From 329d341fbf02813c28bbf183b08f87c1fe5c5207 Mon Sep 17 00:00:00 2001 From: danielgrunbergerarmo Date: Wed, 18 Aug 2021 11:58:23 +0300 Subject: [PATCH 1/6] delete build.yaml --- .github/workflows/build.yaml | 53 ------------------------------------ 1 file changed, 53 deletions(-) delete mode 100644 .github/workflows/build.yaml diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml deleted file mode 100644 index 40e7dae4..00000000 --- a/.github/workflows/build.yaml +++ /dev/null @@ -1,53 +0,0 @@ -name: build - -on: - push: - branches: [ master ] - pull_request: - branches: [ master ] - -jobs: - build: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v2 - - - name: Set up Go - uses: actions/setup-go@v2 - with: - go-version: 1.16 - - - name: Build - run: mkdir build && go mod tidy && go build -ldflags "-w -s" -o build/kubescape - - - name: Chmod - run: chmod +x build/kubescape - - - name: List - run: ls -la - - - name: Create Release - id: create_release - uses: actions/create-release@v1 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - tag_name: v0.0.${{ github.run_number }} - release_name: Release v0.0.${{ github.run_number }} - body: | - Changes in this Release - - First Change - - Second Change - draft: false - prerelease: false - - - name: Upload Release Asset - id: upload-release-asset - uses: actions/upload-release-asset@v1 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - upload_url: ${{ steps.create_release.outputs.upload_url }} # This pulls from the CREATE RELEASE step above, referencing it's ID to get its outputs object, which include a `upload_url`. See this blog post for more info: https://jasonet.co/posts/new-features-of-github-actions/#passing-data-to-future-steps - asset_path: build/kubescape - asset_name: kubescape - asset_content_type: application/octet-stream From d5383fe218d59b0b021f7afa0dea44a9e5362cc4 Mon Sep 17 00:00:00 2001 From: danielgrunbergerarmo Date: Wed, 18 Aug 2021 14:04:00 +0300 Subject: [PATCH 2/6] fix field selector for non-namespaced resources --- policyhandler/k8sresources.go | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/policyhandler/k8sresources.go b/policyhandler/k8sresources.go index e9d256ee..31de93ea 100644 --- a/policyhandler/k8sresources.go +++ b/policyhandler/k8sresources.go @@ -60,7 +60,7 @@ func (policyHandler *PolicyHandler) pullSingleResource(resource *schema.GroupVer // set labels listOptions := metav1.ListOptions{} - if excludedNamespaces != "" { + if excludedNamespaces != "" && k8sinterface.IsNamespaceScope(resource.Group, resource.Resource) { excludedNamespacesSlice := strings.Split(excludedNamespaces, ",") for _, excludedNamespace := range excludedNamespacesSlice { listOptions.FieldSelector += "metadata.namespace!=" + excludedNamespace + "," @@ -73,7 +73,6 @@ func (policyHandler *PolicyHandler) pullSingleResource(resource *schema.GroupVer // set dynamic object var clientResource dynamic.ResourceInterface - if namespace != "" && k8sinterface.IsNamespaceScope(resource.Group, resource.Resource) { clientResource = policyHandler.k8s.DynamicClient.Resource(*resource).Namespace(namespace) } else { From 8b7a4b1e488124804dc5ca5605eb93ed8c8f64a4 Mon Sep 17 00:00:00 2001 From: danielgrunbergerarmo Date: Wed, 18 Aug 2021 14:21:44 +0300 Subject: [PATCH 3/6] fix output format --- printer/printresults.go | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/printer/printresults.go b/printer/printresults.go index 83f61321..4d87cb8e 100644 --- a/printer/printresults.go +++ b/printer/printresults.go @@ -13,7 +13,7 @@ import ( "github.com/olekukonko/tablewriter" ) -var INDENT = " " +var INDENT = " " type Printer struct { opaSessionObj *chan *cautils.OPASessionObj @@ -96,7 +96,7 @@ func (printer *Printer) printTitle(controlName string, controlSummery *ControlSu cautils.FailureDisplay(os.Stdout, "failed %v\n", emoji.SadButRelievedFace) } - cautils.SimpleDisplay(os.Stdout, "Description: %s\n", controlSummery.Description) + cautils.SimpleDisplay(os.Stdout, "Description: %s\n\n", controlSummery.Description) } func (printer *Printer) printResult(controlName string, controlSummery *ControlSummery) { @@ -104,7 +104,6 @@ func (printer *Printer) printResult(controlName string, controlSummery *ControlS indent := INDENT for ns, rsc := range controlSummery.WorkloadSummery { preIndent := indent - indent += indent cautils.SimpleDisplay(os.Stdout, "%sNamespace %s\n", indent, ns) preIndent2 := indent for r := range rsc { From d5d0da8ac3198e26aae1bf1126ffefc49457ec3c Mon Sep 17 00:00:00 2001 From: danielgrunbergerarmo Date: Wed, 18 Aug 2021 14:33:14 +0300 Subject: [PATCH 4/6] fix non-namespacd resources --- cautils/display.go | 1 + printer/printresults.go | 8 +++++--- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/cautils/display.go b/cautils/display.go index 62f056ee..b7cc0181 100644 --- a/cautils/display.go +++ b/cautils/display.go @@ -16,6 +16,7 @@ var InfoDisplay = color.New(color.Bold, color.FgHiYellow).FprintfFunc() var InfoTextDisplay = color.New(color.Faint, color.FgHiYellow).FprintfFunc() var SimpleDisplay = color.New(color.Bold, color.FgHiWhite).FprintfFunc() var SuccessDisplay = color.New(color.Bold, color.FgHiGreen).FprintfFunc() +var DescriptionDisplay = color.New(color.Faint, color.FgWhite).FprintfFunc() var Spinner *spinner.Spinner diff --git a/printer/printresults.go b/printer/printresults.go index 4d87cb8e..21bd7de3 100644 --- a/printer/printresults.go +++ b/printer/printresults.go @@ -83,7 +83,7 @@ func (print *Printer) printSummery(controlName string, controlSummery *ControlSu cautils.SimpleDisplay(os.Stdout, "Summary - ") cautils.SuccessDisplay(os.Stdout, "Passed:%v ", controlSummery.TotalResources-controlSummery.TotalFailed) cautils.FailureDisplay(os.Stdout, "Failed:%v ", controlSummery.TotalFailed) - cautils.InfoDisplay(os.Stdout, "Total:%v\n", controlSummery.TotalResources) + cautils.InfoDisplay(os.Stdout, "Total:%v\n\n", controlSummery.TotalResources) } func (printer *Printer) printTitle(controlName string, controlSummery *ControlSummery) { @@ -96,7 +96,7 @@ func (printer *Printer) printTitle(controlName string, controlSummery *ControlSu cautils.FailureDisplay(os.Stdout, "failed %v\n", emoji.SadButRelievedFace) } - cautils.SimpleDisplay(os.Stdout, "Description: %s\n\n", controlSummery.Description) + cautils.DescriptionDisplay(os.Stdout, "Description: %s\n", controlSummery.Description) } func (printer *Printer) printResult(controlName string, controlSummery *ControlSummery) { @@ -104,7 +104,9 @@ func (printer *Printer) printResult(controlName string, controlSummery *ControlS indent := INDENT for ns, rsc := range controlSummery.WorkloadSummery { preIndent := indent - cautils.SimpleDisplay(os.Stdout, "%sNamespace %s\n", indent, ns) + if ns != "" { + cautils.SimpleDisplay(os.Stdout, "%sNamespace %s\n", indent, ns) + } preIndent2 := indent for r := range rsc { indent += indent From 34170faae99d677ebd8a0dd4a912b866e7bd7a3f Mon Sep 17 00:00:00 2001 From: danielgrunbergerarmo Date: Wed, 18 Aug 2021 14:45:49 +0300 Subject: [PATCH 5/6] update readme.md --- README.md | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 99246b86..41fa69d6 100644 --- a/README.md +++ b/README.md @@ -9,14 +9,20 @@ Tests are configured with YAML files, making this tool easy to update as test sp ## Installation To install the tool locally, run this: -`curl -s https://raw.githubusercontent.com/armosec/kubescape/master/install.sh | /bin/bash` +``` +curl -s https://raw.githubusercontent.com/armosec/kubescape/master/install.sh | /bin/bash +``` ## Run To get a fast check of the security posture of your Kubernetes cluster, run this: -`kubescape scan framework nsa` +``` +kubescape scan framework nsa --exclude-namespaces kube-system,kube-public +``` + +If you wish to scan all namespaces in your cluster, remove the `--exclude-namespaces` flag. From 9509c69d8782bc376a5622da1cdcde6ef7d586fb Mon Sep 17 00:00:00 2001 From: danielgrunbergerarmo Date: Wed, 18 Aug 2021 14:51:05 +0300 Subject: [PATCH 6/6] update install version --- .github/workflows/build.yaml | 53 ++++++++++++++++++++++++++++++++++++ install.sh | 2 +- 2 files changed, 54 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/build.yaml diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml new file mode 100644 index 00000000..a129889e --- /dev/null +++ b/.github/workflows/build.yaml @@ -0,0 +1,53 @@ +name: build + +on: + push: + branches: [ master ] + pull_request: + branches: [ master ] + +jobs: + build: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v2 + + - name: Set up Go + uses: actions/setup-go@v2 + with: + go-version: 1.16 + + - name: Build + run: mkdir build && go mod tidy && go build -ldflags "-w -s" -o build/kubescape + + - name: Chmod + run: chmod +x build/kubescape + + - name: List + run: ls -la + + - name: Create Release + id: create_release + uses: actions/create-release@v1 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + tag_name: v0.0.${{ github.run_number }} + release_name: Release v0.0.${{ github.run_number }} + body: | + Changes in this Release + - First Change + - Second Change + draft: false + prerelease: false + + - name: Upload Release Asset + id: upload-release-asset + uses: actions/upload-release-asset@v1 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + upload_url: ${{ steps.create_release.outputs.upload_url }} # This pulls from the CREATE RELEASE step above, referencing it's ID to get its outputs object, which include a `upload_url`. See this blog post for more info: https://jasonet.co/posts/new-features-of-github-actions/#passing-data-to-future-steps + asset_path: build/kubescape + asset_name: kubescape + asset_content_type: application/octet-stream \ No newline at end of file diff --git a/install.sh b/install.sh index 1beb7bc5..9844bd08 100755 --- a/install.sh +++ b/install.sh @@ -6,7 +6,7 @@ echo BASE_DIR=~/.kubescape KUBESCAPE_EXEC=kubescape -RELEASE=v0.0.18 +RELEASE=v0.0.29 DOWNLOAD_URL="https://github.com/armosec/kubescape/releases/download/$RELEASE/kubescape" mkdir -p $BASE_DIR