90 Commits

Author SHA1 Message Date
Broder Peters
3f3681a4cd Add SkipPersistence flag to MetricsQueryParams in metrics endpoint
Signed-off-by: Broder Peters <broder.peters@protonmail.com>
2026-01-05 13:24:21 +01:00
Mujib Ahasan
cb7cca7b44 fix: log added and minor fixes applied
Signed-off-by: Mujib Ahasan <ahasanmujib8@gmail.com>
2025-12-09 22:07:29 +05:30
Mujib Ahasan
efbb8e8367 feature: skipPersistence request parameter added
Signed-off-by: Mujib Ahasan <ahasanmujib8@gmail.com>
2025-12-05 22:18:35 +05:30
copilot-swe-agent[bot]
c05427ff38 Remove KS_METRICS_FRAMEWORKS environment variable support
Co-authored-by: matthyx <20683409+matthyx@users.noreply.github.com>
Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>
2025-12-05 09:43:49 +01:00
copilot-swe-agent[bot]
cc7aae470f Fix typo in comment: fom -> from
Co-authored-by: matthyx <20683409+matthyx@users.noreply.github.com>
2025-12-04 13:47:52 +00:00
copilot-swe-agent[bot]
8d59a6074e Add frameworks query parameter to /v1/metrics endpoint
Co-authored-by: matthyx <20683409+matthyx@users.noreply.github.com>
2025-12-04 13:45:55 +00:00
copilot-swe-agent[bot]
1f7dd6e5f5 Fix incorrect comment about default output format
Co-authored-by: matthyx <20683409+matthyx@users.noreply.github.com>
2025-12-04 13:31:52 +00:00
copilot-swe-agent[bot]
bf5ca3c1f0 Add KS_METRICS_FRAMEWORKS env var to allow selecting specific frameworks
Co-authored-by: matthyx <20683409+matthyx@users.noreply.github.com>
2025-12-04 13:30:11 +00:00
copilot-swe-agent[bot]
ba78527c80 Enable ScanAll for prometheus metrics to include all frameworks including CIS
Co-authored-by: matthyx <20683409+matthyx@users.noreply.github.com>
2025-12-03 16:32:43 +00:00
Matthias Bertschy
8deff34d12 always save WorkloadConfigurationScanResultSummaries
Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>
2025-11-28 16:45:23 +01:00
Matthias Bertschy
6ed3e408be check scanInfo.Submit in HandleResults to not submit by default
Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>
2025-06-30 08:16:41 +02:00
Ruslan Semagin
fe7dad4560 Refactor: propagate context from main to avoid redundant context creation
- Introduced a single context in main() to handle interrupt signals (os.Interrupt, syscall.SIGTERM).
- Removed repetitive context creation in the program by reusing the propagated context.
- Improved code readability and maintainability by centralizing context management.
- Ensured consistent handling of graceful shutdown across the program.

Signed-off-by: Ruslan Semagin <pixel.365.24@gmail.com>
2025-02-11 19:52:48 +03:00
Matthias Bertschy
815c87b532 implement reviews from DW
Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>
2025-02-07 12:16:35 +01:00
Sanskarzz
82120f9d31 added support for exception rules
Signed-off-by: Sanskarzz <sanskar.gur@gmail.com>
2025-02-07 12:15:56 +01:00
Matthias Bertschy
70a9380966 fix go imports
Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>
2025-01-09 12:14:56 +01:00
Matthias Bertschy
600f19406e enable offline mode with env KS_OFFLINE
Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>
2025-01-09 10:33:19 +01:00
Ben
4f3ef49f99 Implementing capability to print out the "print" statements of the rego
Signed-off-by: Ben <ben@armosec.io>
2024-11-20 00:10:18 +02:00
ttimonen
7507f58306 refactor(handler) Simplify the scan http handler concurrency.
In particular,
Replace scanResponseChan struct with a reply channel in req.
This removes one chokepoint with tracking a map of channel with a mutex wrapping by not sharing data across different requests and
 makes it easier to reason about the correctness of the behavior.

Other changes are mostly cosmetic to group your operations related to
the primitives you are operating on, reducing the average lifetime of
a local variable (matters mostly for humans; compilers are very good at this nowadays).

Also this is net benefical by reducing LOCs by 45.

Signed-off-by: ttimonen <toni.timonen@iki.fi>
2024-07-07 22:44:35 +00:00
ttimonen
48ad56a2ef Implement unit-test for scan handler.
It plays wtih channels and goroutines, so having it
behave correctly is not completely trivial and test
worthy.

Signed-off-by: ttimonen <toni.timonen@iki.fi>
2024-07-07 22:40:58 +00:00
Matthias Bertschy
2d77ea7b62 use pager.EachListItem to filter parented resources
Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>
2024-07-03 16:41:12 +02:00
Matthias Bertschy
2429d2b89d move versioncheck to kubescape/backend
Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>
2024-03-06 14:44:37 +01:00
David Wertenteil
3b2feca0dd Update flags (#1462)
* add access key flag to the scan command

Signed-off-by: David Wertenteil <dwertent@armosec.io>

* support triggering ns

Signed-off-by: David Wertenteil <dwertent@armosec.io>

* Fixed json keys

Signed-off-by: David Wertenteil <dwertent@armosec.io>

* get k8s config

Signed-off-by: David Wertenteil <dwertent@armosec.io>

---------

Signed-off-by: David Wertenteil <dwertent@armosec.io>
2023-10-31 15:41:18 +02:00
David Wertenteil
3e2314a269 Bump v3 (#1449)
* bump version

Signed-off-by: David Wertenteil <dwertent@armosec.io>

* change default view

Signed-off-by: David Wertenteil <dwertent@armosec.io>

* fixed tests

Signed-off-by: David Wertenteil <dwertent@armosec.io>

* fixed go mod

Signed-off-by: David Wertenteil <dwertent@armosec.io>

---------

Signed-off-by: David Wertenteil <dwertent@armosec.io>
2023-10-22 17:43:51 +03:00
rcohencyberarmor
052c042dac Support backend access key (#1404)
Support backend access key

Signed-off-by: Amir Malka <amirm@armosec.io>
2023-10-22 15:10:08 +03:00
Amir Malka
8257e31232 Save scan results in storage and support scanning a deleted resource (#1376)
* store scan results in storage

Signed-off-by: Amir Malka <amirm@armosec.io>

* store scan results in storage

Signed-off-by: Amir Malka <amirm@armosec.io>

* save resources in their namespaces, load namespace from env var, extend the config obj

Signed-off-by: Amir Malka <amirm@armosec.io>

* setting context name

Signed-off-by: Amir Malka <amirm@armosec.io>

* updated k8s-interface

Signed-off-by: Amir Malka <amirm@armosec.io>

* scanning a deleted resource

Signed-off-by: Amir Malka <amirm@armosec.io>

* cr changes

Signed-off-by: Amir Malka <amirm@armosec.io>

* cr changes

Signed-off-by: Amir Malka <amirm@armosec.io>

* fix

Signed-off-by: Amir Malka <amirm@armosec.io>

* remove unused constants

Signed-off-by: Amir Malka <amirm@armosec.io>

* use t.Setenv

Signed-off-by: Amir Malka <amirm@armosec.io>

* added tests for rbac triplet slugs

Signed-off-by: Amir Malka <amirm@armosec.io>

* updated namespace logic

Signed-off-by: Amir Malka <amirm@armosec.io>

* fix test

Signed-off-by: Amir Malka <amirm@armosec.io>

---------

Signed-off-by: Amir Malka <amirm@armosec.io>
2023-09-14 10:03:36 +03:00
Amir Malka
4372ca320a fix setting context name in httphandler
Signed-off-by: Amir Malka <amirm@armosec.io>
2023-09-10 16:16:01 +03:00
Daniel Grunberger
26c47d501c move context flag to root (#1367)
* move context flag to root

Signed-off-by: Daniel Grunberger <danielgrunberger@armosec.io>

* rm from httphandler

Signed-off-by: Daniel Grunberger <danielgrunberger@armosec.io>

---------

Signed-off-by: Daniel Grunberger <danielgrunberger@armosec.io>
Co-authored-by: Daniel Grunberger <danielgrunberger@armosec.io>
2023-09-03 10:39:15 +03:00
Amir Malka
150967eae8 Refactor backend integration (#1355)
* refactor BE integration

Signed-off-by: Amir Malka <amirm@armosec.io>
2023-08-23 15:36:08 +03:00
David Wertenteil
cf08daf7fb scan per namespace (#1337)
* scan per namespace

Signed-off-by: David Wertenteil <dwertent@armosec.io>

* disable unit test

Signed-off-by: David Wertenteil <dwertent@armosec.io>

* Adding build image wf

Signed-off-by: David Wertenteil <dwertent@armosec.io>

* removing unused channels

Signed-off-by: David Wertenteil <dwertent@armosec.io>

* adding scopes

Signed-off-by: David Wertenteil <dwertent@armosec.io>

* update

Signed-off-by: David Wertenteil <dwertent@armosec.io>

* fixed cluster size

Signed-off-by: David Wertenteil <dwertent@armosec.io>

* update rbac deps

Signed-off-by: David Wertenteil <dwertent@armosec.io>

* aggregate resources

Signed-off-by: David Wertenteil <dwertent@armosec.io>

* Delete build-image.yaml

Signed-off-by: David Wertenteil <dwertent@armosec.io>

* adding scan image logs

Signed-off-by: David Wertenteil <dwertent@armosec.io>

* update cmd message

Signed-off-by: David Wertenteil <dwertent@armosec.io>

* update logs

Signed-off-by: David Wertenteil <dwertent@armosec.io>

---------

Signed-off-by: David Wertenteil <dwertent@armosec.io>
2023-08-08 10:47:15 +03:00
Amir Malka
0c019819ff Scanning a single resource (#1300)
* add cmd

Signed-off-by: Daniel Grunberger <danielgrunberger@armosec.io>

* support single workload scan

Signed-off-by: Amir Malka <amirm@armosec.io>

* fix conflict

Signed-off-by: Amir Malka <amirm@armosec.io>

* added unit tests

Signed-off-by: Amir Malka <amirm@armosec.io>

* added unit tests

Signed-off-by: Amir Malka <amirm@armosec.io>

* more refactoring

Signed-off-by: Amir Malka <amirm@armosec.io>

* add scanned workload reference to opasessionobj

Signed-off-by: Amir Malka <amirm@armosec.io>

* fix GetWorkloadParentKind

Signed-off-by: Amir Malka <amirm@armosec.io>

* remove namespace argument from pullSingleResource, using field selector instead

Signed-off-by: Amir Malka <amirm@armosec.io>

* removed designators (unused) field from PolicyIdentifier, and designators argument from GetResources function

Signed-off-by: Amir Malka <amirm@armosec.io>

* fix tests

Signed-off-by: Amir Malka <amirm@armosec.io>

* use ScanObject instead of workload identifier

Signed-off-by: Amir Malka <amirm@armosec.io>

* refactor logic after CR

Signed-off-by: Amir Malka <amirm@armosec.io>

---------

Signed-off-by: Daniel Grunberger <danielgrunberger@armosec.io>
Signed-off-by: Amir Malka <amirm@armosec.io>
Co-authored-by: Daniel Grunberger <danielgrunberger@armosec.io>
2023-08-01 14:07:31 +03:00
YiscahLevySilas1
d44746cb85 allow adding a fw name when running all (#1286)
* allow adding a fw name when running all

Signed-off-by: YiscahLevySilas1 <yiscahls@armosec.io>

clean code

Signed-off-by: YiscahLevySilas1 <yiscahls@armosec.io>

* fix following review

Signed-off-by: YiscahLevySilas1 <yiscahls@armosec.io>

---------

Signed-off-by: YiscahLevySilas1 <yiscahls@armosec.io>
2023-07-20 14:07:38 +03:00
David Wertenteil
211ee487b3 core(metrics api): Update API default behavior (#1250)
* scan default frameworks

Signed-off-by: David Wertenteil <dwertent@armosec.io>

* wip: update context

Signed-off-by: David Wertenteil <dwertent@armosec.io>

* do not trigger host scan

Signed-off-by: David Wertenteil <dwertent@armosec.io>

* adding unitests

Signed-off-by: David Wertenteil <dwertent@armosec.io>

---------

Signed-off-by: David Wertenteil <dwertent@armosec.io>
2023-06-04 15:12:31 +03:00
Matthias Bertschy
2cddc4b395 start with a new context, extracting span from request
Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>
2023-05-15 14:55:46 +02:00
YiscahLevySilas1
95e88f8581 add compliance-threshold, deprecate fail-threshold (#1197)
* add compliance-threshold, deprecate fail-threshold

Signed-off-by: YiscahLevySilas1 <yiscahls@armosec.io>

* update opa-utils version

Signed-off-by: YiscahLevySilas1 <yiscahls@armosec.io>

* update opa-utils version for fix in compliance score

Signed-off-by: YiscahLevySilas1 <yiscahls@armosec.io>

---------

Signed-off-by: YiscahLevySilas1 <yiscahls@armosec.io>
2023-04-24 15:33:30 +03:00
David Wertenteil
b4180b34e7 core(logs): Enhance logs (#1158)
* adding ks version

Signed-off-by: David Wertenteil <dwertent@armosec.io>

* Initialize scanInfo

Signed-off-by: David Wertenteil <dwertent@armosec.io>

* print if logger level is lower than warning

Signed-off-by: David Wertenteil <dwertent@armosec.io>

* wip: scan default frameworks when scanning files

Signed-off-by: David Wertenteil <dwertent@armosec.io>

* change print to log

Signed-off-by: David Wertenteil <dwertent@armosec.io>

* wip: Add end-line after last log

Signed-off-by: David Wertenteil <dwertent@armosec.io>

* wip: silent spinner when logger is warn

Signed-off-by: David Wertenteil <dwertent@armosec.io>

---------

Signed-off-by: David Wertenteil <dwertent@armosec.io>
2023-03-20 17:49:51 +02:00
David Wertenteil
28531859f3 Signed-off-by: David Wertenteil <dwertent@armosec.io>
Signed-off-by: David Wertenteil <dwertent@armosec.io>
2023-03-15 21:26:10 +02:00
David Wertenteil
ec4a098b1c replace error by warning
Signed-off-by: David Wertenteil <dwertent@armosec.io>
2023-03-15 17:17:29 +02:00
David Wertenteil
a29fe367dc Added context to HandleResults
Signed-off-by: David Wertenteil <dwertent@armosec.io>
2023-03-15 16:58:02 +02:00
Matthias Bertschy
1004902f51 initialize context in Prometheus handler
Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>
2023-03-09 14:05:26 +01:00
David Wertenteil
6cc5116999 Loading kubeconfig name from env when running ms (#1089)
Signed-off-by: David Wertenteil <dwertent@armosec.io>
2023-02-09 09:32:13 +02:00
David Wertenteil
7706c1264c removed unwnated span (#1088)
Signed-off-by: David Wertenteil <dwertent@armosec.io>
2023-02-08 18:47:01 +02:00
Matthias Bertschy
160ac0db7c add otel with uptrace client
Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>
2023-01-31 08:06:33 +01:00
dingfei
07fa3b4589 bug fix of cannot read local artifacts 2023-01-06 17:28:36 +08:00
kooomix
cf87c2d30b Fixed test 2022-12-21 19:25:22 +02:00
kooomix
ca5b3e626b test fix 2022-12-14 14:08:32 +02:00
Marco Kilchhofer
4fef6200f8 fix: filepath.Dir requires trailing slash
Signed-off-by: Marco Kilchhofer <mkilchhofer@users.noreply.github.com>
2022-11-22 21:26:37 +01:00
Matthias Bertschy
746e060402 remove deprecated ioutil package 2022-11-10 09:58:07 +01:00
David Wertenteil
bd970eff83 update to kubescape org 2022-08-22 18:22:28 +03:00
David Wertenteil
ad91178ef7 updated dependencies pkgs 2022-08-18 17:41:03 +03:00
David Wertenteil
eab0d6650e -tags=Merge remote-tracking branch 'armosec/dev' 2022-08-03 10:44:35 +03:00