diff --git a/cautils/scaninfo.go b/cautils/scaninfo.go index f8b7e7f7..d79de6a9 100644 --- a/cautils/scaninfo.go +++ b/cautils/scaninfo.go @@ -73,7 +73,7 @@ type ScanInfo struct { IncludeNamespaces string // DEPRECATED? InputPatterns []string // Yaml files input patterns Silent bool // Silent mode - Do not print progress logs - FailThreshold uint16 // Failure score threshold + FailThreshold float32 // Failure score threshold Submit bool // Submit results to Armo BE HostSensorEnabled BoolPtrFlag // Deploy ARMO K8s host sensor to collect data from certain controls HostSensorYamlPath string // Path to hostsensor file diff --git a/clihandler/cmd/control.go b/clihandler/cmd/control.go index 827fd4f8..15c7f083 100644 --- a/clihandler/cmd/control.go +++ b/clihandler/cmd/control.go @@ -40,8 +40,10 @@ var controlCmd = &cobra.Command{ if len(args) > 0 { controls := strings.Split(args[0], ",") if len(controls) > 1 { - if controls[1] == "" { - return fmt.Errorf("usage: ,") + for _, control := range controls { + if control == "" { + return fmt.Errorf("usage: ,") + } } } } else { diff --git a/clihandler/cmd/framework.go b/clihandler/cmd/framework.go index ad978473..9bfeb753 100644 --- a/clihandler/cmd/framework.go +++ b/clihandler/cmd/framework.go @@ -42,8 +42,10 @@ var frameworkCmd = &cobra.Command{ if len(args) > 0 { frameworks := strings.Split(args[0], ",") if len(frameworks) > 1 { - if frameworks[1] == "" { - return fmt.Errorf("usage: ,") + for _, framework := range frameworks { + if framework == "" { + return fmt.Errorf("usage: ,") + } } } } else { diff --git a/clihandler/cmd/scan.go b/clihandler/cmd/scan.go index d2aabd74..6e39856e 100644 --- a/clihandler/cmd/scan.go +++ b/clihandler/cmd/scan.go @@ -68,7 +68,7 @@ func init() { scanCmd.PersistentFlags().StringVar(&scanInfo.UseExceptions, "exceptions", "", "Path to an exceptions obj. If not set will download exceptions from ARMO management portal") scanCmd.PersistentFlags().StringVar(&scanInfo.UseArtifactsFrom, "use-artifacts-from", "", "Load artifacts from local directory. If not used will download them") scanCmd.PersistentFlags().StringVarP(&scanInfo.ExcludedNamespaces, "exclude-namespaces", "e", "", "Namespaces to exclude from scanning. Recommended: kube-system,kube-public") - scanCmd.PersistentFlags().Uint16VarP(&scanInfo.FailThreshold, "fail-threshold", "t", 100, "Failure threshold is the percent above which the command fails and returns exit code 1") + scanCmd.PersistentFlags().Float32VarP(&scanInfo.FailThreshold, "fail-threshold", "t", 100, "Failure threshold is the percent above which the command fails and returns exit code 1") scanCmd.PersistentFlags().StringVarP(&scanInfo.Format, "format", "f", "pretty-printer", `Output format. Supported formats: "pretty-printer","json","junit","prometheus","pdf"`) scanCmd.PersistentFlags().StringVar(&scanInfo.IncludeNamespaces, "include-namespaces", "", "scan specific namespaces. e.g: --include-namespaces ns-a,ns-b") scanCmd.PersistentFlags().BoolVarP(&scanInfo.Local, "keep-local", "", false, "If you do not want your Kubescape results reported to Armo backend. Use this flag if you ran with the '--submit' flag in the past and you do not want to submit your current scan results") diff --git a/clihandler/initcli.go b/clihandler/initcli.go index def16384..f7cfac5f 100644 --- a/clihandler/initcli.go +++ b/clihandler/initcli.go @@ -153,7 +153,7 @@ func ScanCliSetup(scanInfo *cautils.ScanInfo) error { interfaces.report.DisplayReportURL() if score > float32(scanInfo.FailThreshold) { - return fmt.Errorf("scan risk-score %.2f is above permitted threshold %d", score, scanInfo.FailThreshold) + return fmt.Errorf("scan risk-score %.2f is above permitted threshold %.2f", score, scanInfo.FailThreshold) } return nil diff --git a/docs/roadmap.md b/docs/roadmap.md index f5586f23..224e3fd7 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -1,19 +1,49 @@ # Kubescape project roadmap +## Planning principles -## Proposals -* [Container registry integration](/docs/proposals/container-image-vulnerability-adaptor.md) +Kubescape roadmap items are labeled based on where the feature is used and by their maturity. -## Planed features -* Image vulnerablity scanning based controls -* Assited remidiation (telling where/what to fix) -* Git integration for pull requests -* Integration with container registries -* Custom controls and regos -* API server configuration validation +The features serve different stages of the workflow of the users: +* development phase (writing Kubernetes manifests) - example: VS Code extension is used while editing YAMLs +* CI phase (integrating manifests to GIT repo) - example: GitHub action validating HELM charts on PRs +* delivery phase (deploying applications in Kubernetes) - example: running cluster scan after a new deployment +* monitoring phase (scanning application in Kubernetes) - example: Prometheus scraping the cluster security risk + +Items in Kubescape roadmap are split to 3 major groups based on the feature planning maturity: + +* Planning - we have tickets open for these issues with more or less clear vision of design +* Backlog - feature which were discussed at a high level but are not ready for development +* Wishlist - features we are dreaming of 😀 and want to push them gradually forward + + +## Planning 👷 +* **Integration with image registries**: we want to expand Kubescape to integrate with differnet image registries and read image vulnerability information from there. This will allow Kubescape to give contextual security information about vulnerabilities [Container registry integration](/docs/proposals/container-image-vulnerability-adaptor.md) +* **Kubescape as a microservice**: create a REST API for Kubescape so it can run constantly in a cluster and other components like Prometheus can scrape results +* **Kubescape CLI control over cluster operations**: add functionality to Kubescape CLI to trigger operations in Kubescape cluster components (example: trigger images scans and etc.) +* **Produce md/HTML reports**: create scan reports for different output formats +* **Git integration for pull requests**: create insightful GitHub actions for Kubescape + +## Backlog 📅 +* **JSON path for HELM charts**: today Kubescape can point to issues in the Kubernetes object, we want to develop this feature so Kubescape will be able to point to the misconfigured source file (HELM) +* **Create Kubescape HELM plugin** +* **Kubescape based admission controller**: Implement admission controller API for Kubescape microservice to enable users to use Kubescape rules as policies + +## Wishlist 💭 +* **Integrate with other Kubernetes CLI tools** use Kubescape as a YAML validator for `kubectl` and others. +* **Kubernetes audit log integration**: connect Kubescape to audit log stream to enable it to produce more contextual security information based on how the API service is used. +* **TUI for Kubescape**: interactive terminal based user interface which helps to analyze and fix issues +* **Scanning images with GO for vulnerabilities**: Images scanners cannot determine which packages were used to build Go executables and we want to scan them for vulnerabilities +* **Scanning Dockerfile-s for security best practices**: Scan image or Dockerfile to determine whether it is using security best practices (like root containers) +* **Custom controls and rules**: enable users to define their own Rego base rules +* **More CI/CD tool integration**: Jenkins and etc. 😀 + + +## Completed features 🎓 * Kubelet configuration validation - -## Completed features +* API server configuration validation +* Image vulnerability scanning based controls +* Assisted remediation (telling where/what to fix) * Integration with Prometheus * Confiugration of controls (customizing rules for a given environment) * Installation in the cluster for continous monitoring