From f8eea4d0825bc4a5c58d1f2d01ea03d0bbb0ea1e Mon Sep 17 00:00:00 2001 From: yiscah Date: Mon, 22 Nov 2021 11:06:29 +0200 Subject: [PATCH] use inputaggregator on k8sresources, don't use v0 rules --- cautils/getter/armoapi.go | 3 ++- cautils/getter/downloadreleasedpolicy.go | 3 ++- go.mod | 4 ++-- go.sum | 7 +++--- opaprocessor/processorhandler.go | 5 ++++ resultshandling/printer/summeryhelpers.go | 29 +++++++++++++++++++++++ 6 files changed, 44 insertions(+), 7 deletions(-) diff --git a/cautils/getter/armoapi.go b/cautils/getter/armoapi.go index 87e04395..0abe32c4 100644 --- a/cautils/getter/armoapi.go +++ b/cautils/getter/armoapi.go @@ -85,7 +85,8 @@ func NewARMOAPICustomized(armoERURL, armoBEURL, armoFEURL string) *ArmoAPI { func newArmoAPI() *ArmoAPI { return &ArmoAPI{ httpClient: &http.Client{Timeout: time.Duration(61) * time.Second}, - gs: gitregostore.InitDefaultGitRegoStore(-1), + // gs: gitregostore.InitDefaultGitRegoStore(-1), + gs: gitregostore.InitGitRegoStore("https://api.github.com/repos", "armosec", "regolibrary", "git/trees", "", "dev", -1), } } func (armoAPI *ArmoAPI) SetCustomerGUID(customerGUID string) { diff --git a/cautils/getter/downloadreleasedpolicy.go b/cautils/getter/downloadreleasedpolicy.go index caac33d2..b3b457ff 100644 --- a/cautils/getter/downloadreleasedpolicy.go +++ b/cautils/getter/downloadreleasedpolicy.go @@ -18,7 +18,8 @@ type DownloadReleasedPolicy struct { func NewDownloadReleasedPolicy() *DownloadReleasedPolicy { return &DownloadReleasedPolicy{ - gs: gitregostore.InitDefaultGitRegoStore(-1), + // gs: gitregostore.InitDefaultGitRegoStore(-1), + gs: gitregostore.InitGitRegoStore("https://api.github.com/repos", "armosec", "regolibrary", "git/trees", "", "dev", -1), } } diff --git a/go.mod b/go.mod index ac553962..d78d414c 100644 --- a/go.mod +++ b/go.mod @@ -4,8 +4,8 @@ go 1.17 require ( github.com/armosec/armoapi-go v0.0.23 - github.com/armosec/k8s-interface v0.0.8 - github.com/armosec/opa-utils v0.0.42 + github.com/armosec/k8s-interface v0.0.12 + github.com/armosec/opa-utils v0.0.45 github.com/armosec/rbac-utils v0.0.1 github.com/armosec/utils-go v0.0.3 github.com/briandowns/spinner v1.16.0 diff --git a/go.sum b/go.sum index d298636d..43ea3b26 100644 --- a/go.sum +++ b/go.sum @@ -86,10 +86,11 @@ github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj github.com/armosec/armoapi-go v0.0.2/go.mod h1:vIK17yoKbJRQyZXWWLe3AqfqCRITxW8qmSkApyq5xFs= github.com/armosec/armoapi-go v0.0.23 h1:jqoLIWM5CR7DCD9fpFgN0ePqtHvOCoZv/XzCwsUluJU= github.com/armosec/armoapi-go v0.0.23/go.mod h1:iaVVGyc23QGGzAdv4n+szGQg3Rbpixn9yQTU3qWRpaw= -github.com/armosec/k8s-interface v0.0.8 h1:Eo3Qen4yFXxzVem49FNeij2ckyzHSAJ0w6PZMaSEIm8= github.com/armosec/k8s-interface v0.0.8/go.mod h1:xxS+V5QT3gVQTwZyAMMDrYLWGrfKOpiJ7Jfhfa0w9sM= -github.com/armosec/opa-utils v0.0.42 h1:7YzQJNVBmM0+1nWOAiUgDt+mvlVEwApg80FjMh4oxXo= -github.com/armosec/opa-utils v0.0.42/go.mod h1:OqewZoSqKD5udtQ4lGFixb8yyFNqLq9zqinlAL6KSjM= +github.com/armosec/k8s-interface v0.0.12 h1:SzFqu9dG+Pak+empVkYu+weznWTNSWlxcIqTaGFIgFo= +github.com/armosec/k8s-interface v0.0.12/go.mod h1:xxS+V5QT3gVQTwZyAMMDrYLWGrfKOpiJ7Jfhfa0w9sM= +github.com/armosec/opa-utils v0.0.45 h1:TZQ9QY6Lft4BxLrHADv0ERoJdzRMg8U6N7LBO9vAUMs= +github.com/armosec/opa-utils v0.0.45/go.mod h1:HtOWZJXviVwuCeUBc5TMZFoxYz9QsITxCE3oJVx/Z6Y= github.com/armosec/rbac-utils v0.0.1 h1:N2MI98F/0zbDjmRZ29CNElU1AXkFLk5csd/qAHOBdXY= github.com/armosec/rbac-utils v0.0.1/go.mod h1:pQ8CBiij8kSKV7aeZm9FMvtZN28VgA7LZcYyTWimq40= github.com/armosec/utils-go v0.0.2/go.mod h1:itWmRLzRdsnwjpEOomL0mBWGnVNNIxSjDAdyc+b0iUo= diff --git a/opaprocessor/processorhandler.go b/opaprocessor/processorhandler.go index 31ede043..402b9ccb 100644 --- a/opaprocessor/processorhandler.go +++ b/opaprocessor/processorhandler.go @@ -3,6 +3,7 @@ package opaprocessor import ( "context" "fmt" + "strings" "time" "github.com/armosec/kubescape/cautils" @@ -149,7 +150,11 @@ func (opap *OPAProcessor) processRule(rule *reporthandling.PolicyRule) (*reporth if ruleWithArmoOpaDependency(rule.Attributes) { return nil, nil } + if strings.HasSuffix(rule.Name, "-v0") { + return nil, nil + } k8sObjects := getKubernetesObjects(opap.K8SResources, rule.Match) + k8sObjects = reporthandling.RegoResourcesAggregator(rule, k8sObjects) ruleReport, err := opap.runOPAOnSingleRule(rule, k8sObjects) if err != nil { ruleReport.RuleStatus.Status = "failure" diff --git a/resultshandling/printer/summeryhelpers.go b/resultshandling/printer/summeryhelpers.go index cf7a4e43..65c50232 100644 --- a/resultshandling/printer/summeryhelpers.go +++ b/resultshandling/printer/summeryhelpers.go @@ -57,6 +57,13 @@ func ruleResultSummary(obj reporthandling.AlertObject) ([]WorkloadSummary, error resource = append(resource, *r) } + if obj.ExternalObjects != nil { + r, err := newWorkloadSummaryExternalObj(obj.ExternalObjects) + if err != nil { + return resource, err + } + resource = append(resource, *r) + } return resource, nil } @@ -73,3 +80,25 @@ func newWorkloadSummary(obj map[string]interface{}) (*WorkloadSummary, error) { r.Name = workload.GetName() return r, nil } + +func newWorkloadSummaryExternalObj(obj map[string]interface{}) (*WorkloadSummary, error) { + r := &WorkloadSummary{} + + relatedObjects := []workloadinterface.IMetadata{} + if relatedObjectslist, ok := obj["relatedObjects"].([]interface{}); ok { + for _, related := range relatedObjectslist { + if r, ok := related.(map[string]interface{}); ok { + o := workloadinterface.NewWorkloadObj(r) + relatedObjects = append(relatedObjects, o) + } + } + } + vector := workloadinterface.NewRegoResponseVectorObject(obj, relatedObjects) + if vector == nil { + return r, fmt.Errorf("error creating rego response vector obj") + } + r.Kind = vector.GetKind() + r.Namespace = vector.GetNamespace() + r.Name = vector.GetName() + return r, nil +}