From d5b8532e4025787b4ab53f402c623ccd1ef3b6ef Mon Sep 17 00:00:00 2001 From: Matthias Bertschy Date: Tue, 23 Jul 2024 18:18:24 +0200 Subject: [PATCH] fix include/exclude NS for SA discovered via CRB Signed-off-by: Matthias Bertschy --- build/Dockerfile | 2 +- core/core/scan.go | 2 +- core/pkg/opaprocessor/processorhandler.go | 37 ++++++++++++++++++- .../pkg/opaprocessor/processorhandler_test.go | 2 +- 4 files changed, 38 insertions(+), 5 deletions(-) diff --git a/build/Dockerfile b/build/Dockerfile index 0f40bb20..601b6e21 100644 --- a/build/Dockerfile +++ b/build/Dockerfile @@ -1,4 +1,4 @@ -FROM --platform=$BUILDPLATFORM golang:1.22-bullseye as builder +FROM --platform=$BUILDPLATFORM golang:1.22-bullseye AS builder ENV GO111MODULE=on CGO_ENABLED=0 WORKDIR /work diff --git a/core/core/scan.go b/core/core/scan.go index dc57f4af..e954865a 100644 --- a/core/core/scan.go +++ b/core/core/scan.go @@ -182,7 +182,7 @@ func (ks *Kubescape) Scan(ctx context.Context, scanInfo *cautils.ScanInfo) (*res defer spanOpa.End() deps := resources.NewRegoDependenciesData(k8sinterface.GetK8sConfig(), interfaces.tenantConfig.GetContextName()) - reportResults := opaprocessor.NewOPAProcessor(scanData, deps, interfaces.tenantConfig.GetContextName()) + reportResults := opaprocessor.NewOPAProcessor(scanData, deps, interfaces.tenantConfig.GetContextName(), scanInfo.ExcludedNamespaces, scanInfo.IncludeNamespaces) if err = reportResults.ProcessRulesListener(ctxOpa, cautils.NewProgressHandler("")); err != nil { // TODO - do something return resultsHandling, fmt.Errorf("%w", err) diff --git a/core/pkg/opaprocessor/processorhandler.go b/core/pkg/opaprocessor/processorhandler.go index 5a786d59..8bdf4263 100644 --- a/core/pkg/opaprocessor/processorhandler.go +++ b/core/pkg/opaprocessor/processorhandler.go @@ -3,6 +3,7 @@ package opaprocessor import ( "context" "fmt" + "strings" "sync" "github.com/armosec/armoapi-go/armotypes" @@ -37,10 +38,12 @@ type OPAProcessor struct { clusterName string regoDependenciesData *resources.RegoDependenciesData *cautils.OPASessionObj - opaRegisterOnce sync.Once + opaRegisterOnce sync.Once + excludeNamespaces []string + includeNamespaces []string } -func NewOPAProcessor(sessionObj *cautils.OPASessionObj, regoDependenciesData *resources.RegoDependenciesData, clusterName string) *OPAProcessor { +func NewOPAProcessor(sessionObj *cautils.OPASessionObj, regoDependenciesData *resources.RegoDependenciesData, clusterName string, excludeNamespaces string, includeNamespaces string) *OPAProcessor { if regoDependenciesData != nil && sessionObj != nil { regoDependenciesData.PostureControlInputs = sessionObj.RegoInputData.PostureControlInputs regoDependenciesData.DataControlInputs = sessionObj.RegoInputData.DataControlInputs @@ -50,6 +53,8 @@ func NewOPAProcessor(sessionObj *cautils.OPASessionObj, regoDependenciesData *re OPASessionObj: sessionObj, regoDependenciesData: regoDependenciesData, clusterName: clusterName, + excludeNamespaces: split(excludeNamespaces), + includeNamespaces: split(includeNamespaces), } } @@ -211,6 +216,9 @@ func (opap *OPAProcessor) processRule(ctx context.Context, rule *reporthandling. inputResources = objectsenvelopes.ListMapToMeta(enumeratedData) for i, inputResource := range inputResources { + if opap.skipNamespace(inputResource.GetNamespace()) { + continue + } resources[inputResource.GetID()] = &resourcesresults.ResourceAssociatedRule{ Name: rule.Name, ControlConfigurations: ruleRegoDependenciesData.PostureControlInputs, @@ -229,6 +237,9 @@ func (opap *OPAProcessor) processRule(ctx context.Context, rule *reporthandling. for _, ruleResponse := range ruleResponses { failedResources := objectsenvelopes.ListMapToMeta(ruleResponse.GetFailedResources()) for _, failedResource := range failedResources { + if opap.skipNamespace(failedResource.GetNamespace()) { + continue + } var ruleResult *resourcesresults.ResourceAssociatedRule if r, found := resources[failedResource.GetID()]; found { ruleResult = r @@ -387,3 +398,25 @@ func (opap *OPAProcessor) makeRegoDeps(configInputs []reporthandling.ControlConf PostureControlInputs: postureControlInputs, } } + +func (opap *OPAProcessor) skipNamespace(ns string) bool { + if includeNamespaces := opap.includeNamespaces; len(includeNamespaces) > 0 { + if !slices.Contains(includeNamespaces, ns) { + // skip ns not in IncludeNamespaces + return true + } + } else if excludeNamespaces := opap.excludeNamespaces; len(excludeNamespaces) > 0 { + if slices.Contains(excludeNamespaces, ns) { + // skip ns in ExcludeNamespaces + return true + } + } + return false +} + +func split(namespaces string) []string { + if namespaces == "" { + return nil + } + return strings.Split(namespaces, ",") +} diff --git a/core/pkg/opaprocessor/processorhandler_test.go b/core/pkg/opaprocessor/processorhandler_test.go index 6adeabef..a8621489 100644 --- a/core/pkg/opaprocessor/processorhandler_test.go +++ b/core/pkg/opaprocessor/processorhandler_test.go @@ -197,7 +197,7 @@ func TestProcessResourcesResult(t *testing.T) { opaSessionObj.K8SResources = k8sResources opaSessionObj.AllResources[deployment.GetID()] = deployment - opap := NewOPAProcessor(opaSessionObj, resources.NewRegoDependenciesDataMock(), "test") + opap := NewOPAProcessor(opaSessionObj, resources.NewRegoDependenciesDataMock(), "test", "", "") opap.AllPolicies = policies opap.Process(context.TODO(), policies, nil)