From 1f47223918ca512110ba4b93b16b8d19661e6b32 Mon Sep 17 00:00:00 2001 From: shm12 Date: Sun, 23 Oct 2022 10:46:44 +0300 Subject: [PATCH 1/8] Fixed host-sensor control plane info collecting --- core/pkg/hostsensorutils/hostsensorgetfrompod.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/pkg/hostsensorutils/hostsensorgetfrompod.go b/core/pkg/hostsensorutils/hostsensorgetfrompod.go index d6b8ff0d..a8074261 100644 --- a/core/pkg/hostsensorutils/hostsensorgetfrompod.go +++ b/core/pkg/hostsensorutils/hostsensorgetfrompod.go @@ -278,7 +278,7 @@ func (hsh *HostSensorHandler) CollectResources() ([]hostsensor.HostSensorDataEnv // GetControlPlaneInfo kcData, err = hsh.GetControlPlaneInfo() if err != nil { - addInfoToMap(KubeProxyInfo, infoMap, err) + addInfoToMap(ControlPlaneInfo, infoMap, err) logger.L().Warning(err.Error()) } if len(kcData) > 0 { From 3be54ca484ea67e35c54c6f0c4cb9ed5a4d9e2e1 Mon Sep 17 00:00:00 2001 From: David Wertenteil Date: Sun, 23 Oct 2022 12:35:54 +0300 Subject: [PATCH 2/8] fixed typo --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 6f3aaea0..a9a49874 100644 --- a/README.md +++ b/README.md @@ -194,7 +194,7 @@ kubescape scan framework mitre --submit kubescape scan control "Privileged container" ``` -#### Scan using an anternative kubeconfig file +#### Scan using an alternative kubeconfig file ``` kubescape scan --kubeconfig cluster.conf ``` From c296666d8eb6aa16985cffe2a9c081187f09397b Mon Sep 17 00:00:00 2001 From: David Wertenteil Date: Sun, 23 Oct 2022 16:00:10 +0300 Subject: [PATCH 3/8] removed path from dockerfile --- build/Dockerfile | 1 - 1 file changed, 1 deletion(-) diff --git a/build/Dockerfile b/build/Dockerfile index 768267d7..8b5c144b 100644 --- a/build/Dockerfile +++ b/build/Dockerfile @@ -9,7 +9,6 @@ ENV CLIENT=$client ENV GO111MODULE= ENV CGO_ENABLED=1 -ENV PATH=$PATH:/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin # Install required python/pip ENV PYTHONUNBUFFERED=1 From 8f1da32001bbec335bcfb93076a527703c8c71a6 Mon Sep 17 00:00:00 2001 From: Moshe Rappaport Date: Sun, 23 Oct 2022 20:29:25 +0300 Subject: [PATCH 4/8] Store default URLs in cache (#875) --- core/cautils/customerloader.go | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/core/cautils/customerloader.go b/core/cautils/customerloader.go index 9f29b3db..733fb216 100644 --- a/core/cautils/customerloader.go +++ b/core/cautils/customerloader.go @@ -126,15 +126,23 @@ func NewLocalConfig( lc.backendAPI.SetSecretKey(lc.configObj.SecretKey) if lc.configObj.CloudAPIURL != "" { lc.backendAPI.SetCloudAPIURL(lc.configObj.CloudAPIURL) + } else { + lc.configObj.CloudAPIURL = lc.backendAPI.GetCloudAPIURL() } if lc.configObj.CloudAuthURL != "" { lc.backendAPI.SetCloudAuthURL(lc.configObj.CloudAuthURL) + } else { + lc.configObj.CloudAuthURL = lc.backendAPI.GetCloudAuthURL() } if lc.configObj.CloudReportURL != "" { lc.backendAPI.SetCloudReportURL(lc.configObj.CloudReportURL) + } else { + lc.configObj.CloudReportURL = lc.backendAPI.GetCloudReportURL() } if lc.configObj.CloudUIURL != "" { lc.backendAPI.SetCloudUIURL(lc.configObj.CloudUIURL) + } else { + lc.configObj.CloudUIURL = lc.backendAPI.GetCloudUIURL() } logger.L().Debug("Kubescape Cloud URLs", helpers.String("api", lc.backendAPI.GetCloudAPIURL()), helpers.String("auth", lc.backendAPI.GetCloudAuthURL()), helpers.String("report", lc.backendAPI.GetCloudReportURL()), helpers.String("UI", lc.backendAPI.GetCloudUIURL())) @@ -260,15 +268,23 @@ func NewClusterConfig(k8s *k8sinterface.KubernetesApi, backendAPI getter.IBacken c.backendAPI.SetSecretKey(c.configObj.SecretKey) if c.configObj.CloudAPIURL != "" { c.backendAPI.SetCloudAPIURL(c.configObj.CloudAPIURL) + } else { + c.configObj.CloudAPIURL = c.backendAPI.GetCloudAPIURL() } if c.configObj.CloudAuthURL != "" { c.backendAPI.SetCloudAuthURL(c.configObj.CloudAuthURL) + } else { + c.configObj.CloudAuthURL = c.backendAPI.GetCloudAuthURL() } if c.configObj.CloudReportURL != "" { c.backendAPI.SetCloudReportURL(c.configObj.CloudReportURL) + } else { + c.configObj.CloudReportURL = c.backendAPI.GetCloudReportURL() } if c.configObj.CloudUIURL != "" { c.backendAPI.SetCloudUIURL(c.configObj.CloudUIURL) + } else { + c.configObj.CloudUIURL = c.backendAPI.GetCloudUIURL() } logger.L().Debug("Kubescape Cloud URLs", helpers.String("api", c.backendAPI.GetCloudAPIURL()), helpers.String("auth", c.backendAPI.GetCloudAuthURL()), helpers.String("report", c.backendAPI.GetCloudReportURL()), helpers.String("UI", c.backendAPI.GetCloudUIURL())) From 1b2242330c8d9a70132be6d250856de3dfb9044f Mon Sep 17 00:00:00 2001 From: David Wertenteil Date: Sun, 23 Oct 2022 20:35:13 +0300 Subject: [PATCH 5/8] comment out image release --- .github/workflows/build.yaml | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index afa64862..6fb9d10f 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -76,14 +76,14 @@ jobs: asset_name: kubescape-${{ matrix.os }}-sha256 asset_content_type: application/octet-stream - publish-image: - if: ${{ github.repository == 'kubescape/kubescape' }} # TODO - uses: ./.github/workflows/build-image.yaml - needs: create-release - with: - client: "image-release" - image_name: "quay.io/${{ github.repository_owner }}/kubescape" - image_tag: "v2.0.${{ github.run_number }}" - support_platforms: true - cosign: true - secrets: inherit + # publish-image: + # if: ${{ github.repository == 'kubescape/kubescape' }} # TODO + # uses: ./.github/workflows/build-image.yaml + # needs: create-release + # with: + # client: "image-release" + # image_name: "quay.io/${{ github.repository_owner }}/kubescape" + # image_tag: "v2.0.${{ github.run_number }}" + # support_platforms: true + # cosign: true + # secrets: inherit From e5fb14138e6c0e78a7f2713b5ab1096e8b8b15ec Mon Sep 17 00:00:00 2001 From: David Wertenteil Date: Sun, 23 Oct 2022 20:48:36 +0300 Subject: [PATCH 6/8] adding github token --- .github/workflows/build.yaml | 2 ++ .github/workflows/test.yaml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 6fb9d10f..87b68b18 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -25,6 +25,8 @@ jobs: name: Build and publish artifacts needs: create-release runs-on: ${{ matrix.os }} + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} strategy: matrix: os: [ubuntu-latest, macos-latest, windows-latest] diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 696a9dc9..9b6d04f3 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -15,6 +15,8 @@ jobs: build: name: Create cross-platform build runs-on: ${{ matrix.os }} + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} strategy: matrix: os: [ubuntu-latest, macos-latest, windows-latest] From 22521b7159678b8347ba5bcf6fb4abd2775bc1c2 Mon Sep 17 00:00:00 2001 From: David Wertenteil Date: Mon, 24 Oct 2022 11:39:37 +0300 Subject: [PATCH 7/8] use os path join in build file --- build.py | 11 ++++++----- core/pkg/resourcehandler/k8sresources.go | 2 +- httphandler/build.py | 12 ++++++------ 3 files changed, 13 insertions(+), 12 deletions(-) diff --git a/build.py b/build.py index bf33d395..c3329112 100644 --- a/build.py +++ b/build.py @@ -14,14 +14,15 @@ def check_status(status, msg): def get_build_dir(): current_platform = platform.system() - build_dir = "./build/" + build_dir = "" - if current_platform == "Windows": build_dir += "windows-latest" - elif current_platform == "Linux": build_dir += "ubuntu-latest" - elif current_platform == "Darwin": build_dir += "macos-latest" + if current_platform == "Windows": build_dir = "windows-latest" + elif current_platform == "Linux": build_dir = "ubuntu-latest" + elif current_platform == "Darwin": build_dir = "macos-latest" else: raise OSError("Platform %s is not supported!" % (current_platform)) - return build_dir + return os.path.join("build", build_dir) + def get_package_name(): package_name = "kubescape" diff --git a/core/pkg/resourcehandler/k8sresources.go b/core/pkg/resourcehandler/k8sresources.go index a2b322ab..70e4f9a7 100644 --- a/core/pkg/resourcehandler/k8sresources.go +++ b/core/pkg/resourcehandler/k8sresources.go @@ -84,7 +84,7 @@ func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessio imgVulnResources := cautils.MapImageVulnResources(ksResourceMap) // check that controls use image vulnerability resources - if false { //len(imgVulnResources) > 0 { + if len(imgVulnResources) > 0 { logger.L().Info("Requesting images vulnerabilities results") cautils.StartSpinner() if err := k8sHandler.registryAdaptors.collectImagesVulnerabilities(k8sResourcesMap, allResources, ksResourceMap); err != nil { diff --git a/httphandler/build.py b/httphandler/build.py index 7c61397d..ee516c1c 100644 --- a/httphandler/build.py +++ b/httphandler/build.py @@ -14,18 +14,18 @@ def check_status(status, msg): def get_build_dir(): current_platform = platform.system() - build_dir = "build/" + build_dir = "" - if current_platform == "Windows": build_dir += "windows-latest" - elif current_platform == "Linux": build_dir += "ubuntu-latest" - elif current_platform == "Darwin": build_dir += "macos-latest" + if current_platform == "Windows": build_dir = "windows-latest" + elif current_platform == "Linux": build_dir = "ubuntu-latest" + elif current_platform == "Darwin": build_dir = "macos-latest" else: raise OSError("Platform %s is not supported!" % (current_platform)) - return build_dir + return os.path.join("build", build_dir) def get_package_name(): package_name = "kubescape" - + # TODO: if platform.system() == "Windows": packageName += ".exe" - we should find all places were we access the windows executable before changing the extension return package_name From bfbd278e7cc21b7c11df642023296bb16c60cf0f Mon Sep 17 00:00:00 2001 From: Amir Malka Date: Tue, 25 Oct 2022 18:26:07 +0300 Subject: [PATCH 8/8] commented out tests which made actual http calls --- core/cautils/scaninfo_test.go | 5 +++-- core/pkg/resourcehandler/repositoryscanner_test.go | 5 +++++ core/pkg/resourcehandler/urlloader_test.go | 7 +++---- 3 files changed, 11 insertions(+), 6 deletions(-) diff --git a/core/cautils/scaninfo_test.go b/core/cautils/scaninfo_test.go index c8705879..a825fcb8 100644 --- a/core/cautils/scaninfo_test.go +++ b/core/cautils/scaninfo_test.go @@ -18,7 +18,8 @@ func TestSetContextMetadata(t *testing.T) { assert.Nil(t, ctx.HelmContextMetadata) assert.Nil(t, ctx.RepoContextMetadata) } - { + // TODO: tests were commented out due to actual http calls ; http calls should be mocked. + /*{ ctx := reporthandlingv2.ContextMetadata{} setContextMetadata(&ctx, "https://github.com/kubescape/kubescape") @@ -31,7 +32,7 @@ func TestSetContextMetadata(t *testing.T) { assert.Equal(t, "kubescape", ctx.RepoContextMetadata.Repo) assert.Equal(t, "kubescape", ctx.RepoContextMetadata.Owner) assert.Equal(t, "master", ctx.RepoContextMetadata.Branch) - } + }*/ } func TestGetHostname(t *testing.T) { diff --git a/core/pkg/resourcehandler/repositoryscanner_test.go b/core/pkg/resourcehandler/repositoryscanner_test.go index 8470f92d..f9ce633b 100644 --- a/core/pkg/resourcehandler/repositoryscanner_test.go +++ b/core/pkg/resourcehandler/repositoryscanner_test.go @@ -13,6 +13,10 @@ var ( urlD = "https://raw.githubusercontent.com/kubescape/kubescape/master/examples/online-boutique/adservice.yaml" ) +/* + +TODO: tests were commented out due to actual http calls ; http calls should be mocked. + func TestScanRepository(t *testing.T) { { files, err := ScanRepository(urlA, "") @@ -112,6 +116,7 @@ func TestGithubGetYamlFromTree(t *testing.T) { assert.Equal(t, 12, len(files)) } } +*/ func TestGithubParse(t *testing.T) { { diff --git a/core/pkg/resourcehandler/urlloader_test.go b/core/pkg/resourcehandler/urlloader_test.go index aa7356c8..1f500197 100644 --- a/core/pkg/resourcehandler/urlloader_test.go +++ b/core/pkg/resourcehandler/urlloader_test.go @@ -2,12 +2,11 @@ package resourcehandler import ( "testing" - - "github.com/stretchr/testify/assert" ) func TestLoadResourcesFromUrl(t *testing.T) { - { + //TODO: tests were commented out due to actual http calls ; http calls should be mocked. + /*{ workloads, err := loadResourcesFromUrl([]string{"https://github.com/kubescape/kubescape/tree/master/examples/online-boutique"}) assert.NoError(t, err) assert.Equal(t, 12, len(workloads)) @@ -62,5 +61,5 @@ func TestLoadResourcesFromUrl(t *testing.T) { assert.Equal(t, "/v1//Service/adservice", w[1].GetID()) } } - } + }*/ }