diff --git a/core/cautils/workloadmappingutils.go b/core/cautils/workloadmappingutils.go index f20bcafb..2f1d5fe7 100644 --- a/core/cautils/workloadmappingutils.go +++ b/core/cautils/workloadmappingutils.go @@ -20,6 +20,7 @@ var ( "KubeProxyInfo", "ControlPlaneInfo", "CloudProviderInfo", + "CNIInfo", } CloudResources = []string{ "ClusterDescribe", diff --git a/core/pkg/hostsensorutils/hostsensor.yaml b/core/pkg/hostsensorutils/hostsensor.yaml index 4ad7e84d..77f8c0c3 100644 --- a/core/pkg/hostsensorutils/hostsensor.yaml +++ b/core/pkg/hostsensorutils/hostsensor.yaml @@ -36,7 +36,7 @@ spec: effect: NoSchedule containers: - name: host-sensor - image: quay.io/kubescape/host-scanner:v1.0.39 + image: quay.io/kubescape/host-scanner:v1.0.43 securityContext: allowPrivilegeEscalation: true privileged: true diff --git a/core/pkg/hostsensorutils/hostsensorgetfrompod.go b/core/pkg/hostsensorutils/hostsensorgetfrompod.go index 33999d12..9befa0cd 100644 --- a/core/pkg/hostsensorutils/hostsensorgetfrompod.go +++ b/core/pkg/hostsensorutils/hostsensorgetfrompod.go @@ -127,40 +127,40 @@ func (hsh *HostSensorHandler) GetVersion() (string, error) { // return list of LinuxKernelVariables func (hsh *HostSensorHandler) GetKernelVariables() ([]hostsensor.HostSensorDataEnvelope, error) { // loop over pods and port-forward it to each of them - return hsh.sendAllPodsHTTPGETRequest("/LinuxKernelVariables", "LinuxKernelVariables") + return hsh.sendAllPodsHTTPGETRequest("/LinuxKernelVariables", LinuxKernelVariables) } // return list of OpenPortsList func (hsh *HostSensorHandler) GetOpenPortsList() ([]hostsensor.HostSensorDataEnvelope, error) { // loop over pods and port-forward it to each of them - return hsh.sendAllPodsHTTPGETRequest("/openedPorts", "OpenPortsList") + return hsh.sendAllPodsHTTPGETRequest("/openedPorts", OpenPortsList) } // return list of LinuxSecurityHardeningStatus func (hsh *HostSensorHandler) GetLinuxSecurityHardeningStatus() ([]hostsensor.HostSensorDataEnvelope, error) { // loop over pods and port-forward it to each of them - return hsh.sendAllPodsHTTPGETRequest("/linuxSecurityHardening", "LinuxSecurityHardeningStatus") + return hsh.sendAllPodsHTTPGETRequest("/linuxSecurityHardening", LinuxSecurityHardeningStatus) } // return list of KubeletInfo func (hsh *HostSensorHandler) GetKubeletInfo() ([]hostsensor.HostSensorDataEnvelope, error) { // loop over pods and port-forward it to each of them - return hsh.sendAllPodsHTTPGETRequest("/kubeletInfo", "KubeletInfo") + return hsh.sendAllPodsHTTPGETRequest("/kubeletInfo", KubeletInfo) } -// return list of KubeProxyInfo +// return list of kubeProxyInfo func (hsh *HostSensorHandler) GetKubeProxyInfo() ([]hostsensor.HostSensorDataEnvelope, error) { // loop over pods and port-forward it to each of them - return hsh.sendAllPodsHTTPGETRequest("/kubeProxyInfo", "KubeProxyInfo") + return hsh.sendAllPodsHTTPGETRequest("/kubeProxyInfo", KubeProxyInfo) } -// return list of KubeProxyInfo +// return list of controlPlaneInfo func (hsh *HostSensorHandler) GetControlPlaneInfo() ([]hostsensor.HostSensorDataEnvelope, error) { // loop over pods and port-forward it to each of them return hsh.sendAllPodsHTTPGETRequest("/controlPlaneInfo", ControlPlaneInfo) } -// return list of KubeProxyInfo +// return list of cloudProviderInfo func (hsh *HostSensorHandler) GetCloudProviderInfo() ([]hostsensor.HostSensorDataEnvelope, error) { // loop over pods and port-forward it to each of them return hsh.sendAllPodsHTTPGETRequest("/cloudProviderInfo", CloudProviderInfo) @@ -169,7 +169,7 @@ func (hsh *HostSensorHandler) GetCloudProviderInfo() ([]hostsensor.HostSensorDat // return list of KubeletCommandLine func (hsh *HostSensorHandler) GetKubeletCommandLine() ([]hostsensor.HostSensorDataEnvelope, error) { // loop over pods and port-forward it to each of them - resps, err := hsh.sendAllPodsHTTPGETRequest("/kubeletCommandLine", "KubeletCommandLine") + resps, err := hsh.sendAllPodsHTTPGETRequest("/kubeletCommandLine", KubeletCommandLine) if err != nil { return resps, err } @@ -187,19 +187,25 @@ func (hsh *HostSensorHandler) GetKubeletCommandLine() ([]hostsensor.HostSensorDa } -// return list of +// return list of CNIInfo +func (hsh *HostSensorHandler) GetCNIInfo() ([]hostsensor.HostSensorDataEnvelope, error) { + // loop over pods and port-forward it to each of them + return hsh.sendAllPodsHTTPGETRequest("/CNIInfo", CNIInfo) +} + +// return list of kernelVersion func (hsh *HostSensorHandler) GetKernelVersion() ([]hostsensor.HostSensorDataEnvelope, error) { // loop over pods and port-forward it to each of them return hsh.sendAllPodsHTTPGETRequest("/kernelVersion", "KernelVersion") } -// return list of +// return list of osRelease func (hsh *HostSensorHandler) GetOsReleaseFile() ([]hostsensor.HostSensorDataEnvelope, error) { // loop over pods and port-forward it to each of them return hsh.sendAllPodsHTTPGETRequest("/osRelease", "OsReleaseFile") } -// return list of +// return list of kubeletConfigurations func (hsh *HostSensorHandler) GetKubeletConfigurations() ([]hostsensor.HostSensorDataEnvelope, error) { // loop over pods and port-forward it to each of them res, err := hsh.sendAllPodsHTTPGETRequest("/kubeletConfigurations", "KubeletConfiguration") // empty kind, will be overridden @@ -336,6 +342,16 @@ func (hsh *HostSensorHandler) CollectResources() ([]hostsensor.HostSensorDataEnv res = append(res, kcData...) } + // GetCNIInfo + kcData, err = hsh.GetCNIInfo() + if err != nil { + addInfoToMap(CNIInfo, infoMap, err) + logger.L().Warning(err.Error()) + } + if len(kcData) > 0 { + res = append(res, kcData...) + } + logger.L().Debug("Done reading information from host scanner") return res, infoMap, nil } diff --git a/core/pkg/hostsensorutils/utils.go b/core/pkg/hostsensorutils/utils.go index 3e630c7f..a6862c06 100644 --- a/core/pkg/hostsensorutils/utils.go +++ b/core/pkg/hostsensorutils/utils.go @@ -17,6 +17,7 @@ var ( KubeProxyInfo = "KubeProxyInfo" ControlPlaneInfo = "ControlPlaneInfo" CloudProviderInfo = "CloudProviderInfo" + CNIInfo = "CNIInfo" MapHostSensorResourceToApiGroup = map[string]string{ KubeletConfiguration: "hostdata.kubescape.cloud/v1beta0", @@ -30,6 +31,7 @@ var ( KubeProxyInfo: "hostdata.kubescape.cloud/v1beta0", ControlPlaneInfo: "hostdata.kubescape.cloud/v1beta0", CloudProviderInfo: "hostdata.kubescape.cloud/v1beta0", + CNIInfo: "hostdata.kubescape.cloud/v1beta0", } ) diff --git a/core/pkg/resourcehandler/k8sresourcesutils.go b/core/pkg/resourcehandler/k8sresourcesutils.go index a021bd95..5b67d4c3 100644 --- a/core/pkg/resourcehandler/k8sresourcesutils.go +++ b/core/pkg/resourcehandler/k8sresourcesutils.go @@ -24,6 +24,7 @@ var ( KubeProxyInfo = "KubeProxyInfo" ControlPlaneInfo = "ControlPlaneInfo" CloudProviderInfo = "CloudProviderInfo" + CNIInfo = "CNIInfo" MapResourceToApiGroup = map[string]string{ KubeletConfiguration: "hostdata.kubescape.cloud/v1beta0", @@ -37,6 +38,7 @@ var ( KubeProxyInfo: "hostdata.kubescape.cloud/v1beta0", ControlPlaneInfo: "hostdata.kubescape.cloud/v1beta0", CloudProviderInfo: "hostdata.kubescape.cloud/v1beta0", + CNIInfo: "hostdata.kubescape.cloud/v1beta0", } MapResourceToApiGroupVuln = map[string][]string{ ImageVulnerabilities: {"armo.vuln.images/v1", "image.vulnscan.com/v1"}}