github/kubescape
1
0
Fork 0
mirror of https://github.com/kubescape/kubescape.git synced 2026-04-15 06:58:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

use objectsenvelopes pkg

Browse Source
This commit is contained in:
dwertent
2021-12-14 20:06:38 +02:00
parent 52bfd4cadc
commit e2f8902222
12 changed files with 43 additions and 103 deletions
Download Patch File Download Diff File Expand all files Collapse all files
go.mod
+3 -3
View File
@@ -4,9 +4,9 @@ go 1.17
require (
github.com/armosec/armoapi-go v0.0.23
github.com/armosec/k8s-interface v0.0.36
github.com/armosec/opa-utils v0.0.62
github.com/armosec/rbac-utils v0.0.8
github.com/armosec/k8s-interface v0.0.37
github.com/armosec/opa-utils v0.0.64
github.com/armosec/rbac-utils v0.0.9
github.com/armosec/utils-go v0.0.3
github.com/briandowns/spinner v1.16.0
github.com/enescakir/emoji v1.0.0
go.sum
+6 -8
View File
@@ -87,15 +87,13 @@ github.com/armosec/armoapi-go v0.0.2/go.mod h1:vIK17yoKbJRQyZXWWLe3AqfqCRITxW8qm
github.com/armosec/armoapi-go v0.0.23 h1:jqoLIWM5CR7DCD9fpFgN0ePqtHvOCoZv/XzCwsUluJU=
github.com/armosec/armoapi-go v0.0.23/go.mod h1:iaVVGyc23QGGzAdv4n+szGQg3Rbpixn9yQTU3qWRpaw=
github.com/armosec/k8s-interface v0.0.8/go.mod h1:xxS+V5QT3gVQTwZyAMMDrYLWGrfKOpiJ7Jfhfa0w9sM=
github.com/armosec/k8s-interface v0.0.19/go.mod h1:0ztwEWLez2lpMMKHbs0DoZV64S0YIA4s72vCs9iAAiE=
github.com/armosec/k8s-interface v0.0.26/go.mod h1:vHxGWqD/uh6+GQb9Sqv7OGMs+Rvc2dsFVc0XtgRh1ZU=
github.com/armosec/k8s-interface v0.0.36 h1:i/fdgpXEsQq08Py8Utg537VzITpWJW4sjR9OXTfi4Oc=
github.com/armosec/k8s-interface v0.0.36/go.mod h1:vHxGWqD/uh6+GQb9Sqv7OGMs+Rvc2dsFVc0XtgRh1ZU=
github.com/armosec/opa-utils v0.0.62 h1:C/VN1HUDoa0BX2CTSqgjuKEIlb/rkIwGY2/UlvfS154=
github.com/armosec/opa-utils v0.0.62/go.mod h1:P63qZDPG3vjPtSQqwx2N4Nfm8VaboDul7R7kmnUvvWc=
github.com/armosec/k8s-interface v0.0.37 h1:EPjzozpkVw0SmizoALmVg6D8VZIX7gcgTg+WxA02jNc=
github.com/armosec/k8s-interface v0.0.37/go.mod h1:vHxGWqD/uh6+GQb9Sqv7OGMs+Rvc2dsFVc0XtgRh1ZU=
github.com/armosec/opa-utils v0.0.64 h1:RdiFpy6QqoTD2e9k5eIwgDrTWctUL215QI3ust8tnD0=
github.com/armosec/opa-utils v0.0.64/go.mod h1:6tQP8UDq2EvEfSqh8vrUdr/9QVSCG4sJfju1SXQOn4c=
github.com/armosec/rbac-utils v0.0.1/go.mod h1:pQ8CBiij8kSKV7aeZm9FMvtZN28VgA7LZcYyTWimq40=
github.com/armosec/rbac-utils v0.0.8 h1:Hpr2p9F3Elp9NxbDAZiMlNUcQOdfyu9rWFE2fM2nNGw=
github.com/armosec/rbac-utils v0.0.8/go.mod h1:fmLZDgT5ILNo5gzR19boIIn7TOpfWh2pIgprxLrYN/g=
github.com/armosec/rbac-utils v0.0.9 h1:rIOWp4K7BELUNX32ktSjVbb8d/0SpH7W76W6Tf+8rzw=
github.com/armosec/rbac-utils v0.0.9/go.mod h1:Ex/IdGWhGv9HZq6Hs8N/ApzCKSIvpNe/ETqDfnuyah0=
github.com/armosec/utils-go v0.0.2/go.mod h1:itWmRLzRdsnwjpEOomL0mBWGnVNNIxSjDAdyc+b0iUo=
github.com/armosec/utils-go v0.0.3 h1:uyQI676yRciQM0sSN9uPoqHkbspTxHO0kmzXhBeE/xU=
github.com/armosec/utils-go v0.0.3/go.mod h1:itWmRLzRdsnwjpEOomL0mBWGnVNNIxSjDAdyc+b0iUo=
hostsensorutils/hostsensordataenvelope.go
-67
View File
@@ -1,67 +0,0 @@
package hostsensorutils
import (
"encoding/json"
"fmt"
"k8s.io/apimachinery/pkg/runtime/schema"
)
type HostSensorDataEnvelope struct {
schema.GroupVersionResource
NodeName string `json:"nodeName"`
Data json.RawMessage `json:"data"`
}
func (hsde *HostSensorDataEnvelope) SetNamespace(string) {
}
func (hsde *HostSensorDataEnvelope) SetName(val string) {
hsde.NodeName = val
}
func (hsde *HostSensorDataEnvelope) SetKind(val string) {
hsde.Resource = val
}
func (hsde *HostSensorDataEnvelope) SetWorkload(val map[string]interface{}) { //deprecated
hsde.Data, _ = json.Marshal(val)
}
func (hsde *HostSensorDataEnvelope) SetObject(val map[string]interface{}) {
hsde.Data, _ = json.Marshal(val)
}
func (hsde *HostSensorDataEnvelope) GetNamespace() string {
return ""
}
func (hsde *HostSensorDataEnvelope) GetName() string {
return hsde.NodeName
}
func (hsde *HostSensorDataEnvelope) GetKind() string {
return hsde.Resource
}
func (hsde *HostSensorDataEnvelope) GetApiVersion() string {
return hsde.Version
}
func (hsde *HostSensorDataEnvelope) GetWorkload() map[string]interface{} { // DEPRECATED
res := map[string]interface{}{}
json.Unmarshal(hsde.Data, &res)
return res
}
func (hsde *HostSensorDataEnvelope) GetObject() map[string]interface{} {
res := map[string]interface{}{}
json.Unmarshal(hsde.Data, &res)
return res
}
func (hsde *HostSensorDataEnvelope) GetID() string { // -> <api-group>/<api-version>/<kind>/<name>
return fmt.Sprintf("%s/%s/%s/%s", hsde.Group, hsde.GetApiVersion(), hsde.GetKind(), hsde.GetName())
}
hostsensorutils/hostsensorgetfrompod.go
+12 -11
View File
@@ -6,6 +6,7 @@ import (
"sync"
"github.com/armosec/kubescape/cautils"
"github.com/armosec/opa-utils/objectsenvelopes"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"sigs.k8s.io/yaml"
)
@@ -56,12 +57,12 @@ func (hsh *HostSensorHandler) ForwardToPod(podName, path string) ([]byte, error)
// sendAllPodsHTTPGETRequest fills the raw byte response in the envelope and the node name, but not the GroupVersionKind
// so the caller is responsible to convert the raw data to some structured data and add the GroupVersionKind details
func (hsh *HostSensorHandler) sendAllPodsHTTPGETRequest(path string) ([]HostSensorDataEnvelope, error) {
func (hsh *HostSensorHandler) sendAllPodsHTTPGETRequest(path string) ([]objectsenvelopes.HostSensorDataEnvelope, error) {
podList, err := hsh.getPodList()
if err != nil {
return nil, fmt.Errorf("failed to sendAllPodsHTTPGETRequest: %v", err)
}
res := make([]HostSensorDataEnvelope, 0, len(podList))
res := make([]objectsenvelopes.HostSensorDataEnvelope, 0, len(podList))
resLock := sync.Mutex{}
wg := sync.WaitGroup{}
wg.Add(len(podList))
@@ -74,7 +75,7 @@ func (hsh *HostSensorHandler) sendAllPodsHTTPGETRequest(path string) ([]HostSens
} else {
resLock.Lock()
defer resLock.Unlock()
res = append(res, HostSensorDataEnvelope{NodeName: podList[podName], Data: resBytes})
res = append(res, objectsenvelopes.HostSensorDataEnvelope{NodeName: podList[podName], Data: resBytes})
}
}(podName, path)
@@ -84,7 +85,7 @@ func (hsh *HostSensorHandler) sendAllPodsHTTPGETRequest(path string) ([]HostSens
}
// return list of
func (hsh *HostSensorHandler) GetOpenPortsList() ([]HostSensorDataEnvelope, error) {
func (hsh *HostSensorHandler) GetOpenPortsList() ([]objectsenvelopes.HostSensorDataEnvelope, error) {
// loop over pods and port-forward it to each of them
res, err := hsh.sendAllPodsHTTPGETRequest("/openedPorts")
for resIdx := range res {
@@ -96,7 +97,7 @@ func (hsh *HostSensorHandler) GetOpenPortsList() ([]HostSensorDataEnvelope, erro
}
// return list of
func (hsh *HostSensorHandler) GetLinuxSecurityHardeningStatus() ([]HostSensorDataEnvelope, error) {
func (hsh *HostSensorHandler) GetLinuxSecurityHardeningStatus() ([]objectsenvelopes.HostSensorDataEnvelope, error) {
// loop over pods and port-forward it to each of them
res, err := hsh.sendAllPodsHTTPGETRequest("/linuxSecurityHardening")
for resIdx := range res {
@@ -108,7 +109,7 @@ func (hsh *HostSensorHandler) GetLinuxSecurityHardeningStatus() ([]HostSensorDat
}
// return list of
func (hsh *HostSensorHandler) GetKubeletCommandLine() ([]HostSensorDataEnvelope, error) {
func (hsh *HostSensorHandler) GetKubeletCommandLine() ([]objectsenvelopes.HostSensorDataEnvelope, error) {
// loop over pods and port-forward it to each of them
res, err := hsh.sendAllPodsHTTPGETRequest("/kubeletCommandLine")
for resIdx := range res {
@@ -120,7 +121,7 @@ func (hsh *HostSensorHandler) GetKubeletCommandLine() ([]HostSensorDataEnvelope,
}
// return list of
func (hsh *HostSensorHandler) GetKernelVersion() ([]HostSensorDataEnvelope, error) {
func (hsh *HostSensorHandler) GetKernelVersion() ([]objectsenvelopes.HostSensorDataEnvelope, error) {
// loop over pods and port-forward it to each of them
res, err := hsh.sendAllPodsHTTPGETRequest("/kernelVersion")
for resIdx := range res {
@@ -132,7 +133,7 @@ func (hsh *HostSensorHandler) GetKernelVersion() ([]HostSensorDataEnvelope, erro
}
// return list of
func (hsh *HostSensorHandler) GetOsReleaseFile() ([]HostSensorDataEnvelope, error) {
func (hsh *HostSensorHandler) GetOsReleaseFile() ([]objectsenvelopes.HostSensorDataEnvelope, error) {
// loop over pods and port-forward it to each of them
res, err := hsh.sendAllPodsHTTPGETRequest("/osRelease")
for resIdx := range res {
@@ -144,7 +145,7 @@ func (hsh *HostSensorHandler) GetOsReleaseFile() ([]HostSensorDataEnvelope, erro
}
// return list of
func (hsh *HostSensorHandler) GetKubeletConfigurations() ([]HostSensorDataEnvelope, error) {
func (hsh *HostSensorHandler) GetKubeletConfigurations() ([]objectsenvelopes.HostSensorDataEnvelope, error) {
// loop over pods and port-forward it to each of them
res, err := hsh.sendAllPodsHTTPGETRequest("/kubeletConfigurations")
for resIdx := range res {
@@ -166,8 +167,8 @@ func (hsh *HostSensorHandler) GetKubeletConfigurations() ([]HostSensorDataEnvelo
return res, err
}
func (hsh *HostSensorHandler) CollectResources() ([]HostSensorDataEnvelope, error) {
res := make([]HostSensorDataEnvelope, 0)
func (hsh *HostSensorHandler) CollectResources() ([]objectsenvelopes.HostSensorDataEnvelope, error) {
res := make([]objectsenvelopes.HostSensorDataEnvelope, 0)
if hsh.DaemonSet == nil {
return res, nil
}
hostsensorutils/hostsensorinterface.go
+3 -1
View File
@@ -1,8 +1,10 @@
package hostsensorutils
import "github.com/armosec/opa-utils/objectsenvelopes"
type IHostSensor interface {
Init() error
TearDown() error
CollectResources() ([]HostSensorDataEnvelope, error)
CollectResources() ([]objectsenvelopes.HostSensorDataEnvelope, error)
GetNamespace() string
}
hostsensorutils/hostsensormock.go
+4 -2
View File
@@ -1,5 +1,7 @@
package hostsensorutils
import "github.com/armosec/opa-utils/objectsenvelopes"
type HostSensorHandlerMock struct {
}
@@ -11,8 +13,8 @@ func (hshm *HostSensorHandlerMock) TearDown() error {
return nil
}
func (hshm *HostSensorHandlerMock) CollectResources() ([]HostSensorDataEnvelope, error) {
return []HostSensorDataEnvelope{}, nil
func (hshm *HostSensorHandlerMock) CollectResources() ([]objectsenvelopes.HostSensorDataEnvelope, error) {
return []objectsenvelopes.HostSensorDataEnvelope{}, nil
}
func (hshm *HostSensorHandlerMock) GetNamespace() string {
opaprocessor/processorhandler.go
+4 -3
View File
@@ -6,6 +6,7 @@ import (
"time"
"github.com/armosec/kubescape/cautils"
"github.com/armosec/opa-utils/objectsenvelopes"
"github.com/armosec/opa-utils/reporthandling"
"github.com/golang/glog"
@@ -183,20 +184,20 @@ func (opap *OPAProcessor) processRule(rule *reporthandling.PolicyRule) (*reporth
if err != nil {
return nil, err
}
inputResources = workloadinterface.ListMapToMeta(enumeratedData)
inputResources = objectsenvelopes.ListMapToMeta(enumeratedData)
ruleReport.ListInputKinds = workloadinterface.ListMetaIDs(inputResources)
for i := range inputResources {
opap.AllResources[inputResources[i].GetID()] = inputResources[i]
}
failedResources := workloadinterface.ListMapToMeta(ruleReport.GetFailedResources())
failedResources := objectsenvelopes.ListMapToMeta(ruleReport.GetFailedResources())
for i := range failedResources {
if r, ok := opap.AllResources[failedResources[i].GetID()]; !ok {
opap.AllResources[failedResources[i].GetID()] = r
}
}
warningResources := workloadinterface.ListMapToMeta(ruleReport.GetWarnignResources())
warningResources := objectsenvelopes.ListMapToMeta(ruleReport.GetWarnignResources())
for i := range warningResources {
if r, ok := opap.AllResources[warningResources[i].GetID()]; !ok {
opap.AllResources[warningResources[i].GetID()] = r
opaprocessor/processorhandler_test.go
+2 -1
View File
@@ -4,6 +4,7 @@ import (
"testing"
"github.com/armosec/kubescape/cautils"
"github.com/armosec/opa-utils/objectsenvelopes"
"github.com/armosec/opa-utils/reporthandling"
"github.com/armosec/opa-utils/resources"
@@ -20,7 +21,7 @@ func TestProcess(t *testing.T) {
// set k8s
k8sResources := make(cautils.K8SResources)
allResources := make(map[string]workloadinterface.IMetadata)
imetaObj := workloadinterface.ListMapToMeta(k8sinterface.ConvertUnstructuredSliceToMap(k8sinterface.V1KubeSystemNamespaceMock().Items))
imetaObj := objectsenvelopes.ListMapToMeta(k8sinterface.ConvertUnstructuredSliceToMap(k8sinterface.V1KubeSystemNamespaceMock().Items))
for i := range imetaObj {
allResources[imetaObj[i].GetID()] = imetaObj[i]
}
opaprocessor/processorhandlerutils_test.go
+1 -1
View File
@@ -65,7 +65,7 @@ func TestRemoveData(t *testing.T) {
c, _ := workload.GetContainers()
for i := range c {
for _, e := range c[i].Env {
assert.Equal(t, "", e.Value)
assert.Equal(t, "XXXXXX", e.Value)
}
}
}
resourcehandler/filesloader.go
+3 -2
View File
@@ -14,6 +14,7 @@ import (
"github.com/armosec/k8s-interface/k8sinterface"
"github.com/armosec/kubescape/cautils"
"github.com/armosec/opa-utils/objectsenvelopes"
"github.com/armosec/opa-utils/reporthandling"
"gopkg.in/yaml.v2"
@@ -211,7 +212,7 @@ func readYamlFile(yamlFile []byte) ([]workloadinterface.IMetadata, []error) {
continue
}
if obj, ok := j.(map[string]interface{}); ok {
if o := workloadinterface.NewObject(obj); o != nil {
if o := objectsenvelopes.NewObject(obj); o != nil {
yamlObjs = append(yamlObjs, o)
}
} else {
@@ -237,7 +238,7 @@ func convertJsonToWorkload(jsonObj interface{}, workloads *[]workloadinterface.I
switch x := jsonObj.(type) {
case map[string]interface{}:
if o := workloadinterface.NewObject(x); o != nil {
if o := objectsenvelopes.NewObject(x); o != nil {
(*workloads) = append(*workloads, o)
}
case []interface{}:
resourcehandler/k8sresources.go
+2 -1
View File
@@ -7,6 +7,7 @@ import (
"github.com/armosec/kubescape/cautils"
"github.com/armosec/kubescape/hostsensorutils"
"github.com/armosec/opa-utils/objectsenvelopes"
"github.com/armosec/opa-utils/reporthandling"
"github.com/armosec/k8s-interface/k8sinterface"
@@ -142,7 +143,7 @@ func (k8sHandler *K8sResourceHandler) pullSingleResource(resource *schema.GroupV
func ConvertMapListToMeta(resourceMap []map[string]interface{}) []workloadinterface.IMetadata {
workloads := []workloadinterface.IMetadata{}
for i := range resourceMap {
if w := workloadinterface.NewObject(resourceMap[i]); w != nil {
if w := objectsenvelopes.NewObject(resourceMap[i]); w != nil {
workloads = append(workloads, w)
}
}
resultshandling/printer/prettyprinter.go
+3 -3
View File
@@ -7,6 +7,7 @@ import (
"github.com/armosec/k8s-interface/workloadinterface"
"github.com/armosec/kubescape/cautils"
"github.com/armosec/opa-utils/objectsenvelopes"
"github.com/armosec/opa-utils/reporthandling"
"github.com/enescakir/emoji"
"github.com/olekukonko/tablewriter"
@@ -178,9 +179,8 @@ func (printer *PrettyPrinter) printGroupedResource(indent string, ns string, rsc
func generateRelatedObjectsStr(workload WorkloadSummary) string {
relatedStr := ""
w := workload.resource.GetObject()
if workloadinterface.IsTypeRegoResponseVector(w) {
relatedObjects := workloadinterface.NewRegoResponseVectorObject(w).GetRelatedObjects()
if workload.resource.GetObjectType() == workloadinterface.TypeWorkloadObject {
relatedObjects := objectsenvelopes.NewRegoResponseVectorObject(workload.resource.GetObject()).GetRelatedObjects()
for i, related := range relatedObjects {
if ns := related.GetNamespace(); i == 0 && ns != "" {
relatedStr += fmt.Sprintf("Namespace - %s, ", ns)