update auth url

Set number of worker nodes based on scheduable nodes (based on taints) & set status to 'skipped' when there are no image vulns

.github/workflows/build.yaml

@@ -101,28 +101,28 @@ jobs:
         id: image-name
         run: echo '::set-output name=IMAGE_NAME::quay.io/${{ github.repository_owner }}/kubescape'
 
-      - name: Build the Docker image
-        run: docker build . --file build/Dockerfile --tag ${{ steps.image-name.outputs.IMAGE_NAME }}:${{ steps.image-version.outputs.IMAGE_VERSION }} --build-arg image_version=${{ steps.image-version.outputs.IMAGE_VERSION }}
-      
-      - name: Re-Tag Image to latest
-        run: docker tag ${{ steps.image-name.outputs.IMAGE_NAME }}:${{ steps.image-version.outputs.IMAGE_VERSION }} ${{ steps.image-name.outputs.IMAGE_NAME }}:latest
-      
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
       - name: Login to Quay.io
-        env: # Or as an environment variable
+        env:
           QUAY_PASSWORD: ${{ secrets.QUAYIO_REGISTRY_PASSWORD }}
           QUAY_USERNAME: ${{ secrets.QUAYIO_REGISTRY_USERNAME }}
         run: docker login -u="${QUAY_USERNAME}" -p="${QUAY_PASSWORD}" quay.io
+
+      - name: Build the Docker image
+        run: docker buildx build . --file build/Dockerfile --tag ${{ steps.image-name.outputs.IMAGE_NAME }}:${{ steps.image-version.outputs.IMAGE_VERSION }} --tag ${{ steps.image-name.outputs.IMAGE_NAME }}:latest --build-arg image_version=${{ steps.image-version.outputs.IMAGE_VERSION }} --push --platform linux/amd64,linux/arm64
+
       # - name: Login to GitHub Container Registry
       #   uses: docker/login-action@v1
       #   with:
       #     registry: ghcr.io
       #     username: ${{ github.actor }}
       #     password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Push Docker image
-        run: |
-          docker push ${{ steps.image-name.outputs.IMAGE_NAME }}:${{ steps.image-version.outputs.IMAGE_VERSION }}
-          docker push ${{ steps.image-name.outputs.IMAGE_NAME }}:latest
-      
+    
       # TODO - Wait for casign to support fixed tags -> https://github.com/sigstore/cosign/issues/1424
       # - name: Install cosign
       #   uses: sigstore/cosign-installer@main

.github/workflows/build_dev.yaml

@@ -80,21 +80,17 @@ jobs:
         id: image-name
         run: echo '::set-output name=IMAGE_NAME::quay.io/${{ github.repository_owner }}/kubescape'
 
-      - name: Build the Docker image
-        run: docker build . --file build/Dockerfile --tag ${{ steps.image-name.outputs.IMAGE_NAME }}:${{ steps.image-version.outputs.IMAGE_VERSION }} --build-arg image_version=${{ steps.image-version.outputs.IMAGE_VERSION }}
-      
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
       - name: Login to Quay.io
         env:
           QUAY_PASSWORD: ${{ secrets.QUAYIO_REGISTRY_PASSWORD }}
           QUAY_USERNAME: ${{ secrets.QUAYIO_REGISTRY_USERNAME }}
         run: docker login -u="${QUAY_USERNAME}" -p="${QUAY_PASSWORD}" quay.io
-      # - name: Login to GitHub Container Registry
-      #   uses: docker/login-action@v1
-      #   with:
-      #     registry: ghcr.io
-      #     username: ${{ github.actor }}
-      #     password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Push Docker image
-        run: |
-          docker push ${{ steps.image-name.outputs.IMAGE_NAME }}:${{ steps.image-version.outputs.IMAGE_VERSION }}
-      
+
+      - name: Build the Docker image
+        run: docker buildx build . --file build/Dockerfile --tag ${{ steps.image-name.outputs.IMAGE_NAME }}:${{ steps.image-version.outputs.IMAGE_VERSION }} --build-arg image_version=${{ steps.image-version.outputs.IMAGE_VERSION }} --push --platform linux/amd64,linux/arm64

cmd/scan/scan.go

@@ -91,7 +91,7 @@ func GetScanCommand(ks meta.IKubescape) *cobra.Command {
 	scanCmd.PersistentFlags().MarkHidden("silent")         // this flag should be deprecated since we added the --logger support
 	// scanCmd.PersistentFlags().MarkHidden("format-version") // meant for testing different output approaches and not for common use
 
-	hostF := scanCmd.PersistentFlags().VarPF(&scanInfo.HostSensorEnabled, "enable-host-scan", "", "Deploy ARMO K8s host-sensor daemonset in the scanned cluster. Deleting it right after we collecting the data. Required to collect valuable data from cluster nodes for certain controls. Yaml file: https://raw.githubusercontent.com/armosec/kubescape/master/hostsensorutils/hostsensor.yaml")
+	hostF := scanCmd.PersistentFlags().VarPF(&scanInfo.HostSensorEnabled, "enable-host-scan", "", "Deploy ARMO K8s host-sensor daemonset in the scanned cluster. Deleting it right after we collecting the data. Required to collect valuable data from cluster nodes for certain controls. Yaml file: https://github.com/armosec/kubescape/blob/master/core/pkg/hostsensorutils/hostsensor.yaml")
 	hostF.NoOptDefVal = "true"
 	hostF.DefValue = "false, for no TTY in stdin"
 

core/cautils/customerloader.go

@@ -288,9 +288,13 @@ func (c *ClusterConfig) loadConfigFromConfigMap() (*ConfigObj, error) {
 		return nil, err
 	}
 
+	if jsonConf, ok := configMap.Data["config.json"]; ok {
+		return readConfig([]byte(jsonConf))
+	}
 	if bData, err := json.Marshal(configMap.Data); err == nil {
 		return readConfig(bData)
 	}
+
 	return nil, nil
 }
 

core/cautils/getter/armoapi.go

@@ -147,7 +147,8 @@ func (armoAPI *ArmoAPI) IsLoggedIn() bool              { return armoAPI.loggedIn
 func (armoAPI *ArmoAPI) GetClientID() string           { return armoAPI.clientID }
 func (armoAPI *ArmoAPI) GetSecretKey() string          { return armoAPI.secretKey }
 func (armoAPI *ArmoAPI) GetFrontendURL() string        { return armoAPI.feURL }
-func (armoAPI *ArmoAPI) GetAPIURL() string             { return armoAPI.apiURL }
+func (armoAPI *ArmoAPI) GetApiURL() string             { return armoAPI.apiURL }
+func (armoAPI *ArmoAPI) GetAuthURL() string            { return armoAPI.authURL }
 func (armoAPI *ArmoAPI) GetReportReceiverURL() string  { return armoAPI.erURL }
 func (armoAPI *ArmoAPI) SetAccountID(accountID string) { armoAPI.accountID = accountID }
 func (armoAPI *ArmoAPI) SetClientID(clientID string)   { armoAPI.clientID = clientID }

core/cautils/getter/armoapiutils.go

@@ -13,8 +13,7 @@ var NativeFrameworks = []string{"nsa", "mitre", "armobest", "devopsbest"}
 
 func (armoAPI *ArmoAPI) getFrameworkURL(frameworkName string) string {
 	u := url.URL{}
-	u.Scheme = "https"
-	u.Host = armoAPI.apiURL
+	u.Scheme, u.Host = parseHost(armoAPI.GetApiURL())
 	u.Path = "api/v1/armoFrameworks"
 	q := u.Query()
 	q.Add("customerGUID", armoAPI.getCustomerGUIDFallBack())
@@ -31,8 +30,7 @@ func (armoAPI *ArmoAPI) getFrameworkURL(frameworkName string) string {
 
 func (armoAPI *ArmoAPI) getListFrameworkURL() string {
 	u := url.URL{}
-	u.Scheme = "https"
-	u.Host = armoAPI.apiURL
+	u.Scheme, u.Host = parseHost(armoAPI.GetApiURL())
 	u.Path = "api/v1/armoFrameworks"
 	q := u.Query()
 	q.Add("customerGUID", armoAPI.getCustomerGUIDFallBack())
@@ -42,8 +40,7 @@ func (armoAPI *ArmoAPI) getListFrameworkURL() string {
 }
 func (armoAPI *ArmoAPI) getExceptionsURL(clusterName string) string {
 	u := url.URL{}
-	u.Scheme = "https"
-	u.Host = armoAPI.apiURL
+	u.Scheme, u.Host = parseHost(armoAPI.GetApiURL())
 	u.Path = "api/v1/armoPostureExceptions"
 
 	q := u.Query()
@@ -58,8 +55,7 @@ func (armoAPI *ArmoAPI) getExceptionsURL(clusterName string) string {
 
 func (armoAPI *ArmoAPI) exceptionsURL(exceptionsPolicyName string) string {
 	u := url.URL{}
-	u.Scheme = "https"
-	u.Host = armoAPI.apiURL
+	u.Scheme, u.Host = parseHost(armoAPI.GetApiURL())
 	u.Path = "api/v1/postureExceptionPolicy"
 
 	q := u.Query()
@@ -81,8 +77,7 @@ func (armoAPI *ArmoAPI) getAccountConfigDefault(clusterName string) string {
 
 func (armoAPI *ArmoAPI) getAccountConfig(clusterName string) string {
 	u := url.URL{}
-	u.Scheme = "https"
-	u.Host = armoAPI.apiURL
+	u.Scheme, u.Host = parseHost(armoAPI.GetApiURL())
 	u.Path = "api/v1/armoCustomerConfiguration"
 
 	q := u.Query()
@@ -97,24 +92,21 @@ func (armoAPI *ArmoAPI) getAccountConfig(clusterName string) string {
 
 func (armoAPI *ArmoAPI) getAccountURL() string {
 	u := url.URL{}
-	u.Scheme = "https"
-	u.Host = armoAPI.apiURL
+	u.Scheme, u.Host = parseHost(armoAPI.GetApiURL())
 	u.Path = "api/v1/createTenant"
 	return u.String()
 }
 
 func (armoAPI *ArmoAPI) getApiToken() string {
 	u := url.URL{}
-	u.Scheme = "https"
-	u.Host = armoAPI.authURL
-	u.Path = "frontegg/identity/resources/auth/v1/api-token"
+	u.Scheme, u.Host = parseHost(armoAPI.GetAuthURL())
+	u.Path = "identity/resources/auth/v1/api-token"
 	return u.String()
 }
 
 func (armoAPI *ArmoAPI) getOpenidCustomers() string {
 	u := url.URL{}
-	u.Scheme = "https"
-	u.Host = armoAPI.apiURL
+	u.Scheme, u.Host = parseHost(armoAPI.GetApiURL())
 	u.Path = "api/v1/openid_customers"
 	return u.String()
 }
@@ -173,3 +165,12 @@ func (armoAPI *ArmoAPI) getCustomerGUIDFallBack() string {
 	}
 	return "11111111-1111-1111-1111-111111111111"
 }
+
+func parseHost(host string) (string, string) {
+	if strings.HasPrefix(host, "http://") {
+		return "http", strings.Replace(host, "http://", "", 1)
+	}
+
+	// default scheme
+	return "https", strings.Replace(host, "https://", "", 1)
+}

core/pkg/hostsensorutils/utils.go

@@ -14,7 +14,7 @@ var (
 	LinuxKernelVariables         = "LinuxKernelVariables"
 	KubeletCommandLine           = "KubeletCommandLine"
 
-	MapResourceToApiGroup = map[string]string{
+	MapHostSensorResourceToApiGroup = map[string]string{
 		KubeletConfiguration:         "hostdata.kubescape.cloud/v1beta0",
 		OsReleaseFile:                "hostdata.kubescape.cloud/v1beta0",
 		KubeletCommandLine:           "hostdata.kubescape.cloud/v1beta0",
@@ -26,7 +26,7 @@ var (
 )
 
 func addInfoToMap(resource string, infoMap map[string]apis.StatusInfo, err error) {
-	group, version := k8sinterface.SplitApiVersion(MapResourceToApiGroup[resource])
+	group, version := k8sinterface.SplitApiVersion(MapHostSensorResourceToApiGroup[resource])
 	r := k8sinterface.JoinResourceTriplets(group, version, resource)
 	infoMap[r] = apis.StatusInfo{
 		InnerStatus: apis.StatusSkipped,

core/pkg/registryadaptors/armosec/v1/civarmoadaptor.go

@@ -51,7 +51,7 @@ func (armoCivAdaptor *ArmoCivAdaptor) GetImageVulnerability(imageID *registryvul
 	pageNumber := 1
 	request := V2ListRequest{PageSize: &pageSize, PageNum: &pageNumber, InnerFilters: filter, OrderBy: "timestamp:desc"}
 	requestBody, _ := json.Marshal(request)
-	requestUrl := fmt.Sprintf("https://%s/api/v1/vulnerability/scanResultsDetails?customerGUID=%s", armoCivAdaptor.armoAPI.GetAPIURL(), armoCivAdaptor.armoAPI.GetAccountID())
+	requestUrl := fmt.Sprintf("https://%s/api/v1/vulnerability/scanResultsDetails?customerGUID=%s", armoCivAdaptor.armoAPI.GetApiURL(), armoCivAdaptor.armoAPI.GetAccountID())
 
 	resp, err := armoCivAdaptor.armoAPI.Post(requestUrl, map[string]string{"Content-Type": "application/json"}, requestBody)
 	if err != nil {

core/pkg/registryadaptors/armosec/v1/civarmoadaptorutils.go

@@ -14,7 +14,7 @@ func (armoCivAdaptor *ArmoCivAdaptor) getImageLastScanId(imageID *registryvulner
 	pageNumber := 1
 	request := V2ListRequest{PageSize: &pageSize, PageNum: &pageNumber, InnerFilters: filter, OrderBy: "timestamp:desc"}
 	requestBody, _ := json.Marshal(request)
-	requestUrl := fmt.Sprintf("https://%s/api/v1/vulnerability/scanResultsSumSummary?customerGUID=%s", armoCivAdaptor.armoAPI.GetAPIURL(), armoCivAdaptor.armoAPI.GetAccountID())
+	requestUrl := fmt.Sprintf("https://%s/api/v1/vulnerability/scanResultsSumSummary?customerGUID=%s", armoCivAdaptor.armoAPI.GetApiURL(), armoCivAdaptor.armoAPI.GetAccountID())
 
 	resp, err := armoCivAdaptor.armoAPI.Post(requestUrl, map[string]string{"Content-Type": "application/json"}, requestBody)
 	if err != nil {

core/pkg/resourcehandler/k8sresources.go

@@ -18,6 +18,7 @@ import (
 
 	"github.com/armosec/armoapi-go/armotypes"
 
+	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	k8slabels "k8s.io/apimachinery/pkg/labels"
@@ -86,6 +87,9 @@ func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessio
 		if err := k8sHandler.registryAdaptors.collectImagesVulnerabilities(k8sResourcesMap, allResources, armoResourceMap); err != nil {
 			logger.L().Warning("failed to collect image vulnerabilities", helpers.Error(err))
 		}
+		if isEmptyImgVulns(*armoResourceMap) {
+			cautils.SetInfoMapForResources("image scanning is not configured. for more information: https://hub.armo.cloud/docs/cluster-vulnerability-scanning", imgVulnResources, sessionObj.InfoMap)
+		}
 	}
 
 	hostResources := cautils.MapHostResources(armoResourceMap)
@@ -103,7 +107,7 @@ func (k8sHandler *K8sResourceHandler) GetResources(sessionObj *cautils.OPASessio
 				sessionObj.InfoMap = infoMap
 			}
 		} else {
-			cautils.SetInfoMapForResources("enable-host-scan flag not used", hostResources, sessionObj.InfoMap)
+			cautils.SetInfoMapForResources("enable-host-scan flag not used. For more information:  https://hub.armo.cloud/docs/host-sensor", hostResources, sessionObj.InfoMap)
 		}
 	}
 
@@ -287,17 +291,31 @@ func getCloudProviderDescription(allResources map[string]workloadinterface.IMeta
 }
 
 func (k8sHandler *K8sResourceHandler) pullWorkerNodesNumber() (int, error) {
-	// labels used for control plane
-	listOptions := metav1.ListOptions{
-		LabelSelector: "!node-role.kubernetes.io/control-plane,!node-role.kubernetes.io/master",
+	nodesList, err := k8sHandler.k8s.KubernetesClient.CoreV1().Nodes().List(context.TODO(), metav1.ListOptions{})
+	scheduableNodes := v1.NodeList{}
+	if nodesList != nil {
+		for _, node := range nodesList.Items {
+			if len(node.Spec.Taints) == 0 {
+				scheduableNodes.Items = append(scheduableNodes.Items, node)
+			} else {
+				if !isMasterNodeTaints(node.Spec.Taints) {
+					scheduableNodes.Items = append(scheduableNodes.Items, node)
+				}
+			}
+		}
 	}
-	nodesList, err := k8sHandler.k8s.KubernetesClient.CoreV1().Nodes().List(context.TODO(), listOptions)
 	if err != nil {
 		return 0, err
 	}
-	nodesNumber := 0
-	if nodesList != nil {
-		nodesNumber = len(nodesList.Items)
-	}
-	return nodesNumber, nil
+	return len(scheduableNodes.Items), nil
+}
+
+// NoSchedule taint with empty value is usually applied to controlplane
+func isMasterNodeTaints(taints []v1.Taint) bool {
+	for _, taint := range taints {
+		if taint.Effect == v1.TaintEffectNoSchedule && taint.Value == "" {
+			return true
+		}
+	}
+	return false
 }

core/pkg/resourcehandler/k8sresources_test.go

@@ -0,0 +1,532 @@
+package resourcehandler
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	v1 "k8s.io/api/core/v1"
+)
+
+func TestIsMasterNodeTaints(t *testing.T) {
+	noTaintNode := `
+{
+"apiVersion": "v1",
+"kind": "Node",
+"metadata": {
+	"annotations": {
+		"kubeadm.alpha.kubernetes.io/cri-socket": "/var/run/dockershim.sock",
+		"node.alpha.kubernetes.io/ttl": "0",
+		"volumes.kubernetes.io/controller-managed-attach-detach": "true"
+	},
+	"creationTimestamp": "2022-05-16T10:52:32Z",
+	"labels": {
+		"beta.kubernetes.io/arch": "amd64",
+		"beta.kubernetes.io/os": "linux",
+		"kubernetes.io/arch": "amd64",
+		"kubernetes.io/hostname": "danielg-minikube",
+		"kubernetes.io/os": "linux",
+		"minikube.k8s.io/commit": "3e64b11ed75e56e4898ea85f96b2e4af0301f43d",
+		"minikube.k8s.io/name": "danielg-minikube",
+		"minikube.k8s.io/updated_at": "2022_05_16T13_52_35_0700",
+		"minikube.k8s.io/version": "v1.25.1",
+		"node-role.kubernetes.io/control-plane": "",
+		"node-role.kubernetes.io/master": "",
+		"node.kubernetes.io/exclude-from-external-load-balancers": ""
+	},
+	"name": "danielg-minikube",
+	"resourceVersion": "9432",
+	"uid": "fc4afcb6-4ca4-4038-ba54-5e16065a614a"
+},
+"spec": {
+	"podCIDR": "10.244.0.0/24",
+	"podCIDRs": [
+		"10.244.0.0/24"
+	]
+},
+"status": {
+	"addresses": [
+		{
+			"address": "192.168.49.2",
+			"type": "InternalIP"
+		},
+		{
+			"address": "danielg-minikube",
+			"type": "Hostname"
+		}
+	],
+	"allocatable": {
+		"cpu": "4",
+		"ephemeral-storage": "94850516Ki",
+		"hugepages-2Mi": "0",
+		"memory": "10432976Ki",
+		"pods": "110"
+	},
+	"capacity": {
+		"cpu": "4",
+		"ephemeral-storage": "94850516Ki",
+		"hugepages-2Mi": "0",
+		"memory": "10432976Ki",
+		"pods": "110"
+	},
+	"conditions": [
+		{
+			"lastHeartbeatTime": "2022-05-16T14:14:31Z",
+			"lastTransitionTime": "2022-05-16T10:52:29Z",
+			"message": "kubelet has sufficient memory available",
+			"reason": "KubeletHasSufficientMemory",
+			"status": "False",
+			"type": "MemoryPressure"
+		},
+		{
+			"lastHeartbeatTime": "2022-05-16T14:14:31Z",
+			"lastTransitionTime": "2022-05-16T10:52:29Z",
+			"message": "kubelet has no disk pressure",
+			"reason": "KubeletHasNoDiskPressure",
+			"status": "False",
+			"type": "DiskPressure"
+		},
+		{
+			"lastHeartbeatTime": "2022-05-16T14:14:31Z",
+			"lastTransitionTime": "2022-05-16T10:52:29Z",
+			"message": "kubelet has sufficient PID available",
+			"reason": "KubeletHasSufficientPID",
+			"status": "False",
+			"type": "PIDPressure"
+		},
+		{
+			"lastHeartbeatTime": "2022-05-16T14:14:31Z",
+			"lastTransitionTime": "2022-05-16T10:52:45Z",
+			"message": "kubelet is posting ready status",
+			"reason": "KubeletReady",
+			"status": "True",
+			"type": "Ready"
+		}
+	],
+	"daemonEndpoints": {
+		"kubeletEndpoint": {
+			"Port": 10250
+		}
+	},
+	"images": [
+		{
+			"names": [
+				"requarks/wiki@sha256:dd83fff15e77843ff934b25c28c865ac000edf7653e5d11adad1dd51df87439d"
+			],
+			"sizeBytes": 441083858
+		},
+		{
+			"names": [
+				"mariadb@sha256:821d0411208eaa88f9e1f0daccd1d534f88d19baf724eb9a2777cbedb10b6c66"
+			],
+			"sizeBytes": 400782682
+		},
+		{
+			"names": [
+				"k8s.gcr.io/etcd@sha256:64b9ea357325d5db9f8a723dcf503b5a449177b17ac87d69481e126bb724c263",
+				"k8s.gcr.io/etcd:3.5.1-0"
+			],
+			"sizeBytes": 292558922
+		},
+		{
+			"names": [
+				"kubernetesui/dashboard@sha256:ec27f462cf1946220f5a9ace416a84a57c18f98c777876a8054405d1428cc92e",
+				"kubernetesui/dashboard:v2.3.1"
+			],
+			"sizeBytes": 220033604
+		},
+		{
+			"names": [
+				"k8s.gcr.io/kube-apiserver@sha256:f54681a71cce62cbc1b13ebb3dbf1d880f849112789811f98b6aebd2caa2f255",
+				"k8s.gcr.io/kube-apiserver:v1.23.1"
+			],
+			"sizeBytes": 135162256
+		},
+		{
+			"names": [
+				"k8s.gcr.io/kube-controller-manager@sha256:a7ed87380108a2d811f0d392a3fe87546c85bc366e0d1e024dfa74eb14468604",
+				"k8s.gcr.io/kube-controller-manager:v1.23.1"
+			],
+			"sizeBytes": 124971684
+		},
+		{
+			"names": [
+				"k8s.gcr.io/kube-proxy@sha256:e40f3a28721588affcf187f3f246d1e078157dabe274003eaa2957a83f7170c8",
+				"k8s.gcr.io/kube-proxy:v1.23.1"
+			],
+			"sizeBytes": 112327826
+		},
+		{
+			"names": [
+				"quay.io/armosec/kubescape@sha256:6196f766be50d94b45d903a911f5ee95ac99bc392a1324c3e063bec41efd98ba",
+				"quay.io/armosec/kubescape:v2.0.153"
+			],
+			"sizeBytes": 110345054
+		},
+		{
+			"names": [
+				"nginx@sha256:f7988fb6c02e0ce69257d9bd9cf37ae20a60f1df7563c3a2a6abe24160306b8d"
+			],
+			"sizeBytes": 109129446
+		},
+		{
+			"names": [
+				"quay.io/armosec/action-trigger@sha256:b93707d10ff86aac8dfa42ad37192d6bcf9aceeb4321b21756e438389c26e07c",
+				"quay.io/armosec/action-trigger:v0.0.5"
+			],
+			"sizeBytes": 65127067
+		},
+		{
+			"names": [
+				"quay.io/armosec/images-vulnerabilities-scan@sha256:a5f9ddc04a7fdce6d52ef85a21f0de567d8e04d418c2bc5bf5d72b151c997625",
+				"quay.io/armosec/images-vulnerabilities-scan:v0.0.7"
+			],
+			"sizeBytes": 61446712
+		},
+		{
+			"names": [
+				"quay.io/armosec/images-vulnerabilities-scan@sha256:2f879858da89f6542e3223fb18d6d793810cc2ad6e398b66776475e4218b6af5",
+				"quay.io/armosec/images-vulnerabilities-scan:v0.0.8"
+			],
+			"sizeBytes": 61446528
+		},
+		{
+			"names": [
+				"quay.io/armosec/cluster-collector@sha256:2c4f733d09f7f4090ace04585230bdfacbbc29a3ade38a2e1233d2c0f730d9b6",
+				"quay.io/armosec/cluster-collector:v0.0.9"
+			],
+			"sizeBytes": 53699576
+		},
+		{
+			"names": [
+				"k8s.gcr.io/kube-scheduler@sha256:8be4eb1593cf9ff2d91b44596633b7815a3753696031a1eb4273d1b39427fa8c",
+				"k8s.gcr.io/kube-scheduler:v1.23.1"
+			],
+			"sizeBytes": 53488305
+		},
+		{
+			"names": [
+				"k8s.gcr.io/coredns/coredns@sha256:5b6ec0d6de9baaf3e92d0f66cd96a25b9edbce8716f5f15dcd1a616b3abd590e",
+				"k8s.gcr.io/coredns/coredns:v1.8.6"
+			],
+			"sizeBytes": 46829283
+		},
+		{
+			"names": [
+				"kubernetesui/metrics-scraper@sha256:36d5b3f60e1a144cc5ada820910535074bdf5cf73fb70d1ff1681537eef4e172",
+				"kubernetesui/metrics-scraper:v1.0.7"
+			],
+			"sizeBytes": 34446077
+		},
+		{
+			"names": [
+				"gcr.io/k8s-minikube/storage-provisioner@sha256:18eb69d1418e854ad5a19e399310e52808a8321e4c441c1dddad8977a0d7a944",
+				"gcr.io/k8s-minikube/storage-provisioner:v5"
+			],
+			"sizeBytes": 31465472
+		},
+		{
+			"names": [
+				"quay.io/armosec/notification-server@sha256:b6e9b296cd53bd3b2b42c516d8ab43db998acff1124a57aff8d66b3dd7881979",
+				"quay.io/armosec/notification-server:v0.0.3"
+			],
+			"sizeBytes": 20209940
+		},
+		{
+			"names": [
+				"quay.io/armosec/kube-host-sensor@sha256:82139d2561039726be060df2878ef023c59df7c536fbd7f6d766af5a99569fee",
+				"quay.io/armosec/kube-host-sensor:latest"
+			],
+			"sizeBytes": 11796788
+		},
+		{
+			"names": [
+				"k8s.gcr.io/pause@sha256:3d380ca8864549e74af4b29c10f9cb0956236dfb01c40ca076fb6c37253234db",
+				"k8s.gcr.io/pause:3.6"
+			],
+			"sizeBytes": 682696
+		}
+	],
+	"nodeInfo": {
+		"architecture": "amd64",
+		"bootID": "828cbe73-120b-43cf-aae0-9e2d15b8c873",
+		"containerRuntimeVersion": "docker://20.10.12",
+		"kernelVersion": "5.13.0-40-generic",
+		"kubeProxyVersion": "v1.23.1",
+		"kubeletVersion": "v1.23.1",
+		"machineID": "8de776e053e140d6a14c2d2def3d6bb8",
+		"operatingSystem": "linux",
+		"osImage": "Ubuntu 20.04.2 LTS",
+		"systemUUID": "da12dc19-10bf-4033-a440-2d9aa33d6fe3"
+	}
+}
+}
+`
+	var l v1.Node
+	_ = json.Unmarshal([]byte(noTaintNode), &l)
+	assert.False(t, isMasterNodeTaints(l.Spec.Taints))
+
+	taintNode :=
+		`
+	{
+    "apiVersion": "v1",
+    "kind": "Node",
+    "metadata": {
+        "annotations": {
+            "kubeadm.alpha.kubernetes.io/cri-socket": "/var/run/dockershim.sock",
+            "node.alpha.kubernetes.io/ttl": "0",
+            "volumes.kubernetes.io/controller-managed-attach-detach": "true"
+        },
+        "creationTimestamp": "2022-05-16T10:52:32Z",
+        "labels": {
+            "beta.kubernetes.io/arch": "amd64",
+            "beta.kubernetes.io/os": "linux",
+            "kubernetes.io/arch": "amd64",
+            "kubernetes.io/hostname": "danielg-minikube",
+            "kubernetes.io/os": "linux",
+            "minikube.k8s.io/commit": "3e64b11ed75e56e4898ea85f96b2e4af0301f43d",
+            "minikube.k8s.io/name": "danielg-minikube",
+            "minikube.k8s.io/updated_at": "2022_05_16T13_52_35_0700",
+            "minikube.k8s.io/version": "v1.25.1",
+            "node-role.kubernetes.io/control-plane": "",
+            "node-role.kubernetes.io/master": "",
+            "node.kubernetes.io/exclude-from-external-load-balancers": ""
+        },
+        "name": "danielg-minikube",
+        "resourceVersion": "9871",
+        "uid": "fc4afcb6-4ca4-4038-ba54-5e16065a614a"
+    },
+    "spec": {
+        "podCIDR": "10.244.0.0/24",
+        "podCIDRs": [
+            "10.244.0.0/24"
+        ],
+        "taints": [
+            {
+                "effect": "NoSchedule",
+                "key": "key1",
+                "value": ""
+            }
+        ]
+    },
+    "status": {
+        "addresses": [
+            {
+                "address": "192.168.49.2",
+                "type": "InternalIP"
+            },
+            {
+                "address": "danielg-minikube",
+                "type": "Hostname"
+            }
+        ],
+        "allocatable": {
+            "cpu": "4",
+            "ephemeral-storage": "94850516Ki",
+            "hugepages-2Mi": "0",
+            "memory": "10432976Ki",
+            "pods": "110"
+        },
+        "capacity": {
+            "cpu": "4",
+            "ephemeral-storage": "94850516Ki",
+            "hugepages-2Mi": "0",
+            "memory": "10432976Ki",
+            "pods": "110"
+        },
+        "conditions": [
+            {
+                "lastHeartbeatTime": "2022-05-16T14:24:45Z",
+                "lastTransitionTime": "2022-05-16T10:52:29Z",
+                "message": "kubelet has sufficient memory available",
+                "reason": "KubeletHasSufficientMemory",
+                "status": "False",
+                "type": "MemoryPressure"
+            },
+            {
+                "lastHeartbeatTime": "2022-05-16T14:24:45Z",
+                "lastTransitionTime": "2022-05-16T10:52:29Z",
+                "message": "kubelet has no disk pressure",
+                "reason": "KubeletHasNoDiskPressure",
+                "status": "False",
+                "type": "DiskPressure"
+            },
+            {
+                "lastHeartbeatTime": "2022-05-16T14:24:45Z",
+                "lastTransitionTime": "2022-05-16T10:52:29Z",
+                "message": "kubelet has sufficient PID available",
+                "reason": "KubeletHasSufficientPID",
+                "status": "False",
+                "type": "PIDPressure"
+            },
+            {
+                "lastHeartbeatTime": "2022-05-16T14:24:45Z",
+                "lastTransitionTime": "2022-05-16T10:52:45Z",
+                "message": "kubelet is posting ready status",
+                "reason": "KubeletReady",
+                "status": "True",
+                "type": "Ready"
+            }
+        ],
+        "daemonEndpoints": {
+            "kubeletEndpoint": {
+                "Port": 10250
+            }
+        },
+        "images": [
+            {
+                "names": [
+                    "requarks/wiki@sha256:dd83fff15e77843ff934b25c28c865ac000edf7653e5d11adad1dd51df87439d"
+                ],
+                "sizeBytes": 441083858
+            },
+            {
+                "names": [
+                    "mariadb@sha256:821d0411208eaa88f9e1f0daccd1d534f88d19baf724eb9a2777cbedb10b6c66"
+                ],
+                "sizeBytes": 400782682
+            },
+            {
+                "names": [
+                    "k8s.gcr.io/etcd@sha256:64b9ea357325d5db9f8a723dcf503b5a449177b17ac87d69481e126bb724c263",
+                    "k8s.gcr.io/etcd:3.5.1-0"
+                ],
+                "sizeBytes": 292558922
+            },
+            {
+                "names": [
+                    "kubernetesui/dashboard@sha256:ec27f462cf1946220f5a9ace416a84a57c18f98c777876a8054405d1428cc92e",
+                    "kubernetesui/dashboard:v2.3.1"
+                ],
+                "sizeBytes": 220033604
+            },
+            {
+                "names": [
+                    "k8s.gcr.io/kube-apiserver@sha256:f54681a71cce62cbc1b13ebb3dbf1d880f849112789811f98b6aebd2caa2f255",
+                    "k8s.gcr.io/kube-apiserver:v1.23.1"
+                ],
+                "sizeBytes": 135162256
+            },
+            {
+                "names": [
+                    "k8s.gcr.io/kube-controller-manager@sha256:a7ed87380108a2d811f0d392a3fe87546c85bc366e0d1e024dfa74eb14468604",
+                    "k8s.gcr.io/kube-controller-manager:v1.23.1"
+                ],
+                "sizeBytes": 124971684
+            },
+            {
+                "names": [
+                    "k8s.gcr.io/kube-proxy@sha256:e40f3a28721588affcf187f3f246d1e078157dabe274003eaa2957a83f7170c8",
+                    "k8s.gcr.io/kube-proxy:v1.23.1"
+                ],
+                "sizeBytes": 112327826
+            },
+            {
+                "names": [
+                    "quay.io/armosec/kubescape@sha256:6196f766be50d94b45d903a911f5ee95ac99bc392a1324c3e063bec41efd98ba",
+                    "quay.io/armosec/kubescape:v2.0.153"
+                ],
+                "sizeBytes": 110345054
+            },
+            {
+                "names": [
+                    "nginx@sha256:f7988fb6c02e0ce69257d9bd9cf37ae20a60f1df7563c3a2a6abe24160306b8d"
+                ],
+                "sizeBytes": 109129446
+            },
+            {
+                "names": [
+                    "quay.io/armosec/action-trigger@sha256:b93707d10ff86aac8dfa42ad37192d6bcf9aceeb4321b21756e438389c26e07c",
+                    "quay.io/armosec/action-trigger:v0.0.5"
+                ],
+                "sizeBytes": 65127067
+            },
+            {
+                "names": [
+                    "quay.io/armosec/images-vulnerabilities-scan@sha256:a5f9ddc04a7fdce6d52ef85a21f0de567d8e04d418c2bc5bf5d72b151c997625",
+                    "quay.io/armosec/images-vulnerabilities-scan:v0.0.7"
+                ],
+                "sizeBytes": 61446712
+            },
+            {
+                "names": [
+                    "quay.io/armosec/images-vulnerabilities-scan@sha256:2f879858da89f6542e3223fb18d6d793810cc2ad6e398b66776475e4218b6af5",
+                    "quay.io/armosec/images-vulnerabilities-scan:v0.0.8"
+                ],
+                "sizeBytes": 61446528
+            },
+            {
+                "names": [
+                    "quay.io/armosec/cluster-collector@sha256:2c4f733d09f7f4090ace04585230bdfacbbc29a3ade38a2e1233d2c0f730d9b6",
+                    "quay.io/armosec/cluster-collector:v0.0.9"
+                ],
+                "sizeBytes": 53699576
+            },
+            {
+                "names": [
+                    "k8s.gcr.io/kube-scheduler@sha256:8be4eb1593cf9ff2d91b44596633b7815a3753696031a1eb4273d1b39427fa8c",
+                    "k8s.gcr.io/kube-scheduler:v1.23.1"
+                ],
+                "sizeBytes": 53488305
+            },
+            {
+                "names": [
+                    "k8s.gcr.io/coredns/coredns@sha256:5b6ec0d6de9baaf3e92d0f66cd96a25b9edbce8716f5f15dcd1a616b3abd590e",
+                    "k8s.gcr.io/coredns/coredns:v1.8.6"
+                ],
+                "sizeBytes": 46829283
+            },
+            {
+                "names": [
+                    "kubernetesui/metrics-scraper@sha256:36d5b3f60e1a144cc5ada820910535074bdf5cf73fb70d1ff1681537eef4e172",
+                    "kubernetesui/metrics-scraper:v1.0.7"
+                ],
+                "sizeBytes": 34446077
+            },
+            {
+                "names": [
+                    "gcr.io/k8s-minikube/storage-provisioner@sha256:18eb69d1418e854ad5a19e399310e52808a8321e4c441c1dddad8977a0d7a944",
+                    "gcr.io/k8s-minikube/storage-provisioner:v5"
+                ],
+                "sizeBytes": 31465472
+            },
+            {
+                "names": [
+                    "quay.io/armosec/notification-server@sha256:b6e9b296cd53bd3b2b42c516d8ab43db998acff1124a57aff8d66b3dd7881979",
+                    "quay.io/armosec/notification-server:v0.0.3"
+                ],
+                "sizeBytes": 20209940
+            },
+            {
+                "names": [
+                    "quay.io/armosec/kube-host-sensor@sha256:82139d2561039726be060df2878ef023c59df7c536fbd7f6d766af5a99569fee",
+                    "quay.io/armosec/kube-host-sensor:latest"
+                ],
+                "sizeBytes": 11796788
+            },
+            {
+                "names": [
+                    "k8s.gcr.io/pause@sha256:3d380ca8864549e74af4b29c10f9cb0956236dfb01c40ca076fb6c37253234db",
+                    "k8s.gcr.io/pause:3.6"
+                ],
+                "sizeBytes": 682696
+            }
+        ],
+        "nodeInfo": {
+            "architecture": "amd64",
+            "bootID": "828cbe73-120b-43cf-aae0-9e2d15b8c873",
+            "containerRuntimeVersion": "docker://20.10.12",
+            "kernelVersion": "5.13.0-40-generic",
+            "kubeProxyVersion": "v1.23.1",
+            "kubeletVersion": "v1.23.1",
+            "machineID": "8de776e053e140d6a14c2d2def3d6bb8",
+            "operatingSystem": "linux",
+            "osImage": "Ubuntu 20.04.2 LTS",
+            "systemUUID": "da12dc19-10bf-4033-a440-2d9aa33d6fe3"
+        }
+    }
+}
+`
+	_ = json.Unmarshal([]byte(taintNode), &l)
+	assert.True(t, isMasterNodeTaints(l.Spec.Taints))
+}

core/pkg/resourcehandler/k8sresourcesutils.go

@@ -4,7 +4,6 @@ import (
 	"strings"
 
 	"github.com/armosec/kubescape/v2/core/cautils"
-	"github.com/armosec/kubescape/v2/core/pkg/hostsensorutils"
 	"github.com/armosec/opa-utils/reporthandling"
 	"k8s.io/utils/strings/slices"
 
@@ -12,12 +11,43 @@ import (
 )
 
 var (
-	ClusterDescribe = "ClusterDescribe"
+	ClusterDescribe              = "ClusterDescribe"
+	KubeletConfiguration         = "KubeletConfiguration"
+	OsReleaseFile                = "OsReleaseFile"
+	KernelVersion                = "KernelVersion"
+	LinuxSecurityHardeningStatus = "LinuxSecurityHardeningStatus"
+	OpenPortsList                = "OpenPortsList"
+	LinuxKernelVariables         = "LinuxKernelVariables"
+	KubeletCommandLine           = "KubeletCommandLine"
+	ImageVulnerabilities         = "ImageVulnerabilities"
 
+	MapResourceToApiGroup = map[string]string{
+		KubeletConfiguration:         "hostdata.kubescape.cloud/v1beta0",
+		OsReleaseFile:                "hostdata.kubescape.cloud/v1beta0",
+		KubeletCommandLine:           "hostdata.kubescape.cloud/v1beta0",
+		KernelVersion:                "hostdata.kubescape.cloud/v1beta0",
+		LinuxSecurityHardeningStatus: "hostdata.kubescape.cloud/v1beta0",
+		OpenPortsList:                "hostdata.kubescape.cloud/v1beta0",
+		LinuxKernelVariables:         "hostdata.kubescape.cloud/v1beta0",
+	}
+	MapResourceToApiGroupVuln = map[string][]string{
+		ImageVulnerabilities: {"armo.vuln.images/v1", "image.vulnscan.com/v1"}}
 	MapResourceToApiGroupCloud = map[string][]string{
 		ClusterDescribe: {"container.googleapis.com/v1", "eks.amazonaws.com/v1", "management.azure.com/v1"}}
 )
 
+func isEmptyImgVulns(armoResourcesMap cautils.ArmoResources) bool {
+	imgVulnResources := cautils.MapImageVulnResources(&armoResourcesMap)
+	for _, resource := range imgVulnResources {
+		if val, ok := armoResourcesMap[resource]; ok {
+			if len(val) > 0 {
+				return false
+			}
+		}
+	}
+	return true
+}
+
 func setK8sResourceMap(frameworks []reporthandling.Framework) *cautils.K8SResources {
 	k8sResources := make(cautils.K8SResources)
 	complexMap := setComplexK8sResourceMap(frameworks)
@@ -80,10 +110,16 @@ func setComplexArmoResourceMap(frameworks []reporthandling.Framework, resourceTo
 }
 
 func mapArmoResourceToApiGroup(resource string) []string {
-	if val, ok := hostsensorutils.MapResourceToApiGroup[resource]; ok {
+	if val, ok := MapResourceToApiGroup[resource]; ok {
 		return []string{val}
 	}
-	return MapResourceToApiGroupCloud[resource]
+	if val, ok := MapResourceToApiGroupCloud[resource]; ok {
+		return val
+	}
+	if val, ok := MapResourceToApiGroupVuln[resource]; ok {
+		return val
+	}
+	return []string{}
 }
 
 func insertControls(resource string, resourceToControl map[string][]string, control reporthandling.Control) {

core/pkg/resourcehandler/k8sresourcesutils_test.go

@@ -2,7 +2,9 @@ package resourcehandler
 
 import (
 	"github.com/armosec/k8s-interface/k8sinterface"
+	"github.com/armosec/kubescape/v2/core/cautils"
 	"github.com/armosec/opa-utils/reporthandling"
+	"github.com/stretchr/testify/assert"
 
 	"testing"
 )
@@ -24,6 +26,18 @@ func TestSetResourceMap(t *testing.T) {
 	}
 
 }
+func TestSsEmptyImgVulns(t *testing.T) {
+	armoResourcesMap := make(cautils.ArmoResources, 0)
+	armoResourcesMap["container.googleapis.com/v1"] = []string{"fsdfds"}
+	assert.Equal(t, true, isEmptyImgVulns(armoResourcesMap))
+
+	armoResourcesMap["armo.vuln.images/v1/ImageVulnerabilities"] = []string{"dada"}
+	assert.Equal(t, false, isEmptyImgVulns(armoResourcesMap))
+
+	armoResourcesMap["armo.vuln.images/v1/ImageVulnerabilities"] = []string{}
+	armoResourcesMap["bla"] = []string{"blu"}
+	assert.Equal(t, true, isEmptyImgVulns(armoResourcesMap))
+}
 
 func TestInsertK8sResources(t *testing.T) {
 	// insertK8sResources

core/pkg/resultshandling/reporter/v1/reporteventreceiver.go

@@ -12,6 +12,7 @@ import (
 	"github.com/armosec/kubescape/v2/core/cautils/getter"
 	"github.com/armosec/kubescape/v2/core/cautils/logger"
 	"github.com/armosec/kubescape/v2/core/cautils/logger/helpers"
+	v2 "github.com/armosec/kubescape/v2/core/pkg/resultshandling/reporter/v2"
 	"github.com/armosec/opa-utils/reporthandling"
 	"github.com/google/uuid"
 )
@@ -140,8 +141,8 @@ func (report *ReportEventReceiver) generateMessage() {
 	message := "You can see the results in a user-friendly UI, choose your preferred compliance framework, check risk results history and trends, manage exceptions, get remediation recommendations and much more by registering here:"
 
 	u := url.URL{}
-	u.Scheme = "https"
 	u.Host = getter.GetArmoAPIConnector().GetFrontendURL()
+	v2.ParseHost(&u)
 
 	if report.customerAdminEMail != "" {
 		logger.L().Debug("", helpers.String("account ID", report.customerGUID))

core/pkg/resultshandling/reporter/v1/reporteventreceiverutils.go

@@ -5,15 +5,16 @@ import (
 
 	"github.com/armosec/k8s-interface/workloadinterface"
 	"github.com/armosec/kubescape/v2/core/cautils/getter"
+	v2 "github.com/armosec/kubescape/v2/core/pkg/resultshandling/reporter/v2"
 	"github.com/armosec/opa-utils/reporthandling"
 	"github.com/google/uuid"
 )
 
 func (report *ReportEventReceiver) initEventReceiverURL() {
 	urlObj := url.URL{}
-
-	urlObj.Scheme = "https"
 	urlObj.Host = getter.GetArmoAPIConnector().GetReportReceiverURL()
+	v2.ParseHost(&urlObj)
+
 	urlObj.Path = "/k8s/postureReport"
 	q := urlObj.Query()
 	q.Add("customerGUID", uuid.MustParse(report.customerGUID).String())

core/pkg/resultshandling/reporter/v2/reporteventreceiver.go

@@ -89,9 +89,8 @@ func (report *ReportEventReceiver) prepareReport(opaSessionObj *cautils.OPASessi
 
 func (report *ReportEventReceiver) GetURL() string {
 	u := url.URL{}
-	u.Scheme = "https"
 	u.Host = getter.GetArmoAPIConnector().GetFrontendURL()
-
+	ParseHost(&u)
 	q := u.Query()
 
 	if report.customerAdminEMail != "" || report.token == "" { // data has been submitted

core/pkg/resultshandling/reporter/v2/reporteventreceiverutils.go

@@ -11,11 +11,9 @@ import (
 
 func (report *ReportEventReceiver) initEventReceiverURL() {
 	urlObj := url.URL{}
-
-	urlObj.Scheme = "https"
 	urlObj.Host = getter.GetArmoAPIConnector().GetReportReceiverURL()
+	ParseHost(&urlObj)
 	urlObj.Path = "/k8s/v2/postureReport"
-
 	q := urlObj.Query()
 	q.Add("customerGUID", uuid.MustParse(report.customerGUID).String())
 	q.Add("clusterName", report.clusterName)

core/pkg/resultshandling/reporter/v2/utils.go

@@ -1,6 +1,7 @@
 package v2
 
 import (
+	"net/url"
 	"strings"
 )
 
@@ -21,3 +22,13 @@ func maskID(id string) string {
 
 	return strings.TrimSuffix(str, sep)
 }
+
+func ParseHost(urlObj *url.URL) {
+	if strings.Contains(urlObj.Host, "http://") {
+		urlObj.Scheme = "http"
+		urlObj.Host = strings.Replace(urlObj.Host, "http://", "", 1)
+	} else {
+		urlObj.Scheme = "https"
+		urlObj.Host = strings.Replace(urlObj.Host, "https://", "", 1)
+	}
+}

core/pkg/resultshandling/reporter/v2/utils_test.go

@@ -0,0 +1,38 @@
+package v2
+
+import (
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestParseHost(t *testing.T) {
+	urlObj := url.URL{}
+
+	urlObj.Host = "http://localhost:7555"
+	ParseHost(&urlObj)
+	assert.Equal(t, "http", urlObj.Scheme)
+	assert.Equal(t, "localhost:7555", urlObj.Host)
+
+	urlObj.Host = "https://localhost:7555"
+	ParseHost(&urlObj)
+	assert.Equal(t, "https", urlObj.Scheme)
+	assert.Equal(t, "localhost:7555", urlObj.Host)
+
+	urlObj.Host = "http://portal-dev.armo.cloud"
+	ParseHost(&urlObj)
+	assert.Equal(t, "http", urlObj.Scheme)
+	assert.Equal(t, "portal-dev.armo.cloud", urlObj.Host)
+
+	urlObj.Host = "https://portal-dev.armo.cloud"
+	ParseHost(&urlObj)
+	assert.Equal(t, "https", urlObj.Scheme)
+	assert.Equal(t, "portal-dev.armo.cloud", urlObj.Host)
+
+	urlObj.Host = "portal-dev.armo.cloud"
+	ParseHost(&urlObj)
+	assert.Equal(t, "https", urlObj.Scheme)
+	assert.Equal(t, "portal-dev.armo.cloud", urlObj.Host)
+
+}

go.mod

@@ -5,8 +5,8 @@ go 1.17
 require (
 	github.com/armosec/armoapi-go v0.0.73
 	github.com/armosec/go-git-url v0.0.4
-	github.com/armosec/k8s-interface v0.0.70
-	github.com/armosec/opa-utils v0.0.139
+	github.com/armosec/k8s-interface v0.0.76
+	github.com/armosec/opa-utils v0.0.140
 	github.com/armosec/rbac-utils v0.0.14
 	github.com/armosec/utils-go v0.0.5
 	github.com/armosec/utils-k8s-go v0.0.6

go.sum

@@ -119,11 +119,11 @@ github.com/armosec/go-git-url v0.0.4 h1:emG9Yfl53rHpuX41fXLD92ehzhRoNSSnGT6Pr7og
 github.com/armosec/go-git-url v0.0.4/go.mod h1:PJqdEyJyFxTQvawBcyOM0Ies6+uezire5gpwfr1XX5M=
 github.com/armosec/k8s-interface v0.0.8/go.mod h1:xxS+V5QT3gVQTwZyAMMDrYLWGrfKOpiJ7Jfhfa0w9sM=
 github.com/armosec/k8s-interface v0.0.37/go.mod h1:vHxGWqD/uh6+GQb9Sqv7OGMs+Rvc2dsFVc0XtgRh1ZU=
-github.com/armosec/k8s-interface v0.0.70 h1:NU3UIaNl7H3hsRecwggiaQbZXTwXtOKg3GOBjq6/XJw=
-github.com/armosec/k8s-interface v0.0.70/go.mod h1:8NX4xWXh8mwW7QyZdZea1czNdM2azCK9BbUNmiZYXW0=
+github.com/armosec/k8s-interface v0.0.76 h1:pQaF+8BcNMm6GTYTjdG7vCM1l4BIk7oALXoT6v5gCAk=
+github.com/armosec/k8s-interface v0.0.76/go.mod h1:8NX4xWXh8mwW7QyZdZea1czNdM2azCK9BbUNmiZYXW0=
 github.com/armosec/opa-utils v0.0.64/go.mod h1:6tQP8UDq2EvEfSqh8vrUdr/9QVSCG4sJfju1SXQOn4c=
-github.com/armosec/opa-utils v0.0.139 h1:JPxgPXVJUUIujtIoZk6TejE8PkZhX2pYnpj+E8PhcfA=
-github.com/armosec/opa-utils v0.0.139/go.mod h1:VnRVJgDDPFAprGDcibTtKHf9wgkoyTU8wmX2BxEIwok=
+github.com/armosec/opa-utils v0.0.140 h1:iv6inb6+D0qgeVkv7f+ZIHpy239IUpAwg6Dau0JAWzg=
+github.com/armosec/opa-utils v0.0.140/go.mod h1:Hwm9ZkcW87mB2567WT6mBuSBEzaKowBNfrl3Q0IVsV8=
 github.com/armosec/rbac-utils v0.0.1/go.mod h1:pQ8CBiij8kSKV7aeZm9FMvtZN28VgA7LZcYyTWimq40=
 github.com/armosec/rbac-utils v0.0.14 h1:CKYKcgqJEXWF2Hen/B1pVGtS3nDAG1wp9dDv6oNtq90=
 github.com/armosec/rbac-utils v0.0.14/go.mod h1:Ex/IdGWhGv9HZq6Hs8N/ApzCKSIvpNe/ETqDfnuyah0=

httphandler/README.md

@@ -1,26 +1,85 @@
 # Kubescape HTTP Handler Package
 
-> This is a beta version, we might make some changes before publishing the official Prometheus support
-
-Running `kubescape` will start up a webserver on port `8080` which will serve the following paths: 
+Running `kubescape` will start up a webserver on port `8080` which will serve the following API's: 
 
 ### Trigger scan
 
-* POST `/v1/scan` - Trigger a kubescape scan. The server will return an ID and will execute the scanning asynchronously 
-* * `wait`: scan synchronously (return results and not ID). Use only in small clusters are with an increased timeout
-* * `keep`: Do not delete results from local storage after returning
+* POST `/v1/scan` - trigger a kubescape scan. The server will return an ID and will execute the scanning asynchronously. the request body should look [as followed](#trigger-scan-object).
+* * `wait=true`: scan synchronously (return results and not ID). Use only in small clusters or with an increased timeout. default is `wait=false`
+* * `keep=true`: do not delete results from local storage after returning. default is `keep=false`
+* POST `/v1/metrics` - trigger kubescape for Prometheus support. [read more](examples/prometheus/README.md)
+
+[Response](#response-object):
+
+```
+{
+  "id": <str>,                      // scan ID
+  "type": "busy",                   // response object type
+  "response": <message:string>      // message indicating scanning is still in process
+}
+```
+
+> When scanning was triggered with the `wait=true` query param, the response is like the [`/v1/results` API](#get-results) response
 
 ### Get results
-* GET `/v1/results` -  Request kubescape scan results
-* * query `id=<string>` -> ID returned when triggering the scan action. If empty will return latest results
-* * query `keep` -> Do not delete results from local storage after returning
+* GET `/v1/results` -  request kubescape scan results
+* * query `id=<string>` -> request results of a specific scan ID. If empty will return latest results
+* * query `keep=true` -> keep the results in the local storage after returning. default is `keep=false` - the results will be deleted from local storage after they are returned
 
+[Response](#response-object):
+
+When scanning was done successfully
+```
+{
+  "id": <str>,                      // scan ID
+  "type": "v1results",              // response object type
+  "response": <object:v1results>    // v1 results payload
+}
+```
+
+When scanning failed
+```
+{
+  "id": <str>,                  // scan ID
+  "type": "error",              // response object type
+  "response": <error:string>    // error string
+}
+```
+
+When scanning is in progress
+```
+{
+  "id": <str>,                    // scan ID
+  "type": "busy",                 // response object type
+  "response": <message:string>    // message indicating scanning is still in process
+}
+```
 ### Check scanning progress status
 Check the scanning status - is the scanning in progress or done. This is meant for a waiting mechanize since the API does not return the entire results object when the scanning is done
 
 * GET `/v1/status` -  Request kubescape scan status
 * * query `id=<string>` -> Check status of a specific scan. If empty will check if any scan is in progress
 
+[Response](#response-object):
+
+When scanning is in progress
+```
+{
+  "id": <str>,                    // scan ID
+  "type": "busy",                 // response object type
+  "response": <message:string>    // message indicating scanning is still in process
+}
+```
+
+When scanning is not in progress
+```
+{
+  "id": <str>,                    // scan ID
+  "type": "notBusy",              // response object type
+  "response": <message:string>    // message indicating scanning is done in process
+}
+```
+
 ### Delete cached results
 * DELETE `/v1/results` - Delete kubescape scan results from storage. If empty will delete latest results
 * * query `id=<string>`: Delete ID of specific results 
@@ -32,10 +91,10 @@ Check the scanning status - is the scanning in progress or done. This is meant f
 * `/livez` - will respond 200 is server is alive
 * `/readyz` - will respond 200 if server can receive requests 
 
-## Trigger Kubescape scan
+## Objects
+
+### Trigger scan object
 
-POST /v1/scan
-body:
 ```
 {
   "format": <str>,               // results format [default: json] (same as 'kubescape scan --format')
@@ -51,7 +110,8 @@ body:
 }
 ```
 
-Response body:
+### Response object
+
 ```
 {
   "id": <str>,                      // scan ID
@@ -59,10 +119,12 @@ Response body:
   "response": <object:interface>    // response payload as list of bytes
 }
 ```
+#### Response object types
 
-Response body types:
 *  "v1results" - v1 results object
-*  "id" - id string
+*  "busy" - server is busy processing previous requests 
+*  "notBusy" - server is not busy processing previous requests
+*  "ready" - server is done processing request and results are ready  
 *  "error" - error object
 
 ## API Examples

httphandler/examples/prometheus/README.md

@@ -110,13 +110,4 @@ kubescape_control_count_resources_excluded{name="<control name>",url="<docs url>
 kubescape_control_count_resources_passed{name="<control name>",url="<docs url>",severity="<control severity>"} <counter>
 ```
 
-#### Resources metrics
-The resources metrics give you the ability to prioritize fixing the resources by the number of controls that failed 
-
-```
-# Number of controls that failed for this particular resource
-kubescape_resource_count_controls_failed{apiVersion="<>",kind="<>",namespace="<>",name="<>"} <counter>
-
-# Number of controls that where excluded for this particular resource
-kubescape_resource_count_controls_excluded{apiVersion="<>",kind="<>",namespace="<>",name="<>"} <counter>
-```
+ 

httphandler/go.mod

@@ -6,7 +6,7 @@ replace github.com/armosec/kubescape/v2 => ../
 
 require (
 	github.com/armosec/kubescape/v2 v2.0.0-00010101000000-000000000000
-	github.com/armosec/opa-utils v0.0.139
+	github.com/armosec/opa-utils v0.0.140
 	github.com/armosec/utils-go v0.0.5
 	github.com/google/uuid v1.3.0
 	github.com/gorilla/mux v1.8.0
@@ -31,7 +31,7 @@ require (
 	github.com/OneOfOne/xxhash v1.2.8 // indirect
 	github.com/armosec/armoapi-go v0.0.73 // indirect
 	github.com/armosec/go-git-url v0.0.4 // indirect
-	github.com/armosec/k8s-interface v0.0.70 // indirect
+	github.com/armosec/k8s-interface v0.0.76 // indirect
 	github.com/armosec/rbac-utils v0.0.14 // indirect
 	github.com/armosec/utils-k8s-go v0.0.6 // indirect
 	github.com/aws/aws-sdk-go v1.41.11 // indirect

httphandler/go.sum

@@ -113,19 +113,19 @@ github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj
 github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armosec/armoapi-go v0.0.2/go.mod h1:vIK17yoKbJRQyZXWWLe3AqfqCRITxW8qmSkApyq5xFs=
 github.com/armosec/armoapi-go v0.0.23/go.mod h1:iaVVGyc23QGGzAdv4n+szGQg3Rbpixn9yQTU3qWRpaw=
-github.com/armosec/armoapi-go v0.0.67/go.mod h1:/9SQAgtLbYkfFneRRm/zkIn3zz+4Y2xv6N3vtFcyF8s=
 github.com/armosec/armoapi-go v0.0.73 h1:LMf+eCkkf+W9NVvOzHKFgVUEpBMvh27M7//UQP3aiO8=
 github.com/armosec/armoapi-go v0.0.73/go.mod h1:/9SQAgtLbYkfFneRRm/zkIn3zz+4Y2xv6N3vtFcyF8s=
 github.com/armosec/go-git-url v0.0.4 h1:emG9Yfl53rHpuX41fXLD92ehzhRoNSSnGT6Pr7ogWMY=
 github.com/armosec/go-git-url v0.0.4/go.mod h1:PJqdEyJyFxTQvawBcyOM0Ies6+uezire5gpwfr1XX5M=
 github.com/armosec/k8s-interface v0.0.8/go.mod h1:xxS+V5QT3gVQTwZyAMMDrYLWGrfKOpiJ7Jfhfa0w9sM=
 github.com/armosec/k8s-interface v0.0.37/go.mod h1:vHxGWqD/uh6+GQb9Sqv7OGMs+Rvc2dsFVc0XtgRh1ZU=
-github.com/armosec/k8s-interface v0.0.70 h1:NU3UIaNl7H3hsRecwggiaQbZXTwXtOKg3GOBjq6/XJw=
 github.com/armosec/k8s-interface v0.0.70/go.mod h1:8NX4xWXh8mwW7QyZdZea1czNdM2azCK9BbUNmiZYXW0=
+github.com/armosec/k8s-interface v0.0.76 h1:pQaF+8BcNMm6GTYTjdG7vCM1l4BIk7oALXoT6v5gCAk=
+github.com/armosec/k8s-interface v0.0.76/go.mod h1:8NX4xWXh8mwW7QyZdZea1czNdM2azCK9BbUNmiZYXW0=
 github.com/armosec/opa-utils v0.0.64/go.mod h1:6tQP8UDq2EvEfSqh8vrUdr/9QVSCG4sJfju1SXQOn4c=
-github.com/armosec/opa-utils v0.0.137/go.mod h1:mCFQzz4E227f7V2jQVQ9XCivkNNK3UWCTaZ0HE5rBWk=
-github.com/armosec/opa-utils v0.0.139 h1:JPxgPXVJUUIujtIoZk6TejE8PkZhX2pYnpj+E8PhcfA=
 github.com/armosec/opa-utils v0.0.139/go.mod h1:VnRVJgDDPFAprGDcibTtKHf9wgkoyTU8wmX2BxEIwok=
+github.com/armosec/opa-utils v0.0.140 h1:iv6inb6+D0qgeVkv7f+ZIHpy239IUpAwg6Dau0JAWzg=
+github.com/armosec/opa-utils v0.0.140/go.mod h1:Hwm9ZkcW87mB2567WT6mBuSBEzaKowBNfrl3Q0IVsV8=
 github.com/armosec/rbac-utils v0.0.1/go.mod h1:pQ8CBiij8kSKV7aeZm9FMvtZN28VgA7LZcYyTWimq40=
 github.com/armosec/rbac-utils v0.0.14 h1:CKYKcgqJEXWF2Hen/B1pVGtS3nDAG1wp9dDv6oNtq90=
 github.com/armosec/rbac-utils v0.0.14/go.mod h1:Ex/IdGWhGv9HZq6Hs8N/ApzCKSIvpNe/ETqDfnuyah0=

httphandler/handlerequests/v1/datastructuremethods.go

@@ -5,6 +5,7 @@ import (
 
 	apisv1 "github.com/armosec/opa-utils/httpserver/apis/v1"
 	utilsmetav1 "github.com/armosec/opa-utils/httpserver/meta/v1"
+	"k8s.io/utils/strings/slices"
 
 	"github.com/armosec/kubescape/v2/core/cautils"
 	"github.com/armosec/kubescape/v2/core/cautils/getter"
@@ -59,6 +60,9 @@ func ToScanInfo(scanRequest *utilsmetav1.PostScanRequest) *cautils.ScanInfo {
 }
 
 func setTargetInScanInfo(scanRequest *utilsmetav1.PostScanRequest, scanInfo *cautils.ScanInfo) {
+	// remove empty targets from slice
+	scanRequest.TargetNames = slices.Filter(nil, scanRequest.TargetNames, func(e string) bool { return e != "" })
+
 	if scanRequest.TargetType != "" && len(scanRequest.TargetNames) > 0 {
 		if strings.EqualFold(string(scanRequest.TargetType), string(apisv1.KindFramework)) {
 			scanRequest.TargetType = apisv1.KindFramework

httphandler/handlerequests/v1/datastructuremethods_test.go

@@ -61,6 +61,17 @@ func TestToScanInfo(t *testing.T) {
 }
 
 func TestSetTargetInScanInfo(t *testing.T) {
+	{
+		req := &utilsmetav1.PostScanRequest{
+			TargetType:  apisv1.KindFramework,
+			TargetNames: []string{""},
+		}
+		scanInfo := &cautils.ScanInfo{}
+		setTargetInScanInfo(req, scanInfo)
+		assert.True(t, scanInfo.FrameworkScan)
+		assert.True(t, scanInfo.ScanAll)
+		assert.Equal(t, 0, len(scanInfo.PolicyIdentifier))
+	}
 	{
 		req := &utilsmetav1.PostScanRequest{
 			TargetType:  apisv1.KindFramework,

httphandler/handlerequests/v1/prometheus.go

@@ -7,49 +7,56 @@ import (
 	"path/filepath"
 
 	"github.com/armosec/kubescape/v2/core/cautils"
-	"github.com/armosec/kubescape/v2/core/cautils/logger"
-	"github.com/armosec/kubescape/v2/core/cautils/logger/helpers"
-	"github.com/armosec/kubescape/v2/core/core"
+	utilsapisv1 "github.com/armosec/opa-utils/httpserver/apis/v1"
 	"github.com/google/uuid"
 )
 
 // Metrics http listener for prometheus support
 func (handler *HTTPHandler) Metrics(w http.ResponseWriter, r *http.Request) {
-	if handler.state.isBusy() { // if already scanning the cluster
-		message := fmt.Sprintf("scan '%s' in action", handler.state.getID())
-		logger.L().Info("server is busy", helpers.String("message", message), helpers.Time())
-		w.WriteHeader(http.StatusServiceUnavailable)
-		w.Write([]byte(message))
-		return
-	}
-
-	handler.state.setBusy()
-	defer handler.state.setNotBusy()
 
 	scanID := uuid.NewString()
-	handler.state.setID(scanID)
+	handler.state.setBusy(scanID)
+	defer handler.state.setNotBusy(scanID)
 
 	resultsFile := filepath.Join(OutputDir, scanID)
+	scanInfo := getPrometheusDefaultScanCommand(scanID, resultsFile)
 
-	// trigger scanning
-	logger.L().Info(handler.state.getID(), helpers.String("action", "triggering scan"), helpers.Time())
-	ks := core.NewKubescape()
-	results, err := ks.Scan(getPrometheusDefaultScanCommand(scanID, resultsFile))
-	if err != nil {
+	scanParams := &scanRequestParams{
+		scanQueryParams: &ScanQueryParams{
+			ReturnResults: true,
+			KeepResults:   false,
+		},
+		scanInfo: scanInfo,
+		scanID:   scanID,
+	}
+
+	handler.scanResponseChan.set(scanID) // add scan to channel
+	defer handler.scanResponseChan.delete(scanID)
+
+	// send to scan queue
+	handler.scanRequestChan <- scanParams
+
+	// wait for scan to complete
+	results := <-handler.scanResponseChan.get(scanID)
+	defer removeResultsFile(scanID) // remove json format results file
+	defer os.Remove(resultsFile)    // remove prometheus format results file
+
+	// handle response
+	if results.Type == utilsapisv1.ErrorScanResponseType {
 		w.WriteHeader(http.StatusInternalServerError)
-		w.Write([]byte(fmt.Sprintf("failed to complete scan. reason: %s", err.Error())))
+		w.Write(responseToBytes(results))
 		return
 	}
-	results.HandleResults()
-	logger.L().Info(handler.state.getID(), helpers.String("action", "done scanning"), helpers.Time())
 
+	// read prometheus format results file
 	f, err := os.ReadFile(resultsFile)
 	if err != nil {
 		w.WriteHeader(http.StatusInternalServerError)
-		w.Write([]byte(fmt.Sprintf("failed read results from file. reason: %s", err.Error())))
+		results.Type = utilsapisv1.ErrorScanResponseType
+		results.Response = fmt.Sprintf("failed read results from file. reason: %s", err.Error())
+		w.Write(responseToBytes(results))
 		return
 	}
-	os.Remove(resultsFile)
 
 	w.WriteHeader(http.StatusOK)
 	w.Write(f)

httphandler/handlerequests/v1/requestparser.go

@@ -0,0 +1,110 @@
+package v1
+
+import (
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"sync"
+
+	"github.com/armosec/kubescape/v2/core/cautils"
+	"github.com/armosec/kubescape/v2/core/cautils/logger"
+	"github.com/armosec/kubescape/v2/core/cautils/logger/helpers"
+	utilsmetav1 "github.com/armosec/opa-utils/httpserver/meta/v1"
+	"github.com/gorilla/schema"
+)
+
+type scanResponseChan struct {
+	scanResponseChan map[string]chan *utilsmetav1.Response
+	mtx              sync.RWMutex
+}
+
+// get response object chan
+func (resChan *scanResponseChan) get(key string) chan *utilsmetav1.Response {
+	resChan.mtx.RLock()
+	defer resChan.mtx.RUnlock()
+	return resChan.scanResponseChan[key]
+}
+
+// set chan for response object
+func (resChan *scanResponseChan) set(key string) {
+	resChan.mtx.Lock()
+	defer resChan.mtx.Unlock()
+	resChan.scanResponseChan[key] = make(chan *utilsmetav1.Response)
+}
+
+// push response object to chan
+func (resChan *scanResponseChan) push(key string, resp *utilsmetav1.Response) {
+	resChan.mtx.Lock()
+	defer resChan.mtx.Unlock()
+	if _, ok := resChan.scanResponseChan[key]; ok {
+		resChan.scanResponseChan[key] <- resp
+	}
+}
+
+// delete channel
+func (resChan *scanResponseChan) delete(key string) {
+	resChan.mtx.Lock()
+	defer resChan.mtx.Unlock()
+	delete(resChan.scanResponseChan, key)
+}
+func newScanResponseChan() *scanResponseChan {
+	return &scanResponseChan{
+		scanResponseChan: make(map[string]chan *utilsmetav1.Response),
+		mtx:              sync.RWMutex{},
+	}
+}
+
+type ScanQueryParams struct {
+	ReturnResults bool `schema:"wait"` // wait for scanning to complete (synchronized request)
+	KeepResults   bool `schema:"keep"` // do not delete results after returning (relevant only for synchronized requests)
+}
+
+type ResultsQueryParams struct {
+	ScanID      string `schema:"id"`
+	KeepResults bool   `schema:"keep"` // do not delete results after returning (default will delete results)
+	AllResults  bool   `schema:"all"`  // delete all results
+}
+
+type StatusQueryParams struct {
+	ScanID string `schema:"id"`
+}
+
+// scanRequestParams params passed to channel
+type scanRequestParams struct {
+	scanInfo        *cautils.ScanInfo // request as received from api
+	scanQueryParams *ScanQueryParams  // request as received from api
+	scanID          string            // generated scan ID
+}
+
+func getScanParamsFromRequest(r *http.Request, scanID string) (*scanRequestParams, error) {
+	defer r.Body.Close()
+
+	scanRequestParams := &scanRequestParams{}
+
+	scanQueryParams := &ScanQueryParams{}
+	if err := schema.NewDecoder().Decode(scanQueryParams, r.URL.Query()); err != nil {
+		return scanRequestParams, fmt.Errorf("failed to parse query params, reason: %s", err.Error())
+	}
+
+	readBuffer, err := ioutil.ReadAll(r.Body)
+	if err != nil {
+		// handler.writeError(w, fmt.Errorf("failed to read request body, reason: %s", err.Error()), scanID)
+		return scanRequestParams, fmt.Errorf("failed to read request body, reason: %s", err.Error())
+	}
+
+	logger.L().Info("REST API received scan request", helpers.String("body", string(readBuffer)))
+
+	scanRequest := &utilsmetav1.PostScanRequest{}
+	if err := json.Unmarshal(readBuffer, &scanRequest); err != nil {
+		return scanRequestParams, fmt.Errorf("failed to parse request payload, reason: %s", err.Error())
+	}
+
+	scanInfo := getScanCommand(scanRequest, scanID)
+
+	scanRequestParams.scanID = scanID
+	scanRequestParams.scanQueryParams = scanQueryParams
+	scanRequestParams.scanInfo = scanInfo
+
+	return scanRequestParams, nil
+}

httphandler/handlerequests/v1/requestparser_test.go

@@ -0,0 +1,76 @@
+package v1
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/url"
+	"testing"
+
+	utilsmetav1 "github.com/armosec/opa-utils/httpserver/meta/v1"
+	"github.com/armosec/utils-go/boolutils"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetScanParamsFromRequest(t *testing.T) {
+	{
+		body := utilsmetav1.PostScanRequest{
+			Submit:      boolutils.BoolPointer(true),
+			HostScanner: boolutils.BoolPointer(true),
+			Account:     "aaaaaaaaaa",
+		}
+
+		jsonBytes, err := json.Marshal(body)
+		assert.NoError(t, err)
+
+		u := url.URL{
+			Scheme:   "http",
+			Host:     "bla",
+			Path:     "bla",
+			RawQuery: "wait=true&keep=true",
+		}
+		request, err := http.NewRequest(http.MethodPost, u.String(), bytes.NewReader(jsonBytes))
+		assert.NoError(t, err)
+
+		scanID := "ccccccc"
+
+		req, err := getScanParamsFromRequest(request, scanID)
+		assert.NoError(t, err)
+		assert.Equal(t, scanID, req.scanID)
+		assert.True(t, req.scanQueryParams.KeepResults)
+		assert.True(t, req.scanQueryParams.ReturnResults)
+		assert.True(t, req.scanInfo.HostSensorEnabled.GetBool())
+		assert.True(t, req.scanInfo.Submit)
+		assert.Equal(t, "aaaaaaaaaa", req.scanInfo.Account)
+	}
+
+	{
+		body := utilsmetav1.PostScanRequest{
+			Submit:      boolutils.BoolPointer(false),
+			HostScanner: boolutils.BoolPointer(false),
+			Account:     "aaaaaaaaaa",
+		}
+
+		jsonBytes, err := json.Marshal(body)
+		assert.NoError(t, err)
+
+		u := url.URL{
+			Scheme: "http",
+			Host:   "bla",
+			Path:   "bla",
+		}
+		request, err := http.NewRequest(http.MethodPost, u.String(), bytes.NewReader(jsonBytes))
+		assert.NoError(t, err)
+
+		scanID := "ccccccc"
+
+		req, err := getScanParamsFromRequest(request, scanID)
+		assert.NoError(t, err)
+		assert.Equal(t, scanID, req.scanID)
+		assert.False(t, req.scanQueryParams.KeepResults)
+		assert.False(t, req.scanQueryParams.ReturnResults)
+		assert.False(t, req.scanInfo.HostSensorEnabled.GetBool())
+		assert.False(t, req.scanInfo.Submit)
+		assert.Equal(t, "aaaaaaaaaa", req.scanInfo.Account)
+	}
+}

httphandler/handlerequests/v1/requestshandler.go

@@ -1,11 +1,8 @@
 package v1
 
 import (
-	"encoding/json"
 	"fmt"
-	"io/ioutil"
 	"net/http"
-	"sync"
 
 	utilsapisv1 "github.com/armosec/opa-utils/httpserver/apis/v1"
 	utilsmetav1 "github.com/armosec/opa-utils/httpserver/meta/v1"
@@ -19,35 +16,27 @@ import (
 var OutputDir = "./results"
 var FailedOutputDir = "./failed"
 
-type ScanQueryParams struct {
-	ReturnResults bool `schema:"wait"` // wait for scanning to complete (synchronized request)
-	KeepResults   bool `schema:"keep"` // do not delete results after returning (relevant only for synchronized requests)
-}
-
-type ResultsQueryParams struct {
-	ScanID      string `schema:"id"`
-	KeepResults bool   `schema:"keep"` // do not delete results after returning (default will delete results)
-	AllResults  bool   `schema:"all"`  // delete all results
-}
-
-type StatusQueryParams struct {
-	ScanID string `schema:"id"`
-}
-
 type HTTPHandler struct {
-	state *serverState
+	state            *serverState
+	scanResponseChan *scanResponseChan
+	scanRequestChan  chan *scanRequestParams
 }
 
 func NewHTTPHandler() *HTTPHandler {
-	return &HTTPHandler{
-		state: newServerState(),
+	handler := &HTTPHandler{
+		state:            newServerState(),
+		scanRequestChan:  make(chan *scanRequestParams),
+		scanResponseChan: newScanResponseChan(),
 	}
+	go handler.executeScan()
+
+	return handler
 }
 
 // ============================================== STATUS ========================================================
 // Status API
 func (handler *HTTPHandler) Status(w http.ResponseWriter, r *http.Request) {
-	defer handler.recover(w)
+	defer handler.recover(w, "")
 
 	if r.Method != http.MethodGet {
 		w.WriteHeader(http.StatusMethodNotAllowed)
@@ -59,117 +48,81 @@ func (handler *HTTPHandler) Status(w http.ResponseWriter, r *http.Request) {
 
 	statusQueryParams := &StatusQueryParams{}
 	if err := schema.NewDecoder().Decode(statusQueryParams, r.URL.Query()); err != nil {
-		handler.writeError(w, fmt.Errorf("failed to parse query params, reason: %s", err.Error()))
+		handler.writeError(w, fmt.Errorf("failed to parse query params, reason: %s", err.Error()), "")
 		return
 	}
 
-	if !handler.state.isBusy() {
+	if !handler.state.isBusy(statusQueryParams.ScanID) {
 		response.Type = utilsapisv1.NotBusyScanResponseType
 		w.Write(responseToBytes(&response))
 		return
 	}
 
-	currentScanID := handler.state.getID()
-	if statusQueryParams.ScanID != "" && currentScanID != statusQueryParams.ScanID {
-		response.Type = utilsapisv1.NotBusyScanResponseType
-		w.Write(responseToBytes(&response))
-		return
+	if statusQueryParams.ScanID == "" {
+		statusQueryParams.ScanID = handler.state.getLatestID()
 	}
 
-	response.Response = currentScanID
-	response.ID = currentScanID
+	response.Response = statusQueryParams.ScanID
+	response.ID = statusQueryParams.ScanID
 	response.Type = utilsapisv1.BusyScanResponseType
 	w.Write(responseToBytes(&response))
 }
 
 // ============================================== SCAN ========================================================
-// Scan API - TODO: break down to functions
+// Scan API
 func (handler *HTTPHandler) Scan(w http.ResponseWriter, r *http.Request) {
 
-	defer handler.recover(w)
+	// generate id
+	scanID := uuid.NewString()
 
-	defer r.Body.Close()
+	defer handler.recover(w, scanID)
 
 	if r.Method != http.MethodPost {
 		w.WriteHeader(http.StatusMethodNotAllowed)
 		return
 	}
-	response := utilsmetav1.Response{}
 	w.Header().Set("Content-Type", "application/json")
 
-	scanQueryParams := &ScanQueryParams{}
-	if err := schema.NewDecoder().Decode(scanQueryParams, r.URL.Query()); err != nil {
-		handler.writeError(w, fmt.Errorf("failed to parse query params, reason: %s", err.Error()))
-		return
-	}
-	if handler.state.isBusy() {
-		// TODO - Add to queue
-		w.WriteHeader(http.StatusOK)
-		response.Response = handler.state.getID()
-		response.ID = handler.state.getID()
-		response.Type = utilsapisv1.IDScanResponseType
-		w.Write(responseToBytes(&response))
-		return
-	}
-
-	handler.state.setBusy()
-
-	// generate id
-	scanID := uuid.NewString()
-	handler.state.setID(scanID)
-	response.ID = scanID
-	response.Type = utilsapisv1.IDScanResponseType
-
-	readBuffer, err := ioutil.ReadAll(r.Body)
+	scanRequestParams, err := getScanParamsFromRequest(r, scanID)
 	if err != nil {
-		handler.writeError(w, fmt.Errorf("failed to read request body, reason: %s", err.Error()))
-		return
-	}
-	scanRequest := utilsmetav1.PostScanRequest{}
-	if err := json.Unmarshal(readBuffer, &scanRequest); err != nil {
-		handler.writeError(w, fmt.Errorf("failed to parse request payload, reason: %s", err.Error()))
+		handler.writeError(w, err, "")
 		return
 	}
 
-	var wg sync.WaitGroup
-	if scanQueryParams.ReturnResults {
-		wg.Add(1)
-	} else {
-		wg.Add(0)
-	}
-	statusCode := http.StatusOK
+	handler.state.setBusy(scanID)
+
+	response := &utilsmetav1.Response{}
+	response.ID = scanID
+	response.Type = utilsapisv1.BusyScanResponseType
+	response.Response = fmt.Sprintf("scanning '%s' is in progress", scanID)
+
+	handler.scanResponseChan.set(scanID) // add channel
+	defer handler.scanResponseChan.delete(scanID)
+
+	// you must use a goroutine since the executeScan function is not always listening to the channel
 	go func() {
-		// execute scan in the background
+		// send to scanning handler
+		handler.scanRequestChan <- scanRequestParams
+	}()
 
-		logger.L().Info("scan triggered", helpers.String("ID", scanID))
+	if scanRequestParams.scanQueryParams.ReturnResults {
+		// wait for scan to complete
+		response = <-handler.scanResponseChan.get(scanID)
 
-		results, err := scan(&scanRequest, scanID)
-		if err != nil {
-			logger.L().Error("scanning failed", helpers.String("ID", scanID), helpers.Error(err))
-			if scanQueryParams.ReturnResults {
-				response.Type = utilsapisv1.ErrorScanResponseType
-				response.Response = err.Error()
-				statusCode = http.StatusInternalServerError
-			}
-		} else {
-			logger.L().Success("done scanning", helpers.String("ID", scanID))
-			if scanQueryParams.ReturnResults {
-				response.Type = utilsapisv1.ResultsV1ScanResponseType
-				response.Response = results
-				wg.Done()
-			}
-		}
-		if scanQueryParams.ReturnResults && !scanQueryParams.KeepResults {
+		if scanRequestParams.scanQueryParams.KeepResults {
+			// delete results after returning
 			logger.L().Debug("deleting results", helpers.String("ID", scanID))
 			removeResultsFile(scanID)
 		}
-		handler.state.setNotBusy()
-	}()
+	}
 
-	wg.Wait()
+	statusCode := http.StatusOK
+	if response.Type == utilsapisv1.ErrorScanResponseType {
+		statusCode = http.StatusInternalServerError
+	}
 
 	w.WriteHeader(statusCode)
-	w.Write(responseToBytes(&response))
+	w.Write(responseToBytes(response))
 }
 
 // ============================================== RESULTS ========================================================
@@ -179,13 +132,13 @@ func (handler *HTTPHandler) Results(w http.ResponseWriter, r *http.Request) {
 	response := utilsmetav1.Response{}
 	w.Header().Set("Content-Type", "application/json")
 
-	defer handler.recover(w)
+	defer handler.recover(w, "")
 
 	defer r.Body.Close()
 
 	resultsQueryParams := &ResultsQueryParams{}
 	if err := schema.NewDecoder().Decode(resultsQueryParams, r.URL.Query()); err != nil {
-		handler.writeError(w, fmt.Errorf("failed to parse query params, reason: %s", err.Error()))
+		handler.writeError(w, fmt.Errorf("failed to parse query params, reason: %s", err.Error()), "")
 		return
 	}
 
@@ -195,22 +148,22 @@ func (handler *HTTPHandler) Results(w http.ResponseWriter, r *http.Request) {
 
 	if resultsQueryParams.ScanID == "" { // if no scan found
 		logger.L().Info("empty scan ID")
-		w.WriteHeader(http.StatusBadRequest) // Should we return ok?
-		response.Response = "latest scan not found. trigger again"
+		w.WriteHeader(http.StatusBadRequest)
+		response.Response = "latest scan not found"
 		response.Type = utilsapisv1.ErrorScanResponseType
 		w.Write(responseToBytes(&response))
 		return
 	}
 	response.ID = resultsQueryParams.ScanID
 
-	if handler.state.isBusy() { // if requested ID is still scanning
-		if resultsQueryParams.ScanID == handler.state.getID() {
-			logger.L().Info("scan in process", helpers.String("ID", resultsQueryParams.ScanID))
-			w.WriteHeader(http.StatusOK)
-			response.Response = "scanning in progress"
-			w.Write(responseToBytes(&response))
-			return
-		}
+	if handler.state.isBusy(resultsQueryParams.ScanID) { // if requested ID is still scanning
+		logger.L().Info("scan in process", helpers.String("ID", resultsQueryParams.ScanID))
+		w.WriteHeader(http.StatusOK)
+		response.Type = utilsapisv1.BusyScanResponseType
+		response.Response = fmt.Sprintf("scanning '%s' in progress", resultsQueryParams.ScanID)
+		w.Write(responseToBytes(&response))
+		return
+
 	}
 
 	switch r.Method {
@@ -256,15 +209,10 @@ func (handler *HTTPHandler) Ready(w http.ResponseWriter, r *http.Request) {
 	w.WriteHeader(http.StatusOK)
 }
 
-func responseToBytes(res *utilsmetav1.Response) []byte {
-	b, _ := json.Marshal(res)
-	return b
-}
-
-func (handler *HTTPHandler) recover(w http.ResponseWriter) {
+func (handler *HTTPHandler) recover(w http.ResponseWriter, scanID string) {
 	response := utilsmetav1.Response{}
 	if err := recover(); err != nil {
-		handler.state.setNotBusy()
+		handler.state.setNotBusy(scanID)
 		logger.L().Error("recover", helpers.Error(fmt.Errorf("%v", err)))
 		w.WriteHeader(http.StatusInternalServerError)
 		response.Response = fmt.Sprintf("%v", err)
@@ -273,11 +221,11 @@ func (handler *HTTPHandler) recover(w http.ResponseWriter) {
 	}
 }
 
-func (handler *HTTPHandler) writeError(w http.ResponseWriter, err error) {
+func (handler *HTTPHandler) writeError(w http.ResponseWriter, err error, scanID string) {
 	response := utilsmetav1.Response{}
 	w.WriteHeader(http.StatusBadRequest)
 	response.Response = err.Error()
 	response.Type = utilsapisv1.ErrorScanResponseType
 	w.Write(responseToBytes(&response))
-	handler.state.setNotBusy()
+	handler.state.setNotBusy(scanID)
 }

httphandler/handlerequests/v1/requestshandler_test.go

@@ -0,0 +1,32 @@
+package v1
+
+// ============================================== STATUS ========================================================
+// Status API
+// func TestStatus(t *testing.T) {
+
+// 	{
+// 		httpHandler := NewHTTPHandler()
+
+// 		u := url.URL{
+// 			Scheme:   "http",
+// 			Host:     "bla",
+// 			Path:     "bla",
+// 			RawQuery: "wait=true&keep=true",
+// 		}
+// 		request, err := http.NewRequest(http.MethodPost, u.String(), nil)
+// 		httpHandler.Status(nil, request)
+
+// 		assert.NoError(t, err)
+
+// 		scanID := "ccccccc"
+
+// 		req, err := getScanParamsFromRequest(request, scanID)
+// 		assert.NoError(t, err)
+// 		assert.Equal(t, scanID, req.scanID)
+// 		assert.True(t, req.scanQueryParams.KeepResults)
+// 		assert.True(t, req.scanQueryParams.ReturnResults)
+// 		assert.True(t, *req.scanRequest.HostScanner)
+// 		assert.True(t, *req.scanRequest.Submit)
+// 		assert.Equal(t, "aaaaaaaaaa", req.scanRequest.Account)
+// 	}
+// }

httphandler/handlerequests/v1/requestshandlerutils.go

@@ -9,14 +9,48 @@ import (
 
 	"github.com/armosec/kubescape/v2/core/cautils"
 	"github.com/armosec/kubescape/v2/core/cautils/getter"
+	"github.com/armosec/kubescape/v2/core/cautils/logger"
+	"github.com/armosec/kubescape/v2/core/cautils/logger/helpers"
 	"github.com/armosec/kubescape/v2/core/core"
+	utilsapisv1 "github.com/armosec/opa-utils/httpserver/apis/v1"
 	utilsmetav1 "github.com/armosec/opa-utils/httpserver/meta/v1"
 	reporthandlingv2 "github.com/armosec/opa-utils/reporthandling/v2"
 	"github.com/armosec/utils-go/boolutils"
 )
 
-func scan(scanRequest *utilsmetav1.PostScanRequest, scanID string) (*reporthandlingv2.PostureReport, error) {
-	scanInfo := getScanCommand(scanRequest, scanID)
+// executeScan execute the scan request passed in the channel
+func (handler *HTTPHandler) executeScan() {
+	for {
+		scanReq := <-handler.scanRequestChan
+
+		logger.L().Info("triggering scan", helpers.String("scanID", scanReq.scanID))
+
+		response := &utilsmetav1.Response{}
+
+		logger.L().Info("scan triggered", helpers.String("ID", scanReq.scanID))
+		results, err := scan(scanReq.scanInfo, scanReq.scanID)
+		if err != nil {
+			logger.L().Error("scanning failed", helpers.String("ID", scanReq.scanID), helpers.Error(err))
+			if scanReq.scanQueryParams.ReturnResults {
+				response.Type = utilsapisv1.ErrorScanResponseType
+				response.Response = err.Error()
+			}
+		} else {
+			logger.L().Success("done scanning", helpers.String("ID", scanReq.scanID))
+			if scanReq.scanQueryParams.ReturnResults {
+				response.Type = utilsapisv1.ResultsV1ScanResponseType
+				response.Response = results
+			}
+		}
+
+		handler.state.setNotBusy(scanReq.scanID)
+
+		// return results
+		handler.scanResponseChan.push(scanReq.scanID, response)
+
+	}
+}
+func scan(scanInfo *cautils.ScanInfo, scanID string) (*reporthandlingv2.PostureReport, error) {
 
 	ks := core.NewKubescape()
 	result, err := ks.Scan(scanInfo)
@@ -136,7 +170,7 @@ func writeScanErrorToFile(err error, scanID string) error {
 	if e := os.MkdirAll(filepath.Dir(FailedOutputDir), os.ModePerm); e != nil {
 		return fmt.Errorf("failed to scan. reason: '%s'. failed to save error in file - failed to create directory. reason: %s", err.Error(), e.Error())
 	}
-	f, e := os.Create(filepath.Join(FailedOutputDir, scanID))
+	f, e := os.Create(filepath.Join(filepath.Dir(FailedOutputDir), scanID))
 	if e != nil {
 		return fmt.Errorf("failed to scan. reason: '%s'. failed to save error in file - failed to open file for writing. reason: %s", err.Error(), e.Error())
 	}
@@ -147,3 +181,9 @@ func writeScanErrorToFile(err error, scanID string) error {
 	}
 	return fmt.Errorf("failed to scan. reason: '%s'", err.Error())
 }
+
+// responseToBytes convert response object to bytes
+func responseToBytes(res *utilsmetav1.Response) []byte {
+	b, _ := json.Marshal(res)
+	return b
+}

httphandler/handlerequests/v1/serverstate.go

@@ -3,44 +3,32 @@ package v1
 import "sync"
 
 type serverState struct {
-	// response string
-	busy     bool
-	id       string
+	statusID map[string]bool
 	latestID string
 	mtx      sync.RWMutex
 }
 
-func (s *serverState) isBusy() bool {
+// isBusy is server busy with ID, if id is empty will check for latest ID
+func (s *serverState) isBusy(id string) bool {
 	s.mtx.RLock()
-	busy := s.busy
+	if id == "" {
+		id = s.latestID
+	}
+	busy := s.statusID[id]
 	s.mtx.RUnlock()
 	return busy
 }
 
-func (s *serverState) setBusy() {
+func (s *serverState) setBusy(id string) {
 	s.mtx.Lock()
-	s.busy = true
+	s.statusID[id] = true
+	s.latestID = id
 	s.mtx.Unlock()
 }
 
-func (s *serverState) setNotBusy() {
+func (s *serverState) setNotBusy(id string) {
 	s.mtx.Lock()
-	s.busy = false
-	s.latestID = s.id
-	s.id = ""
-	s.mtx.Unlock()
-}
-
-func (s *serverState) getID() string {
-	s.mtx.RLock()
-	id := s.id
-	s.mtx.RUnlock()
-	return id
-}
-
-func (s *serverState) setID(id string) {
-	s.mtx.Lock()
-	s.id = id
+	delete(s.statusID, id)
 	s.mtx.Unlock()
 }
 
@@ -51,9 +39,16 @@ func (s *serverState) getLatestID() string {
 	return id
 }
 
+func (s *serverState) len() int {
+	s.mtx.RLock()
+	l := len(s.statusID)
+	s.mtx.RUnlock()
+	return l
+}
+
 func newServerState() *serverState {
 	return &serverState{
-		busy: false,
-		mtx:  sync.RWMutex{},
+		statusID: make(map[string]bool),
+		mtx:      sync.RWMutex{},
 	}
 }