github/kubescape
1
0
Fork 0
mirror of https://github.com/kubescape/kubescape.git synced 2026-04-15 06:58:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #109 from armosec/dev

Browse Source 
Update master with fixed issues #95 #96
This commit is contained in:
Ben Hirschberg
2021-10-05 09:25:35 +03:00
committed by GitHub
parent f0cd1965b4 22bae315be
commit ccbc11408b
9 changed files with 82 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+4 -2
View File
@@ -24,6 +24,8 @@ If you wish to scan all namespaces in your cluster, remove the `--exclude-namesp
<img src="docs/summary.png">
### Click [👍](https://github.com/armosec/kubescape/stargazers) if you want us to continue to develop and improve Kubescape 😀
# Being part of the team
We invite you to our team! We are excited about this project and want to return the love we get.
@@ -31,9 +33,9 @@ We invite you to our team! We are excited about this project and want to return
Want to contribute? Want to discuss something? Have an issue?
* Open a issue, we are trying to respond within 48 hours
* [Join us](https://discordapp.com/invite/CTcCaBbb) in a discussion on our discord server!
* [Join us](https://armosec.github.io/kubescape/) in a discussion on our discord server!
[<img src="docs/discord-banner.png" width="100" alt="logo" align="center">](https://discordapp.com/invite/CTcCaBbb)
[<img src="docs/discord-banner.png" width="100" alt="logo" align="center">](https://armosec.github.io/kubescape/)
# Options and examples
cmd/framework.go
+3 -3
View File
@@ -23,7 +23,7 @@ import (
)
var scanInfo cautils.ScanInfo
var supportedFrameworks = []string{"nsa"}
var supportedFrameworks = []string{"nsa", "mitre"}
type CLIHandler struct {
policyHandler *policyhandler.PolicyHandler
@@ -39,7 +39,7 @@ var frameworkCmd = &cobra.Command{
if len(args) < 1 && !(cmd.Flags().Lookup("use-from").Changed) {
return fmt.Errorf("requires at least one argument")
} else if len(args) > 0 {
if !isValidFramework(args[0]) {
if !isValidFramework(strings.ToLower(args[0])) {
return fmt.Errorf(fmt.Sprintf("supported frameworks: %s", strings.Join(supportedFrameworks, ", ")))
}
}
@@ -50,7 +50,7 @@ var frameworkCmd = &cobra.Command{
scanInfo.PolicyIdentifier.Kind = opapolicy.KindFramework
if !(cmd.Flags().Lookup("use-from").Changed) {
scanInfo.PolicyIdentifier.Name = args[0]
scanInfo.PolicyIdentifier.Name = strings.ToLower(args[0])
}
if len(args) > 0 {
if len(args[1:]) == 0 || args[1] != "-" {
docs/favicon.ico
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 15 KiB

docs/index.html
+24
View File
@@ -0,0 +1,24 @@
<html>
<head>
<title>
Kubscape Website
</title>
<link rel="icon" type="image/x-icon" href="favicon.ico">
</head>
<style>
img {
display: block;
margin-left: auto;
margin-right: auto;
}
</style>
<body style="text-align: center;">
<img src="kubescape.png" alt="Kubescap logo" style="width:20%">
<iframe src="https://discordapp.com/widget?id=893048809884643379&theme=dark" width="350" height="500"
allowtransparency="true" frameborder="0"
sandbox="allow-popups allow-popups-to-escape-sandbox allow-same-origin allow-scripts"></iframe>
</body>
</html>
opaprocessor/processorhandler.go
+6 -1
View File
@@ -112,7 +112,9 @@ func (opap *OPAProcessor) processFramework(framework *opapolicy.Framework) (*opa
if err != nil {
errs = fmt.Errorf("%v\n%s", errs, err.Error())
}
controlReports = append(controlReports, *controlReport)
if controlReport != nil {
controlReports = append(controlReports, *controlReport)
}
}
frameworkReport.ControlReports = controlReports
return &frameworkReport, errs
@@ -139,6 +141,9 @@ func (opap *OPAProcessor) processControl(control *opapolicy.Control) (*opapolicy
ruleReports = append(ruleReports, *ruleReport)
}
}
if len(ruleReports) == 0 {
return nil, nil
}
controlReport.RuleReports = ruleReports
return &controlReport, errs
}
policyhandler/handlepullpolicies.go
+2 -3
View File
@@ -18,14 +18,13 @@ func (policyHandler *PolicyHandler) GetPoliciesFromBackend(notification *opapoli
switch rule.Kind {
case opapolicy.KindFramework:
receivedFramework, recExceptionPolicies, err := policyHandler.getFrameworkPolicies(rule.Name)
if err != nil {
return nil, nil, fmt.Errorf("kind: %v, name: %s, error: %s", rule.Kind, rule.Name, err.Error())
}
if receivedFramework != nil {
frameworks = append(frameworks, *receivedFramework)
if recExceptionPolicies != nil {
exceptionPolicies = append(exceptionPolicies, recExceptionPolicies...)
}
} else if err != nil {
return nil, nil, fmt.Errorf("kind: %v, name: %s, error: %s", rule.Kind, rule.Name, err.Error())
}
default:
policyhandler/k8sresources.go
+17 -5
View File
@@ -65,11 +65,8 @@ func (policyHandler *PolicyHandler) pullSingleResource(resource *schema.GroupVer
// set labels
listOptions := metav1.ListOptions{}
if excludedNamespaces != "" && k8sinterface.IsNamespaceScope(resource.Group, resource.Resource) {
excludedNamespacesSlice := strings.Split(excludedNamespaces, ",")
for _, excludedNamespace := range excludedNamespacesSlice {
listOptions.FieldSelector += "metadata.namespace!=" + excludedNamespace + ","
}
if excludedNamespaces != "" {
setFieldSelector(&listOptions, resource, excludedNamespaces)
}
if len(labels) > 0 {
set := k8slabels.Set(labels)
@@ -93,3 +90,18 @@ func (policyHandler *PolicyHandler) pullSingleResource(resource *schema.GroupVer
return result.Items, nil
}
func setFieldSelector(listOptions *metav1.ListOptions, resource *schema.GroupVersionResource, excludedNamespaces string) {
fieldSelector := "metadata."
if resource.Resource == "namespaces" {
fieldSelector += "name"
} else if k8sinterface.IsNamespaceScope(resource.Group, resource.Resource) {
fieldSelector += "namespace"
} else {
return
}
excludedNamespacesSlice := strings.Split(excludedNamespaces, ",")
for _, excludedNamespace := range excludedNamespacesSlice {
listOptions.FieldSelector += fmt.Sprintf("%s!=%s,", fieldSelector, excludedNamespace)
}
}
scapepkg/exceptions/exceptionprocessor.go
+12 -5
View File
@@ -1,6 +1,8 @@
package exceptions
import (
"regexp"
"github.com/armosec/kubescape/cautils"
"github.com/armosec/kubescape/cautils/k8sinterface"
@@ -96,7 +98,7 @@ func hasException(designator *armotypes.PortalDesignator, workload k8sinterface.
return false // if designators are empty
}
if cluster != "" && cautils.ClusterName != "" && cluster != cautils.ClusterName { // TODO - where do we receive cluster name from?
if cluster != "" && cautils.ClusterName != "" && regexCompare(cluster, cautils.ClusterName) { // TODO - where do we receive cluster name from?
return false // cluster name does not match
}
@@ -120,17 +122,17 @@ func hasException(designator *armotypes.PortalDesignator, workload k8sinterface.
func compareNamespace(workload k8sinterface.IWorkload, namespace string) bool {
if workload.GetKind() == "Namespace" {
return namespace == workload.GetName()
return regexCompare(namespace, workload.GetName())
}
return namespace == workload.GetNamespace()
return regexCompare(namespace, workload.GetNamespace())
}
func compareKind(workload k8sinterface.IWorkload, kind string) bool {
return kind == workload.GetKind()
return regexCompare(kind, workload.GetKind())
}
func compareName(workload k8sinterface.IWorkload, name string) bool {
return name == workload.GetName()
return regexCompare(workload.GetName(), name)
}
func compareLabels(workload k8sinterface.IWorkload, attributes map[string]string) bool {
@@ -139,3 +141,8 @@ func compareLabels(workload k8sinterface.IWorkload, attributes map[string]string
return designators.Matches(workloadLabels)
}
func regexCompare(reg, name string) bool {
r, _ := regexp.MatchString(reg, name)
return r
}
website/index.html
+14
View File
@@ -0,0 +1,14 @@
<html>
<head>
<title>
Kubscape Website
</title>
<h1>Kubscape Website</h1>
</head>
<body>
<h2>
Join us!!!
<iframe src="https://discordapp.com/widget?id=893048809884643379&theme=dark" width="350" height="500" allowtransparency="true" frameborder="0" sandbox="allow-popups allow-popups-to-escape-sandbox allow-same-origin allow-scripts"></iframe>
</h2>
</body>
</html>