From c67e584cfb15839ff4d6162138b910cdfd6c30b5 Mon Sep 17 00:00:00 2001 From: danielgrunbergerarmo Date: Thu, 26 Aug 2021 11:03:51 +0300 Subject: [PATCH] Support yamls --- cautils/opapolicy/datastructures.go | 2 ++ cmd/framework.go | 35 ++++++++++++++++++++++++++--- cmd/root.go | 4 ++-- main.go | 15 ------------- printer/printresults.go | 8 ++++++- printer/summery.go | 1 + 6 files changed, 44 insertions(+), 21 deletions(-) diff --git a/cautils/opapolicy/datastructures.go b/cautils/opapolicy/datastructures.go index 7730a08f..4c9a25a0 100644 --- a/cautils/opapolicy/datastructures.go +++ b/cautils/opapolicy/datastructures.go @@ -153,4 +153,6 @@ type ScanInfo struct { PolicyIdentifier PolicyIdentifier `json:"policyIdentifier"` Output string `json:"output"` ExcludedNamespaces string `json:"excludedNamespaces"` + Input []string `json:"input"` + Silent bool `json:"silent"` } diff --git a/cmd/framework.go b/cmd/framework.go index 5332b007..4fdee4eb 100644 --- a/cmd/framework.go +++ b/cmd/framework.go @@ -1,7 +1,9 @@ package cmd import ( + "errors" "fmt" + "io/ioutil" "kube-escape/cautils" "kube-escape/cautils/armotypes" "kube-escape/cautils/k8sinterface" @@ -27,20 +29,47 @@ var frameworkCmd = &cobra.Command{ Short: "The framework you wish to use. Supported frameworks: nsa, mitre", Long: ``, ValidArgs: []string{"nsa", "mitre"}, - Args: cobra.ExactValidArgs(1), + Args: func(cmd *cobra.Command, args []string) error { + if len(args) < 1 { + return errors.New("requires at least one argument") + } + if !isValidFramework(args[0]) { + return errors.New("supported frameworks: nsa and mitre") + } + return nil + }, Run: func(cmd *cobra.Command, args []string) { scanInfo.PolicyIdentifier = opapolicy.PolicyIdentifier{} - scanInfo.PolicyIdentifier.Kind = "Framework" - scanInfo.PolicyIdentifier.Name = strings.Join(args, ",") + scanInfo.PolicyIdentifier.Kind = opapolicy.KindFramework + scanInfo.PolicyIdentifier.Name = args[0] + scanInfo.Input = args[1:] CliSetup() }, } +func isValidFramework(framework string) bool { + return framework == "nsa" || framework != "mitre" +} + func init() { scanCmd.AddCommand(frameworkCmd) scanInfo = opapolicy.ScanInfo{} frameworkCmd.Flags().StringVarP(&scanInfo.ExcludedNamespaces, "excluded-namespaces", "e", "", "namespaces to exclude from check") frameworkCmd.Flags().StringVarP(&scanInfo.Output, "output", "o", "", "output format") + frameworkCmd.Flags().BoolVarP(&scanInfo.Silent, "silent", "s", false, "silent output") + +} + +func processYamlInput(yamls string) { + listOfYamls := strings.Split(yamls, ",") + for _, yaml := range listOfYamls { + dat, err := ioutil.ReadFile(yaml) + if err != nil { + fmt.Printf("Could not open file: %s.", yaml) + } + fmt.Print(string(dat)) + } + } func CliSetup() error { diff --git a/cmd/root.go b/cmd/root.go index 35f35478..c80ca026 100644 --- a/cmd/root.go +++ b/cmd/root.go @@ -9,8 +9,8 @@ var cfgFile string var rootCmd = &cobra.Command{ Use: "kubescape", Short: "A tool for running NSA recommended tests in your cluster ", - Long: `This tool pulls checks based on the NSA recommendations from the ARMO backend - and run these checks on your cluster resources `, + Long: `Kubescape is the first tool for testing if Kubernetes is deployed securely as defined in Kubernetes Hardening Guidance +by to NSA and CISA Tests are configured with YAML files, making this tool easy to update as test specifications evolve.`, } func Execute() { diff --git a/main.go b/main.go index 8269a1b2..4f4ce7ac 100644 --- a/main.go +++ b/main.go @@ -1,18 +1,3 @@ -/* -Copyright © 2021 NAME HERE - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ package main import "kube-escape/cmd" diff --git a/printer/printresults.go b/printer/printresults.go index 9b456611..fc3ccd0b 100644 --- a/printer/printresults.go +++ b/printer/printresults.go @@ -57,6 +57,7 @@ func (printer *Printer) SummerySetup(postureReport *opapolicy.PostureReport) { TotalFailed: len(workloadsSummery), WorkloadSummery: mapResources, Description: cr.Description, + Remediation: cr.Remediation, } } } @@ -81,7 +82,12 @@ func (print *Printer) printSummery(controlName string, controlSummery *ControlSu cautils.SimpleDisplay(os.Stdout, "Summary - ") cautils.SuccessDisplay(os.Stdout, "Passed:%v ", controlSummery.TotalResources-controlSummery.TotalFailed) cautils.FailureDisplay(os.Stdout, "Failed:%v ", controlSummery.TotalFailed) - cautils.InfoDisplay(os.Stdout, "Total:%v\n\n", controlSummery.TotalResources) + cautils.InfoDisplay(os.Stdout, "Total:%v\n", controlSummery.TotalResources) + if controlSummery.TotalFailed > 0 { + cautils.DescriptionDisplay(os.Stdout, "Remediation: %v\n", controlSummery.Remediation) + } + cautils.DescriptionDisplay(os.Stdout, "\n") + } func (printer *Printer) printTitle(controlName string, controlSummery *ControlSummery) { diff --git a/printer/summery.go b/printer/summery.go index ad54ff23..4723f0ee 100644 --- a/printer/summery.go +++ b/printer/summery.go @@ -14,6 +14,7 @@ type ControlSummery struct { TotalResources int TotalFailed int Description string + Remediation string WorkloadSummery map[string][]WorkloadSummery // :[] }