github/kubescape
1
0
Fork 0
mirror of https://github.com/kubescape/kubescape.git synced 2026-04-15 06:58:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge to master - PR number: 1086

Browse Source
This commit is contained in:
David Wertenteil
2023-02-08 09:44:10 +02:00
committed by GitHub
parent 2a0a2cf95a d3abd66aa3
commit f1af9d5687
7 changed files with 31 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/scan/framework.go
+6 -1
View File
@@ -15,6 +15,7 @@ import (
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/cautils/getter"
"github.com/kubescape/kubescape/v2/core/meta"
"github.com/spf13/cobra"
@@ -72,6 +73,9 @@ func getFrameworkCmd(ks meta.IKubescape, scanInfo *cautils.ScanInfo) *cobra.Comm
}
scanInfo.FrameworkScan = true
// We do not scan all frameworks by default when triggering scan from the CLI
scanInfo.ScanAll = false
var frameworks []string
if len(args) == 0 { // scan all frameworks
@@ -81,11 +85,12 @@ func getFrameworkCmd(ks meta.IKubescape, scanInfo *cautils.ScanInfo) *cobra.Comm
frameworks = strings.Split(args[0], ",")
if cautils.StringInSlice(frameworks, "all") != cautils.ValueNotFound {
scanInfo.ScanAll = true
frameworks = []string{}
frameworks = getter.NativeFrameworks
}
if len(args) > 1 {
if len(args[1:]) == 0 || args[1] != "-" {
scanInfo.InputPatterns = args[1:]
logger.L().Debug("List of input files", helpers.Interface("patterns", scanInfo.InputPatterns))
} else { // store stdin to file - do NOT move to separate function !!
tempFile, err := os.CreateTemp(".", "tmp-kubescape*.yaml")
if err != nil {
cmd/scan/scan.go
+3 -3
View File
@@ -3,9 +3,11 @@ package scan
import (
"flag"
"fmt"
"strings"
"github.com/kubescape/k8s-interface/k8sinterface"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/kubescape/v2/core/cautils/getter"
"github.com/kubescape/kubescape/v2/core/meta"
"github.com/spf13/cobra"
)
@@ -41,7 +43,6 @@ func GetScanCommand(ks meta.IKubescape) *cobra.Command {
Args: func(cmd *cobra.Command, args []string) error {
if len(args) > 0 {
if args[0] != "framework" && args[0] != "control" {
scanInfo.ScanAll = true
return getFrameworkCmd(ks, &scanInfo).RunE(cmd, append([]string{"all"}, args...))
}
}
@@ -50,8 +51,7 @@ func GetScanCommand(ks meta.IKubescape) *cobra.Command {
RunE: func(cmd *cobra.Command, args []string) error {
if len(args) == 0 {
scanInfo.ScanAll = true
return getFrameworkCmd(ks, &scanInfo).RunE(cmd, []string{"all"})
return getFrameworkCmd(ks, &scanInfo).RunE(cmd, []string{strings.Join(getter.NativeFrameworks, ",")})
}
return nil
},
core/cautils/getter/kscloudapiutils.go
+1 -1
View File
@@ -8,7 +8,7 @@ import (
"strings"
)
var NativeFrameworks = []string{"nsa", "mitre", "armobest", "devopsbest"}
var NativeFrameworks = []string{"allcontrols", "nsa", "mitre"}
func (api *KSCloudAPI) getFrameworkURL(frameworkName string) string {
u := url.URL{}
core/pkg/opaprocessor/cosign_has_signature.go
+1 -6
View File
@@ -2,25 +2,20 @@ package opaprocessor
import (
"context"
"github.com/google/go-containerregistry/pkg/name"
"github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/sigstore/cosign/pkg/cosign"
)
func has_signature(img string) bool {
ref, err := name.ParseReference(img)
if err != nil {
logger.L().Error("parsing reference", helpers.Error(err))
return false
}
sins, err := cosign.FetchSignaturesForReference(context.Background(), ref)
if err != nil {
logger.L().Error("verifying signature", helpers.Error(err))
return false
}
return len(sins) > 0
core/pkg/opaprocessor/cosign_verify.go
+11 -11
View File
@@ -18,29 +18,29 @@ import (
// nolint
type VerifyCommand struct {
options.RegistryOptions
CheckClaims bool
KeyRef string
CertRef string
Annotations sigs.AnnotationsMap
CertChain string
CertEmail string
CertOidcProvider string
CertIdentity string
CertOidcIssuer string
CertGithubWorkflowTrigger string
CertGithubWorkflowSha string
CertGithubWorkflowName string
CertGithubWorkflowRepository string
KeyRef string
CertGithubWorkflowRef string
CertChain string
CertOidcProvider string
EnforceSCT bool
Sk bool
SignatureRef string
CertRef string
CertGithubWorkflowRepository string
Attachment string
Slot string
Output string
RekorURL string
Attachment string
Annotations sigs.AnnotationsMap
SignatureRef string
HashAlgorithm crypto.Hash
Sk bool
CheckClaims bool
LocalImage bool
EnforceSCT bool
}
// Exec runs the verification command
core/pkg/opaprocessor/utils.go
+7 -1
View File
@@ -3,6 +3,8 @@ package opaprocessor
import (
"fmt"
logger "github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
"github.com/kubescape/kubescape/v2/core/cautils"
"github.com/kubescape/opa-utils/reporthandling"
"github.com/kubescape/opa-utils/reporthandling/results/v1/reportsummary"
@@ -64,7 +66,11 @@ var cosignVerifySignatureDefinition = func(bctx rego.BuiltinContext, a, b *ast.T
if err != nil {
return nil, fmt.Errorf("invalid parameter type: %v", err)
}
result, _ := verify(string(aStr), string(bStr))
result, err := verify(string(aStr), string(bStr))
if err != nil {
// Do not change this log from debug level. We might find a lot of images without signature
logger.L().Debug("failed to verify signature", helpers.String("image", string(aStr)), helpers.String("key", string(bStr)), helpers.Error(err))
}
return ast.BooleanTerm(result), nil
}
core/pkg/policyhandler/handlepullpolicies.go
+2
View File
@@ -59,6 +59,7 @@ func (policyHandler *PolicyHandler) getScanPolicies(ctx context.Context, policyI
switch getScanKind(policyIdentifier) {
case apisv1.KindFramework: // Download frameworks
for _, rule := range policyIdentifier {
logger.L().Debug("Downloading framework", helpers.String("framework", rule.Identifier))
receivedFramework, err := policyHandler.getters.PolicyGetter.GetFramework(rule.Identifier)
if err != nil {
return frameworks, policyDownloadError(err)
@@ -79,6 +80,7 @@ func (policyHandler *PolicyHandler) getScanPolicies(ctx context.Context, policyI
var receivedControl *reporthandling.Control
var err error
for _, policy := range policyIdentifier {
logger.L().Debug("Downloading control", helpers.String("control", policy.Identifier))
receivedControl, err = policyHandler.getters.PolicyGetter.GetControl(policy.Identifier)
if err != nil {
return frameworks, policyDownloadError(err)