mirror of
https://github.com/kubeshark/kubeshark.git
synced 2026-08-19 04:16:35 +00:00
* deps: bump indirect deps to clear critical/high Dependabot alerts Bumps the vulnerable indirect dependencies flagged as critical or high severity in Dependabot: - golang.org/x/crypto v0.39.0 -> v0.54.0 (7 critical + 2 high: SSH agent constraint/key-constraint bypass, @revoked auth bypass, FIDO/U2F presence check bypass, VerifiedPublicKeyCallback permission skip, infinite loop on large channel writes, client-induced server deadlock, RSA/DSA DoS, byte arithmetic underflow panic) - google.golang.org/grpc v1.68.1 -> v1.83.0 (critical: authz bypass via missing leading slash in :path; high: xDS RBAC and HTTP/2 issues) - github.com/containerd/containerd v1.7.27 -> v1.7.34 (high: LABEL -> restart-monitor binary:// host-root RCE, runAsNonRoot evasion, local privesc via wide CRI directory permissions) - oras.land/oras-go/v2 v2.6.0 -> v2.6.2 (high: CVE-2026-50163 hardlink extract-dir escape, credential forwarding via unvalidated Location header) - github.com/moby/spdystream v0.5.0 -> v0.5.1 (high: DoS on CRI) Transitively pulls up x/net, x/sync, x/sys, x/term, x/text, x/time, x/oauth2, protobuf, filepath-securejoin, selinux and go-logr via go mod tidy. The go directive moves 1.24.0 -> 1.25.0 (required by the upgraded modules); the explicit toolchain pin is dropped. CI resolves Go from go.mod, so no workflow changes are needed. go build ./... and go test ./... pass. * ci: move golangci-lint to v2, fix resulting lint issues golangci-lint-action@v3 pins `latest` to v1.64.8, which is built with go1.24 and refuses to run now that go.mod targets 1.25.0: can't load config: the Go language version (go1.24) used to build golangci-lint is lower than the targeted Go version (1.25.0) Move the job to golangci-lint-action@v7 + v2.8.0 and add a .golangci.yml mirroring the hub repo's v2 config: govet, staticcheck, ineffassign and unused, plus gofmt/goimports as formatters. Fixes for the issues that surfaced: - ST1005: lowercase error strings, drop trailing '!' in connect/hub.go - SA4011: kubernetes/watch.go had a `break` inside a `select` default that broke the select rather than the loop, i.e. a no-op; removed - QF1008: drop the embedded ChartPathOptions selector in helm.go - QF1003: tagged switch on r.URL.Path in mcp_test.go - QF1004: strings.Replace(..., -1) -> strings.ReplaceAll - gofmt -s and goimports with a local prefix across the tree errcheck is not in the enabled set, matching hub. * cmd: clarify --time parse error in pcap dump The error neither named the offending flag/value nor separated the wrapped error from the message. Reported by Copilot on #1952. --------- Co-authored-by: Alon Girmonsky <1990761+alongir@users.noreply.github.com>
119 lines
4.1 KiB
Go
119 lines
4.1 KiB
Go
package cmd
|
||
|
||
import (
|
||
"context"
|
||
"errors"
|
||
"fmt"
|
||
"path"
|
||
"regexp"
|
||
"time"
|
||
|
||
"github.com/rs/zerolog/log"
|
||
|
||
"github.com/kubeshark/kubeshark/config"
|
||
"github.com/kubeshark/kubeshark/errormessage"
|
||
"github.com/kubeshark/kubeshark/internal/connect"
|
||
"github.com/kubeshark/kubeshark/kubernetes"
|
||
"github.com/kubeshark/kubeshark/misc"
|
||
"github.com/kubeshark/kubeshark/misc/fsUtils"
|
||
)
|
||
|
||
func startProxyReportErrorIfAny(kubernetesProvider *kubernetes.Provider, ctx context.Context, serviceName string, podName string, proxyPortLabel string, srcPort uint16, dstPort uint16, healthCheck string) {
|
||
httpServer, err := kubernetes.StartProxy(kubernetesProvider, config.Config.Tap.Proxy.Host, srcPort, config.Config.Tap.Release.Namespace, serviceName)
|
||
if err != nil {
|
||
log.Error().
|
||
Err(errormessage.FormatError(err)).
|
||
Msg(fmt.Sprintf("Error occurred while running K8s proxy. Try setting different port using --%s", proxyPortLabel))
|
||
return
|
||
}
|
||
|
||
connector := connect.NewConnector(kubernetes.GetProxyOnPort(srcPort), connect.DefaultRetries, connect.DefaultTimeout)
|
||
if err := connector.TestConnection(healthCheck); err != nil {
|
||
log.Warn().
|
||
Str("service", serviceName).
|
||
Msg("Couldn't connect using proxy, stopping proxy and trying to create port-forward...")
|
||
if err := httpServer.Shutdown(ctx); err != nil {
|
||
log.Error().
|
||
Err(errormessage.FormatError(err)).
|
||
Msg("Error occurred while stopping proxy.")
|
||
}
|
||
|
||
podRegex, _ := regexp.Compile(podName)
|
||
if _, err := kubernetes.NewPortForward(kubernetesProvider, config.Config.Tap.Release.Namespace, podRegex, srcPort, dstPort, ctx); err != nil {
|
||
log.Error().
|
||
Str("pod-regex", podRegex.String()).
|
||
Err(errormessage.FormatError(err)).
|
||
Msg(fmt.Sprintf("Error occurred while running port forward. Try setting different port using --%s", proxyPortLabel))
|
||
return
|
||
}
|
||
|
||
connector = connect.NewConnector(kubernetes.GetProxyOnPort(srcPort), connect.DefaultRetries, connect.DefaultTimeout)
|
||
if err := connector.TestConnection(healthCheck); err != nil {
|
||
log.Error().
|
||
Str("service", serviceName).
|
||
Err(errormessage.FormatError(err)).
|
||
Msg("Couldn't connect to service.")
|
||
return
|
||
}
|
||
}
|
||
}
|
||
|
||
func getKubernetesProviderForCli(silent bool, dontCheckVersion bool) (*kubernetes.Provider, error) {
|
||
kubeConfigPath := config.Config.KubeConfigPath()
|
||
kubernetesProvider, err := kubernetes.NewProvider(kubeConfigPath, config.Config.Kube.Context)
|
||
if err != nil {
|
||
handleKubernetesProviderError(err)
|
||
return nil, err
|
||
}
|
||
|
||
if !silent {
|
||
log.Info().Str("path", kubeConfigPath).Msg("Using kubeconfig:")
|
||
}
|
||
|
||
if err := kubernetesProvider.ValidateNotProxy(); err != nil {
|
||
handleKubernetesProviderError(err)
|
||
return nil, err
|
||
}
|
||
|
||
if !dontCheckVersion {
|
||
kubernetesVersion, err := kubernetesProvider.GetKubernetesVersion()
|
||
if err != nil {
|
||
handleKubernetesProviderError(err)
|
||
return nil, err
|
||
}
|
||
|
||
if err := kubernetes.ValidateKubernetesVersion(kubernetesVersion); err != nil {
|
||
handleKubernetesProviderError(err)
|
||
return nil, err
|
||
}
|
||
}
|
||
|
||
return kubernetesProvider, nil
|
||
}
|
||
|
||
func handleKubernetesProviderError(err error) {
|
||
var clusterBehindProxyErr *kubernetes.ClusterBehindProxyError
|
||
if ok := errors.As(err, &clusterBehindProxyErr); ok {
|
||
log.Error().Msg(fmt.Sprintf("Cannot establish http-proxy connection to the Kubernetes cluster. If you’re using Lens or similar tool, please run '%s' with regular kubectl config using --%v %v=$HOME/.kube/config flag", misc.Program, config.SetCommandName, config.KubeConfigPathConfigName))
|
||
} else {
|
||
log.Error().Err(err).Send()
|
||
}
|
||
}
|
||
|
||
func finishSelfExecution(kubernetesProvider *kubernetes.Provider) {
|
||
removalCtx, cancel := context.WithTimeout(context.Background(), cleanupTimeout)
|
||
defer cancel()
|
||
dumpLogsIfNeeded(removalCtx, kubernetesProvider)
|
||
}
|
||
|
||
func dumpLogsIfNeeded(ctx context.Context, kubernetesProvider *kubernetes.Provider) {
|
||
if !config.Config.DumpLogs {
|
||
return
|
||
}
|
||
dotDir := misc.GetDotFolderPath()
|
||
filePath := path.Join(dotDir, fmt.Sprintf("%s_logs_%s.zip", misc.Program, time.Now().Format("2006_01_02__15_04_05")))
|
||
if err := fsUtils.DumpLogs(ctx, kubernetesProvider, filePath, config.Config.Logs.Grep); err != nil {
|
||
log.Error().Err(err).Msg("Failed to dump logs.")
|
||
}
|
||
}
|