From 3a4c06a8181060566336d39a378fd08c235ba21b Mon Sep 17 00:00:00 2001 From: dwertent Date: Sun, 3 Oct 2021 17:22:50 +0300 Subject: [PATCH 1/7] fixed issue #95 --- opaprocessor/processorhandler.go | 7 ++++++- policyhandler/handlepullpolicies.go | 5 ++--- policyhandler/k8sresources.go | 22 +++++++++++++++++----- 3 files changed, 25 insertions(+), 9 deletions(-) diff --git a/opaprocessor/processorhandler.go b/opaprocessor/processorhandler.go index b2546ab8..78c2f6a4 100644 --- a/opaprocessor/processorhandler.go +++ b/opaprocessor/processorhandler.go @@ -112,7 +112,9 @@ func (opap *OPAProcessor) processFramework(framework *opapolicy.Framework) (*opa if err != nil { errs = fmt.Errorf("%v\n%s", errs, err.Error()) } - controlReports = append(controlReports, *controlReport) + if controlReport != nil { + controlReports = append(controlReports, *controlReport) + } } frameworkReport.ControlReports = controlReports return &frameworkReport, errs @@ -139,6 +141,9 @@ func (opap *OPAProcessor) processControl(control *opapolicy.Control) (*opapolicy ruleReports = append(ruleReports, *ruleReport) } } + if len(ruleReports) == 0 { + return nil, nil + } controlReport.RuleReports = ruleReports return &controlReport, errs } diff --git a/policyhandler/handlepullpolicies.go b/policyhandler/handlepullpolicies.go index 5d335ac2..858ea5d9 100644 --- a/policyhandler/handlepullpolicies.go +++ b/policyhandler/handlepullpolicies.go @@ -18,14 +18,13 @@ func (policyHandler *PolicyHandler) GetPoliciesFromBackend(notification *opapoli switch rule.Kind { case opapolicy.KindFramework: receivedFramework, recExceptionPolicies, err := policyHandler.getFrameworkPolicies(rule.Name) - if err != nil { - return nil, nil, fmt.Errorf("kind: %v, name: %s, error: %s", rule.Kind, rule.Name, err.Error()) - } if receivedFramework != nil { frameworks = append(frameworks, *receivedFramework) if recExceptionPolicies != nil { exceptionPolicies = append(exceptionPolicies, recExceptionPolicies...) } + } else if err != nil { + return nil, nil, fmt.Errorf("kind: %v, name: %s, error: %s", rule.Kind, rule.Name, err.Error()) } default: diff --git a/policyhandler/k8sresources.go b/policyhandler/k8sresources.go index 082790de..f94a4252 100644 --- a/policyhandler/k8sresources.go +++ b/policyhandler/k8sresources.go @@ -65,11 +65,8 @@ func (policyHandler *PolicyHandler) pullSingleResource(resource *schema.GroupVer // set labels listOptions := metav1.ListOptions{} - if excludedNamespaces != "" && k8sinterface.IsNamespaceScope(resource.Group, resource.Resource) { - excludedNamespacesSlice := strings.Split(excludedNamespaces, ",") - for _, excludedNamespace := range excludedNamespacesSlice { - listOptions.FieldSelector += "metadata.namespace!=" + excludedNamespace + "," - } + if excludedNamespaces != "" { + setFieldSelector(&listOptions, resource, excludedNamespaces) } if len(labels) > 0 { set := k8slabels.Set(labels) @@ -93,3 +90,18 @@ func (policyHandler *PolicyHandler) pullSingleResource(resource *schema.GroupVer return result.Items, nil } + +func setFieldSelector(listOptions *metav1.ListOptions, resource *schema.GroupVersionResource, excludedNamespaces string) { + fieldSelector := "metadata." + if resource.Resource == "namespaces" { + fieldSelector += "name" + } else if k8sinterface.IsNamespaceScope(resource.Group, resource.Resource) { + fieldSelector += "namespace" + } else { + return + } + excludedNamespacesSlice := strings.Split(excludedNamespaces, ",") + for _, excludedNamespace := range excludedNamespacesSlice { + listOptions.FieldSelector += fmt.Sprintf("%s!=%s,", fieldSelector, excludedNamespace) + } +} From 3c12247b00d2655c203c169b897e62767b0e8911 Mon Sep 17 00:00:00 2001 From: Bezalel Brandwine Date: Mon, 4 Oct 2021 14:54:04 +0300 Subject: [PATCH 2/7] add index html as GitHub pages landing page --- website/index.html | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 website/index.html diff --git a/website/index.html b/website/index.html new file mode 100644 index 00000000..9c7d7b85 --- /dev/null +++ b/website/index.html @@ -0,0 +1,14 @@ + + + + Kubscape Website + +

Kubscape Website

+ + +

+ Join us!!! + +

+ + \ No newline at end of file From 263821ce67377188a062b35f49cd82abfed1c8ab Mon Sep 17 00:00:00 2001 From: Bezalel Brandwine Date: Mon, 4 Oct 2021 14:57:11 +0300 Subject: [PATCH 3/7] landing page in docs dir --- docs/index.html | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 docs/index.html diff --git a/docs/index.html b/docs/index.html new file mode 100644 index 00000000..9c7d7b85 --- /dev/null +++ b/docs/index.html @@ -0,0 +1,14 @@ + + + + Kubscape Website + +

Kubscape Website

+ + +

+ Join us!!! + +

+ + \ No newline at end of file From 27d00b58d7945c84f6070581db9e75627131fd1d Mon Sep 17 00:00:00 2001 From: dwertent Date: Mon, 4 Oct 2021 15:15:18 +0300 Subject: [PATCH 4/7] Adding star to readme, support wild labels --- README.md | 2 ++ scapepkg/exceptions/exceptionprocessor.go | 17 ++++++++++++----- 2 files changed, 14 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 5e4bd782..8451864d 100644 --- a/README.md +++ b/README.md @@ -24,6 +24,8 @@ If you wish to scan all namespaces in your cluster, remove the `--exclude-namesp +### Click [👍](https://github.com/armosec/kubescape/stargazers) if you want us to continue to develop and improve Kubescape 😀 + # Being part of the team We invite you to our team! We are excited about this project and want to return the love we get. diff --git a/scapepkg/exceptions/exceptionprocessor.go b/scapepkg/exceptions/exceptionprocessor.go index 6e4bdef1..eb0528b0 100644 --- a/scapepkg/exceptions/exceptionprocessor.go +++ b/scapepkg/exceptions/exceptionprocessor.go @@ -1,6 +1,8 @@ package exceptions import ( + "regexp" + "github.com/armosec/kubescape/cautils" "github.com/armosec/kubescape/cautils/k8sinterface" @@ -96,7 +98,7 @@ func hasException(designator *armotypes.PortalDesignator, workload k8sinterface. return false // if designators are empty } - if cluster != "" && cautils.ClusterName != "" && cluster != cautils.ClusterName { // TODO - where do we receive cluster name from? + if cluster != "" && cautils.ClusterName != "" && regexCompare(cluster, cautils.ClusterName) { // TODO - where do we receive cluster name from? return false // cluster name does not match } @@ -120,17 +122,17 @@ func hasException(designator *armotypes.PortalDesignator, workload k8sinterface. func compareNamespace(workload k8sinterface.IWorkload, namespace string) bool { if workload.GetKind() == "Namespace" { - return namespace == workload.GetName() + return regexCompare(namespace, workload.GetName()) } - return namespace == workload.GetNamespace() + return regexCompare(namespace, workload.GetNamespace()) } func compareKind(workload k8sinterface.IWorkload, kind string) bool { - return kind == workload.GetKind() + return regexCompare(kind, workload.GetKind()) } func compareName(workload k8sinterface.IWorkload, name string) bool { - return name == workload.GetName() + return regexCompare(workload.GetName(), name) } func compareLabels(workload k8sinterface.IWorkload, attributes map[string]string) bool { @@ -139,3 +141,8 @@ func compareLabels(workload k8sinterface.IWorkload, attributes map[string]string return designators.Matches(workloadLabels) } + +func regexCompare(reg, name string) bool { + r, _ := regexp.MatchString(reg, name) + return r +} From 25247491eeed6c8d9b3c7343b3c74137022f4e4b Mon Sep 17 00:00:00 2001 From: yiscah Date: Mon, 4 Oct 2021 16:56:18 +0300 Subject: [PATCH 5/7] add mitre to supportedFrameworks, accept upper/lowercase "MITRE" --- cmd/framework.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/cmd/framework.go b/cmd/framework.go index 1487e0fa..e247e183 100644 --- a/cmd/framework.go +++ b/cmd/framework.go @@ -23,7 +23,7 @@ import ( ) var scanInfo cautils.ScanInfo -var supportedFrameworks = []string{"nsa"} +var supportedFrameworks = []string{"nsa", "mitre"} type CLIHandler struct { policyHandler *policyhandler.PolicyHandler @@ -39,7 +39,7 @@ var frameworkCmd = &cobra.Command{ if len(args) < 1 && !(cmd.Flags().Lookup("use-from").Changed) { return fmt.Errorf("requires at least one argument") } else if len(args) > 0 { - if !isValidFramework(args[0]) { + if !isValidFramework(strings.ToLower(args[0])) { return fmt.Errorf(fmt.Sprintf("supported frameworks: %s", strings.Join(supportedFrameworks, ", "))) } } @@ -50,7 +50,7 @@ var frameworkCmd = &cobra.Command{ scanInfo.PolicyIdentifier.Kind = opapolicy.KindFramework if !(cmd.Flags().Lookup("use-from").Changed) { - scanInfo.PolicyIdentifier.Name = args[0] + scanInfo.PolicyIdentifier.Name = strings.ToLower(args[0]) } if len(args) > 0 { if len(args[1:]) == 0 || args[1] != "-" { From cdaa9aa1b03ed976bc30c62070b390fefea9a7dc Mon Sep 17 00:00:00 2001 From: Bezalel Brandwine Date: Tue, 5 Oct 2021 09:18:39 +0300 Subject: [PATCH 6/7] discord UI beautify --- docs/favicon.ico | Bin 0 -> 15406 bytes docs/index.html | 34 ++++++++++++++++++++++------------ 2 files changed, 22 insertions(+), 12 deletions(-) create mode 100644 docs/favicon.ico diff --git a/docs/favicon.ico b/docs/favicon.ico new file mode 100644 index 0000000000000000000000000000000000000000..038e7cf0702b3069efae53276510fc6a3e43acd6 GIT binary patch literal 15406 zcmeI2YmgjO6@YItw|h4WYJ4CuqAVIB2GEUYlHKX#MXW#- zt0g7AewZqv3%fhhGn3t71%eeYSb!;oN@0*l`A#q);gv`vA#pJR3Gq8U)7kEx?w;A% zhp}q9>Q;B(dtUe4bM8HTPAfG_Wz^icihHM8sg+uylZ*<}RBF>n zN}T}=C}33jxgEFHFD_JVu9f+OYiCw8(h5D9Pp-8TGp}6voN9M16 zHXmQ^ZdTtM!2LJRJBpUEU79@8#scHTqoUTp<#rp3k>M4ADcZ*7;s?|Ts~4y?Y5nJ@ z4*Gvx#Xsz3GZzL>y+>dS!K=a?%I8d3LhmZ{w7nPFFIQ=A7ux<<@b23Bx+?xr*V5Pf zV?1Bu_ZMvQ2Y!F_KG5B^Ai(EQk!fR2X>d1H@n2bM8Rtat{P$6%GQd3`um#)rPa$ib z={24`e9L%DX!`JRcXaS2U|$#bqNQ&{_M5zC`U;l5HV!A)SF+VRfZs1Tw1c#NRiDR- zPWx#=*tq9DrDhjxePC|1L(_Nz2h>e`;MV z4IJ+paI@;&1uHYanRCaqv}~qSw)J^QdKg}+PG*1kQ|%tp==oI-PVdWGI+w&>&P&d< zAHv_;XQx_@f@S<>pj*8qiNEyA8Hfz~rkXeO4woGL^?K*bNLJ0~YcMSC!= zaXvf*-d{MY;`FzRc`Z$wyNpTv0PXMkF+)fWM}JfFS6-^#7}xS$YHrCkE|a;2@G58I zy1}e^Lp}a7Ua)nRGxfy?4bD9M^VRT9q9O4Ib98I)h*8kV$|SsKzsv((qRYTJOYC6j zJ$c7GI|}c=7tZzKpfQT@ZHQB@M&_s<4;8SXBz&2pA16g*xDC7O zNWzQj7h8eW&Ip~?v9Wvmm#a5Laf;`w6R?}RfREbVL5ZP(55=WX{OG&b3Ttprlpb^3 zna>)_qVN*`p)-kzLuv?Pq#24wiH^N)|3rRc!{Vx@q%*En6&GL%F^X%N#-zGk-6PxN=B#w-u(duhyprwK1O9PT8Aw{dc zNNeRuP(tf!X`rQnmIkI-0}`LfH|~(F7L_dZ!Q-J(A2=JC=GV(niE2g{DYKFzARlGx zZPXQ>{9iZnGmn>g^)wZv*pJK$xQ?k7rr+TP{6wCEU5mK^i5>nE7!lX^4$`+f2iFQu-5eDB-T zdM$kbcwif79;`8jUIjOC{_qz6d$5c@_DwKX=GEA9<_hp7R~gPjgn5eG5233OTDg%1 zy^eQ&w)#>3Ir>m_+D|1mfr%uU#M9piY z$zCq?7Rl2!yhK8g0m-3Y6SB6P zFR?oD>iO{AFwkS3)oji~Y)JAe?7fmdj<+GpIDn6pMW+!l6JLMAIRwogL-U_W@?(>X znX4K(vl1Dx53TJ{r$TEze8ysVIbJ^W&x5(f_UFDn{x?`|z90M8T=ma5n-rVcTDIq8 z$$^_G^3@$0C7+G_*Wm}x#>&t7Q~TKC_8OPhtKkVV&KBsIpR3Y~UsKySfX&`929Mu1lz&q{-FjnCQXH z8ejA5WSmcU4pOIZj4P#Pl0=sn;6z})f;~Q8qk}44*6|=Px5_@8L}#M?Qb+P?pN{bd z_{Qo@)&|~XS*s-a@~;tl)gUxt_X5@sf6&jcH+^1Wup~Oo^xwWjorcX0()|CMBKr4y zV@p0aXIY#Li4LTehm5lCB>9ol)gD3ri<{l^lji2_8;z9pWk=qcg@-uk0E+qg<# zqjV~@IInJ4Q@0D)(tg)6Z<)wh66KThF1|E$p1BD9KL)>~@0x@7@SSls{)>h|CVAyd#Nd1EAh9FPcGmj>BBdZ>pYx~CCj{C{!#Gpruy!E z*GTQzF@MP%;%$h!I6ktDy3j(Oe<`cphwS%&6ROv;7XBU}YqCYoNo*(ee@mZcv-e89 z%9MX+lVW$V<87s^{;0_EJE^nU`U3joTQn(N;9pJZ;rK|iay5!4{~nj@%*WXSx2MRn z7n#3-Ezey?!**@}Hpyp*mG$n4#^8<08-)`alJ7b8x%-i+@}KRv9r*Tei1_U8e2?lv zr;G8K^~^UG7C(9ozur?^1Who>!&l^ay9@o}$BlxsJXY*~M?;ZHN7o zIjoU?{H8-w%m1kXvF*X|XYf%n6vM$uE3rs$$JJd1Lx!jS!n- z*LR`2qY~bAXQ{gu) z@j|_M^k1YpD*r+0M+y_pv+Lh7?@MRcZ$ne+!{;QY-At`xIIGT-vz+r}M)v%W;H{UI U23i_uX`rQnmIhiHn3M+o3)%k**8l(j literal 0 HcmV?d00001 diff --git a/docs/index.html b/docs/index.html index 9c7d7b85..add13cd3 100644 --- a/docs/index.html +++ b/docs/index.html @@ -1,14 +1,24 @@ - - - Kubscape Website - -

Kubscape Website

- - -

- Join us!!! - -

- + + + + Kubscape Website + + + + + + + Kubescap logo + + + \ No newline at end of file From 740ab7cb46cda191643f291d062cffd96b31c67c Mon Sep 17 00:00:00 2001 From: Bezalel Brandwine Date: Tue, 5 Oct 2021 09:21:58 +0300 Subject: [PATCH 7/7] point readme discord to github pages --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index face5a82..96817b2b 100644 --- a/README.md +++ b/README.md @@ -33,9 +33,9 @@ We invite you to our team! We are excited about this project and want to return Want to contribute? Want to discuss something? Have an issue? * Open a issue, we are trying to respond within 48 hours -* [Join us](https://discordapp.com/invite/CTcCaBbb) in a discussion on our discord server! +* [Join us](https://armosec.github.io/kubescape/) in a discussion on our discord server! -[logo](https://discordapp.com/invite/CTcCaBbb) +[logo](https://armosec.github.io/kubescape/) # Options and examples