Merge pull request #203 from armosec/cluster-name-issue

adopt cluster name (HotFix)

.github/workflows/build.yaml

@@ -46,12 +46,6 @@ jobs:
           CGO_ENABLED: 0
         run: python3 --version && python3 build.py
       
-      - name: Smoke Testing
-        env:
-          RELEASE: v1.0.${{ github.run_number }} 
-          KUBESCAPE_SKIP_UPDATE_CHECK: "true"
-        run: python3 smoke_testing/init.py ${PWD}/build/${{ matrix.os }}/kubescape
-
       - name: Upload Release binaries
         id: upload-release-asset
         uses: actions/upload-release-asset@v1

.github/workflows/build_dev.yaml

@@ -30,12 +30,6 @@ jobs:
           CGO_ENABLED: 0
         run: python3 --version && python3 build.py
       
-      - name: Smoke Testing
-        env:
-          RELEASE: v1.0.${{ github.run_number }}
-          KUBESCAPE_SKIP_UPDATE_CHECK: "true"
-        run: python3 smoke_testing/init.py ${PWD}/build/${{ matrix.os }}/kubescape
-
       - name: Upload build artifacts 
         uses: actions/upload-artifact@v2
         with:

.gitignore

@@ -2,5 +2,4 @@
 *kubescape*
 *debug*
 *vender*
-*.pyc*
 .idea

README.md

@@ -69,31 +69,31 @@ Set-ExecutionPolicy RemoteSigned -scope CurrentUser
 
 ## Flags
 
-| flag                        | default                   | description                                                                                                                                                                                                                                                                                                          | options                          |
-|-----------------------------|---------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------|
-| `-e`/`--exclude-namespaces` | Scan all namespaces       | Namespaces to exclude from scanning. Recommended to exclude `kube-system` and `kube-public` namespaces                                                                                                                                                                                                               |                                              |
-| `-s`/`--silent`             | Display progress messages | Silent progress messages                                                                                                                                                                                                                                                                                             |                                              |
-| `-t`/`--fail-threshold`     | `0` (do not fail)         | fail command (return exit code 1) if result bellow threshold                                                                                                                                                                                                                                                         | `0` -> `100`                                 |
-| `-f`/`--format`             | `pretty-printer`          | Output format                                                                                                                                                                                                                                                                                                        | `pretty-printer`/`json`/`junit`/`prometheus` |
-| `-o`/`--output`             | print to stdout           | Save scan result in file                                                                                                                                                                                                                                                                                             |                                              |
-| `--use-from`                |                           | Load local framework object from specified path. If not used will download latest                                                                                                                                                                                                                                    |                                              |
-| `--use-default`             | `false`                   | Load local framework object from default path. If not used will download latest                                                                                                                                                                                                                                      | `true`/`false`                               |
-| `--exceptions`              |                           | Path to an [exceptions obj](examples/exceptions.json). If not set will download exceptions from Armo management portal                                                                                                                                                                                               |                                              |
-| `--submit`                  | `false`                   | If set, Kubescape will send the scan results to Armo management portal where you can see the results in a user-friendly UI, choose your preferred compliance framework, check risk results history and trends, manage exceptions, get remediation recommendations and much more. By default the results are not sent | `true`/`false`                               |
-| `--keep-local`              | `false`                   | Kubescape will not send scan results to Armo management portal. Use this flag if you ran with the `--submit` flag in the past and you do not want to submit your current scan results                                                                                                                                | `true`/`false`                               |
-| `--account`                 |                           | Armo portal account ID. Default will load account ID from configMap or config file                                                                                                                                                                                                                                   |                                              |
+| flag |  default | description | options |
+| --- | --- | --- | --- |
+| `-e`/`--exclude-namespaces` | Scan all namespaces | Namespaces to exclude from scanning. Recommended to exclude `kube-system` and `kube-public` namespaces |
+| `-s`/`--silent` | Display progress messages | Silent progress messages |
+| `-t`/`--fail-threshold` | `0` (do not fail) | fail command (return exit code 1) if result bellow threshold| `0` -> `100` |
+| `-f`/`--format` | `pretty-printer` | Output format | `pretty-printer`/`json`/`junit` |
+| `-o`/`--output` | print to stdout | Save scan result in file |
+| `--use-from` | | Load local framework object from specified path. If not used will download latest |
+| `--use-default` | `false` | Load local framework object from default path. If not used will download latest | `true`/`false` |
+| `--exceptions` | | Path to an [exceptions obj](examples/exceptions.json). If not set will download exceptions from Armo management portal |
+| `--submit` | `false` | If set, Kubescape will send the scan results to Armo management portal where you can see the results in a user-friendly UI, choose your preferred compliance framework, check risk results history and trends, manage exceptions, get remediation recommendations and much more. By default the results are not sent | `true`/`false`|
+| `--keep-local` | `false` | Kubescape will not send scan results to Armo management portal. Use this flag if you ran with the `--submit` flag in the past and you do not want to submit your current scan results | `true`/`false`|
+| `--account` | | Armo portal account ID. Default will load account ID from configMap or config file | |
 
 ## Usage & Examples
 
 ### Examples
 
-* Scan a running Kubernetes cluster with [`nsa`](https://www.nsa.gov/News-Features/Feature-Stories/Article-View/Article/2716980/nsa-cisa-release-kubernetes-hardening-guidance/) framework and submit results to the [Kubescape SaaS version](https://portal.armo.cloud/)
+* Scan a running Kubernetes cluster with [`nsa`](https://www.nsa.gov/News-Features/Feature-Stories/Article-View/Article/2716980/nsa-cisa-release-kubernetes-hardening-guidance/) framework and submit results to [ARMO portal](https://portal.armo.cloud/)
 ```
 kubescape scan framework nsa --submit
 ```
 
 
-* Scan a running Kubernetes cluster with [`MITRE ATT&CK®`](https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/) framework and submit results to the [Kubescape SaaS version](https://portal.armo.cloud/)
+* Scan a running Kubernetes cluster with [`MITRE ATT&CK®`](https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/) framework and submit results to [ARMO portal](https://portal.armo.cloud/)
 ```
 kubescape scan framework mitre --submit
 ```
@@ -125,20 +125,11 @@ kubescape scan framework nsa --exclude-namespaces kube-system,kube-public --form
 kubescape scan framework nsa --exclude-namespaces kube-system,kube-public --format junit --output results.xml
 ```
 
-* Output in `prometheus` metrics format
-```
-kubescape scan framework nsa --exclude-namespaces kube-system,kube-public --format prometheus
-```
-
 * Scan with exceptions, objects with exceptions will be presented as `exclude` and not `fail`
 ```
 kubescape scan framework nsa --exceptions examples/exceptions.json
 ```
 
-### CronJob Scan Periodically 
-
-For setting up a cronJob please follow the [instructions](examples/cronJob-support/README.md) 
-
 ### Helm Support
 
 * Render the helm chart using [`helm template`](https://helm.sh/docs/helm/helm_template/) and pass to stdout

build.py

@@ -60,6 +60,9 @@ def main():
     status = subprocess.call(["go", "build", "-o", "%s/%s" % (buildDir, packageName), "-ldflags" ,ldflags])
     checkStatus(status, "Failed to build kubescape")
     
+    test_cli_prints(buildDir,packageName)
+
+
     sha1 = hashlib.sha1()
     with open(buildDir + "/" + packageName, "rb") as kube:
         sha1.update(kube.read())
@@ -67,7 +70,13 @@ def main():
             kube_sha.write(sha1.hexdigest())
 
     print("Build Done")
- 
- 
+
+def test_cli_prints(buildDir,packageName):
+    bin_cli = os.path.abspath(os.path.join(buildDir,packageName))
+
+    print(f"testing CLI prints on {bin_cli}")
+    status = str(subprocess.check_output([bin_cli, "-h"]))
+    assert "download" in status, "download is missing: " + status    
+
 if __name__ == "__main__":
     main()

cautils/customerloader.go

@@ -129,7 +129,7 @@ func (c *EmptyConfig) GetCustomerGUID() string                { return "" }
 func (c *EmptyConfig) GetK8sAPI() *k8sinterface.KubernetesApi { return nil } // TODO: return mock obj
 func (c *EmptyConfig) GetDefaultNS() string                   { return k8sinterface.GetDefaultNamespace() }
 func (c *EmptyConfig) GetBackendAPI() getter.IBackend         { return nil } // TODO: return mock obj
-func (c *EmptyConfig) GetClusterName() string                 { return adoptClusterName(k8sinterface.GetClusterName()) }
+func (c *EmptyConfig) GetClusterName() string                 { return k8sinterface.GetClusterName() }
 func (c *EmptyConfig) GenerateURL() {
 	message := fmt.Sprintf("\nCheckout for more cool features: https://%s\n", getter.GetArmoAPIConnector().GetFrontendURL())
 	InfoTextDisplay(os.Stdout, fmt.Sprintf("\n%s\n", message))

cautils/datastructures.go

@@ -13,7 +13,6 @@ type OPASessionObj struct {
 	K8SResources  *K8SResources
 	Exceptions    []armotypes.PostureExceptionPolicy
 	PostureReport *reporthandling.PostureReport
-	RegoInputData RegoInputData // map[<control name>][<input arguments>]
 }
 
 func NewOPASessionObj(frameworks []reporthandling.Framework, k8sResources *K8SResources) *OPASessionObj {
@@ -50,9 +49,3 @@ type Exception struct {
 	Namespaces    []string                   `json:"namespaces"`
 	Regex         string                     `json:"regex"` // not supported
 }
-
-type RegoInputData struct {
-	PostureControlInputs map[string][]string `json:"postureControlInputs"`
-	// ClusterName          string              `json:"clusterName"`
-	// K8sConfig            RegoK8sConfig       `json:"k8sconfig"`
-}

cautils/datastructuresmethods.go

@@ -1,26 +0,0 @@
-package cautils
-
-import (
-	"encoding/json"
-
-	"github.com/open-policy-agent/opa/storage"
-	"github.com/open-policy-agent/opa/storage/inmem"
-	"github.com/open-policy-agent/opa/util"
-)
-
-func (data *RegoInputData) SetControlsInputs(controlsInputs map[string][]string) {
-	data.PostureControlInputs = controlsInputs
-}
-
-func (data *RegoInputData) TOStorage() (storage.Store, error) {
-	var jsonObj map[string]interface{}
-	bytesData, err := json.Marshal(*data)
-	if err != nil {
-		return nil, err
-	}
-	// glog.Infof("RegoDependenciesData: %s", bytesData)
-	if err := util.UnmarshalJSON(bytesData, &jsonObj); err != nil {
-		return nil, err
-	}
-	return inmem.NewFromObject(jsonObj), nil
-}

cautils/getter/armoapi.go

@@ -140,33 +140,6 @@ func (armoAPI *ArmoAPI) GetCustomerGUID(customerGUID string) (*TenantResponse, e
 	return tenant, nil
 }
 
-// ControlsInputs  // map[<control name>][<input arguments>]
-func (armoAPI *ArmoAPI) GetAccountConfig(customerGUID, clusterName string) (*armotypes.CustomerConfig, error) {
-	accountConfig := &armotypes.CustomerConfig{}
-	if customerGUID == "" {
-		return accountConfig, nil
-	}
-	respStr, err := HttpGetter(armoAPI.httpClient, armoAPI.getAccountConfig(customerGUID, clusterName))
-	if err != nil {
-		return nil, err
-	}
-
-	if err = JSONDecoder(respStr).Decode(&accountConfig); err != nil {
-		return nil, err
-	}
-
-	return accountConfig, nil
-}
-
-// ControlsInputs  // map[<control name>][<input arguments>]
-func (armoAPI *ArmoAPI) GetControlsInputs(customerGUID, clusterName string) (map[string][]string, error) {
-	accountConfig, err := armoAPI.GetAccountConfig(customerGUID, clusterName)
-	if err == nil {
-		return accountConfig.Settings.PostureControlInputs, nil
-	}
-	return nil, err
-}
-
 type TenantResponse struct {
 	TenantID  string `json:"tenantId"`
 	Token     string `json:"token"`

cautils/getter/armoapiutils.go

@@ -35,22 +35,6 @@ func (armoAPI *ArmoAPI) getExceptionsURL(customerGUID, clusterName string) strin
 	return u.String()
 }
 
-func (armoAPI *ArmoAPI) getAccountConfig(customerGUID, clusterName string) string {
-	u := url.URL{}
-	u.Scheme = "https"
-	u.Host = armoAPI.apiURL
-	u.Path = "api/v1/customerConfiguration"
-
-	q := u.Query()
-	q.Add("customerGUID", customerGUID)
-	if clusterName != "" { // TODO - fix customer name support in Armo BE
-		q.Add("clusterName", clusterName)
-	}
-	u.RawQuery = q.Encode()
-
-	return u.String()
-}
-
 func (armoAPI *ArmoAPI) getCustomerURL() string {
 	u := url.URL{}
 	u.Scheme = "https"

cautils/getter/getpolicies.go

@@ -7,7 +7,7 @@ import (
 
 type IPolicyGetter interface {
 	GetFramework(name string) (*reporthandling.Framework, error)
-	GetControl(name string) (*reporthandling.Control, error)
+	GetControl(policyName string) (*reporthandling.Control, error)
 }
 
 type IExceptionsGetter interface {
@@ -16,7 +16,3 @@ type IExceptionsGetter interface {
 type IBackend interface {
 	GetCustomerGUID(customerGUID string) (*TenantResponse, error)
 }
-
-type IControlsInputsGetter interface {
-	GetControlsInputs(customerGUID, clusterName string) (map[string][]string, error)
-}

cautils/getter/loadpolicy.go

@@ -17,12 +17,12 @@ const DefaultLocalStore = ".kubescape"
 
 // Load policies from a local repository
 type LoadPolicy struct {
-	filePaths []string
+	filePath string
 }
 
-func NewLoadPolicy(filePaths []string) *LoadPolicy {
+func NewLoadPolicy(filePath string) *LoadPolicy {
 	return &LoadPolicy{
-		filePaths: filePaths,
+		filePath: filePath,
 	}
 }
 
@@ -30,8 +30,7 @@ func NewLoadPolicy(filePaths []string) *LoadPolicy {
 func (lp *LoadPolicy) GetControl(controlName string) (*reporthandling.Control, error) {
 
 	control := &reporthandling.Control{}
-	filePath := lp.filePath()
-	f, err := os.ReadFile(filePath)
+	f, err := os.ReadFile(lp.filePath)
 	if err != nil {
 		return nil, err
 	}
@@ -39,49 +38,35 @@ func (lp *LoadPolicy) GetControl(controlName string) (*reporthandling.Control, e
 	if err = json.Unmarshal(f, control); err != nil {
 		return control, err
 	}
+
 	if controlName != "" && !strings.EqualFold(controlName, control.Name) && !strings.EqualFold(controlName, control.ControlID) {
-		framework, err := lp.GetFramework(controlName)
-		if err != nil {
-			return nil, fmt.Errorf("control from file not matching")
-		} else {
-			for _, ctrl := range framework.Controls {
-				if strings.EqualFold(ctrl.Name, controlName) || strings.EqualFold(ctrl.ControlID, controlName) {
-					control = &ctrl
-					break
-				}
-			}
-		}
+		return nil, fmt.Errorf("control from file not matching")
 	}
 	return control, err
 }
 
 func (lp *LoadPolicy) GetFramework(frameworkName string) (*reporthandling.Framework, error) {
+
 	framework := &reporthandling.Framework{}
-	var err error
-	for _, filePath := range lp.filePaths {
-		f, err := os.ReadFile(filePath)
-		if err != nil {
-			return nil, err
-		}
-
-		if err = json.Unmarshal(f, framework); err != nil {
-			return framework, err
-		}
-		if strings.EqualFold(frameworkName, framework.Name) {
-			break
-		}
+	f, err := os.ReadFile(lp.filePath)
+	if err != nil {
+		return nil, err
 	}
-	if frameworkName != "" && !strings.EqualFold(frameworkName, framework.Name) {
 
+	if err = json.Unmarshal(f, framework); err != nil {
+		return framework, err
+	}
+
+	if frameworkName != "" && !strings.EqualFold(frameworkName, framework.Name) {
 		return nil, fmt.Errorf("framework from file not matching")
 	}
 	return framework, err
 }
 
 func (lp *LoadPolicy) GetExceptions(customerGUID, clusterName string) ([]armotypes.PostureExceptionPolicy, error) {
-	filePath := lp.filePath()
+
 	exception := []armotypes.PostureExceptionPolicy{}
-	f, err := os.ReadFile(filePath)
+	f, err := os.ReadFile(lp.filePath)
 	if err != nil {
 		return nil, err
 	}
@@ -89,25 +74,3 @@ func (lp *LoadPolicy) GetExceptions(customerGUID, clusterName string) ([]armotyp
 	err = json.Unmarshal(f, &exception)
 	return exception, err
 }
-
-func (lp *LoadPolicy) GetControlsInputs(customerGUID, clusterName string) (map[string][]string, error) {
-	filePath := lp.filePath()
-	accountConfig := &armotypes.CustomerConfig{}
-	f, err := os.ReadFile(filePath)
-	if err != nil {
-		return nil, err
-	}
-
-	if err = json.Unmarshal(f, &accountConfig); err == nil {
-		return accountConfig.Settings.PostureControlInputs, nil
-	}
-	return nil, err
-}
-
-// temporary support for a list of files
-func (lp *LoadPolicy) filePath() string {
-	if len(lp.filePaths) > 0 {
-		return lp.filePaths[0]
-	}
-	return ""
-}

cautils/scaninfo.go

@@ -9,10 +9,9 @@ import (
 
 type ScanInfo struct {
 	Getters
-	PolicyIdentifier   []reporthandling.PolicyIdentifier
-	UseExceptions      string   // Load file with exceptions configuration
-	ControlsInputs     string   // Load file with inputs for controls
-	UseFrom            []string // Load framework from local file (instead of download). Use when running offline
+	PolicyIdentifier   reporthandling.PolicyIdentifier
+	UseExceptions      string   // Load exceptions configuration
+	UseFrom            string   // Load framework from local file (instead of download). Use when running offline
 	UseDefault         bool     // Load framework from cached file (instead of download). Use when running offline
 	Format             string   // Format results (table, json, junit ...)
 	Output             string   // Store results in an output file, Output file name
@@ -27,15 +26,13 @@ type ScanInfo struct {
 }
 
 type Getters struct {
-	ExceptionsGetter     getter.IExceptionsGetter
-	ControlsInputsGetter getter.IControlsInputsGetter
-	PolicyGetter         getter.IPolicyGetter
+	ExceptionsGetter getter.IExceptionsGetter
+	PolicyGetter     getter.IPolicyGetter
 }
 
 func (scanInfo *ScanInfo) Init() {
 	scanInfo.setUseFrom()
 	scanInfo.setUseExceptions()
-	scanInfo.setAccountConfig()
 	scanInfo.setOutputFile()
 	scanInfo.setGetter()
 
@@ -44,29 +41,22 @@ func (scanInfo *ScanInfo) Init() {
 func (scanInfo *ScanInfo) setUseExceptions() {
 	if scanInfo.UseExceptions != "" {
 		// load exceptions from file
-		scanInfo.ExceptionsGetter = getter.NewLoadPolicy([]string{scanInfo.UseExceptions})
+		scanInfo.ExceptionsGetter = getter.NewLoadPolicy(scanInfo.UseExceptions)
 	} else {
 		scanInfo.ExceptionsGetter = getter.GetArmoAPIConnector()
 	}
-}
 
-func (scanInfo *ScanInfo) setAccountConfig() {
-	if scanInfo.ControlsInputs != "" {
-		// load account config from file
-		scanInfo.ControlsInputsGetter = getter.NewLoadPolicy([]string{scanInfo.ControlsInputs})
-	} else {
-		scanInfo.ControlsInputsGetter = getter.GetArmoAPIConnector()
-	}
 }
 func (scanInfo *ScanInfo) setUseFrom() {
+	if scanInfo.UseFrom != "" {
+		return
+	}
 	if scanInfo.UseDefault {
-		for _, policy := range scanInfo.PolicyIdentifier {
-			scanInfo.UseFrom = append(scanInfo.UseFrom, getter.GetDefaultPath(policy.Name+".json"))
-		}
+		scanInfo.UseFrom = getter.GetDefaultPath(scanInfo.PolicyIdentifier.Name + ".json")
 	}
 }
 func (scanInfo *ScanInfo) setGetter() {
-	if len(scanInfo.UseFrom) > 0 {
+	if scanInfo.UseFrom != "" {
 		// load from file
 		scanInfo.PolicyGetter = getter.NewLoadPolicy(scanInfo.UseFrom)
 	} else {

clihandler/cmd/control.go

@@ -13,40 +13,22 @@ import (
 
 // controlCmd represents the control command
 var controlCmd = &cobra.Command{
-	Use:   "control <control names list>/<control ids list>.\nExamples:\n$ kubescape scan control C-0058,C-0057 [flags]\n$ kubescape scan contol C-0058 [flags]\n$ kubescape scan control 'privileged container,allowed hostpath' [flags]",
+	Use:   "control <control name>/<control id>",
 	Short: fmt.Sprintf("The control you wish to use for scan. It must be present in at least one of the folloiwng frameworks: %s", clihandler.ValidFrameworks),
 	Args: func(cmd *cobra.Command, args []string) error {
-		if len(args) > 0 {
-			controls := strings.Split(args[0], ",")
-			if len(controls) > 1 {
-				if controls[1] == "" {
-					return fmt.Errorf("usage: <control_one>,<control_two>")
-				}
-			}
-		} else {
-			return fmt.Errorf("requires at least one control name")
+		if len(args) < 1 && !(cmd.Flags().Lookup("use-from").Changed) {
+			return fmt.Errorf("requires at least one argument")
 		}
 		return nil
 	},
 	RunE: func(cmd *cobra.Command, args []string) error {
 		flagValidationControl()
-		scanInfo.PolicyIdentifier = []reporthandling.PolicyIdentifier{}
-
-		if len(args) < 1 {
-			scanInfo.PolicyIdentifier = SetScanForGivenFrameworks(clihandler.SupportedFrameworks)
-		} else {
-			var controls []string
-			if len(args) > 0 {
-				controls = strings.Split(args[0], ",")
-				scanInfo.PolicyIdentifier = []reporthandling.PolicyIdentifier{}
-				scanInfo.PolicyIdentifier = setScanForFirstControl(controls)
-			}
-
-			if len(controls) > 1 {
-				scanInfo.PolicyIdentifier = SetScanForGivenControls(controls[1:])
-			}
+		scanInfo.PolicyIdentifier = reporthandling.PolicyIdentifier{}
+		if !(cmd.Flags().Lookup("use-from").Changed) {
+			scanInfo.PolicyIdentifier.Name = strings.ToLower(args[0])
 		}
 		scanInfo.FrameworkScan = false
+		scanInfo.PolicyIdentifier.Kind = reporthandling.KindControl
 		scanInfo.Init()
 		cautils.SetSilentMode(scanInfo.Silent)
 		err := clihandler.CliSetup(&scanInfo)
@@ -69,22 +51,3 @@ func flagValidationControl() {
 		os.Exit(1)
 	}
 }
-
-func setScanForFirstControl(controls []string) []reporthandling.PolicyIdentifier {
-	newPolicy := reporthandling.PolicyIdentifier{}
-	newPolicy.Kind = reporthandling.KindControl
-	newPolicy.Name = controls[0]
-	scanInfo.PolicyIdentifier = append(scanInfo.PolicyIdentifier, newPolicy)
-	return scanInfo.PolicyIdentifier
-}
-
-func SetScanForGivenControls(controls []string) []reporthandling.PolicyIdentifier {
-	for _, control := range controls {
-		control := strings.TrimLeft(control, " ")
-		newPolicy := reporthandling.PolicyIdentifier{}
-		newPolicy.Kind = reporthandling.KindControl
-		newPolicy.Name = control
-		scanInfo.PolicyIdentifier = append(scanInfo.PolicyIdentifier, newPolicy)
-	}
-	return scanInfo.PolicyIdentifier
-}

clihandler/cmd/framework.go

@@ -9,42 +9,32 @@ import (
 	"github.com/armosec/kubescape/cautils"
 	"github.com/armosec/kubescape/clihandler"
 	"github.com/armosec/opa-utils/reporthandling"
+
 	"github.com/spf13/cobra"
 )
 
 var frameworkCmd = &cobra.Command{
-	Use:       fmt.Sprintf("framework <framework names list> [`<glob pattern>`/`-`] [flags]\nExamples:\n$ kubescape scan framework nsa [flags]\n$ kubescape scan framework mitre,nsa [flags]\n$ kubescape scan framework 'nsa, mitre' [flags]\nSupported frameworks: %s", clihandler.ValidFrameworks),
+
+	Use:       fmt.Sprintf("framework <framework name> [`<glob pattern>`/`-`] [flags]\nSupported frameworks: %s", clihandler.ValidFrameworks),
 	Short:     fmt.Sprintf("The framework you wish to use. Supported frameworks: %s", strings.Join(clihandler.SupportedFrameworks, ", ")),
 	Long:      "Execute a scan on a running Kubernetes cluster or `yaml`/`json` files (use glob) or `-` for stdin",
 	ValidArgs: clihandler.SupportedFrameworks,
 	Args: func(cmd *cobra.Command, args []string) error {
-		if len(args) > 0 {
-			// "nsa, mitre" -> ["nsa", "mitre"] and nsa,mitre -> ["nsa", "mitre"]
-			frameworks := strings.Split(strings.Join(strings.Fields(args[0]), ""), ",")
-			for _, framework := range frameworks {
-				if !isValidFramework(strings.ToLower(framework)) {
-					return fmt.Errorf(fmt.Sprintf("supported frameworks: %s", strings.Join(clihandler.SupportedFrameworks, ", ")))
-				}
+		if len(args) < 1 && !(cmd.Flags().Lookup("use-from").Changed) {
+			return fmt.Errorf("requires at least one argument")
+		} else if len(args) > 0 {
+			if !isValidFramework(strings.ToLower(args[0])) {
+				return fmt.Errorf(fmt.Sprintf("supported frameworks: %s", strings.Join(clihandler.SupportedFrameworks, ", ")))
 			}
-		} else {
-			return fmt.Errorf("requires at least one framework name")
 		}
 		return nil
 	},
 	RunE: func(cmd *cobra.Command, args []string) error {
+		scanInfo.PolicyIdentifier = reporthandling.PolicyIdentifier{}
+		scanInfo.PolicyIdentifier.Kind = reporthandling.KindFramework
 		flagValidationFramework()
-		scanInfo.PolicyIdentifier = []reporthandling.PolicyIdentifier{}
-		// If no framework provided, use all
-		if len(args) < 1 {
-			scanInfo.PolicyIdentifier = SetScanForGivenFrameworks(clihandler.SupportedFrameworks)
-		} else {
-			// Read frameworks from input args
-			scanInfo.PolicyIdentifier = []reporthandling.PolicyIdentifier{}
-			frameworks := strings.Split(strings.Join(strings.Fields(args[0]), ""), ",")
-			scanInfo.PolicyIdentifier = SetScanForFirstFramework(frameworks)
-			if len(frameworks) > 1 {
-				scanInfo.PolicyIdentifier = SetScanForGivenFrameworks(frameworks[1:])
-			}
+		if !(cmd.Flags().Lookup("use-from").Changed) {
+			scanInfo.PolicyIdentifier.Name = strings.ToLower(args[0])
 		}
 		if len(args) > 0 {
 			if len(args[1:]) == 0 || args[1] != "-" {
@@ -84,26 +74,11 @@ func init() {
 	frameworkCmd.Flags().BoolVarP(&scanInfo.Submit, "submit", "", false, "Send the scan results to Armo management portal where you can see the results in a user-friendly UI, choose your preferred compliance framework, check risk results history and trends, manage exceptions, get remediation recommendations and much more. By default the results are not submitted")
 	frameworkCmd.Flags().BoolVarP(&scanInfo.Local, "keep-local", "", false, "If you do not want your Kubescape results reported to Armo backend. Use this flag if you ran with the '--submit' flag in the past and you do not want to submit your current scan results")
 	frameworkCmd.Flags().StringVarP(&scanInfo.Account, "account", "", "", "Armo portal account ID. Default will load account ID from configMap or config file")
-}
-func SetScanForGivenFrameworks(frameworks []string) []reporthandling.PolicyIdentifier {
-	for _, framework := range frameworks {
-		newPolicy := reporthandling.PolicyIdentifier{}
-		newPolicy.Kind = reporthandling.KindFramework
-		newPolicy.Name = framework
-		scanInfo.PolicyIdentifier = append(scanInfo.PolicyIdentifier, newPolicy)
-	}
-	return scanInfo.PolicyIdentifier
-}
 
-func SetScanForFirstFramework(frameworks []string) []reporthandling.PolicyIdentifier {
-	newPolicy := reporthandling.PolicyIdentifier{}
-	newPolicy.Kind = reporthandling.KindFramework
-	newPolicy.Name = frameworks[0]
-	scanInfo.PolicyIdentifier = append(scanInfo.PolicyIdentifier, newPolicy)
-	return scanInfo.PolicyIdentifier
 }
 
 func flagValidationFramework() {
+
 	if scanInfo.Submit && scanInfo.Local {
 		fmt.Println("You can use `keep-local` or `submit`, but not both")
 		os.Exit(1)

clihandler/cmd/scan.go

@@ -5,7 +5,6 @@ import (
 	"strings"
 
 	"github.com/armosec/kubescape/cautils"
-	"github.com/armosec/kubescape/clihandler"
 	"github.com/spf13/cobra"
 )
 
@@ -17,19 +16,15 @@ var scanCmd = &cobra.Command{
 	Short: "Scan the current running cluster or yaml files",
 	Long:  `The action you want to perform`,
 	Args: func(cmd *cobra.Command, args []string) error {
-		if len(args) > 0 {
-			if !strings.EqualFold(args[0], "framework") && !strings.EqualFold(args[0], "control") {
-				return fmt.Errorf("invalid parameter '%s'. Supported parameters: framework, control", args[0])
-			}
+		if len(args) == 0 {
+			return fmt.Errorf("requires one  argument: framework/control")
+		}
+		if !strings.EqualFold(args[0], "framework") && !strings.EqualFold(args[0], "control") {
+			return fmt.Errorf("invalid parameter '%s'. Supported parameters: framework, control", args[0])
 		}
 		return nil
 	},
 	Run: func(cmd *cobra.Command, args []string) {
-		if len(args) == 0 {
-			frameworkArgs := []string{clihandler.ValidFrameworks}
-			frameworkArgs = append(frameworkArgs, args...)
-			frameworkCmd.RunE(cmd, frameworkArgs)
-		}
 	},
 }
 
@@ -40,8 +35,7 @@ func init() {
 	scanCmd.PersistentFlags().StringVarP(&scanInfo.Output, "output", "o", "", "Output file. Print output to file and not stdout")
 	scanCmd.PersistentFlags().BoolVarP(&scanInfo.Silent, "silent", "s", false, "Silent progress messages")
 	scanCmd.PersistentFlags().Uint16VarP(&scanInfo.FailThreshold, "fail-threshold", "t", 0, "Failure threshold is the percent bellow which the command fails and returns exit code 1")
-	scanCmd.PersistentFlags().StringSliceVar(&scanInfo.UseFrom, "use-from", nil, "Load local policy object from specified path. If not used will download latest")
-	scanCmd.PersistentFlags().BoolVar(&scanInfo.UseDefault, "use-default", false, "Load local policy object from default path. If not used will download latest")
-	scanCmd.PersistentFlags().StringVar(&scanInfo.UseExceptions, "exceptions", "", "Path to an exceptions obj. If not set will download exceptions from ARMO management portal")
-	scanCmd.PersistentFlags().StringVar(&scanInfo.ControlsInputs, "controls-config", "", "Path to an controls-config obj. If not set will download controls-config from ARMO management portal")
+	scanCmd.PersistentFlags().StringVar(&scanInfo.UseFrom, "use-from", "", "Load local framework object from specified path. If not used will download latest")
+	scanCmd.PersistentFlags().BoolVar(&scanInfo.UseDefault, "use-default", false, "Load local framework object from default path. If not used will download latest")
+	scanCmd.PersistentFlags().StringVar(&scanInfo.UseExceptions, "exceptions", "", "Path to an exceptions obj. If not set will download exceptions from Armo management portal")
 }

clihandler/cmd/version.go

@@ -29,7 +29,7 @@ func GetLatestVersion() (string, error) {
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode < 200 || 301 < resp.StatusCode {
-		return "unknown", nil
+		return "unknown", fmt.Errorf("failed to download file, status code: %s", resp.Status)
 	}
 
 	body, err := io.ReadAll(resp.Body)

clihandler/initcli.go

@@ -135,8 +135,10 @@ func (clihandler *CLIHandler) Scan() error {
 	cautils.ScanStartDisplay()
 	policyNotification := &reporthandling.PolicyNotification{
 		NotificationType: reporthandling.TypeExecPostureScan,
-		Rules:            clihandler.scanInfo.PolicyIdentifier,
-		Designators:      armotypes.PortalDesignator{},
+		Rules: []reporthandling.PolicyIdentifier{
+			clihandler.scanInfo.PolicyIdentifier,
+		},
+		Designators: armotypes.PortalDesignator{},
 	}
 	switch policyNotification.NotificationType {
 	case reporthandling.TypeExecPostureScan:

examples/cronJob-support/README.md

@@ -1,85 +0,0 @@
-# Periodically Kubescape Scanning
-
-You can scan your cluster periodically by adding a `CronJob` that will repeatedly trigger kubescape
-
-* Setup [scanning & submitting](#scanning-and-submitting)
-* Setup [scanning without submitting](#scanning-without-submitting)
-
-## Scanning And Submitting
-
-If you wish to periodically scan and submit the result to the [Kubescape SaaS version](https://portal.armo.cloud/) where you can benefit the features the SaaS version provides, please follow this instructions ->
-
-1. Apply kubescape namespace
-    ```
-    kubectl apply ks-namespace.yaml
-    ```
-
-2. Apply serviceAccount and roles
-    ```
-    kubectl apply ks-serviceAccount.yaml
-    ```
-
-3. Setup and apply configMap
-   
-    Before you apply the configMap you need to set the account ID and cluster name in the `ks-configMap.yaml` file.
-
-    * Set cluster name:
-        Run `kubectl config current-context` and set the result in the `data.clusterName` field
-    * Set account ID:
-        1. Navigate to the [Kubescape SaaS version](https://portal.armo.cloud/) and login/sign up for free 
-        2. Click the `Add Cluster` button on the top right of the page 
-            </br>
-            <img src="screenshots/add-cluster.png"  alt="add-cluster">
-        3. Copy the value of `--account` and set it in the `data.customerGUID` field
-            </br>
-            <img src="screenshots/account.png"  alt="account">
-
-        Make sure the configMap looks as following;
-        ```
-        kind: ConfigMap 
-        apiVersion: v1 
-        metadata:
-        name: kubescape 
-        labels:
-            app: kubescape
-        namespace: kubescape
-        data:
-        config.json: |
-            {
-                "customerGUID": "XXXXXXXX-XXXX-XXXX-XXXXXXXXXXXX",
-                "clusterName": "my-awesome-cluster-name"
-            }
-        ```
-
-    Finally, apply the configMap
-    ```
-    kubectl apply ks-configMap.yaml
-    ```
-
-4. Apply CronJob
-
-    Before you apply the cronJob, make sure the scanning frequency suites your needs
-    ```
-    kubectl apply ks-cronJob-submit.yaml
-    ```
-
-## Scanning Without Submitting
-
-If you wish to periodically scan but not submit the scan results, follow this instructions ->
-
-1. Apply kubescape namespace
-    ```
-    kubectl apply ks-namespace.yaml
-    ```
-
-2. Apply serviceAccount and roles
-    ```
-    kubectl apply ks-serviceAccount.yaml
-    ```
-
-3. Apply CronJob
-
-    Before you apply the cronJob, make sure the scanning frequency suites your needs
-    ```
-    kubectl apply ks-cronJob-non-submit.yaml
-    ```

examples/cronJob-support/ks-configMap.yaml

@@ -1,14 +0,0 @@
-# ------------------- Kubescape User/Customer ID ------------------- #
-kind: ConfigMap 
-apiVersion: v1 
-metadata:
-  name: kubescape 
-  labels:
-    app: kubescape
-  namespace: kubescape
-data:
-  config.json: |
-    {
-      "customerGUID": "<ID>",
-      "clusterName": "<cluster name>"
-    }

examples/cronJob-support/ks-cronJob-non-submit.yaml

@@ -1,32 +0,0 @@
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: kubescape
-  labels:
-    app: kubescape
-  namespace: kubescape
-spec:
-  #      ┌────────────────── timezone (optional)
-  #      |      ┌───────────── minute (0 - 59)
-  #      |      │ ┌───────────── hour (0 - 23)
-  #      |      │ │ ┌───────────── day of the month (1 - 31)
-  #      |      │ │ │ ┌───────────── month (1 - 12)
-  #      |      │ │ │ │ ┌───────────── day of the week (0 - 6) (Sunday to Saturday;
-  #      |      │ │ │ │ │                         7 is also Sunday on some systems)
-  #      |      │ │ │ │ │
-  #      |      │ │ │ │ │
-  # CRON_TZ=UTC * * * * *
-  schedule: "0 0 1 * *"
-  jobTemplate:
-    spec:
-      template:
-        spec:
-          containers:
-          - name: kubescape
-            image: quay.io/armosec/kubescape:latest
-            imagePullPolicy: IfNotPresent
-            command: ["/bin/sh","-c"]
-            args: 
-            - kubescape scan framework nsa
-          restartPolicy: OnFailure
-          serviceAccountName: kubescape-discovery

examples/cronJob-support/ks-cronJob-submit.yaml

@@ -1,40 +0,0 @@
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: kubescape
-  labels:
-    app: kubescape
-  namespace: kubescape
-spec:
-  #      ┌────────────────── timezone (optional)
-  #      |      ┌───────────── minute (0 - 59)
-  #      |      │ ┌───────────── hour (0 - 23)
-  #      |      │ │ ┌───────────── day of the month (1 - 31)
-  #      |      │ │ │ ┌───────────── month (1 - 12)
-  #      |      │ │ │ │ ┌───────────── day of the week (0 - 6) (Sunday to Saturday;
-  #      |      │ │ │ │ │                         7 is also Sunday on some systems)
-  #      |      │ │ │ │ │
-  #      |      │ │ │ │ │
-  # CRON_TZ=UTC * * * * *
-  schedule: "0 0 1 * *"
-  jobTemplate:
-    spec:
-      template:
-        spec:
-          containers:
-          - name: kubescape
-            image: quay.io/armosec/kubescape:latest
-            imagePullPolicy: IfNotPresent
-            command: ["/bin/sh","-c"]
-            args: 
-            - kubescape scan framework nsa --submit
-            volumeMounts:
-            - name: kubescape-config-volume
-              mountPath: /root/.kubescape/config.json
-              subPath: config.json
-          restartPolicy: OnFailure
-          serviceAccountName: kubescape-discovery
-          volumes:
-          - name: kubescape-config-volume
-            configMap:
-              name: kubescape

examples/cronJob-support/ks-namespace.yaml

@@ -1,7 +0,0 @@
-# ------------------- Kubescape User/Customer ID ------------------- #
-kind: Namespace 
-apiVersion: v1 
-metadata:
-  name: kubescape
-  labels:
-    app: kubescape

examples/cronJob-support/ks-serviceAccount.yaml

@@ -1,61 +0,0 @@
----
-# ------------------- Kubescape Service Account ------------------- #
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  labels:
-    app: kubescape
-  name: kubescape-discovery
-  namespace: kubescape
-
----
-# ------------------- Kubescape Role & Role Binding ------------------- #
-kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: kubescape-discovery-role
-  namespace: kubescape
-rules:
-- apiGroups: ["*"]
-  resources: ["*"]
-  verbs: ["get", "list", "describe"]
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: kubescape-discovery-binding
-  namespace: kubescape
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: kubescape-discovery-role
-subjects:
-- kind: ServiceAccount
-  name: kubescape-discovery
-
----
-# ------------------- Kubescape Cluster Role & Cluster Role Binding ------------------- #
-kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: kubescape-discovery-clusterroles
-  # "namespace" omitted since ClusterRoles are not namespaced
-rules:
-- apiGroups: ["*"]
-  resources: ["*"]
-  verbs: ["get", "list", "describe"]
-
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: kubescape-discovery-role-binding
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: kubescape-discovery-clusterroles
-subjects:
-- kind: ServiceAccount
-  name: kubescape-discovery
-  namespace: kubescape

examples/cronjob/ks-cronjob.yaml

@@ -1,10 +1,3 @@
-# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
-# 
-# This file is DEPRECATE, please navigate to the official docs ->
-# https://github.com/armosec/kubescape/tree/master/examples/cronJob-support/README.md
-#
-# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
-
 ---
 # ------------------- Kubescape Service Account ------------------- #
 apiVersion: v1

go.mod

@@ -5,7 +5,7 @@ go 1.17
 require (
 	github.com/armosec/armoapi-go v0.0.8
 	github.com/armosec/k8s-interface v0.0.8
-	github.com/armosec/opa-utils v0.0.21
+	github.com/armosec/opa-utils v0.0.18
 	github.com/armosec/utils-go v0.0.3
 	github.com/briandowns/spinner v1.16.0
 	github.com/enescakir/emoji v1.0.0
@@ -32,7 +32,6 @@ require (
 	github.com/Azure/go-autorest/logger v0.2.1 // indirect
 	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
 	github.com/OneOfOne/xxhash v1.2.8 // indirect
-	github.com/armosec/rbac-utils v0.0.1 // indirect
 	github.com/armosec/utils-k8s-go v0.0.1 // indirect
 	github.com/coreos/go-oidc v2.2.1+incompatible // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect

go.sum

@@ -87,12 +87,11 @@ github.com/armosec/armoapi-go v0.0.2/go.mod h1:vIK17yoKbJRQyZXWWLe3AqfqCRITxW8qm
 github.com/armosec/armoapi-go v0.0.7/go.mod h1:iaVVGyc23QGGzAdv4n+szGQg3Rbpixn9yQTU3qWRpaw=
 github.com/armosec/armoapi-go v0.0.8 h1:JPa9rZynuE2RucamDh6dsy/sjCScmWDsyt1zagJFCDo=
 github.com/armosec/armoapi-go v0.0.8/go.mod h1:iaVVGyc23QGGzAdv4n+szGQg3Rbpixn9yQTU3qWRpaw=
+github.com/armosec/k8s-interface v0.0.5/go.mod h1:xxS+V5QT3gVQTwZyAMMDrYLWGrfKOpiJ7Jfhfa0w9sM=
 github.com/armosec/k8s-interface v0.0.8 h1:Eo3Qen4yFXxzVem49FNeij2ckyzHSAJ0w6PZMaSEIm8=
 github.com/armosec/k8s-interface v0.0.8/go.mod h1:xxS+V5QT3gVQTwZyAMMDrYLWGrfKOpiJ7Jfhfa0w9sM=
-github.com/armosec/opa-utils v0.0.21 h1:LzQ4LoY+fKQIhyLdR7cI/YfjdCztLdAeP40Ct3Wcw5o=
-github.com/armosec/opa-utils v0.0.21/go.mod h1:JaE2a0kB2O22JZCqBBfOS9Pvh9rXs9xXXb9lVo01rTs=
-github.com/armosec/rbac-utils v0.0.1 h1:N2MI98F/0zbDjmRZ29CNElU1AXkFLk5csd/qAHOBdXY=
-github.com/armosec/rbac-utils v0.0.1/go.mod h1:pQ8CBiij8kSKV7aeZm9FMvtZN28VgA7LZcYyTWimq40=
+github.com/armosec/opa-utils v0.0.18 h1:1hL5v2KCD8yStuwzul+gq1zg9+RCV9N3kHoRepKnrg0=
+github.com/armosec/opa-utils v0.0.18/go.mod h1:E0mFTVx+4BYAVvO2hxWnIniv/IZIogRCak8BkKd7KK4=
 github.com/armosec/utils-go v0.0.2/go.mod h1:itWmRLzRdsnwjpEOomL0mBWGnVNNIxSjDAdyc+b0iUo=
 github.com/armosec/utils-go v0.0.3 h1:uyQI676yRciQM0sSN9uPoqHkbspTxHO0kmzXhBeE/xU=
 github.com/armosec/utils-go v0.0.3/go.mod h1:itWmRLzRdsnwjpEOomL0mBWGnVNNIxSjDAdyc+b0iUo=
@@ -100,7 +99,6 @@ github.com/armosec/utils-k8s-go v0.0.1 h1:Ay3y7fW+4+FjVc0+obOWm8YsnEvM31vPAVoKTy
 github.com/armosec/utils-k8s-go v0.0.1/go.mod h1:qrU4pmY2iZsOb39Eltpm0sTTNM3E4pmeyWx4dgDUC2U=
 github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
 github.com/aws/aws-sdk-go v1.41.1/go.mod h1:585smgzpB/KqRA+K3y/NL/oYRqQvpNJYvLm+LY1U59Q=
-github.com/aws/aws-sdk-go v1.41.11/go.mod h1:585smgzpB/KqRA+K3y/NL/oYRqQvpNJYvLm+LY1U59Q=
 github.com/benbjohnson/clock v1.0.3/go.mod h1:bGMdMPoPVvcYyt1gHDf4J2KE153Yf9BuiUKYMaxlTDM=
 github.com/benbjohnson/clock v1.1.0 h1:Q92kusRqC1XV2MjkWETPvjJVqKetz1OzxZB7mHJLju8=
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=

main.go

@@ -5,25 +5,19 @@ import (
 	"os"
 
 	"github.com/armosec/kubescape/clihandler/cmd"
-	pkgutils "github.com/armosec/utils-go/utils"
 )
 
-const SKIP_VERSION_CHECK = "KUBESCAPE_SKIP_UPDATE_CHECK"
-
 func main() {
 	CheckLatestVersion()
 	cmd.Execute()
 }
 
 func CheckLatestVersion() {
-	if v, ok := os.LookupEnv(SKIP_VERSION_CHECK); ok && pkgutils.StringToBool(v) {
-		return
-	}
 	latest, err := cmd.GetLatestVersion()
-	if err != nil || latest == "unknown" {
-		return
-	}
-	if latest != cmd.BuildNumber {
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "error: %v\n", err)
+	} else if latest != cmd.BuildNumber {
 		fmt.Println("Warning: You are not updated to the latest release: " + latest)
 	}
+
 }

opaprocessor/processorhandler.go

@@ -15,37 +15,42 @@ import (
 	"github.com/golang/glog"
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/rego"
+	"github.com/open-policy-agent/opa/storage"
 	uuid "github.com/satori/go.uuid"
 )
 
 const ScoreConfigPath = "/resources/config"
 
+var RegoK8sCredentials storage.Store
+
 type OPAProcessorHandler struct {
-	processedPolicy      *chan *cautils.OPASessionObj
-	reportResults        *chan *cautils.OPASessionObj
-	regoDependenciesData *resources.RegoDependenciesData
+	processedPolicy *chan *cautils.OPASessionObj
+	reportResults   *chan *cautils.OPASessionObj
+	// componentConfig    cautils.ComponentConfig
 }
 
 type OPAProcessor struct {
 	*cautils.OPASessionObj
-	regoDependenciesData *resources.RegoDependenciesData
 }
 
-func NewOPAProcessor(sessionObj *cautils.OPASessionObj, regoDependenciesData *resources.RegoDependenciesData) *OPAProcessor {
-	if regoDependenciesData != nil && sessionObj != nil {
-		regoDependenciesData.PostureControlInputs = sessionObj.RegoInputData.PostureControlInputs
-	}
+func NewOPAProcessor(sessionObj *cautils.OPASessionObj) *OPAProcessor {
 	return &OPAProcessor{
-		OPASessionObj:        sessionObj,
-		regoDependenciesData: regoDependenciesData,
+		OPASessionObj: sessionObj,
 	}
 }
 
 func NewOPAProcessorHandler(processedPolicy, reportResults *chan *cautils.OPASessionObj) *OPAProcessorHandler {
+
+	regoDependenciesData := resources.NewRegoDependenciesData(k8sinterface.GetK8sConfig(), cautils.ClusterName)
+	store, err := regoDependenciesData.TOStorage()
+	if err != nil {
+		panic(err)
+	}
+	RegoK8sCredentials = store
+
 	return &OPAProcessorHandler{
-		processedPolicy:      processedPolicy,
-		reportResults:        reportResults,
-		regoDependenciesData: resources.NewRegoDependenciesData(k8sinterface.GetK8sConfig(), cautils.ClusterName),
+		processedPolicy: processedPolicy,
+		reportResults:   reportResults,
 	}
 }
 
@@ -53,7 +58,7 @@ func (opaHandler *OPAProcessorHandler) ProcessRulesListenner() {
 
 	for {
 		opaSessionObj := <-*opaHandler.processedPolicy
-		opap := NewOPAProcessor(opaSessionObj, opaHandler.regoDependenciesData)
+		opap := NewOPAProcessor(opaSessionObj)
 
 		// process
 		if err := opap.Process(); err != nil {
@@ -198,16 +203,11 @@ func (opap *OPAProcessor) runRegoOnK8s(rule *reporthandling.PolicyRule, k8sObjec
 }
 
 func (opap *OPAProcessor) regoEval(inputObj []map[string]interface{}, compiledRego *ast.Compiler) ([]reporthandling.RuleResponse, error) {
-	store, err := opap.regoDependenciesData.TOStorage() // get store
-	if err != nil {
-		return nil, err
-	}
-
 	rego := rego.New(
 		rego.Query("data.armo_builtins"), // get package name from rule
 		rego.Compiler(compiledRego),
 		rego.Input(inputObj),
-		rego.Store(store),
+		rego.Store(RegoK8sCredentials),
 	)
 
 	// Run evaluation

opaprocessor/processorhandler_test.go

@@ -5,7 +5,6 @@ import (
 
 	"github.com/armosec/kubescape/cautils"
 	"github.com/armosec/opa-utils/reporthandling"
-	"github.com/armosec/opa-utils/resources"
 
 	"github.com/armosec/k8s-interface/k8sinterface"
 	// _ "k8s.io/client-go/plugin/pkg/client/auth"
@@ -25,7 +24,7 @@ func TestProcess(t *testing.T) {
 	opaSessionObj.Frameworks = []reporthandling.Framework{*reporthandling.MockFrameworkA()}
 	opaSessionObj.K8SResources = &k8sResources
 
-	opap := NewOPAProcessor(opaSessionObj, resources.NewRegoDependenciesDataMock())
+	opap := NewOPAProcessor(opaSessionObj)
 	opap.Process()
 	opap.updateResults()
 	for _, f := range opap.PostureReport.FrameworkReports {

policyhandler/handlenotification.go

@@ -6,6 +6,8 @@ import (
 	"github.com/armosec/kubescape/cautils"
 	"github.com/armosec/kubescape/resourcehandler"
 	"github.com/armosec/opa-utils/reporthandling"
+
+	"github.com/armosec/armoapi-go/armotypes"
 )
 
 // PolicyHandler -
@@ -31,9 +33,15 @@ func (policyHandler *PolicyHandler) HandleNotificationRequest(notification *repo
 	policyHandler.getters = &scanInfo.Getters
 
 	// get policies
-	if err := policyHandler.getPolicies(notification, opaSessionObj); err != nil {
+	frameworks, exceptions, err := policyHandler.getPolicies(notification)
+	if err != nil {
 		return err
 	}
+	if len(frameworks) == 0 {
+		return fmt.Errorf("empty list of frameworks")
+	}
+	opaSessionObj.Frameworks = frameworks
+	opaSessionObj.Exceptions = exceptions
 
 	k8sResources, err := policyHandler.getResources(notification, opaSessionObj, scanInfo)
 	if err != nil {
@@ -49,6 +57,25 @@ func (policyHandler *PolicyHandler) HandleNotificationRequest(notification *repo
 	return nil
 }
 
+func (policyHandler *PolicyHandler) getPolicies(notification *reporthandling.PolicyNotification) ([]reporthandling.Framework, []armotypes.PostureExceptionPolicy, error) {
+
+	cautils.ProgressTextDisplay("Downloading/Loading policy definitions")
+
+	frameworks, exceptions, err := policyHandler.GetPoliciesFromBackend(notification)
+	if err != nil {
+		return frameworks, exceptions, err
+	}
+
+	if len(frameworks) == 0 {
+		err := fmt.Errorf("could not download any policies, please check previous logs")
+		return frameworks, exceptions, err
+	}
+	//if notification.Rules
+	cautils.SuccessTextDisplay("Downloaded/Loaded policy")
+
+	return frameworks, exceptions, nil
+}
+
 func (policyHandler *PolicyHandler) getResources(notification *reporthandling.PolicyNotification, opaSessionObj *cautils.OPASessionObj, scanInfo *cautils.ScanInfo) (*cautils.K8SResources, error) {
 
 	opaSessionObj.PostureReport.ClusterAPIServerInfo = policyHandler.resourceHandler.GetClusterAPIServerInfo()

policyhandler/handlepullpolicies.go

@@ -2,71 +2,90 @@ package policyhandler
 
 import (
 	"fmt"
+	"strings"
 
+	"github.com/armosec/armoapi-go/armotypes"
 	"github.com/armosec/kubescape/cautils"
 	"github.com/armosec/opa-utils/reporthandling"
 )
 
-func (policyHandler *PolicyHandler) getPolicies(notification *reporthandling.PolicyNotification, policiesAndResources *cautils.OPASessionObj) error {
-	cautils.ProgressTextDisplay("Downloading/Loading policy definitions")
-
-	frameworks, err := policyHandler.getScanPolicies(notification)
-	if err != nil {
-		return err
-	}
-	if len(frameworks) == 0 {
-		return fmt.Errorf("failed to download policies, please ARMO team for more information")
-	}
-
-	policiesAndResources.Frameworks = frameworks
-
-	// get exceptions
-	exceptionPolicies, err := policyHandler.getters.ExceptionsGetter.GetExceptions(cautils.CustomerGUID, cautils.ClusterName)
-	if err == nil {
-		policiesAndResources.Exceptions = exceptionPolicies
-	}
-
-	// get account configuration
-	controlsInputs, err := policyHandler.getters.ControlsInputsGetter.GetControlsInputs(cautils.CustomerGUID, cautils.ClusterName)
-	if err == nil {
-		policiesAndResources.RegoInputData.PostureControlInputs = controlsInputs
-	}
-
-	cautils.SuccessTextDisplay("Downloaded/Loaded policy")
-	return nil
-}
-
-func (policyHandler *PolicyHandler) getScanPolicies(notification *reporthandling.PolicyNotification) ([]reporthandling.Framework, error) {
+func (policyHandler *PolicyHandler) GetPoliciesFromBackend(notification *reporthandling.PolicyNotification) ([]reporthandling.Framework, []armotypes.PostureExceptionPolicy, error) {
+	var errs error
 	frameworks := []reporthandling.Framework{}
-
-	switch getScanKind(notification) {
-	case reporthandling.KindFramework: // Download frameworks
-		for _, rule := range notification.Rules {
-			receivedFramework, err := policyHandler.getters.PolicyGetter.GetFramework(rule.Name)
-			if err != nil {
-				return frameworks, policyDownloadError(err)
-			}
+	exceptionPolicies := []armotypes.PostureExceptionPolicy{}
+	// Get - cacli opa get
+	for _, rule := range notification.Rules {
+		switch rule.Kind {
+		case reporthandling.KindFramework:
+			receivedFramework, recExceptionPolicies, err := policyHandler.getFrameworkPolicies(rule.Name)
 			if receivedFramework != nil {
 				frameworks = append(frameworks, *receivedFramework)
+				if recExceptionPolicies != nil {
+					exceptionPolicies = append(exceptionPolicies, recExceptionPolicies...)
+				}
+			} else if err != nil {
+				if strings.Contains(err.Error(), "unsupported protocol scheme") {
+					err = fmt.Errorf("failed to download from GitHub release, try running with `--use-default` flag")
+				}
+				return nil, nil, fmt.Errorf("kind: %v, name: %s, error: %s", rule.Kind, rule.Name, err.Error())
 			}
-		}
-	case reporthandling.KindControl: // Download controls
-		f := reporthandling.Framework{}
-		var receivedControl *reporthandling.Control
-		var err error
-		for _, rule := range notification.Rules {
-			receivedControl, err = policyHandler.getters.PolicyGetter.GetControl(rule.Name)
-			if err != nil {
-				return frameworks, policyDownloadError(err)
+		case reporthandling.KindControl:
+			receivedControls, recExceptionPolicies, err := policyHandler.getControl(rule.Name)
+			if receivedControls != nil {
+				f := reporthandling.Framework{
+					Controls: receivedControls,
+				}
+				frameworks = append(frameworks, f)
+				if recExceptionPolicies != nil {
+					exceptionPolicies = append(exceptionPolicies, recExceptionPolicies...)
+				}
+			} else if err != nil {
+				if strings.Contains(err.Error(), "unsupported protocol scheme") {
+					err = fmt.Errorf("failed to download from GitHub release, try running with `--use-default` flag")
+				}
+				return nil, nil, fmt.Errorf("error: %s", err.Error())
 			}
+			// TODO: add case for control from file
+		default:
+			err := fmt.Errorf("missing rule kind, expected: %s", reporthandling.KindFramework)
+			errs = fmt.Errorf("%s", err.Error())
 		}
-		if receivedControl != nil {
-			f.Controls = append(f.Controls, *receivedControl)
-		}
-		frameworks = append(frameworks, f)
-		// TODO: add case for control from file
-	default:
-		return frameworks, fmt.Errorf("unknown policy kind")
 	}
-	return frameworks, nil
+	return frameworks, exceptionPolicies, errs
+}
+
+func (policyHandler *PolicyHandler) getFrameworkPolicies(policyName string) (*reporthandling.Framework, []armotypes.PostureExceptionPolicy, error) {
+	receivedFramework, err := policyHandler.getters.PolicyGetter.GetFramework(policyName)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	receivedException, err := policyHandler.getters.ExceptionsGetter.GetExceptions(cautils.CustomerGUID, cautils.ClusterName)
+	if err != nil {
+		return receivedFramework, nil, err
+	}
+
+	return receivedFramework, receivedException, nil
+}
+
+// Get control by name
+func (policyHandler *PolicyHandler) getControl(policyName string) ([]reporthandling.Control, []armotypes.PostureExceptionPolicy, error) {
+
+	controls := []reporthandling.Control{}
+
+	control, err := policyHandler.getters.PolicyGetter.GetControl(policyName)
+	if err != nil {
+		return nil, nil, err
+	}
+	if control == nil {
+		return nil, nil, fmt.Errorf("control not found")
+	}
+	controls = append(controls, *control)
+
+	exceptions, err := policyHandler.getters.ExceptionsGetter.GetExceptions(cautils.CustomerGUID, cautils.ClusterName)
+	if err != nil {
+		return controls, nil, err
+	}
+
+	return controls, exceptions, nil
 }

policyhandler/handlepullpoliciesutils.go

@@ -1,21 +0,0 @@
-package policyhandler
-
-import (
-	"fmt"
-	"strings"
-
-	"github.com/armosec/opa-utils/reporthandling"
-)
-
-func getScanKind(notification *reporthandling.PolicyNotification) reporthandling.NotificationPolicyKind {
-	if len(notification.Rules) > 0 {
-		return notification.Rules[0].Kind
-	}
-	return "unknown"
-}
-func policyDownloadError(err error) error {
-	if strings.Contains(err.Error(), "unsupported protocol scheme") {
-		err = fmt.Errorf("failed to download from GitHub release, try running with `--use-default` flag")
-	}
-	return err
-}

resultshandling/printer/jsonprinter.go

@@ -25,15 +25,7 @@ func (jsonPrinter *JsonPrinter) Score(score float32) {
 }
 
 func (jsonPrinter *JsonPrinter) ActionPrint(opaSessionObj *cautils.OPASessionObj) {
-	var postureReportStr []byte
-	var err error
-
-	if len(opaSessionObj.PostureReport.FrameworkReports) == 1 {
-		postureReportStr, err = json.Marshal(opaSessionObj.PostureReport.FrameworkReports[0])
-	} else {
-		postureReportStr, err = json.Marshal(opaSessionObj.PostureReport.FrameworkReports)
-	}
-
+	postureReportStr, err := json.Marshal(opaSessionObj.PostureReport.FrameworkReports[0])
 	if err != nil {
 		fmt.Println("Failed to convert posture report object!")
 		os.Exit(1)

resultshandling/printer/prettyprinter.go

@@ -24,25 +24,12 @@ func NewPrettyPrinter() *PrettyPrinter {
 	}
 }
 
-// Initializes empty printer for new table
-func (printer *PrettyPrinter) init() *PrettyPrinter {
-	printer.frameworkSummary = ControlSummary{}
-	printer.summary = Summary{}
-	printer.sortedControlNames = []string{}
-	return printer
-}
-
 func (printer *PrettyPrinter) ActionPrint(opaSessionObj *cautils.OPASessionObj) {
 	// score := calculatePostureScore(opaSessionObj.PostureReport)
-	for _, report := range opaSessionObj.PostureReport.FrameworkReports {
-		// Print summary table together for control scan
-		if report.Name != "" {
-			printer = printer.init()
-		}
-		printer.summarySetup(report)
-		printer.printResults()
-		printer.printSummaryTable(report.Name)
-	}
+
+	printer.summarySetup(opaSessionObj.PostureReport)
+	printer.printResults()
+	printer.printSummaryTable()
 
 	// return score
 }
@@ -54,27 +41,29 @@ func (printer *PrettyPrinter) SetWriter(outputFile string) {
 func (printer *PrettyPrinter) Score(score float32) {
 }
 
-func (printer *PrettyPrinter) summarySetup(fr reporthandling.FrameworkReport) {
-	printer.frameworkSummary = ControlSummary{
-		TotalResources: fr.GetNumberOfResources(),
-		TotalFailed:    fr.GetNumberOfFailedResources(),
-		TotalWarnign:   fr.GetNumberOfWarningResources(),
-	}
-	for _, cr := range fr.ControlReports {
-		if len(cr.RuleReports) == 0 {
-			continue
+func (printer *PrettyPrinter) summarySetup(postureReport *reporthandling.PostureReport) {
+	for _, fr := range postureReport.FrameworkReports {
+		printer.frameworkSummary = ControlSummary{
+			TotalResources: fr.GetNumberOfResources(),
+			TotalFailed:    fr.GetNumberOfFailedResources(),
+			TotalWarnign:   fr.GetNumberOfWarningResources(),
 		}
-		workloadsSummary := listResultSummary(cr.RuleReports)
+		for _, cr := range fr.ControlReports {
+			if len(cr.RuleReports) == 0 {
+				continue
+			}
+			workloadsSummary := listResultSummary(cr.RuleReports)
 
-		printer.summary[cr.Name] = ControlSummary{
-			TotalResources:    cr.GetNumberOfResources(),
-			TotalFailed:       cr.GetNumberOfFailedResources(),
-			TotalWarnign:      cr.GetNumberOfWarningResources(),
-			FailedWorkloads:   groupByNamespace(workloadsSummary, workloadSummaryFailed),
-			ExcludedWorkloads: groupByNamespace(workloadsSummary, workloadSummaryExclude),
-			Description:       cr.Description,
-			Remediation:       cr.Remediation,
-			ListInputKinds:    cr.ListControlsInputKinds(),
+			printer.summary[cr.Name] = ControlSummary{
+				TotalResources:    cr.GetNumberOfResources(),
+				TotalFailed:       cr.GetNumberOfFailedResources(),
+				TotalWarnign:      cr.GetNumberOfWarningResources(),
+				FailedWorkloads:   groupByNamespace(workloadsSummary, workloadSummaryFailed),
+				ExcludedWorkloads: groupByNamespace(workloadsSummary, workloadSummaryExclude),
+				Description:       cr.Description,
+				Remediation:       cr.Remediation,
+				ListInputKinds:    cr.ListControlsInputKinds(),
+			}
 		}
 	}
 	printer.sortedControlNames = printer.getSortedControlsNames()
@@ -190,10 +179,7 @@ func generateFooter(numControlers, sumFailed, sumWarning, sumTotal int) []string
 	}
 	return row
 }
-func (printer *PrettyPrinter) printSummaryTable(framework string) {
-	// For control scan framework will be nil
-	printer.printFramework(framework)
-
+func (printer *PrettyPrinter) printSummaryTable() {
 	summaryTable := tablewriter.NewWriter(printer.writer)
 	summaryTable.SetAutoWrapText(false)
 	summaryTable.SetHeader(generateHeader())
@@ -209,12 +195,6 @@ func (printer *PrettyPrinter) printSummaryTable(framework string) {
 	summaryTable.Render()
 }
 
-func (printer *PrettyPrinter) printFramework(framework string) {
-	if framework != "" {
-		cautils.InfoTextDisplay(printer.writer, fmt.Sprintf("%s FRAMEWORK\n", framework))
-	}
-}
-
 func (printer *PrettyPrinter) getSortedControlsNames() []string {
 	controlNames := make([]string, 0, len(printer.summary))
 	for k := range printer.summary {

resultshandling/printer/printresults.go

@@ -11,8 +11,7 @@ const EmptyPercentage = "NaN"
 const (
 	PrettyFormat       string = "pretty-printer"
 	JsonFormat         string = "json"
-	JunitResultFormat  string = "junit"
-	PrometheusFormat   string = "prometheus"
+	JunitResultPrinter string = "junit"
 )
 
 type IPrinter interface {
@@ -25,10 +24,8 @@ func GetPrinter(printFormat string) IPrinter {
 	switch printFormat {
 	case JsonFormat:
 		return NewJsonPrinter()
-	case JunitResultFormat:
+	case JunitResultPrinter:
 		return NewJunitPrinter()
-	case PrometheusFormat:
-		return NewPrometheusPrinter()
 	default:
 		return NewPrettyPrinter()
 	}

resultshandling/printer/prometheusprinter.go

@@ -1,100 +0,0 @@
-package printer
-
-import (
-	"errors"
-	"fmt"
-	"os"
-
-	"github.com/armosec/kubescape/cautils"
-	"github.com/armosec/opa-utils/reporthandling"
-)
-
-type PrometheusPrinter struct {
-	writer *os.File
-}
-
-func NewPrometheusPrinter() *PrometheusPrinter {
-	return &PrometheusPrinter{}
-}
-
-func (prometheusPrinter *PrometheusPrinter) SetWriter(outputFile string) {
-	prometheusPrinter.writer = getWriter(outputFile)
-}
-
-func (prometheusPrinter *PrometheusPrinter) Score(score float32) {
-	fmt.Printf("\n# Overall score out of 100\nkubescape_score %f\n", score*100)
-}
-
-func (printer *PrometheusPrinter) printDetails(details []reporthandling.RuleResponse, frameworkName string, controlName string) error {
-	objs := make(map[string]map[string]map[string]int)
-	for _, ruleResponses := range details {
-		for _, k8sObj := range ruleResponses.AlertObject.K8SApiObjects {
-			kind, ok := k8sObj[`kind`].(string)
-			if (!ok) {
-				return errors.New("Found object with non string kind")
-			}
-			apiVersion,ok := k8sObj[`apiVersion`].(string)
-			if (!ok) {
-				return errors.New("Found object with non string apiVersion")
-			}
-			gvk := fmt.Sprintf("%s/%s",apiVersion,kind)
-			metadata,ok := k8sObj[`metadata`].(map[string]interface{})
-			if (!ok) {
-				return errors.New("Found object with non convertable metadata")
-			}
-			name,ok := metadata[`name`].(string)
-			if (!ok) {
-				return errors.New("Found metadata with non string name")
-			}
-			namespace,ok := metadata[`namespace`].(string)
-			if (!ok) {
-				namespace = ""
-			}
-			if (objs[gvk] == nil) {
-				objs[gvk] = make(map[string]map[string]int)
-			}
-			if (objs[gvk][namespace] == nil) {
-				objs[gvk][namespace] = make(map[string]int)
-			}
-			objs[gvk][namespace][name]++
-		}
-	}
-	for gvk, namespaces := range objs {
-		for namespace, names := range namespaces {
-			for name, value := range names {
-				fmt.Fprintf(printer.writer, "# Failed object from %s control %s\n", frameworkName, controlName)
-				if namespace != "" {
-					fmt.Fprintf(printer.writer, "kubescape_object_failed_count{framework=\"%s\",control=\"%s\",namespace=\"%s\",name=\"%s\",groupVersionKind=\"%s\"} %d\n", frameworkName, controlName, namespace, name, gvk, value)
-				} else {
-					fmt.Fprintf(printer.writer, "kubescape_object_failed_count{framework=\"%s\",control=\"%s\",name=\"%s\",groupVersionKind=\"%s\"} %d\n", frameworkName, controlName, name, gvk, value)
-				}
-			}
-		}
-	}
-	return nil
-}
-
-func (printer *PrometheusPrinter) printReports(frameworks []reporthandling.FrameworkReport) error {
-	for _, framework := range frameworks {
-		for _, controlReports := range framework.ControlReports {
-			if len(controlReports.RuleReports[0].RuleResponses) > 0 {
-				fmt.Fprintf(printer.writer, "# Number of resources found as part of %s control %s\nkubescape_resources_found_count{framework=\"%s\",control=\"%s\"} %d\n", framework.Name, controlReports.Name, framework.Name, controlReports.Name, controlReports.GetNumberOfResources())
-				fmt.Fprintf(printer.writer, "# Number of resources excluded as part of %s control %s\nkubescape_resources_excluded_count{framework=\"%s\",control=\"%s\"} %d\n", framework.Name, controlReports.Name, framework.Name, controlReports.Name, controlReports.GetNumberOfWarningResources())
-				fmt.Fprintf(printer.writer, "# Number of resources failed as part of %s control %s\nkubescape_resources_failed_count{framework=\"%s\",control=\"%s\"} %d\n", framework.Name, controlReports.Name, framework.Name, controlReports.Name, controlReports.GetNumberOfFailedResources())
-				err := printer.printDetails(controlReports.RuleReports[0].RuleResponses, framework.Name, controlReports.Name)
-				if err != nil {
-					return err
-				}
-			}
-		}
-	}
-	return nil
-}
-
-func (printer *PrometheusPrinter) ActionPrint(opaSessionObj *cautils.OPASessionObj) {
-	err := printer.printReports(opaSessionObj.PostureReport.FrameworkReports)
-	if err != nil {
-		fmt.Println(err)
-		os.Exit(1)
-	}
-}

smoke_testing/init.py

@@ -1,18 +0,0 @@
-import sys
-import smoke_utils
-
-
-tests_pkg = [
-    "test_command"
-    , "test_version"
-]
-
-
-def run(**kwargs):
-    for i in tests_pkg:
-        m = __import__(i)
-        m.run(**kwargs)
-
-
-if __name__ == "__main__":
-    run(kubescape_exec=smoke_utils.get_exec_from_args(sys.argv))

smoke_testing/smoke_utils.py

@@ -1,34 +0,0 @@
-import platform
-from os import path
-from sys import stderr
-
-
-def get_build_dir():
-    current_platform = platform.system()
-    build_dir = "build/"
-
-    if current_platform == "Windows": build_dir += "windows-latest"
-    elif current_platform == "Linux": build_dir += "ubuntu-latest"
-    elif current_platform == "Darwin": build_dir += "macos-latest"
-    else: raise OSError(f"Platform {current_platform} is not supported!")
-
-    return build_dir
-
-
-def get_package_name():
-    return "kubescape"
-
-
-def get_bin_cli():
-    return path.abspath(path.join(get_build_dir(), get_package_name()))
-
-
-def check_status(status, msg):
-    if status != 0:
-        stderr.write(msg)
-        exit(status)
-
-
-def get_exec_from_args(args: list):
-    return args[1]
-

smoke_testing/test_command.py

@@ -1,31 +0,0 @@
-import subprocess
-import smoke_utils
-import sys
-
-
-def test_command(command: list):
-    print(f"Testing \"{' '.join(command[1:])}\" command")
-
-    msg = str(subprocess.check_output(command))
-    assert "unknown command" not in msg, f"{command[1:]} is missing: {msg}"
-    assert "invalid parameter" not in msg, f"{command[1:]} is invalid: {msg}"
-
-    print(f"Done testing \"{' '.join(command[1:])}\" command")
-
-
-def run(kubescape_exec:str):
-    print("Testing supported commands")
-
-    test_command(command=[kubescape_exec, "version"])
-    test_command(command=[kubescape_exec, "download"])
-    test_command(command=[kubescape_exec, "config"])
-    test_command(command=[kubescape_exec, "help"])
-    test_command(command=[kubescape_exec, "scan"])
-    test_command(command=[kubescape_exec, "scan", "framework"])
-    test_command(command=[kubescape_exec, "scan", "control"])
-    
-    print("Done testing commands")
-
-
-if __name__ == "__main__":
-    run(kubescape_exec=smoke_utils.get_exec_from_args(sys.argv))

smoke_testing/test_version.py

@@ -1,18 +0,0 @@
-import os
-import subprocess
-import smoke_utils
-import sys
-
-
-def run(kubescape_exec:str):
-    print("Testing version")
-
-    ver = os.getenv("RELEASE")
-    msg = str(subprocess.check_output([kubescape_exec, "version"]))
-    assert ver in msg, f"expected version: {ver}, found: {msg}"
-
-    print("Done testing version")
-
-
-if __name__ == "__main__":
-    run(kubescape_exec=smoke_utils.get_exec_from_args(sys.argv))