mirror of
https://github.com/kubescape/kubescape.git
synced 2026-04-15 06:58:11 +00:00
* phase-1 Signed-off-by: Daniel Grunberger <danielgrunberger@armosec.io> * factory Signed-off-by: Daniel Grunberger <danielgrunberger@armosec.io> * wip: feat(cli): add an image scanning command Add a CLI command that launches an image scan. Does not scan images yet. Signed-off-by: Vlad Klokun <vklokun@protonmail.ch> * wip: feat: add image scanning service Signed-off-by: Vlad Klokun <vklokun@protonmail.ch> * chore: include dependencies Signed-off-by: Vlad Klokun <vklokun@protonmail.ch> * wip: adjust image scanning service Signed-off-by: Vlad Klokun <vklokun@protonmail.ch> * wip: feat: use scanning service in CLI Signed-off-by: Vlad Klokun <vklokun@protonmail.ch> * use iface Signed-off-by: Daniel Grunberger <danielgrunberger@armosec.io> * touches Signed-off-by: Daniel Grunberger <danielgrunberger@armosec.io> * continue Signed-off-by: Daniel Grunberger <danielgrunberger@armosec.io> * add cmd Signed-off-by: Daniel Grunberger <danielgrunberger@armosec.io> * support single workload scan Signed-off-by: Amir Malka <amirm@armosec.io> * fix conflict Signed-off-by: Amir Malka <amirm@armosec.io> * identifiers * go mod * feat(imagescan): add an image scanning command This commit adds a CLI command and an associated package that scan images for vulnerabilities. Signed-off-by: Vlad Klokun <vklokun@protonmail.ch> feat(imagescan): fail on exceeding the severity threshold Signed-off-by: Vlad Klokun <vklokun@protonmail.ch> * chore(imagescan): include dependencies This commit adds the dependencies necessary for image scanning. Signed-off-by: Vlad Klokun <vklokun@protonmail.ch> * chore(imagescan): add dependencies to httphandler Signed-off-by: Vlad Klokun <vklokun@protonmail.ch> * added unit tests Signed-off-by: Amir Malka <amirm@armosec.io> * merge * more * integrate img scan * added unit tests Signed-off-by: Amir Malka <amirm@armosec.io> * more refactoring Signed-off-by: Amir Malka <amirm@armosec.io> * add scanned workload reference to opasessionobj Signed-off-by: Amir Malka <amirm@armosec.io> * fix GetWorkloadParentKind Signed-off-by: Amir Malka <amirm@armosec.io> * remove namespace argument from pullSingleResource, using field selector instead Signed-off-by: Amir Malka <amirm@armosec.io> * removed designators (unused) field from PolicyIdentifier, and designators argument from GetResources function Signed-off-by: Amir Malka <amirm@armosec.io> * changes * changes * fixes * changes * feat(imagescan): add an image scanning command This commit adds a CLI command and an associated package that scan images for vulnerabilities. Signed-off-by: Vlad Klokun <vklokun@protonmail.ch> feat(imagescan): fail on exceeding the severity threshold Signed-off-by: Vlad Klokun <vklokun@protonmail.ch> * chore(imagescan): include dependencies This commit adds the dependencies necessary for image scanning. Signed-off-by: Vlad Klokun <vklokun@protonmail.ch> * chore(imagescan): add dependencies to httphandler Signed-off-by: Vlad Klokun <vklokun@protonmail.ch> * chore(imagescan): create vuln db with dedicated function Remove commented out code, too. Signed-off-by: Vlad Klokun <vklokun@protonmail.ch> * docs(imagescan): provide package-level docs Signed-off-by: Vlad Klokun <vklokun@protonmail.ch> * finish merge * image scan tests * continue * fixes * refactor * rm duplicate * start fixes * update gh actions Signed-off-by: David Wertenteil <dwertent@armosec.io> * pr fixes * fix test * improvements --------- Signed-off-by: Daniel Grunberger <danielgrunberger@armosec.io> Signed-off-by: Vlad Klokun <vklokun@protonmail.ch> Signed-off-by: Amir Malka <amirm@armosec.io> Signed-off-by: David Wertenteil <dwertent@armosec.io> Co-authored-by: Daniel Grunberger <danielgrunberger@armosec.io> Co-authored-by: Vlad Klokun <vklokun@protonmail.ch> Co-authored-by: Amir Malka <amirm@armosec.io> Co-authored-by: David Wertenteil <dwertent@armosec.io>
122 lines
3.5 KiB
Bash
122 lines
3.5 KiB
Bash
#!/bin/bash
|
|
set -e
|
|
|
|
while getopts v: option
|
|
do
|
|
case ${option} in
|
|
v) RELEASE="download/${OPTARG}";;
|
|
*) ;;
|
|
esac
|
|
done
|
|
|
|
if [ -z "${RELEASE}" ]; then
|
|
RELEASE="latest/download"
|
|
fi
|
|
|
|
echo -e "\033[0;36mInstalling Kubescape..."
|
|
echo
|
|
|
|
BASE_DIR=~/.kubescape
|
|
KUBESCAPE_EXEC=kubescape
|
|
|
|
osName=$(uname -s)
|
|
if [[ $osName == *"MINGW"* ]]; then
|
|
osName=windows
|
|
elif [[ $osName == *"Darwin"* ]]; then
|
|
osName=macos
|
|
else
|
|
osName=ubuntu
|
|
fi
|
|
|
|
arch=$(uname -m)
|
|
if [[ $arch == *"aarch64"* || $arch == *"arm64"* ]]; then
|
|
arch="-arm64"
|
|
else
|
|
if [[ $arch != *"x86_64"* ]]; then
|
|
echo -e "\033[33mArchitecture $arch may be unsupported, will try to install the amd64 one anyway."
|
|
fi
|
|
arch=""
|
|
fi
|
|
|
|
mkdir -p $BASE_DIR
|
|
|
|
OUTPUT=$BASE_DIR/$KUBESCAPE_EXEC
|
|
DOWNLOAD_URL="https://github.com/kubescape/kubescape/releases/${RELEASE}/kubescape${arch}-${osName}-latest"
|
|
|
|
curl --progress-bar -L $DOWNLOAD_URL -o $OUTPUT
|
|
|
|
# Find install dir
|
|
install_dir=/usr/local/bin # default if running as root
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
install_dir=$BASE_DIR/bin # if not running as root, install to user dir
|
|
export PATH=$PATH:$BASE_DIR/bin
|
|
fi
|
|
|
|
# Create install dir if it does not exist
|
|
if [ ! -d "$install_dir" ]; then
|
|
mkdir -p $install_dir
|
|
fi
|
|
|
|
chmod +x $OUTPUT 2>/dev/null
|
|
|
|
# cleaning up old install
|
|
SUDO=
|
|
if [ "$(id -u)" -ne 0 ] && [ -n "$(which sudo)" ] && [ "$KUBESCAPE_EXEC" != "" ] && [ -f /usr/local/bin/$KUBESCAPE_EXEC ]; then
|
|
SUDO=sudo
|
|
echo -e "\n\033[33mOld installation as root found, do you want to remove it? [\033[0my\033[33m/n]:"
|
|
read -n 1 -r
|
|
if [[ ! $REPLY =~ ^[Yy]$ ]] && [[ "$REPLY" != "" ]]; then
|
|
echo -e "\n\033[0mSkipping old installation as root removal."
|
|
else
|
|
echo -e "\n\033[0mWe will need the root access to uninstall the old kubescape CLI."
|
|
if $SUDO rm -f /usr/local/bin/$KUBESCAPE_EXEC 2>/dev/null; then
|
|
echo -e "\033[32mRemoved old installation as root at /usr/local/bin/$KUBESCAPE_EXEC"
|
|
else
|
|
echo -e "\033[31mFailed to remove old installation as root at /usr/local/bin/$KUBESCAPE_EXEC, please remove it manually."
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
if [ "$KUBESCAPE_EXEC" != "" ]; then
|
|
if [ "${SUDO_USER:-$USER}" != "" ]; then
|
|
rm -f /home/"${SUDO_USER:-$USER}"/.kubescape/bin/$KUBESCAPE_EXEC 2>/dev/null || true
|
|
fi
|
|
if [ "$BASE_DIR" != "" ]; then
|
|
rm -f $BASE_DIR/bin/$KUBESCAPE_EXEC 2>/dev/null || true
|
|
fi
|
|
fi
|
|
|
|
# Old install location, clean all those things up
|
|
for pdir in ${PATH//:/ }; do
|
|
edir="${pdir/#\~/$HOME}"
|
|
if [[ $edir == $HOME/* ]] && [[ -f $edir/$KUBESCAPE_EXEC ]]; then
|
|
echo -e "\n\033[33mOld installation found at $edir/$KUBESCAPE_EXEC, do you want to remove it? [\033[0my\033[33m/n]:"
|
|
read -n 1 -r
|
|
if [[ ! $REPLY =~ ^[Yy]$ ]] && [[ "$REPLY" != "" ]]; then
|
|
continue
|
|
fi
|
|
if rm -f "$edir"/$KUBESCAPE_EXEC 2>/dev/null; then
|
|
echo -e "\n\033[32mRemoved old installation at $edir/$KUBESCAPE_EXEC"
|
|
else
|
|
echo -e "\n\033[31mFailed to remove old installation as root at $edir/$KUBESCAPE_EXEC, please remove it manually."
|
|
fi
|
|
fi
|
|
done
|
|
|
|
cp $OUTPUT $install_dir/$KUBESCAPE_EXEC
|
|
rm -f $OUTPUT
|
|
|
|
echo
|
|
echo -e "\033[32mFinished Installation."
|
|
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo -e "\nRemember to add the Kubescape CLI to your path with:"
|
|
echo -e " export PATH=\$PATH:$BASE_DIR/bin"
|
|
export PATH=\$PATH:$BASE_DIR/bin
|
|
fi
|
|
|
|
echo -e "\033[0m"
|
|
echo -e "\033[32mExecuting Kubescape."
|
|
echo
|
|
$KUBESCAPE_EXEC scan --create-account
|