"nginx-external-666b749977-","labels":{"app":"nginx-external","pod-template-hash":"666b749977"},"managedFields":[{"apiVersion":"v1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:generateName":{},"f:labels":{".":{},"f:app":{},"f:pod-template-hash":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"8845ed17-b259-4b6f-b83b-960875cb218e\"}":{".":{},"f:apiVersion":{},"f:blockOwnerDeletion":{},"f:controller":{},"f:kind":{},"f:name":{},"f:uid":{}}}},"f:spec":{"f:containers":{"k:{\"name\":\"nginx-external\"}":{".":{},"f:image":{},"f:imagePullPolicy":{},"f:name":{},"f:ports":{".":{},"k:{\"containerPort\":80,\"protocol\":\"TCP\"}":{".":{},"f:containerPort":{},"f:protocol":{}}},"f:resources":{},"f:terminationMessagePath":{},"f:terminationMessagePolicy":{}}},"f:dnsPolicy":{},"f:enableServiceLinks":{},"f:restartPolicy":{},"f:schedulerName":{},"f:securityContext":{},"f:terminationGracePeriodSeconds":{}}},"manager":"kube-controller-manager","operation":"Update","time":"2021-04-09T09:29:24Z"},{"apiVersion":"v1","fieldsType":"FieldsV1","fieldsV1":{"f:status":{"f:conditions":{"k:{\"type\":\"ContainersReady\"}":{".":{},"f:lastProbeTime":{},"f:lastTransitionTime":{},"f:status":{},"f:type":{}},"k:{\"type\":\"Initialized\"}":{".":{},"f:lastProbeTime":{},"f:lastTransitionTime":{},"f:status":{},"f:type":{}},"k:{\"type\":\"Ready\"}":{".":{},"f:lastProbeTime":{},"f:lastTransitionTime":{},"f:status":{},"f:type":{}}},"f:containerStatuses":{},"f:hostIP":{},"f:phase":{},"f:podIP":{},"f:podIPs":{".":{},"k:{\"ip\":\"172.17.0.10\"}":{".":{},"f:ip":{}}},"f:startTime":{}}},"manager":"kubelet","operation":"Update","time":"2021-04-12T04:42:30Z"}],"name":"nginx-external-666b749977-qmkbp","namespace":"default","ownerReferences":[{"apiVersion":"apps/v1","blockOwnerDeletion":true,"controller":true,"kind":"ReplicaSet","name":"nginx-external-666b749977","uid":"8845ed17-b259-4b6f-b83b-960875cb218e"}],"resourceVersion":"611874","uid":"10e7197a-4ca3-4ffa-b2de-258b88087bb3"},"spec":{"containers":[{"image":"nginx:1.14.2","imagePullPolicy":"IfNotPresent","name":"nginx-external","ports":[{"containerPort":80,"protocol":"TCP"}],"resources":{},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","volumeMounts":[{"mountPath":"/var/run/secrets/kubernetes.io/serviceaccount","name":"default-token-gpl5r","readOnly":true}]}],"dnsPolicy":"ClusterFirst","enableServiceLinks":true,"nodeName":"david-virtualbox","preemptionPolicy":"PreemptLowerPriority","priority":0,"restartPolicy":"Always","schedulerName":"default-scheduler","securityContext":{},"serviceAccount":"default","serviceAccountName":"default","terminationGracePeriodSeconds":30,"tolerations":[{"effect":"NoExecute","key":"node.kubernetes.io/not-ready","operator":"Exists","tolerationSeconds":300},{"effect":"NoExecute","key":"node.kubernetes.io/unreachable","operator":"Exists","tolerationSeconds":300}],"volumes":[{"name":"default-token-gpl5r","secret":{"defaultMode":420,"secretName":"default-token-gpl5r"}}]},"status":{"conditions":[{"lastProbeTime":null,"lastTransitionTime":"2021-04-08T10:59:58Z","status":"True","type":"Initialized"},{"lastProbeTime":null,"lastTransitionTime":"2021-04-12T04:42:23Z","status":"True","type":"Ready"},{"lastProbeTime":null,"lastTransitionTime":"2021-04-12T04:42:23Z","status":"True","type":"ContainersReady"},{"lastProbeTime":null,"lastTransitionTime":"2021-04-08T10:59:58Z","status":"True","type":"PodScheduled"}],"containerStatuses":[{"containerID":"docker://0f7155f130cc50f1a3f7bb42c6fa990d6a05c59ca5de6c1cc920c352244e3fb8","image":"nginx:1.14.2","imageID":"docker-pullable://nginx@sha256:f7988fb6c02e0ce69257d9bd9cf37ae20a60f1df7563c3a2a6abe24160306b8d","lastState":{"terminated":{"containerID":"docker://2f72ec2807284ba31c555988833a00569224bc3e9ef1459e2a972f478947ad82","exitCode":0,"finishedAt":"2021-04-11T17:58:51Z","reason":"Completed","startedAt":"2021-04-11T10:53:50Z"}},"name":"nginx-external","ready":true,"restartCount":3,"started":true,"state":{"running":{"startedAt":"2021-04-12T04:42:23Z"}}}],"hostIP":"10.0.2.15","phase":"Running","podIP":"172.17.0.10","podIPs":[{"ip":"172.17.0.10"}],"qosClass":"BestEffort","startTime":"2021-04-08T10:59:58Z"}},{"apiVersion":"v1","kind":"Pod","metadata":{"annotations":{"kubectl.kubernetes.io/last-applied-configuration":"{\"apiVersion\":\"v1\",\"kind\":\"Pod\",\"metadata\":{\"annotations\":{},\"name\":\"privileged\",\"namespace\":\"default\"},\"spec\":{\"containers\":[{\"image\":\"k8s.gcr.io/pause\",\"name\":\"pause\",\"securityContext\":{\"privileged\":true}}]}}\n"},"creationTimestamp":"2021-04-08T06:20:36Z","managedFields":[{"apiVersion":"v1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:kubectl.kubernetes.io/last-applied-configuration":{}}},"f:spec":{"f:containers":{"k:{\"name\":\"pause\"}":{".":{},"f:image":{},"f:imagePullPolicy":{},"f:name":{},"f:resources":{},"f:securityContext":{".":{},"f:privileged":{}},"f:terminationMessagePath":{},"f:terminationMessagePolicy":{}}},"f:dnsPolicy":{},"f:enableServiceLinks":{},"f:restartPolicy":{},"f:schedulerName":{},"f:securityContext":{},"f:terminationGracePeriodSeconds":{}}},"manager":"kubectl-client-side-apply","operation":"Update","time":"2021-04-08T06:20:35Z"},{"apiVersion":"v1","fieldsType":"FieldsV1","fieldsV1":{"f:status":{"f:conditions":{"k:{\"type\":\"ContainersReady\"}":{".":{},"f:lastProbeTime":{},"f:lastTransitionTime":{},"f:status":{},"f:type":{}},"k:{\"type\":\"Initialized\"}":{".":{},"f:lastProbeTime":{},"f:lastTransitionTime":{},"f:status":{},"f:type":{}},"k:{\"type\":\"Ready\"}":{".":{},"f:lastProbeTime":{},"f:lastTransitionTime":{},"f:status":{},"f:type":{}}},"f:containerStatuses":{},"f:hostIP":{},"f:phase":{},"f:podIP":{},"f:podIPs":{".":{},"k:{\"ip\":\"172.17.0.11\"}":{".":{},"f:ip":{}}},"f:startTime":{}}},"manager":"kubelet","operation":"Update","time":"2021-04-12T04:42:55Z"}],"name":"privileged","namespace":"default","resourceVersion":"612034","uid":"aeb4d71a-e99f-4927-a725-9a42661ed173"},"spec":{"containers":[{"image":"k8s.gcr.io/pause","imagePullPolicy":"Always","name":"pause","resources":{},"securityContext":{"privileged":true},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","volumeMounts":[{"mountPath":"/var/run/secrets/kubernetes.io/serviceaccount","name":"default-token-gpl5r","readOnly":true}]}],"dnsPolicy":"ClusterFirst","enableServiceLinks":true,"nodeName":"david-virtualbox","preemptionPolicy":"PreemptLowerPriority","priority":0,"restartPolicy":"Always","schedulerName":"default-scheduler","securityContext":{},"serviceAccount":"default","serviceAccountName":"default","terminationGracePeriodSeconds":30,"tolerations":[{"effect":"NoExecute","key":"node.kubernetes.io/not-ready","operator":"Exists","tolerationSeconds":300},{"effect":"NoExecute","key":"node.kubernetes.io/unreachable","operator":"Exists","tolerationSeconds":300}],"volumes":[{"name":"default-token-gpl5r","secret":{"defaultMode":420,"secretName":"default-token-gpl5r"}}]},"status":{"conditions":[{"lastProbeTime":null,"lastTransitionTime":"2021-04-08T06:20:36Z","status":"True","type":"Initialized"},{"lastProbeTime":null,"lastTransitionTime":"2021-04-12T04:42:55Z","status":"True","type":"Ready"},{"lastProbeTime":null,"lastTransitionTime":"2021-04-12T04:42:55Z","status":"True","type":"ContainersReady"},{"lastProbeTime":null,"lastTransitionTime":"2021-04-08T06:20:36Z","status":"True","type":"PodScheduled"}],"containerStatuses":[{"containerID":"docker://5ff07dda633a0fca12b02d5fb87ea3bbf5bfaaec6f8634c0fe83f076f798b777","image":"k8s.gcr.io/pause:latest","imageID":"docker-pullable://k8s.gcr.io/pause@sha256:a78c2d6208eff9b672de43f880093100050983047b7b0afe0217d3656e1b0d5f","lastState":{"terminated":{"containerID":"docker://dcb0accc4283112478d94e44ad5dcf4e1b6fa08c336fc98121d860f66e756fa3","exitCode":2,"finishedAt":"2021-04-11T17:58:51Z","reason":"Error","startedAt":"2021-04-11T10:54:03Z"}},"name":"pause","ready":true,"restartCount":3,"started":true,"state":{"running":{"startedAt":"2021-04-12T04:42:54Z"}}}],"hostIP":"10.0.2.15","phase":"Running","podIP":"172.17.0.11","podIPs":[{"ip":"172.17.0.11"}],"qosClass":"BestEffort","startTime":"2021-04-08T06:20:36Z"}}],"kind":"PodList","metadata":{"resourceVersion":"630469"}} - ` - unstructuredList := unstructured.UnstructuredList{} - if err := json.Unmarshal([]byte(podsList), &unstructuredList); err != nil { - glog.Error(err) - } - return &unstructuredList -} - -func V1AllClusterWithCompromisedRegistriesMock() *unstructured.UnstructuredList { - podsList := ` - { - "apiVersion": "v1", - "items": [ - { - "apiVersion": "v1", - "kind": "Pod", - "metadata": { - "creationTimestamp": "2021-04-06T10:55:58Z", - "generateName": "coredns-569467d7c-", - "name": "coredns-569467d7c-4f4sz", - "namespace": "kube-system", - "ownerReferences": [ - { - "apiVersion": "apps/v1", - "blockOwnerDeletion": true, - "controller": true, - "kind": "ReplicaSet", - "name": "coredns-569467d7c", - "uid": "033d590d-a773-402c-8c41-c9ccbc1b4ebf" - } - ], - "resourceVersion": "6776216", - "selfLink": "/api/v1/namespaces/kube-system/pods/coredns-569467d7c-4f4sz", - "uid": "a8f5b268-2ced-4172-a404-88281141e829" - }, - "spec": { - "containers": [ - { - "args": [ - "-conf", - "/etc/coredns/Corefile" - ], - "image": "quay.io/keycloak/coredns:1.3.1", - "imagePullPolicy": "IfNotPresent", - "livenessProbe": { - "failureThreshold": 5, - "httpGet": { - "path": "/health", - "port": 8080, - "scheme": "HTTP" - }, - "initialDelaySeconds": 60, - "periodSeconds": 10, - "successThreshold": 1, - "timeoutSeconds": 5 - }, - "name": "coredns", - "ports": [ - { - "containerPort": 53, - "name": "dns", - "protocol": "UDP" - }, - { - "containerPort": 53, - "name": "dns-tcp", - "protocol": "TCP" - }, - { - "containerPort": 9153, - "name": "metrics", - "protocol": "TCP" - } - ], - "readinessProbe": { - "failureThreshold": 3, - "httpGet": { - "path": "/health", - "port": 8080, - "scheme": "HTTP" - }, - "periodSeconds": 10, - "successThreshold": 1, - "timeoutSeconds": 1 - }, - "resources": { - "limits": { - "memory": "170Mi" - }, - "requests": { - "cpu": "100m", - "memory": "70Mi" - } - }, - "securityContext": { - "allowPrivilegeEscalation": false, - "capabilities": { - "add": [ - "NET_BIND_SERVICE" - ], - "drop": [ - "all" - ] - }, - "readOnlyRootFilesystem": true - }, - "terminationMessagePath": "/dev/termination-log", - "terminationMessagePolicy": "File", - "volumeMounts": [ - { - "mountPath": "/etc/coredns", - "name": "config-volume", - "readOnly": true - }, - { - "mountPath": "/var/run/secrets/kubernetes.io/serviceaccount", - "name": "coredns-token-pc89n", - "readOnly": true - } - ] - } - ], - "dnsPolicy": "Default", - "enableServiceLinks": true, - "nodeName": "minikube", - "nodeSelector": { - "beta.kubernetes.io/os": "linux" - }, - "priority": 2000000000, - "priorityClassName": "system-cluster-critical", - "restartPolicy": "Always", - "schedulerName": "default-scheduler", - "securityContext": {}, - "serviceAccount": "coredns", - "serviceAccountName": "coredns", - "terminationGracePeriodSeconds": 30, - "tolerations": [ - { - "key": "CriticalAddonsOnly", - "operator": "Exists" - }, - { - "effect": "NoSchedule", - "key": "node-role.kubernetes.io/master" - }, - { - "effect": "NoExecute", - "key": "node.kubernetes.io/not-ready", - "operator": "Exists", - "tolerationSeconds": 300 - }, - { - "effect": "NoExecute", - "key": "node.kubernetes.io/unreachable", - "operator": "Exists", - "tolerationSeconds": 300 - } - ], - "volumes": [ - { - "configMap": { - "defaultMode": 420, - "items": [ - { - "key": "Corefile", - "path": "Corefile" - } - ], - "name": "coredns" - }, - "name": "config-volume" - }, - { - "name": "coredns-token-pc89n", - "secret": { - "defaultMode": 420, - "secretName": "coredns-token-pc89n" - } - } - ] - }, - "status": { - "conditions": [ - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-06T10:55:59Z", - "status": "True", - "type": "Initialized" - }, - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-21T08:12:21Z", - "status": "True", - "type": "Ready" - }, - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-21T08:12:21Z", - "status": "True", - "type": "ContainersReady" - }, - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-06T10:55:58Z", - "status": "True", - "type": "PodScheduled" - } - ], - "containerStatuses": [ - { - "containerID": "docker://b2193a2366bd66183ca9ae791ec83e2c7539215bc6df8c72d209eea219c33ee9", - "image": "k8s.gcr.io/coredns:1.3.1", - "imageID": "docker-pullable://k8s.gcr.io/coredns@sha256:02382353821b12c21b062c59184e227e001079bb13ebd01f9d3270ba0fcbf1e4", - "lastState": { - "terminated": { - "containerID": "docker://230f6e53c7573be85855d6b458d690b8624e30a0404e44279655384ef3b47651", - "exitCode": 2, - "finishedAt": "2021-04-21T08:11:17Z", - "reason": "Error", - "startedAt": "2021-04-21T07:06:46Z" - } - }, - "name": "coredns", - "ready": true, - "restartCount": 26, - "state": { - "running": { - "startedAt": "2021-04-21T08:12:14Z" - } - } - } - ], - "hostIP": "10.0.2.15", - "phase": "Running", - "podIP": "172.17.0.3", - "qosClass": "Burstable", - "startTime": "2021-04-06T10:55:59Z" - } - }, - { - "apiVersion": "v1", - "kind": "Pod", - "metadata": { - "annotations": { - "cyberarmor.jobs": "{\"jobID\":\"684c562a-e80e-45a4-ac79-dd6a0c3c5dfd\",\"parentJobID\":\"\",\"actionID\":\"3\"}", - "cyberarmor.last-update": "06-04-2021 10:55:58", - "cyberarmor.wlid": "wlid://cluster-decrypt_secret-tadl/namespace-kube-system/deployment-coredns", - "latets-catriger-update": "23-07-2020 06:49:56", - "wlid": "wlid://cluster-decrypt_secret-tadl/namespace-kube-system/deployment-coredns" - }, - "creationTimestamp": "2021-04-06T10:55:58Z", - "generateName": "coredns-569467d7c-", - "labels": { - "cyberarmor.inject": "add", - "injectCyberArmor": "add", - "k8s-app": "kube-dns", - "pod-template-hash": "569467d7c" - }, - "name": "coredns-569467d7c-6q4mq", - "namespace": "kube-system", - "ownerReferences": [ - { - "apiVersion": "apps/v1", - "blockOwnerDeletion": true, - "controller": true, - "kind": "ReplicaSet", - "name": "coredns-569467d7c", - "uid": "033d590d-a773-402c-8c41-c9ccbc1b4ebf" - } - ], - "resourceVersion": "6776210", - "selfLink": "/api/v1/namespaces/kube-system/pods/coredns-569467d7c-6q4mq", - "uid": "198305ea-82b4-4c14-9b40-ca01b2caafe8" - }, - "spec": { - "containers": [ - { - "args": [ - "-conf", - "/etc/coredns/Corefile" - ], - "image": "015253967648.dkr.ecr.eu-central-1.amazonaws.com/coredns:1.3.1", - "imagePullPolicy": "IfNotPresent", - "livenessProbe": { - "failureThreshold": 5, - "httpGet": { - "path": "/health", - "port": 8080, - "scheme": "HTTP" - }, - "initialDelaySeconds": 60, - "periodSeconds": 10, - "successThreshold": 1, - "timeoutSeconds": 5 - }, - "name": "coredns", - "ports": [ - { - "containerPort": 53, - "name": "dns", - "protocol": "UDP" - }, - { - "containerPort": 53, - "name": "dns-tcp", - "protocol": "TCP" - }, - { - "containerPort": 9153, - "name": "metrics", - "protocol": "TCP" - } - ], - "readinessProbe": { - "failureThreshold": 3, - "httpGet": { - "path": "/health", - "port": 8080, - "scheme": "HTTP" - }, - "periodSeconds": 10, - "successThreshold": 1, - "timeoutSeconds": 1 - }, - "resources": { - "limits": { - "memory": "170Mi" - }, - "requests": { - "cpu": "100m", - "memory": "70Mi" - } - }, - "securityContext": { - "allowPrivilegeEscalation": false, - "capabilities": { - "add": [ - "NET_BIND_SERVICE" - ], - "drop": [ - "all" - ] - }, - "readOnlyRootFilesystem": true - }, - "terminationMessagePath": "/dev/termination-log", - "terminationMessagePolicy": "File", - "volumeMounts": [ - { - "mountPath": "/etc/coredns", - "name": "config-volume", - "readOnly": true - }, - { - "mountPath": "/var/run/secrets/kubernetes.io/serviceaccount", - "name": "coredns-token-pc89n", - "readOnly": true - } - ] - } - ], - "dnsPolicy": "Default", - "enableServiceLinks": true, - "nodeName": "minikube", - "nodeSelector": { - "beta.kubernetes.io/os": "linux" - }, - "priority": 2000000000, - "priorityClassName": "system-cluster-critical", - "restartPolicy": "Always", - "schedulerName": "default-scheduler", - "securityContext": {}, - "serviceAccount": "coredns", - "serviceAccountName": "coredns", - "terminationGracePeriodSeconds": 30, - "tolerations": [ - { - "key": "CriticalAddonsOnly", - "operator": "Exists" - }, - { - "effect": "NoSchedule", - "key": "node-role.kubernetes.io/master" - }, - { - "effect": "NoExecute", - "key": "node.kubernetes.io/not-ready", - "operator": "Exists", - "tolerationSeconds": 300 - }, - { - "effect": "NoExecute", - "key": "node.kubernetes.io/unreachable", - "operator": "Exists", - "tolerationSeconds": 300 - } - ], - "volumes": [ - { - "configMap": { - "defaultMode": 420, - "items": [ - { - "key": "Corefile", - "path": "Corefile" - } - ], - "name": "coredns" - }, - "name": "config-volume" - }, - { - "name": "coredns-token-pc89n", - "secret": { - "defaultMode": 420, - "secretName": "coredns-token-pc89n" - } - } - ] - }, - "status": { - "conditions": [ - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-06T10:55:58Z", - "status": "True", - "type": "Initialized" - }, - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-21T08:12:20Z", - "status": "True", - "type": "Ready" - }, - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-21T08:12:20Z", - "status": "True", - "type": "ContainersReady" - }, - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-06T10:55:58Z", - "status": "True", - "type": "PodScheduled" - } - ], - "containerStatuses": [ - { - "containerID": "docker://d7ea4c43607c7ab2b6f70e45b60eaf8d83a328e1372126dda2e7cb8238492d7f", - "image": "k8s.gcr.io/coredns:1.3.1", - "imageID": "docker-pullable://k8s.gcr.io/coredns@sha256:02382353821b12c21b062c59184e227e001079bb13ebd01f9d3270ba0fcbf1e4", - "lastState": { - "terminated": { - "containerID": "docker://6cbec2cca5ed9194e59ba56d64d93a62fbc09601f54db7986d00a52baf1897c8", - "exitCode": 2, - "finishedAt": "2021-04-21T08:11:17Z", - "reason": "Error", - "startedAt": "2021-04-21T07:05:39Z" - } - }, - "name": "coredns", - "ready": true, - "restartCount": 25, - "state": { - "running": { - "startedAt": "2021-04-21T08:12:14Z" - } - } - } - ], - "hostIP": "10.0.2.15", - "phase": "Running", - "podIP": "172.17.0.4", - "qosClass": "Burstable", - "startTime": "2021-04-06T10:55:58Z" - } - }, - { - "apiVersion": "v1", - "kind": "Pod", - "metadata": { - "creationTimestamp": "2020-07-23T06:50:09Z", - "labels": { - "component": "etcd", - "tier": "control-plane" - }, - "name": "etcd-minikube", - "namespace": "kube-system", - "resourceVersion": "6776159", - "selfLink": "/api/v1/namespaces/kube-system/pods/etcd-minikube", - "uid": "1ff6c452-3487-4866-8c5c-920b0d67fc12" - }, - "spec": { - "containers": [ - { - "command": [ - "etcd", - "--advertise-client-urls=https://10.0.2.15:2379", - "--cert-file=/var/lib/minikube/certs/etcd/server.crt", - "--client-cert-auth=true", - "--data-dir=/data/minikube", - "--initial-advertise-peer-urls=https://10.0.2.15:2380", - "--initial-cluster=minikube=https://10.0.2.15:2380", - "--key-file=/var/lib/minikube/certs/etcd/server.key", - "--listen-client-urls=https://127.0.0.1:2379,https://10.0.2.15:2379", - "--listen-peer-urls=https://10.0.2.15:2380", - "--name=minikube", - "--peer-cert-file=/var/lib/minikube/certs/etcd/peer.crt", - "--peer-client-cert-auth=true", - "--peer-key-file=/var/lib/minikube/certs/etcd/peer.key", - "--peer-trusted-ca-file=/var/lib/minikube/certs/etcd/ca.crt", - "--snapshot-count=10000", - "--trusted-ca-file=/var/lib/minikube/certs/etcd/ca.crt" - ], - "image": "k8s.gcr.io/etcd:3.3.10", - "imagePullPolicy": "IfNotPresent", - "livenessProbe": { - "exec": { - "command": [ - "/bin/sh", - "-ec", - "ETCDCTL_API=3 etcdctl --endpoints=https://[127.0.0.1]:2379 --cacert=/var/lib/minikube/certs//etcd/ca.crt --cert=/var/lib/minikube/certs//etcd/healthcheck-client.crt --key=/var/lib/minikube/certs//etcd/healthcheck-client.key get foo" - ] - }, - "failureThreshold": 8, - "initialDelaySeconds": 15, - "periodSeconds": 10, - "successThreshold": 1, - "timeoutSeconds": 15 - }, - "name": "etcd", - "resources": {}, - "terminationMessagePath": "/dev/termination-log", - "terminationMessagePolicy": "File", - "volumeMounts": [ - { - "mountPath": "/data/minikube", - "name": "etcd-data" - }, - { - "mountPath": "/var/lib/minikube/certs//etcd", - "name": "etcd-certs" - } - ] - } - ], - "dnsPolicy": "ClusterFirst", - "enableServiceLinks": true, - "hostNetwork": true, - "nodeName": "minikube", - "priority": 2000000000, - "priorityClassName": "system-cluster-critical", - "restartPolicy": "Always", - "schedulerName": "default-scheduler", - "securityContext": {}, - "terminationGracePeriodSeconds": 30, - "tolerations": [ - { - "effect": "NoExecute", - "operator": "Exists" - } - ], - "volumes": [ - { - "hostPath": { - "path": "/var/lib/minikube/certs//etcd", - "type": "DirectoryOrCreate" - }, - "name": "etcd-certs" - }, - { - "hostPath": { - "path": "/data/minikube", - "type": "DirectoryOrCreate" - }, - "name": "etcd-data" - } - ] - }, - "status": { - "conditions": [ - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-21T08:11:58Z", - "status": "True", - "type": "Initialized" - }, - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-21T08:12:01Z", - "status": "True", - "type": "Ready" - }, - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-21T08:12:01Z", - "status": "True", - "type": "ContainersReady" - }, - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-21T08:11:58Z", - "status": "True", - "type": "PodScheduled" - } - ], - "containerStatuses": [ - { - "containerID": "docker://1ac15d2e60fa674f5395701798dd78730ec95d4e91c849907bd4c6482f6cfec9", - "image": "k8s.gcr.io/etcd:3.3.10", - "imageID": "docker-pullable://k8s.gcr.io/etcd@sha256:17da501f5d2a675be46040422a27b7cc21b8a43895ac998b171db1c346f361f7", - "lastState": { - "terminated": { - "containerID": "docker://6103b7f8f27245b801e7a61afdb78f548a98f8c33d46701333c92857010355aa", - "exitCode": 0, - "finishedAt": "2021-04-21T08:11:18Z", - "reason": "Completed", - "startedAt": "2021-04-21T06:43:56Z" - } - }, - "name": "etcd", - "ready": true, - "restartCount": 64, - "state": { - "running": { - "startedAt": "2021-04-21T08:12:00Z" - } - } - } - ], - "hostIP": "10.0.2.15", - "phase": "Running", - "podIP": "10.0.2.15", - "qosClass": "BestEffort", - "startTime": "2021-04-21T08:11:58Z" - } - }, - { - "apiVersion": "v1", - "kind": "Pod", - "metadata": { - "creationTimestamp": "2020-07-23T06:49:45Z", - "labels": { - "component": "kube-addon-manager", - "kubernetes.io/minikube-addons": "addon-manager", - "version": "v9.0" - }, - "name": "kube-addon-manager-minikube", - "namespace": "kube-system", - "resourceVersion": "6776138", - "selfLink": "/api/v1/namespaces/kube-system/pods/kube-addon-manager-minikube", - "uid": "73d0e5b3-4dfe-48ff-9ebd-2a1510896130" - }, - "spec": { - "containers": [ - { - "env": [ - { - "name": "KUBECONFIG", - "value": "/var/lib/minikube/kubeconfig" - } - ], - "image": "k8s.gcr.io/kube-addon-manager:v9.0", - "imagePullPolicy": "IfNotPresent", - "name": "kube-addon-manager", - "resources": { - "requests": { - "cpu": "5m", - "memory": "50Mi" - } - }, - "terminationMessagePath": "/dev/termination-log", - "terminationMessagePolicy": "File", - "volumeMounts": [ - { - "mountPath": "/etc/kubernetes/", - "name": "addons", - "readOnly": true - }, - { - "mountPath": "/var/lib/minikube/", - "name": "kubeconfig", - "readOnly": true - } - ] - } - ], - "dnsPolicy": "ClusterFirst", - "enableServiceLinks": true, - "hostNetwork": true, - "nodeName": "minikube", - "priority": 0, - "restartPolicy": "Always", - "schedulerName": "default-scheduler", - "securityContext": {}, - "terminationGracePeriodSeconds": 30, - "tolerations": [ - { - "effect": "NoExecute", - "operator": "Exists" - } - ], - "volumes": [ - { - "hostPath": { - "path": "/etc/kubernetes/", - "type": "" - }, - "name": "addons" - }, - { - "hostPath": { - "path": "/var/lib/minikube/", - "type": "" - }, - "name": "kubeconfig" - } - ] - }, - "status": { - "conditions": [ - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-21T08:11:58Z", - "status": "True", - "type": "Initialized" - }, - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-21T08:12:01Z", - "status": "True", - "type": "Ready" - }, - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-21T08:12:01Z", - "status": "True", - "type": "ContainersReady" - }, - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-21T08:11:58Z", - "status": "True", - "type": "PodScheduled" - } - ], - "containerStatuses": [ - { - "containerID": "docker://89a166c6ebb9d58bbf6c26497c4bc7cde22f2da8c3fbf2ce2370699f78cb367f", - "image": "k8s.gcr.io/kube-addon-manager:v9.0", - "imageID": "docker-pullable://k8s.gcr.io/kube-addon-manager@sha256:672794ee3582521eb8bc4f257d0f70c92893f1989f39a200f9c84bcfe1aea7c9", - "lastState": { - "terminated": { - "containerID": "docker://d520fe96ad1956ac0bdad37b1f614c932ec57e0dc55a4c7a3c2484a3d3d2ea2f", - "exitCode": 137, - "finishedAt": "2021-04-21T08:11:27Z", - "reason": "Error", - "startedAt": "2021-04-21T06:43:56Z" - } - }, - "name": "kube-addon-manager", - "ready": true, - "restartCount": 63, - "state": { - "running": { - "startedAt": "2021-04-21T08:12:00Z" - } - } - } - ], - "hostIP": "10.0.2.15", - "phase": "Running", - "podIP": "10.0.2.15", - "qosClass": "Burstable", - "startTime": "2021-04-21T08:11:58Z" - } - }, - { - "apiVersion": "v1", - "kind": "Pod", - "metadata": { - "annotations": { - "kubernetes.io/config.hash": "ced911db87a00e7b4e0cb9c620003f19", - "kubernetes.io/config.mirror": "ced911db87a00e7b4e0cb9c620003f19", - "kubernetes.io/config.seen": "2020-07-23T09:22:31.141864724+03:00", - "kubernetes.io/config.source": "file" - }, - "creationTimestamp": "2021-04-06T10:56:03Z", - "labels": { - "component": "kube-apiserver", - "cyberarmor.inject": "add", - "injectCyberArmor": "add", - "tier": "control-plane" - }, - "name": "kube-apiserver-minikube", - "namespace": "kube-system", - "resourceVersion": "6776162", - "selfLink": "/api/v1/namespaces/kube-system/pods/kube-apiserver-minikube", - "uid": "41bb3ea6-cb73-493a-81c8-f5075e3670e0" - }, - "spec": { - "containers": [ - { - "command": [ - "kube-apiserver", - "--advertise-address=10.0.2.15", - "--allow-privileged=true", - "--authorization-mode=Node,RBAC", - "--client-ca-file=/var/lib/minikube/certs/ca.crt", - "--enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,NodeRestriction,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota", - "--enable-bootstrap-token-auth=true", - "--etcd-cafile=/var/lib/minikube/certs/etcd/ca.crt", - "--etcd-certfile=/var/lib/minikube/certs/apiserver-etcd-client.crt", - "--etcd-keyfile=/var/lib/minikube/certs/apiserver-etcd-client.key", - "--etcd-servers=https://127.0.0.1:2379", - "--insecure-port=0", - "--kubelet-client-certificate=/var/lib/minikube/certs/apiserver-kubelet-client.crt", - "--kubelet-client-key=/var/lib/minikube/certs/apiserver-kubelet-client.key", - "--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname", - "--proxy-client-cert-file=/var/lib/minikube/certs/front-proxy-client.crt", - "--proxy-client-key-file=/var/lib/minikube/certs/front-proxy-client.key", - "--requestheader-allowed-names=front-proxy-client", - "--requestheader-client-ca-file=/var/lib/minikube/certs/front-proxy-ca.crt", - "--requestheader-extra-headers-prefix=X-Remote-Extra-", - "--requestheader-group-headers=X-Remote-Group", - "--requestheader-username-headers=X-Remote-User", - "--secure-port=8443", - "--service-account-key-file=/var/lib/minikube/certs/sa.pub", - "--service-cluster-ip-range=10.96.0.0/12", - "--tls-cert-file=/var/lib/minikube/certs/apiserver.crt", - "--tls-private-key-file=/var/lib/minikube/certs/apiserver.key" - ], - "image": "k8s.gcr.io/kube-apiserver:v1.15.2", - "imagePullPolicy": "IfNotPresent", - "livenessProbe": { - "failureThreshold": 8, - "httpGet": { - "host": "10.0.2.15", - "path": "/healthz", - "port": 8443, - "scheme": "HTTPS" - }, - "initialDelaySeconds": 15, - "periodSeconds": 10, - "successThreshold": 1, - "timeoutSeconds": 15 - }, - "name": "kube-apiserver", - "resources": { - "requests": { - "cpu": "250m" - } - }, - "terminationMessagePath": "/dev/termination-log", - "terminationMessagePolicy": "File", - "volumeMounts": [ - { - "mountPath": "/etc/ssl/certs", - "name": "ca-certs", - "readOnly": true - }, - { - "mountPath": "/etc/ca-certificates", - "name": "etc-ca-certificates", - "readOnly": true - }, - { - "mountPath": "/etc/pki", - "name": "etc-pki", - "readOnly": true - }, - { - "mountPath": "/var/lib/minikube/certs/", - "name": "k8s-certs", - "readOnly": true - }, - { - "mountPath": "/usr/local/share/ca-certificates", - "name": "usr-local-share-ca-certificates", - "readOnly": true - }, - { - "mountPath": "/usr/share/ca-certificates", - "name": "usr-share-ca-certificates", - "readOnly": true - } - ] - } - ], - "dnsPolicy": "ClusterFirst", - "enableServiceLinks": true, - "hostNetwork": true, - "nodeName": "minikube", - "priority": 2000000000, - "priorityClassName": "system-cluster-critical", - "restartPolicy": "Always", - "schedulerName": "default-scheduler", - "securityContext": {}, - "terminationGracePeriodSeconds": 30, - "tolerations": [ - { - "effect": "NoExecute", - "operator": "Exists" - } - ], - "volumes": [ - { - "hostPath": { - "path": "/etc/ssl/certs", - "type": "DirectoryOrCreate" - }, - "name": "ca-certs" - }, - { - "hostPath": { - "path": "/etc/ca-certificates", - "type": "DirectoryOrCreate" - }, - "name": "etc-ca-certificates" - }, - { - "hostPath": { - "path": "/etc/pki", - "type": "DirectoryOrCreate" - }, - "name": "etc-pki" - }, - { - "hostPath": { - "path": "/var/lib/minikube/certs/", - "type": "DirectoryOrCreate" - }, - "name": "k8s-certs" - }, - { - "hostPath": { - "path": "/usr/local/share/ca-certificates", - "type": "DirectoryOrCreate" - }, - "name": "usr-local-share-ca-certificates" - }, - { - "hostPath": { - "path": "/usr/share/ca-certificates", - "type": "DirectoryOrCreate" - }, - "name": "usr-share-ca-certificates" - } - ] - }, - "status": { - "conditions": [ - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-21T08:11:58Z", - "status": "True", - "type": "Initialized" - }, - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-21T08:12:01Z", - "status": "True", - "type": "Ready" - }, - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-21T08:12:01Z", - "status": "True", - "type": "ContainersReady" - }, - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-21T08:11:58Z", - "status": "True", - "type": "PodScheduled" - } - ], - "containerStatuses": [ - { - "containerID": "docker://6b8e96abe51bcda9a71b21291670dd8b6e6d8e564b0acef38356c2947afd7106", - "image": "k8s.gcr.io/kube-apiserver:v1.15.2", - "imageID": "docker-pullable://k8s.gcr.io/kube-apiserver@sha256:5fae387bacf1def6c3915b4a3035cf8c8a4d06158b2e676721776d3d4afc05a2", - "lastState": { - "terminated": { - "containerID": "docker://5118904be7098415ae0a3441b08390b059c06129a9310ff7f3427358e7d91fd6", - "exitCode": 0, - "finishedAt": "2021-04-21T08:11:17Z", - "reason": "Completed", - "startedAt": "2021-04-21T07:05:10Z" - } - }, - "name": "kube-apiserver", - "ready": true, - "restartCount": 74, - "state": { - "running": { - "startedAt": "2021-04-21T08:12:00Z" - } - } - } - ], - "hostIP": "10.0.2.15", - "phase": "Running", - "podIP": "10.0.2.15", - "qosClass": "Burstable", - "startTime": "2021-04-21T08:11:58Z" - } - }, - { - "apiVersion": "v1", - "kind": "Pod", - "metadata": { - "annotations": { - "kubernetes.io/config.hash": "05f404ddde6cbb3d8fd2bf0bfa77e509", - "kubernetes.io/config.mirror": "05f404ddde6cbb3d8fd2bf0bfa77e509", - "kubernetes.io/config.seen": "2020-07-23T09:22:31.141870113+03:00", - "kubernetes.io/config.source": "file" - }, - "creationTimestamp": "2020-07-23T06:49:50Z", - "labels": { - "component": "kube-controller-manager", - "tier": "control-plane" - }, - "name": "kube-controller-manager-minikube", - "namespace": "kube-system", - "resourceVersion": "6776125", - "selfLink": "/api/v1/namespaces/kube-system/pods/kube-controller-manager-minikube", - "uid": "01587a51-1fb0-4fe1-a9e5-cd1332b3138d" - }, - "spec": { - "containers": [ - { - "command": [ - "kube-controller-manager", - "--authentication-kubeconfig=/etc/kubernetes/controller-manager.conf", - "--authorization-kubeconfig=/etc/kubernetes/controller-manager.conf", - "--bind-address=127.0.0.1", - "--client-ca-file=/var/lib/minikube/certs/ca.crt", - "--cluster-signing-cert-file=/var/lib/minikube/certs/ca.crt", - "--cluster-signing-key-file=/var/lib/minikube/certs/ca.key", - "--controllers=*,bootstrapsigner,tokencleaner", - "--kubeconfig=/etc/kubernetes/controller-manager.conf", - "--leader-elect=true", - "--requestheader-client-ca-file=/var/lib/minikube/certs/front-proxy-ca.crt", - "--root-ca-file=/var/lib/minikube/certs/ca.crt", - "--service-account-private-key-file=/var/lib/minikube/certs/sa.key", - "--use-service-account-credentials=true" - ], - "image": "k8s.gcr.io/kube-controller-manager:v1.15.2", - "imagePullPolicy": "IfNotPresent", - "livenessProbe": { - "failureThreshold": 8, - "httpGet": { - "host": "127.0.0.1", - "path": "/healthz", - "port": 10252, - "scheme": "HTTP" - }, - "initialDelaySeconds": 15, - "periodSeconds": 10, - "successThreshold": 1, - "timeoutSeconds": 15 - }, - "name": "kube-controller-manager", - "resources": { - "requests": { - "cpu": "200m" - } - }, - "terminationMessagePath": "/dev/termination-log", - "terminationMessagePolicy": "File", - "volumeMounts": [ - { - "mountPath": "/etc/ssl/certs", - "name": "ca-certs", - "readOnly": true - }, - { - "mountPath": "/etc/ca-certificates", - "name": "etc-ca-certificates", - "readOnly": true - }, - { - "mountPath": "/etc/pki", - "name": "etc-pki", - "readOnly": true - }, - { - "mountPath": "/usr/libexec/kubernetes/kubelet-plugins/volume/exec", - "name": "flexvolume-dir" - }, - { - "mountPath": "/var/lib/minikube/certs/", - "name": "k8s-certs", - "readOnly": true - }, - { - "mountPath": "/etc/kubernetes/controller-manager.conf", - "name": "kubeconfig", - "readOnly": true - }, - { - "mountPath": "/usr/local/share/ca-certificates", - "name": "usr-local-share-ca-certificates", - "readOnly": true - }, - { - "mountPath": "/usr/share/ca-certificates", - "name": "usr-share-ca-certificates", - "readOnly": true - } - ] - } - ], - "dnsPolicy": "ClusterFirst", - "enableServiceLinks": true, - "hostNetwork": true, - "nodeName": "minikube", - "priority": 2000000000, - "priorityClassName": "system-cluster-critical", - "restartPolicy": "Always", - "schedulerName": "default-scheduler", - "securityContext": {}, - "terminationGracePeriodSeconds": 30, - "tolerations": [ - { - "effect": "NoExecute", - "operator": "Exists" - } - ], - "volumes": [ - { - "hostPath": { - "path": "/etc/ssl/certs", - "type": "DirectoryOrCreate" - }, - "name": "ca-certs" - }, - { - "hostPath": { - "path": "/etc/ca-certificates", - "type": "DirectoryOrCreate" - }, - "name": "etc-ca-certificates" - }, - { - "hostPath": { - "path": "/etc/pki", - "type": "DirectoryOrCreate" - }, - "name": "etc-pki" - }, - { - "hostPath": { - "path": "/usr/libexec/kubernetes/kubelet-plugins/volume/exec", - "type": "DirectoryOrCreate" - }, - "name": "flexvolume-dir" - }, - { - "hostPath": { - "path": "/var/lib/minikube/certs/", - "type": "DirectoryOrCreate" - }, - "name": "k8s-certs" - }, - { - "hostPath": { - "path": "/etc/kubernetes/controller-manager.conf", - "type": "FileOrCreate" - }, - "name": "kubeconfig" - }, - { - "hostPath": { - "path": "/usr/local/share/ca-certificates", - "type": "DirectoryOrCreate" - }, - "name": "usr-local-share-ca-certificates" - }, - { - "hostPath": { - "path": "/usr/share/ca-certificates", - "type": "DirectoryOrCreate" - }, - "name": "usr-share-ca-certificates" - } - ] - }, - "status": { - "conditions": [ - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-21T08:11:58Z", - "status": "True", - "type": "Initialized" - }, - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-21T08:12:01Z", - "status": "True", - "type": "Ready" - }, - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-21T08:12:01Z", - "status": "True", - "type": "ContainersReady" - }, - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-21T08:11:58Z", - "status": "True", - "type": "PodScheduled" - } - ], - "containerStatuses": [ - { - "containerID": "docker://e214d647667783e111dc70ff5c0d83327474c8c5ce3526661cf8ad03bcf2fb76", - "image": "k8s.gcr.io/kube-controller-manager:v1.15.2", - "imageID": "docker-pullable://k8s.gcr.io/kube-controller-manager@sha256:7d3fc48cf83aa0a7b8f129fa4255bb5530908e1a5b194be269ea8329b48e9598", - "lastState": { - "terminated": { - "containerID": "docker://5f6f6bea6b2bb4041784d3c01f973928c421d511ae5a09a0d794d224170b9405", - "exitCode": 2, - "finishedAt": "2021-04-21T08:11:17Z", - "reason": "Error", - "startedAt": "2021-04-21T07:25:56Z" - } - }, - "name": "kube-controller-manager", - "ready": true, - "restartCount": 84, - "state": { - "running": { - "startedAt": "2021-04-21T08:12:00Z" - } - } - } - ], - "hostIP": "10.0.2.15", - "phase": "Running", - "podIP": "10.0.2.15", - "qosClass": "Burstable", - "startTime": "2021-04-21T08:11:58Z" - } - }, - { - "apiVersion": "v1", - "kind": "Pod", - "metadata": { - "creationTimestamp": "2021-04-06T10:56:07Z", - "generateName": "kube-proxy-", - "labels": { - "controller-revision-hash": "7ccdf4749c", - "k8s-app": "kube-proxy", - "pod-template-generation": "3" - }, - "name": "kube-proxy-6p8h4", - "namespace": "kube-system", - "ownerReferences": [ - { - "apiVersion": "apps/v1", - "blockOwnerDeletion": true, - "controller": true, - "kind": "DaemonSet", - "name": "kube-proxy", - "uid": "85df40d3-2970-490e-8cfb-2559f09a5fe5" - } - ], - "resourceVersion": "6776181", - "selfLink": "/api/v1/namespaces/kube-system/pods/kube-proxy-6p8h4", - "uid": "f7d6c813-525d-4fdd-a340-127c74de5c83" - }, - "spec": { - "affinity": { - "nodeAffinity": { - "requiredDuringSchedulingIgnoredDuringExecution": { - "nodeSelectorTerms": [ - { - "matchFields": [ - { - "key": "metadata.name", - "operator": "In", - "values": [ - "minikube" - ] - } - ] - } - ] - } - } - }, - "containers": [ - { - "command": [ - "/usr/local/bin/kube-proxy", - "--config=/var/lib/kube-proxy/config.conf", - "--hostname-override=$(NODE_NAME)" - ], - "env": [ - { - "name": "NODE_NAME", - "valueFrom": { - "fieldRef": { - "apiVersion": "v1", - "fieldPath": "spec.nodeName" - } - } - } - ], - "image": "k8s.gcr.io/kube-proxy:v1.15.2", - "imagePullPolicy": "IfNotPresent", - "name": "kube-proxy", - "resources": {}, - "securityContext": { - "privileged": true - }, - "terminationMessagePath": "/dev/termination-log", - "terminationMessagePolicy": "File", - "volumeMounts": [ - { - "mountPath": "/var/lib/kube-proxy", - "name": "kube-proxy" - }, - { - "mountPath": "/run/xtables.lock", - "name": "xtables-lock" - }, - { - "mountPath": "/lib/modules", - "name": "lib-modules", - "readOnly": true - }, - { - "mountPath": "/var/run/secrets/kubernetes.io/serviceaccount", - "name": "kube-proxy-token-874bk", - "readOnly": true - } - ] - } - ], - "dnsPolicy": "ClusterFirst", - "enableServiceLinks": true, - "hostNetwork": true, - "nodeName": "minikube", - "nodeSelector": { - "beta.kubernetes.io/os": "linux" - }, - "priority": 2000001000, - "priorityClassName": "system-node-critical", - "restartPolicy": "Always", - "schedulerName": "default-scheduler", - "securityContext": {}, - "serviceAccount": "kube-proxy", - "serviceAccountName": "kube-proxy", - "terminationGracePeriodSeconds": 30, - "tolerations": [ - { - "key": "CriticalAddonsOnly", - "operator": "Exists" - }, - { - "operator": "Exists" - }, - { - "effect": "NoExecute", - "key": "node.kubernetes.io/not-ready", - "operator": "Exists" - }, - { - "effect": "NoExecute", - "key": "node.kubernetes.io/unreachable", - "operator": "Exists" - }, - { - "effect": "NoSchedule", - "key": "node.kubernetes.io/disk-pressure", - "operator": "Exists" - }, - { - "effect": "NoSchedule", - "key": "node.kubernetes.io/memory-pressure", - "operator": "Exists" - }, - { - "effect": "NoSchedule", - "key": "node.kubernetes.io/pid-pressure", - "operator": "Exists" - }, - { - "effect": "NoSchedule", - "key": "node.kubernetes.io/unschedulable", - "operator": "Exists" - }, - { - "effect": "NoSchedule", - "key": "node.kubernetes.io/network-unavailable", - "operator": "Exists" - } - ], - "volumes": [ - { - "configMap": { - "defaultMode": 420, - "name": "kube-proxy" - }, - "name": "kube-proxy" - }, - { - "hostPath": { - "path": "/run/xtables.lock", - "type": "FileOrCreate" - }, - "name": "xtables-lock" - }, - { - "hostPath": { - "path": "/lib/modules", - "type": "" - }, - "name": "lib-modules" - }, - { - "name": "kube-proxy-token-874bk", - "secret": { - "defaultMode": 420, - "secretName": "kube-proxy-token-874bk" - } - } - ] - }, - "status": { - "conditions": [ - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-06T10:56:07Z", - "status": "True", - "type": "Initialized" - }, - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-21T08:12:12Z", - "status": "True", - "type": "Ready" - }, - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-21T08:12:12Z", - "status": "True", - "type": "ContainersReady" - }, - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-06T10:56:07Z", - "status": "True", - "type": "PodScheduled" - } - ], - "containerStatuses": [ - { - "containerID": "docker://842c5b82f53dc777468f64834061a13173fcbfe68a06839cff58f5a29a7ca349", - "image": "k8s.gcr.io/kube-proxy:v1.15.2", - "imageID": "docker-pullable://k8s.gcr.io/kube-proxy@sha256:626f983f25f8b7799ca7ab001fd0985a72c2643c0acb877d2888c0aa4fcbdf56", - "lastState": { - "terminated": { - "containerID": "docker://b4a6059146f53c35c48f411e8203dd0f55680be8700171f67d9e35590d3252c8", - "exitCode": 2, - "finishedAt": "2021-04-21T08:11:17Z", - "reason": "Error", - "startedAt": "2021-04-21T06:44:16Z" - } - }, - "name": "kube-proxy", - "ready": true, - "restartCount": 5, - "state": { - "running": { - "startedAt": "2021-04-21T08:12:11Z" - } - } - } - ], - "hostIP": "10.0.2.15", - "phase": "Running", - "podIP": "10.0.2.15", - "qosClass": "BestEffort", - "startTime": "2021-04-06T10:56:07Z" - } - }, - { - "apiVersion": "v1", - "kind": "Pod", - "metadata": { - "annotations": { - "kubernetes.io/config.hash": "abfcb4f52e957b11256c1f6841d49700", - "kubernetes.io/config.mirror": "abfcb4f52e957b11256c1f6841d49700", - "kubernetes.io/config.seen": "2020-07-23T09:22:31.141872438+03:00", - "kubernetes.io/config.source": "file" - }, - "creationTimestamp": "2020-07-23T06:50:03Z", - "labels": { - "component": "kube-scheduler", - "tier": "control-plane" - }, - "name": "kube-scheduler-minikube", - "namespace": "kube-system", - "resourceVersion": "6776144", - "selfLink": "/api/v1/namespaces/kube-system/pods/kube-scheduler-minikube", - "uid": "a7efef08-ac8b-4871-821c-d760ae910dc7" - }, - "spec": { - "containers": [ - { - "command": [ - "kube-scheduler", - "--bind-address=127.0.0.1", - "--kubeconfig=/etc/kubernetes/scheduler.conf", - "--leader-elect=true" - ], - "image": "k8s.gcr.io/kube-scheduler:v1.15.2", - "imagePullPolicy": "IfNotPresent", - "livenessProbe": { - "failureThreshold": 8, - "httpGet": { - "host": "127.0.0.1", - "path": "/healthz", - "port": 10251, - "scheme": "HTTP" - }, - "initialDelaySeconds": 15, - "periodSeconds": 10, - "successThreshold": 1, - "timeoutSeconds": 15 - }, - "name": "kube-scheduler", - "resources": { - "requests": { - "cpu": "100m" - } - }, - "terminationMessagePath": "/dev/termination-log", - "terminationMessagePolicy": "File", - "volumeMounts": [ - { - "mountPath": "/etc/kubernetes/scheduler.conf", - "name": "kubeconfig", - "readOnly": true - } - ] - } - ], - "dnsPolicy": "ClusterFirst", - "enableServiceLinks": true, - "hostNetwork": true, - "nodeName": "minikube", - "priority": 2000000000, - "priorityClassName": "system-cluster-critical", - "restartPolicy": "Always", - "schedulerName": "default-scheduler", - "securityContext": {}, - "terminationGracePeriodSeconds": 30, - "tolerations": [ - { - "effect": "NoExecute", - "operator": "Exists" - } - ], - "volumes": [ - { - "hostPath": { - "path": "/etc/kubernetes/scheduler.conf", - "type": "FileOrCreate" - }, - "name": "kubeconfig" - } - ] - }, - "status": { - "conditions": [ - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-21T08:11:59Z", - "status": "True", - "type": "Initialized" - }, - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-21T08:12:01Z", - "status": "True", - "type": "Ready" - }, - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-21T08:12:01Z", - "status": "True", - "type": "ContainersReady" - }, - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-21T08:11:59Z", - "status": "True", - "type": "PodScheduled" - } - ], - "containerStatuses": [ - { - "containerID": "docker://533a3bb256738e9a6cb32efd6a77b726126937f7debc8cbda149dfa17bbbaeaf", - "image": "k8s.gcr.io/kube-scheduler:v1.15.2", - "imageID": "docker-pullable://k8s.gcr.io/kube-scheduler@sha256:8fd3c3251f07234a234469e201900e4274726f1fe0d5dc6fb7da911f1c851a1a", - "lastState": { - "terminated": { - "containerID": "docker://5a595b656ee2b84e1260b03dd95d6daef49d4a29e65a8a9e848727dab3a8b7e5", - "exitCode": 2, - "finishedAt": "2021-04-21T08:11:17Z", - "reason": "Error", - "startedAt": "2021-04-21T07:25:48Z" - } - }, - "name": "kube-scheduler", - "ready": true, - "restartCount": 84, - "state": { - "running": { - "startedAt": "2021-04-21T08:12:00Z" - } - } - } - ], - "hostIP": "10.0.2.15", - "phase": "Running", - "podIP": "10.0.2.15", - "qosClass": "Burstable", - "startTime": "2021-04-21T08:11:59Z" - } - }, - { - "apiVersion": "v1", - "kind": "Pod", - "metadata": { - "creationTimestamp": "2021-04-06T10:55:57Z", - "generateName": "kubernetes-dashboard-679fb79dd5-", - "labels": { - "addonmanager.kubernetes.io/mode": "Reconcile", - "app": "kubernetes-dashboard", - "pod-template-hash": "679fb79dd5", - "version": "v1.8.1" - }, - "name": "kubernetes-dashboard-679fb79dd5-8gbz9", - "namespace": "kube-system", - "ownerReferences": [ - { - "apiVersion": "apps/v1", - "blockOwnerDeletion": true, - "controller": true, - "kind": "ReplicaSet", - "name": "kubernetes-dashboard-679fb79dd5", - "uid": "acb36534-dc63-45a0-8ffe-8124b10c99aa" - } - ], - "resourceVersion": "6776193", - "selfLink": "/api/v1/namespaces/kube-system/pods/kubernetes-dashboard-679fb79dd5-8gbz9", - "uid": "39ec8419-37f2-4b43-a3e3-33bad14d0524" - }, - "spec": { - "containers": [ - { - "image": "k8s.gcr.io/kubernetes-dashboard-amd64:v1.8.1", - "imagePullPolicy": "IfNotPresent", - "livenessProbe": { - "failureThreshold": 3, - "httpGet": { - "path": "/", - "port": 9090, - "scheme": "HTTP" - }, - "initialDelaySeconds": 30, - "periodSeconds": 10, - "successThreshold": 1, - "timeoutSeconds": 30 - }, - "name": "kubernetes-dashboard", - "ports": [ - { - "containerPort": 9090, - "protocol": "TCP" - } - ], - "resources": {}, - "terminationMessagePath": "/dev/termination-log", - "terminationMessagePolicy": "File", - "volumeMounts": [ - { - "mountPath": "/var/run/secrets/kubernetes.io/serviceaccount", - "name": "default-token-rptf5", - "readOnly": true - } - ] - } - ], - "dnsPolicy": "ClusterFirst", - "enableServiceLinks": true, - "nodeName": "minikube", - "priority": 0, - "restartPolicy": "Always", - "schedulerName": "default-scheduler", - "securityContext": {}, - "serviceAccount": "default", - "serviceAccountName": "default", - "terminationGracePeriodSeconds": 30, - "tolerations": [ - { - "effect": "NoExecute", - "key": "node.kubernetes.io/not-ready", - "operator": "Exists", - "tolerationSeconds": 300 - }, - { - "effect": "NoExecute", - "key": "node.kubernetes.io/unreachable", - "operator": "Exists", - "tolerationSeconds": 300 - } - ], - "volumes": [ - { - "name": "default-token-rptf5", - "secret": { - "defaultMode": 420, - "secretName": "default-token-rptf5" - } - } - ] - }, - "status": { - "conditions": [ - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-06T10:55:57Z", - "status": "True", - "type": "Initialized" - }, - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-21T08:12:14Z", - "status": "True", - "type": "Ready" - }, - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-21T08:12:14Z", - "status": "True", - "type": "ContainersReady" - }, - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-06T10:55:57Z", - "status": "True", - "type": "PodScheduled" - } - ], - "containerStatuses": [ - { - "containerID": "docker://2efb0756b6d1c56d2ebb0aaa968fd131f8ecbc13018f4c97e4539d9241cea8eb", - "image": "k8s.gcr.io/kubernetes-dashboard-amd64:v1.8.1", - "imageID": "docker-pullable://k8s.gcr.io/kubernetes-dashboard-amd64@sha256:3861695e962972965a4c611bcabc2032f885d8cbdb0bccc9bf513ef16335fe33", - "lastState": { - "terminated": { - "containerID": "docker://5720642be28f36e18048f2dc9b7a4174c69191cbad388aa2d7b5e0916fd67b28", - "exitCode": 2, - "finishedAt": "2021-04-21T08:11:17Z", - "reason": "Error", - "startedAt": "2021-04-21T07:25:48Z" - } - }, - "name": "kubernetes-dashboard", - "ready": true, - "restartCount": 15, - "state": { - "running": { - "startedAt": "2021-04-21T08:12:13Z" - } - } - } - ], - "hostIP": "10.0.2.15", - "phase": "Running", - "podIP": "172.17.0.2", - "qosClass": "BestEffort", - "startTime": "2021-04-06T10:55:57Z" - } - }, - { - "apiVersion": "v1", - "kind": "Pod", - "metadata": { - "annotations": { - "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"v1\",\"kind\":\"Pod\",\"metadata\":{\"annotations\":{},\"labels\":{\"addonmanager.kubernetes.io/mode\":\"Reconcile\",\"integration-test\":\"storage-provisioner\"},\"name\":\"storage-provisioner\",\"namespace\":\"kube-system\"},\"spec\":{\"containers\":[{\"command\":[\"/storage-provisioner\"],\"image\":\"gcr.io/k8s-minikube/storage-provisioner:v1.8.1\",\"imagePullPolicy\":\"IfNotPresent\",\"name\":\"storage-provisioner\",\"volumeMounts\":[{\"mountPath\":\"/tmp\",\"name\":\"tmp\"}]}],\"hostNetwork\":true,\"serviceAccountName\":\"storage-provisioner\",\"volumes\":[{\"hostPath\":{\"path\":\"/tmp\",\"type\":\"Directory\"},\"name\":\"tmp\"}]}}\n" - }, - "creationTimestamp": "2020-07-23T06:50:07Z", - "labels": { - "addonmanager.kubernetes.io/mode": "Reconcile", - "integration-test": "storage-provisioner" - }, - "name": "storage-provisioner", - "namespace": "kube-system", - "resourceVersion": "6776184", - "selfLink": "/api/v1/namespaces/kube-system/pods/storage-provisioner", - "uid": "9dccc712-4040-4436-868e-cb5a1575f136" - }, - "spec": { - "containers": [ - { - "command": [ - "/storage-provisioner" - ], - "image": "gcr.io/k8s-minikube/storage-provisioner:v1.8.1", - "imagePullPolicy": "IfNotPresent", - "name": "storage-provisioner", - "resources": {}, - "terminationMessagePath": "/dev/termination-log", - "terminationMessagePolicy": "File", - "volumeMounts": [ - { - "mountPath": "/tmp", - "name": "tmp" - }, - { - "mountPath": "/var/run/secrets/kubernetes.io/serviceaccount", - "name": "storage-provisioner-token-srzhq", - "readOnly": true - } - ] - } - ], - "dnsPolicy": "ClusterFirst", - "enableServiceLinks": true, - "hostNetwork": true, - "nodeName": "minikube", - "priority": 0, - "restartPolicy": "Always", - "schedulerName": "default-scheduler", - "securityContext": {}, - "serviceAccount": "storage-provisioner", - "serviceAccountName": "storage-provisioner", - "terminationGracePeriodSeconds": 30, - "tolerations": [ - { - "effect": "NoExecute", - "key": "node.kubernetes.io/not-ready", - "operator": "Exists", - "tolerationSeconds": 300 - }, - { - "effect": "NoExecute", - "key": "node.kubernetes.io/unreachable", - "operator": "Exists", - "tolerationSeconds": 300 - } - ], - "volumes": [ - { - "hostPath": { - "path": "/tmp", - "type": "Directory" - }, - "name": "tmp" - }, - { - "name": "storage-provisioner-token-srzhq", - "secret": { - "defaultMode": 420, - "secretName": "storage-provisioner-token-srzhq" - } - } - ] - }, - "status": { - "conditions": [ - { - "lastProbeTime": null, - "lastTransitionTime": "2020-07-23T06:50:07Z", - "status": "True", - "type": "Initialized" - }, - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-21T08:12:13Z", - "status": "True", - "type": "Ready" - }, - { - "lastProbeTime": null, - "lastTransitionTime": "2021-04-21T08:12:13Z", - "status": "True", - "type": "ContainersReady" - }, - { - "lastProbeTime": null, - "lastTransitionTime": "2020-07-23T06:50:07Z", - "status": "True", - "type": "PodScheduled" - } - ], - "containerStatuses": [ - { - "containerID": "docker://36c5c504d7351db670f96ff0ad200072706f5db80317163fc360851c9c548944", - "image": "gcr.io/k8s-minikube/storage-provisioner:v1.8.1", - "imageID": "docker://sha256:4689081edb103a9e8174bf23a255bfbe0b2d9ed82edc907abab6989d1c60f02c", - "lastState": { - "terminated": { - "containerID": "docker://8c489dfc8785a84d3c936c5b810bdcec373b3dd9dcd99143294ddf72241b0ea2", - "exitCode": 2, - "finishedAt": "2021-04-21T08:11:17Z", - "reason": "Error", - "startedAt": "2021-04-21T06:44:16Z" - } - }, - "name": "storage-provisioner", - "ready": true, - "restartCount": 81, - "state": { - "running": { - "startedAt": "2021-04-21T08:12:12Z" - } - } - } - ], - "hostIP": "10.0.2.15", - "phase": "Running", - "podIP": "10.0.2.15", - "qosClass": "BestEffort", - "startTime": "2020-07-23T06:50:07Z" - } - } - ], - "kind": "PodList", - "metadata": { - "resourceVersion": "6777343", - "selfLink": "/api/v1/pods" - } - } - ` - unstructuredList := unstructured.UnstructuredList{} - if err := json.Unmarshal([]byte(podsList), &unstructuredList); err != nil { - glog.Error(err) - } - return &unstructuredList -} diff --git a/cautils/k8sinterface/resourcegroupmapping.go b/cautils/k8sinterface/resourcegroupmapping.go deleted file mode 100644 index e6c0dad4..00000000 --- a/cautils/k8sinterface/resourcegroupmapping.go +++ /dev/null @@ -1,142 +0,0 @@ -package k8sinterface - -import ( - "fmt" - "strings" - - "github.com/golang/glog" - "k8s.io/apimachinery/pkg/runtime/schema" -) - -const ValueNotFound = -1 - -// https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.21/#-strong-api-groups-strong- -var ResourceGroupMapping = map[string]string{ - "services": "/v1", - "pods": "/v1", - "replicationcontrollers": "/v1", - "podtemplates": "/v1", - "namespaces": "/v1", - "nodes": "/v1", - "configmaps": "/v1", - "secrets": "/v1", - "serviceaccounts": "/v1", - "persistentvolumeclaims": "/v1", - "limitranges": "/v1", - "resourcequotas": "/v1", - "daemonsets": "apps/v1", - "deployments": "apps/v1", - "replicasets": "apps/v1", - "statefulsets": "apps/v1", - "controllerrevisions": "apps/v1", - "jobs": "batch/v1", - "cronjobs": "batch/v1beta1", - "horizontalpodautoscalers": "autoscaling/v1", - "ingresses": "extensions/v1beta1", - "networkpolicies": "networking.k8s.io/v1", - "clusterroles": "rbac.authorization.k8s.io/v1", - "clusterrolebindings": "rbac.authorization.k8s.io/v1", - "roles": "rbac.authorization.k8s.io/v1", - "rolebindings": "rbac.authorization.k8s.io/v1", - "mutatingwebhookconfigurations": "admissionregistration.k8s.io/v1", - "validatingwebhookconfigurations": "admissionregistration.k8s.io/v1", -} - -var GroupsClusterScope = []string{} -var ResourceClusterScope = []string{"nodes", "namespaces", "clusterroles", "clusterrolebindings"} - -func GetGroupVersionResource(resource string) (schema.GroupVersionResource, error) { - resource = updateResourceKind(resource) - if r, ok := ResourceGroupMapping[resource]; ok { - gv := strings.Split(r, "/") - return schema.GroupVersionResource{Group: gv[0], Version: gv[1], Resource: resource}, nil - } - return schema.GroupVersionResource{}, fmt.Errorf("resource '%s' not found in resourceMap", resource) -} - -func IsNamespaceScope(apiGroup, resource string) bool { - return StringInSlice(GroupsClusterScope, apiGroup) == ValueNotFound && - StringInSlice(ResourceClusterScope, resource) == ValueNotFound -} - -func StringInSlice(strSlice []string, str string) int { - for i := range strSlice { - if strSlice[i] == str { - return i - } - } - return ValueNotFound -} - -func JoinResourceTriplets(group, version, resource string) string { - return fmt.Sprintf("%s/%s/%s", group, version, resource) -} -func GetResourceTriplets(group, version, resource string) []string { - resourceTriplets := []string{} - if resource == "" { - // load full map - for k, v := range ResourceGroupMapping { - g := strings.Split(v, "/") - resourceTriplets = append(resourceTriplets, JoinResourceTriplets(g[0], g[1], k)) - } - } else if version == "" { - // load by resource - if v, ok := ResourceGroupMapping[resource]; ok { - g := strings.Split(v, "/") - if group == "" { - group = g[0] - } - resourceTriplets = append(resourceTriplets, JoinResourceTriplets(group, g[1], resource)) - } else { - glog.Errorf("Resource '%s' unknown", resource) - } - } else if group == "" { - // load by resource and version - if v, ok := ResourceGroupMapping[resource]; ok { - g := strings.Split(v, "/") - resourceTriplets = append(resourceTriplets, JoinResourceTriplets(g[0], version, resource)) - } else { - glog.Errorf("Resource '%s' unknown", resource) - } - } else { - resourceTriplets = append(resourceTriplets, JoinResourceTriplets(group, version, resource)) - } - return resourceTriplets -} -func ResourceGroupToString(group, version, resource string) []string { - if group == "*" { - group = "" - } - if version == "*" { - version = "" - } - if resource == "*" { - resource = "" - } - resource = updateResourceKind(resource) - return GetResourceTriplets(group, version, resource) -} - -func StringToResourceGroup(str string) (string, string, string) { - splitted := strings.Split(str, "/") - for i := range splitted { - if splitted[i] == "*" { - splitted[i] = "" - } - } - return splitted[0], splitted[1], splitted[2] -} - -func updateResourceKind(resource string) string { - resource = strings.ToLower(resource) - - if resource != "" && !strings.HasSuffix(resource, "s") { - if strings.HasSuffix(resource, "y") { - return fmt.Sprintf("%sies", strings.TrimSuffix(resource, "y")) // e.g. NetworkPolicy -> networkpolicies - } else { - return fmt.Sprintf("%ss", resource) // add 's' at the end of a resource - } - } - return resource - -} diff --git a/cautils/k8sinterface/resourcegroupmapping_test.go b/cautils/k8sinterface/resourcegroupmapping_test.go deleted file mode 100644 index bb96f69f..00000000 --- a/cautils/k8sinterface/resourcegroupmapping_test.go +++ /dev/null @@ -1,22 +0,0 @@ -package k8sinterface - -import "testing" - -func TestResourceGroupToString(t *testing.T) { - allResources := ResourceGroupToString("*", "*", "*") - if len(allResources) != len(ResourceGroupMapping) { - t.Errorf("Expected len: %d, received: %d", len(ResourceGroupMapping), len(allResources)) - } - pod := ResourceGroupToString("*", "*", "Pod") - if len(pod) == 0 || pod[0] != "/v1/pods" { - t.Errorf("pod: %v", pod) - } - deployments := ResourceGroupToString("*", "*", "Deployment") - if len(deployments) == 0 || deployments[0] != "apps/v1/deployments" { - t.Errorf("deployments: %v", deployments) - } - cronjobs := ResourceGroupToString("*", "*", "cronjobs") - if len(cronjobs) == 0 || cronjobs[0] != "batch/v1beta1/cronjobs" { - t.Errorf("cronjobs: %v", cronjobs) - } -} diff --git a/cautils/k8sinterface/workload.go b/cautils/k8sinterface/workload.go deleted file mode 100644 index c0264984..00000000 --- a/cautils/k8sinterface/workload.go +++ /dev/null @@ -1,161 +0,0 @@ -package k8sinterface - -import ( - "encoding/json" - - "github.com/armosec/kubescape/cautils/apis" - - corev1 "k8s.io/api/core/v1" - - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" -) - -type IWorkload interface { - IBasicWorkload - - // Convert - ToUnstructured() (*unstructured.Unstructured, error) - ToString() string - Json() string // DEPRECATED - - // GET - GetWlid() string - GetJobID() *apis.JobTracking - GetVersion() string - GetGroup() string - - // SET - SetWlid(string) - SetInject() - SetIgnore() - SetUpdateTime() - SetJobID(apis.JobTracking) - SetCompatible() - SetIncompatible() - SetReplaceheaders() - - // EXIST - IsIgnore() bool - IsInject() bool - IsAttached() bool - IsCompatible() bool - IsIncompatible() bool - - // REMOVE - RemoveWlid() - RemoveSecretData() - RemoveInject() - RemoveIgnore() - RemoveUpdateTime() - RemoveJobID() - RemoveCompatible() - RemoveArmoMetadata() - RemoveArmoLabels() - RemoveArmoAnnotations() -} -type IBasicWorkload interface { - - // Set - SetKind(string) - SetWorkload(map[string]interface{}) - SetLabel(key, value string) - SetAnnotation(key, value string) - SetNamespace(string) - SetName(string) - - // Get - GetNamespace() string - GetName() string - GetGenerateName() string - GetApiVersion() string - GetKind() string - GetInnerAnnotation(string) (string, bool) - GetPodAnnotation(string) (string, bool) - GetAnnotation(string) (string, bool) - GetLabel(string) (string, bool) - GetAnnotations() map[string]string - GetInnerAnnotations() map[string]string - GetPodAnnotations() map[string]string - GetLabels() map[string]string - GetInnerLabels() map[string]string - GetPodLabels() map[string]string - GetVolumes() ([]corev1.Volume, error) - GetReplicas() int - GetContainers() ([]corev1.Container, error) - GetInitContainers() ([]corev1.Container, error) - GetOwnerReferences() ([]metav1.OwnerReference, error) - GetImagePullSecret() ([]corev1.LocalObjectReference, error) - GetServiceAccountName() string - GetSelector() (*metav1.LabelSelector, error) - GetResourceVersion() string - GetUID() string - GetPodSpec() (*corev1.PodSpec, error) - - GetWorkload() map[string]interface{} - - // REMOVE - RemoveLabel(string) - RemoveAnnotation(string) - RemovePodStatus() - RemoveResourceVersion() -} - -type Workload struct { - workload map[string]interface{} -} - -func NewWorkload(bWorkload []byte) (*Workload, error) { - workload := make(map[string]interface{}) - if bWorkload != nil { - if err := json.Unmarshal(bWorkload, &workload); err != nil { - return nil, err - } - } - return &Workload{ - workload: workload, - }, nil -} - -func NewWorkloadObj(workload map[string]interface{}) *Workload { - return &Workload{ - workload: workload, - } -} - -func (w *Workload) Json() string { - return w.ToString() -} -func (w *Workload) ToString() string { - if w.GetWorkload() == nil { - return "" - } - bWorkload, err := json.Marshal(w.GetWorkload()) - if err != nil { - return err.Error() - } - return string(bWorkload) -} - -func (workload *Workload) DeepCopy(w map[string]interface{}) { - workload.workload = make(map[string]interface{}) - byt, _ := json.Marshal(w) - json.Unmarshal(byt, &workload.workload) -} - -func (w *Workload) ToUnstructured() (*unstructured.Unstructured, error) { - obj := &unstructured.Unstructured{} - if w.workload == nil { - return obj, nil - } - bWorkload, err := json.Marshal(w.workload) - if err != nil { - return obj, err - } - if err := json.Unmarshal(bWorkload, obj); err != nil { - return obj, err - - } - - return obj, nil -} diff --git a/cautils/k8sinterface/workloadmethods.go b/cautils/k8sinterface/workloadmethods.go deleted file mode 100644 index a3f2b403..00000000 --- a/cautils/k8sinterface/workloadmethods.go +++ /dev/null @@ -1,642 +0,0 @@ -package k8sinterface - -import ( - "encoding/json" - "fmt" - "strconv" - "strings" - "time" - - "github.com/armosec/kubescape/cautils/apis" - "github.com/armosec/kubescape/cautils/cautils" - - corev1 "k8s.io/api/core/v1" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" -) - -// ======================================= DELETE ======================================== - -func (w *Workload) RemoveInject() { - w.RemovePodLabel(cautils.CAInject) // DEPRECATED - w.RemovePodLabel(cautils.CAAttachLabel) // DEPRECATED - w.RemovePodLabel(cautils.ArmoAttach) - - w.RemoveLabel(cautils.CAInject) // DEPRECATED - w.RemoveLabel(cautils.CAAttachLabel) // DEPRECATED - w.RemoveLabel(cautils.ArmoAttach) -} - -func (w *Workload) RemoveIgnore() { - w.RemovePodLabel(cautils.CAIgnore) // DEPRECATED - w.RemovePodLabel(cautils.ArmoAttach) - - w.RemoveLabel(cautils.CAIgnore) // DEPRECATED - w.RemoveLabel(cautils.ArmoAttach) -} - -func (w *Workload) RemoveWlid() { - w.RemovePodAnnotation(cautils.CAWlid) // DEPRECATED - w.RemovePodAnnotation(cautils.ArmoWlid) - - w.RemoveAnnotation(cautils.CAWlid) // DEPRECATED - w.RemoveAnnotation(cautils.ArmoWlid) -} - -func (w *Workload) RemoveCompatible() { - w.RemovePodAnnotation(cautils.ArmoCompatibleAnnotation) -} -func (w *Workload) RemoveJobID() { - w.RemovePodAnnotation(cautils.ArmoJobIDPath) - w.RemovePodAnnotation(cautils.ArmoJobParentPath) - w.RemovePodAnnotation(cautils.ArmoJobActionPath) - - w.RemoveAnnotation(cautils.ArmoJobIDPath) - w.RemoveAnnotation(cautils.ArmoJobParentPath) - w.RemoveAnnotation(cautils.ArmoJobActionPath) -} -func (w *Workload) RemoveArmoMetadata() { - w.RemoveArmoLabels() - w.RemoveArmoAnnotations() -} - -func (w *Workload) RemoveArmoAnnotations() { - l := w.GetAnnotations() - if l != nil { - for k := range l { - if strings.HasPrefix(k, cautils.ArmoPrefix) { - w.RemoveAnnotation(k) - } - if strings.HasPrefix(k, cautils.CAPrefix) { // DEPRECATED - w.RemoveAnnotation(k) - } - } - } - lp := w.GetPodAnnotations() - if lp != nil { - for k := range lp { - if strings.HasPrefix(k, cautils.ArmoPrefix) { - w.RemovePodAnnotation(k) - } - if strings.HasPrefix(k, cautils.CAPrefix) { // DEPRECATED - w.RemovePodAnnotation(k) - } - } - } -} -func (w *Workload) RemoveArmoLabels() { - l := w.GetLabels() - if l != nil { - for k := range l { - if strings.HasPrefix(k, cautils.ArmoPrefix) { - w.RemoveLabel(k) - } - if strings.HasPrefix(k, cautils.CAPrefix) { // DEPRECATED - w.RemoveLabel(k) - } - } - } - lp := w.GetPodLabels() - if lp != nil { - for k := range lp { - if strings.HasPrefix(k, cautils.ArmoPrefix) { - w.RemovePodLabel(k) - } - if strings.HasPrefix(k, cautils.CAPrefix) { // DEPRECATED - w.RemovePodLabel(k) - } - } - } -} -func (w *Workload) RemoveUpdateTime() { - - // remove from pod - w.RemovePodAnnotation(cautils.CAUpdate) // DEPRECATED - w.RemovePodAnnotation(cautils.ArmoUpdate) - - // remove from workload - w.RemoveAnnotation(cautils.CAUpdate) // DEPRECATED - w.RemoveAnnotation(cautils.ArmoUpdate) -} -func (w *Workload) RemoveSecretData() { - w.RemoveAnnotation("kubectl.kubernetes.io/last-applied-configuration") - delete(w.workload, "data") -} - -func (w *Workload) RemovePodStatus() { - delete(w.workload, "status") -} - -func (w *Workload) RemoveResourceVersion() { - if _, ok := w.workload["metadata"]; !ok { - return - } - meta, _ := w.workload["metadata"].(map[string]interface{}) - delete(meta, "resourceVersion") -} - -func (w *Workload) RemoveLabel(key string) { - w.RemoveMetadata([]string{"metadata"}, "labels", key) -} - -func (w *Workload) RemoveAnnotation(key string) { - w.RemoveMetadata([]string{"metadata"}, "annotations", key) -} - -func (w *Workload) RemovePodAnnotation(key string) { - w.RemoveMetadata(PodMetadata(w.GetKind()), "annotations", key) -} - -func (w *Workload) RemovePodLabel(key string) { - w.RemoveMetadata(PodMetadata(w.GetKind()), "labels", key) -} - -func (w *Workload) RemoveMetadata(scope []string, metadata, key string) { - - workload := w.workload - for i := range scope { - if _, ok := workload[scope[i]]; !ok { - return - } - workload, _ = workload[scope[i]].(map[string]interface{}) - } - - if _, ok := workload[metadata]; !ok { - return - } - - labels, _ := workload[metadata].(map[string]interface{}) - delete(labels, key) - -} - -// ========================================= SET ========================================= - -func (w *Workload) SetWorkload(workload map[string]interface{}) { - w.workload = workload -} - -func (w *Workload) SetKind(kind string) { - w.workload["kind"] = kind -} - -func (w *Workload) SetInject() { - w.SetPodLabel(cautils.ArmoAttach, cautils.BoolToString(true)) -} - -func (w *Workload) SetJobID(jobTracking apis.JobTracking) { - w.SetPodAnnotation(cautils.ArmoJobIDPath, jobTracking.JobID) - w.SetPodAnnotation(cautils.ArmoJobParentPath, jobTracking.ParentID) - w.SetPodAnnotation(cautils.ArmoJobActionPath, fmt.Sprintf("%d", jobTracking.LastActionNumber)) -} - -func (w *Workload) SetIgnore() { - w.SetPodLabel(cautils.ArmoAttach, cautils.BoolToString(false)) -} - -func (w *Workload) SetCompatible() { - w.SetPodAnnotation(cautils.ArmoCompatibleAnnotation, cautils.BoolToString(true)) -} - -func (w *Workload) SetIncompatible() { - w.SetPodAnnotation(cautils.ArmoCompatibleAnnotation, cautils.BoolToString(false)) -} - -func (w *Workload) SetReplaceheaders() { - w.SetPodAnnotation(cautils.ArmoReplaceheaders, cautils.BoolToString(true)) -} - -func (w *Workload) SetWlid(wlid string) { - w.SetPodAnnotation(cautils.ArmoWlid, wlid) -} - -func (w *Workload) SetUpdateTime() { - w.SetPodAnnotation(cautils.ArmoUpdate, string(time.Now().UTC().Format("02-01-2006 15:04:05"))) -} - -func (w *Workload) SetNamespace(namespace string) { - w.SetMetadata([]string{"metadata"}, "namespace", namespace) -} - -func (w *Workload) SetName(name string) { - w.SetMetadata([]string{"metadata"}, "name", name) -} - -func (w *Workload) SetLabel(key, value string) { - w.SetMetadata([]string{"metadata", "labels"}, key, value) -} - -func (w *Workload) SetPodLabel(key, value string) { - w.SetMetadata(append(PodMetadata(w.GetKind()), "labels"), key, value) -} -func (w *Workload) SetAnnotation(key, value string) { - w.SetMetadata([]string{"metadata", "annotations"}, key, value) -} -func (w *Workload) SetPodAnnotation(key, value string) { - w.SetMetadata(append(PodMetadata(w.GetKind()), "annotations"), key, value) -} - -func (w *Workload) SetMetadata(scope []string, key string, val interface{}) { - workload := w.workload - for i := range scope { - if _, ok := workload[scope[i]]; !ok { - workload[scope[i]] = make(map[string]interface{}) - } - workload, _ = workload[scope[i]].(map[string]interface{}) - } - - workload[key] = val -} - -// ========================================= GET ========================================= -func (w *Workload) GetWorkload() map[string]interface{} { - return w.workload -} -func (w *Workload) GetNamespace() string { - if v, ok := InspectWorkload(w.workload, "metadata", "namespace"); ok { - return v.(string) - } - return "" -} - -func (w *Workload) GetName() string { - if v, ok := InspectWorkload(w.workload, "metadata", "name"); ok { - return v.(string) - } - return "" -} - -func (w *Workload) GetApiVersion() string { - if v, ok := InspectWorkload(w.workload, "apiVersion"); ok { - return v.(string) - } - return "" -} - -func (w *Workload) GetVersion() string { - apiVersion := w.GetApiVersion() - splitted := strings.Split(apiVersion, "/") - if len(splitted) == 1 { - return splitted[0] - } else if len(splitted) == 2 { - return splitted[1] - } - return "" -} - -func (w *Workload) GetGroup() string { - apiVersion := w.GetApiVersion() - splitted := strings.Split(apiVersion, "/") - if len(splitted) == 2 { - return splitted[0] - } - return "" -} - -func (w *Workload) GetGenerateName() string { - if v, ok := InspectWorkload(w.workload, "metadata", "generateName"); ok { - return v.(string) - } - return "" -} - -func (w *Workload) GetReplicas() int { - if v, ok := InspectWorkload(w.workload, "spec", "replicas"); ok { - replicas, isok := v.(float64) - if isok { - return int(replicas) - } - } - return 1 -} - -func (w *Workload) GetKind() string { - if v, ok := InspectWorkload(w.workload, "kind"); ok { - return v.(string) - } - return "" -} -func (w *Workload) GetSelector() (*metav1.LabelSelector, error) { - selector := &metav1.LabelSelector{} - if v, ok := InspectWorkload(w.workload, "spec", "selector", "matchLabels"); ok && v != nil { - b, err := json.Marshal(v) - if err != nil { - return selector, err - } - if err := json.Unmarshal(b, selector); err != nil { - return selector, err - } - return selector, nil - } - return selector, nil -} - -func (w *Workload) GetAnnotation(annotation string) (string, bool) { - if v, ok := InspectWorkload(w.workload, "metadata", "annotations", annotation); ok { - return v.(string), ok - } - return "", false -} -func (w *Workload) GetLabel(label string) (string, bool) { - if v, ok := InspectWorkload(w.workload, "metadata", "labels", label); ok { - return v.(string), ok - } - return "", false -} - -func (w *Workload) GetPodLabel(label string) (string, bool) { - if v, ok := InspectWorkload(w.workload, append(PodMetadata(w.GetKind()), "labels", label)...); ok && v != nil { - return v.(string), ok - } - return "", false -} - -func (w *Workload) GetLabels() map[string]string { - if v, ok := InspectWorkload(w.workload, "metadata", "labels"); ok && v != nil { - labels := make(map[string]string) - for k, i := range v.(map[string]interface{}) { - labels[k] = i.(string) - } - return labels - } - return nil -} - -// GetInnerLabels - DEPRECATED -func (w *Workload) GetInnerLabels() map[string]string { - return w.GetPodLabels() -} - -func (w *Workload) GetPodLabels() map[string]string { - if v, ok := InspectWorkload(w.workload, append(PodMetadata(w.GetKind()), "labels")...); ok && v != nil { - labels := make(map[string]string) - for k, i := range v.(map[string]interface{}) { - labels[k] = i.(string) - } - return labels - } - return nil -} - -// GetInnerAnnotations - DEPRECATED -func (w *Workload) GetInnerAnnotations() map[string]string { - return w.GetPodAnnotations() -} - -// GetPodAnnotations -func (w *Workload) GetPodAnnotations() map[string]string { - if v, ok := InspectWorkload(w.workload, append(PodMetadata(w.GetKind()), "annotations")...); ok && v != nil { - annotations := make(map[string]string) - for k, i := range v.(map[string]interface{}) { - annotations[k] = fmt.Sprintf("%v", i) - } - return annotations - } - return nil -} - -// GetInnerAnnotation DEPRECATED -func (w *Workload) GetInnerAnnotation(annotation string) (string, bool) { - return w.GetPodAnnotation(annotation) -} - -func (w *Workload) GetPodAnnotation(annotation string) (string, bool) { - if v, ok := InspectWorkload(w.workload, append(PodMetadata(w.GetKind()), "annotations", annotation)...); ok && v != nil { - return v.(string), ok - } - return "", false -} - -func (w *Workload) GetAnnotations() map[string]string { - if v, ok := InspectWorkload(w.workload, "metadata", "annotations"); ok && v != nil { - annotations := make(map[string]string) - for k, i := range v.(map[string]interface{}) { - annotations[k] = fmt.Sprintf("%v", i) - } - return annotations - } - return nil -} - -// GetVolumes - -func (w *Workload) GetVolumes() ([]corev1.Volume, error) { - volumes := []corev1.Volume{} - - interVolumes, _ := InspectWorkload(w.workload, append(PodSpec(w.GetKind()), "volumes")...) - if interVolumes == nil { - return volumes, nil - } - volumesBytes, err := json.Marshal(interVolumes) - if err != nil { - return volumes, err - } - err = json.Unmarshal(volumesBytes, &volumes) - - return volumes, err -} - -func (w *Workload) GetServiceAccountName() string { - - if v, ok := InspectWorkload(w.workload, append(PodSpec(w.GetKind()), "serviceAccountName")...); ok && v != nil { - return v.(string) - } - return "" -} - -func (w *Workload) GetPodSpec() (*corev1.PodSpec, error) { - podSpec := &corev1.PodSpec{} - podSepcRaw, _ := InspectWorkload(w.workload, PodSpec(w.GetKind())...) - if podSepcRaw == nil { - return podSpec, fmt.Errorf("no PodSpec for workload: %v", w) - } - b, err := json.Marshal(podSepcRaw) - if err != nil { - return podSpec, err - } - err = json.Unmarshal(b, podSpec) - - return podSpec, err -} - -func (w *Workload) GetImagePullSecret() ([]corev1.LocalObjectReference, error) { - imgPullSecrets := []corev1.LocalObjectReference{} - - iImgPullSecrets, _ := InspectWorkload(w.workload, append(PodSpec(w.GetKind()), "imagePullSecrets")...) - b, err := json.Marshal(iImgPullSecrets) - if err != nil { - return imgPullSecrets, err - } - err = json.Unmarshal(b, &imgPullSecrets) - - return imgPullSecrets, err -} - -// GetContainers - -func (w *Workload) GetContainers() ([]corev1.Container, error) { - containers := []corev1.Container{} - - interContainers, _ := InspectWorkload(w.workload, append(PodSpec(w.GetKind()), "containers")...) - if interContainers == nil { - return containers, nil - } - containersBytes, err := json.Marshal(interContainers) - if err != nil { - return containers, err - } - err = json.Unmarshal(containersBytes, &containers) - - return containers, err -} - -// GetInitContainers - -func (w *Workload) GetInitContainers() ([]corev1.Container, error) { - containers := []corev1.Container{} - - interContainers, _ := InspectWorkload(w.workload, append(PodSpec(w.GetKind()), "initContainers")...) - if interContainers == nil { - return containers, nil - } - containersBytes, err := json.Marshal(interContainers) - if err != nil { - return containers, err - } - err = json.Unmarshal(containersBytes, &containers) - - return containers, err -} - -// GetOwnerReferences - -func (w *Workload) GetOwnerReferences() ([]metav1.OwnerReference, error) { - ownerReferences := []metav1.OwnerReference{} - interOwnerReferences, ok := InspectWorkload(w.workload, "metadata", "ownerReferences") - if !ok { - return ownerReferences, nil - } - - ownerReferencesBytes, err := json.Marshal(interOwnerReferences) - if err != nil { - return ownerReferences, err - } - err = json.Unmarshal(ownerReferencesBytes, &ownerReferences) - if err != nil { - return ownerReferences, err - - } - return ownerReferences, nil -} -func (w *Workload) GetResourceVersion() string { - if v, ok := InspectWorkload(w.workload, "metadata", "resourceVersion"); ok { - return v.(string) - } - return "" -} -func (w *Workload) GetUID() string { - if v, ok := InspectWorkload(w.workload, "metadata", "uid"); ok { - return v.(string) - } - return "" -} -func (w *Workload) GetWlid() string { - if wlid, ok := w.GetAnnotation(cautils.ArmoWlid); ok { - return wlid - } - return "" -} - -func (w *Workload) GetJobID() *apis.JobTracking { - jobTracking := apis.JobTracking{} - if job, ok := w.GetPodAnnotation(cautils.ArmoJobIDPath); ok { - jobTracking.JobID = job - } - if parent, ok := w.GetPodAnnotation(cautils.ArmoJobParentPath); ok { - jobTracking.ParentID = parent - } - if action, ok := w.GetPodAnnotation(cautils.ArmoJobActionPath); ok { - if i, err := strconv.Atoi(action); err == nil { - jobTracking.LastActionNumber = i - } - } - if jobTracking.LastActionNumber == 0 { // start the counter at 1 - jobTracking.LastActionNumber = 1 - } - return &jobTracking -} - -// func (w *Workload) GetJobID() string { -// if status, ok := w.GetAnnotation(cautils.ArmoJobID); ok { -// return status -// } -// return "" -// } - -// ========================================= IS ========================================= - -func (w *Workload) IsInject() bool { - return w.IsAttached() -} - -func (w *Workload) IsIgnore() bool { - if attach := cautils.IsAttached(w.GetPodLabels()); attach != nil { - return !(*attach) - } - if attach := cautils.IsAttached(w.GetLabels()); attach != nil { - return !(*attach) - } - return false -} - -func (w *Workload) IsCompatible() bool { - if c, ok := w.GetPodAnnotation(cautils.ArmoCompatibleAnnotation); ok { - return cautils.StringToBool(c) - - } - if c, ok := w.GetAnnotation(cautils.ArmoCompatibleAnnotation); ok { - return cautils.StringToBool(c) - - } - return false -} - -func (w *Workload) IsIncompatible() bool { - if c, ok := w.GetPodAnnotation(cautils.ArmoCompatibleAnnotation); ok { - return !cautils.StringToBool(c) - } - if c, ok := w.GetAnnotation(cautils.ArmoCompatibleAnnotation); ok { - return !cautils.StringToBool(c) - } - return false -} -func (w *Workload) IsAttached() bool { - if attach := cautils.IsAttached(w.GetPodLabels()); attach != nil { - return *attach - } - if attach := cautils.IsAttached(w.GetLabels()); attach != nil { - return *attach - } - return false -} - -func (w *Workload) IsReplaceheaders() bool { - if c, ok := w.GetPodAnnotation(cautils.ArmoReplaceheaders); ok { - return cautils.StringToBool(c) - } - return false -} - -// ======================================= UTILS ========================================= - -// InspectWorkload - -func InspectWorkload(workload interface{}, scopes ...string) (val interface{}, k bool) { - - val, k = nil, false - if len(scopes) == 0 { - if workload != nil { - return workload, true - } - return nil, false - } - if data, ok := workload.(map[string]interface{}); ok { - val, k = InspectWorkload(data[scopes[0]], scopes[1:]...) - } - return val, k - -} diff --git a/cautils/k8sinterface/workloadmethods_test.go b/cautils/k8sinterface/workloadmethods_test.go deleted file mode 100644 index 7136b449..00000000 --- a/cautils/k8sinterface/workloadmethods_test.go +++ /dev/null @@ -1,155 +0,0 @@ -package k8sinterface - -import ( - "testing" -) - -// ========================================= IS ========================================= - -func TestLabels(t *testing.T) { - w := `{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"annotations":{"deployment.kubernetes.io/revision":"1"},"creationTimestamp":"2021-05-03T13:10:32Z","generation":1,"labels":{"app":"demoservice-server","cyberarmor.inject":"true"},"managedFields":[{"apiVersion":"apps/v1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:app":{},"f:cyberarmor.inject":{}}},"f:spec":{"f:progressDeadlineSeconds":{},"f:replicas":{},"f:revisionHistoryLimit":{},"f:selector":{},"f:strategy":{"f:rollingUpdate":{".":{},"f:maxSurge":{},"f:maxUnavailable":{}},"f:type":{}},"f:template":{"f:metadata":{"f:labels":{".":{},"f:app":{}}},"f:spec":{"f:containers":{"k:{\"name\":\"demoservice\"}":{".":{},"f:env":{".":{},"k:{\"name\":\"ARMO_TEST_NAME\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"CAA_ENABLE_CRASH_REPORTER\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"DEMO_FOLDERS\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"SERVER_PORT\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"SLEEP_DURATION\"}":{".":{},"f:name":{},"f:value":{}}},"f:image":{},"f:imagePullPolicy":{},"f:name":{},"f:ports":{".":{},"k:{\"containerPort\":8089,\"protocol\":\"TCP\"}":{".":{},"f:containerPort":{},"f:protocol":{}}},"f:resources":{},"f:terminationMessagePath":{},"f:terminationMessagePolicy":{}}},"f:dnsPolicy":{},"f:restartPolicy":{},"f:schedulerName":{},"f:securityContext":{},"f:terminationGracePeriodSeconds":{}}}}},"manager":"OpenAPI-Generator","operation":"Update","time":"2021-05-03T13:10:32Z"},{"apiVersion":"apps/v1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:deployment.kubernetes.io/revision":{}}},"f:status":{"f:availableReplicas":{},"f:conditions":{".":{},"k:{\"type\":\"Available\"}":{".":{},"f:lastTransitionTime":{},"f:lastUpdateTime":{},"f:message":{},"f:reason":{},"f:status":{},"f:type":{}},"k:{\"type\":\"Progressing\"}":{".":{},"f:lastTransitionTime":{},"f:lastUpdateTime":{},"f:message":{},"f:reason":{},"f:status":{},"f:type":{}}},"f:observedGeneration":{},"f:readyReplicas":{},"f:replicas":{},"f:updatedReplicas":{}}},"manager":"kube-controller-manager","operation":"Update","time":"2021-05-03T13:52:58Z"}],"name":"demoservice-server","namespace":"default","resourceVersion":"1016043","uid":"e9e8a3e9-6cb4-4301-ace1-2c0cef3bd61e"},"spec":{"progressDeadlineSeconds":600,"replicas":1,"revisionHistoryLimit":10,"selector":{"matchLabels":{"app":"demoservice-server"}},"strategy":{"rollingUpdate":{"maxSurge":"25%","maxUnavailable":"25%"},"type":"RollingUpdate"},"template":{"metadata":{"creationTimestamp":null,"labels":{"app":"demoservice-server"}},"spec":{"containers":[{"env":[{"name":"SERVER_PORT","value":"8089"},{"name":"SLEEP_DURATION","value":"1"},{"name":"DEMO_FOLDERS","value":"/app"},{"name":"ARMO_TEST_NAME","value":"auto_attach_deployment"},{"name":"CAA_ENABLE_CRASH_REPORTER","value":"1"}],"image":"quay.io/armosec/demoservice:v25","imagePullPolicy":"IfNotPresent","name":"demoservice","ports":[{"containerPort":8089,"protocol":"TCP"}],"resources":{},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File"}],"dnsPolicy":"ClusterFirst","restartPolicy":"Always","schedulerName":"default-scheduler","securityContext":{},"terminationGracePeriodSeconds":30}}},"status":{"availableReplicas":1,"conditions":[{"lastTransitionTime":"2021-05-03T13:10:32Z","lastUpdateTime":"2021-05-03T13:10:37Z","message":"ReplicaSet \"demoservice-server-7d478b6998\" has successfully progressed.","reason":"NewReplicaSetAvailable","status":"True","type":"Progressing"},{"lastTransitionTime":"2021-05-03T13:52:58Z","lastUpdateTime":"2021-05-03T13:52:58Z","message":"Deployment has minimum availability.","reason":"MinimumReplicasAvailable","status":"True","type":"Available"}],"observedGeneration":1,"readyReplicas":1,"replicas":1,"updatedReplicas":1}}` - workload, err := NewWorkload([]byte(w)) - if err != nil { - t.Errorf(err.Error()) - } - if workload.GetKind() != "Deployment" { - t.Errorf("wrong kind") - } - if workload.GetNamespace() != "default" { - t.Errorf("wrong namespace") - } - if workload.GetName() != "demoservice-server" { - t.Errorf("wrong name") - } - if !workload.IsInject() { - t.Errorf("expect to find inject label") - } - if workload.IsIgnore() { - t.Errorf("expect to find ignore label") - } -} - -func TestSetNamespace(t *testing.T) { - w := `{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"name":"demoservice-server"},"spec":{"replicas":1,"selector":{"matchLabels":{"app":"demoservice-server"}},"template":{"metadata":{"creationTimestamp":null,"labels":{"app":"demoservice-server"}},"spec":{"containers":[{"env":[{"name":"SERVER_PORT","value":"8089"},{"name":"SLEEP_DURATION","value":"1"},{"name":"DEMO_FOLDERS","value":"/app"},{"name":"ARMO_TEST_NAME","value":"auto_attach_deployment"},{"name":"CAA_ENABLE_CRASH_REPORTER","value":"1"}],"image":"quay.io/armosec/demoservice:v25","imagePullPolicy":"IfNotPresent","name":"demoservice","ports":[{"containerPort":8089,"protocol":"TCP"}],"resources":{},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File"}],"dnsPolicy":"ClusterFirst","restartPolicy":"Always","schedulerName":"default-scheduler","securityContext":{},"terminationGracePeriodSeconds":30}}}}` - workload, err := NewWorkload([]byte(w)) - if err != nil { - t.Errorf(err.Error()) - } - workload.SetNamespace("default") - if workload.GetNamespace() != "default" { - t.Errorf("wrong namespace") - } -} -func TestSetLabels(t *testing.T) { - w := `{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"annotations":{"deployment.kubernetes.io/revision":"1"},"creationTimestamp":"2021-05-03T13:10:32Z","generation":1,"managedFields":[{"apiVersion":"apps/v1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:app":{},"f:cyberarmor.inject":{}}},"f:spec":{"f:progressDeadlineSeconds":{},"f:replicas":{},"f:revisionHistoryLimit":{},"f:selector":{},"f:strategy":{"f:rollingUpdate":{".":{},"f:maxSurge":{},"f:maxUnavailable":{}},"f:type":{}},"f:template":{"f:metadata":{"f:labels":{".":{},"f:app":{}}},"f:spec":{"f:containers":{"k:{\"name\":\"demoservice\"}":{".":{},"f:env":{".":{},"k:{\"name\":\"ARMO_TEST_NAME\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"CAA_ENABLE_CRASH_REPORTER\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"DEMO_FOLDERS\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"SERVER_PORT\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"SLEEP_DURATION\"}":{".":{},"f:name":{},"f:value":{}}},"f:image":{},"f:imagePullPolicy":{},"f:name":{},"f:ports":{".":{},"k:{\"containerPort\":8089,\"protocol\":\"TCP\"}":{".":{},"f:containerPort":{},"f:protocol":{}}},"f:resources":{},"f:terminationMessagePath":{},"f:terminationMessagePolicy":{}}},"f:dnsPolicy":{},"f:restartPolicy":{},"f:schedulerName":{},"f:securityContext":{},"f:terminationGracePeriodSeconds":{}}}}},"manager":"OpenAPI-Generator","operation":"Update","time":"2021-05-03T13:10:32Z"},{"apiVersion":"apps/v1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:deployment.kubernetes.io/revision":{}}},"f:status":{"f:availableReplicas":{},"f:conditions":{".":{},"k:{\"type\":\"Available\"}":{".":{},"f:lastTransitionTime":{},"f:lastUpdateTime":{},"f:message":{},"f:reason":{},"f:status":{},"f:type":{}},"k:{\"type\":\"Progressing\"}":{".":{},"f:lastTransitionTime":{},"f:lastUpdateTime":{},"f:message":{},"f:reason":{},"f:status":{},"f:type":{}}},"f:observedGeneration":{},"f:readyReplicas":{},"f:replicas":{},"f:updatedReplicas":{}}},"manager":"kube-controller-manager","operation":"Update","time":"2021-05-03T13:52:58Z"}],"name":"demoservice-server","namespace":"default","resourceVersion":"1016043","uid":"e9e8a3e9-6cb4-4301-ace1-2c0cef3bd61e"},"spec":{"progressDeadlineSeconds":600,"replicas":1,"revisionHistoryLimit":10,"selector":{"matchLabels":{"app":"demoservice-server"}},"strategy":{"rollingUpdate":{"maxSurge":"25%","maxUnavailable":"25%"},"type":"RollingUpdate"},"template":{"metadata":{"creationTimestamp":null,"labels":{"app":"demoservice-server"}},"spec":{"containers":[{"env":[{"name":"SERVER_PORT","value":"8089"},{"name":"SLEEP_DURATION","value":"1"},{"name":"DEMO_FOLDERS","value":"/app"},{"name":"ARMO_TEST_NAME","value":"auto_attach_deployment"},{"name":"CAA_ENABLE_CRASH_REPORTER","value":"1"}],"image":"quay.io/armosec/demoservice:v25","imagePullPolicy":"IfNotPresent","name":"demoservice","ports":[{"containerPort":8089,"protocol":"TCP"}],"resources":{},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File"}],"dnsPolicy":"ClusterFirst","restartPolicy":"Always","schedulerName":"default-scheduler","securityContext":{},"terminationGracePeriodSeconds":30}}},"status":{"availableReplicas":1,"conditions":[{"lastTransitionTime":"2021-05-03T13:10:32Z","lastUpdateTime":"2021-05-03T13:10:37Z","message":"ReplicaSet \"demoservice-server-7d478b6998\" has successfully progressed.","reason":"NewReplicaSetAvailable","status":"True","type":"Progressing"},{"lastTransitionTime":"2021-05-03T13:52:58Z","lastUpdateTime":"2021-05-03T13:52:58Z","message":"Deployment has minimum availability.","reason":"MinimumReplicasAvailable","status":"True","type":"Available"}],"observedGeneration":1,"readyReplicas":1,"replicas":1,"updatedReplicas":1}}` - workload, err := NewWorkload([]byte(w)) - if err != nil { - t.Errorf(err.Error()) - } - workload.SetLabel("bla", "daa") - v, ok := workload.GetLabel("bla") - if !ok || v != "daa" { - t.Errorf("expect to find label") - } - workload.RemoveLabel("bla") - v2, ok2 := workload.GetLabel("bla") - if ok2 || v2 == "daa" { - t.Errorf("label not deleted") - } -} - -func TestSetAnnotations(t *testing.T) { - w := `{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"annotations":{"deployment.kubernetes.io/revision":"1"},"creationTimestamp":"2021-05-03T13:10:32Z","generation":1,"managedFields":[{"apiVersion":"apps/v1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:app":{},"f:cyberarmor.inject":{}}},"f:spec":{"f:progressDeadlineSeconds":{},"f:replicas":{},"f:revisionHistoryLimit":{},"f:selector":{},"f:strategy":{"f:rollingUpdate":{".":{},"f:maxSurge":{},"f:maxUnavailable":{}},"f:type":{}},"f:template":{"f:metadata":{"f:labels":{".":{},"f:app":{}}},"f:spec":{"f:containers":{"k:{\"name\":\"demoservice\"}":{".":{},"f:env":{".":{},"k:{\"name\":\"ARMO_TEST_NAME\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"CAA_ENABLE_CRASH_REPORTER\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"DEMO_FOLDERS\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"SERVER_PORT\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"SLEEP_DURATION\"}":{".":{},"f:name":{},"f:value":{}}},"f:image":{},"f:imagePullPolicy":{},"f:name":{},"f:ports":{".":{},"k:{\"containerPort\":8089,\"protocol\":\"TCP\"}":{".":{},"f:containerPort":{},"f:protocol":{}}},"f:resources":{},"f:terminationMessagePath":{},"f:terminationMessagePolicy":{}}},"f:dnsPolicy":{},"f:restartPolicy":{},"f:schedulerName":{},"f:securityContext":{},"f:terminationGracePeriodSeconds":{}}}}},"manager":"OpenAPI-Generator","operation":"Update","time":"2021-05-03T13:10:32Z"},{"apiVersion":"apps/v1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:deployment.kubernetes.io/revision":{}}},"f:status":{"f:availableReplicas":{},"f:conditions":{".":{},"k:{\"type\":\"Available\"}":{".":{},"f:lastTransitionTime":{},"f:lastUpdateTime":{},"f:message":{},"f:reason":{},"f:status":{},"f:type":{}},"k:{\"type\":\"Progressing\"}":{".":{},"f:lastTransitionTime":{},"f:lastUpdateTime":{},"f:message":{},"f:reason":{},"f:status":{},"f:type":{}}},"f:observedGeneration":{},"f:readyReplicas":{},"f:replicas":{},"f:updatedReplicas":{}}},"manager":"kube-controller-manager","operation":"Update","time":"2021-05-03T13:52:58Z"}],"name":"demoservice-server","namespace":"default","resourceVersion":"1016043","uid":"e9e8a3e9-6cb4-4301-ace1-2c0cef3bd61e"},"spec":{"progressDeadlineSeconds":600,"replicas":1,"revisionHistoryLimit":10,"selector":{"matchLabels":{"app":"demoservice-server"}},"strategy":{"rollingUpdate":{"maxSurge":"25%","maxUnavailable":"25%"},"type":"RollingUpdate"},"template":{"metadata":{"creationTimestamp":null,"labels":{"app":"demoservice-server"}},"spec":{"containers":[{"env":[{"name":"SERVER_PORT","value":"8089"},{"name":"SLEEP_DURATION","value":"1"},{"name":"DEMO_FOLDERS","value":"/app"},{"name":"ARMO_TEST_NAME","value":"auto_attach_deployment"},{"name":"CAA_ENABLE_CRASH_REPORTER","value":"1"}],"image":"quay.io/armosec/demoservice:v25","imagePullPolicy":"IfNotPresent","name":"demoservice","ports":[{"containerPort":8089,"protocol":"TCP"}],"resources":{},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File"}],"dnsPolicy":"ClusterFirst","restartPolicy":"Always","schedulerName":"default-scheduler","securityContext":{},"terminationGracePeriodSeconds":30}}},"status":{"availableReplicas":1,"conditions":[{"lastTransitionTime":"2021-05-03T13:10:32Z","lastUpdateTime":"2021-05-03T13:10:37Z","message":"ReplicaSet \"demoservice-server-7d478b6998\" has successfully progressed.","reason":"NewReplicaSetAvailable","status":"True","type":"Progressing"},{"lastTransitionTime":"2021-05-03T13:52:58Z","lastUpdateTime":"2021-05-03T13:52:58Z","message":"Deployment has minimum availability.","reason":"MinimumReplicasAvailable","status":"True","type":"Available"}],"observedGeneration":1,"readyReplicas":1,"replicas":1,"updatedReplicas":1}}` - workload, err := NewWorkload([]byte(w)) - if err != nil { - t.Errorf(err.Error()) - } - workload.SetAnnotation("bla", "daa") - v, ok := workload.GetAnnotation("bla") - if !ok || v != "daa" { - t.Errorf("expect to find annotation") - } - workload.RemoveAnnotation("bla") - v2, ok2 := workload.GetAnnotation("bla") - if ok2 || v2 == "daa" { - t.Errorf("annotation not deleted") - } -} -func TestSetPodLabels(t *testing.T) { - w := `{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"annotations":{"deployment.kubernetes.io/revision":"1"},"creationTimestamp":"2021-05-03T13:10:32Z","generation":1,"managedFields":[{"apiVersion":"apps/v1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:app":{},"f:cyberarmor.inject":{}}},"f:spec":{"f:progressDeadlineSeconds":{},"f:replicas":{},"f:revisionHistoryLimit":{},"f:selector":{},"f:strategy":{"f:rollingUpdate":{".":{},"f:maxSurge":{},"f:maxUnavailable":{}},"f:type":{}},"f:template":{"f:metadata":{"f:labels":{".":{},"f:app":{}}},"f:spec":{"f:containers":{"k:{\"name\":\"demoservice\"}":{".":{},"f:env":{".":{},"k:{\"name\":\"ARMO_TEST_NAME\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"CAA_ENABLE_CRASH_REPORTER\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"DEMO_FOLDERS\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"SERVER_PORT\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"SLEEP_DURATION\"}":{".":{},"f:name":{},"f:value":{}}},"f:image":{},"f:imagePullPolicy":{},"f:name":{},"f:ports":{".":{},"k:{\"containerPort\":8089,\"protocol\":\"TCP\"}":{".":{},"f:containerPort":{},"f:protocol":{}}},"f:resources":{},"f:terminationMessagePath":{},"f:terminationMessagePolicy":{}}},"f:dnsPolicy":{},"f:restartPolicy":{},"f:schedulerName":{},"f:securityContext":{},"f:terminationGracePeriodSeconds":{}}}}},"manager":"OpenAPI-Generator","operation":"Update","time":"2021-05-03T13:10:32Z"},{"apiVersion":"apps/v1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:deployment.kubernetes.io/revision":{}}},"f:status":{"f:availableReplicas":{},"f:conditions":{".":{},"k:{\"type\":\"Available\"}":{".":{},"f:lastTransitionTime":{},"f:lastUpdateTime":{},"f:message":{},"f:reason":{},"f:status":{},"f:type":{}},"k:{\"type\":\"Progressing\"}":{".":{},"f:lastTransitionTime":{},"f:lastUpdateTime":{},"f:message":{},"f:reason":{},"f:status":{},"f:type":{}}},"f:observedGeneration":{},"f:readyReplicas":{},"f:replicas":{},"f:updatedReplicas":{}}},"manager":"kube-controller-manager","operation":"Update","time":"2021-05-03T13:52:58Z"}],"name":"demoservice-server","namespace":"default","resourceVersion":"1016043","uid":"e9e8a3e9-6cb4-4301-ace1-2c0cef3bd61e"},"spec":{"progressDeadlineSeconds":600,"replicas":1,"revisionHistoryLimit":10,"selector":{"matchLabels":{"app":"demoservice-server"}},"strategy":{"rollingUpdate":{"maxSurge":"25%","maxUnavailable":"25%"},"type":"RollingUpdate"},"template":{"metadata":{"creationTimestamp":null,"labels":{"app":"demoservice-server"}},"spec":{"containers":[{"env":[{"name":"SERVER_PORT","value":"8089"},{"name":"SLEEP_DURATION","value":"1"},{"name":"DEMO_FOLDERS","value":"/app"},{"name":"ARMO_TEST_NAME","value":"auto_attach_deployment"},{"name":"CAA_ENABLE_CRASH_REPORTER","value":"1"}],"image":"quay.io/armosec/demoservice:v25","imagePullPolicy":"IfNotPresent","name":"demoservice","ports":[{"containerPort":8089,"protocol":"TCP"}],"resources":{},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File"}],"dnsPolicy":"ClusterFirst","restartPolicy":"Always","schedulerName":"default-scheduler","securityContext":{},"terminationGracePeriodSeconds":30}}},"status":{"availableReplicas":1,"conditions":[{"lastTransitionTime":"2021-05-03T13:10:32Z","lastUpdateTime":"2021-05-03T13:10:37Z","message":"ReplicaSet \"demoservice-server-7d478b6998\" has successfully progressed.","reason":"NewReplicaSetAvailable","status":"True","type":"Progressing"},{"lastTransitionTime":"2021-05-03T13:52:58Z","lastUpdateTime":"2021-05-03T13:52:58Z","message":"Deployment has minimum availability.","reason":"MinimumReplicasAvailable","status":"True","type":"Available"}],"observedGeneration":1,"readyReplicas":1,"replicas":1,"updatedReplicas":1}}` - workload, err := NewWorkload([]byte(w)) - if err != nil { - t.Errorf(err.Error()) - } - workload.SetPodLabel("bla", "daa") - v, ok := workload.GetPodLabel("bla") - if !ok || v != "daa" { - t.Errorf("expect to find label") - } - workload.RemovePodLabel("bla") - v2, ok2 := workload.GetPodLabel("bla") - if ok2 || v2 == "daa" { - t.Errorf("label not deleted") - } -} -func TestRemoveArmo(t *testing.T) { - w := `{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"annotations":{"deployment.kubernetes.io/revision":"1"},"creationTimestamp":"2021-05-03T13:10:32Z","generation":1,"managedFields":[{"apiVersion":"apps/v1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:app":{},"f:cyberarmor.inject":{}}},"f:spec":{"f:progressDeadlineSeconds":{},"f:replicas":{},"f:revisionHistoryLimit":{},"f:selector":{},"f:strategy":{"f:rollingUpdate":{".":{},"f:maxSurge":{},"f:maxUnavailable":{}},"f:type":{}},"f:template":{"f:metadata":{"f:labels":{".":{},"f:app":{}}},"f:spec":{"f:containers":{"k:{\"name\":\"demoservice\"}":{".":{},"f:env":{".":{},"k:{\"name\":\"ARMO_TEST_NAME\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"CAA_ENABLE_CRASH_REPORTER\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"DEMO_FOLDERS\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"SERVER_PORT\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"SLEEP_DURATION\"}":{".":{},"f:name":{},"f:value":{}}},"f:image":{},"f:imagePullPolicy":{},"f:name":{},"f:ports":{".":{},"k:{\"containerPort\":8089,\"protocol\":\"TCP\"}":{".":{},"f:containerPort":{},"f:protocol":{}}},"f:resources":{},"f:terminationMessagePath":{},"f:terminationMessagePolicy":{}}},"f:dnsPolicy":{},"f:restartPolicy":{},"f:schedulerName":{},"f:securityContext":{},"f:terminationGracePeriodSeconds":{}}}}},"manager":"OpenAPI-Generator","operation":"Update","time":"2021-05-03T13:10:32Z"},{"apiVersion":"apps/v1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:deployment.kubernetes.io/revision":{}}},"f:status":{"f:availableReplicas":{},"f:conditions":{".":{},"k:{\"type\":\"Available\"}":{".":{},"f:lastTransitionTime":{},"f:lastUpdateTime":{},"f:message":{},"f:reason":{},"f:status":{},"f:type":{}},"k:{\"type\":\"Progressing\"}":{".":{},"f:lastTransitionTime":{},"f:lastUpdateTime":{},"f:message":{},"f:reason":{},"f:status":{},"f:type":{}}},"f:observedGeneration":{},"f:readyReplicas":{},"f:replicas":{},"f:updatedReplicas":{}}},"manager":"kube-controller-manager","operation":"Update","time":"2021-05-03T13:52:58Z"}],"name":"demoservice-server","namespace":"default","resourceVersion":"1016043","uid":"e9e8a3e9-6cb4-4301-ace1-2c0cef3bd61e"},"spec":{"progressDeadlineSeconds":600,"replicas":1,"revisionHistoryLimit":10,"selector":{"matchLabels":{"app":"demoservice-server"}},"strategy":{"rollingUpdate":{"maxSurge":"25%","maxUnavailable":"25%"},"type":"RollingUpdate"},"template":{"metadata":{"creationTimestamp":null,"labels":{"app":"demoservice-server", "armo.attach": "true"}},"spec":{"containers":[{"env":[{"name":"SERVER_PORT","value":"8089"},{"name":"SLEEP_DURATION","value":"1"},{"name":"DEMO_FOLDERS","value":"/app"},{"name":"ARMO_TEST_NAME","value":"auto_attach_deployment"},{"name":"CAA_ENABLE_CRASH_REPORTER","value":"1"}],"image":"quay.io/armosec/demoservice:v25","imagePullPolicy":"IfNotPresent","name":"demoservice","ports":[{"containerPort":8089,"protocol":"TCP"}],"resources":{},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File"}],"dnsPolicy":"ClusterFirst","restartPolicy":"Always","schedulerName":"default-scheduler","securityContext":{},"terminationGracePeriodSeconds":30}}},"status":{"availableReplicas":1,"conditions":[{"lastTransitionTime":"2021-05-03T13:10:32Z","lastUpdateTime":"2021-05-03T13:10:37Z","message":"ReplicaSet \"demoservice-server-7d478b6998\" has successfully progressed.","reason":"NewReplicaSetAvailable","status":"True","type":"Progressing"},{"lastTransitionTime":"2021-05-03T13:52:58Z","lastUpdateTime":"2021-05-03T13:52:58Z","message":"Deployment has minimum availability.","reason":"MinimumReplicasAvailable","status":"True","type":"Available"}],"observedGeneration":1,"readyReplicas":1,"replicas":1,"updatedReplicas":1}}` - workload, err := NewWorkload([]byte(w)) - if err != nil { - t.Errorf(err.Error()) - } - if !workload.IsAttached() { - t.Errorf("expect to be attached") - } - workload.RemoveArmoMetadata() - if workload.IsAttached() { - t.Errorf("expect to be clear") - } - -} - -func TestSetWlid(t *testing.T) { - w := `{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"annotations":{"deployment.kubernetes.io/revision":"1"},"creationTimestamp":"2021-05-03T13:10:32Z","generation":1,"managedFields":[{"apiVersion":"apps/v1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:app":{},"f:cyberarmor.inject":{}}},"f:spec":{"f:progressDeadlineSeconds":{},"f:replicas":{},"f:revisionHistoryLimit":{},"f:selector":{},"f:strategy":{"f:rollingUpdate":{".":{},"f:maxSurge":{},"f:maxUnavailable":{}},"f:type":{}},"f:template":{"f:metadata":{"f:labels":{".":{},"f:app":{}}},"f:spec":{"f:containers":{"k:{\"name\":\"demoservice\"}":{".":{},"f:env":{".":{},"k:{\"name\":\"ARMO_TEST_NAME\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"CAA_ENABLE_CRASH_REPORTER\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"DEMO_FOLDERS\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"SERVER_PORT\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"SLEEP_DURATION\"}":{".":{},"f:name":{},"f:value":{}}},"f:image":{},"f:imagePullPolicy":{},"f:name":{},"f:ports":{".":{},"k:{\"containerPort\":8089,\"protocol\":\"TCP\"}":{".":{},"f:containerPort":{},"f:protocol":{}}},"f:resources":{},"f:terminationMessagePath":{},"f:terminationMessagePolicy":{}}},"f:dnsPolicy":{},"f:restartPolicy":{},"f:schedulerName":{},"f:securityContext":{},"f:terminationGracePeriodSeconds":{}}}}},"manager":"OpenAPI-Generator","operation":"Update","time":"2021-05-03T13:10:32Z"},{"apiVersion":"apps/v1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:deployment.kubernetes.io/revision":{}}},"f:status":{"f:availableReplicas":{},"f:conditions":{".":{},"k:{\"type\":\"Available\"}":{".":{},"f:lastTransitionTime":{},"f:lastUpdateTime":{},"f:message":{},"f:reason":{},"f:status":{},"f:type":{}},"k:{\"type\":\"Progressing\"}":{".":{},"f:lastTransitionTime":{},"f:lastUpdateTime":{},"f:message":{},"f:reason":{},"f:status":{},"f:type":{}}},"f:observedGeneration":{},"f:readyReplicas":{},"f:replicas":{},"f:updatedReplicas":{}}},"manager":"kube-controller-manager","operation":"Update","time":"2021-05-03T13:52:58Z"}],"name":"demoservice-server","namespace":"default","resourceVersion":"1016043","uid":"e9e8a3e9-6cb4-4301-ace1-2c0cef3bd61e"},"spec":{"progressDeadlineSeconds":600,"replicas":1,"revisionHistoryLimit":10,"selector":{"matchLabels":{"app":"demoservice-server"}},"strategy":{"rollingUpdate":{"maxSurge":"25%","maxUnavailable":"25%"},"type":"RollingUpdate"},"template":{"metadata":{"creationTimestamp":null,"labels":{"app":"demoservice-server"}},"spec":{"containers":[{"env":[{"name":"SERVER_PORT","value":"8089"},{"name":"SLEEP_DURATION","value":"1"},{"name":"DEMO_FOLDERS","value":"/app"},{"name":"ARMO_TEST_NAME","value":"auto_attach_deployment"},{"name":"CAA_ENABLE_CRASH_REPORTER","value":"1"}],"image":"quay.io/armosec/demoservice:v25","imagePullPolicy":"IfNotPresent","name":"demoservice","ports":[{"containerPort":8089,"protocol":"TCP"}],"resources":{},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File"}],"dnsPolicy":"ClusterFirst","restartPolicy":"Always","schedulerName":"default-scheduler","securityContext":{},"terminationGracePeriodSeconds":30}}},"status":{"availableReplicas":1,"conditions":[{"lastTransitionTime":"2021-05-03T13:10:32Z","lastUpdateTime":"2021-05-03T13:10:37Z","message":"ReplicaSet \"demoservice-server-7d478b6998\" has successfully progressed.","reason":"NewReplicaSetAvailable","status":"True","type":"Progressing"},{"lastTransitionTime":"2021-05-03T13:52:58Z","lastUpdateTime":"2021-05-03T13:52:58Z","message":"Deployment has minimum availability.","reason":"MinimumReplicasAvailable","status":"True","type":"Available"}],"observedGeneration":1,"readyReplicas":1,"replicas":1,"updatedReplicas":1}}` - workload, err := NewWorkload([]byte(w)) - if err != nil { - t.Errorf(err.Error()) - } - workload.SetWlid("wlid://bla") - // t.Errorf(workload.Json()) - -} - -func TestGetResourceVersion(t *testing.T) { - w := `{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"annotations":{"deployment.kubernetes.io/revision":"1"},"creationTimestamp":"2021-05-03T13:10:32Z","generation":1,"managedFields":[{"apiVersion":"apps/v1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:app":{},"f:cyberarmor.inject":{}}},"f:spec":{"f:progressDeadlineSeconds":{},"f:replicas":{},"f:revisionHistoryLimit":{},"f:selector":{},"f:strategy":{"f:rollingUpdate":{".":{},"f:maxSurge":{},"f:maxUnavailable":{}},"f:type":{}},"f:template":{"f:metadata":{"f:labels":{".":{},"f:app":{}}},"f:spec":{"f:containers":{"k:{\"name\":\"demoservice\"}":{".":{},"f:env":{".":{},"k:{\"name\":\"ARMO_TEST_NAME\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"CAA_ENABLE_CRASH_REPORTER\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"DEMO_FOLDERS\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"SERVER_PORT\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"SLEEP_DURATION\"}":{".":{},"f:name":{},"f:value":{}}},"f:image":{},"f:imagePullPolicy":{},"f:name":{},"f:ports":{".":{},"k:{\"containerPort\":8089,\"protocol\":\"TCP\"}":{".":{},"f:containerPort":{},"f:protocol":{}}},"f:resources":{},"f:terminationMessagePath":{},"f:terminationMessagePolicy":{}}},"f:dnsPolicy":{},"f:restartPolicy":{},"f:schedulerName":{},"f:securityContext":{},"f:terminationGracePeriodSeconds":{}}}}},"manager":"OpenAPI-Generator","operation":"Update","time":"2021-05-03T13:10:32Z"},{"apiVersion":"apps/v1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:deployment.kubernetes.io/revision":{}}},"f:status":{"f:availableReplicas":{},"f:conditions":{".":{},"k:{\"type\":\"Available\"}":{".":{},"f:lastTransitionTime":{},"f:lastUpdateTime":{},"f:message":{},"f:reason":{},"f:status":{},"f:type":{}},"k:{\"type\":\"Progressing\"}":{".":{},"f:lastTransitionTime":{},"f:lastUpdateTime":{},"f:message":{},"f:reason":{},"f:status":{},"f:type":{}}},"f:observedGeneration":{},"f:readyReplicas":{},"f:replicas":{},"f:updatedReplicas":{}}},"manager":"kube-controller-manager","operation":"Update","time":"2021-05-03T13:52:58Z"}],"name":"demoservice-server","namespace":"default","resourceVersion":"1016043","uid":"e9e8a3e9-6cb4-4301-ace1-2c0cef3bd61e"},"spec":{"progressDeadlineSeconds":600,"replicas":1,"revisionHistoryLimit":10,"selector":{"matchLabels":{"app":"demoservice-server"}},"strategy":{"rollingUpdate":{"maxSurge":"25%","maxUnavailable":"25%"},"type":"RollingUpdate"},"template":{"metadata":{"creationTimestamp":null,"labels":{"app":"demoservice-server"}},"spec":{"containers":[{"env":[{"name":"SERVER_PORT","value":"8089"},{"name":"SLEEP_DURATION","value":"1"},{"name":"DEMO_FOLDERS","value":"/app"},{"name":"ARMO_TEST_NAME","value":"auto_attach_deployment"},{"name":"CAA_ENABLE_CRASH_REPORTER","value":"1"}],"image":"quay.io/armosec/demoservice:v25","imagePullPolicy":"IfNotPresent","name":"demoservice","ports":[{"containerPort":8089,"protocol":"TCP"}],"resources":{},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File"}],"dnsPolicy":"ClusterFirst","restartPolicy":"Always","schedulerName":"default-scheduler","securityContext":{},"terminationGracePeriodSeconds":30}}},"status":{"availableReplicas":1,"conditions":[{"lastTransitionTime":"2021-05-03T13:10:32Z","lastUpdateTime":"2021-05-03T13:10:37Z","message":"ReplicaSet \"demoservice-server-7d478b6998\" has successfully progressed.","reason":"NewReplicaSetAvailable","status":"True","type":"Progressing"},{"lastTransitionTime":"2021-05-03T13:52:58Z","lastUpdateTime":"2021-05-03T13:52:58Z","message":"Deployment has minimum availability.","reason":"MinimumReplicasAvailable","status":"True","type":"Available"}],"observedGeneration":1,"readyReplicas":1,"replicas":1,"updatedReplicas":1}}` - workload, err := NewWorkload([]byte(w)) - if err != nil { - t.Errorf(err.Error()) - } - if workload.GetResourceVersion() != "1016043" { - t.Errorf("wrong resourceVersion") - } - -} -func TestGetUID(t *testing.T) { - w := `{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"annotations":{"deployment.kubernetes.io/revision":"1"},"creationTimestamp":"2021-05-03T13:10:32Z","generation":1,"managedFields":[{"apiVersion":"apps/v1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:app":{},"f:cyberarmor.inject":{}}},"f:spec":{"f:progressDeadlineSeconds":{},"f:replicas":{},"f:revisionHistoryLimit":{},"f:selector":{},"f:strategy":{"f:rollingUpdate":{".":{},"f:maxSurge":{},"f:maxUnavailable":{}},"f:type":{}},"f:template":{"f:metadata":{"f:labels":{".":{},"f:app":{}}},"f:spec":{"f:containers":{"k:{\"name\":\"demoservice\"}":{".":{},"f:env":{".":{},"k:{\"name\":\"ARMO_TEST_NAME\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"CAA_ENABLE_CRASH_REPORTER\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"DEMO_FOLDERS\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"SERVER_PORT\"}":{".":{},"f:name":{},"f:value":{}},"k:{\"name\":\"SLEEP_DURATION\"}":{".":{},"f:name":{},"f:value":{}}},"f:image":{},"f:imagePullPolicy":{},"f:name":{},"f:ports":{".":{},"k:{\"containerPort\":8089,\"protocol\":\"TCP\"}":{".":{},"f:containerPort":{},"f:protocol":{}}},"f:resources":{},"f:terminationMessagePath":{},"f:terminationMessagePolicy":{}}},"f:dnsPolicy":{},"f:restartPolicy":{},"f:schedulerName":{},"f:securityContext":{},"f:terminationGracePeriodSeconds":{}}}}},"manager":"OpenAPI-Generator","operation":"Update","time":"2021-05-03T13:10:32Z"},{"apiVersion":"apps/v1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:deployment.kubernetes.io/revision":{}}},"f:status":{"f:availableReplicas":{},"f:conditions":{".":{},"k:{\"type\":\"Available\"}":{".":{},"f:lastTransitionTime":{},"f:lastUpdateTime":{},"f:message":{},"f:reason":{},"f:status":{},"f:type":{}},"k:{\"type\":\"Progressing\"}":{".":{},"f:lastTransitionTime":{},"f:lastUpdateTime":{},"f:message":{},"f:reason":{},"f:status":{},"f:type":{}}},"f:observedGeneration":{},"f:readyReplicas":{},"f:replicas":{},"f:updatedReplicas":{}}},"manager":"kube-controller-manager","operation":"Update","time":"2021-05-03T13:52:58Z"}],"name":"demoservice-server","namespace":"default","resourceVersion":"1016043","uid":"e9e8a3e9-6cb4-4301-ace1-2c0cef3bd61e"},"spec":{"progressDeadlineSeconds":600,"replicas":1,"revisionHistoryLimit":10,"selector":{"matchLabels":{"app":"demoservice-server"}},"strategy":{"rollingUpdate":{"maxSurge":"25%","maxUnavailable":"25%"},"type":"RollingUpdate"},"template":{"metadata":{"creationTimestamp":null,"labels":{"app":"demoservice-server"}},"spec":{"containers":[{"env":[{"name":"SERVER_PORT","value":"8089"},{"name":"SLEEP_DURATION","value":"1"},{"name":"DEMO_FOLDERS","value":"/app"},{"name":"ARMO_TEST_NAME","value":"auto_attach_deployment"},{"name":"CAA_ENABLE_CRASH_REPORTER","value":"1"}],"image":"quay.io/armosec/demoservice:v25","imagePullPolicy":"IfNotPresent","name":"demoservice","ports":[{"containerPort":8089,"protocol":"TCP"}],"resources":{},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File"}],"dnsPolicy":"ClusterFirst","restartPolicy":"Always","schedulerName":"default-scheduler","securityContext":{},"terminationGracePeriodSeconds":30}}},"status":{"availableReplicas":1,"conditions":[{"lastTransitionTime":"2021-05-03T13:10:32Z","lastUpdateTime":"2021-05-03T13:10:37Z","message":"ReplicaSet \"demoservice-server-7d478b6998\" has successfully progressed.","reason":"NewReplicaSetAvailable","status":"True","type":"Progressing"},{"lastTransitionTime":"2021-05-03T13:52:58Z","lastUpdateTime":"2021-05-03T13:52:58Z","message":"Deployment has minimum availability.","reason":"MinimumReplicasAvailable","status":"True","type":"Available"}],"observedGeneration":1,"readyReplicas":1,"replicas":1,"updatedReplicas":1}}` - workload, err := NewWorkload([]byte(w)) - if err != nil { - t.Errorf(err.Error()) - } - if workload.GetUID() != "e9e8a3e9-6cb4-4301-ace1-2c0cef3bd61e" { - t.Errorf("wrong UID") - } - -} - -func TestIsAttached(t *testing.T) { - w := `{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"annotations":{"deployment.kubernetes.io/revision":"3"},"creationTimestamp":"2021-06-21T04:52:05Z","generation":3,"name":"emailservice","namespace":"default"},"spec":{"progressDeadlineSeconds":600,"replicas":1,"revisionHistoryLimit":10,"selector":{"matchLabels":{"app":"emailservice"}},"strategy":{"rollingUpdate":{"maxSurge":"25%","maxUnavailable":"25%"},"type":"RollingUpdate"},"template":{"metadata":{"annotations":{"armo.last-update":"21-06-2021 06:40:42","armo.wlid":"wlid://cluster-david-demo/namespace-default/deployment-emailservice"},"creationTimestamp":null,"labels":{"app":"emailservice","armo.attach":"true"}},"spec":{"containers":[{"env":[{"name":"PORT","value":"8080"},{"name":"DISABLE_PROFILER","value":"1"}],"image":"gcr.io/google-samples/microservices-demo/emailservice:v0.2.3","imagePullPolicy":"IfNotPresent","livenessProbe":{"exec":{"command":["/bin/grpc_health_probe","-addr=:8080"]},"failureThreshold":3,"periodSeconds":5,"successThreshold":1,"timeoutSeconds":1},"name":"server","ports":[{"containerPort":8080,"protocol":"TCP"}],"readinessProbe":{"exec":{"command":["/bin/grpc_health_probe","-addr=:8080"]},"failureThreshold":3,"periodSeconds":5,"successThreshold":1,"timeoutSeconds":1},"resources":{"limits":{"cpu":"200m","memory":"128Mi"},"requests":{"cpu":"100m","memory":"64Mi"}},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File"}],"dnsPolicy":"ClusterFirst","restartPolicy":"Always","schedulerName":"default-scheduler","securityContext":{},"serviceAccount":"default","serviceAccountName":"default","terminationGracePeriodSeconds":5}}}}` - workload, err := NewWorkload([]byte(w)) - if err != nil { - t.Errorf(err.Error()) - } - if !workload.IsAttached() { - t.Errorf("expected attached") - } - -} diff --git a/cautils/k8sinterface/workloadmethodsutils.go b/cautils/k8sinterface/workloadmethodsutils.go deleted file mode 100644 index 51dbf4cb..00000000 --- a/cautils/k8sinterface/workloadmethodsutils.go +++ /dev/null @@ -1,23 +0,0 @@ -package k8sinterface - -func PodSpec(kind string) []string { - switch kind { - case "Pod", "Namespace": - return []string{"spec"} - case "CronJob": - return []string{"spec", "jobTemplate", "spec", "template", "spec"} - default: - return []string{"spec", "template", "spec"} - } -} - -func PodMetadata(kind string) []string { - switch kind { - case "Pod", "Namespace", "Secret": - return []string{"metadata"} - case "CronJob": - return []string{"spec", "jobTemplate", "spec", "template", "metadata"} - default: - return []string{"spec", "template", "metadata"} - } -} diff --git a/cautils/opapolicy/apis.go b/cautils/opapolicy/apis.go deleted file mode 100644 index 758cca1f..00000000 --- a/cautils/opapolicy/apis.go +++ /dev/null @@ -1,7 +0,0 @@ -package opapolicy - -const ( - PostureRestAPIPathV1 = "/v1/posture" - PostureRedisPrefix = "_postureReportv1" - K8sPostureNotification = "/k8srestapi/v1/newPostureReport" -) diff --git a/cautils/opapolicy/datastructures.go b/cautils/opapolicy/datastructures.go deleted file mode 100644 index ee36c234..00000000 --- a/cautils/opapolicy/datastructures.go +++ /dev/null @@ -1,163 +0,0 @@ -package opapolicy - -import ( - "time" - - armotypes "github.com/armosec/kubescape/cautils/armotypes" -) - -type AlertScore float32 -type RuleLanguages string - -const ( - RegoLanguage RuleLanguages = "Rego" - RegoLanguage2 RuleLanguages = "rego" -) - -// RegoResponse the expected response of single run of rego policy -type RuleResponse struct { - AlertMessage string `json:"alertMessage"` - RuleStatus string `json:"ruleStatus"` - PackageName string `json:"packagename"` - AlertScore AlertScore `json:"alertScore"` - AlertObject AlertObject `json:"alertObject"` - Context []string `json:"context,omitempty"` // TODO - Remove - Rulename string `json:"rulename,omitempty"` // TODO - Remove - ExceptionName string `json:"exceptionName,omitempty"` // Not in use - Exception *armotypes.PostureExceptionPolicy `json:"exception,omitempty"` -} - -type AlertObject struct { - K8SApiObjects []map[string]interface{} `json:"k8sApiObjects,omitempty"` - ExternalObjects map[string]interface{} `json:"externalObjects,omitempty"` -} - -type FrameworkReport struct { - Name string `json:"name"` - ControlReports []ControlReport `json:"controlReports"` - Score float32 `json:"score,omitempty"` - ARMOImprovement float32 `json:"ARMOImprovement,omitempty"` - WCSScore float32 `json:"wcsScore,omitempty"` -} -type ControlReport struct { - armotypes.PortalBase `json:",inline"` - Control_ID string `json:"id,omitempty"` // to be Deprecated - ControlID string `json:"controlID"` - Name string `json:"name"` - RuleReports []RuleReport `json:"ruleReports"` - Remediation string `json:"remediation"` - Description string `json:"description"` - Score float32 `json:"score"` - BaseScore float32 `json:"baseScore,omitempty"` - ARMOImprovement float32 `json:"ARMOImprovement,omitempty"` -} -type RuleReport struct { - Name string `json:"name"` - Remediation string `json:"remediation"` - RuleStatus RuleStatus `json:"ruleStatus"` // did we run the rule or not (if there where compile errors, the value will be failed) - RuleResponses []RuleResponse `json:"ruleResponses"` - ListInputResources []map[string]interface{} `json:"-"` - ListInputKinds []string `json:"-"` -} -type RuleStatus struct { - Status string `json:"status"` - Message string `json:"message"` -} - -// PostureReport -type PostureReport struct { - CustomerGUID string `json:"customerGUID"` - ClusterName string `json:"clusterName"` - ReportID string `json:"reportID"` - JobID string `json:"jobID"` - ReportGenerationTime time.Time `json:"generationTime"` - FrameworkReports []FrameworkReport `json:"frameworks"` -} - -// RuleMatchObjects defines which objects this rule applied on -type RuleMatchObjects struct { - APIGroups []string `json:"apiGroups"` // apps - APIVersions []string `json:"apiVersions"` // v1/ v1beta1 / * - Resources []string `json:"resources"` // dep.., pods, -} - -// RuleMatchObjects defines which objects this rule applied on -type RuleDependency struct { - PackageName string `json:"packageName"` // package name -} - -// PolicyRule represents single rule, the fundamental executable block of policy -type PolicyRule struct { - armotypes.PortalBase `json:",inline"` - CreationTime string `json:"creationTime"` - Rule string `json:"rule"` // multiline string! - RuleLanguage RuleLanguages `json:"ruleLanguage"` - Match []RuleMatchObjects `json:"match"` - RuleDependencies []RuleDependency `json:"ruleDependencies"` - Description string `json:"description"` - Remediation string `json:"remediation"` - RuleQuery string `json:"ruleQuery"` // default "armo_builtins" - DEPRECATED -} - -// Control represents a collection of rules which are combined together to single purpose -type Control struct { - armotypes.PortalBase `json:",inline"` - Control_ID string `json:"id,omitempty"` // to be Deprecated - ControlID string `json:"controlID"` - CreationTime string `json:"creationTime"` - Description string `json:"description"` - Remediation string `json:"remediation"` - Rules []PolicyRule `json:"rules"` - // for new list of rules in POST/UPADTE requests - RulesIDs *[]string `json:"rulesIDs,omitempty"` -} - -type UpdatedControl struct { - Control `json:",inline"` - Rules []interface{} `json:"rules"` -} - -// Framework represents a collection of controls which are combined together to expose comprehensive behavior -type Framework struct { - armotypes.PortalBase `json:",inline"` - CreationTime string `json:"creationTime"` - Description string `json:"description"` - Controls []Control `json:"controls"` - // for new list of controls in POST/UPADTE requests - ControlsIDs *[]string `json:"controlsIDs,omitempty"` -} - -type UpdatedFramework struct { - Framework `json:",inline"` - Controls []interface{} `json:"controls"` -} - -type NotificationPolicyType string -type NotificationPolicyKind string - -// Supported NotificationTypes -const ( - TypeValidateRules NotificationPolicyType = "validateRules" - TypeExecPostureScan NotificationPolicyType = "execPostureScan" - TypeUpdateRules NotificationPolicyType = "updateRules" -) - -// Supported NotificationKinds -const ( - KindFramework NotificationPolicyKind = "Framework" - KindControl NotificationPolicyKind = "Control" - KindRule NotificationPolicyKind = "Rule" -) - -type PolicyNotification struct { - NotificationType NotificationPolicyType `json:"notificationType"` - Rules []PolicyIdentifier `json:"rules"` - ReportID string `json:"reportID"` - JobID string `json:"jobID"` - Designators armotypes.PortalDesignator `json:"designators"` -} - -type PolicyIdentifier struct { - Kind NotificationPolicyKind `json:"kind"` - Name string `json:"name"` -} diff --git a/cautils/opapolicy/datastructures_mock.go b/cautils/opapolicy/datastructures_mock.go deleted file mode 100644 index db0caeb0..00000000 --- a/cautils/opapolicy/datastructures_mock.go +++ /dev/null @@ -1,301 +0,0 @@ -package opapolicy - -import ( - "time" - - armotypes "github.com/armosec/kubescape/cautils/armotypes" -) - -// Mock A -var ( - AMockCustomerGUID = "5d817063-096f-4d91-b39b-8665240080af" - AMockJobID = "36b6f9e1-3b63-4628-994d-cbe16f81e9c7" - AMockReportID = "2c31e4da-c6fe-440d-9b8a-785b80c8576a" - AMockClusterName = "clusterA" - AMockFrameworkName = "testFrameworkA" - AMockControlName = "testControlA" - AMockRuleName = "testRuleA" - AMockPortalBase = *armotypes.MockPortalBase(AMockCustomerGUID, "", nil) -) - -func MockRuleResponseA() *RuleResponse { - return &RuleResponse{ - AlertMessage: "test alert message A", - AlertScore: 0, - Rulename: AMockRuleName, - PackageName: "test.package.name.A", - Context: []string{}, - } -} - -func MockFrameworkReportA() *FrameworkReport { - return &FrameworkReport{ - Name: AMockFrameworkName, - ControlReports: []ControlReport{ - { - ControlID: "C-0010", - Name: AMockControlName, - RuleReports: []RuleReport{ - { - Name: AMockRuleName, - Remediation: "remove privilegedContainer: True flag from your pod spec", - RuleResponses: []RuleResponse{ - *MockRuleResponseA(), - }, - }, - }, - }, - }, - } -} - -func MockPostureReportA() *PostureReport { - return &PostureReport{ - CustomerGUID: AMockCustomerGUID, - ClusterName: AMockClusterName, - ReportID: AMockReportID, - JobID: AMockJobID, - ReportGenerationTime: time.Now().UTC(), - FrameworkReports: []FrameworkReport{*MockFrameworkReportA()}, - } -} - -func MockFrameworkA() *Framework { - return &Framework{ - PortalBase: *armotypes.MockPortalBase("aaaaaaaa-096f-4d91-b39b-8665240080af", AMockFrameworkName, nil), - CreationTime: "", - Description: "mock framework descryption", - Controls: []Control{ - { - PortalBase: *armotypes.MockPortalBase("aaaaaaaa-aaaa-4d91-b39b-8665240080af", AMockControlName, nil), - Rules: []PolicyRule{ - *MockRuleA(), - }, - }, - }, - } -} - -func MockRuleUntrustedRegistries() *PolicyRule { - return &PolicyRule{ - PortalBase: *armotypes.MockPortalBase("aaaaaaaa-aaaa-aaaa-b39b-8665240080af", AMockControlName, nil), - Rule: ` -package armo_builtins -# Check for images from blacklisted repos - -untrusted_registries(z) = x { - x := ["015253967648.dkr.ecr.eu-central-1.amazonaws.com/"] -} - -public_registries(z) = y{ - y := ["quay.io/kiali/","quay.io/datawire/","quay.io/keycloak/","quay.io/bitnami/"] -} - -untrustedImageRepo[msga] { - pod := input[_] - k := pod.kind - k == "Pod" - container := pod.spec.containers[_] - image := container.image - repo_prefix := untrusted_registries(image)[_] - startswith(image, repo_prefix) - selfLink := pod.metadata.selfLink - containerName := container.name - - msga := { - "alertMessage": sprintf("image '%v' in container '%s' in [%s] comes from untrusted registry", [image, containerName, selfLink]), - "alert": true, - "prevent": false, - "alertScore": 2, - "alertObject": [{"pod":pod}] - } -} - -untrustedImageRepo[msga] { - pod := input[_] - k := pod.kind - k == "Pod" - container := pod.spec.containers[_] - image := container.image - repo_prefix := public_registries(image)[_] - startswith(pod, repo_prefix) - selfLink := input.metadata.selfLink - containerName := container.name - - msga := { - "alertMessage": sprintf("image '%v' in container '%s' in [%s] comes from public registry", [image, containerName, selfLink]), - "alert": true, - "prevent": false, - "alertScore": 1, - "alertObject": [{"pod":pod}] - } -} - `, - RuleLanguage: RegoLanguage, - Match: []RuleMatchObjects{ - { - APIVersions: []string{"v1"}, - APIGroups: []string{"*"}, - Resources: []string{"pods"}, - }, - }, - RuleDependencies: []RuleDependency{ - { - PackageName: "kubernetes.api.client", - }, - }, - } -} - -func MockRuleA() *PolicyRule { - return &PolicyRule{ - PortalBase: *armotypes.MockPortalBase("aaaaaaaa-aaaa-aaaa-b39b-8665240080af", AMockControlName, nil), - Rule: MockRegoPrivilegedPods(), // - RuleLanguage: RegoLanguage, - Match: []RuleMatchObjects{ - { - APIVersions: []string{"v1"}, - APIGroups: []string{"*"}, - Resources: []string{"pods"}, - }, - }, - RuleDependencies: []RuleDependency{ - { - PackageName: "kubernetes.api.client", - }, - }, - } -} - -func MockRuleB() *PolicyRule { - return &PolicyRule{ - PortalBase: *armotypes.MockPortalBase("bbbbbbbb-aaaa-aaaa-b39b-8665240080af", AMockControlName, nil), - Rule: MockExternalFacingService(), // - RuleLanguage: RegoLanguage, - Match: []RuleMatchObjects{ - { - APIVersions: []string{"v1"}, - APIGroups: []string{""}, - Resources: []string{"pods"}, - }, - }, - RuleDependencies: []RuleDependency{ - { - PackageName: "kubernetes.api.client", - }, - }, - } -} - -func MockPolicyNotificationA() *PolicyNotification { - return &PolicyNotification{ - NotificationType: TypeExecPostureScan, - ReportID: AMockReportID, - JobID: AMockJobID, - Designators: armotypes.PortalDesignator{}, - Rules: []PolicyIdentifier{ - { - Kind: KindFramework, - Name: AMockFrameworkName, - }}, - } -} - -func MockTemp() string { - return ` - package armo_builtins - import data.kubernetes.api.client as client - deny[msga] { - #object := input[_] - object := client.query_all("pods") - obj := object.body.items[_] - msga := { - "packagename": "armo_builtins", - "alertMessage": "found object", - "alertScore": 3, - "alertObject": {"object": obj}, - } - } - ` -} - -func MockRegoPrivilegedPods() string { - return `package armo_builtins - - import data.kubernetes.api.client as client - - # Deny mutating action unless user is in group owning the resource - - #privileged pods - deny[msga] { - - pod := input[_] - containers := pod.spec.containers[_] - containers.securityContext.privileged == true - msga := { - "packagename": "armo_builtins", - "alertMessage": sprintf("the following pods are defined as privileged: %v", [pod]), - "alertScore": 3, - "alertObject": pod, - } - } - - #handles majority of workload resources - deny[msga] { - wl := input[_] - spec_template_spec_patterns := {"Deployment","ReplicaSet","DaemonSet","StatefulSet","Job"} - spec_template_spec_patterns[wl.kind] - containers := wl.spec.template.spec.containers[_] - containers.securityContext.privileged == true - msga := { - "packagename": "armo_builtins", - "alertMessage": sprintf("the following workloads are defined as privileged: %v", [wl]), - "alertScore": 3, - "alertObject": wl, - } - } - - #handles cronjob - deny[msga] { - wl := input[_] - wl.kind == "CronJob" - containers := wl.spec.jobTemplate.spec.template.spec.containers[_] - containers.securityContext.privileged == true - msga := { - "packagename": "armo_builtins", - "alertMessage": sprintf("the following cronjobs are defined as privileged: %v", [wl]), - "alertScore": 3, - "alertObject": wl, - } - } - ` -} - -func MockExternalFacingService() string { - return "\n\tpackage armo_builtins\n\n\timport data.kubernetes.api.client as client\n\timport data.cautils as cautils\n\ndeny[msga] {\n\n\twl := input[_]\n\tcluster_resource := client.query_all(\n\t\t\"services\"\n\t)\n\n\tlabels := wl.metadata.labels\n\tfiltered_labels := json.remove(labels, [\"pod-template-hash\"])\n \n#service := cluster_resource.body.items[i]\nservices := [svc | cluster_resource.body.items[i].metadata.namespace == wl.metadata.namespace; svc := cluster_resource.body.items[i]]\nservice := services[_]\nnp_or_lb := {\"NodePort\", \"LoadBalancer\"}\nnp_or_lb[service.spec.type]\ncautils.is_subobject(service.spec.selector,filtered_labels)\n\n msga := {\n\t\t\"alertMessage\": sprintf(\"%v pod %v expose external facing service: %v\",[wl.metadata.namespace, wl.metadata.name, service.metadata.name]),\n\t\t\"alertScore\": 2,\n\t\t\"packagename\": \"armo_builtins\",\n\t\t\"alertObject\": {\"srvc\":service}\n\t}\n}\n\t" -} -func GetRuntimePods() string { - return ` - package armo_builtins - - import data.kubernetes.api.client as client - - -deny[msga] { - - - cluster_resource := client.query_all( - "pods" - ) - - pod := cluster_resource.body.items[i] - msga := { - "alertMessage": "got something", - "alertScore": 2, - "packagename": "armo_builtins", - "alertObject": {"pod": pod} - } -} - - ` -} diff --git a/cautils/opapolicy/datastructures_test.go b/cautils/opapolicy/datastructures_test.go deleted file mode 100644 index 4ee1709b..00000000 --- a/cautils/opapolicy/datastructures_test.go +++ /dev/null @@ -1,42 +0,0 @@ -package opapolicy - -import ( - "encoding/json" - "testing" -) - -func TestMockPolicyNotificationA(t *testing.T) { - policy := MockPolicyNotificationA() - bp, err := json.Marshal(policy) - if err != nil { - t.Error(err) - } else { - t.Logf("%s\n", string(bp)) - // t.Errorf("%s\n", string(bp)) - } - -} - -func TestMockFrameworkA(t *testing.T) { - policy := MockFrameworkA() - bp, err := json.Marshal(policy) - if err != nil { - t.Error(err) - } else { - t.Logf("%s\n", string(bp)) - // t.Errorf("%s\n", string(bp)) - } - -} - -func TestMockPostureReportA(t *testing.T) { - policy := MockPostureReportA() - bp, err := json.Marshal(policy) - if err != nil { - t.Error(err) - } else { - // t.Errorf("%s\n", string(bp)) - t.Logf("%s\n", string(bp)) - } - -} diff --git a/cautils/opapolicy/datastructuresmethods.go b/cautils/opapolicy/datastructuresmethods.go deleted file mode 100644 index 56835967..00000000 --- a/cautils/opapolicy/datastructuresmethods.go +++ /dev/null @@ -1,236 +0,0 @@ -package opapolicy - -import ( - "bytes" - "encoding/json" - - "github.com/armosec/kubescape/cautils/k8sinterface" -) - -func (pn *PolicyNotification) ToJSONBytesBuffer() (*bytes.Buffer, error) { - res, err := json.Marshal(pn) - if err != nil { - return nil, err - } - return bytes.NewBuffer(res), err -} - -func (RuleResponse *RuleResponse) GetSingleResultStatus() string { - if RuleResponse.Exception != nil { - if RuleResponse.Exception.IsAlertOnly() { - return "warning" - } - if RuleResponse.Exception.IsDisable() { - return "ignore" - } - } - return "failed" - -} - -func (ruleReport *RuleReport) GetRuleStatus() (string, []RuleResponse, []RuleResponse) { - if len(ruleReport.RuleResponses) == 0 { - return "success", nil, nil - } - exceptions := make([]RuleResponse, 0) - failed := make([]RuleResponse, 0) - - for _, rule := range ruleReport.RuleResponses { - if rule.ExceptionName != "" { - exceptions = append(exceptions, rule) - } else if rule.Exception != nil { - exceptions = append(exceptions, rule) - } else { - failed = append(failed, rule) - } - } - - status := "failed" - if len(failed) == 0 && len(exceptions) > 0 { - status = "warning" - } - return status, failed, exceptions -} - -func (controlReport *ControlReport) GetNumberOfResources() int { - sum := 0 - for i := range controlReport.RuleReports { - sum += controlReport.RuleReports[i].GetNumberOfResources() - } - return sum -} - -func (controlReport *ControlReport) GetNumberOfFailedResources() int { - sum := 0 - for i := range controlReport.RuleReports { - sum += controlReport.RuleReports[i].GetNumberOfFailedResources() - } - return sum -} - -func (controlReport *ControlReport) GetNumberOfWarningResources() int { - sum := 0 - for i := range controlReport.RuleReports { - sum += controlReport.RuleReports[i].GetNumberOfWarningResources() - } - return sum -} -func (controlReport *ControlReport) ListControlsInputKinds() []string { - listControlsInputKinds := []string{} - for i := range controlReport.RuleReports { - listControlsInputKinds = append(listControlsInputKinds, controlReport.RuleReports[i].ListInputKinds...) - } - return listControlsInputKinds -} - -func (controlReport *ControlReport) Passed() bool { - for i := range controlReport.RuleReports { - if len(controlReport.RuleReports[i].RuleResponses) != 0 { - return false - } - } - return true -} - -func (controlReport *ControlReport) Warning() bool { - if controlReport.Passed() || controlReport.Failed() { - return false - } - for i := range controlReport.RuleReports { - if status, _, _ := controlReport.RuleReports[i].GetRuleStatus(); status == "warning" { - return true - } - } - return false -} - -func (controlReport *ControlReport) Failed() bool { - if controlReport.Passed() { - return false - } - for i := range controlReport.RuleReports { - if status, _, _ := controlReport.RuleReports[i].GetRuleStatus(); status == "failed" { - return true - } - } - return false -} - -func (ruleReport *RuleReport) GetNumberOfResources() int { - return len(ruleReport.ListInputResources) -} - -func (ruleReport *RuleReport) GetNumberOfFailedResources() int { - sum := 0 - for i := len(ruleReport.RuleResponses) - 1; i >= 0; i-- { - if ruleReport.RuleResponses[i].GetSingleResultStatus() == "failed" { - //if !ruleReport.DeleteIfRedundantResponse(&ruleReport.RuleResponses[i], i) { - sum += len(ruleReport.RuleResponses[i].AlertObject.K8SApiObjects) - //} - } - } - return sum -} - -func (ruleReport *RuleReport) DeleteIfRedundantResponse(RuleResponse *RuleResponse, index int) bool { - if b, rr := ruleReport.IsDuplicateResponseOfResource(RuleResponse, index); b { - rr.AddMessageToResponse(RuleResponse.AlertMessage) - ruleReport.RuleResponses = removeResponse(ruleReport.RuleResponses, index) - return true - } - return false -} - -func (ruleResponse *RuleResponse) AddMessageToResponse(message string) { - ruleResponse.AlertMessage += message -} - -func (ruleReport *RuleReport) IsDuplicateResponseOfResource(RuleResponse *RuleResponse, index int) (bool, *RuleResponse) { - for i := range ruleReport.RuleResponses { - if i != index { - for j := range ruleReport.RuleResponses[i].AlertObject.K8SApiObjects { - for k := range RuleResponse.AlertObject.K8SApiObjects { - w1 := k8sinterface.NewWorkloadObj(ruleReport.RuleResponses[i].AlertObject.K8SApiObjects[j]) - w2 := k8sinterface.NewWorkloadObj(RuleResponse.AlertObject.K8SApiObjects[k]) - if w1.GetName() == w2.GetName() && w1.GetNamespace() == w2.GetNamespace() && w1.GetKind() != "Role" && w1.GetKind() != "ClusterRole" { - return true, &ruleReport.RuleResponses[i] - } - } - } - } - } - return false, nil -} - -func removeResponse(slice []RuleResponse, index int) []RuleResponse { - return append(slice[:index], slice[index+1:]...) -} - -func (ruleReport *RuleReport) GetNumberOfWarningResources() int { - sum := 0 - for i := range ruleReport.RuleResponses { - if ruleReport.RuleResponses[i].GetSingleResultStatus() == "warning" { - sum += 1 - } - } - return sum -} - -func (postureReport *PostureReport) RemoveData() { - for i := range postureReport.FrameworkReports { - postureReport.FrameworkReports[i].RemoveData() - } -} -func (frameworkReport *FrameworkReport) RemoveData() { - for i := range frameworkReport.ControlReports { - frameworkReport.ControlReports[i].RemoveData() - } -} -func (controlReport *ControlReport) RemoveData() { - for i := range controlReport.RuleReports { - controlReport.RuleReports[i].RemoveData() - } -} - -func (ruleReport *RuleReport) RemoveData() { - for i := range ruleReport.RuleResponses { - ruleReport.RuleResponses[i].RemoveData() - } -} - -func (r *RuleResponse) RemoveData() { - r.AlertObject.ExternalObjects = nil - - keepFields := []string{"kind", "apiVersion", "metadata"} - keepMetadataFields := []string{"name", "namespace", "labels"} - - for i := range r.AlertObject.K8SApiObjects { - deleteFromMap(r.AlertObject.K8SApiObjects[i], keepFields) - for k := range r.AlertObject.K8SApiObjects[i] { - if k == "metadata" { - if b, ok := r.AlertObject.K8SApiObjects[i][k].(map[string]interface{}); ok { - deleteFromMap(b, keepMetadataFields) - r.AlertObject.K8SApiObjects[i][k] = b - } - } - } - } -} - -func deleteFromMap(m map[string]interface{}, keepFields []string) { - for k := range m { - if StringInSlice(keepFields, k) { - continue - } - delete(m, k) - } -} - -func StringInSlice(strSlice []string, str string) bool { - for i := range strSlice { - if strSlice[i] == str { - return true - } - } - return false -} diff --git a/cautils/opapolicy/gojayunmarshaller.go b/cautils/opapolicy/gojayunmarshaller.go deleted file mode 100644 index c232a855..00000000 --- a/cautils/opapolicy/gojayunmarshaller.go +++ /dev/null @@ -1,47 +0,0 @@ -package opapolicy - -import ( - "github.com/francoispqt/gojay" - "time" -) - -/* - responsible on fast unmarshaling of various COMMON containerscan structures and substructures - -*/ -// UnmarshalJSONObject - File inside a pkg -func (r *PostureReport) UnmarshalJSONObject(dec *gojay.Decoder, key string) (err error) { - - switch key { - case "customerGUID": - err = dec.String(&(r.CustomerGUID)) - - case "clusterName": - err = dec.String(&(r.ClusterName)) - - case "reportID": - err = dec.String(&(r.ReportID)) - case "jobID": - err = dec.String(&(r.JobID)) - case "generationTime": - err = dec.Time(&(r.ReportGenerationTime), time.RFC3339) - r.ReportGenerationTime = r.ReportGenerationTime.Local() - } - return err - -} - -// func (files *PkgFiles) UnmarshalJSONArray(dec *gojay.Decoder) error { -// lae := PackageFile{} -// if err := dec.Object(&lae); err != nil { -// return err -// } - -// *files = append(*files, lae) -// return nil -// } - -func (file *PostureReport) NKeys() int { - return 0 -} -//------------------------ diff --git a/cautils/opapolicy/resources/dependencies.go b/cautils/opapolicy/resources/dependencies.go deleted file mode 100644 index f8b0de1d..00000000 --- a/cautils/opapolicy/resources/dependencies.go +++ /dev/null @@ -1,219 +0,0 @@ -package resources - -var RegoCAUtils = ` -package cautils - -list_contains(lista,element) { - some i - lista[i] == element -} - -# getPodName(metadata) = name { -# name := metadata.generateName -#} -getPodName(metadata) = name { - name := metadata.name -} - -#returns subobject ,sub1 is partial to parent, e.g parent = {a:a,b:b,c:c,d:d} -# sub1 = {b:b,c:c} - result is {b:b,c:c}, if sub1={b:b,e:f} returns {b:b} -object_intersection(parent,sub1) = r{ - - r := {k:p | p := sub1[k] - parent[k]== p - } -} - -#returns if parent contains sub(both are objects not sets!!) -is_subobject(sub,parent) { -object_intersection(sub,parent) == sub -} -` - -var RegoDesignators = ` -package designators - -import data.cautils -#functions that related to designators - -#allowed_namespace -#@input@: receive as part of the input object "included_namespaces" list -#@input@: item's namespace as "namespace" -#returns true if namespace exists in that list -included_namespaces(namespace){ - cautils.list_contains(["default"],namespace) -} - -#forbidden_namespaces -#@input@: receive as part of the input object "forbidden_namespaces" list -#@input@: item's namespace as "namespace" -#returns true if namespace exists in that list -excluded_namespaces(namespace){ - not cautils.list_contains(["excluded"],namespace) -} - -forbidden_wlids(wlid){ - input.forbidden_wlids[_] == wlid -} - -filter_k8s_object(obj) = filtered { - #put - filtered := obj - #filtered := [ x | cautils.list_contains(["default"],obj[i].metadata.namespace) ; x := obj[i] ] - # filtered := [ x | not cautils.list_contains([],filter1Set[i].metadata.namespace); x := filter1Set[i]] - -} -` -var RegoKubernetesApiClient = ` -package kubernetes.api.client - -# service account token -token := data.k8sconfig.token - -# Cluster host -host := data.k8sconfig.host - -# default certificate path -# crt_file := "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt" -crt_file := data.k8sconfig.crtfile - -client_crt_file := data.k8sconfig.clientcrtfile -client_key_file := data.k8sconfig.clientkeyfile - - -# This information could be retrieved from the kubernetes API -# too, but would essentially require a request per API group, -# so for now use a lookup table for the most common resources. -resource_group_mapping := { - "services": "api/v1", - "pods": "api/v1", - "configmaps": "api/v1", - "secrets": "api/v1", - "persistentvolumeclaims": "api/v1", - "daemonsets": "apis/apps/v1", - "deployments": "apis/apps/v1", - "statefulsets": "apis/apps/v1", - "horizontalpodautoscalers": "api/autoscaling/v1", - "jobs": "apis/batch/v1", - "cronjobs": "apis/batch/v1beta1", - "ingresses": "api/extensions/v1beta1", - "replicasets": "apis/apps/v1", - "networkpolicies": "apis/networking.k8s.io/v1", - "clusterroles": "apis/rbac.authorization.k8s.io/v1", - "clusterrolebindings": "apis/rbac.authorization.k8s.io/v1", - "roles": "apis/rbac.authorization.k8s.io/v1", - "rolebindings": "apis/rbac.authorization.k8s.io/v1", - "serviceaccounts": "api/v1" -} - -# Query for given resource/name in provided namespace -# Example: query_ns("deployments", "my-app", "default") -query_name_ns(resource, name, namespace) = http.send({ - "url": sprintf("%v/%v/namespaces/%v/%v/%v", [ - host, - resource_group_mapping[resource], - namespace, - resource, - name, - ]), - "method": "get", - "headers": {"authorization": token}, - "tls_client_cert_file": client_crt_file, - "tls_client_key_file": client_key_file, - "tls_ca_cert_file": crt_file, - "raise_error": true, -}) - -# Query for given resource type using label selectors -# https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api -# Example: query_label_selector_ns("deployments", {"app": "opa-kubernetes-api-client"}, "default") -query_label_selector_ns(resource, selector, namespace) = http.send({ - "url": sprintf("%v/%v/namespaces/%v/%v?labelSelector=%v", [ - host, - resource_group_mapping[resource], - namespace, - resource, - label_map_to_query_string(selector), - ]), - "method": "get", - "headers": {"authorization": token}, - "tls_client_cert_file": client_crt_file, - "tls_client_key_file": client_key_file, - "tls_ca_cert_file": crt_file, - "raise_error": true, -}) - -# x := field_transform_to_qry_param("spec.selector",input) -# input = {"app": "acmefit", "service": "catalog-db"} -# result: "spec.selector.app%3Dacmefit,spec.selector.service%3Dcatalog-db" - - -query_field_selector_ns(resource, field, selector, namespace) = http.send({ - "url": sprintf("%v/%v/namespaces/%v/%v?fieldSelector=%v", [ - host, - resource_group_mapping[resource], - namespace, - resource, - field_transform_to_qry_param(field,selector), - ]), - "method": "get", - "headers": {"authorization": token}, - "tls_client_cert_file": client_crt_file, - "tls_client_key_file": client_key_file, - "tls_ca_cert_file": crt_file, - "raise_error": true, - -}) - -# # Query for all resources of type resource in all namespaces -# # Example: query_all("deployments") -# query_all(resource) = http.send({ -# "url": sprintf("https://%v:%v/%v/%v", [ -# ip, -# port, -# resource_group_mapping[resource], -# resource, -# ]), -# "method": "get", -# "headers": {"authorization": sprintf("Bearer %v", [token])}, -# "tls_client_cert_file": crt_file, -# "raise_error": true, -# }) - -# Query for all resources of type resource in all namespaces -# Example: query_all("deployments") -query_all(resource) = http.send({ - "url": sprintf("%v/%v/%v", [ - host, - resource_group_mapping[resource], - resource, - ]), - "method": "get", - "headers": {"authorization": token}, - "tls_client_cert_file": client_crt_file, - "tls_client_key_file": client_key_file, - "tls_ca_cert_file": crt_file, - "raise_error": true, -}) - - - -# Query for all resources of type resource in all namespaces - without authentication -# Example: query_all("deployments") -query_all_no_auth(resource) = http.send({ - "url": sprintf("%v/%v/namespaces/default/%v", [ - host, - resource_group_mapping[resource], - resource, - ]), - "method": "get", - "raise_error": true, - "tls_insecure_skip_verify" : true, -}) - -field_transform_to_qry_param(field,map) = finala { - mid := {concat(".",[field,key]): val | val := map[key]} - finala := label_map_to_query_string(mid) -} -label_map_to_query_string(map) = concat(",", [str | val := map[key]; str := concat("%3D", [key, val])]) -` diff --git a/cautils/opapolicy/resources/rego/modules/cronJob.reg b/cautils/opapolicy/resources/rego/modules/cronJob.reg deleted file mode 100755 index 32e98600..00000000 --- a/cautils/opapolicy/resources/rego/modules/cronJob.reg +++ /dev/null @@ -1,20 +0,0 @@ -package armo_builtins - -# import data.kubernetes.api.client as client -import data.cautils as cautils - - -# alert cronjobs - -#handles cronjob -deny[msga] { - - wl := input[_] - wl.kind == "CronJob" - msga := { - "alertMessage": sprintf("the following cronjobs are defined: %v", [wl]), - "alertScore": 2, - "packagename": "armo_builtins", - "alertObject": wl - } -} diff --git a/cautils/opapolicy/resources/rego/modules/externalfacing.reg b/cautils/opapolicy/resources/rego/modules/externalfacing.reg deleted file mode 100755 index 4ad647cb..00000000 --- a/cautils/opapolicy/resources/rego/modules/externalfacing.reg +++ /dev/null @@ -1,44 +0,0 @@ -package armo_builtins - -import data.kubernetes.api.client as client - - -# input: pod -# apiversion: v1 -# does: -# returns the external facing services of that pod -# -# -deny[msga] { - pod := input[_] - podns := pod.metadata.namespace - podname := getName(pod.metadata) - # pod := client.query_name_ns("pods","frontend-86c5ffb485-kfp9d", "default") - labels := pod.body.metadata.labels - filtered_labels := json.remove(labels, ["pod-template-hash"]) - - cluster_resource := client.query_all( - "services" - ) - - - services := [svc | cluster_resource.body.items[i].metadata.namespace == podns; svc := cluster_resource.body.items[i]] - service := services[_] - np_or_lb := {"NodePort", "LoadBalancer"} - np_or_lb[service.spec.type] - service.spec.selector == filtered_labels - - msga := { - "packagename": "armo_builtins", - "alertMessage": sprintf("pod %v/%v exposed services: %v\n", [podns,podname,service]), - "alertScore": 7, - "alertObject": {"service":service,"labels":filtered_labels, "podname":podname,"namespace":podns} - } -} - -getName(metadata) = name { - name := metadata.generateName -} -getName(metadata) = name { - name := metadata.name -} \ No newline at end of file diff --git a/cautils/opapolicy/resources/rego/modules/hostpath.reg b/cautils/opapolicy/resources/rego/modules/hostpath.reg deleted file mode 100755 index e312436e..00000000 --- a/cautils/opapolicy/resources/rego/modules/hostpath.reg +++ /dev/null @@ -1,57 +0,0 @@ -package armo_builtins -#import data.kubernetes.api.client as client -import data.cautils as cautils - -# input: pod -# apiversion: v1 -# does: -# returns hostPath volumes -# -# -deny[msga] { - pod := input[_] - pod.kind == "Pod" - volumes := pod.spec.volumes - volume := volumes[_] - # crsrcs.body.spec.containers[_].volumeMounts[_].name = volume.name - volume.hostPath - podname := cautils.getPodName(pod.metadata) - obj := {"volume":volume,"podname": podname} - - msga := { - "packagename": "armo_builtins", - "alertMessage": sprintf("pod: %v has {%v,%v} ashostPath volume \n\n\n", [podname, volume]), - "alertScore": 7, - "alertObject": [obj] - } -} - -isRWMount(mount) { - not mount.readOnly -} -isRWMount(mount) { - mount.readOnly == false -} - - -#handles majority of workload resources -deny[msga] { - - wl := input[_] - spec_template_spec_patterns := {"Deployment","ReplicaSet","DaemonSet","StatefulSet","Job"} - spec_template_spec_patterns[wl.kind] - volumes := wl.spec.template.spec.volumes - volume := volumes[_] - volume.hostPath - wlname := cautils.getPodName(wl.metadata) - obj := {"volume":volume,"podname": wlname} - - msga := { - "packagename": "armo_builtins", - "alertMessage": sprintf("%v: %v has {%v,%v} as hostPath volume\n\n\n", [wl.kind,wlname, volume]), - "alertScore": 7, - "alertObject": [obj] - } -} - - diff --git a/cautils/opapolicy/resources/rego/modules/privileged.reg b/cautils/opapolicy/resources/rego/modules/privileged.reg deleted file mode 100755 index 85111179..00000000 --- a/cautils/opapolicy/resources/rego/modules/privileged.reg +++ /dev/null @@ -1,56 +0,0 @@ -package armo_builtins - -#import data.kubernetes.api.client as client - - -# Deny mutating action unless user is in group owning the resource - - -#privileged pods -deny[msga] { - - - pod := input[_] - containers := pod.spec.containers[_] - containers.securityContext.privileged == true - msga := { - "packagename": "armo_builtins", - "alertMessage": sprintf("the following pods are defined as privileged: %v", [pod]), - "alertScore": 3, - "alertObject": pod, - } -} - - -#handles majority of workload resources -deny[msga] { - - wl := input[_] - spec_template_spec_patterns := {"Deployment","ReplicaSet","DaemonSet","StatefulSet","Job"} - spec_template_spec_patterns[wl.kind] - containers := wl.spec.template.spec.containers[_] - containers.securityContext.privileged == true - msga := { - "packagename": "armo_builtins", - "alertMessage": sprintf("the following workloads are defined as privileged: %v", [wl]), - "alertScore": 3, - "alertObject": wl, - } -} - - - -#handles cronjob -deny[msga] { - - wl := input[_] - wl.kind == "CronJob" - containers := wl.spec.jobTemplate.spec.template.spec.containers[_] - containers.securityContext.privileged == true - msga := { - "packagename": "armo_builtins", - "alertMessage": sprintf("the following cronjobs are defined as privileged: %v", [wl]), - "alertScore": 3, - "alertObject": wl, - } -} diff --git a/cautils/opapolicy/resources/rego/modules/rbacsecrets.reg b/cautils/opapolicy/resources/rego/modules/rbacsecrets.reg deleted file mode 100755 index 049d57f3..00000000 --- a/cautils/opapolicy/resources/rego/modules/rbacsecrets.reg +++ /dev/null @@ -1,98 +0,0 @@ -package armo_builtins -import data.kubernetes.api.client as client -import data.cautils as cautils - - -# input: None -# apiversion: v1 -# does: -# returns roles+ related subjects in rolebinding - - -deny[msga] { - # rsrc := client.query_all("roles") - # role := rsrc.body.items[_] - role := input[_] - role.kind == "Role" - rule := role.rules[_] - cautils.list_contains(rule.resources,"secrets") - canViewSecrets(rule) - rbsrc := client.query_all("rolebindings") - rolebinding := rbsrc.body.items[_] - rolebinding.roleRef.kind == "Role" - rolebinding.roleRef.name == role.metadata.name - - - msga := { - "alertMessage": sprintf("the following users: %v , got read secret access roles", [rolebinding.subjects]), - "alertScore": 9, - "packagename": "armo_builtins", - "alertObject": {"role":role,"users":rolebinding.subjects} - } -} - - - -# input: None -# apiversion: v1 -# does: -# returns clusterroles+ related subjects in rolebinding - - -deny[msga] { - # rsrc := client.query_all("clusterroles") - # role := rsrc.body.items[_] - role := input[_] - role.kind == "ClusterRole" - rule := role.rules[_] - cautils.list_contains(rule.resources,"secrets") - canViewSecrets(rule) - rbsrc := client.query_all("rolebindings") - rolebinding := rbsrc.body.items[_] - rolebinding.roleRef.kind == "ClusterRole" - rolebinding.roleRef.name == role.metadata.name - - - msga := { - "alertMessage": sprintf("the following users: %v , got read secret access roles", [rolebinding.subjects]), - "alertScore": 9, - "packagename": "armo_builtins", - "alertObject": {"clusterrole":role,"users":rolebinding.subjects} - } -} - - -# input: None -# apiversion: v1 -# does: -# returns clusterroles+ related subjects in clusterrolebinding -# -# -deny[msga] { - # rsrc := client.query_all("clusterroles") - # role := rsrc.body.items[_] - role := input[_] - role.kind == "ClusterRole" - rule := role.rules[_] - cautils.list_contains(rule.resources,"secrets") - canViewSecrets(rule) - rbsrc := client.query_all("clusterrolebindings") - rolebinding := rbsrc.body.items[_] - rolebinding.roleRef.kind == "ClusterRole" - rolebinding.roleRef.name == role.metadata.name - - - msga := { - "alertMessage": sprintf("the following users: %v , got read secret access roles", [rolebinding.subjects]), - "alertScore": 9, - "packagename": "armo_builtins", - "alertObject": {"clusterrole":role,"users":rolebinding.subjects} - } -} - -canViewSecrets(rule) { - cautils.list_contains(rule.verbs,"get") -} -canViewSecrets(rule) { - cautils.list_contains(rule.verbs,"watch") -} diff --git a/cautils/opapolicy/resources/rego/modules/rwhostpath.reg b/cautils/opapolicy/resources/rego/modules/rwhostpath.reg deleted file mode 100755 index 68c6280e..00000000 --- a/cautils/opapolicy/resources/rego/modules/rwhostpath.reg +++ /dev/null @@ -1,64 +0,0 @@ -package armo_builtins -#import data.kubernetes.api.client as client -import data.cautils as cautils - -# input: pod -# apiversion: v1 -# does: -# returns rw hostpath volumes of that pod -# -# -deny[msga] { - pod := input[_] - pod.kind == "Pod" - volumes := pod.spec.volumes - volume := volumes[_] - # crsrcs.body.spec.containers[_].volumeMounts[_].name = volume.name - mount := pod.spec.containers[_].volumeMounts[_] - mount.name == volume.name - volume.hostPath - isRWMount(mount) - podname := cautils.getPodName(pod.metadata) - obj := {"volume":volume,"mount":mount,"podname": podname} - - msga := { - "packagename": "armo_builtins", - "alertMessage": sprintf("pod: %v has {%v,%v} as rw hostPath volume and volumemount pair\n\n\n", [podname, volume,mount]), - "alertScore": 7, - "alertObject": [obj], - - } -} - -isRWMount(mount) { - not mount.readOnly -} -isRWMount(mount) { - mount.readOnly == false -} - - -#handles majority of workload resources -deny[msga] { - - wl := input[_] - spec_template_spec_patterns := {"Deployment","ReplicaSet","DaemonSet","StatefulSet","Job"} - spec_template_spec_patterns[wl.kind] - volumes := wl.spec.template.spec.volumes - volume := volumes[_] - mount := wl.spec.template.spec.containers[_].volumeMounts[_] - mount.name == volume.name - volume.hostPath - isRWMount(mount) - wlname := cautils.getPodName(wl.metadata) - obj := {"volume":volume,"mount":mount,"podname": wlname} - - msga := { - "packagename": "armo_builtins", - "alertMessage": sprintf("%v: %v has {%v,%v} as rw hostPath volume and volumemount pair\n\n\n", [wl.kind,wlname, volume,mount]), - "alertScore": 7, - "alertObject": [obj], - } -} - - diff --git a/cautils/opapolicy/resources/rego/modules/sshableworkload.reg b/cautils/opapolicy/resources/rego/modules/sshableworkload.reg deleted file mode 100755 index 431374e4..00000000 --- a/cautils/opapolicy/resources/rego/modules/sshableworkload.reg +++ /dev/null @@ -1,57 +0,0 @@ -package armo_builtins -import data.kubernetes.api.client as client -import data.cautils as cautils - -# input: pod -# apiversion: v1 -# does: -# returns the external facing services of that pod -# -# -deny[msga] { - pod := input[_] - podns := pod.metadata.namespace - podname := cautils.getPodName(pod.metadata) - # pod := client.query_name_ns("pods", "catalog-mongo-6f468d99b4-pn242", "default") - labels := pod.body.metadata.labels - filtered_labels := json.remove(labels, ["pod-template-hash"]) - - cluster_resource := client.query_all( - "services" - ) - - services := [svc | cluster_resource.body.items[i].metadata.namespace == podns; svc := cluster_resource.body.items[i]] - service := services[_] - service.spec.selector == filtered_labels - - hasSSHPorts(service) - - msga := { - "alertMessage": sprintf("pod %v/%v exposed by SSH services: %v\n", [podns,podname,service]), - "packagename": "armo_builtins", - "alertScore": 7, - "alertObject": [{"pod":pod,"service":{service}}] - } -} - -hasSSHPorts(service) { - port := service.spec.ports[_] - port.port == 22 -} - - -hasSSHPorts(service) { - port := service.spec.ports[_] - port.port == 2222 -} - -hasSSHPorts(service) { - port := service.spec.ports[_] - port.targetPort == 22 -} - - -hasSSHPorts(service) { - port := service.spec.ports[_] - port.targetPort == 2222 -} \ No newline at end of file diff --git a/cautils/opapolicy/resources/rego/regorulesjsons/access2secrets.json b/cautils/opapolicy/resources/rego/regorulesjsons/access2secrets.json deleted file mode 100755 index 14933b48..00000000 --- a/cautils/opapolicy/resources/rego/regorulesjsons/access2secrets.json +++ /dev/null @@ -1,33 +0,0 @@ -{ - "guid": "3b0467c9-488d-c244-99d0-90fbf600aaff", - "name": "[Builtin] rule-deny-access-to-secrets", - "creationTime": "2019-09-04T12:04:58.461455", - "description": "determines which users can get/list/watch secrets", - "attributes": { - "m$K8sThreatMatrix": "Credential Access::List k8s Secrets" - }, - "ruleDependencies": [ - { - "packageName":"cautils" - }, - { - "packageName":"kubernetes.api.client" - } - ], - "remediation": "", - "match": [ - { - "resources": [ - "Role","ClusterRole" - ], - "apiVersions": [ - "v1" - ], - "apiGroups": [ - "rbac.authorization.k8s.io" - ] - } - ], - "ruleLanguage": "Rego", - "rule": "\npackage armo_builtins\nimport data.kubernetes.api.client as client\nimport data.cautils as cautils\n\n\n# input: None\n# apiversion: v1\n# does: \n#\treturns roles+ related subjects in rolebinding\n\n\ndeny[msga] {\n\t# rsrc := client.query_all(\"roles\")\n\t# role := rsrc.body.items[_]\n\trole := input[_]\n\trole.kind == \"Role\"\n\trule := role.rules[_]\n\tcautils.list_contains(rule.resources,\"secrets\")\n\tcanViewSecrets(rule)\n\trbsrc := client.query_all(\"rolebindings\")\n\trolebinding := rbsrc.body.items[_]\n\trolebinding.roleRef.kind == \"Role\"\n\trolebinding.roleRef.name == role.metadata.name\n\t\n \n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"the following users: %v , got read secret access roles\", [rolebinding.subjects]),\n\t\t\"alert\": true,\n\t\t\"prevent\": false,\n\t\t\"alertScore\": 9,\n\t\t\"alertObject\": {\"role\":role,\"users\":rolebinding.subjects}\n\t\n\t}\n}\n\n\n\n# input: None\n# apiversion: v1\n# does: \n#\treturns clusterroles+ related subjects in rolebinding\n\n\ndeny[msga] {\n\t# rsrc := client.query_all(\"clusterroles\")\n\t# role := rsrc.body.items[_]\n\trole := input[_]\n\trole.kind == \"ClusterRole\"\n\trule := role.rules[_]\n\tcautils.list_contains(rule.resources,\"secrets\")\n\tcanViewSecrets(rule)\n\trbsrc := client.query_all(\"rolebindings\")\n\trolebinding := rbsrc.body.items[_]\n\trolebinding.roleRef.kind == \"ClusterRole\"\n\trolebinding.roleRef.name == role.metadata.name\n\t\n \n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"the following users: %v , got read secret access roles\", [rolebinding.subjects]),\n\t\t\"alert\": true,\n\t\t\"prevent\": false,\n\t\t\"alertScore\": 9,\n\t\t\"alertObject\": {\"clusterrole\":role,\"users\":rolebinding.subjects}\n\t\n\t}\n}\n\n\n# input: None\n# apiversion: v1\n# does: \n#\treturns clusterroles+ related subjects in clusterrolebinding\n#\n#\ndeny[msga] {\n\t# rsrc := client.query_all(\"clusterroles\")\n\t# role := rsrc.body.items[_]\n\trole := input[_]\n\trole.kind == \"ClusterRole\"\n\trule := role.rules[_]\n\tcautils.list_contains(rule.resources,\"secrets\")\n\tcanViewSecrets(rule)\n\trbsrc := client.query_all(\"clusterrolebindings\")\n\trolebinding := rbsrc.body.items[_]\n\trolebinding.roleRef.kind == \"ClusterRole\"\n\trolebinding.roleRef.name == role.metadata.name\n\t\n \n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"the following users: %v , got read secret access roles\", [rolebinding.subjects]),\n\t\t\"alert\": true,\n\t\t\"prevent\": false,\n\t\t\"alertScore\": 9,\n\t\t\"alertObject\": {\"clusterrole\":role,\"users\":rolebinding.subjects}\n\t\n\t}\n}\n\ncanViewSecrets(rule) {\n\tcautils.list_contains(rule.verbs,\"get\")\n}\ncanViewSecrets(rule) {\n\tcautils.list_contains(rule.verbs,\"watch\")\n}\n" -} diff --git a/cautils/opapolicy/resources/rego/regorulesjsons/cansshtopod.json b/cautils/opapolicy/resources/rego/regorulesjsons/cansshtopod.json deleted file mode 100755 index c00b15a1..00000000 --- a/cautils/opapolicy/resources/rego/regorulesjsons/cansshtopod.json +++ /dev/null @@ -1,34 +0,0 @@ -{ - "guid": "3b0467c9-488d-c244-99d0-90fbf600aaff", - "name": "[Builtin] rule-can-ssh-to-pod", - "creationTime": "2019-09-04T12:04:58.461455", - "description": "denies pods with SSH ports opened(22/222)", - "attributes": { - "microsoftK8sThreatMatrix": "val1" - }, - "ruleDependencies": [ - { - "packageName":"cautils" - }, - { - "packageName":"kubernetes.api.client" - } - ], - "remediation": "create a network policy that protects SSH ports", - "match": [ - { - "resources": [ - "Pods" - ], - "apiVersions": [ - "v1" - ], - "apiGroups": [ - "*" - ] - } - ], - "ruleLanguage": "Rego", - "rule": "\npackage armo_builtins\nimport data.kubernetes.api.client as client\nimport data.cautils as cautils\n\n# input: pod\n# apiversion: v1\n# does: \n#\treturns the external facing services of that pod\n#\n#\ndeny[msga] {\n\tpod := input[_]\n\tpodns := pod.metadata.namespace\n\tpodname := cautils.getPodName(pod.metadata)\n\t# pod := client.query_name_ns(\"pods\", \"catalog-mongo-6f468d99b4-pn242\", \"default\")\n\tlabels := pod.body.metadata.labels\n\tfiltered_labels := json.remove(labels, [\"pod-template-hash\"])\n \n\t cluster_resource := client.query_all(\n\t \t\"services\"\n\t )\n\n\tservices := [svc | cluster_resource.body.items[i].metadata.namespace == podns; svc := cluster_resource.body.items[i]]\n\tservice := \tservices[_]\n\tservice.spec.selector == filtered_labels\n \n\thasSSHPorts(service)\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"pod %v/%v exposed by SSH services: %v\n\", [podns,podname,service]),\n\t\t\"alert\": true,\n\t\t\"prevent\": false,\n\t\t\"alertScore\": 7,\n\t\t\"alertObject\": [{\"pod\":pod,\"service\":{service}}]\n\t\n\t}\n}\n\nhasSSHPorts(service) {\n\tport := service.spec.ports[_]\n\tport.port == 22\n}\n\n\nhasSSHPorts(service) {\n\tport := service.spec.ports[_]\n\tport.port == 2222\n}\n\nhasSSHPorts(service) {\n\tport := service.spec.ports[_]\n\tport.targetPort == 22\n}\n\n\nhasSSHPorts(service) {\n\tport := service.spec.ports[_]\n\tport.targetPort == 2222\n}\n" - -} diff --git a/cautils/opapolicy/resources/rego/regorulesjsons/compromisedregistries.json b/cautils/opapolicy/resources/rego/regorulesjsons/compromisedregistries.json deleted file mode 100755 index 103e41c5..00000000 --- a/cautils/opapolicy/resources/rego/regorulesjsons/compromisedregistries.json +++ /dev/null @@ -1,33 +0,0 @@ -{ - "guid": "", - "name": "[Builtin] rule-identify-blacklisted-image-registries", - "creationTime": "", - "description": "Identifying if pod container images are from unallowed registries", - "attributes": { - "m$K8sThreatMatrix": "Initial Access::Compromised images in registry" - }, - "ruleDependencies": [ - { - "packageName": "cautils" - }, - { - "packageName": "kubernetes.api.client" - } - ], - "remediation": "Use images from safe registry", - "match": [ - { - "resources": [ - "Pods" - ], - "apiVersions": [ - "v1" - ], - "apiGroups": [ - "*" - ] - } - ], - "ruleLanguage": "Rego", - "rule": "\npackage armo_builtins\n# Check for images from blacklisted repos\n\nuntrusted_registries(z) = x {\n\tx := [\"015253967648.dkr.ecr.eu-central-1.amazonaws.com/\"]\t\n}\n\npublic_registries(z) = y{\n\ty := [\"quay.io/kiali/\",\"quay.io/datawire/\",\"quay.io/keycloak/\",\"quay.io/bitnami/\"]\n}\n\nuntrustedImageRepo[msga] {\n\tpod := input[_]\n\tk := pod.kind\n\tk == \"Pod\"\n\tcontainer := pod.spec.containers[_]\n\timage := container.image\n repo_prefix := untrusted_registries(image)[_]\n\tstartswith(image, repo_prefix)\n\tselfLink := pod.metadata.selfLink\n\tcontainerName := container.name\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"image '%v' in container '%s' in [%s] comes from untrusted registry\", [image, containerName, selfLink]),\n\t\t\"alert\": true,\n\t\t\"prevent\": false,\n\t\t\"alertScore\": 2,\n\t\t\"alertObject\": [{\"pod\":pod}]\n\t}\n}\n\nuntrustedImageRepo[msga] {\n pod := input[_]\n\tk := pod.kind\n\tk == \"Pod\"\n\tcontainer := pod.spec.containers[_]\n\timage := container.image\n repo_prefix := public_registries(image)[_]\n\tstartswith(pod, repo_prefix)\n\tselfLink := input.metadata.selfLink\n\tcontainerName := container.name\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"image '%v' in container '%s' in [%s] comes from public registry\", [image, containerName, selfLink]),\n\t\t\"alert\": true,\n\t\t\"prevent\": false,\n\t\t\"alertScore\": 1,\n\t\t\"alertObject\": [{\"pod\":pod}]\n\t}\n}" -} \ No newline at end of file diff --git a/cautils/opapolicy/resources/rego/regorulesjsons/externalfacingservicesbypod.json b/cautils/opapolicy/resources/rego/regorulesjsons/externalfacingservicesbypod.json deleted file mode 100755 index e5203fe2..00000000 --- a/cautils/opapolicy/resources/rego/regorulesjsons/externalfacingservicesbypod.json +++ /dev/null @@ -1,31 +0,0 @@ -{ - "guid": "3b0467c9-488d-c244-99d0-90fbf600aaff", - "name": "[Builtin] rule-pod-external-facing", - "creationTime": "2019-09-04T12:04:58.461455", - "description": "denies pods with external facing services, grabs related services", - "attributes": { - "microsoftK8sThreatMatrix": "val1" - }, - "ruleDependencies": [ - { - "packageName":"kubernetes.api.client" - } - ], - "remediation": "create a network policy that controls which protect your cluster from unwanted connections and the outside world", - "match": [ - { - "resources": [ - "Pods" - ], - "apiVersions": [ - "v1" - ], - "apiGroups": [ - "*" - ] - } - ], - "ruleLanguage": "Rego", - "rule": "\npackage armo_builtins\n\nimport data.kubernetes.api.client as client\n\n\n# input: pod\n# apiversion: v1\n# does: \n#\treturns the external facing services of that pod\n#\n#\ndeny[msga] {\n\tpod := input[_]\n\tpodns := pod.metadata.namespace\n\tpodname := getName(pod.metadata)\n\t# pod := client.query_name_ns(\"pods\",\"frontend-86c5ffb485-kfp9d\", \"default\")\n\tlabels := pod.body.metadata.labels\n\tfiltered_labels := json.remove(labels, [\"pod-template-hash\"])\n \n\t cluster_resource := client.query_all(\n\t \t\"services\"\n\t )\n\n\n\tservices := [svc | cluster_resource.body.items[i].metadata.namespace == podns; svc := cluster_resource.body.items[i]]\n\tservice := \tservices[_]\n\tnp_or_lb := {\"NodePort\", \"LoadBalancer\"}\n\tnp_or_lb[service.spec.type]\n\tservice.spec.selector == filtered_labels\n \n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"pod %v/%v exposed services: %v\n\", [podns,podname,service]),\n\t\t\"alert\": true,\n\t\t\"prevent\": false,\n\t\t\"alertScore\": 7,\n\t\t\"alertObject\": {\"service\":service,\"labels\":filtered_labels, \"podname\":podname,\"namespace\":podns}\n\t\n\t}\n}\n\ngetName(metadata) = name {\n\tname := metadata.generateName\n}\ngetName(metadata) = name {\n\tname := metadata.name\n}\n" - -} diff --git a/cautils/opapolicy/resources/rego/regorulesjsons/hostpath.json b/cautils/opapolicy/resources/rego/regorulesjsons/hostpath.json deleted file mode 100755 index baa84855..00000000 --- a/cautils/opapolicy/resources/rego/regorulesjsons/hostpath.json +++ /dev/null @@ -1,31 +0,0 @@ -{ - "guid": "3b0467c9-488d-c244-99d0-90fbf600aaff", - "name": "[Builtin] alert-any-hostpath", - "creationTime": "2019-09-04T12:04:58.461455", - "description": "determines if any workload contains a hostPath volume", - "attributes": { - "m$K8sThreatMatrix": "Privilege Escalation::hostPath mount" - }, - "ruleDependencies": [ - { - "packageName":"cautils" - } - ], - "remediation": "consider if hostPath is really necessary - reading sensitive data like hostPath credentials might endanger cluster, if so consider encrypting the data", - - "match": [ - { - "resources": [ - "Deployment","ReplicaSet","DaemonSet","StatefulSet","Job","Pod" - ], - "apiVersions": [ - "v1" - ], - "apiGroups": [ - "*" - ] - } - ], - "ruleLanguage": "Rego", - "rule": "\npackage armo_builtins\nimport data.kubernetes.api.client as client\nimport data.cautils as cautils\n\n# input: pod\n# apiversion: v1\n# does: \n#\treturns hostPath volumes\n#\n#\ndeny[msga] {\n pod := input[_]\n pod.kind == \"Pod\"\n volumes := pod.spec.volumes\n volume := volumes[_]\n # crsrcs.body.spec.containers[_].volumeMounts[_].name = volume.name\n volume.hostPath\n podname := cautils.getPodName(pod.metadata)\n obj := {\"volume\":volume,\"podname\": podname}\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"pod: %v has {%v,%v} ashostPath volume \n\n\n\", [podname, volume]),\n\t\t\"alert\": true,\n\t\t\"prevent\": false,\n\t\t\"alertScore\": 7,\n\t\t\"alertObject\": [obj],\n\t\n\t}\n}\n\nisRWMount(mount) {\n not mount.readOnly\n}\nisRWMount(mount) {\n mount.readOnly == false\n}\n\n\n#handles majority of workload resources\ndeny[msga] {\n\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n volumes := wl.spec.template.spec.volumes\n volume := volumes[_]\n volume.hostPath\n wlname := cautils.getPodName(wl.metadata)\n obj := {\"volume\":volume,\"podname\": wlname}\n\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"%v: %v has {%v,%v} as hostPath volume\n\n\n\", [wl.kind,wlname, volume]),\n\t\t\"alert\": true,\n\t\t\"prevent\": false,\n\t\t\"alertScore\": 7,\n\t\t\"alertObject\": [obj],\n\t\n\t}\n}\n\n\n" - } diff --git a/cautils/opapolicy/resources/rego/regorulesjsons/instancemetadataapi.json b/cautils/opapolicy/resources/rego/regorulesjsons/instancemetadataapi.json deleted file mode 100644 index 7ab203bb..00000000 --- a/cautils/opapolicy/resources/rego/regorulesjsons/instancemetadataapi.json +++ /dev/null @@ -1,27 +0,0 @@ -{ - "guid": "82f19070-2826-4fe4-a079-f5f7e7a1b04d", - "name": "[Builtin] instance-metadata-api-access", - "attributes": { - "m$K8sThreatMatrix": "Credential Access::Instance Metadata API" - }, - "creationTime": "2021-04-25T10:48:48.861806", - "rule": "package armo_builtins\n# Check for images from blacklisted repos\n\nmetadata_azure(z) = http.send({\n\t\"url\": \"http://169.254.169.254/metadata/instance?api-version=2020-09-01\",\n\t\"method\": \"get\",\n\t\"headers\": {\"Metadata\": \"true\"},\n\t\"raise_error\": true,\t\n})\n\nmetadata_gcp(z) = http.send({\n\t\"url\": \"http://169.254.169.254/computeMetadata/v1/?alt=json&recursive=true\",\n\t\"method\": \"get\",\n\t\"headers\": {\"Metadata-Flavor\": \"Google\"},\n\t\"raise_error\": true,\t\n})\n\nmetadata_aws(z) = metadata_object { \n\thostname := http.send({\n\t\"url\": \"http://169.254.169.254/latest/meta-data/local-hostname\",\n\t\"method\": \"get\",\n\t\"raise_error\": true,\t\n })\n\tmetadata_object := {\n\t\t\"raw_body\": hostname.raw_body,\n\t\t\"hostname\" : hostname.raw_body,\n\t\t\"status_code\" : hostname.status_code\n\t}\n}\n\nazure_metadata[msga] {\t\n\tmetadata_object := metadata_azure(\"aaa\")\n\tmetadata_object.status_code == 200\n\tnode_name := metadata_object.body.compute.name\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Node '%s' has access to Instance Metadata Services of Azure.\", [node_name]),\n\t\t\"alert\": true,\n\t\t\"prevent\": false,\n\t\t\"alertScore\": 1,\n\t\t\"alertObject\": [{\"nodeMetadata\":metadata_object.body}]\n\t}\n}\n\ngcp_metadata[msga] {\t\n\tmetadata_object := metadata_gcp(\"aaa\")\n\tmetadata_object.status_code == 200\n\tnode_name := metadata_object.body.instance.hostname\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Node '%s' has access to Instance Metadata Services of GCP.\", [node_name]),\n\t\t\"alert\": true,\n\t\t\"prevent\": false,\n\t\t\"alertScore\": 1,\n\t\t\"alertObject\": [{\"nodeMetadata\": metadata_object.raw_body}]\n\t}\n}\n\naws_metadata[msga] {\t\n\tmetadata_object := metadata_aws(\"aaa\")\n\tmetadata_object.status_code == 200\n\tnode_name := metadata_object.hostname\n\tmsga := {\n\t\t\"alertMessage\": sprintf(\"Node '%s' has access to Instance Metadata Services of AWS.\", [node_name]),\n\t\t\"alert\": true,\n\t\t\"prevent\": false,\n\t\t\"alertScore\": 1,\n\t\t\"alertObject\": [{\"nodeMetadata\": metadata_object.raw_body}]\n\t}\n}", - "ruleLanguage": "Rego", - "match": [ - { - "apiGroups": [ - "*" - ], - "apiVersions": [ - "*" - ], - "resources": [ - "nodes" - ] - } - ], - "ruleDependencies": [], - "description": "Checks if there is access from the nodes to cloud prividers instance metadata services", - "remediation": "From https://attack.mitre.org/techniques/T1552/005/ :Option A: Disable or Remove Feature or Program, Option B: Filter Network Traffic", - "ruleQuery": "" -} diff --git a/cautils/opapolicy/resources/rego/regorulesjsons/iscronjob.json b/cautils/opapolicy/resources/rego/regorulesjsons/iscronjob.json deleted file mode 100755 index 182ee4de..00000000 --- a/cautils/opapolicy/resources/rego/regorulesjsons/iscronjob.json +++ /dev/null @@ -1,30 +0,0 @@ -{ - "guid": "[Builtin] 3b0467c9-488d-c244-99d0-90fbf600aaff", - "name": "rule-deny-cronjobs", - "creationTime": "2019-09-04T12:04:58.461455", - "description": "determines if it's cronjob", - "attributes": { - "m$K8sThreatMatrix": "Persistence::Cronjob" - }, - "ruleDependencies": [ - { - "packageName":"cautils" - } - ], - "remediation": "", - "match": [ - { - "resources": [ - "CronJob" - ], - "apiVersions": [ - "v1beta1" - ], - "apiGroups": [ - "batch" - ] - } - ], - "ruleLanguage": "Rego", - "rule": "\npackage armo_builtins\n\n# import data.kubernetes.api.client as client\nimport data.cautils as cautils\n\n\n# alert cronjobs\n\n#handles cronjob\ndeny[msga] {\n\n\twl := input[_]\n\twl.kind == \"CronJob\"\n msga := {\n\t\t\"alertMessage\": sprintf(\"the following cronjobs are defined: %v\", [wl]),\n\t\t\"alert\": true,\n\t\t\"prevent\": false,\n\t\t\"alertScore\": 2,\n\t\t\"alertObject\": wl\n\t\n\t}\n}\n" -} diff --git a/cautils/opapolicy/resources/rego/regorulesjsons/privilegedworkload.json b/cautils/opapolicy/resources/rego/regorulesjsons/privilegedworkload.json deleted file mode 100755 index 5a6e0faf..00000000 --- a/cautils/opapolicy/resources/rego/regorulesjsons/privilegedworkload.json +++ /dev/null @@ -1,29 +0,0 @@ -{ - "guid": "", - "name": "[Builtin] rule-privilege-escalation", - "creationTime": "2019-09-04T12:04:58.461455", - "description": "determines if pods/deployments defined as privileged true", - "attributes": { - "mitre": "Privilege Escalation", - "mitreCode": "TA0004", - "m$K8sThreatMatrix": "Privilege Escalation::privileged container" - }, - "ruleDependencies": [ - ], - "remediation": "avoid defining pods as privilleged", - "match": [ - { - "resources": [ - "Deployment","ReplicaSet","DaemonSet","StatefulSet","Job","Pod","CronJob" - ], - "apiVersions": [ - "v1" - ], - "apiGroups": [ - "*" - ] - } - ], - "ruleLanguage": "Rego", - "rule": "\npackage armo_builtins\n\nimport data.kubernetes.api.client as client\nimport data.designators as scope\nimport data.cautils as cautils\n\n\n# Deny mutating action unless user is in group owning the resource\n\n\n#privileged pods\ndeny[msga] {\n\n \n\tpod := input[_]\n\tcontainers := pod.spec.containers[_]\n\tcontainers.securityContext.privileged == true\n msga := {\n\t\t\"alertMessage\": sprintf(\"the following pods are defined as privileged: %v\", [pod]),\n\t\t\"alert\": true,\n\t\t\"prevent\": false,\n\t\t\"alertScore\": 3,\n\t\t\"alertObject\": pod,\n\t\n\t}\n}\n\n\n#handles majority of workload resources\ndeny[msga] {\n\n\twl := input[_]\n\tspec_template_spec_patterns := {\"Deployment\",\"ReplicaSet\",\"DaemonSet\",\"StatefulSet\",\"Job\"}\n\tspec_template_spec_patterns[wl.kind]\n\tcontainers := wl.spec.template.spec.containers[_]\n\tcontainers.securityContext.privileged == true\n msga := {\n\t\t\"alertMessage\": sprintf(\"the following workloads are defined as privileged: %v\", [wl]),\n\t\t\"alert\": true,\n\t\t\"prevent\": false,\n\t\t\"alertScore\": 3,\n\t\t\"alertObject\": wl,\n\t\n\t}\n}\n\n\n\n#handles cronjob\ndeny[msga] {\n\n\twl := input[_]\n\twl.kind == \"CronJob\"\n\tcontainers := wl.spec.jobTemplate.spec.template.spec.containers[_]\n\tcontainers.securityContext.privileged == true\n msga := {\n\t\t\"alertMessage\": sprintf(\"the following cronjobs are defined as privileged: %v\", [wl]),\n\t\t\"alert\": true,\n\t\t\"prevent\": false,\n\t\t\"alertScore\": 3,\n\t\t\"alertObject\": wl,\n\t\n\t}\n}\n\n" -} diff --git a/cautils/opapolicy/resources/rego/regorulesjsons/rwhostpath.json b/cautils/opapolicy/resources/rego/regorulesjsons/rwhostpath.json deleted file mode 100755 index 93f57e94..00000000 --- a/cautils/opapolicy/resources/rego/regorulesjsons/rwhostpath.json +++ /dev/null @@ -1,31 +0,0 @@ -{ - "guid": "3b0467c9-488d-c244-99d0-90fbf600aaff", - "name": "[Builtin] alert-rw-hostpath", - "creationTime": "2019-09-04T12:04:58.461455", - "description": "determines if any workload contains a hostPath volume with rw permissions", - "attributes": { - "m$K8sThreatMatrix": "Persistance::Writable hostPath mount" - }, - "ruleDependencies": [ - { - "packageName":"cautils" - } - ], - "remediation": "consider if hostPath is really necessary- sensitive data like hostPath credentials might endanger cluster, if so consider encrypting the data", - - "match": [ - { - "resources": [ - "Deployment","ReplicaSet","DaemonSet","StatefulSet","Job","Pod" - ], - "apiVersions": [ - "v1" - ], - "apiGroups": [ - "*" - ] - } - ], - "ruleLanguage": "Rego", - "rule": "\"\\npackage armo_builtins\\nimport data.kubernetes.api.client as client\\nimport data.cautils as cautils\\n\\n# input: pod\\n# apiversion: v1\\n# does: \\n#\\treturns hostPath volumes\\n#\\n#\\ndeny[msga] {\\n pod := input[_]\\n pod.kind == \\\"Pod\\\"\\n volumes := pod.spec.volumes\\n volume := volumes[_]\\n # crsrcs.body.spec.containers[_].volumeMounts[_].name = volume.name\\n volume.hostPath\\n podname := cautils.getPodName(pod.metadata)\\n obj := {\\\"volume\\\":volume,\\\"podname\\\": podname}\\n\\n\\tmsga := {\\n\\t\\t\\\"alertMessage\\\": sprintf(\\\"pod: %v has {%v,%v} ashostPath volume \\n\\n\\n\\\", [podname, volume]),\\n\\t\\t\\\"alert\\\": true,\\n\\t\\t\\\"prevent\\\": false,\\n\\t\\t\\\"alertScore\\\": 7,\\n\\t\\t\\\"alertObject\\\": [obj],\\n\\t\\n\\t}\\n}\\n\\nisRWMount(mount) {\\n not mount.readOnly\\n}\\nisRWMount(mount) {\\n mount.readOnly == false\\n}\\n\\n\\n#handles majority of workload resources\\ndeny[msga] {\\n\\n\\twl := input[_]\\n\\tspec_template_spec_patterns := {\\\"Deployment\\\",\\\"ReplicaSet\\\",\\\"DaemonSet\\\",\\\"StatefulSet\\\",\\\"Job\\\"}\\n\\tspec_template_spec_patterns[wl.kind]\\n volumes := wl.spec.template.spec.volumes\\n volume := volumes[_]\\n volume.hostPath\\n wlname := cautils.getPodName(wl.metadata)\\n obj := {\\\"volume\\\":volume,\\\"podname\\\": wlname}\\n\\n\\tmsga := {\\n\\t\\t\\\"alertMessage\\\": sprintf(\\\"%v: %v has {%v,%v} as hostPath volume\\n\\n\\n\\\", [wl.kind,wlname, volume]),\\n\\t\\t\\\"alert\\\": true,\\n\\t\\t\\\"prevent\\\": false,\\n\\t\\t\\\"alertScore\\\": 7,\\n\\t\\t\\\"alertObject\\\": [obj],\\n\\t\\n\\t}\\n}\\n\\n\\n\"" -} diff --git a/cautils/opapolicy/resources/resourcesutils.go b/cautils/opapolicy/resources/resourcesutils.go deleted file mode 100644 index befd25b7..00000000 --- a/cautils/opapolicy/resources/resourcesutils.go +++ /dev/null @@ -1,118 +0,0 @@ -package resources - -import ( - "encoding/json" - "fmt" - "os" - "path/filepath" - "strings" - - "github.com/armosec/kubescape/cautils/k8sinterface" - - "github.com/golang/glog" - "github.com/open-policy-agent/opa/storage" - "github.com/open-policy-agent/opa/storage/inmem" - "github.com/open-policy-agent/opa/util" - "k8s.io/client-go/rest" -) - -var ( - RegoDependenciesPath = "/resources/rego/dependencies" -) - -type RegoDependenciesData struct { - K8sConfig RegoK8sConfig `json:"k8sconfig"` -} - -type RegoK8sConfig struct { - Token string `json:"token"` - IP string `json:"ip"` - Host string `json:"host"` - Port string `json:"port"` - CrtFile string `json:"crtfile"` - ClientCrtFile string `json:"clientcrtfile"` - ClientKeyFile string `json:"clientkeyfile"` - // ClientKeyFile string `json:"crtfile"` -} - -func NewRegoDependenciesDataMock() *RegoDependenciesData { - return NewRegoDependenciesData(k8sinterface.GetK8sConfig()) -} - -func NewRegoDependenciesData(k8sConfig *rest.Config) *RegoDependenciesData { - - regoDependenciesData := RegoDependenciesData{} - - if k8sConfig != nil { - regoDependenciesData.K8sConfig = *NewRegoK8sConfig(k8sConfig) - } - - return ®oDependenciesData -} -func NewRegoK8sConfig(k8sConfig *rest.Config) *RegoK8sConfig { - - host := k8sConfig.Host - if host == "" { - ip := os.Getenv("KUBERNETES_SERVICE_HOST") - port := os.Getenv("KUBERNETES_SERVICE_PORT") - host = fmt.Sprintf("https://%s:%s", ip, port) - } - - token := "" - if k8sConfig.BearerToken != "" { - token = fmt.Sprintf("Bearer %s", k8sConfig.BearerToken) - } - - regoK8sConfig := RegoK8sConfig{ - Token: token, - Host: host, - CrtFile: k8sConfig.CAFile, - ClientCrtFile: k8sConfig.CertFile, - ClientKeyFile: k8sConfig.KeyFile, - } - return ®oK8sConfig -} -func (data *RegoDependenciesData) TOStorage() (storage.Store, error) { - var jsonObj map[string]interface{} - bytesData, err := json.Marshal(*data) - if err != nil { - return nil, err - } - // glog.Infof("RegoDependenciesData: %s", bytesData) - if err := util.UnmarshalJSON(bytesData, &jsonObj); err != nil { - return nil, err - } - return inmem.NewFromObject(jsonObj), nil -} - -// LoadRegoDependenciesFromDir loads the policies list from *.rego file in given directory -func LoadRegoFiles(dir string) map[string]string { - - modules := make(map[string]string) - - // Compile the module. The keys are used as identifiers in error messages. - filepath.Walk(dir, func(path string, info os.FileInfo, err error) error { - if err == nil && strings.HasSuffix(path, ".rego") && !info.IsDir() { - content, err := os.ReadFile(path) - if err != nil { - glog.Errorf("LoadRegoFiles, Failed to load: %s: %v", path, err) - } else { - modules[strings.Trim(filepath.Base(path), ".rego")] = string(content) - } - } - return nil - }) - - return modules -} - -// LoadRegoModules loads the policies from variables -func LoadRegoModules() map[string]string { - - modules := make(map[string]string) - modules["cautils"] = RegoCAUtils - modules["designators"] = RegoDesignators - modules["kubernetes.api.client"] = RegoKubernetesApiClient - - return modules -} diff --git a/cautils/opapolicy/resources/resourcesutils_test.go b/cautils/opapolicy/resources/resourcesutils_test.go deleted file mode 100644 index 18d6395a..00000000 --- a/cautils/opapolicy/resources/resourcesutils_test.go +++ /dev/null @@ -1 +0,0 @@ -package resources diff --git a/cautils/scaninfo.go b/cautils/scaninfo.go index 5d8607dd..338fac87 100644 --- a/cautils/scaninfo.go +++ b/cautils/scaninfo.go @@ -3,8 +3,8 @@ package cautils import ( "path/filepath" + "github.com/armosec/armoapi-go/opapolicy" "github.com/armosec/kubescape/cautils/getter" - "github.com/armosec/kubescape/cautils/opapolicy" ) type ScanInfo struct { diff --git a/cmd/cluster_get.go b/cmd/cluster_get.go index 83915524..74816369 100644 --- a/cmd/cluster_get.go +++ b/cmd/cluster_get.go @@ -4,9 +4,9 @@ import ( "fmt" "strings" + "github.com/armosec/k8s-interface/k8sinterface" "github.com/armosec/kubescape/cautils" "github.com/armosec/kubescape/cautils/getter" - "github.com/armosec/kubescape/cautils/k8sinterface" "github.com/spf13/cobra" ) diff --git a/cmd/cluster_set.go b/cmd/cluster_set.go index f7c94b84..f7c6edae 100644 --- a/cmd/cluster_set.go +++ b/cmd/cluster_set.go @@ -4,9 +4,9 @@ import ( "fmt" "strings" + "github.com/armosec/k8s-interface/k8sinterface" "github.com/armosec/kubescape/cautils" "github.com/armosec/kubescape/cautils/getter" - "github.com/armosec/kubescape/cautils/k8sinterface" "github.com/spf13/cobra" ) diff --git a/cmd/framework.go b/cmd/framework.go index b5f1e0c9..9b461ec4 100644 --- a/cmd/framework.go +++ b/cmd/framework.go @@ -7,11 +7,11 @@ import ( "os" "strings" + "github.com/armosec/armoapi-go/armotypes" + "github.com/armosec/armoapi-go/opapolicy" + "github.com/armosec/k8s-interface/k8sinterface" "github.com/armosec/kubescape/cautils" - "github.com/armosec/kubescape/cautils/armotypes" "github.com/armosec/kubescape/cautils/getter" - "github.com/armosec/kubescape/cautils/k8sinterface" - "github.com/armosec/kubescape/cautils/opapolicy" "github.com/armosec/kubescape/opaprocessor" "github.com/armosec/kubescape/policyhandler" "github.com/armosec/kubescape/resultshandling" diff --git a/go.mod b/go.mod index a85c2657..997c4cdc 100644 --- a/go.mod +++ b/go.mod @@ -3,30 +3,37 @@ module github.com/armosec/kubescape go 1.17 require ( - github.com/aws/aws-sdk-go v1.40.30 + github.com/aws/aws-sdk-go v1.41.1 // indirect github.com/briandowns/spinner v1.16.0 - github.com/coreos/go-oidc v2.2.1+incompatible - github.com/docker/docker v20.10.8+incompatible + github.com/coreos/go-oidc v2.2.1+incompatible // indirect + github.com/docker/docker v20.10.9+incompatible // indirect github.com/docker/go-connections v0.4.0 // indirect github.com/docker/go-units v0.4.0 // indirect github.com/enescakir/emoji v1.0.0 github.com/fatih/color v1.12.0 - github.com/francoispqt/gojay v1.2.13 + github.com/francoispqt/gojay v1.2.13 // indirect github.com/gofrs/uuid v4.0.0+incompatible github.com/golang/glog v1.0.0 github.com/mattn/go-isatty v0.0.13 github.com/olekukonko/tablewriter v0.0.5 - github.com/open-policy-agent/opa v0.31.0 + github.com/open-policy-agent/opa v0.33.1 github.com/opencontainers/go-digest v1.0.0 // indirect github.com/opencontainers/image-spec v1.0.1 // indirect github.com/satori/go.uuid v1.2.0 github.com/spf13/cobra v1.2.1 - golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f + golang.org/x/oauth2 v0.0.0-20211005180243-6b3c2da341f1 // indirect gopkg.in/yaml.v2 v2.4.0 - k8s.io/api v0.22.1 - k8s.io/apimachinery v0.22.1 - k8s.io/client-go v0.22.1 - sigs.k8s.io/controller-runtime v0.9.6 + k8s.io/api v0.22.2 + k8s.io/apimachinery v0.22.2 + k8s.io/client-go v0.22.2 + sigs.k8s.io/controller-runtime v0.10.2 // indirect +) + +require ( + github.com/armosec/armoapi-go v0.0.5 + github.com/armosec/k8s-interface v0.0.2 + github.com/armosec/opa-utils v0.0.1 + github.com/armosec/utils-go v0.0.3 ) require ( @@ -38,9 +45,8 @@ require ( github.com/Azure/go-autorest/logger v0.2.1 // indirect github.com/Azure/go-autorest/tracing v0.6.0 // indirect github.com/OneOfOne/xxhash v1.2.8 // indirect - github.com/bytecodealliance/wasmtime-go v0.28.0 // indirect + github.com/armosec/utils-k8s-go v0.0.1 // indirect github.com/davecgh/go-spew v1.1.1 // indirect - github.com/evanphx/json-patch v4.11.0+incompatible // indirect github.com/form3tech-oss/jwt-go v3.2.3+incompatible // indirect github.com/ghodss/yaml v1.0.0 // indirect github.com/go-logr/logr v0.4.0 // indirect @@ -59,26 +65,28 @@ require ( github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect github.com/modern-go/reflect2 v1.0.1 // indirect github.com/pkg/errors v0.9.1 // indirect - github.com/pquerna/cachecontrol v0.0.0-20171018203845-0dec1b30a021 // indirect + github.com/pquerna/cachecontrol v0.1.0 // indirect github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0 // indirect github.com/spf13/pflag v1.0.5 // indirect github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect github.com/yashtewari/glob-intersection v0.0.0-20180916065949-5c77d914dd0b // indirect + go.uber.org/atomic v1.7.0 // indirect + go.uber.org/multierr v1.6.0 // indirect + go.uber.org/zap v1.19.1 // indirect golang.org/x/crypto v0.0.0-20210220033148-5ea612d1eb83 // indirect - golang.org/x/net v0.0.0-20210614182718-04defd469f4e // indirect - golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c // indirect + golang.org/x/net v0.0.0-20210825183410-e898025ed96a // indirect + golang.org/x/sys v0.0.0-20210823070655-63515b42dcdf // indirect golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d // indirect golang.org/x/text v0.3.6 // indirect golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac // indirect google.golang.org/appengine v1.6.7 // indirect - google.golang.org/protobuf v1.26.0 // indirect + google.golang.org/protobuf v1.27.1 // indirect gopkg.in/inf.v0 v0.9.1 // indirect - gopkg.in/square/go-jose.v2 v2.2.2 // indirect + gopkg.in/square/go-jose.v2 v2.6.0 // indirect gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect k8s.io/klog/v2 v2.9.0 // indirect - k8s.io/kube-openapi v0.0.0-20210421082810-95288971da7e // indirect - k8s.io/utils v0.0.0-20210722164352-7f3ee0f31471 // indirect + k8s.io/utils v0.0.0-20210819203725-bdf08cb9a70a // indirect sigs.k8s.io/structured-merge-diff/v4 v4.1.2 // indirect sigs.k8s.io/yaml v1.2.0 // indirect ) diff --git a/go.sum b/go.sum index dc2e9729..09173d94 100644 --- a/go.sum +++ b/go.sum @@ -45,20 +45,18 @@ dmitri.shuralyov.com/html/belt v0.0.0-20180602232347-f7d459c86be0/go.mod h1:JLBr dmitri.shuralyov.com/service/change v0.0.0-20181023043359-a85b471d5412/go.mod h1:a1inKt/atXimZ4Mv927x+r7UpyzRUf4emIoiiSC2TN4= dmitri.shuralyov.com/state v0.0.0-20180228185332-28bcc343414c/go.mod h1:0PRwlb0D6DFvNNtx+9ybjezNCa8XF0xaYcETyp6rHWU= git.apache.org/thrift.git v0.0.0-20180902110319-2566ecd5d999/go.mod h1:fPE2ZNJGynbRyZ4dJvy6G277gSllfV2HJqblrnkyeyg= -github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78/go.mod h1:LmzpDX56iTiv29bbRTIsUNlaFfuhWRQBWjQdVyAevI8= +github.com/Azure/go-ansiterm v0.0.0-20210608223527-2377c96fe795/go.mod h1:LmzpDX56iTiv29bbRTIsUNlaFfuhWRQBWjQdVyAevI8= +github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E= github.com/Azure/go-autorest v14.2.0+incompatible h1:V5VMDjClD3GiElqLWO7mz2MxNAK/vTfRHdAubSIPRgs= github.com/Azure/go-autorest v14.2.0+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24= -github.com/Azure/go-autorest/autorest v0.11.12/go.mod h1:eipySxLmqSyC5s5k1CLupqet0PSENBEDP93LQ9a8QYw= github.com/Azure/go-autorest/autorest v0.11.18 h1:90Y4srNYrwOtAgVo3ndrQkTYn6kf1Eg/AjTFJ8Is2aM= github.com/Azure/go-autorest/autorest v0.11.18/go.mod h1:dSiJPy22c3u0OtOKDNttNgqpNFY/GeWa7GH/Pz56QRA= -github.com/Azure/go-autorest/autorest/adal v0.9.5/go.mod h1:B7KF7jKIeC9Mct5spmyCB/A8CG/sEz1vwIRGv/bbw7A= github.com/Azure/go-autorest/autorest/adal v0.9.13 h1:Mp5hbtOePIzM8pJVRa3YLrWWmZtoxRXqUEzCfJt3+/Q= github.com/Azure/go-autorest/autorest/adal v0.9.13/go.mod h1:W/MM4U6nLxnIskrw4UwWzlHfGjwUS50aOsc/I3yuU8M= github.com/Azure/go-autorest/autorest/date v0.3.0 h1:7gUk1U5M/CQbp9WoqinNzJar+8KY+LPI6wiWrP/myHw= github.com/Azure/go-autorest/autorest/date v0.3.0/go.mod h1:BI0uouVdmngYNUzGWeSYnokU+TrmwEsOqdt8Y6sso74= github.com/Azure/go-autorest/autorest/mocks v0.4.1 h1:K0laFcLE6VLTOwNgSxaGbUcLPuGXlNkbVvq4cW4nIHk= github.com/Azure/go-autorest/autorest/mocks v0.4.1/go.mod h1:LTp+uSrOhSkaKrUy935gNZuuIPPVsHlr9DSOxSayd+k= -github.com/Azure/go-autorest/logger v0.2.0/go.mod h1:T9E3cAhj2VqvPOtCYAvby9aBXkZmbF5NWuPV8+WeEW8= github.com/Azure/go-autorest/logger v0.2.1 h1:IG7i4p/mDa2Ce4TRyAO8IHnVhAVF3RFU+ZtXWSmf4Tg= github.com/Azure/go-autorest/logger v0.2.1/go.mod h1:T9E3cAhj2VqvPOtCYAvby9aBXkZmbF5NWuPV8+WeEW8= github.com/Azure/go-autorest/tracing v0.6.0 h1:TYi4+3m5t6K48TGI9AUdb+IzbnSxvnvUMfuitfgcfuo= @@ -80,11 +78,26 @@ github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk5 github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239/go.mod h1:2FmKhYUyUczH0OGQWaF5ceTx0UBShxjsH6f8oGKYe2c= github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY= github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o= +github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8= github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY= github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8= +github.com/armosec/armoapi-go v0.0.2/go.mod h1:vIK17yoKbJRQyZXWWLe3AqfqCRITxW8qmSkApyq5xFs= +github.com/armosec/armoapi-go v0.0.5 h1:ylPEKGXvQoaSfUDwegBFMhG0IWUECX4Ma+csosXDJgA= +github.com/armosec/armoapi-go v0.0.5/go.mod h1:vIK17yoKbJRQyZXWWLe3AqfqCRITxW8qmSkApyq5xFs= +github.com/armosec/k8s-interface v0.0.2 h1:Xw7HbQLNO9DN4NlD486VgXPwVpMFFxxwTlrVkcpsn5M= +github.com/armosec/k8s-interface v0.0.2/go.mod h1:xxS+V5QT3gVQTwZyAMMDrYLWGrfKOpiJ7Jfhfa0w9sM= +github.com/armosec/opa-utils v0.0.1 h1:RwaHWLK2dBnW57++mzttzGge2AQc//dwVP9bhO9BToI= +github.com/armosec/opa-utils v0.0.1/go.mod h1:4e8ISMdB12Xdn0ripkeiwOqyF4i9d/QB8+Gj0a6YRq0= +github.com/armosec/utils-go v0.0.2/go.mod h1:itWmRLzRdsnwjpEOomL0mBWGnVNNIxSjDAdyc+b0iUo= +github.com/armosec/utils-go v0.0.3 h1:uyQI676yRciQM0sSN9uPoqHkbspTxHO0kmzXhBeE/xU= +github.com/armosec/utils-go v0.0.3/go.mod h1:itWmRLzRdsnwjpEOomL0mBWGnVNNIxSjDAdyc+b0iUo= +github.com/armosec/utils-k8s-go v0.0.1 h1:Ay3y7fW+4+FjVc0+obOWm8YsnEvM31vPAVoKTyTAFRk= +github.com/armosec/utils-k8s-go v0.0.1/go.mod h1:qrU4pmY2iZsOb39Eltpm0sTTNM3E4pmeyWx4dgDUC2U= github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY= -github.com/aws/aws-sdk-go v1.40.30 h1:Zq1YYIr002ymVe3QjLFgIaPefi/ia+tXs1mXNAn2RN8= -github.com/aws/aws-sdk-go v1.40.30/go.mod h1:585smgzpB/KqRA+K3y/NL/oYRqQvpNJYvLm+LY1U59Q= +github.com/aws/aws-sdk-go v1.41.1 h1:TR9j7i73tzV8ELPMc0LkImSRLljRJ+gQeArKBC7IfVE= +github.com/aws/aws-sdk-go v1.41.1/go.mod h1:585smgzpB/KqRA+K3y/NL/oYRqQvpNJYvLm+LY1U59Q= +github.com/benbjohnson/clock v1.0.3/go.mod h1:bGMdMPoPVvcYyt1gHDf4J2KE153Yf9BuiUKYMaxlTDM= +github.com/benbjohnson/clock v1.1.0 h1:Q92kusRqC1XV2MjkWETPvjJVqKetz1OzxZB7mHJLju8= github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA= github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q= github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8= @@ -97,11 +110,16 @@ github.com/bradfitz/go-smtpd v0.0.0-20170404230938-deb6d6237625/go.mod h1:HYsPBT github.com/briandowns/spinner v1.16.0 h1:DFmp6hEaIx2QXXuqSJmtfSBSAjRmpGiKG6ip2Wm/yOs= github.com/briandowns/spinner v1.16.0/go.mod h1:QOuQk7x+EaDASo80FEXwlwiA+j/PPIcX3FScO+3/ZPQ= github.com/buger/jsonparser v0.0.0-20181115193947-bf1c66bbce23/go.mod h1:bbYlZJ7hK1yFx9hf58LP0zeX7UjIGs20ufpu3evjr+s= -github.com/bytecodealliance/wasmtime-go v0.28.0 h1:JTWP482wkmR79O9T0JiIAllPqmNW5oP0v56v/FwCpaQ= -github.com/bytecodealliance/wasmtime-go v0.28.0/go.mod h1:q320gUxqyI8yB+ZqRuaJOEnGkAnHh6WtJjMaT2CW4wI= +github.com/bytecodealliance/wasmtime-go v0.30.0 h1:WfYpr4WdqInt8m5/HvYinf+HrSEAIhItKIcth+qb1h4= +github.com/bytecodealliance/wasmtime-go v0.30.0/go.mod h1:q320gUxqyI8yB+ZqRuaJOEnGkAnHh6WtJjMaT2CW4wI= github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU= +github.com/certifi/gocertifi v0.0.0-20191021191039-0944d244cd40/go.mod h1:sGbDF6GwGcLpkNXPUTkMRoywsNa/ol15pxFe6ERfguA= +github.com/certifi/gocertifi v0.0.0-20200922220541-2c3bb06c6054/go.mod h1:sGbDF6GwGcLpkNXPUTkMRoywsNa/ol15pxFe6ERfguA= +github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko= github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc= github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= +github.com/cespare/xxhash/v2 v2.1.2 h1:YRXhKfTDauu4ajMg1TPgFO5jnlC2HCbmLXMcTG5cbYE= +github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI= github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI= github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU= @@ -109,37 +127,45 @@ github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDk github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc= github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk= github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk= -github.com/cockroachdb/datadriven v0.0.0-20190809214429-80d97fb3cbaa/go.mod h1:zn76sxSg3SzpJ0PPJaLDCu+Bu0Lg3sKTORVIj19EIF8= +github.com/cockroachdb/datadriven v0.0.0-20200714090401-bf6692d28da5/go.mod h1:h6jFvWxBdQXxjopDMZyH2UVceIRfR84bdzbkoKrsWNo= +github.com/cockroachdb/errors v1.2.4/go.mod h1:rQD95gz6FARkaKkQXUksEje/d9a6wBJoCr5oaCLELYA= +github.com/cockroachdb/logtags v0.0.0-20190617123548-eb05cc24525f/go.mod h1:i/u985jwjWRlyHXQbwatDASoW0RMlZ/3i9yJHE2xLkI= github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk= +github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE= github.com/coreos/etcd v3.3.13+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE= +github.com/coreos/go-etcd v2.0.0+incompatible/go.mod h1:Jez6KQU2B/sWsbdaef3ED8NzMklzPG4d5KIOhIy30Tk= github.com/coreos/go-oidc v2.1.0+incompatible/go.mod h1:CgnwVTmzoESiwO9qyAFEMiHoZ1nMCKZlZ9V6mm3/LKc= github.com/coreos/go-oidc v2.2.1+incompatible h1:mh48q/BqXqgjVHpy2ZY7WnWAbenxRjsz9N1i1YxjHAk= github.com/coreos/go-oidc v2.2.1+incompatible/go.mod h1:CgnwVTmzoESiwO9qyAFEMiHoZ1nMCKZlZ9V6mm3/LKc= github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk= github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk= -github.com/coreos/go-systemd v0.0.0-20180511133405-39ca1b05acc7/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4= github.com/coreos/go-systemd v0.0.0-20181012123002-c6f51f82210d/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4= github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4= github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc= -github.com/coreos/pkg v0.0.0-20160727233714-3ac0863d7acf/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA= github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA= +github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwcJI5acqYI6dE= github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU= -github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY= github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= github.com/creack/pty v1.1.11/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/dgraph-io/badger/v3 v3.2103.1 h1:zaX53IRg7ycxVlkd5pYdCeFp1FynD6qBGQoQql3R3Hk= +github.com/dgraph-io/badger/v3 v3.2103.1/go.mod h1:dULbq6ehJ5K0cGW/1TQ9iSfUk0gbSiToDWmWmTsJ53E= +github.com/dgraph-io/ristretto v0.1.0 h1:Jv3CGQHp9OjuMBSne1485aDpUkTKEcUqF+jm/LuerPI= +github.com/dgraph-io/ristretto v0.1.0/go.mod h1:fux0lOrBhrVCJd3lcTHsIJhq1T2rokOu6v9Vcb3Q9ug= github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ= +github.com/dgryski/go-farm v0.0.0-20190423205320-6a90982ecee2/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw= +github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw= github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no= -github.com/docker/docker v20.10.8+incompatible h1:RVqD337BgQicVCzYrrlhLDWhq6OAD2PJDUg2LsEUvKM= -github.com/docker/docker v20.10.8+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk= +github.com/docker/docker v20.10.9+incompatible h1:JlsVnETOjM2RLQa0Cc1XCIspUdXW3Zenq9P54uXBm6k= +github.com/docker/docker v20.10.9+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk= github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ= github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec= github.com/docker/go-units v0.4.0 h1:3uh0PgVws3nIA0Q+MwDC8yjEPf9zjRfZZWXZYDct3Tw= github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk= github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE= -github.com/dustin/go-humanize v0.0.0-20171111073723-bb3d318650d4/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk= +github.com/dustin/go-humanize v1.0.0 h1:VSnTsYCnlFHaM2/igO1h6X3HA71jcobQuxemgkq4zYo= github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk= github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc= github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs= @@ -154,12 +180,12 @@ github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.m github.com/envoyproxy/go-control-plane v0.9.9-0.20210217033140-668b12f5399d/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk= github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c= github.com/evanphx/json-patch v0.5.2/go.mod h1:ZWS5hhDbVDyob71nXKNL0+PWn6ToqBHMikGIFbs31qQ= -github.com/evanphx/json-patch v4.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk= github.com/evanphx/json-patch v4.11.0+incompatible h1:glyUF9yIYtMHzn8xaKw5rMhdWcwsYV8dZHIq5567/xs= github.com/evanphx/json-patch v4.11.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk= github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4= github.com/fatih/color v1.12.0 h1:mRhaKNwANqRgUBGKmnI5ZxEk7QXmjQeCcuYFMX2bfcc= github.com/fatih/color v1.12.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM= +github.com/felixge/httpsnoop v1.0.1/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc= github.com/form3tech-oss/jwt-go v3.2.2+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k= github.com/form3tech-oss/jwt-go v3.2.3+incompatible h1:7ZaBxOI7TMoYBfyA3cQHErNNyAWIKUMIwqxEtgHOs5c= @@ -169,8 +195,10 @@ github.com/fortytw2/leaktest v1.3.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHqu github.com/francoispqt/gojay v1.2.13 h1:d2m3sFjloqoIUQU3TsHBgj6qg/BVGlTBeHDUmyJnXKk= github.com/francoispqt/gojay v1.2.13/go.mod h1:ehT5mTG4ua4581f1++1WLG0vPdaA9HaiDsoyrBGkyDY= github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo= -github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4= github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ= +github.com/fsnotify/fsnotify v1.5.1 h1:mZcQUHVQUQWoPXXtuf9yuEXKudkV2sx1E06UadKWpgI= +github.com/fsnotify/fsnotify v1.5.1/go.mod h1:T3375wBYaZdLLcVNkcVbzGHY7f1l/uK5T5Ai1i3InKU= +github.com/getsentry/raven-go v0.2.0/go.mod h1:KungGk8q33+aIAZUIVWZDr2OfAEBsO49PX4NzFV5kcQ= github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk= github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04= github.com/gliderlabs/ssh v0.1.1/go.mod h1:U7qILu1NlMHj9FlMhZLlkCdDnU1DBEAqr0aevW3Awn0= @@ -190,14 +218,12 @@ github.com/go-logr/logr v0.4.0 h1:K7/B1jt6fIBQVd4Owv2MqGQClcgf0R266+7C/QjRcLc= github.com/go-logr/logr v0.4.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU= github.com/go-logr/zapr v0.4.0 h1:uc1uML3hRYL9/ZZPdgHS/n8Nzo+eaYL/Efxkkamf7OM= github.com/go-logr/zapr v0.4.0/go.mod h1:tabnROwaDl0UNxkVeFRbY8bwB37GwRv0P8lg6aAiEnk= -github.com/go-openapi/jsonpointer v0.19.2/go.mod h1:3akKfEdA7DF1sugOqz1dVQHBcuDBPKZGEoHC/NkiQRg= github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg= -github.com/go-openapi/jsonreference v0.19.2/go.mod h1:jMjeRr2HHw6nAVajTXJ4eiUwohSTlpa0o73RUL1owJc= +github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg= github.com/go-openapi/jsonreference v0.19.3/go.mod h1:rjx6GuL8TTa9VaixXglHmQmIL98+wF9xc8zWvFonSJ8= -github.com/go-openapi/spec v0.19.3/go.mod h1:FpwSN1ksY1eteniUU7X0N/BgJ7a4WvBFVA8Lj9mJglo= -github.com/go-openapi/spec v0.19.5/go.mod h1:Hm2Jr4jv8G1ciIAo+frC/Ft+rR2kQDh8JHKHb3gWUSk= -github.com/go-openapi/swag v0.19.2/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk= +github.com/go-openapi/jsonreference v0.19.5/go.mod h1:RdybgQwPxbL4UEjuAruzK1x3nE69AqPYEJeo/TWfEeg= github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk= +github.com/go-openapi/swag v0.19.14/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ= github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY= github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE= github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y= @@ -207,16 +233,17 @@ github.com/gofrs/uuid v4.0.0+incompatible h1:1SD/1F5pU8p29ybwgQSwpQk+mwdRrXCYuPh github.com/gofrs/uuid v4.0.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM= github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ= github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4= +github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o= github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q= github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q= github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q= github.com/golang/glog v1.0.0 h1:nfP3RFugxnNRyKgeWd4oI1nYvXpxrx8ck8ZrcizshdQ= github.com/golang/glog v1.0.0/go.mod h1:EWib/APOK0SL3dFbYqvxE3UYd8E6s1ouQ7iEp/0LWV4= -github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= +github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE= github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= github.com/golang/lint v0.0.0-20180702182130-06c8688daad7/go.mod h1:tluoj9z5200jBnyusfRPU2LqT6J+DAorxEvtC7LHB+E= github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A= @@ -245,9 +272,15 @@ github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaS github.com/golang/protobuf v1.5.1/go.mod h1:DopwsBzvsk0Fs44TXzsVbJyPhcCPeIwnvohx4u74HPM= github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw= github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY= +github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q= +github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM= +github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q= github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ= github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ= github.com/google/btree v1.0.1/go.mod h1:xXMiIv4Fb/0kKde4SpL7qlzvu5cMJDRkFDxJfI9uaxA= +github.com/google/flatbuffers v1.12.0/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8= +github.com/google/flatbuffers v1.12.1 h1:MVlul7pQNoDzWRLTw5imwYsl+usrS1TXG2H4jg6ImGw= +github.com/google/flatbuffers v1.12.1/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8= github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M= github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= @@ -280,28 +313,24 @@ github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2/go.mod h1:kpwsk12EmLe github.com/google/pprof v0.0.0-20210122040257-d980be63207e/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE= github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE= github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI= -github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/googleapis/gax-go v2.0.0+incompatible/go.mod h1:SFVmujtThgffbyetf+mdk2eWhX2bMyUtNHzFKcPA9HY= github.com/googleapis/gax-go/v2 v2.0.3/go.mod h1:LLvjysVCY1JZeum8Z6l8qUty8fiNwE08qbEPm1M08qg= github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg= github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk= -github.com/googleapis/gnostic v0.4.1/go.mod h1:LRhVm6pbyptWbWbuZ38d1eyptfvIytN3ir6b65WBswg= github.com/googleapis/gnostic v0.5.1/go.mod h1:6U4PtQXGIEt/Z3h5MAT7FNofLnw9vXk2cUuW7uA/OeU= github.com/googleapis/gnostic v0.5.5 h1:9fHAtK0uDfpveeqqo1hkEZJcFvYXAiCN3UutL8F9xHw= github.com/googleapis/gnostic v0.5.5/go.mod h1:7+EbHbldMins07ALC74bsA81Ovc97DwqyJO1AENw9kA= github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY= github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So= -github.com/gorilla/websocket v0.0.0-20170926233335-4201258b820c/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ= github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE= github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA= github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs= -github.com/grpc-ecosystem/go-grpc-middleware v1.0.1-0.20190118093823-f849b5445de4/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs= +github.com/grpc-ecosystem/go-grpc-middleware v1.3.0/go.mod h1:z0ButlSOZa5vEBq9m2m2hlwIgKw+rp3sdCBRoJY+30Y= github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk= github.com/grpc-ecosystem/grpc-gateway v1.5.0/go.mod h1:RSKVYQBd5MCa4OVpNdGskqpgL2+G+NZTnrVHpWWfpdw= github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY= -github.com/grpc-ecosystem/grpc-gateway v1.9.5/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY= github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw= github.com/hashicorp/consul/api v1.1.0/go.mod h1:VmuI/Lkw1nC05EYQWNKwWGbkg+FbDBtguAZLlVdkD9Q= github.com/hashicorp/consul/sdk v0.1.1/go.mod h1:VKf9jXwCTEY1QZP2MOLRhb5i/I/ssyNV1vwHyQBF0x8= @@ -318,7 +347,6 @@ github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/b github.com/hashicorp/go.net v0.0.1/go.mod h1:hjKkEWcCURg++eb33jQU7oqQcI9XDCnUzHA0oac0k90= github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8= github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8= -github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4= github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ= github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64= github.com/hashicorp/mdns v1.0.0/go.mod h1:tL+uN++7HEJ6SQLQ2/p+z2pH24WQKWjBPkE0mNTz8vQ= @@ -339,9 +367,10 @@ github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHW github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8= github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U= github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo= +github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8= +github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y= github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4= github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU= -github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4= github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4= github.com/json-iterator/go v1.1.11 h1:uVUAXhF2To8cbw/3xN3pxj6kk7TYKs98NIrTqPlMWAQ= github.com/json-iterator/go v1.1.11/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4= @@ -351,8 +380,12 @@ github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfV github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w= github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM= github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q= +github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= +github.com/klauspost/compress v1.12.3/go.mod h1:8dP1Hq4DHOhN9w426knH3Rhby4rFm6D8eO+e+Dq5Gzg= +github.com/klauspost/compress v1.13.5 h1:9O69jUPDcsT9fEm74W92rZL9FQY7rCdaXVneq+yyzl4= +github.com/klauspost/compress v1.13.5/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk= github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ= github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ= github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg= @@ -361,28 +394,26 @@ github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORN github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI= github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/pty v1.1.3/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= -github.com/kr/pty v1.1.5/go.mod h1:9r2w37qlBe7rQ6e1fg1S/9xpWHSnaqNdHD3WcMdbPDA= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= github.com/lunixbochs/vtclean v1.0.0/go.mod h1:pHhQNgMf3btfWnGBVipUOjRYhoOsdGqdm/+2c2E2WMI= +github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ= github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ= github.com/magiconair/properties v1.8.5/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60= github.com/mailru/easyjson v0.0.0-20190312143242-1de009706dbe/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc= github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc= github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc= -github.com/mailru/easyjson v0.7.0/go.mod h1:KAzv3t3aY1NaHWoQz1+4F1ccyAH66Jk7yos7ldAVICs= +github.com/mailru/easyjson v0.7.6/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc= github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU= github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE= github.com/mattn/go-colorable v0.1.8 h1:c1ghPdyEDarC70ftn0y+A/Ee++9zz8ljHG1b13eJ0s8= github.com/mattn/go-colorable v0.1.8/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc= github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4= -github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4= github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s= github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU= github.com/mattn/go-isatty v0.0.13 h1:qdl+GuBjcsKKDco5BsxPJlId98mSWNKqYA+Co0SC1yA= github.com/mattn/go-isatty v0.0.13/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU= -github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU= github.com/mattn/go-runewidth v0.0.9 h1:Lm995f3rfxdpd6TSmuVCHVb/QhupuXlYr8sCI/QdE+0= github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI= github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0= @@ -399,7 +430,7 @@ github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:F github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y= github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo= github.com/moby/spdystream v0.2.0/go.mod h1:f7i0iNDQJ059oMTcWxx8MA/zKFIuD/lY+0GqbN2Wy8c= -github.com/moby/term v0.0.0-20201216013528-df9cb8a40635/go.mod h1:FBS0z0QWA44HXygs7VXDUOGoN/1TV3RuWkLO04am3wc= +github.com/moby/term v0.0.0-20210610120745-9d4ed1856297/go.mod h1:vgPCkQMyxTZ7IDy8SXRufE172gr8+K/JE/7hHFxHW3A= github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg= github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= @@ -419,28 +450,26 @@ github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE= github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU= github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U= -github.com/olekukonko/tablewriter v0.0.0-20170122224234-a0225b3f23b5/go.mod h1:vsDQFd/mU46D+Z4whnwzcISnGGzXWMclvtLoiIKAKIo= github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec= github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY= github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= -github.com/onsi/ginkgo v1.11.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk= github.com/onsi/ginkgo v1.14.0/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY= github.com/onsi/ginkgo v1.16.4 h1:29JGrr5oVBm5ulCWet69zQkzWipVXIol6ygQUe/EzNc= github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0= github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA= -github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY= github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY= github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo= -github.com/onsi/gomega v1.14.0 h1:ep6kpPVwmr/nTbklSx2nrLNSIO62DoYAhnPNIMhK8gI= -github.com/onsi/gomega v1.14.0/go.mod h1:cIuvLEne0aoVhAgh/O6ac0Op8WWw9H6eYCriF+tEHG0= -github.com/open-policy-agent/opa v0.31.0 h1:sVxgdUZz426hpPfeIP+XGIwy8yfVkETerRojY3nQTc4= -github.com/open-policy-agent/opa v0.31.0/go.mod h1:aeLYiWaZe9ikcX67qLzmtRTOxj7psNYh6YGTbTW6V+s= +github.com/onsi/gomega v1.15.0 h1:WjP/FQ/sk43MRmnEcT+MlDw2TFvkrXlprrPST/IudjU= +github.com/onsi/gomega v1.15.0/go.mod h1:cIuvLEne0aoVhAgh/O6ac0Op8WWw9H6eYCriF+tEHG0= +github.com/open-policy-agent/opa v0.33.1 h1:EJe00U5H82iMsemgxcNm9RFwjW8zPyRMvL+0upg8+Yo= +github.com/open-policy-agent/opa v0.33.1/go.mod h1:Zb+IdRe0s7M++Rv/KgyuB0qvxO3CUpQ+ZW5v+w/cRUo= github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U= github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM= github.com/opencontainers/image-spec v1.0.1 h1:JMemWkRwHx4Zj+fVxWoMCFm/8sYGGrUVojFA6h/TRcI= github.com/opencontainers/image-spec v1.0.1/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0= +github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o= github.com/openzipkin/zipkin-go v0.1.1/go.mod h1:NtoC/o8u3JlF1lSlyPNswIbeQH9bJTmOf0Erfk+hxe8= github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc= github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic= @@ -455,8 +484,9 @@ github.com/pkg/sftp v1.10.1/go.mod h1:lYOWFsE0bwd1+KfKJaKeuokY15vzFx25BLbzYYoAxZ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI= -github.com/pquerna/cachecontrol v0.0.0-20171018203845-0dec1b30a021 h1:0XM1XL/OFFJjXsYXlG30spTkV/E9+gmd5GD1w2HE8xM= github.com/pquerna/cachecontrol v0.0.0-20171018203845-0dec1b30a021/go.mod h1:prYjPmNq4d1NPVmpShWobRqXY3q7Vp+80DqgxxUrUIA= +github.com/pquerna/cachecontrol v0.1.0 h1:yJMy84ti9h/+OEWa752kBTKv4XC30OtVVHYv/8cTqKc= +github.com/pquerna/cachecontrol v0.1.0/go.mod h1:NrUG3Z7Rdu85UNR3vm7SOsl1nFIeSiQnrHV5K9mBcUI= github.com/prometheus/client_golang v0.8.0/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw= github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw= github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDft0ttaMvbicHlPoso= @@ -479,7 +509,6 @@ github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA= github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA= github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU= -github.com/prometheus/procfs v0.2.0/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU= github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA= github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU= github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0 h1:MkV+77GLUNo5oJ0jf870itWm3D0Sjh7+Za9gazKc5LQ= @@ -525,31 +554,32 @@ github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc= github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA= github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM= +github.com/soheilhy/cmux v0.1.5/go.mod h1:T7TcVDs9LWfQgPlPsdngu6I6QIoyIFZDDC6sNE1GqG0= github.com/sourcegraph/annotate v0.0.0-20160123013949-f4cad6c6324d/go.mod h1:UdhH50NIW0fCiwBSr0co2m7BnFLdv4fQTgdqdJTHFeE= github.com/sourcegraph/syntaxhighlight v0.0.0-20170531221838-bd320f5d308e/go.mod h1:HuIsMU8RRBOtsCgI77wP899iHVBQpCmg4ErYMZB+2IA= github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA= +github.com/spaolacci/murmur3 v1.1.0/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA= github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ= github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk= github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z93I= github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE= github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE= -github.com/spf13/cobra v0.0.3/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ= -github.com/spf13/cobra v1.1.1/go.mod h1:WnodtKOvamDL/PwE2M4iKs8aMDBZ5Q5klgD3qfVJQMI= +github.com/spf13/cobra v0.0.5/go.mod h1:3K3wKZymM7VvHMDS9+Akkh4K60UwM26emMESw8tLCHU= +github.com/spf13/cobra v1.1.3/go.mod h1:pGADOWyqRD/YMrPZigI/zbliZ2wVD/23d+is3pSWzOo= github.com/spf13/cobra v1.2.1 h1:+KmjbUw1hriSNMF55oPrkZcb27aECyrj8V2ytv7kWDw= github.com/spf13/cobra v1.2.1/go.mod h1:ExllRjgxM/piMAM+3tAZvg8fsklGAf3tPfi+i8t68Nk= github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo= github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo= github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4= -github.com/spf13/pflag v1.0.1/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4= github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4= github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA= github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= +github.com/spf13/viper v1.3.2/go.mod h1:ZiWeW+zYFKm7srdB9IoDzzZXaJaI5eL9QjNiN/DMA2s= github.com/spf13/viper v1.7.0/go.mod h1:8WkrPz2fc9jxqZNCJI/76HCieCp4Q8HaLFoCha5qpdg= github.com/spf13/viper v1.8.1/go.mod h1:o0Pch8wJ9BVSWGQMbra6iw0oQ5oktSIBaujf1rJH9Ns= github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= -github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE= github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4= @@ -559,9 +589,9 @@ github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5Cc github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw= github.com/tarm/serial v0.0.0-20180830185346-98f6abe2eb07/go.mod h1:kDXzergiv9cbyO7IOYJZWg1U88JhDg3PB6klq9Hg2pA= -github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U= github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U= -github.com/urfave/cli v1.20.0/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA= +github.com/tmc/grpc-websocket-proxy v0.0.0-20201229170055-e5319fda7802/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U= +github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0= github.com/viant/assertly v0.4.8/go.mod h1:aGifi++jvCrUaklKEKT0BU95igDNaqkvz+49uaYMPRU= github.com/viant/toolbox v0.24.0/go.mod h1:OxMCG57V0PXuIP2HNQrtJf2CjqdmbrOx5EkMILuUhzM= github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo= @@ -569,6 +599,7 @@ github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2 github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0= github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ= github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU= +github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q= github.com/yashtewari/glob-intersection v0.0.0-20180916065949-5c77d914dd0b h1:vVRagRXf67ESqAb72hG2C/ZwI8NtJF2u2V76EsuOHGY= github.com/yashtewari/glob-intersection v0.0.0-20180916065949-5c77d914dd0b/go.mod h1:HptNXiXVDcJjXe9SqMd0v2FsL9f8dz4GnXgltU6q/co= github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= @@ -577,12 +608,14 @@ github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k= go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU= -go.etcd.io/bbolt v1.3.3/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU= -go.etcd.io/bbolt v1.3.5/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ= -go.etcd.io/etcd v0.5.0-alpha.5.0.20200910180754-dd1b699fc489/go.mod h1:yVHk9ub3CSBatqGNg7GRmsnfLWtoW60w4eDYfh7vHDg= +go.etcd.io/bbolt v1.3.6/go.mod h1:qXsaaIqmgQH0T+OPdb99Bf+PKfBBQVAdyD6TY9G8XM4= go.etcd.io/etcd/api/v3 v3.5.0/go.mod h1:cbVKeC6lCfl7j/8jBhAK6aIYO9XOjdptoxU/nLQcPvs= go.etcd.io/etcd/client/pkg/v3 v3.5.0/go.mod h1:IJHfcCEKxYu1Os13ZdwCwIUTUVGYTSAM3YSwc9/Ac1g= go.etcd.io/etcd/client/v2 v2.305.0/go.mod h1:h9puh54ZTgAKtEbut2oe9P4L/oqKCVB6xsXlzd7alYQ= +go.etcd.io/etcd/client/v3 v3.5.0/go.mod h1:AIKXXVX/DQXtfTEqBryiLTUXwON+GuvO6Z7lLS/oTh0= +go.etcd.io/etcd/pkg/v3 v3.5.0/go.mod h1:UzJGatBQ1lXChBkQF0AuAtkRQMYnHubxAEYIrC3MSsE= +go.etcd.io/etcd/raft/v3 v3.5.0/go.mod h1:UFOHSIvO/nKwd4lhkwabrTD3cqW5yVyYYf/KlD00Szc= +go.etcd.io/etcd/server/v3 v3.5.0/go.mod h1:3Ah5ruV+M+7RZr0+Y/5mNLwC+eQlni+mQmOVdCRJoS4= go.opencensus.io v0.18.0/go.mod h1:vKdFvxhtzZ9onBp9VKHK8z/sRpBMnKAsufL7wlDrCOA= go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU= go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8= @@ -590,30 +623,45 @@ go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw= go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw= go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw= go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk= +go.opencensus.io v0.23.0 h1:gqCw0LfLxScz8irSi8exQc7fyQ0fKQU/qnC/X8+V/1M= go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E= -go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE= +go.opentelemetry.io/contrib v0.20.0/go.mod h1:G/EtFaa6qaN7+LxqfIAT3GiZa7Wv5DTBUzl5H4LY0Kc= +go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.20.0/go.mod h1:oVGt1LRbBOBq1A5BQLlUg9UaU/54aiHw8cgjV3aWZ/E= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.20.0/go.mod h1:2AboqHi0CiIZU0qwhtUfCYD1GeUzvvIXWNkhDt7ZMG4= +go.opentelemetry.io/otel v0.20.0/go.mod h1:Y3ugLH2oa81t5QO+Lty+zXf8zC9L26ax4Nzoxm/dooo= +go.opentelemetry.io/otel/exporters/otlp v0.20.0/go.mod h1:YIieizyaN77rtLJra0buKiNBOm9XQfkPEKBeuhoMwAM= +go.opentelemetry.io/otel/metric v0.20.0/go.mod h1:598I5tYlH1vzBjn+BTuhzTCSb/9debfNp6R3s7Pr1eU= +go.opentelemetry.io/otel/oteltest v0.20.0/go.mod h1:L7bgKf9ZB7qCwT9Up7i9/pn0PWIa9FqQ2IQ8LoxiGnw= +go.opentelemetry.io/otel/sdk v0.20.0/go.mod h1:g/IcepuwNsoiX5Byy2nNV0ySUF1em498m7hBWC279Yc= +go.opentelemetry.io/otel/sdk/export/metric v0.20.0/go.mod h1:h7RBNMsDJ5pmI1zExLi+bJK+Dr8NQCh0qGhm1KDnNlE= +go.opentelemetry.io/otel/sdk/metric v0.20.0/go.mod h1:knxiS8Xd4E/N+ZqKmUPf3gTTZ4/0TjTXukfxjzSTpHE= +go.opentelemetry.io/otel/trace v0.20.0/go.mod h1:6GjCW8zgDjwGHGa6GkyeB8+/5vjT16gUEi0Nf1iBdgw= +go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI= go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE= go.uber.org/atomic v1.7.0 h1:ADUqmZGgLDDfbSL9ZmPxKTybcoEYHgpYfELNoN+7hsw= go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc= go.uber.org/automaxprocs v1.4.0/go.mod h1:/mTEdr7LvHhs0v7mjdxDreTz1OG5zdZGqgOnhWiR/+Q= go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A= +go.uber.org/goleak v1.1.11-0.20210813005559-691160354723 h1:sHOAIxRGBp443oHZIPB+HsUGaksVCXVQENPxwTfQdH4= +go.uber.org/goleak v1.1.11-0.20210813005559-691160354723/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ= go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0= go.uber.org/multierr v1.6.0 h1:y6IPFStTAIT5Ytl7/XYmHvzXQ7S3g/IeZW9hyZ5thw4= go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU= go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q= go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo= -go.uber.org/zap v1.18.1 h1:CSUJ2mjFszzEWt4CdKISEuChVIXGBn3lAPwkRGyVrc4= -go.uber.org/zap v1.18.1/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI= +go.uber.org/zap v1.19.0/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI= +go.uber.org/zap v1.19.1 h1:ue41HOKd1vGURxrmeKIgELGb3jPW9DMUDGtsinblHwI= +go.uber.org/zap v1.19.1/go.mod h1:j3DNczoxDZroyBnOT1L/Q79cfUMGZxlv/9dzN7SM1rI= go4.org v0.0.0-20180809161055-417644f6feb5/go.mod h1:MkTOUMDaeVYJUOUsaDXIhWPZYa1yOyC1qaOBpL57BhE= golang.org/x/build v0.0.0-20190111050920-041ab4dc3f9d/go.mod h1:OWs+y06UdEOHN4y+MfF/py+xQ/tYqIWW03b70/CG9Rw= golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= golang.org/x/crypto v0.0.0-20181029021203-45a5f77698d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= golang.org/x/crypto v0.0.0-20181030102418-4d3f4d9ffa16/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= +golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20190313024323-a1f597ede03a/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= -golang.org/x/crypto v0.0.0-20190611184440-5c40567a22f8/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= @@ -653,7 +701,6 @@ golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzB golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/mod v0.3.1-0.20200828183125-ce943fd02449/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= @@ -678,7 +725,6 @@ golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLL golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= -golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= @@ -698,17 +744,18 @@ golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81R golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= +golang.org/x/net v0.0.0-20201202161906-c7110b5ffcbb/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= -golang.org/x/net v0.0.0-20210224082022-3d97a244fca7/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLdyRGr576XBO4/greRjx4P4O3yc= golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM= golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk= golang.org/x/net v0.0.0-20210520170846-37e1c6afe023/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= -golang.org/x/net v0.0.0-20210614182718-04defd469f4e h1:XpT3nA5TvE525Ne3hInMh6+GETgn27Zfm9dxsThnX2Q= golang.org/x/net v0.0.0-20210614182718-04defd469f4e/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= +golang.org/x/net v0.0.0-20210825183410-e898025ed96a h1:bRuuGXV8wwSdGTB+CtJf+FjgO1APK1CoO39T4BN/XBw= +golang.org/x/net v0.0.0-20210825183410-e898025ed96a/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20181017192945-9dcd33a902f4/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20181203162652-d668ce993890/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= @@ -724,8 +771,8 @@ golang.org/x/oauth2 v0.0.0-20210220000619-9bb904979d93/go.mod h1:KelEdhl1UZF7XfJ golang.org/x/oauth2 v0.0.0-20210313182246-cd4f82c27b84/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= golang.org/x/oauth2 v0.0.0-20210402161424-2e8d93401602/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= -golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f h1:Qmd2pbz05z7z6lm0DrgQVVPuBm92jqujBKMHMOlOQEw= -golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= +golang.org/x/oauth2 v0.0.0-20211005180243-6b3c2da341f1 h1:B333XXssMuKQeBwiNODx4TupZy7bf4sxFZnN2ZOcvUE= +golang.org/x/oauth2 v0.0.0-20211005180243-6b3c2da341f1/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= golang.org/x/perf v0.0.0-20180704124530-6e6d33e29852/go.mod h1:JLpeXjPJfIyPr5TlbXLkXWLhP8nz10XfvxElABhCtcw= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -746,6 +793,7 @@ golang.org/x/sys v0.0.0-20181026203630-95b1ffbd15a5/go.mod h1:STP8DvDyc/dI5b8T5h golang.org/x/sys v0.0.0-20181029174526-d69651ed3497/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20181107165924-66b7b1311ac8/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= +golang.org/x/sys v0.0.0-20181205085412-a5c9d58dba9a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -755,10 +803,8 @@ golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20190616124812-15dcb6c0061f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -786,6 +832,7 @@ golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200831180312-196b9ba8737a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200923182605-d9f96fdee20d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -800,12 +847,13 @@ golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210426230700-d19ff857e887/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c h1:F1jZWGFhYfh0Ci55sIpILtKKK8p3i2/krTr0H1rg74I= golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20210817190340-bfb29a6856f2/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20210823070655-63515b42dcdf h1:2ucpDCmfkl8Bd/FsLtiD653Wf96cW37s+iGx93zsu4k= +golang.org/x/sys v0.0.0-20210823070655-63515b42dcdf/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d h1:SZxvLBoTP5yHO3Frd4z4vrF+DBX9vMVanchswa69toE= @@ -830,6 +878,7 @@ golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGm golang.org/x/tools v0.0.0-20180828015842-6cd1fcedba52/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20181030000716-a0a13e073c7b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= +golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY= golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs= @@ -840,7 +889,6 @@ golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBn golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q= golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q= golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc= -golang.org/x/tools v0.0.0-20190614205625-5aca471b1d59/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc= golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc= golang.org/x/tools v0.0.0-20190624222133-a101b041ded4/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc= golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc= @@ -885,6 +933,7 @@ golang.org/x/tools v0.0.0-20210105154028-b0ab187a4818/go.mod h1:emZCQorbCU4vsT4f golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0= golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= +golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= @@ -951,6 +1000,7 @@ google.golang.org/genproto v0.0.0-20200228133532-8c2c7df3a383/go.mod h1:55QSHmfG google.golang.org/genproto v0.0.0-20200305110556-506484158171/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= google.golang.org/genproto v0.0.0-20200312145019-da6875a35672/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= google.golang.org/genproto v0.0.0-20200331122359-1ee6d9798940/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= +google.golang.org/genproto v0.0.0-20200423170343-7949de9c1215/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= google.golang.org/genproto v0.0.0-20200430143042-b979b6f78d84/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= google.golang.org/genproto v0.0.0-20200511104702-f5ebc3bea380/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= @@ -963,7 +1013,6 @@ google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6D google.golang.org/genproto v0.0.0-20200904004341-0bd0a958aa1d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= google.golang.org/genproto v0.0.0-20201019141844-1ed22bb0c154/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= google.golang.org/genproto v0.0.0-20201109203340-2640f1f9cdfb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= -google.golang.org/genproto v0.0.0-20201110150050-8816d57aaa9a/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= google.golang.org/genproto v0.0.0-20201201144952-b05cb90ed32e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= google.golang.org/genproto v0.0.0-20201210142538-e3217bee35cc/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= @@ -995,6 +1044,7 @@ google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA5 google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU= google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU= google.golang.org/grpc v1.36.1/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU= +google.golang.org/grpc v1.37.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM= google.golang.org/grpc v1.38.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM= google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0= @@ -1007,15 +1057,15 @@ google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpAD google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4= google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c= google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw= -google.golang.org/protobuf v1.26.0 h1:bxAC2xTBsZGibn2RTntX0oH50xLsqy1OxA9tTL3p/lk= google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= +google.golang.org/protobuf v1.27.1 h1:SnqbnDw1V7RiZcXPx5MEeqPv2s79L9i7BJUlG/+RurQ= +google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU= gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= -gopkg.in/cheggaaa/pb.v1 v1.0.25/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qStrOgw= gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI= gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys= gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc= @@ -1024,8 +1074,9 @@ gopkg.in/ini.v1 v1.51.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k= gopkg.in/ini.v1 v1.62.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k= gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k= gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo= -gopkg.in/square/go-jose.v2 v2.2.2 h1:orlkJ3myw8CN1nVQHBFfloD+L3egixIa4FvUP6RosSA= gopkg.in/square/go-jose.v2 v2.2.2/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI= +gopkg.in/square/go-jose.v2 v2.6.0 h1:NGk74WTnPKBNUhNzQX7PYcTLUjoq7mzKk2OKbvwk2iI= +gopkg.in/square/go-jose.v2 v2.6.0/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI= gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ= gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw= gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7/go.mod h1:JAlM8MvJe8wmxCU4Bli9HhUf9+ttbYbLASfIpnQbh74= @@ -1054,43 +1105,35 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg= honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k= honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k= -k8s.io/api v0.21.3/go.mod h1:hUgeYHUbBp23Ue4qdX9tR8/ANi/g3ehylAqDn9NWVOg= -k8s.io/api v0.22.1 h1:ISu3tD/jRhYfSW8jI/Q1e+lRxkR7w9UwQEZ7FgslrwY= -k8s.io/api v0.22.1/go.mod h1:bh13rkTp3F1XEaLGykbyRD2QaTTzPm0e/BMd8ptFONY= -k8s.io/apiextensions-apiserver v0.21.3/go.mod h1:kl6dap3Gd45+21Jnh6utCx8Z2xxLm8LGDkprcd+KbsE= -k8s.io/apimachinery v0.21.3/go.mod h1:H/IM+5vH9kZRNJ4l3x/fXP/5bOPJaVP/guptnZPeCFI= -k8s.io/apimachinery v0.22.1 h1:DTARnyzmdHMz7bFWFDDm22AM4pLWTQECMpRTFu2d2OM= -k8s.io/apimachinery v0.22.1/go.mod h1:O3oNtNadZdeOMxHFVxOreoznohCpy0z6mocxbZr7oJ0= -k8s.io/apiserver v0.21.3/go.mod h1:eDPWlZG6/cCCMj/JBcEpDoK+I+6i3r9GsChYBHSbAzU= -k8s.io/client-go v0.21.3/go.mod h1:+VPhCgTsaFmGILxR/7E1N0S+ryO010QBeNCv5JwRGYU= -k8s.io/client-go v0.22.1 h1:jW0ZSHi8wW260FvcXHkIa0NLxFBQszTlhiAVsU5mopw= -k8s.io/client-go v0.22.1/go.mod h1:BquC5A4UOo4qVDUtoc04/+Nxp1MeHcVc1HJm1KmG8kk= -k8s.io/code-generator v0.21.3/go.mod h1:K3y0Bv9Cz2cOW2vXUrNZlFbflhuPvuadW6JdnN6gGKo= -k8s.io/component-base v0.21.3/go.mod h1:kkuhtfEHeZM6LkX0saqSK8PbdO7A0HigUngmhhrwfGQ= +k8s.io/api v0.22.2 h1:M8ZzAD0V6725Fjg53fKeTJxGsJvRbk4TEm/fexHMtfw= +k8s.io/api v0.22.2/go.mod h1:y3ydYpLJAaDI+BbSe2xmGcqxiWHmWjkEeIbiwHvnPR8= +k8s.io/apiextensions-apiserver v0.22.2/go.mod h1:2E0Ve/isxNl7tWLSUDgi6+cmwHi5fQRdwGVCxbC+KFA= +k8s.io/apimachinery v0.22.2 h1:ejz6y/zNma8clPVfNDLnPbleBo6MpoFy/HBiBqCouVk= +k8s.io/apimachinery v0.22.2/go.mod h1:O3oNtNadZdeOMxHFVxOreoznohCpy0z6mocxbZr7oJ0= +k8s.io/apiserver v0.22.2/go.mod h1:vrpMmbyjWrgdyOvZTSpsusQq5iigKNWv9o9KlDAbBHI= +k8s.io/client-go v0.22.2 h1:DaSQgs02aCC1QcwUdkKZWOeaVsQjYvWv8ZazcZ6JcHc= +k8s.io/client-go v0.22.2/go.mod h1:sAlhrkVDf50ZHx6z4K0S40wISNTarf1r800F+RlCF6U= +k8s.io/code-generator v0.22.2/go.mod h1:eV77Y09IopzeXOJzndrDyCI88UBok2h6WxAlBwpxa+o= +k8s.io/component-base v0.22.2/go.mod h1:5Br2QhI9OTe79p+TzPe9JKNQYvEKbq9rTJDWllunGug= k8s.io/gengo v0.0.0-20200413195148-3a45101e95ac/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0= k8s.io/gengo v0.0.0-20201214224949-b6c5ce23f027/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E= k8s.io/klog/v2 v2.0.0/go.mod h1:PBfzABfn139FHAV07az/IF9Wp1bkk3vpT2XSJ76fSDE= k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y= -k8s.io/klog/v2 v2.8.0/go.mod h1:hy9LJ/NvuK+iVyP4Ehqva4HxZG/oXyIS3n3Jmire4Ec= k8s.io/klog/v2 v2.9.0 h1:D7HV+n1V57XeZ0m6tdRkfknthUaM06VFbWldOFh8kzM= k8s.io/klog/v2 v2.9.0/go.mod h1:hy9LJ/NvuK+iVyP4Ehqva4HxZG/oXyIS3n3Jmire4Ec= -k8s.io/kube-openapi v0.0.0-20210305001622-591a79e4bda7/go.mod h1:wXW5VT87nVfh/iLV8FpR2uDvrFyomxbtb1KivDbvPTE= k8s.io/kube-openapi v0.0.0-20210421082810-95288971da7e h1:KLHHjkdQFomZy8+06csTWZ0m1343QqxZhR2LJ1OxCYM= k8s.io/kube-openapi v0.0.0-20210421082810-95288971da7e/go.mod h1:vHXdDvt9+2spS2Rx9ql3I8tycm3H9FDfdUoIuKCefvw= -k8s.io/utils v0.0.0-20201110183641-67b214c5f920/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA= -k8s.io/utils v0.0.0-20210707171843-4b05e18ac7d9/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA= -k8s.io/utils v0.0.0-20210722164352-7f3ee0f31471 h1:DnzUXII7sVg1FJ/4JX6YDRJfLNAC7idRatPwe07suiI= -k8s.io/utils v0.0.0-20210722164352-7f3ee0f31471/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA= +k8s.io/utils v0.0.0-20210819203725-bdf08cb9a70a h1:8dYfu/Fc9Gz2rNJKB9IQRGgQOh2clmRzNIPPY1xLY5g= +k8s.io/utils v0.0.0-20210819203725-bdf08cb9a70a/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA= rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8= rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0= rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA= -sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.19/go.mod h1:LEScyzhFmoF5pso/YSeBstl57mOzx9xlU9n85RGrDQg= -sigs.k8s.io/controller-runtime v0.9.6 h1:EevVMlgUj4fC1NVM4+DB3iPkWkmGRNarA66neqv9Qew= -sigs.k8s.io/controller-runtime v0.9.6/go.mod h1:q6PpkM5vqQubEKUKOM6qr06oXGzOBcCby1DA9FbyZeA= +sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.22/go.mod h1:LEScyzhFmoF5pso/YSeBstl57mOzx9xlU9n85RGrDQg= +sigs.k8s.io/controller-runtime v0.10.2 h1:jW8qiY+yMnnPx6O9hu63tgcwaKzd1yLYui+mpvClOOc= +sigs.k8s.io/controller-runtime v0.10.2/go.mod h1:CQp8eyUQZ/Q7PJvnIrB6/hgfTC1kBkGylwsLgOQi1WY= sigs.k8s.io/structured-merge-diff/v4 v4.0.2/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw= sigs.k8s.io/structured-merge-diff/v4 v4.1.2 h1:Hr/htKFmJEbtMgS/UD0N+gtgctAqz81t3nu+sPzynno= sigs.k8s.io/structured-merge-diff/v4 v4.1.2/go.mod h1:j/nl6xW8vLS49O8YvXW1ocPhZawJtm+Yrr7PPRQ0Vg4= -sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o= sigs.k8s.io/yaml v1.2.0 h1:kr/MCeFWJWTwyaHoR9c8EjH9OumOmoF9YGiZd7lFm/Q= sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc= sourcegraph.com/sourcegraph/go-diff v0.5.0/go.mod h1:kuch7UrkMzY0X+p9CRK03kfuPQ2zzQcaEFbx8wA8rck= diff --git a/opaprocessor/processorhandler.go b/opaprocessor/processorhandler.go index 44f059d5..d6ed669f 100644 --- a/opaprocessor/processorhandler.go +++ b/opaprocessor/processorhandler.go @@ -9,10 +9,10 @@ import ( "github.com/armosec/kubescape/scapepkg/exceptions" "github.com/armosec/kubescape/scapepkg/score" - "github.com/armosec/kubescape/cautils/k8sinterface" + "github.com/armosec/k8s-interface/k8sinterface" - "github.com/armosec/kubescape/cautils/opapolicy" - "github.com/armosec/kubescape/cautils/opapolicy/resources" + "github.com/armosec/armoapi-go/opapolicy" + "github.com/armosec/opa-utils/resources" "github.com/golang/glog" "github.com/open-policy-agent/opa/ast" "github.com/open-policy-agent/opa/rego" @@ -42,7 +42,7 @@ func NewOPAProcessor(sessionObj *cautils.OPASessionObj) *OPAProcessor { func NewOPAProcessorHandler(processedPolicy, reportResults *chan *cautils.OPASessionObj) *OPAProcessorHandler { - regoDependenciesData := resources.NewRegoDependenciesData(k8sinterface.GetK8sConfig()) + regoDependenciesData := resources.NewRegoDependenciesData(k8sinterface.GetK8sConfig(), cautils.ClusterName) store, err := regoDependenciesData.TOStorage() if err != nil { panic(err) diff --git a/opaprocessor/processorhandler_test.go b/opaprocessor/processorhandler_test.go index e6bf66f9..542e533d 100644 --- a/opaprocessor/processorhandler_test.go +++ b/opaprocessor/processorhandler_test.go @@ -5,10 +5,10 @@ import ( "github.com/armosec/kubescape/cautils" - "github.com/armosec/kubescape/cautils/k8sinterface" + "github.com/armosec/k8s-interface/k8sinterface" // _ "k8s.io/client-go/plugin/pkg/client/auth" - "github.com/armosec/kubescape/cautils/opapolicy" + "github.com/armosec/armoapi-go/opapolicy" ) func NewOPAProcessorMock() *OPAProcessor { diff --git a/opaprocessor/processorhandlerutils.go b/opaprocessor/processorhandlerutils.go index d08a8876..fcc442a8 100644 --- a/opaprocessor/processorhandlerutils.go +++ b/opaprocessor/processorhandlerutils.go @@ -4,13 +4,13 @@ import ( "encoding/json" "fmt" - pkgcautils "github.com/armosec/kubescape/cautils/cautils" + pkgcautils "github.com/armosec/utils-go/utils" "github.com/armosec/kubescape/cautils" - "github.com/armosec/kubescape/cautils/k8sinterface" - "github.com/armosec/kubescape/cautils/opapolicy" - resources "github.com/armosec/kubescape/cautils/opapolicy/resources" + "github.com/armosec/armoapi-go/opapolicy" + "github.com/armosec/k8s-interface/k8sinterface" + resources "github.com/armosec/opa-utils/resources" "github.com/open-policy-agent/opa/rego" "github.com/golang/glog" diff --git a/policyhandler/filesloader.go b/policyhandler/filesloader.go index c95d6400..ab10a157 100644 --- a/policyhandler/filesloader.go +++ b/policyhandler/filesloader.go @@ -8,9 +8,9 @@ import ( "path/filepath" "strings" + "github.com/armosec/armoapi-go/opapolicy" + "github.com/armosec/k8s-interface/k8sinterface" "github.com/armosec/kubescape/cautils" - "github.com/armosec/kubescape/cautils/k8sinterface" - "github.com/armosec/kubescape/cautils/opapolicy" "gopkg.in/yaml.v2" ) diff --git a/policyhandler/handlenotification.go b/policyhandler/handlenotification.go index 42a02c31..1512272f 100644 --- a/policyhandler/handlenotification.go +++ b/policyhandler/handlenotification.go @@ -5,10 +5,10 @@ import ( "github.com/armosec/kubescape/cautils" - "github.com/armosec/kubescape/cautils/armotypes" - "github.com/armosec/kubescape/cautils/k8sinterface" + "github.com/armosec/armoapi-go/armotypes" + "github.com/armosec/k8s-interface/k8sinterface" - "github.com/armosec/kubescape/cautils/opapolicy" + "github.com/armosec/armoapi-go/opapolicy" ) // PolicyHandler - diff --git a/policyhandler/handlepullpolicies.go b/policyhandler/handlepullpolicies.go index ddceff4b..72e9163e 100644 --- a/policyhandler/handlepullpolicies.go +++ b/policyhandler/handlepullpolicies.go @@ -4,9 +4,9 @@ import ( "fmt" "strings" + "github.com/armosec/armoapi-go/armotypes" + "github.com/armosec/armoapi-go/opapolicy" "github.com/armosec/kubescape/cautils" - "github.com/armosec/kubescape/cautils/armotypes" - "github.com/armosec/kubescape/cautils/opapolicy" ) func (policyHandler *PolicyHandler) GetPoliciesFromBackend(notification *opapolicy.PolicyNotification) ([]opapolicy.Framework, []armotypes.PostureExceptionPolicy, error) { diff --git a/policyhandler/k8sresources.go b/policyhandler/k8sresources.go index f94a4252..7f517b5a 100644 --- a/policyhandler/k8sresources.go +++ b/policyhandler/k8sresources.go @@ -6,10 +6,10 @@ import ( "github.com/armosec/kubescape/cautils" - "github.com/armosec/kubescape/cautils/k8sinterface" + "github.com/armosec/k8s-interface/k8sinterface" - "github.com/armosec/kubescape/cautils/armotypes" - "github.com/armosec/kubescape/cautils/opapolicy" + "github.com/armosec/armoapi-go/armotypes" + "github.com/armosec/armoapi-go/opapolicy" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" diff --git a/policyhandler/k8sresourcesutils.go b/policyhandler/k8sresourcesutils.go index 32e15bb0..52690f61 100644 --- a/policyhandler/k8sresourcesutils.go +++ b/policyhandler/k8sresourcesutils.go @@ -3,8 +3,8 @@ package policyhandler import ( "github.com/armosec/kubescape/cautils" - "github.com/armosec/kubescape/cautils/k8sinterface" - "github.com/armosec/kubescape/cautils/opapolicy" + "github.com/armosec/armoapi-go/opapolicy" + "github.com/armosec/k8s-interface/k8sinterface" ) func setResourceMap(frameworks []opapolicy.Framework) *cautils.K8SResources { diff --git a/policyhandler/k8sresourcesutils_test.go b/policyhandler/k8sresourcesutils_test.go index 2441e519..b0751f09 100644 --- a/policyhandler/k8sresourcesutils_test.go +++ b/policyhandler/k8sresourcesutils_test.go @@ -1,8 +1,8 @@ package policyhandler import ( - "github.com/armosec/kubescape/cautils/k8sinterface" - "github.com/armosec/kubescape/cautils/opapolicy" + "github.com/armosec/armoapi-go/opapolicy" + "github.com/armosec/k8s-interface/k8sinterface" "testing" ) diff --git a/policyhandler/urlloader.go b/policyhandler/urlloader.go index c87c1252..151aeaa5 100644 --- a/policyhandler/urlloader.go +++ b/policyhandler/urlloader.go @@ -7,8 +7,8 @@ import ( "net/http" "strings" + "github.com/armosec/k8s-interface/k8sinterface" "github.com/armosec/kubescape/cautils" - "github.com/armosec/kubescape/cautils/k8sinterface" ) func loadResourcesFromUrl(inputPatterns []string) ([]k8sinterface.IWorkload, error) { diff --git a/resultshandling/printer/junit.go b/resultshandling/printer/junit.go index 7917abd5..f18ee1de 100644 --- a/resultshandling/printer/junit.go +++ b/resultshandling/printer/junit.go @@ -4,7 +4,7 @@ import ( "encoding/xml" "fmt" - "github.com/armosec/kubescape/cautils/opapolicy" + "github.com/armosec/armoapi-go/opapolicy" ) type JUnitTestSuites struct { diff --git a/resultshandling/printer/printresults.go b/resultshandling/printer/printresults.go index e652e60e..879dab30 100644 --- a/resultshandling/printer/printresults.go +++ b/resultshandling/printer/printresults.go @@ -9,7 +9,7 @@ import ( "github.com/armosec/kubescape/cautils" - "github.com/armosec/kubescape/cautils/opapolicy" + "github.com/armosec/armoapi-go/opapolicy" "github.com/enescakir/emoji" "github.com/olekukonko/tablewriter" diff --git a/resultshandling/printer/summary.go b/resultshandling/printer/summary.go index 9fd5f26d..1bc90911 100644 --- a/resultshandling/printer/summary.go +++ b/resultshandling/printer/summary.go @@ -3,7 +3,7 @@ package printer import ( "fmt" - "github.com/armosec/kubescape/cautils/armotypes" + "github.com/armosec/armoapi-go/armotypes" ) type Summary map[string]ControlSummary diff --git a/resultshandling/printer/summeryhelpers.go b/resultshandling/printer/summeryhelpers.go index 6795bea1..e7659dc8 100644 --- a/resultshandling/printer/summeryhelpers.go +++ b/resultshandling/printer/summeryhelpers.go @@ -3,8 +3,8 @@ package printer import ( "fmt" - "github.com/armosec/kubescape/cautils/k8sinterface" - "github.com/armosec/kubescape/cautils/opapolicy" + "github.com/armosec/armoapi-go/opapolicy" + "github.com/armosec/k8s-interface/k8sinterface" ) // Group workloads by namespace - return {"namespace": <[]WorkloadSummary>} diff --git a/resultshandling/reporter/reporteventreceiver.go b/resultshandling/reporter/reporteventreceiver.go index 0e346c12..518c6236 100644 --- a/resultshandling/reporter/reporteventreceiver.go +++ b/resultshandling/reporter/reporteventreceiver.go @@ -7,8 +7,8 @@ import ( "net/http" "net/url" + "github.com/armosec/armoapi-go/opapolicy" "github.com/armosec/kubescape/cautils" - "github.com/armosec/kubescape/cautils/opapolicy" ) type ReportEventReceiver struct { @@ -29,7 +29,12 @@ func (report *ReportEventReceiver) ActionSendReportListenner(opaSessionObj *caut return } //Add score - opaSessionObj.PostureReport.RemoveData() + + // Remove data before reporting + keepFields := []string{"kind", "apiVersion", "metadata"} + keepMetadataFields := []string{"name", "namespace", "labels"} + opaSessionObj.PostureReport.RemoveData(keepFields, keepMetadataFields) + if err := report.Send(opaSessionObj.PostureReport); err != nil { fmt.Println(err) } diff --git a/scapepkg/exceptions/exceptionprocessor.go b/scapepkg/exceptions/exceptionprocessor.go index 68ec5229..e9f997e5 100644 --- a/scapepkg/exceptions/exceptionprocessor.go +++ b/scapepkg/exceptions/exceptionprocessor.go @@ -3,11 +3,11 @@ package exceptions import ( "regexp" + "github.com/armosec/k8s-interface/k8sinterface" "github.com/armosec/kubescape/cautils" - "github.com/armosec/kubescape/cautils/k8sinterface" - "github.com/armosec/kubescape/cautils/armotypes" - "github.com/armosec/kubescape/cautils/opapolicy" + "github.com/armosec/armoapi-go/armotypes" + "github.com/armosec/armoapi-go/opapolicy" "k8s.io/apimachinery/pkg/labels" ) diff --git a/scapepkg/exceptions/exceptionprocessor_test.go b/scapepkg/exceptions/exceptionprocessor_test.go index f9efbb44..8a358edc 100644 --- a/scapepkg/exceptions/exceptionprocessor_test.go +++ b/scapepkg/exceptions/exceptionprocessor_test.go @@ -3,7 +3,7 @@ package exceptions import ( "testing" - "github.com/armosec/kubescape/cautils/armotypes" + "github.com/armosec/armoapi-go/armotypes" ) func PostureExceptionPolicyDisableMock() *armotypes.PostureExceptionPolicy { diff --git a/scapepkg/score/score.go b/scapepkg/score/score.go index 36e0f7f6..03e4c3b9 100644 --- a/scapepkg/score/score.go +++ b/scapepkg/score/score.go @@ -9,8 +9,8 @@ import ( appsv1 "k8s.io/api/apps/v1" // corev1 "k8s.io/api/core/v1" - k8sinterface "github.com/armosec/kubescape/cautils/k8sinterface" - "github.com/armosec/kubescape/cautils/opapolicy" + "github.com/armosec/armoapi-go/opapolicy" + k8sinterface "github.com/armosec/k8s-interface/k8sinterface" ) type ControlScoreWeights struct { diff --git a/scapepkg/score/score_mocks.go b/scapepkg/score/score_mocks.go index 17c6fc6e..fd67c5a1 100644 --- a/scapepkg/score/score_mocks.go +++ b/scapepkg/score/score_mocks.go @@ -5,8 +5,8 @@ import ( "os" "strings" - k8sinterface "github.com/armosec/kubescape/cautils/k8sinterface" - "github.com/armosec/kubescape/cautils/opapolicy" + "github.com/armosec/armoapi-go/opapolicy" + k8sinterface "github.com/armosec/k8s-interface/k8sinterface" ) func loadResourcesMock() []map[string]interface{} {