github/kubescape
1
0
Fork 0
mirror of https://github.com/kubescape/kubescape.git synced 2026-04-15 06:58:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Supporting verbose flag

Browse Source
This commit is contained in:
David Wertenteil
2021-12-01 14:49:53 +02:00
committed by GitHub
parent 4a08fbdf28 01d41520d4
commit d69e790c61
19 changed files with 4196 additions and 200 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+7 -1
View File
@@ -91,7 +91,7 @@ Set-ExecutionPolicy RemoteSigned -scope CurrentUser
| `-e`/`--exclude-namespaces` | Scan all namespaces | Namespaces to exclude from scanning. Recommended to exclude `kube-system` and `kube-public` namespaces | |
| `--include-namespaces` | Scan all namespaces | Scan specific namespaces | |
| `-s`/`--silent` | Display progress messages | Silent progress messages | |
| `-t`/`--fail-threshold` | `0` (do not fail) | fail command (return exit code 1) if result is below threshold | `0` -> `100` |
| `-t`/`--fail-threshold` | `0` (do not fail) | fail command (return exit code 1) if result is below threshold | `0` -> `100` |
| `-f`/`--format` | `pretty-printer` | Output format | `pretty-printer`/`json`/`junit`/`prometheus` |
| `-o`/`--output` | print to stdout | Save scan result in file | |
| `--use-from` | | Load local framework object from specified path. If not used will download latest | |
@@ -100,6 +100,7 @@ Set-ExecutionPolicy RemoteSigned -scope CurrentUser
| `--submit` | `false` | If set, Kubescape will send the scan results to Armo management portal where you can see the results in a user-friendly UI, choose your preferred compliance framework, check risk results history and trends, manage exceptions, get remediation recommendations and much more. By default the results are not sent | `true`/`false` |
| `--keep-local` | `false` | Kubescape will not send scan results to Armo management portal. Use this flag if you ran with the `--submit` flag in the past and you do not want to submit your current scan results | `true`/`false` |
| `--account` | | Armo portal account ID. Default will load account ID from configMap or config file | |
| `--verbose` | `false` | Display all of the input resources and not only failed resources | `true`/`false` |
## Usage & Examples
@@ -143,6 +144,11 @@ kubescape scan framework nsa *.yaml
kubescape scan framework nsa https://github.com/armosec/kubescape
```
#### Display all scanned resources (including the resources who passed)
```
kubescape scan framework nsa --verbose
```
#### Output in `json` format
```
kubescape scan framework nsa --format json --output results.json
cautils/scaninfo.go
+1
View File
@@ -14,6 +14,7 @@ type ScanInfo struct {
ControlsInputs string // Load file with inputs for controls
UseFrom []string // Load framework from local file (instead of download). Use when running offline
UseDefault bool // Load framework from cached file (instead of download). Use when running offline
VerboseMode bool // Display all of the input resources and not only failed resources
Format string // Format results (table, json, junit ...)
Output string // Store results in an output file, Output file name
ExcludedNamespaces string // DEPRECATED?
clihandler/cmd/scan.go
+12 -11
View File
@@ -36,16 +36,17 @@ var scanCmd = &cobra.Command{
func init() {
rootCmd.AddCommand(scanCmd)
scanCmd.PersistentFlags().BoolVarP(&scanInfo.Submit, "submit", "", false, "Send the scan results to Armo management portal where you can see the results in a user-friendly UI, choose your preferred compliance framework, check risk results history and trends, manage exceptions, get remediation recommendations and much more. By default the results are not submitted")
scanCmd.PersistentFlags().BoolVarP(&scanInfo.Local, "keep-local", "", false, "If you do not want your Kubescape results reported to Armo backend. Use this flag if you ran with the '--submit' flag in the past and you do not want to submit your current scan results")
scanCmd.PersistentFlags().StringVarP(&scanInfo.ExcludedNamespaces, "exclude-namespaces", "e", "", "Namespaces to exclude from scanning. Recommended: kube-system,kube-public")
scanCmd.PersistentFlags().StringVar(&scanInfo.IncludeNamespaces, "include-namespaces", "", "scan specific namespaces. e.g: --include-namespaces ns-a,ns-b")
scanCmd.PersistentFlags().StringVarP(&scanInfo.Format, "format", "f", "pretty-printer", `Output format. Supported formats: "pretty-printer"/"json"/"junit"/"prometheus"`)
scanCmd.PersistentFlags().StringVarP(&scanInfo.Output, "output", "o", "", "Output file. Print output to file and not stdout")
scanCmd.PersistentFlags().BoolVarP(&scanInfo.Silent, "silent", "s", false, "Silent progress messages")
scanCmd.PersistentFlags().Uint16VarP(&scanInfo.FailThreshold, "fail-threshold", "t", 0, "Failure threshold is the percent below which the command fails and returns exit code 1")
scanCmd.PersistentFlags().StringSliceVar(&scanInfo.UseFrom, "use-from", nil, "Load local policy object from specified path. If not used will download latest")
scanCmd.PersistentFlags().BoolVar(&scanInfo.UseDefault, "use-default", false, "Load local policy object from default path. If not used will download latest")
scanCmd.PersistentFlags().StringVar(&scanInfo.UseExceptions, "exceptions", "", "Path to an exceptions obj. If not set will download exceptions from ARMO management portal")
scanCmd.PersistentFlags().StringVar(&scanInfo.ControlsInputs, "controls-config", "", "Path to an controls-config obj. If not set will download controls-config from ARMO management portal")
scanCmd.PersistentFlags().StringVar(&scanInfo.UseExceptions, "exceptions", "", "Path to an exceptions obj. If not set will download exceptions from ARMO management portal")
scanCmd.PersistentFlags().StringVarP(&scanInfo.ExcludedNamespaces, "exclude-namespaces", "e", "", "Namespaces to exclude from scanning. Recommended: kube-system,kube-public")
scanCmd.PersistentFlags().Uint16VarP(&scanInfo.FailThreshold, "fail-threshold", "t", 0, "Failure threshold is the percent below which the command fails and returns exit code 1")
scanCmd.PersistentFlags().StringVarP(&scanInfo.Format, "format", "f", "pretty-printer", `Output format. Supported formats: "pretty-printer"/"json"/"junit"/"prometheus"`)
scanCmd.PersistentFlags().StringVar(&scanInfo.IncludeNamespaces, "include-namespaces", "", "scan specific namespaces. e.g: --include-namespaces ns-a,ns-b")
scanCmd.PersistentFlags().BoolVarP(&scanInfo.Local, "keep-local", "", false, "If you do not want your Kubescape results reported to Armo backend. Use this flag if you ran with the '--submit' flag in the past and you do not want to submit your current scan results")
scanCmd.PersistentFlags().StringVarP(&scanInfo.Output, "output", "o", "", "Output file. Print output to file and not stdout")
scanCmd.PersistentFlags().BoolVar(&scanInfo.VerboseMode, "verbose", false, "Display all of the input resources and not only failed resources")
scanCmd.PersistentFlags().BoolVar(&scanInfo.UseDefault, "use-default", false, "Load local policy object from default path. If not used will download latest")
scanCmd.PersistentFlags().StringSliceVar(&scanInfo.UseFrom, "use-from", nil, "Load local policy object from specified path. If not used will download latest")
scanCmd.PersistentFlags().BoolVarP(&scanInfo.Silent, "silent", "s", false, "Silent progress messages")
scanCmd.PersistentFlags().BoolVarP(&scanInfo.Submit, "submit", "", false, "Send the scan results to Armo management portal where you can see the results in a user-friendly UI, choose your preferred compliance framework, check risk results history and trends, manage exceptions, get remediation recommendations and much more. By default the results are not submitted")
}
clihandler/initcli.go
+3 -3
View File
@@ -36,7 +36,7 @@ func getInterfaces(scanInfo *cautils.ScanInfo) componentInterfaces {
k8sinterface.ConnectedToCluster = false
clusterConfig = cautils.NewEmptyConfig()
// load fom file
// load from file
resourceHandler = resourcehandler.NewFileResourceHandler(scanInfo.InputPatterns)
// set mock report (do not send report)
@@ -56,7 +56,7 @@ func getInterfaces(scanInfo *cautils.ScanInfo) componentInterfaces {
v.CheckLatestVersion(cautils.NewVersionCheckRequest(cautils.BuildNumber, policyIdentifierNames(scanInfo.PolicyIdentifier), "", scanningTarget))
// setup printer
printerHandler := printer.GetPrinter(scanInfo.Format)
printerHandler := printer.GetPrinter(scanInfo.Format, scanInfo.VerboseMode)
printerHandler.SetWriter(scanInfo.Output)
return componentInterfaces{
@@ -90,6 +90,7 @@ func setPolicyGetter(scanInfo *cautils.ScanInfo, customerGUID string) {
}
func ScanCliSetup(scanInfo *cautils.ScanInfo) error {
cautils.ScanStartDisplay()
interfaces := getInterfaces(scanInfo)
@@ -138,7 +139,6 @@ func ScanCliSetup(scanInfo *cautils.ScanInfo) error {
}
func Scan(policyHandler *policyhandler.PolicyHandler, scanInfo *cautils.ScanInfo) error {
cautils.ScanStartDisplay()
policyNotification := &reporthandling.PolicyNotification{
NotificationType: reporthandling.TypeExecPostureScan,
Rules: scanInfo.PolicyIdentifier,
examples/output_mocks/prometheus-verbose-flag.txt
+3326
View File
File diff suppressed because it is too large Load Diff
examples/output_mocks/prometheus.txt
+706
View File
@@ -0,0 +1,706 @@
# Number of resources found as part of failed control "Control plane hardening"
kubescape_resources_found_count{framework="NSA",control="Control plane hardening"} 0
# Number of resources found as part of excluded control "Control plane hardening"
kubescape_resources_found_count{framework="NSA",control="Control plane hardening"} 0
# Number of resources found as part of failed control "Host PID/IPC privileges"
kubescape_resources_found_count{framework="NSA",control="Host PID/IPC privileges"} 0
# Number of resources found as part of excluded control "Host PID/IPC privileges"
kubescape_resources_found_count{framework="NSA",control="Host PID/IPC privileges"} 0
# Number of resources found as part of failed control "Immutable container filesystem"
kubescape_resources_found_count{framework="NSA",control="Immutable container filesystem"} 17
# Failed object from "NSA" control "Immutable container filesystem"
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="kube-system",name="etcd-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Immutable container filesystem"
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="kube-system",name="kube-apiserver-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Immutable container filesystem"
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="kube-system",name="kube-controller-manager-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Immutable container filesystem"
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="kube-system",name="kube-scheduler-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Immutable container filesystem"
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Immutable container filesystem"
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="cyberarmor-system",name="ca-audit",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Immutable container filesystem"
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="cyberarmor-system",name="ca-dashboard-aggregator",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Immutable container filesystem"
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="cyberarmor-system",name="ca-notification-server",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Immutable container filesystem"
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="cyberarmor-system",name="ca-ocimage",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Immutable container filesystem"
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="cyberarmor-system",name="ca-oracle",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Immutable container filesystem"
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="cyberarmor-system",name="ca-posture",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Immutable container filesystem"
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="cyberarmor-system",name="ca-rbac",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Immutable container filesystem"
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="cyberarmor-system",name="ca-vuln-scan",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Immutable container filesystem"
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="cyberarmor-system",name="ca-webhook",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Immutable container filesystem"
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="cyberarmor-system",name="ca-websocket",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Immutable container filesystem"
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Immutable container filesystem"
kubescape_object_failed_count{framework="NSA",control="Immutable container filesystem",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1"} 1
# Number of resources found as part of excluded control "Immutable container filesystem"
kubescape_resources_found_count{framework="NSA",control="Immutable container filesystem"} 0
# Number of resources found as part of failed control "Non-root containers"
kubescape_resources_found_count{framework="NSA",control="Non-root containers"} 0
# Number of resources found as part of excluded control "Non-root containers"
kubescape_resources_found_count{framework="NSA",control="Non-root containers"} 0
# Number of resources found as part of failed control "Privileged container"
kubescape_resources_found_count{framework="NSA",control="Privileged container"} 1
# Failed object from "NSA" control "Privileged container"
kubescape_object_failed_count{framework="NSA",control="Privileged container",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1"} 1
# Number of resources found as part of excluded control "Privileged container"
kubescape_resources_found_count{framework="NSA",control="Privileged container"} 0
# Number of resources found as part of failed control "Allowed hostPath"
kubescape_resources_found_count{framework="NSA",control="Allowed hostPath"} 6
# Failed object from "NSA" control "Allowed hostPath"
kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespace="kube-system",name="etcd-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Allowed hostPath"
kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespace="kube-system",name="kube-controller-manager-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Allowed hostPath"
kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Allowed hostPath"
kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespace="cyberarmor-system",name="ca-webhook",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Allowed hostPath"
kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespace="cyberarmor-system",name="ca-websocket",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Allowed hostPath"
kubescape_object_failed_count{framework="NSA",control="Allowed hostPath",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1"} 1
# Number of resources found as part of excluded control "Allowed hostPath"
kubescape_resources_found_count{framework="NSA",control="Allowed hostPath"} 0
# Number of resources found as part of failed control "Automatic mapping of service account"
kubescape_resources_found_count{framework="NSA",control="Automatic mapping of service account"} 44
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="cyberarmor-system",name="ca-audit",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="cyberarmor-system",name="ca-controller-service-account",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="cyberarmor-system",name="default",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="default",name="default",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-node-lease",name="default",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-public",name="default",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="attachdetach-controller",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="bootstrap-signer",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="certificate-controller",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="clusterrole-aggregation-controller",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="coredns",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="cronjob-controller",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="daemon-set-controller",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="default",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="deployment-controller",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="disruption-controller",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="endpoint-controller",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="endpointslice-controller",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="endpointslicemirroring-controller",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="ephemeral-volume-controller",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="expand-controller",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="generic-garbage-collector",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="horizontal-pod-autoscaler",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="job-controller",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="kube-proxy",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="namespace-controller",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="node-controller",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="persistent-volume-binder",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="pod-garbage-collector",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="pv-protection-controller",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="pvc-protection-controller",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="replicaset-controller",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="replication-controller",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="resourcequota-controller",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="root-ca-cert-publisher",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="service-account-controller",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="service-controller",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="statefulset-controller",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="token-cleaner",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="ttl-after-finished-controller",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="kube-system",name="ttl-controller",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="nginx-ingress",name="default",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Automatic mapping of service account"
kubescape_object_failed_count{framework="NSA",control="Automatic mapping of service account",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="v1"} 1
# Number of resources found as part of excluded control "Automatic mapping of service account"
kubescape_resources_found_count{framework="NSA",control="Automatic mapping of service account"} 0
# Number of resources found as part of failed control "hostNetwork access"
kubescape_resources_found_count{framework="NSA",control="hostNetwork access"} 6
# Failed object from "NSA" control "hostNetwork access"
kubescape_object_failed_count{framework="NSA",control="hostNetwork access",namespace="kube-system",name="etcd-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "NSA" control "hostNetwork access"
kubescape_object_failed_count{framework="NSA",control="hostNetwork access",namespace="kube-system",name="kube-apiserver-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "NSA" control "hostNetwork access"
kubescape_object_failed_count{framework="NSA",control="hostNetwork access",namespace="kube-system",name="kube-controller-manager-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "NSA" control "hostNetwork access"
kubescape_object_failed_count{framework="NSA",control="hostNetwork access",namespace="kube-system",name="kube-scheduler-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "NSA" control "hostNetwork access"
kubescape_object_failed_count{framework="NSA",control="hostNetwork access",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1"} 1
# Failed object from "NSA" control "hostNetwork access"
kubescape_object_failed_count{framework="NSA",control="hostNetwork access",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1"} 1
# Number of resources found as part of excluded control "hostNetwork access"
kubescape_resources_found_count{framework="NSA",control="hostNetwork access"} 0
# Number of resources found as part of failed control "Resource policies"
kubescape_resources_found_count{framework="NSA",control="Resource policies"} 7
# Failed object from "NSA" control "Resource policies"
kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="kube-system",name="etcd-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Resource policies"
kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="kube-system",name="kube-apiserver-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Resource policies"
kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="kube-system",name="kube-controller-manager-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Resource policies"
kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="kube-system",name="kube-scheduler-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Resource policies"
kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Resource policies"
kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Resource policies"
kubescape_object_failed_count{framework="NSA",control="Resource policies",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1"} 1
# Number of resources found as part of excluded control "Resource policies"
kubescape_resources_found_count{framework="NSA",control="Resource policies"} 0
# Number of resources found as part of failed control "Exposed dashboard"
kubescape_resources_found_count{framework="NSA",control="Exposed dashboard"} 0
# Number of resources found as part of excluded control "Exposed dashboard"
kubescape_resources_found_count{framework="NSA",control="Exposed dashboard"} 0
# Number of resources found as part of failed control "Allow privilege escalation"
kubescape_resources_found_count{framework="NSA",control="Allow privilege escalation"} 17
# Failed object from "NSA" control "Allow privilege escalation"
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kube-system",name="etcd-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Allow privilege escalation"
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kube-system",name="kube-apiserver-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Allow privilege escalation"
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kube-system",name="kube-controller-manager-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Allow privilege escalation"
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kube-system",name="kube-scheduler-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Allow privilege escalation"
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Allow privilege escalation"
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="cyberarmor-system",name="ca-audit",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Allow privilege escalation"
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="cyberarmor-system",name="ca-dashboard-aggregator",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Allow privilege escalation"
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="cyberarmor-system",name="ca-notification-server",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Allow privilege escalation"
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="cyberarmor-system",name="ca-ocimage",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Allow privilege escalation"
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="cyberarmor-system",name="ca-oracle",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Allow privilege escalation"
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="cyberarmor-system",name="ca-posture",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Allow privilege escalation"
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="cyberarmor-system",name="ca-rbac",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Allow privilege escalation"
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="cyberarmor-system",name="ca-vuln-scan",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Allow privilege escalation"
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="cyberarmor-system",name="ca-webhook",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Allow privilege escalation"
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="cyberarmor-system",name="ca-websocket",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Allow privilege escalation"
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Allow privilege escalation"
kubescape_object_failed_count{framework="NSA",control="Allow privilege escalation",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1"} 1
# Number of resources found as part of excluded control "Allow privilege escalation"
kubescape_resources_found_count{framework="NSA",control="Allow privilege escalation"} 0
# Number of resources found as part of failed control "Applications credentials in configuration files"
kubescape_resources_found_count{framework="NSA",control="Applications credentials in configuration files"} 7
# Failed object from "NSA" control "Applications credentials in configuration files"
kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="kube-system",name="extension-apiserver-authentication",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Applications credentials in configuration files"
kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="cyberarmor-system",name="kube-root-ca.crt",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Applications credentials in configuration files"
kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="default",name="kube-root-ca.crt",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Applications credentials in configuration files"
kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="kube-node-lease",name="kube-root-ca.crt",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Applications credentials in configuration files"
kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="kube-public",name="kube-root-ca.crt",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Applications credentials in configuration files"
kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="kube-system",name="kube-root-ca.crt",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Applications credentials in configuration files"
kubescape_object_failed_count{framework="NSA",control="Applications credentials in configuration files",namespace="nginx-ingress",name="kube-root-ca.crt",groupVersionKind="v1"} 1
# Number of resources found as part of excluded control "Applications credentials in configuration files"
kubescape_resources_found_count{framework="NSA",control="Applications credentials in configuration files"} 0
# Number of resources found as part of failed control "Cluster-admin binding"
kubescape_resources_found_count{framework="NSA",control="Cluster-admin binding"} 4
# Failed object from "NSA" control "Cluster-admin binding"
kubescape_object_failed_count{framework="NSA",control="Cluster-admin binding",namespace="cyberarmor-system",name="ca-controller-service-account",groupVersionKind=""} 1
# Failed object from "NSA" control "Cluster-admin binding"
kubescape_object_failed_count{framework="NSA",control="Cluster-admin binding",name="system:masters",groupVersionKind="rbac.authorization.k8s.io"} 1
# Failed object from "NSA" control "Cluster-admin binding"
kubescape_object_failed_count{framework="NSA",control="Cluster-admin binding",namespace="kube-system",name="default",groupVersionKind=""} 1
# Failed object from "NSA" control "Cluster-admin binding"
kubescape_object_failed_count{framework="NSA",control="Cluster-admin binding",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind=""} 1
# Number of resources found as part of excluded control "Cluster-admin binding"
kubescape_resources_found_count{framework="NSA",control="Cluster-admin binding"} 0
# Number of resources found as part of failed control "Exec into container"
kubescape_resources_found_count{framework="NSA",control="Exec into container"} 4
# Failed object from "NSA" control "Exec into container"
kubescape_object_failed_count{framework="NSA",control="Exec into container",namespace="cyberarmor-system",name="ca-controller-service-account",groupVersionKind=""} 1
# Failed object from "NSA" control "Exec into container"
kubescape_object_failed_count{framework="NSA",control="Exec into container",name="system:masters",groupVersionKind="rbac.authorization.k8s.io"} 1
# Failed object from "NSA" control "Exec into container"
kubescape_object_failed_count{framework="NSA",control="Exec into container",namespace="kube-system",name="default",groupVersionKind=""} 1
# Failed object from "NSA" control "Exec into container"
kubescape_object_failed_count{framework="NSA",control="Exec into container",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind=""} 1
# Number of resources found as part of excluded control "Exec into container"
kubescape_resources_found_count{framework="NSA",control="Exec into container"} 0
# Number of resources found as part of failed control "Dangerous capabilities"
kubescape_resources_found_count{framework="NSA",control="Dangerous capabilities"} 0
# Number of resources found as part of excluded control "Dangerous capabilities"
kubescape_resources_found_count{framework="NSA",control="Dangerous capabilities"} 0
# Number of resources found as part of failed control "Insecure capabilities"
kubescape_resources_found_count{framework="NSA",control="Insecure capabilities"} 1
# Failed object from "NSA" control "Insecure capabilities"
kubescape_object_failed_count{framework="NSA",control="Insecure capabilities",namespace="kube-system",name="coredns",groupVersionKind="apps/v1"} 1
# Number of resources found as part of excluded control "Insecure capabilities"
kubescape_resources_found_count{framework="NSA",control="Insecure capabilities"} 0
# Number of resources found as part of failed control "Linux hardening"
kubescape_resources_found_count{framework="NSA",control="Linux hardening"} 13
# Failed object from "NSA" control "Linux hardening"
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Linux hardening"
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="cyberarmor-system",name="ca-audit",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Linux hardening"
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="cyberarmor-system",name="ca-dashboard-aggregator",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Linux hardening"
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="cyberarmor-system",name="ca-notification-server",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Linux hardening"
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="cyberarmor-system",name="ca-ocimage",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Linux hardening"
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="cyberarmor-system",name="ca-oracle",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Linux hardening"
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="cyberarmor-system",name="ca-posture",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Linux hardening"
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="cyberarmor-system",name="ca-rbac",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Linux hardening"
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="cyberarmor-system",name="ca-vuln-scan",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Linux hardening"
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="cyberarmor-system",name="ca-webhook",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Linux hardening"
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="cyberarmor-system",name="ca-websocket",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Linux hardening"
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Linux hardening"
kubescape_object_failed_count{framework="NSA",control="Linux hardening",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1"} 1
# Number of resources found as part of excluded control "Linux hardening"
kubescape_resources_found_count{framework="NSA",control="Linux hardening"} 0
# Number of resources found as part of failed control "Ingress and Egress blocked"
kubescape_resources_found_count{framework="NSA",control="Ingress and Egress blocked"} 18
# Failed object from "NSA" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kube-system",name="etcd-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kube-system",name="kube-apiserver-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kube-system",name="kube-controller-manager-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kube-system",name="kube-scheduler-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="cyberarmor-system",name="ca-audit",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="cyberarmor-system",name="ca-dashboard-aggregator",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="cyberarmor-system",name="ca-notification-server",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="cyberarmor-system",name="ca-ocimage",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="cyberarmor-system",name="ca-oracle",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="cyberarmor-system",name="ca-posture",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="cyberarmor-system",name="ca-rbac",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="cyberarmor-system",name="ca-vuln-scan",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="cyberarmor-system",name="ca-webhook",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="cyberarmor-system",name="ca-websocket",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kube-system",name="coredns",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="apps/v1"} 1
# Failed object from "NSA" control "Ingress and Egress blocked"
kubescape_object_failed_count{framework="NSA",control="Ingress and Egress blocked",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1"} 1
# Number of resources found as part of excluded control "Ingress and Egress blocked"
kubescape_resources_found_count{framework="NSA",control="Ingress and Egress blocked"} 0
# Number of resources found as part of failed control "Container hostPort"
kubescape_resources_found_count{framework="NSA",control="Container hostPort"} 0
# Number of resources found as part of excluded control "Container hostPort"
kubescape_resources_found_count{framework="NSA",control="Container hostPort"} 0
# Number of resources found as part of failed control "Network policies"
kubescape_resources_found_count{framework="NSA",control="Network policies"} 6
# Failed object from "NSA" control "Network policies"
kubescape_object_failed_count{framework="NSA",control="Network policies",name="cyberarmor-system",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Network policies"
kubescape_object_failed_count{framework="NSA",control="Network policies",name="default",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Network policies"
kubescape_object_failed_count{framework="NSA",control="Network policies",name="kube-node-lease",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Network policies"
kubescape_object_failed_count{framework="NSA",control="Network policies",name="kube-public",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Network policies"
kubescape_object_failed_count{framework="NSA",control="Network policies",name="kube-system",groupVersionKind="v1"} 1
# Failed object from "NSA" control "Network policies"
kubescape_object_failed_count{framework="NSA",control="Network policies",name="nginx-ingress",groupVersionKind="v1"} 1
# Number of resources found as part of excluded control "Network policies"
kubescape_resources_found_count{framework="NSA",control="Network policies"} 0
# Number of resources found as part of failed control "CVE-2021-25741 - Using symlink for arbitrary host file system access."
kubescape_resources_found_count{framework="NSA",control="CVE-2021-25741 - Using symlink for arbitrary host file system access."} 0
# Number of resources found as part of excluded control "CVE-2021-25741 - Using symlink for arbitrary host file system access."
kubescape_resources_found_count{framework="NSA",control="CVE-2021-25741 - Using symlink for arbitrary host file system access."} 0
# Number of resources found as part of failed control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability"
kubescape_resources_found_count{framework="NSA",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability"} 1
# Failed object from "NSA" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability"
kubescape_object_failed_count{framework="NSA",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="apps/v1"} 1
# Number of resources found as part of excluded control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability"
kubescape_resources_found_count{framework="NSA",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability"} 0
# Number of resources found as part of failed control "Access container service account"
kubescape_resources_found_count{framework="MITRE",control="Access container service account"} 24
# Failed object from "MITRE" control "Access container service account"
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="kube-system",name="system:persistent-volume-provisioner",groupVersionKind="rbac.authorization.k8s.io/v1"} 1
# Failed object from "MITRE" control "Access container service account"
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="kube-system",name="system:persistent-volume-provisioner",groupVersionKind="rbac.authorization.k8s.io/v1"} 1
# Failed object from "MITRE" control "Access container service account"
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1"} 1
# Failed object from "MITRE" control "Access container service account"
kubescape_object_failed_count{framework="MITRE",control="Access container service account",name="system:persistent-volume-provisioner",groupVersionKind="rbac.authorization.k8s.io/v1"} 1
# Failed object from "MITRE" control "Access container service account"
kubescape_object_failed_count{framework="MITRE",control="Access container service account",name="storage-provisioner",groupVersionKind="rbac.authorization.k8s.io/v1"} 1
# Failed object from "MITRE" control "Access container service account"
kubescape_object_failed_count{framework="MITRE",control="Access container service account",name="ca-controller-role-binding",groupVersionKind="rbac.authorization.k8s.io/v1"} 1
# Failed object from "MITRE" control "Access container service account"
kubescape_object_failed_count{framework="MITRE",control="Access container service account",name="ca-controller-roles",groupVersionKind="rbac.authorization.k8s.io/v1"} 1
# Failed object from "MITRE" control "Access container service account"
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="cyberarmor-system",name="ca-dashboard-aggregator",groupVersionKind="apps/v1"} 1
# Failed object from "MITRE" control "Access container service account"
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="cyberarmor-system",name="ca-ocimage",groupVersionKind="apps/v1"} 1
# Failed object from "MITRE" control "Access container service account"
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="cyberarmor-system",name="ca-oracle",groupVersionKind="apps/v1"} 1
# Failed object from "MITRE" control "Access container service account"
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="cyberarmor-system",name="ca-posture",groupVersionKind="apps/v1"} 1
# Failed object from "MITRE" control "Access container service account"
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="cyberarmor-system",name="ca-rbac",groupVersionKind="apps/v1"} 1
# Failed object from "MITRE" control "Access container service account"
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="cyberarmor-system",name="ca-vuln-scan",groupVersionKind="apps/v1"} 1
# Failed object from "MITRE" control "Access container service account"
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="cyberarmor-system",name="ca-webhook",groupVersionKind="apps/v1"} 1
# Failed object from "MITRE" control "Access container service account"
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="cyberarmor-system",name="ca-websocket",groupVersionKind="apps/v1"} 1
# Failed object from "MITRE" control "Access container service account"
kubescape_object_failed_count{framework="MITRE",control="Access container service account",name="system:coredns",groupVersionKind="rbac.authorization.k8s.io/v1"} 1
# Failed object from "MITRE" control "Access container service account"
kubescape_object_failed_count{framework="MITRE",control="Access container service account",name="system:coredns",groupVersionKind="rbac.authorization.k8s.io/v1"} 1
# Failed object from "MITRE" control "Access container service account"
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="kube-system",name="coredns",groupVersionKind="apps/v1"} 1
# Failed object from "MITRE" control "Access container service account"
kubescape_object_failed_count{framework="MITRE",control="Access container service account",name="kubeadm:node-proxier",groupVersionKind="rbac.authorization.k8s.io/v1"} 1
# Failed object from "MITRE" control "Access container service account"
kubescape_object_failed_count{framework="MITRE",control="Access container service account",name="system:node-proxier",groupVersionKind="rbac.authorization.k8s.io/v1"} 1
# Failed object from "MITRE" control "Access container service account"
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1"} 1
# Failed object from "MITRE" control "Access container service account"
kubescape_object_failed_count{framework="MITRE",control="Access container service account",name="nginx-ingress-roles-binding",groupVersionKind="rbac.authorization.k8s.io/v1"} 1
# Failed object from "MITRE" control "Access container service account"
kubescape_object_failed_count{framework="MITRE",control="Access container service account",name="nginx-ingress-roles",groupVersionKind="rbac.authorization.k8s.io/v1"} 1
# Failed object from "MITRE" control "Access container service account"
kubescape_object_failed_count{framework="MITRE",control="Access container service account",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="apps/v1"} 1
# Number of resources found as part of excluded control "Access container service account"
kubescape_resources_found_count{framework="MITRE",control="Access container service account"} 0
# Number of resources found as part of failed control "Access Kubernetes dashboard"
kubescape_resources_found_count{framework="MITRE",control="Access Kubernetes dashboard"} 0
# Number of resources found as part of excluded control "Access Kubernetes dashboard"
kubescape_resources_found_count{framework="MITRE",control="Access Kubernetes dashboard"} 0
# Number of resources found as part of failed control "Access tiller endpoint"
kubescape_resources_found_count{framework="MITRE",control="Access tiller endpoint"} 0
# Number of resources found as part of excluded control "Access tiller endpoint"
kubescape_resources_found_count{framework="MITRE",control="Access tiller endpoint"} 0
# Number of resources found as part of failed control "Applications credentials in configuration files"
kubescape_resources_found_count{framework="MITRE",control="Applications credentials in configuration files"} 0
# Number of resources found as part of excluded control "Applications credentials in configuration files"
kubescape_resources_found_count{framework="MITRE",control="Applications credentials in configuration files"} 0
# Number of resources found as part of failed control "Cluster-admin binding"
kubescape_resources_found_count{framework="MITRE",control="Cluster-admin binding"} 4
# Failed object from "MITRE" control "Cluster-admin binding"
kubescape_object_failed_count{framework="MITRE",control="Cluster-admin binding",namespace="cyberarmor-system",name="ca-controller-service-account",groupVersionKind=""} 1
# Failed object from "MITRE" control "Cluster-admin binding"
kubescape_object_failed_count{framework="MITRE",control="Cluster-admin binding",name="system:masters",groupVersionKind="rbac.authorization.k8s.io"} 1
# Failed object from "MITRE" control "Cluster-admin binding"
kubescape_object_failed_count{framework="MITRE",control="Cluster-admin binding",namespace="kube-system",name="default",groupVersionKind=""} 1
# Failed object from "MITRE" control "Cluster-admin binding"
kubescape_object_failed_count{framework="MITRE",control="Cluster-admin binding",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind=""} 1
# Number of resources found as part of excluded control "Cluster-admin binding"
kubescape_resources_found_count{framework="MITRE",control="Cluster-admin binding"} 0
# Number of resources found as part of failed control "Cluster internal networking"
kubescape_resources_found_count{framework="MITRE",control="Cluster internal networking"} 6
# Failed object from "MITRE" control "Cluster internal networking"
kubescape_object_failed_count{framework="MITRE",control="Cluster internal networking",name="cyberarmor-system",groupVersionKind="v1"} 1
# Failed object from "MITRE" control "Cluster internal networking"
kubescape_object_failed_count{framework="MITRE",control="Cluster internal networking",name="default",groupVersionKind="v1"} 1
# Failed object from "MITRE" control "Cluster internal networking"
kubescape_object_failed_count{framework="MITRE",control="Cluster internal networking",name="kube-node-lease",groupVersionKind="v1"} 1
# Failed object from "MITRE" control "Cluster internal networking"
kubescape_object_failed_count{framework="MITRE",control="Cluster internal networking",name="kube-public",groupVersionKind="v1"} 1
# Failed object from "MITRE" control "Cluster internal networking"
kubescape_object_failed_count{framework="MITRE",control="Cluster internal networking",name="kube-system",groupVersionKind="v1"} 1
# Failed object from "MITRE" control "Cluster internal networking"
kubescape_object_failed_count{framework="MITRE",control="Cluster internal networking",name="nginx-ingress",groupVersionKind="v1"} 1
# Number of resources found as part of excluded control "Cluster internal networking"
kubescape_resources_found_count{framework="MITRE",control="Cluster internal networking"} 0
# Number of resources found as part of failed control "Exec into container"
kubescape_resources_found_count{framework="MITRE",control="Exec into container"} 4
# Failed object from "MITRE" control "Exec into container"
kubescape_object_failed_count{framework="MITRE",control="Exec into container",namespace="cyberarmor-system",name="ca-controller-service-account",groupVersionKind=""} 1
# Failed object from "MITRE" control "Exec into container"
kubescape_object_failed_count{framework="MITRE",control="Exec into container",name="system:masters",groupVersionKind="rbac.authorization.k8s.io"} 1
# Failed object from "MITRE" control "Exec into container"
kubescape_object_failed_count{framework="MITRE",control="Exec into container",namespace="kube-system",name="default",groupVersionKind=""} 1
# Failed object from "MITRE" control "Exec into container"
kubescape_object_failed_count{framework="MITRE",control="Exec into container",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind=""} 1
# Number of resources found as part of excluded control "Exec into container"
kubescape_resources_found_count{framework="MITRE",control="Exec into container"} 0
# Number of resources found as part of failed control "Exposed dashboard"
kubescape_resources_found_count{framework="MITRE",control="Exposed dashboard"} 0
# Number of resources found as part of excluded control "Exposed dashboard"
kubescape_resources_found_count{framework="MITRE",control="Exposed dashboard"} 0
# Number of resources found as part of failed control "Exposed sensitive interfaces"
kubescape_resources_found_count{framework="MITRE",control="Exposed sensitive interfaces"} 0
# Number of resources found as part of excluded control "Exposed sensitive interfaces"
kubescape_resources_found_count{framework="MITRE",control="Exposed sensitive interfaces"} 0
# Number of resources found as part of failed control "hostPath mount"
kubescape_resources_found_count{framework="MITRE",control="hostPath mount"} 6
# Failed object from "MITRE" control "hostPath mount"
kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="kube-system",name="etcd-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "MITRE" control "hostPath mount"
kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="kube-system",name="kube-apiserver-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "MITRE" control "hostPath mount"
kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="kube-system",name="kube-controller-manager-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "MITRE" control "hostPath mount"
kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="kube-system",name="kube-scheduler-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "MITRE" control "hostPath mount"
kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="cyberarmor-system",name="ca-webhook",groupVersionKind="apps/v1"} 1
# Failed object from "MITRE" control "hostPath mount"
kubescape_object_failed_count{framework="MITRE",control="hostPath mount",namespace="cyberarmor-system",name="ca-websocket",groupVersionKind="apps/v1"} 1
# Number of resources found as part of excluded control "hostPath mount"
kubescape_resources_found_count{framework="MITRE",control="hostPath mount"} 0
# Number of resources found as part of failed control "List Kubernetes secrets"
kubescape_resources_found_count{framework="MITRE",control="List Kubernetes secrets"} 13
# Failed object from "MITRE" control "List Kubernetes secrets"
kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="cyberarmor-system",name="ca-controller-service-account",groupVersionKind=""} 1
# Failed object from "MITRE" control "List Kubernetes secrets"
kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",name="system:masters",groupVersionKind="rbac.authorization.k8s.io"} 1
# Failed object from "MITRE" control "List Kubernetes secrets"
kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="kube-system",name="default",groupVersionKind=""} 1
# Failed object from "MITRE" control "List Kubernetes secrets"
kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind=""} 1
# Failed object from "MITRE" control "List Kubernetes secrets"
kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="kube-system",name="expand-controller",groupVersionKind=""} 1
# Failed object from "MITRE" control "List Kubernetes secrets"
kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="kube-system",name="generic-garbage-collector",groupVersionKind=""} 1
# Failed object from "MITRE" control "List Kubernetes secrets"
kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="kube-system",name="namespace-controller",groupVersionKind=""} 1
# Failed object from "MITRE" control "List Kubernetes secrets"
kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="kube-system",name="persistent-volume-binder",groupVersionKind=""} 1
# Failed object from "MITRE" control "List Kubernetes secrets"
kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="kube-system",name="resourcequota-controller",groupVersionKind=""} 1
# Failed object from "MITRE" control "List Kubernetes secrets"
kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",name="system:kube-controller-manager",groupVersionKind="rbac.authorization.k8s.io"} 1
# Failed object from "MITRE" control "List Kubernetes secrets"
kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="kube-system",name="bootstrap-signer",groupVersionKind=""} 1
# Failed object from "MITRE" control "List Kubernetes secrets"
kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="kube-system",name="bootstrap-signer",groupVersionKind=""} 1
# Failed object from "MITRE" control "List Kubernetes secrets"
kubescape_object_failed_count{framework="MITRE",control="List Kubernetes secrets",namespace="kube-system",name="token-cleaner",groupVersionKind=""} 1
# Number of resources found as part of excluded control "List Kubernetes secrets"
kubescape_resources_found_count{framework="MITRE",control="List Kubernetes secrets"} 0
# Number of resources found as part of failed control "Mount service principal"
kubescape_resources_found_count{framework="MITRE",control="Mount service principal"} 6
# Failed object from "MITRE" control "Mount service principal"
kubescape_object_failed_count{framework="MITRE",control="Mount service principal",namespace="kube-system",name="etcd-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "MITRE" control "Mount service principal"
kubescape_object_failed_count{framework="MITRE",control="Mount service principal",namespace="kube-system",name="kube-apiserver-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "MITRE" control "Mount service principal"
kubescape_object_failed_count{framework="MITRE",control="Mount service principal",namespace="kube-system",name="kube-controller-manager-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "MITRE" control "Mount service principal"
kubescape_object_failed_count{framework="MITRE",control="Mount service principal",namespace="kube-system",name="kube-scheduler-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "MITRE" control "Mount service principal"
kubescape_object_failed_count{framework="MITRE",control="Mount service principal",namespace="cyberarmor-system",name="ca-webhook",groupVersionKind="apps/v1"} 1
# Failed object from "MITRE" control "Mount service principal"
kubescape_object_failed_count{framework="MITRE",control="Mount service principal",namespace="cyberarmor-system",name="ca-websocket",groupVersionKind="apps/v1"} 1
# Number of resources found as part of excluded control "Mount service principal"
kubescape_resources_found_count{framework="MITRE",control="Mount service principal"} 0
# Number of resources found as part of failed control "Network mapping"
kubescape_resources_found_count{framework="MITRE",control="Network mapping"} 6
# Failed object from "MITRE" control "Network mapping"
kubescape_object_failed_count{framework="MITRE",control="Network mapping",name="cyberarmor-system",groupVersionKind="v1"} 1
# Failed object from "MITRE" control "Network mapping"
kubescape_object_failed_count{framework="MITRE",control="Network mapping",name="default",groupVersionKind="v1"} 1
# Failed object from "MITRE" control "Network mapping"
kubescape_object_failed_count{framework="MITRE",control="Network mapping",name="kube-node-lease",groupVersionKind="v1"} 1
# Failed object from "MITRE" control "Network mapping"
kubescape_object_failed_count{framework="MITRE",control="Network mapping",name="kube-public",groupVersionKind="v1"} 1
# Failed object from "MITRE" control "Network mapping"
kubescape_object_failed_count{framework="MITRE",control="Network mapping",name="kube-system",groupVersionKind="v1"} 1
# Failed object from "MITRE" control "Network mapping"
kubescape_object_failed_count{framework="MITRE",control="Network mapping",name="nginx-ingress",groupVersionKind="v1"} 1
# Number of resources found as part of excluded control "Network mapping"
kubescape_resources_found_count{framework="MITRE",control="Network mapping"} 0
# Number of resources found as part of failed control "Privileged container"
kubescape_resources_found_count{framework="MITRE",control="Privileged container"} 1
# Failed object from "MITRE" control "Privileged container"
kubescape_object_failed_count{framework="MITRE",control="Privileged container",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1"} 1
# Number of resources found as part of excluded control "Privileged container"
kubescape_resources_found_count{framework="MITRE",control="Privileged container"} 0
# Number of resources found as part of failed control "SSH server running inside container"
kubescape_resources_found_count{framework="MITRE",control="SSH server running inside container"} 0
# Number of resources found as part of excluded control "SSH server running inside container"
kubescape_resources_found_count{framework="MITRE",control="SSH server running inside container"} 0
# Number of resources found as part of failed control "Writable hostPath mount"
kubescape_resources_found_count{framework="MITRE",control="Writable hostPath mount"} 6
# Failed object from "MITRE" control "Writable hostPath mount"
kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="kube-system",name="etcd-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "MITRE" control "Writable hostPath mount"
kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="kube-system",name="kube-controller-manager-david-virtualbox",groupVersionKind="v1"} 1
# Failed object from "MITRE" control "Writable hostPath mount"
kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="kube-system",name="storage-provisioner",groupVersionKind="v1"} 1
# Failed object from "MITRE" control "Writable hostPath mount"
kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="cyberarmor-system",name="ca-webhook",groupVersionKind="apps/v1"} 1
# Failed object from "MITRE" control "Writable hostPath mount"
kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="cyberarmor-system",name="ca-websocket",groupVersionKind="apps/v1"} 1
# Failed object from "MITRE" control "Writable hostPath mount"
kubescape_object_failed_count{framework="MITRE",control="Writable hostPath mount",namespace="kube-system",name="kube-proxy",groupVersionKind="apps/v1"} 1
# Number of resources found as part of excluded control "Writable hostPath mount"
kubescape_resources_found_count{framework="MITRE",control="Writable hostPath mount"} 0
# Number of resources found as part of failed control "Malicious admission controller (mutating)"
kubescape_resources_found_count{framework="MITRE",control="Malicious admission controller (mutating)"} 1
# Failed object from "MITRE" control "Malicious admission controller (mutating)"
kubescape_object_failed_count{framework="MITRE",control="Malicious admission controller (mutating)",name="ca-mutate-cfg",groupVersionKind="admissionregistration.k8s.io/v1"} 1
# Number of resources found as part of excluded control "Malicious admission controller (mutating)"
kubescape_resources_found_count{framework="MITRE",control="Malicious admission controller (mutating)"} 0
# Number of resources found as part of failed control "Malicious admission controller (validating)"
kubescape_resources_found_count{framework="MITRE",control="Malicious admission controller (validating)"} 1
# Failed object from "MITRE" control "Malicious admission controller (validating)"
kubescape_object_failed_count{framework="MITRE",control="Malicious admission controller (validating)",name="ca-validate-cfg",groupVersionKind="admissionregistration.k8s.io/v1"} 1
# Number of resources found as part of excluded control "Malicious admission controller (validating)"
kubescape_resources_found_count{framework="MITRE",control="Malicious admission controller (validating)"} 0
# Number of resources found as part of failed control "Delete Kubernetes events"
kubescape_resources_found_count{framework="MITRE",control="Delete Kubernetes events"} 6
# Failed object from "MITRE" control "Delete Kubernetes events"
kubescape_object_failed_count{framework="MITRE",control="Delete Kubernetes events",namespace="cyberarmor-system",name="ca-controller-service-account",groupVersionKind=""} 1
# Failed object from "MITRE" control "Delete Kubernetes events"
kubescape_object_failed_count{framework="MITRE",control="Delete Kubernetes events",name="system:masters",groupVersionKind="rbac.authorization.k8s.io"} 1
# Failed object from "MITRE" control "Delete Kubernetes events"
kubescape_object_failed_count{framework="MITRE",control="Delete Kubernetes events",namespace="kube-system",name="default",groupVersionKind=""} 1
# Failed object from "MITRE" control "Delete Kubernetes events"
kubescape_object_failed_count{framework="MITRE",control="Delete Kubernetes events",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind=""} 1
# Failed object from "MITRE" control "Delete Kubernetes events"
kubescape_object_failed_count{framework="MITRE",control="Delete Kubernetes events",namespace="kube-system",name="generic-garbage-collector",groupVersionKind=""} 1
# Failed object from "MITRE" control "Delete Kubernetes events"
kubescape_object_failed_count{framework="MITRE",control="Delete Kubernetes events",namespace="kube-system",name="namespace-controller",groupVersionKind=""} 1
# Number of resources found as part of excluded control "Delete Kubernetes events"
kubescape_resources_found_count{framework="MITRE",control="Delete Kubernetes events"} 0
# Number of resources found as part of failed control "CoreDNS poisoning"
kubescape_resources_found_count{framework="MITRE",control="CoreDNS poisoning"} 6
# Failed object from "MITRE" control "CoreDNS poisoning"
kubescape_object_failed_count{framework="MITRE",control="CoreDNS poisoning",namespace="cyberarmor-system",name="ca-controller-service-account",groupVersionKind=""} 1
# Failed object from "MITRE" control "CoreDNS poisoning"
kubescape_object_failed_count{framework="MITRE",control="CoreDNS poisoning",name="system:masters",groupVersionKind="rbac.authorization.k8s.io"} 1
# Failed object from "MITRE" control "CoreDNS poisoning"
kubescape_object_failed_count{framework="MITRE",control="CoreDNS poisoning",namespace="kube-system",name="default",groupVersionKind=""} 1
# Failed object from "MITRE" control "CoreDNS poisoning"
kubescape_object_failed_count{framework="MITRE",control="CoreDNS poisoning",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind=""} 1
# Failed object from "MITRE" control "CoreDNS poisoning"
kubescape_object_failed_count{framework="MITRE",control="CoreDNS poisoning",namespace="kube-system",name="generic-garbage-collector",groupVersionKind=""} 1
# Failed object from "MITRE" control "CoreDNS poisoning"
kubescape_object_failed_count{framework="MITRE",control="CoreDNS poisoning",namespace="kube-system",name="root-ca-cert-publisher",groupVersionKind=""} 1
# Number of resources found as part of excluded control "CoreDNS poisoning"
kubescape_resources_found_count{framework="MITRE",control="CoreDNS poisoning"} 0
# Number of resources found as part of failed control "Data Destruction"
kubescape_resources_found_count{framework="MITRE",control="Data Destruction"} 20
# Failed object from "MITRE" control "Data Destruction"
kubescape_object_failed_count{framework="MITRE",control="Data Destruction",namespace="cyberarmor-system",name="ca-controller-service-account",groupVersionKind=""} 1
# Failed object from "MITRE" control "Data Destruction"
kubescape_object_failed_count{framework="MITRE",control="Data Destruction",name="system:masters",groupVersionKind="rbac.authorization.k8s.io"} 1
# Failed object from "MITRE" control "Data Destruction"
kubescape_object_failed_count{framework="MITRE",control="Data Destruction",namespace="kube-system",name="default",groupVersionKind=""} 1
# Failed object from "MITRE" control "Data Destruction"
kubescape_object_failed_count{framework="MITRE",control="Data Destruction",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind=""} 1
# Failed object from "MITRE" control "Data Destruction"
kubescape_object_failed_count{framework="MITRE",control="Data Destruction",namespace="kube-system",name="cronjob-controller",groupVersionKind=""} 1
# Failed object from "MITRE" control "Data Destruction"
kubescape_object_failed_count{framework="MITRE",control="Data Destruction",namespace="kube-system",name="daemon-set-controller",groupVersionKind=""} 1
# Failed object from "MITRE" control "Data Destruction"
kubescape_object_failed_count{framework="MITRE",control="Data Destruction",namespace="kube-system",name="deployment-controller",groupVersionKind=""} 1
# Failed object from "MITRE" control "Data Destruction"
kubescape_object_failed_count{framework="MITRE",control="Data Destruction",namespace="kube-system",name="generic-garbage-collector",groupVersionKind=""} 1
# Failed object from "MITRE" control "Data Destruction"
kubescape_object_failed_count{framework="MITRE",control="Data Destruction",namespace="kube-system",name="job-controller",groupVersionKind=""} 1
# Failed object from "MITRE" control "Data Destruction"
kubescape_object_failed_count{framework="MITRE",control="Data Destruction",namespace="kube-system",name="namespace-controller",groupVersionKind=""} 1
# Failed object from "MITRE" control "Data Destruction"
kubescape_object_failed_count{framework="MITRE",control="Data Destruction",namespace="kube-system",name="node-controller",groupVersionKind=""} 1
# Failed object from "MITRE" control "Data Destruction"
kubescape_object_failed_count{framework="MITRE",control="Data Destruction",namespace="kube-system",name="persistent-volume-binder",groupVersionKind=""} 1
# Failed object from "MITRE" control "Data Destruction"
kubescape_object_failed_count{framework="MITRE",control="Data Destruction",namespace="kube-system",name="pod-garbage-collector",groupVersionKind=""} 1
# Failed object from "MITRE" control "Data Destruction"
kubescape_object_failed_count{framework="MITRE",control="Data Destruction",namespace="kube-system",name="replicaset-controller",groupVersionKind=""} 1
# Failed object from "MITRE" control "Data Destruction"
kubescape_object_failed_count{framework="MITRE",control="Data Destruction",namespace="kube-system",name="replication-controller",groupVersionKind=""} 1
# Failed object from "MITRE" control "Data Destruction"
kubescape_object_failed_count{framework="MITRE",control="Data Destruction",namespace="kube-system",name="statefulset-controller",groupVersionKind=""} 1
# Failed object from "MITRE" control "Data Destruction"
kubescape_object_failed_count{framework="MITRE",control="Data Destruction",namespace="kube-system",name="ttl-after-finished-controller",groupVersionKind=""} 1
# Failed object from "MITRE" control "Data Destruction"
kubescape_object_failed_count{framework="MITRE",control="Data Destruction",name="system:kube-controller-manager",groupVersionKind="rbac.authorization.k8s.io"} 1
# Failed object from "MITRE" control "Data Destruction"
kubescape_object_failed_count{framework="MITRE",control="Data Destruction",name="system:kube-scheduler",groupVersionKind="rbac.authorization.k8s.io"} 1
# Failed object from "MITRE" control "Data Destruction"
kubescape_object_failed_count{framework="MITRE",control="Data Destruction",namespace="kube-system",name="token-cleaner",groupVersionKind=""} 1
# Number of resources found as part of excluded control "Data Destruction"
kubescape_resources_found_count{framework="MITRE",control="Data Destruction"} 0
# Number of resources found as part of failed control "CVE-2021-25741 - Using symlink for arbitrary host file system access."
kubescape_resources_found_count{framework="MITRE",control="CVE-2021-25741 - Using symlink for arbitrary host file system access."} 0
# Number of resources found as part of excluded control "CVE-2021-25741 - Using symlink for arbitrary host file system access."
kubescape_resources_found_count{framework="MITRE",control="CVE-2021-25741 - Using symlink for arbitrary host file system access."} 0
# Number of resources found as part of failed control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability"
kubescape_resources_found_count{framework="MITRE",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability"} 1
# Failed object from "MITRE" control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability"
kubescape_object_failed_count{framework="MITRE",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability",namespace="nginx-ingress",name="nginx-ingress",groupVersionKind="apps/v1"} 1
# Number of resources found as part of excluded control "CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability"
kubescape_resources_found_count{framework="MITRE",control="CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability"} 0
go.mod
+2 -2
View File
@@ -4,8 +4,8 @@ go 1.17
require (
github.com/armosec/armoapi-go v0.0.23
github.com/armosec/k8s-interface v0.0.21
github.com/armosec/opa-utils v0.0.53
github.com/armosec/k8s-interface v0.0.24
github.com/armosec/opa-utils v0.0.57
github.com/armosec/rbac-utils v0.0.1
github.com/armosec/utils-go v0.0.3
github.com/briandowns/spinner v1.16.0
go.sum
+4 -5
View File
@@ -87,11 +87,10 @@ github.com/armosec/armoapi-go v0.0.2/go.mod h1:vIK17yoKbJRQyZXWWLe3AqfqCRITxW8qm
github.com/armosec/armoapi-go v0.0.23 h1:jqoLIWM5CR7DCD9fpFgN0ePqtHvOCoZv/XzCwsUluJU=
github.com/armosec/armoapi-go v0.0.23/go.mod h1:iaVVGyc23QGGzAdv4n+szGQg3Rbpixn9yQTU3qWRpaw=
github.com/armosec/k8s-interface v0.0.8/go.mod h1:xxS+V5QT3gVQTwZyAMMDrYLWGrfKOpiJ7Jfhfa0w9sM=
github.com/armosec/k8s-interface v0.0.19/go.mod h1:0ztwEWLez2lpMMKHbs0DoZV64S0YIA4s72vCs9iAAiE=
github.com/armosec/k8s-interface v0.0.21 h1:x+UCdU7SEKU1E4fPkPQbGneC4BQljMmUcFdyRNAUry4=
github.com/armosec/k8s-interface v0.0.21/go.mod h1:0ztwEWLez2lpMMKHbs0DoZV64S0YIA4s72vCs9iAAiE=
github.com/armosec/opa-utils v0.0.53 h1:ibmKPK15kEcm53ddFIu8ZcL+hks1l/3ujMDYL1EXz2Q=
github.com/armosec/opa-utils v0.0.53/go.mod h1:9uMk9NbbJydxVztXcwhSgX307xMdGRD2R4pYwzSPi28=
github.com/armosec/k8s-interface v0.0.24 h1:rVFPpx/WqWFbFWDudBjKOhIMIon1Cd/fGFJtE2RBivU=
github.com/armosec/k8s-interface v0.0.24/go.mod h1:0ztwEWLez2lpMMKHbs0DoZV64S0YIA4s72vCs9iAAiE=
github.com/armosec/opa-utils v0.0.57 h1:7lDEKxblqfsEXLn+6lkj17ctBSnhDuYanfdqG55kW2g=
github.com/armosec/opa-utils v0.0.57/go.mod h1:UAT4Xokq91ysLa4Xg0WLqVsjJCnbFgsevkiIJFxTghU=
github.com/armosec/rbac-utils v0.0.1 h1:N2MI98F/0zbDjmRZ29CNElU1AXkFLk5csd/qAHOBdXY=
github.com/armosec/rbac-utils v0.0.1/go.mod h1:pQ8CBiij8kSKV7aeZm9FMvtZN28VgA7LZcYyTWimq40=
github.com/armosec/utils-go v0.0.2/go.mod h1:itWmRLzRdsnwjpEOomL0mBWGnVNNIxSjDAdyc+b0iUo=
opaprocessor/processorhandlerutils.go
+3 -1
View File
@@ -122,6 +122,7 @@ func removeConfigMapData(obj workloadinterface.IMetadata) {
workload := workloadinterface.NewWorkloadObj(obj.GetObject())
workload.RemoveAnnotation("kubectl.kubernetes.io/last-applied-configuration")
workloadinterface.RemoveFromMap(workload.GetObject(), "data")
workloadinterface.RemoveFromMap(workload.GetObject(), "metadata", "managedFields")
}
func removeSecretData(obj workloadinterface.IMetadata) {
@@ -129,7 +130,7 @@ func removeSecretData(obj workloadinterface.IMetadata) {
return // remove data only from kubernetes objects
}
workloadinterface.NewWorkloadObj(obj.GetObject()).RemoveSecretData()
workloadinterface.RemoveFromMap(obj.GetObject(), "metadata", "managedFields")
}
func removePodData(obj workloadinterface.IMetadata) {
if !workloadinterface.IsTypeWorkload(obj.GetObject()) {
@@ -137,6 +138,7 @@ func removePodData(obj workloadinterface.IMetadata) {
}
workload := workloadinterface.NewWorkloadObj(obj.GetObject())
workload.RemoveAnnotation("kubectl.kubernetes.io/last-applied-configuration")
workloadinterface.RemoveFromMap(workload.GetObject(), "metadata", "managedFields")
containers, err := workload.GetContainers()
if err != nil || len(containers) == 0 {
resourcehandler/fieldselector.go
+1 -1
View File
@@ -47,7 +47,7 @@ func getNamespacesSelector(resource *schema.GroupVersionResource, ns, operator s
fieldSelector := "metadata."
if resource.Resource == "namespaces" {
fieldSelector += "name"
} else if k8sinterface.IsNamespaceScope(resource.Group, resource.Resource) {
} else if k8sinterface.IsNamespaceScope(resource) {
fieldSelector += "namespace"
} else {
return ""
resourcehandler/filesloader.go
+1
View File
@@ -37,6 +37,7 @@ type FileResourceHandler struct {
}
func NewFileResourceHandler(inputPatterns []string) *FileResourceHandler {
k8sinterface.InitializeMapResourcesMock() // initialize the resource map
return &FileResourceHandler{
inputPatterns: inputPatterns,
}
resourcehandler/k8sresources.go
+2 -2
View File
@@ -52,7 +52,7 @@ func (k8sHandler *K8sResourceHandler) GetResources(frameworks []reporthandling.F
}
func (k8sHandler *K8sResourceHandler) GetClusterAPIServerInfo() *version.Info {
clusterAPIServerInfo, err := k8sHandler.k8s.KubernetesClient.Discovery().ServerVersion()
clusterAPIServerInfo, err := k8sHandler.k8s.DiscoveryClient.ServerVersion()
if err != nil {
cautils.ErrorDisplay(fmt.Sprintf("Failed to discover API server information: %v", err))
return nil
@@ -95,7 +95,7 @@ func (k8sHandler *K8sResourceHandler) pullSingleResource(resource *schema.GroupV
// set dynamic object
var clientResource dynamic.ResourceInterface
if namespace != "" && k8sinterface.IsNamespaceScope(resource.Group, resource.Resource) {
if namespace != "" && k8sinterface.IsNamespaceScope(resource) {
clientResource = k8sHandler.k8s.DynamicClient.Resource(*resource).Namespace(namespace)
} else {
clientResource = k8sHandler.k8s.DynamicClient.Resource(*resource)
resourcehandler/k8sresourcesutils_test.go
+1
View File
@@ -11,6 +11,7 @@ func TestGetK8sResources(t *testing.T) {
// getK8sResources
}
func TestSetResourceMap(t *testing.T) {
k8sinterface.InitializeMapResourcesMock()
framework := reporthandling.MockFrameworkA()
k8sResources := setResourceMap([]reporthandling.Framework{*framework})
resources := k8sinterface.ResourceGroupToString("*", "v1", "Pod")
resultshandling/printer/prettyprinter.go
+52 -34
View File
@@ -15,37 +15,42 @@ import (
type PrettyPrinter struct {
writer *os.File
summary Summary
verboseMode bool
sortedControlNames []string
frameworkSummary ControlSummary
}
func NewPrettyPrinter() *PrettyPrinter {
func NewPrettyPrinter(verboseMode bool) *PrettyPrinter {
return &PrettyPrinter{
summary: NewSummary(),
verboseMode: verboseMode,
summary: NewSummary(),
}
}
// Initializes empty printer for new table
func (printer *PrettyPrinter) init() *PrettyPrinter {
printer.frameworkSummary = ControlSummary{}
printer.summary = Summary{}
printer.sortedControlNames = []string{}
return printer
}
func (printer *PrettyPrinter) ActionPrint(opaSessionObj *cautils.OPASessionObj) {
// score := calculatePostureScore(opaSessionObj.PostureReport)
for _, report := range opaSessionObj.PostureReport.FrameworkReports {
// Print summary table together for control scan
if report.Name != "" {
printer = printer.init()
}
printer.summarySetup(report)
printer.printResults()
printer.printSummaryTable(report.Name)
failedResources := []string{}
warningResources := []string{}
allResources := []string{}
frameworkNames := []string{}
for _, frameworkReport := range opaSessionObj.PostureReport.FrameworkReports {
frameworkNames = append(frameworkNames, frameworkReport.Name)
failedResources = reporthandling.GetUniqueResourcesIDs(append(failedResources, frameworkReport.ListResourcesIDs().GetFailedResources()...))
warningResources = reporthandling.GetUniqueResourcesIDs(append(warningResources, frameworkReport.ListResourcesIDs().GetWarningResources()...))
allResources = reporthandling.GetUniqueResourcesIDs(append(allResources, frameworkReport.ListResourcesIDs().GetAllResources()...))
printer.summarySetup(frameworkReport, opaSessionObj.AllResources)
}
// return score
printer.frameworkSummary = ControlSummary{
TotalResources: len(allResources),
TotalFailed: len(failedResources),
TotalWarning: len(warningResources),
}
printer.printResults()
printer.printSummaryTable(frameworkNames)
}
func (printer *PrettyPrinter) SetWriter(outputFile string) {
@@ -55,28 +60,30 @@ func (printer *PrettyPrinter) SetWriter(outputFile string) {
func (printer *PrettyPrinter) Score(score float32) {
}
func (printer *PrettyPrinter) summarySetup(fr reporthandling.FrameworkReport) {
printer.frameworkSummary = ControlSummary{
TotalResources: fr.GetNumberOfResources(),
TotalFailed: fr.GetNumberOfFailedResources(),
TotalWarning: fr.GetNumberOfWarningResources(),
}
func (printer *PrettyPrinter) summarySetup(fr reporthandling.FrameworkReport, allResources map[string]workloadinterface.IMetadata) {
for _, cr := range fr.ControlReports {
if len(cr.RuleReports) == 0 {
continue
}
workloadsSummary := listResultSummary(cr.RuleReports)
workloadsSummary := listResultSummary(cr.RuleReports, allResources)
var passedWorkloads map[string][]WorkloadSummary
if printer.verboseMode {
passedWorkloads = groupByNamespaceOrKind(workloadsSummary, workloadSummaryPassed)
}
printer.summary[cr.Name] = ControlSummary{
TotalResources: cr.GetNumberOfResources(),
TotalFailed: cr.GetNumberOfFailedResources(),
TotalWarning: cr.GetNumberOfWarningResources(),
FailedWorkloads: groupByNamespaceOrKind(workloadsSummary, workloadSummaryFailed),
ExcludedWorkloads: groupByNamespaceOrKind(workloadsSummary, workloadSummaryExclude),
PassedWorkloads: passedWorkloads,
Description: cr.Description,
Remediation: cr.Remediation,
ListInputKinds: cr.ListControlsInputKinds(),
}
}
printer.sortedControlNames = printer.getSortedControlsNames()
}
@@ -130,6 +137,10 @@ func (printer *PrettyPrinter) printResources(controlSummary *ControlSummary) {
cautils.WarningDisplay(printer.writer, "Excluded:\n")
printer.printGroupedResources(controlSummary.ExcludedWorkloads)
}
if len(controlSummary.PassedWorkloads) > 0 {
cautils.SuccessDisplay(printer.writer, "Passed:\n")
printer.printGroupedResources(controlSummary.PassedWorkloads)
}
}
@@ -159,7 +170,7 @@ func (printer *PrettyPrinter) printGroupedResource(indent string, ns string, rsc
for r := range rsc {
indent += indent
relatedObjectsStr := generateRelatedObjectsStr(rsc[r])
cautils.SimpleDisplay(printer.writer, fmt.Sprintf("%s%s - %s %s\n", indent, rsc[r].FailedWorkload.GetKind(), rsc[r].FailedWorkload.GetName(), relatedObjectsStr))
cautils.SimpleDisplay(printer.writer, fmt.Sprintf("%s%s - %s %s\n", indent, rsc[r].resource.GetKind(), rsc[r].resource.GetName(), relatedObjectsStr))
indent = preIndent2
}
indent = preIndent
@@ -167,7 +178,7 @@ func (printer *PrettyPrinter) printGroupedResource(indent string, ns string, rsc
func generateRelatedObjectsStr(workload WorkloadSummary) string {
relatedStr := ""
w := workload.FailedWorkload.GetObject()
w := workload.resource.GetObject()
if workloadinterface.IsTypeRegoResponseVector(w) {
relatedObjects := workloadinterface.NewRegoResponseVectorObject(w).GetRelatedObjects()
for i, related := range relatedObjects {
@@ -221,9 +232,9 @@ func generateFooter(numControlers, sumFailed, sumWarning, sumTotal int) []string
}
return row
}
func (printer *PrettyPrinter) printSummaryTable(framework string) {
func (printer *PrettyPrinter) printSummaryTable(frameworksNames []string) {
// For control scan framework will be nil
printer.printFramework(framework)
printer.printFramework(frameworksNames)
summaryTable := tablewriter.NewWriter(printer.writer)
summaryTable.SetAutoWrapText(false)
@@ -240,9 +251,16 @@ func (printer *PrettyPrinter) printSummaryTable(framework string) {
summaryTable.Render()
}
func (printer *PrettyPrinter) printFramework(framework string) {
if framework != "" {
cautils.InfoTextDisplay(printer.writer, fmt.Sprintf("%s FRAMEWORK\n", framework))
func (printer *PrettyPrinter) printFramework(frameworksNames []string) {
if len(frameworksNames) == 1 {
cautils.InfoTextDisplay(printer.writer, fmt.Sprintf("%s FRAMEWORK\n", frameworksNames[0]))
} else if len(frameworksNames) > 1 {
p := ""
for i := 0; i < len(frameworksNames)-1; i++ {
p += frameworksNames[i] + " ,"
}
p += frameworksNames[len(frameworksNames)-1]
cautils.InfoTextDisplay(printer.writer, fmt.Sprintf("%s FRAMEWORKS\n", p))
}
}
@@ -260,7 +278,7 @@ func getWriter(outputFile string) *os.File {
if outputFile != "" {
f, err := os.OpenFile(outputFile, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
if err != nil {
fmt.Println("Error opening file")
fmt.Println("failed to open file for writing, reason: ", err.Error())
return os.Stdout
}
return f
resultshandling/printer/printresults.go
+7 -7
View File
@@ -9,10 +9,10 @@ var INDENT = " "
const EmptyPercentage = "NaN"
const (
PrettyFormat string = "pretty-printer"
JsonFormat string = "json"
JunitResultFormat string = "junit"
PrometheusFormat string = "prometheus"
PrettyFormat string = "pretty-printer"
JsonFormat string = "json"
JunitResultFormat string = "junit"
PrometheusFormat string = "prometheus"
)
type IPrinter interface {
@@ -21,15 +21,15 @@ type IPrinter interface {
Score(score float32)
}
func GetPrinter(printFormat string) IPrinter {
func GetPrinter(printFormat string, verboseMode bool) IPrinter {
switch printFormat {
case JsonFormat:
return NewJsonPrinter()
case JunitResultFormat:
return NewJunitPrinter()
case PrometheusFormat:
return NewPrometheusPrinter()
return NewPrometheusPrinter(verboseMode)
default:
return NewPrettyPrinter()
return NewPrettyPrinter(verboseMode)
}
}
resultshandling/printer/prometheusprinter.go
+32 -61
View File
@@ -1,20 +1,24 @@
package printer
import (
"errors"
"fmt"
"os"
"strings"
"github.com/armosec/k8s-interface/workloadinterface"
"github.com/armosec/kubescape/cautils"
"github.com/armosec/opa-utils/reporthandling"
)
type PrometheusPrinter struct {
writer *os.File
writer *os.File
verboseMode bool
}
func NewPrometheusPrinter() *PrometheusPrinter {
return &PrometheusPrinter{}
func NewPrometheusPrinter(verboseMode bool) *PrometheusPrinter {
return &PrometheusPrinter{
verboseMode: verboseMode,
}
}
func (prometheusPrinter *PrometheusPrinter) SetWriter(outputFile string) {
@@ -25,74 +29,41 @@ func (prometheusPrinter *PrometheusPrinter) Score(score float32) {
fmt.Printf("\n# Overall score out of 100\nkubescape_score %f\n", score*100)
}
func (printer *PrometheusPrinter) printDetails(details []reporthandling.RuleResponse, frameworkName string, controlName string) error {
objs := make(map[string]map[string]map[string]int)
for _, ruleResponses := range details {
for _, k8sObj := range ruleResponses.AlertObject.K8SApiObjects {
kind, ok := k8sObj[`kind`].(string)
if (!ok) {
return errors.New("Found object with non string kind")
}
apiVersion,ok := k8sObj[`apiVersion`].(string)
if (!ok) {
return errors.New("Found object with non string apiVersion")
}
gvk := fmt.Sprintf("%s/%s",apiVersion,kind)
metadata,ok := k8sObj[`metadata`].(map[string]interface{})
if (!ok) {
return errors.New("Found object with non convertable metadata")
}
name,ok := metadata[`name`].(string)
if (!ok) {
return errors.New("Found metadata with non string name")
}
namespace,ok := metadata[`namespace`].(string)
if (!ok) {
namespace = ""
}
if (objs[gvk] == nil) {
objs[gvk] = make(map[string]map[string]int)
}
if (objs[gvk][namespace] == nil) {
objs[gvk][namespace] = make(map[string]int)
}
objs[gvk][namespace][name]++
func (printer *PrometheusPrinter) printResources(allResources map[string]workloadinterface.IMetadata, resourcesIDs *reporthandling.ResourcesIDs, frameworkName, controlName string) {
printer.printDetails(allResources, resourcesIDs.GetFailedResources(), frameworkName, controlName, "failed")
printer.printDetails(allResources, resourcesIDs.GetWarningResources(), frameworkName, controlName, "excluded")
if printer.verboseMode {
printer.printDetails(allResources, resourcesIDs.GetPassedResources(), frameworkName, controlName, "passed")
}
}
func (printer *PrometheusPrinter) printDetails(allResources map[string]workloadinterface.IMetadata, resourcesIDs []string, frameworkName, controlName, status string) {
fmt.Fprintf(printer.writer, "# Number of resources found as part of %s control \"%s\"\nkubescape_resources_found_count{framework=\"%s\",control=\"%s\"} %d\n", status, controlName, frameworkName, controlName, len(resourcesIDs))
for _, resourceID := range resourcesIDs {
resource := allResources[resourceID]
fmt.Fprintf(printer.writer, "# %s object from \"%s\" control \"%s\"\n", strings.Title(status), frameworkName, controlName)
if resource.GetNamespace() != "" {
fmt.Fprintf(printer.writer, "kubescape_object_%s_count{framework=\"%s\",control=\"%s\",namespace=\"%s\",name=\"%s\",groupVersionKind=\"%s\"} %d\n", status, frameworkName, controlName, resource.GetNamespace(), resource.GetName(), fmt.Sprintf("%s/%s", resource.GetApiVersion(), resource.GetKind()), 1)
} else {
fmt.Fprintf(printer.writer, "kubescape_object_%s_count{framework=\"%s\",control=\"%s\",name=\"%s\",groupVersionKind=\"%s\"} %d\n", status, frameworkName, controlName, resource.GetName(), fmt.Sprintf("%s/%s", resource.GetApiVersion(), resource.GetKind()), 1)
}
}
for gvk, namespaces := range objs {
for namespace, names := range namespaces {
for name, value := range names {
fmt.Fprintf(printer.writer, "# Failed object from %s control %s\n", frameworkName, controlName)
if namespace != "" {
fmt.Fprintf(printer.writer, "kubescape_object_failed_count{framework=\"%s\",control=\"%s\",namespace=\"%s\",name=\"%s\",groupVersionKind=\"%s\"} %d\n", frameworkName, controlName, namespace, name, gvk, value)
} else {
fmt.Fprintf(printer.writer, "kubescape_object_failed_count{framework=\"%s\",control=\"%s\",name=\"%s\",groupVersionKind=\"%s\"} %d\n", frameworkName, controlName, name, gvk, value)
}
}
}
}
return nil
}
func (printer *PrometheusPrinter) printReports(frameworks []reporthandling.FrameworkReport) error {
for _, framework := range frameworks {
for _, controlReports := range framework.ControlReports {
if len(controlReports.RuleReports[0].RuleResponses) > 0 {
fmt.Fprintf(printer.writer, "# Number of resources found as part of %s control %s\nkubescape_resources_found_count{framework=\"%s\",control=\"%s\"} %d\n", framework.Name, controlReports.Name, framework.Name, controlReports.Name, controlReports.GetNumberOfResources())
fmt.Fprintf(printer.writer, "# Number of resources excluded as part of %s control %s\nkubescape_resources_excluded_count{framework=\"%s\",control=\"%s\"} %d\n", framework.Name, controlReports.Name, framework.Name, controlReports.Name, controlReports.GetNumberOfWarningResources())
fmt.Fprintf(printer.writer, "# Number of resources failed as part of %s control %s\nkubescape_resources_failed_count{framework=\"%s\",control=\"%s\"} %d\n", framework.Name, controlReports.Name, framework.Name, controlReports.Name, controlReports.GetNumberOfFailedResources())
err := printer.printDetails(controlReports.RuleReports[0].RuleResponses, framework.Name, controlReports.Name)
if err != nil {
return err
}
func (printer *PrometheusPrinter) printReports(allResources map[string]workloadinterface.IMetadata, frameworks []reporthandling.FrameworkReport) error {
for _, frameworkReport := range frameworks {
for _, controlReport := range frameworkReport.ControlReports {
if controlReport.GetNumberOfResources() == 0 {
continue // the control did not test any resources
}
printer.printResources(allResources, controlReport.ListResourcesIDs(), frameworkReport.Name, controlReport.Name)
}
}
return nil
}
func (printer *PrometheusPrinter) ActionPrint(opaSessionObj *cautils.OPASessionObj) {
err := printer.printReports(opaSessionObj.PostureReport.FrameworkReports)
err := printer.printReports(opaSessionObj.AllResources, opaSessionObj.PostureReport.FrameworkReports)
if err != nil {
fmt.Println(err)
os.Exit(1)
resultshandling/printer/summary.go
+11 -5
View File
@@ -3,8 +3,8 @@ package printer
import (
"fmt"
"github.com/armosec/armoapi-go/armotypes"
"github.com/armosec/k8s-interface/workloadinterface"
"github.com/armosec/opa-utils/reporthandling"
)
type Summary map[string]ControlSummary
@@ -19,14 +19,16 @@ type ControlSummary struct {
TotalWarning int
Description string
Remediation string
Framework []string
ListInputKinds []string
FailedWorkloads map[string][]WorkloadSummary // <namespace>:[<WorkloadSummary>]
ExcludedWorkloads map[string][]WorkloadSummary // <namespace>:[<WorkloadSummary>]
PassedWorkloads map[string][]WorkloadSummary // <namespace>:[<WorkloadSummary>]
}
type WorkloadSummary struct {
FailedWorkload workloadinterface.IMetadata
Exception *armotypes.PostureExceptionPolicy
resource workloadinterface.IMetadata
status string
}
func (controlSummary *ControlSummary) ToSlice() []string {
@@ -38,9 +40,13 @@ func (controlSummary *ControlSummary) ToSlice() []string {
}
func workloadSummaryFailed(workloadSummary *WorkloadSummary) bool {
return workloadSummary.Exception == nil
return workloadSummary.status == reporthandling.StatusFailed
}
func workloadSummaryExclude(workloadSummary *WorkloadSummary) bool {
return workloadSummary.Exception != nil && workloadSummary.Exception.IsAlertOnly()
return workloadSummary.status == reporthandling.StatusWarning
}
func workloadSummaryPassed(workloadSummary *WorkloadSummary) bool {
return workloadSummary.status == reporthandling.StatusPassed
}
resultshandling/printer/summeryhelpers.go
+20 -55
View File
@@ -1,8 +1,6 @@
package printer
import (
"fmt"
"github.com/armosec/k8s-interface/workloadinterface"
"github.com/armosec/opa-utils/reporthandling"
)
@@ -12,18 +10,18 @@ func groupByNamespaceOrKind(resources []WorkloadSummary, status func(workloadSum
mapResources := make(map[string][]WorkloadSummary)
for i := range resources {
if status(&resources[i]) {
if isKindToBeGrouped(resources[i].FailedWorkload.GetKind()) {
if r, ok := mapResources[resources[i].FailedWorkload.GetKind()]; ok {
if isKindToBeGrouped(resources[i].resource.GetKind()) {
if r, ok := mapResources[resources[i].resource.GetKind()]; ok {
r = append(r, resources[i])
mapResources[resources[i].FailedWorkload.GetKind()] = r
mapResources[resources[i].resource.GetKind()] = r
} else {
mapResources[resources[i].FailedWorkload.GetKind()] = []WorkloadSummary{resources[i]}
mapResources[resources[i].resource.GetKind()] = []WorkloadSummary{resources[i]}
}
} else if r, ok := mapResources[resources[i].FailedWorkload.GetNamespace()]; ok {
} else if r, ok := mapResources[resources[i].resource.GetNamespace()]; ok {
r = append(r, resources[i])
mapResources[resources[i].FailedWorkload.GetNamespace()] = r
mapResources[resources[i].resource.GetNamespace()] = r
} else {
mapResources[resources[i].FailedWorkload.GetNamespace()] = []WorkloadSummary{resources[i]}
mapResources[resources[i].resource.GetNamespace()] = []WorkloadSummary{resources[i]}
}
}
}
@@ -37,59 +35,26 @@ func isKindToBeGrouped(kind string) bool {
return false
}
func listResultSummary(ruleReports []reporthandling.RuleReport) []WorkloadSummary {
func listResultSummary(ruleReports []reporthandling.RuleReport, allResources map[string]workloadinterface.IMetadata) []WorkloadSummary {
workloadsSummary := []WorkloadSummary{}
track := map[string]bool{}
for c := range ruleReports {
for _, ruleReport := range ruleReports[c].RuleResponses {
resource, err := ruleResultSummary(ruleReport.AlertObject)
if err != nil {
fmt.Println(err.Error())
continue
}
// add resource only once
for i := range resource {
resource[i].Exception = ruleReport.Exception
if ok := track[resource[i].FailedWorkload.GetID()]; !ok {
track[resource[i].FailedWorkload.GetID()] = true
workloadsSummary = append(workloadsSummary, resource[i])
}
}
}
resourcesIDs := ruleReports[c].ListResourcesIDs()
workloadsSummary = append(workloadsSummary, newListWorkloadsSummary(allResources, resourcesIDs.GetFailedResources(), reporthandling.StatusFailed)...)
workloadsSummary = append(workloadsSummary, newListWorkloadsSummary(allResources, resourcesIDs.GetWarningResources(), reporthandling.StatusWarning)...)
workloadsSummary = append(workloadsSummary, newListWorkloadsSummary(allResources, resourcesIDs.GetPassedResources(), reporthandling.StatusPassed)...)
}
return workloadsSummary
}
func ruleResultSummary(obj reporthandling.AlertObject) ([]WorkloadSummary, error) {
resource := []WorkloadSummary{}
for i := range obj.K8SApiObjects {
r, err := newWorkloadSummary(obj.K8SApiObjects[i])
if err != nil {
return resource, err
}
func newListWorkloadsSummary(allResources map[string]workloadinterface.IMetadata, resourcesIDs []string, status string) []WorkloadSummary {
workloadsSummary := []WorkloadSummary{}
resource = append(resource, *r)
for _, i := range resourcesIDs {
workloadsSummary = append(workloadsSummary, WorkloadSummary{
resource: allResources[i],
status: status,
})
}
if obj.ExternalObjects != nil {
r, err := newWorkloadSummary(obj.ExternalObjects)
if err != nil {
return resource, err
}
resource = append(resource, *r)
}
return resource, nil
}
func newWorkloadSummary(obj map[string]interface{}) (*WorkloadSummary, error) {
r := &WorkloadSummary{}
workload := workloadinterface.NewObject(obj)
if workload == nil {
return r, fmt.Errorf("expecting k8s API object")
}
r.FailedWorkload = workload
return r, nil
return workloadsSummary
}
resultshandling/results.go
+5 -12
View File
@@ -42,19 +42,12 @@ func (resultsHandler *ResultsHandler) HandleResults(scanInfo *cautils.ScanInfo)
// CalculatePostureScore calculate final score
func CalculatePostureScore(postureReport *reporthandling.PostureReport) float32 {
lowestScore := float32(100)
failedResources := []string{}
allResources := []string{}
for _, frameworkReport := range postureReport.FrameworkReports {
totalFailed := frameworkReport.GetNumberOfFailedResources()
totalResources := frameworkReport.GetNumberOfResources()
frameworkScore := float32(0)
if float32(totalResources) > 0 {
frameworkScore = (float32(totalResources) - float32(totalFailed)) / float32(totalResources)
}
if lowestScore > frameworkScore {
lowestScore = frameworkScore
}
failedResources = reporthandling.GetUniqueResourcesIDs(append(failedResources, frameworkReport.ListResourcesIDs().GetFailedResources()...))
allResources = reporthandling.GetUniqueResourcesIDs(append(allResources, frameworkReport.ListResourcesIDs().GetAllResources()...))
}
return lowestScore
return (float32(len(allResources)) - float32(len(failedResources))) / float32(len(allResources))
}