diff --git a/README.md b/README.md
index 701c1bf5..96817b2b 100644
--- a/README.md
+++ b/README.md
@@ -24,6 +24,8 @@ If you wish to scan all namespaces in your cluster, remove the `--exclude-namesp
+### Click [👍](https://github.com/armosec/kubescape/stargazers) if you want us to continue to develop and improve Kubescape 😀
+
# Being part of the team
We invite you to our team! We are excited about this project and want to return the love we get.
@@ -31,9 +33,9 @@ We invite you to our team! We are excited about this project and want to return
Want to contribute? Want to discuss something? Have an issue?
* Open a issue, we are trying to respond within 48 hours
-* [Join us](https://discordapp.com/invite/CTcCaBbb) in a discussion on our discord server!
+* [Join us](https://armosec.github.io/kubescape/) in a discussion on our discord server!
-[
](https://discordapp.com/invite/CTcCaBbb)
+[](https://armosec.github.io/kubescape/)
# Options and examples
diff --git a/cmd/framework.go b/cmd/framework.go
index 1487e0fa..e247e183 100644
--- a/cmd/framework.go
+++ b/cmd/framework.go
@@ -23,7 +23,7 @@ import (
)
var scanInfo cautils.ScanInfo
-var supportedFrameworks = []string{"nsa"}
+var supportedFrameworks = []string{"nsa", "mitre"}
type CLIHandler struct {
policyHandler *policyhandler.PolicyHandler
@@ -39,7 +39,7 @@ var frameworkCmd = &cobra.Command{
if len(args) < 1 && !(cmd.Flags().Lookup("use-from").Changed) {
return fmt.Errorf("requires at least one argument")
} else if len(args) > 0 {
- if !isValidFramework(args[0]) {
+ if !isValidFramework(strings.ToLower(args[0])) {
return fmt.Errorf(fmt.Sprintf("supported frameworks: %s", strings.Join(supportedFrameworks, ", ")))
}
}
@@ -50,7 +50,7 @@ var frameworkCmd = &cobra.Command{
scanInfo.PolicyIdentifier.Kind = opapolicy.KindFramework
if !(cmd.Flags().Lookup("use-from").Changed) {
- scanInfo.PolicyIdentifier.Name = args[0]
+ scanInfo.PolicyIdentifier.Name = strings.ToLower(args[0])
}
if len(args) > 0 {
if len(args[1:]) == 0 || args[1] != "-" {
diff --git a/docs/favicon.ico b/docs/favicon.ico
new file mode 100644
index 00000000..038e7cf0
Binary files /dev/null and b/docs/favicon.ico differ
diff --git a/docs/index.html b/docs/index.html
new file mode 100644
index 00000000..add13cd3
--- /dev/null
+++ b/docs/index.html
@@ -0,0 +1,24 @@
+
+
+
+
+ Kubscape Website
+
+
+
+
+
+
+ 
+
+
+
+
\ No newline at end of file
diff --git a/opaprocessor/processorhandler.go b/opaprocessor/processorhandler.go
index b2546ab8..78c2f6a4 100644
--- a/opaprocessor/processorhandler.go
+++ b/opaprocessor/processorhandler.go
@@ -112,7 +112,9 @@ func (opap *OPAProcessor) processFramework(framework *opapolicy.Framework) (*opa
if err != nil {
errs = fmt.Errorf("%v\n%s", errs, err.Error())
}
- controlReports = append(controlReports, *controlReport)
+ if controlReport != nil {
+ controlReports = append(controlReports, *controlReport)
+ }
}
frameworkReport.ControlReports = controlReports
return &frameworkReport, errs
@@ -139,6 +141,9 @@ func (opap *OPAProcessor) processControl(control *opapolicy.Control) (*opapolicy
ruleReports = append(ruleReports, *ruleReport)
}
}
+ if len(ruleReports) == 0 {
+ return nil, nil
+ }
controlReport.RuleReports = ruleReports
return &controlReport, errs
}
diff --git a/policyhandler/handlepullpolicies.go b/policyhandler/handlepullpolicies.go
index 5d335ac2..858ea5d9 100644
--- a/policyhandler/handlepullpolicies.go
+++ b/policyhandler/handlepullpolicies.go
@@ -18,14 +18,13 @@ func (policyHandler *PolicyHandler) GetPoliciesFromBackend(notification *opapoli
switch rule.Kind {
case opapolicy.KindFramework:
receivedFramework, recExceptionPolicies, err := policyHandler.getFrameworkPolicies(rule.Name)
- if err != nil {
- return nil, nil, fmt.Errorf("kind: %v, name: %s, error: %s", rule.Kind, rule.Name, err.Error())
- }
if receivedFramework != nil {
frameworks = append(frameworks, *receivedFramework)
if recExceptionPolicies != nil {
exceptionPolicies = append(exceptionPolicies, recExceptionPolicies...)
}
+ } else if err != nil {
+ return nil, nil, fmt.Errorf("kind: %v, name: %s, error: %s", rule.Kind, rule.Name, err.Error())
}
default:
diff --git a/policyhandler/k8sresources.go b/policyhandler/k8sresources.go
index 082790de..f94a4252 100644
--- a/policyhandler/k8sresources.go
+++ b/policyhandler/k8sresources.go
@@ -65,11 +65,8 @@ func (policyHandler *PolicyHandler) pullSingleResource(resource *schema.GroupVer
// set labels
listOptions := metav1.ListOptions{}
- if excludedNamespaces != "" && k8sinterface.IsNamespaceScope(resource.Group, resource.Resource) {
- excludedNamespacesSlice := strings.Split(excludedNamespaces, ",")
- for _, excludedNamespace := range excludedNamespacesSlice {
- listOptions.FieldSelector += "metadata.namespace!=" + excludedNamespace + ","
- }
+ if excludedNamespaces != "" {
+ setFieldSelector(&listOptions, resource, excludedNamespaces)
}
if len(labels) > 0 {
set := k8slabels.Set(labels)
@@ -93,3 +90,18 @@ func (policyHandler *PolicyHandler) pullSingleResource(resource *schema.GroupVer
return result.Items, nil
}
+
+func setFieldSelector(listOptions *metav1.ListOptions, resource *schema.GroupVersionResource, excludedNamespaces string) {
+ fieldSelector := "metadata."
+ if resource.Resource == "namespaces" {
+ fieldSelector += "name"
+ } else if k8sinterface.IsNamespaceScope(resource.Group, resource.Resource) {
+ fieldSelector += "namespace"
+ } else {
+ return
+ }
+ excludedNamespacesSlice := strings.Split(excludedNamespaces, ",")
+ for _, excludedNamespace := range excludedNamespacesSlice {
+ listOptions.FieldSelector += fmt.Sprintf("%s!=%s,", fieldSelector, excludedNamespace)
+ }
+}
diff --git a/scapepkg/exceptions/exceptionprocessor.go b/scapepkg/exceptions/exceptionprocessor.go
index 6e4bdef1..eb0528b0 100644
--- a/scapepkg/exceptions/exceptionprocessor.go
+++ b/scapepkg/exceptions/exceptionprocessor.go
@@ -1,6 +1,8 @@
package exceptions
import (
+ "regexp"
+
"github.com/armosec/kubescape/cautils"
"github.com/armosec/kubescape/cautils/k8sinterface"
@@ -96,7 +98,7 @@ func hasException(designator *armotypes.PortalDesignator, workload k8sinterface.
return false // if designators are empty
}
- if cluster != "" && cautils.ClusterName != "" && cluster != cautils.ClusterName { // TODO - where do we receive cluster name from?
+ if cluster != "" && cautils.ClusterName != "" && regexCompare(cluster, cautils.ClusterName) { // TODO - where do we receive cluster name from?
return false // cluster name does not match
}
@@ -120,17 +122,17 @@ func hasException(designator *armotypes.PortalDesignator, workload k8sinterface.
func compareNamespace(workload k8sinterface.IWorkload, namespace string) bool {
if workload.GetKind() == "Namespace" {
- return namespace == workload.GetName()
+ return regexCompare(namespace, workload.GetName())
}
- return namespace == workload.GetNamespace()
+ return regexCompare(namespace, workload.GetNamespace())
}
func compareKind(workload k8sinterface.IWorkload, kind string) bool {
- return kind == workload.GetKind()
+ return regexCompare(kind, workload.GetKind())
}
func compareName(workload k8sinterface.IWorkload, name string) bool {
- return name == workload.GetName()
+ return regexCompare(workload.GetName(), name)
}
func compareLabels(workload k8sinterface.IWorkload, attributes map[string]string) bool {
@@ -139,3 +141,8 @@ func compareLabels(workload k8sinterface.IWorkload, attributes map[string]string
return designators.Matches(workloadLabels)
}
+
+func regexCompare(reg, name string) bool {
+ r, _ := regexp.MatchString(reg, name)
+ return r
+}
diff --git a/website/index.html b/website/index.html
new file mode 100644
index 00000000..9c7d7b85
--- /dev/null
+++ b/website/index.html
@@ -0,0 +1,14 @@
+
+
+
+ Kubscape Website
+
+ Kubscape Website
+
+
+
+ Join us!!!
+
+
+
+
\ No newline at end of file