Files
kubescape/docs/providers/install.sh
5379b9b0a6 New output (#1320)
* phase-1

Signed-off-by: Daniel Grunberger <danielgrunberger@armosec.io>

* factory

Signed-off-by: Daniel Grunberger <danielgrunberger@armosec.io>

* wip: feat(cli): add an image scanning command

Add a CLI command that launches an image scan. Does not scan images yet.

Signed-off-by: Vlad Klokun <vklokun@protonmail.ch>

* wip: feat: add image scanning service

Signed-off-by: Vlad Klokun <vklokun@protonmail.ch>

* chore: include dependencies

Signed-off-by: Vlad Klokun <vklokun@protonmail.ch>

* wip: adjust image scanning service

Signed-off-by: Vlad Klokun <vklokun@protonmail.ch>

* wip: feat: use scanning service in CLI

Signed-off-by: Vlad Klokun <vklokun@protonmail.ch>

* use iface

Signed-off-by: Daniel Grunberger <danielgrunberger@armosec.io>

* touches

Signed-off-by: Daniel Grunberger <danielgrunberger@armosec.io>

* continue

Signed-off-by: Daniel Grunberger <danielgrunberger@armosec.io>

* add cmd

Signed-off-by: Daniel Grunberger <danielgrunberger@armosec.io>

* support single workload scan

Signed-off-by: Amir Malka <amirm@armosec.io>

* fix conflict

Signed-off-by: Amir Malka <amirm@armosec.io>

* identifiers

* go mod

* feat(imagescan): add an image scanning command

This commit adds a CLI command and an associated package that scan
images for vulnerabilities.

Signed-off-by: Vlad Klokun <vklokun@protonmail.ch>

feat(imagescan): fail on exceeding the severity threshold

Signed-off-by: Vlad Klokun <vklokun@protonmail.ch>

* chore(imagescan): include dependencies

This commit adds the dependencies necessary for image scanning.

Signed-off-by: Vlad Klokun <vklokun@protonmail.ch>

* chore(imagescan): add dependencies to httphandler

Signed-off-by: Vlad Klokun <vklokun@protonmail.ch>

* added unit tests

Signed-off-by: Amir Malka <amirm@armosec.io>

* merge

* more

* integrate img scan

* added unit tests

Signed-off-by: Amir Malka <amirm@armosec.io>

* more refactoring

Signed-off-by: Amir Malka <amirm@armosec.io>

* add scanned workload reference to opasessionobj

Signed-off-by: Amir Malka <amirm@armosec.io>

* fix GetWorkloadParentKind

Signed-off-by: Amir Malka <amirm@armosec.io>

* remove namespace argument from pullSingleResource, using field selector instead

Signed-off-by: Amir Malka <amirm@armosec.io>

* removed designators (unused) field from PolicyIdentifier, and designators argument from GetResources function

Signed-off-by: Amir Malka <amirm@armosec.io>

* changes

* changes

* fixes

* changes

* feat(imagescan): add an image scanning command

This commit adds a CLI command and an associated package that scan
images for vulnerabilities.

Signed-off-by: Vlad Klokun <vklokun@protonmail.ch>

feat(imagescan): fail on exceeding the severity threshold

Signed-off-by: Vlad Klokun <vklokun@protonmail.ch>

* chore(imagescan): include dependencies

This commit adds the dependencies necessary for image scanning.

Signed-off-by: Vlad Klokun <vklokun@protonmail.ch>

* chore(imagescan): add dependencies to httphandler

Signed-off-by: Vlad Klokun <vklokun@protonmail.ch>

* chore(imagescan): create vuln db with dedicated function

Remove commented out code, too.

Signed-off-by: Vlad Klokun <vklokun@protonmail.ch>

* docs(imagescan): provide package-level docs

Signed-off-by: Vlad Klokun <vklokun@protonmail.ch>

* finish merge

* image scan tests

* continue

* fixes

* refactor

* rm duplicate

* start fixes

* update gh actions

Signed-off-by: David Wertenteil <dwertent@armosec.io>

* pr fixes

* fix test

* improvements

---------

Signed-off-by: Daniel Grunberger <danielgrunberger@armosec.io>
Signed-off-by: Vlad Klokun <vklokun@protonmail.ch>
Signed-off-by: Amir Malka <amirm@armosec.io>
Signed-off-by: David Wertenteil <dwertent@armosec.io>
Co-authored-by: Daniel Grunberger <danielgrunberger@armosec.io>
Co-authored-by: Vlad Klokun <vklokun@protonmail.ch>
Co-authored-by: Amir Malka <amirm@armosec.io>
Co-authored-by: David Wertenteil <dwertent@armosec.io>
2023-08-03 12:09:33 +03:00

122 lines
3.5 KiB
Bash

#!/bin/bash
set -e
while getopts v: option
do
case ${option} in
v) RELEASE="download/${OPTARG}";;
*) ;;
esac
done
if [ -z "${RELEASE}" ]; then
RELEASE="latest/download"
fi
echo -e "\033[0;36mInstalling Kubescape..."
echo
BASE_DIR=~/.kubescape
KUBESCAPE_EXEC=kubescape
osName=$(uname -s)
if [[ $osName == *"MINGW"* ]]; then
osName=windows
elif [[ $osName == *"Darwin"* ]]; then
osName=macos
else
osName=ubuntu
fi
arch=$(uname -m)
if [[ $arch == *"aarch64"* || $arch == *"arm64"* ]]; then
arch="-arm64"
else
if [[ $arch != *"x86_64"* ]]; then
echo -e "\033[33mArchitecture $arch may be unsupported, will try to install the amd64 one anyway."
fi
arch=""
fi
mkdir -p $BASE_DIR
OUTPUT=$BASE_DIR/$KUBESCAPE_EXEC
DOWNLOAD_URL="https://github.com/kubescape/kubescape/releases/${RELEASE}/kubescape${arch}-${osName}-latest"
curl --progress-bar -L $DOWNLOAD_URL -o $OUTPUT
# Find install dir
install_dir=/usr/local/bin # default if running as root
if [ "$(id -u)" -ne 0 ]; then
install_dir=$BASE_DIR/bin # if not running as root, install to user dir
export PATH=$PATH:$BASE_DIR/bin
fi
# Create install dir if it does not exist
if [ ! -d "$install_dir" ]; then
mkdir -p $install_dir
fi
chmod +x $OUTPUT 2>/dev/null
# cleaning up old install
SUDO=
if [ "$(id -u)" -ne 0 ] && [ -n "$(which sudo)" ] && [ "$KUBESCAPE_EXEC" != "" ] && [ -f /usr/local/bin/$KUBESCAPE_EXEC ]; then
SUDO=sudo
echo -e "\n\033[33mOld installation as root found, do you want to remove it? [\033[0my\033[33m/n]:"
read -n 1 -r
if [[ ! $REPLY =~ ^[Yy]$ ]] && [[ "$REPLY" != "" ]]; then
echo -e "\n\033[0mSkipping old installation as root removal."
else
echo -e "\n\033[0mWe will need the root access to uninstall the old kubescape CLI."
if $SUDO rm -f /usr/local/bin/$KUBESCAPE_EXEC 2>/dev/null; then
echo -e "\033[32mRemoved old installation as root at /usr/local/bin/$KUBESCAPE_EXEC"
else
echo -e "\033[31mFailed to remove old installation as root at /usr/local/bin/$KUBESCAPE_EXEC, please remove it manually."
fi
fi
fi
if [ "$KUBESCAPE_EXEC" != "" ]; then
if [ "${SUDO_USER:-$USER}" != "" ]; then
rm -f /home/"${SUDO_USER:-$USER}"/.kubescape/bin/$KUBESCAPE_EXEC 2>/dev/null || true
fi
if [ "$BASE_DIR" != "" ]; then
rm -f $BASE_DIR/bin/$KUBESCAPE_EXEC 2>/dev/null || true
fi
fi
# Old install location, clean all those things up
for pdir in ${PATH//:/ }; do
edir="${pdir/#\~/$HOME}"
if [[ $edir == $HOME/* ]] && [[ -f $edir/$KUBESCAPE_EXEC ]]; then
echo -e "\n\033[33mOld installation found at $edir/$KUBESCAPE_EXEC, do you want to remove it? [\033[0my\033[33m/n]:"
read -n 1 -r
if [[ ! $REPLY =~ ^[Yy]$ ]] && [[ "$REPLY" != "" ]]; then
continue
fi
if rm -f "$edir"/$KUBESCAPE_EXEC 2>/dev/null; then
echo -e "\n\033[32mRemoved old installation at $edir/$KUBESCAPE_EXEC"
else
echo -e "\n\033[31mFailed to remove old installation as root at $edir/$KUBESCAPE_EXEC, please remove it manually."
fi
fi
done
cp $OUTPUT $install_dir/$KUBESCAPE_EXEC
rm -f $OUTPUT
echo
echo -e "\033[32mFinished Installation."
if [ "$(id -u)" -ne 0 ]; then
echo -e "\nRemember to add the Kubescape CLI to your path with:"
echo -e " export PATH=\$PATH:$BASE_DIR/bin"
export PATH=\$PATH:$BASE_DIR/bin
fi
echo -e "\033[0m"
echo -e "\033[32mExecuting Kubescape."
echo
$KUBESCAPE_EXEC scan --create-account