host scanner with fixed version

- github action (uncommented)

Signed-off-by: Dipankar Das <dipankardas0115@gmail.com>

Signed-off-by: Dipankar Das <dipankardas0115@gmail.com>

.github/workflows/build.yaml

@@ -36,7 +36,7 @@ jobs:
           submodules: recursive
 
       - name: Cache Go modules (Linux)
-        if: matrix.os == 'ubuntu-latest' 
+        if: matrix.os == 'ubuntu-latest'
         uses: actions/cache@v3
         with:
           path: |
@@ -47,7 +47,7 @@ jobs:
             ${{ runner.os }}-go-
 
       - name: Cache Go modules (macOS)
-        if: matrix.os == 'macos-latest' 
+        if: matrix.os == 'macos-latest'
         uses: actions/cache@v3
         with:
           path: |
@@ -72,8 +72,6 @@ jobs:
         uses: actions/setup-go@v3
         with:
           go-version: 1.18
-      # - name: Test cmd pkg
-      #   run: cd cmd && go test -v ./...
 
       - name: Install MSYS2 & libgit2 (Windows)
         shell: cmd
@@ -94,14 +92,14 @@ jobs:
 
       - name: Build
         env:
-          RELEASE: v2.0.${{ github.run_number }} 
+          RELEASE: v2.0.${{ github.run_number }}
           CLIENT: release
           CGO_ENABLED: 1
         run: python3 --version && python3 build.py
-      
+
       - name: Smoke Testing
         env:
-          RELEASE: v2.0.${{ github.run_number }} 
+          RELEASE: v2.0.${{ github.run_number }}
           KUBESCAPE_SKIP_UPDATE_CHECK: "true"
         run: python3 smoke_testing/init.py ${PWD}/build/${{ matrix.os }}/kubescape
 
@@ -137,7 +135,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
           submodules: recursive
 
@@ -164,22 +162,14 @@ jobs:
       - name: Build the Docker image
         run: docker buildx build . --file build/Dockerfile --tag ${{ steps.image-name.outputs.IMAGE_NAME }}:${{ steps.image-version.outputs.IMAGE_VERSION }} --tag ${{ steps.image-name.outputs.IMAGE_NAME }}:latest --build-arg image_version=${{ steps.image-version.outputs.IMAGE_VERSION }} --build-arg client=image-release --push --platform linux/amd64,linux/arm64
 
-      # - name: Login to GitHub Container Registry
-      #   uses: docker/login-action@v1
-      #   with:
-      #     registry: ghcr.io
-      #     username: ${{ github.actor }}
-      #     password: ${{ secrets.GITHUB_TOKEN }}
-    
-      # TODO - Wait for casign to support fixed tags -> https://github.com/sigstore/cosign/issues/1424
-      # - name: Install cosign
-      #   uses: sigstore/cosign-installer@main
-      #   with:
-      #     cosign-release: 'v1.5.1' # optional
-      # - name: sign kubescape container image
-      #   env:
-      #     COSIGN_EXPERIMENTAL: "true"
-      #   run: |
-      #       cosign sign --force ${{ steps.image-name.outputs.IMAGE_NAME }}:latest
-      #       cosign sign --force ${{ steps.image-name.outputs.IMAGE_NAME }}:${{ steps.image-version.outputs.IMAGE_VERSION }}
+      - name: Install cosign
+        uses: sigstore/cosign-installer@main
+        with:
+          cosign-release: 'v1.12.0'
+      - name: sign kubescape container image
+        env:
+          COSIGN_EXPERIMENTAL: "true"
+        run: |
+            cosign sign --force ${{ steps.image-name.outputs.IMAGE_NAME }}:latest
+            cosign sign --force ${{ steps.image-name.outputs.IMAGE_NAME }}:${{ steps.image-version.outputs.IMAGE_VERSION }}
 

README.md

@@ -389,7 +389,7 @@ View Kubescape scan results directly in [Lens IDE](https://k8slens.dev/) using k
 
 * Apply changes you wish to make to the kubescape directory using text editors like `Vim`.
 * [Build on Linux](https://github.com/kubescape/kubescape#build-on-linuxmacos)
-* Now, you can use Kubescape just like a normal user. Instead of using `kubescape`, use `./kubescape`. (Make sure you are inside kubescape directory because the command will execute the binary named `kubescape` in `kubescape directory`.
+* Now, you can use Kubescape just like a normal user. Instead of using `kubescape`, use `./kubescape`. (Make sure you are inside kubescape directory because the command will execute the binary named `kubescape` in `kubescape directory`)
 
 </details>
 

build/Dockerfile

@@ -35,15 +35,15 @@ RUN /work/build/ubuntu-latest/kubescape download artifacts -o /work/artifacts
 
 FROM alpine:3.16.2
 
-RUN addgroup -S armo && adduser -S armo -G armo
+RUN addgroup -S ks && adduser -S ks -G ks
 
-COPY --from=builder /work/artifacts/ /home/armo/.kubescape
+COPY --from=builder /work/artifacts/ /home/ks/.kubescape
 
-RUN chown -R armo:armo /home/armo/.kubescape
+RUN chown -R ks:ks /home/ks/.kubescape
 
-USER armo
+USER ks
 
-WORKDIR /home/armo
+WORKDIR /home/ks
 
 COPY --from=builder /work/httphandler/build/ubuntu-latest/kubescape /usr/bin/ksserver
 COPY --from=builder /work/build/ubuntu-latest/kubescape /usr/bin/kubescape

core/pkg/hostsensorutils/hostsensor.yaml

@@ -33,7 +33,7 @@ spec:
         effect: NoSchedule
       containers:
       - name: host-sensor
-        image: quay.io/kubescape/host-scanner:latest
+        image: quay.io/kubescape/host-scanner:v1.0.28
         securityContext:
           privileged: true
           readOnlyRootFilesystem: true

core/pkg/registryadaptors/registryvulnerabilities/interfaces.go

@@ -1,11 +1,11 @@
 package registryvulnerabilities
 
 type IContainerImageVulnerabilityAdaptor interface {
-	// Credentials are coming from user input (CLI or configuration file) and they are abstracted at string to string map level
+	// Login Credentials are coming from user input (CLI or configuration file) and they are abstracted at string to string map level
 	// so and example use would be like registry: "simpledockerregistry:80" and credentials like {"username":"joedoe","password":"abcd1234"}
 	Login() error
 
-	// For "help" purposes
+	// DescribeAdaptor For "help" purposes
 	DescribeAdaptor() string
 
 	GetImagesScanStatus(imageIDs []ContainerImageIdentifier) ([]ContainerImageScanStatus, error)

core/pkg/resourcehandler/k8sresources.go

@@ -79,9 +79,14 @@ func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessio
 		sessionObj.SetNumberOfWorkerNodes(numberOfWorkerNodes)
 	}
 
+	cautils.StopSpinner()
+	logger.L().Success("Accessed to Kubernetes objects")
+
 	imgVulnResources := cautils.MapImageVulnResources(ksResourceMap)
 	// check that controls use image vulnerability resources
-	if len(imgVulnResources) > 0 {
+	if false { //len(imgVulnResources) > 0 {
+		logger.L().Info("Requesting images vulnerabilities results")
+		cautils.StartSpinner()
 		if err := k8sHandler.registryAdaptors.collectImagesVulnerabilities(k8sResourcesMap, allResources, ksResourceMap); err != nil {
 			logger.L().Warning("failed to collect image vulnerabilities", helpers.Error(err))
 			cautils.SetInfoMapForResources(fmt.Sprintf("failed to pull image scanning data: %s. for more information: https://hub.armosec.io/docs/configuration-of-image-vulnerabilities", err.Error()), imgVulnResources, sessionObj.InfoMap)
@@ -90,11 +95,15 @@ func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessio
 				cautils.SetInfoMapForResources("image scanning is not configured. for more information: https://hub.armosec.io/docs/configuration-of-image-vulnerabilities", imgVulnResources, sessionObj.InfoMap)
 			}
 		}
+		cautils.StopSpinner()
+		logger.L().Success("Requested images vulnerabilities results")
 	}
 
 	hostResources := cautils.MapHostResources(ksResourceMap)
 	// check that controls use host sensor resources
 	if len(hostResources) > 0 {
+		logger.L().Info("Requesting Host scanner data")
+		cautils.StartSpinner()
 		if sessionObj.Metadata.ScanMetadata.HostScanner {
 			infoMap, err := k8sHandler.collectHostResources(allResources, ksResourceMap)
 			if err != nil {
@@ -108,6 +117,8 @@ func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessio
 					sessionObj.InfoMap = infoMap
 				}
 			}
+			cautils.StopSpinner()
+			logger.L().Success("Requested Host scanner data")
 		} else {
 			cautils.SetInfoMapForResources("enable-host-scan flag not used. For more information: https://hub.armosec.io/docs/host-sensor", hostResources, sessionObj.InfoMap)
 		}
@@ -123,6 +134,8 @@ func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessio
 
 	// check that controls use cloud resources
 	if len(cloudResources) > 0 {
+		logger.L().Info("Requesting cloud provider data")
+		cautils.StartSpinner()
 		provider, err := getCloudProviderDescription(allResources, ksResourceMap)
 		if err != nil {
 			cautils.SetInfoMapForResources(err.Error(), cloudResources, sessionObj.InfoMap)
@@ -133,11 +146,10 @@ func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessio
 				sessionObj.Metadata.ContextMetadata.ClusterContextMetadata.CloudProvider = provider
 			}
 		}
+		cautils.StopSpinner()
+		logger.L().Info("Requested cloud provider data")
 	}
 
-	cautils.StopSpinner()
-	logger.L().Success("Accessed to Kubernetes objects")
-
 	return k8sResourcesMap, allResources, ksResourceMap, nil
 }
 

core/pkg/score/score.go

@@ -28,8 +28,7 @@ const (
 )
 
 func (su *ScoreWrapper) Calculate(reportVersion PostureReportVersion) error {
-	switch reportVersion {
-	case EPostureReportV2:
+	if reportVersion == EPostureReportV2 {
 		return su.scoreUtil.CalculatePostureReportV2(su.opaSessionObj.Report)
 	}
 

docs/roadmap.md

@@ -5,6 +5,7 @@
 Kubescape roadmap items are labeled based on where the feature is used and by their maturity.
 
 The features serve different stages of the workflow of the users:
+
 * **Development phase** (writing Kubernetes manifests) - example: The VS Code extension is used while editing YAMLs.
 * **CI phase** (integrating manifests to GIT repo) - example: GitHub action validating HELM charts on PRs.
 * **CD phase** (deploying applications in Kubernetes) - example: running a cluster scan after a new deployment.
@@ -19,49 +20,77 @@ The items in the Kubescape roadmap are split into 3 major groups based on the fe
 
 ## Planning 👷
 
-* ##### Storing scan results in cluster
-  We want Kubescape scan results (both cluster and image scan) to be stored in the cluster locally as `CRD`s. This will enable easier integration with results by other projects as well as with scripting via `kubectl`. This will also make image scan based controls to avoid accessing external resources for image vulnerability scan results.
+* ### Storing scan results in cluster
+
+  We want the Kubescape scan results (both cluster and image scan) to be stored in the cluster locally as `CRD`s. This will lead to an easier integration with results by other projects as well as with scripting via `kubectl`. Along with this, the image scan based controls will be able to avoid accessing external resources for image vulnerability scan results.
+
+* ### Vulnerability prioritization based on workload file activity
 
-* ##### Vulnerability prioritization based on workload file activity
   Implementing an eBPF agent (based on Falco or Tracee) which tracks file activity in workloads to prioritize container image vulnerabilities.
 
-* ##### Prioritization engine using MITRE Attack matrix based attack chains
+* ### Prioritization engine using MITRE Attack matrix based attack chains
+
   Create a security issue prioritization engine that scores resources based on control based attack chains. All Kubescape controls can be arranged into attack categories of the MITRE Attack matrix. The Attack matrix categories can be connected to each other based on a theoretical attack (ie. you can't have privilege escalation without initial access). Each of the Kubescape controls is to be categorized in these system and Kubescape will calculate a priority score based on the interconnections between failed controls.
 
-* ##### Integration with image registries 
+* ### Integration with image registries
+
  We want to expand Kubescape to integrate with different image registries and read image vulnerability information from there. This will allow Kubescape to give contextual security information about vulnerabilities. Container registry integration.
-* ##### Kubescape CLI control over cluster operations 
+
+* ### Kubescape CLI control over cluster operations
+
   Add functionality to Kubescape CLI to trigger operations in Kubescape cluster components (example: trigger image scans, etc.)
-* ##### Git integration for pull requests 
+  
+* ### Git integration for pull requests
+
   Create insightful GitHub actions for Kubescape.
 
-
 ## Backlog 📅
-* ##### JSON path for HELM charts 
+
+* ### JSON path for HELM charts
+
   Today, Kubescape can point to issues in the Kubernetes object. We want to develop this feature so Kubescape will be able to point to the misconfigured source file (HELM).
-* ##### Create Kubescape HELM plugin
+
+* ### Create Kubescape HELM plugin
+
   Producing scan results in the context of HELM.
-* ##### Kubescape based admission controller 
+
+* ### Kubescape based admission controller
+
   Implement admission controller API for Kubescape microservice to enable users to use Kubescape rules as policies.
 
 ## Wishlist 💭
-* ##### Integrate with other Kubernetes CLI tools
+
+* ### Integrate with other Kubernetes CLI tools
+
   Use Kubescape as a YAML validator for `kubectl` and others.
-* ##### Kubernetes audit log integration 
+
+* ### Kubernetes audit log integration
+
   Connect Kubescape to the audit log stream to enable it to produce more contextual security information based on how the API service is used.
-* ##### TUI for Kubescape 
+
+* ### TUI for Kubescape
+
   Interactive terminal based user interface which helps to analyze and fix issues.
-* ##### Scanning images with GO for vulnerabilities
+
+* ### Scanning images with GO for vulnerabilities
+
   Images scanners cannot determine which packages were used to build Go executables and we want to scan them for vulnerabilities.
-* ##### Scanning Dockerfile-s for security best practices
+
+* ### Scanning Dockerfile-s for security best practices
+
   Scan image or Dockerfile to determine whether it is using security best practices (like root containers).
-* ##### Custom controls and rules
+
+* ### Custom controls and rules
+
   Enable users to define their own Rego base rules.
-* ##### More CI/CD tool integration
+
+* ### More CI/CD tool integration
+
   Jenkins and etc. 😀
 
 
 ## Completed features 🎓
+
 * Kubelet configuration validation 
 * API server configuration validation
 * Image vulnerability scanning based controls