From e7917277e796589ad66fa101b3befe2b39d60203 Mon Sep 17 00:00:00 2001 From: dwertent Date: Thu, 9 Dec 2021 13:27:23 +0200 Subject: [PATCH] move rbac objects to cautils --- cautils/getter/downloadreleasedpolicy.go | 6 +- cautils/rbac.go | 113 +++++++++++++++++++++++ clihandler/cmd/rbac.go | 110 +--------------------- clihandler/initcli.go | 10 +- clihandler/initcliutils.go | 3 + go.mod | 2 +- go.sum | 4 +- resourcehandler/k8sresources.go | 22 ++++- 8 files changed, 154 insertions(+), 116 deletions(-) create mode 100644 cautils/rbac.go diff --git a/cautils/getter/downloadreleasedpolicy.go b/cautils/getter/downloadreleasedpolicy.go index caac33d2..9b6f9f86 100644 --- a/cautils/getter/downloadreleasedpolicy.go +++ b/cautils/getter/downloadreleasedpolicy.go @@ -18,7 +18,7 @@ type DownloadReleasedPolicy struct { func NewDownloadReleasedPolicy() *DownloadReleasedPolicy { return &DownloadReleasedPolicy{ - gs: gitregostore.InitDefaultGitRegoStore(-1), + gs: gitregostore.NewDefaultGitRegoStore(-1), } } @@ -41,6 +41,10 @@ func (drp *DownloadReleasedPolicy) GetFramework(name string) (*reporthandling.Fr return framework, err } +func (drp *DownloadReleasedPolicy) SetRegoObjects() error { + return drp.gs.SetRegoObjects() +} + func isNativeFramework(framework string) bool { return contains(NativeFrameworks, framework) } diff --git a/cautils/rbac.go b/cautils/rbac.go new file mode 100644 index 00000000..e1b2d2ec --- /dev/null +++ b/cautils/rbac.go @@ -0,0 +1,113 @@ +package cautils + +import ( + "encoding/json" + "time" + + "github.com/armosec/k8s-interface/workloadinterface" + "github.com/armosec/opa-utils/reporthandling" + "github.com/armosec/rbac-utils/rbacscanner" + "github.com/armosec/rbac-utils/rbacutils" + uuid "github.com/satori/go.uuid" +) + +type RBACObjects struct { + scanner *rbacscanner.RbacScannerFromK8sAPI +} + +func NewRBACObjects(scanner *rbacscanner.RbacScannerFromK8sAPI) *RBACObjects { + return &RBACObjects{scanner: scanner} +} + +func (rbacObjects *RBACObjects) SetResourcesReport() (*reporthandling.PostureReport, error) { + return &reporthandling.PostureReport{ + ReportID: uuid.NewV4().String(), + ReportGenerationTime: time.Now().UTC(), + CustomerGUID: rbacObjects.scanner.CustomerGUID, + ClusterName: rbacObjects.scanner.ClusterName, + }, nil +} + +func (rbacObjects *RBACObjects) ListAllResources() (map[string]workloadinterface.IMetadata, error) { + resources, err := rbacObjects.scanner.ListResources() + if err != nil { + return nil, err + } + allresources, err := rbacObjects.rbacObjectsToResources(resources) + if err != nil { + return nil, err + } + return allresources, nil +} + +func (rbacObjects *RBACObjects) rbacObjectsToResources(resources *rbacutils.RbacObjects) (map[string]workloadinterface.IMetadata, error) { + allresources := map[string]workloadinterface.IMetadata{} + // wrap rbac aggregated objects in IMetadata and add to allresources + rbacIMeta, err := rbacutils.RbacObjectIMetadataWrapper(resources.Rbac) + if err != nil { + return nil, err + } + allresources[rbacIMeta.GetID()] = rbacIMeta + rbacTableIMeta, err := rbacutils.RbacTableObjectIMetadataWrapper(resources.RbacT) + if err != nil { + return nil, err + } + allresources[rbacTableIMeta.GetID()] = rbacTableIMeta + SA2WLIDmapIMeta, err := rbacutils.SA2WLIDmapIMetadataWrapper(resources.SA2WLIDmap) + if err != nil { + return nil, err + } + allresources[SA2WLIDmapIMeta.GetID()] = SA2WLIDmapIMeta + + // convert rbac k8s resources to IMetadata and add to allresources + for _, cr := range resources.ClusterRoles.Items { + crmap, err := convertToMap(cr) + if err != nil { + return nil, err + } + crIMeta := workloadinterface.NewWorkloadObj(crmap) + crIMeta.SetKind("ClusterRole") + allresources[crIMeta.GetID()] = crIMeta + } + for _, cr := range resources.Roles.Items { + crmap, err := convertToMap(cr) + if err != nil { + return nil, err + } + crIMeta := workloadinterface.NewWorkloadObj(crmap) + crIMeta.SetKind("Role") + allresources[crIMeta.GetID()] = crIMeta + } + for _, cr := range resources.ClusterRoleBindings.Items { + crmap, err := convertToMap(cr) + if err != nil { + return nil, err + } + crIMeta := workloadinterface.NewWorkloadObj(crmap) + crIMeta.SetKind("ClusterRoleBinding") + allresources[crIMeta.GetID()] = crIMeta + } + for _, cr := range resources.RoleBindings.Items { + crmap, err := convertToMap(cr) + if err != nil { + return nil, err + } + crIMeta := workloadinterface.NewWorkloadObj(crmap) + crIMeta.SetKind("RoleBinding") + allresources[crIMeta.GetID()] = crIMeta + } + return allresources, nil +} + +func convertToMap(obj interface{}) (map[string]interface{}, error) { + var inInterface map[string]interface{} + inrec, err := json.Marshal(obj) + if err != nil { + return nil, err + } + err = json.Unmarshal(inrec, &inInterface) + if err != nil { + return nil, err + } + return inInterface, nil +} diff --git a/clihandler/cmd/rbac.go b/clihandler/cmd/rbac.go index fdfc5aeb..c27d0d0d 100644 --- a/clihandler/cmd/rbac.go +++ b/clihandler/cmd/rbac.go @@ -1,124 +1,18 @@ package cmd import ( - "encoding/json" "fmt" "os" - "time" "github.com/armosec/k8s-interface/k8sinterface" - "github.com/armosec/k8s-interface/workloadinterface" + "github.com/armosec/kubescape/cautils" "github.com/armosec/kubescape/clihandler" "github.com/armosec/kubescape/clihandler/cliinterfaces" "github.com/armosec/kubescape/resultshandling/reporter" - "github.com/armosec/opa-utils/reporthandling" "github.com/armosec/rbac-utils/rbacscanner" - "github.com/armosec/rbac-utils/rbacutils" - uuid "github.com/satori/go.uuid" "github.com/spf13/cobra" ) -type RBACObjects struct { - scanner *rbacscanner.RbacScannerFromK8sAPI -} - -func NewRBACObjects(scanner *rbacscanner.RbacScannerFromK8sAPI) *RBACObjects { - return &RBACObjects{scanner: scanner} -} - -func (rbacObjects *RBACObjects) SetResourcesReport() (*reporthandling.PostureReport, error) { - return &reporthandling.PostureReport{ - ReportID: uuid.NewV4().String(), - ReportGenerationTime: time.Now().UTC(), - CustomerGUID: rbacObjects.scanner.CustomerGUID, - ClusterName: rbacObjects.scanner.ClusterName, - }, nil -} - -func (rbacObjects *RBACObjects) ListAllResources() (map[string]workloadinterface.IMetadata, error) { - resources, err := rbacObjects.scanner.ListResources() - if err != nil { - return nil, err - } - allresources, err := rbacObjects.rbacObjectsToResources(resources) - if err != nil { - return nil, err - } - return allresources, nil -} - -func (rbacObjects *RBACObjects) rbacObjectsToResources(resources *rbacutils.RbacObjects) (map[string]workloadinterface.IMetadata, error) { - allresources := map[string]workloadinterface.IMetadata{} - // wrap rbac aggregated objects in IMetadata and add to allresources - rbacIMeta, err := rbacutils.RbacObjectIMetadataWrapper(resources.Rbac) - if err != nil { - return nil, err - } - allresources[rbacIMeta.GetID()] = rbacIMeta - rbacTableIMeta, err := rbacutils.RbacTableObjectIMetadataWrapper(resources.RbacT) - if err != nil { - return nil, err - } - allresources[rbacTableIMeta.GetID()] = rbacTableIMeta - SA2WLIDmapIMeta, err := rbacutils.SA2WLIDmapIMetadataWrapper(resources.SA2WLIDmap) - if err != nil { - return nil, err - } - allresources[SA2WLIDmapIMeta.GetID()] = SA2WLIDmapIMeta - - // convert rbac k8s resources to IMetadata and add to allresources - for _, cr := range resources.ClusterRoles.Items { - crmap, err := convertToMap(cr) - if err != nil { - return nil, err - } - crIMeta := workloadinterface.NewWorkloadObj(crmap) - crIMeta.SetKind("ClusterRole") - allresources[crIMeta.GetID()] = crIMeta - } - for _, cr := range resources.Roles.Items { - crmap, err := convertToMap(cr) - if err != nil { - return nil, err - } - crIMeta := workloadinterface.NewWorkloadObj(crmap) - crIMeta.SetKind("Role") - allresources[crIMeta.GetID()] = crIMeta - } - for _, cr := range resources.ClusterRoleBindings.Items { - crmap, err := convertToMap(cr) - if err != nil { - return nil, err - } - crIMeta := workloadinterface.NewWorkloadObj(crmap) - crIMeta.SetKind("ClusterRoleBinding") - allresources[crIMeta.GetID()] = crIMeta - } - for _, cr := range resources.RoleBindings.Items { - crmap, err := convertToMap(cr) - if err != nil { - return nil, err - } - crIMeta := workloadinterface.NewWorkloadObj(crmap) - crIMeta.SetKind("RoleBinding") - allresources[crIMeta.GetID()] = crIMeta - } - return allresources, nil -} - -func convertToMap(obj interface{}) (map[string]interface{}, error) { - var inInterface map[string]interface{} - inrec, err := json.Marshal(obj) - if err != nil { - return nil, err - } - err = json.Unmarshal(inrec, &inInterface) - if err != nil { - return nil, err - } - return inInterface, nil -} - // rabcCmd represents the RBAC command var rabcCmd = &cobra.Command{ Use: "rbac \nExample:\n$ kubescape submit rbac", @@ -135,7 +29,7 @@ var rabcCmd = &cobra.Command{ } // list RBAC - rbacObjects := NewRBACObjects(rbacscanner.NewRbacScannerFromK8sAPI(k8s, clusterConfig.GetCustomerGUID(), clusterConfig.GetClusterName())) + rbacObjects := cautils.NewRBACObjects(rbacscanner.NewRbacScannerFromK8sAPI(k8s, clusterConfig.GetCustomerGUID(), clusterConfig.GetClusterName())) // submit resources r := reporter.NewReportEventReceiver(clusterConfig.GetConfigObj()) diff --git a/clihandler/initcli.go b/clihandler/initcli.go index c0bc3a15..78d5ae0b 100644 --- a/clihandler/initcli.go +++ b/clihandler/initcli.go @@ -18,6 +18,7 @@ import ( "github.com/armosec/kubescape/resultshandling/printer" "github.com/armosec/kubescape/resultshandling/reporter" "github.com/armosec/opa-utils/reporthandling" + "github.com/armosec/rbac-utils/rbacscanner" "github.com/golang/glog" ) @@ -69,11 +70,14 @@ func getInterfaces(scanInfo *cautils.ScanInfo) componentInterfaces { case cautils.ScanCluster: k8s := k8sinterface.NewKubernetesApi() // initialize kubernetes api object - // pull k8s resources - hostSensorHandler = initHostSensor(scanInfo, k8s) - resourceHandler = resourcehandler.NewK8sResourceHandler(k8s, getFieldSelector(scanInfo), hostSensorHandler) // use clusterConfig struct tenantConfig = cautils.NewClusterConfig(k8s, getter.GetArmoAPIConnector(), scanInfo.Account) + + // pull k8s resources + hostSensorHandler = initHostSensor(scanInfo, k8s) + rbacObjects := cautils.NewRBACObjects(rbacscanner.NewRbacScannerFromK8sAPI(k8s, tenantConfig.GetCustomerGUID(), tenantConfig.GetClusterName())) + resourceHandler = resourcehandler.NewK8sResourceHandler(k8s, getFieldSelector(scanInfo), hostSensorHandler, rbacObjects) + } // reporting behavior - setup reporter reportHandler := getReporter(scanInfo, tenantConfig) diff --git a/clihandler/initcliutils.go b/clihandler/initcliutils.go index e9abc6ba..c62bee2c 100644 --- a/clihandler/initcliutils.go +++ b/clihandler/initcliutils.go @@ -44,6 +44,9 @@ func policyIdentifierNames(pi []reporthandling.PolicyIdentifier) string { policiesNames += "," } } + if policiesNames == "" { + policiesNames = "all" + } return policiesNames } diff --git a/go.mod b/go.mod index 0f278b9c..73376811 100644 --- a/go.mod +++ b/go.mod @@ -5,7 +5,7 @@ go 1.17 require ( github.com/armosec/armoapi-go v0.0.23 github.com/armosec/k8s-interface v0.0.32 - github.com/armosec/opa-utils v0.0.61 + github.com/armosec/opa-utils v0.0.62 github.com/armosec/rbac-utils v0.0.8 github.com/armosec/utils-go v0.0.3 github.com/briandowns/spinner v1.16.0 diff --git a/go.sum b/go.sum index ac5b4203..fc854e14 100644 --- a/go.sum +++ b/go.sum @@ -91,8 +91,8 @@ github.com/armosec/k8s-interface v0.0.19/go.mod h1:0ztwEWLez2lpMMKHbs0DoZV64S0YI github.com/armosec/k8s-interface v0.0.26/go.mod h1:vHxGWqD/uh6+GQb9Sqv7OGMs+Rvc2dsFVc0XtgRh1ZU= github.com/armosec/k8s-interface v0.0.32 h1:dvSDRTXVZWrHyWOgu1QDrd4M2De4KYClrnB/k5Dq5fk= github.com/armosec/k8s-interface v0.0.32/go.mod h1:vHxGWqD/uh6+GQb9Sqv7OGMs+Rvc2dsFVc0XtgRh1ZU= -github.com/armosec/opa-utils v0.0.61 h1:qIjsiv6BdSE7r+8k6FZtn0ZllYiai7Iyd8rl5YI4qPU= -github.com/armosec/opa-utils v0.0.61/go.mod h1:P63qZDPG3vjPtSQqwx2N4Nfm8VaboDul7R7kmnUvvWc= +github.com/armosec/opa-utils v0.0.62 h1:C/VN1HUDoa0BX2CTSqgjuKEIlb/rkIwGY2/UlvfS154= +github.com/armosec/opa-utils v0.0.62/go.mod h1:P63qZDPG3vjPtSQqwx2N4Nfm8VaboDul7R7kmnUvvWc= github.com/armosec/rbac-utils v0.0.1/go.mod h1:pQ8CBiij8kSKV7aeZm9FMvtZN28VgA7LZcYyTWimq40= github.com/armosec/rbac-utils v0.0.8 h1:Hpr2p9F3Elp9NxbDAZiMlNUcQOdfyu9rWFE2fM2nNGw= github.com/armosec/rbac-utils v0.0.8/go.mod h1:fmLZDgT5ILNo5gzR19boIIn7TOpfWh2pIgprxLrYN/g= diff --git a/resourcehandler/k8sresources.go b/resourcehandler/k8sresources.go index 5eb71242..98359f26 100644 --- a/resourcehandler/k8sresources.go +++ b/resourcehandler/k8sresources.go @@ -25,13 +25,15 @@ type K8sResourceHandler struct { k8s *k8sinterface.KubernetesApi hostSensorHandler hostsensorutils.IHostSensor fieldSelector IFieldSelector + rbacObjectsAPI *cautils.RBACObjects } -func NewK8sResourceHandler(k8s *k8sinterface.KubernetesApi, fieldSelector IFieldSelector, hostSensorHandler hostsensorutils.IHostSensor) *K8sResourceHandler { +func NewK8sResourceHandler(k8s *k8sinterface.KubernetesApi, fieldSelector IFieldSelector, hostSensorHandler hostsensorutils.IHostSensor, rbacObjects *cautils.RBACObjects) *K8sResourceHandler { return &K8sResourceHandler{ k8s: k8s, fieldSelector: fieldSelector, hostSensorHandler: hostSensorHandler, + rbacObjectsAPI: rbacObjects, } } @@ -56,6 +58,10 @@ func (k8sHandler *K8sResourceHandler) GetResources(frameworks []reporthandling.F return k8sResourcesMap, allResources, err } + if err := k8sHandler.collectRbacResources(allResources); err != nil { + fmt.Println("failed to collect rbac resources") + } + cautils.SuccessTextDisplay("Accessed successfully to Kubernetes objects") return k8sResourcesMap, allResources, nil } @@ -158,3 +164,17 @@ func (k8sHandler *K8sResourceHandler) collectHostResources(allResources map[stri } return nil } + +func (k8sHandler *K8sResourceHandler) collectRbacResources(allResources map[string]workloadinterface.IMetadata) error { + if k8sHandler.rbacObjectsAPI == nil { + return nil + } + allRbacResources, err := k8sHandler.rbacObjectsAPI.ListAllResources() + if err != nil { + return err + } + for k, v := range allRbacResources { + allResources[k] = v + } + return nil +}