Skip to content

Commit 1cd1b13

Browse files
matthyxmatthyx
committed
use application profile instead of sbomp
Signed-off-by: Matthias Bertschy <[email protected]>
1 parent 0b44cb2 commit 1cd1b13

File tree

5 files changed

+66
-61
lines changed

5 files changed

+66
-61
lines changed

‎mainhandler/handlerequests.go

+8-4
Original file line numberDiff line numberDiff line change
@@ -146,7 +146,11 @@ func (mainHandler *MainHandler) HandleWatchers(ctx context.Context) {
146146
}
147147
}()
148148

149-
ksStorageClient, err := kssc.NewForConfig(k8sinterface.GetK8sConfig())
149+
cfg := k8sinterface.GetK8sConfig()
150+
// force GRPC
151+
cfg.AcceptContentTypes = "application/vnd.kubernetes.protobuf"
152+
cfg.ContentType = "application/vnd.kubernetes.protobuf"
153+
ksStorageClient, err := kssc.NewForConfig(cfg)
150154
if err != nil {
151155
logger.L().Ctx(ctx).Fatal(fmt.Sprintf("Unable to initialize the storage client: %v", err))
152156
}
@@ -160,7 +164,7 @@ func (mainHandler *MainHandler) HandleWatchers(ctx context.Context) {
160164

161165
// start watching
162166
go watchHandler.PodWatch(ctx, mainHandler.eventWorkerPool)
163-
go watchHandler.SBOMFilteredWatch(ctx, mainHandler.eventWorkerPool)
167+
go watchHandler.ApplicationProfileWatch(ctx, mainHandler.eventWorkerPool)
164168
}
165169

166170
func (h *MainHandler) StartContinuousScanning(_ context.Context) error {
@@ -229,8 +233,8 @@ func (actionHandler *ActionHandler) runCommand(ctx context.Context, sessionObj *
229233
switch c.CommandName {
230234
case apis.TypeScanImages:
231235
return actionHandler.scanImage(ctx, sessionObj)
232-
case utils.CommandScanFilteredSBOM:
233-
actionHandler.scanFilteredSBOM(ctx, sessionObj)
236+
case utils.CommandScanApplicationProfile:
237+
actionHandler.scanApplicationProfile(ctx, sessionObj)
234238
case apis.TypeRunKubescape, apis.TypeRunKubescapeJob:
235239
return actionHandler.kubescapeScan(ctx)
236240
case apis.TypeSetKubescapeCronJob:

‎mainhandler/vulnscan.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -339,8 +339,8 @@ func (actionHandler *ActionHandler) scanImage(ctx context.Context, sessionObj *u
339339
return nil
340340
}
341341

342-
func (actionHandler *ActionHandler) scanFilteredSBOM(ctx context.Context, sessionObj *utils.SessionObj) error {
343-
ctx, span := otel.Tracer("").Start(ctx, "actionHandler.scanFilteredSBOM")
342+
func (actionHandler *ActionHandler) scanApplicationProfile(ctx context.Context, sessionObj *utils.SessionObj) error {
343+
ctx, span := otel.Tracer("").Start(ctx, "actionHandler.scanApplicationProfile")
344344
defer span.End()
345345

346346
if !actionHandler.config.Components().Kubevuln.Enabled {
@@ -352,7 +352,7 @@ func (actionHandler *ActionHandler) scanFilteredSBOM(ctx context.Context, sessio
352352
return fmt.Errorf("failed to get container for image %s", actionHandler.command.Args[utils.ArgsContainerData])
353353
}
354354

355-
// scanning a filtered SBOM (SBOM already downloaded) so AuthConfig can be empty
355+
// scanning an application profile so AuthConfig can be empty
356356
span.AddEvent("scanning", trace.WithAttributes(attribute.String("wlid", actionHandler.wlid)))
357357
cmd := actionHandler.getImageScanCommand(containerData, sessionObj, &ImageScanConfig{})
358358

‎utils/utils.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ const ArgsPod = "pod"
2929
const ArgsContainerData = "containerData"
3030
const dockerPullableURN = "docker-pullable://"
3131

32-
const CommandScanFilteredSBOM = "scanFilteredSBOM"
32+
const CommandScanApplicationProfile = "scanApplicationProfile"
3333

3434
func MapToString(m map[string]interface{}) []string {
3535
s := []string{}

‎watcher/filteredsbomwatcher.go ‎watcher/applicationprofilewatcher.go

+30-30
Original file line numberDiff line numberDiff line change
@@ -29,20 +29,20 @@ var (
2929
ErrMissingContainerName = fmt.Errorf("missing container name")
3030
)
3131

32-
// SBOMFilteredWatch watches and processes changes on Filtered SBOMs
33-
func (wh *WatchHandler) SBOMFilteredWatch(ctx context.Context, workerPool *ants.PoolWithFunc) {
32+
// ApplicationProfileWatch watches and processes changes on ApplicationProfile resources
33+
func (wh *WatchHandler) ApplicationProfileWatch(ctx context.Context, workerPool *ants.PoolWithFunc) {
3434
inputEvents := make(chan watch.Event)
3535
cmdCh := make(chan *apis.Command)
3636
errorCh := make(chan error)
37-
sbomEvents := make(<-chan watch.Event)
37+
apEvents := make(<-chan watch.Event)
3838

3939
// The watcher is considered unavailable by default
40-
sbomWatcherUnavailable := make(chan struct{})
40+
apWatcherUnavailable := make(chan struct{})
4141
go func() {
42-
sbomWatcherUnavailable <- struct{}{}
42+
apWatcherUnavailable <- struct{}{}
4343
}()
4444

45-
go wh.HandleSBOMFilteredEvents(inputEvents, cmdCh, errorCh)
45+
go wh.HandleApplicationProfileEvents(inputEvents, cmdCh, errorCh)
4646

4747
// notifyWatcherDown notifies the appropriate channel that the watcher
4848
// is down and backs off for the retry interval to not produce
@@ -56,45 +56,45 @@ func (wh *WatchHandler) SBOMFilteredWatch(ctx context.Context, workerPool *ants.
5656
var err error
5757
for {
5858
select {
59-
case sbomEvent, ok := <-sbomEvents:
59+
case apEvent, ok := <-apEvents:
6060
if ok {
61-
inputEvents <- sbomEvent
61+
inputEvents <- apEvent
6262
} else {
63-
notifyWatcherDown(sbomWatcherUnavailable)
63+
notifyWatcherDown(apWatcherUnavailable)
6464
}
6565
case cmd, ok := <-cmdCh:
6666
if ok {
6767
utils.AddCommandToChannel(ctx, wh.cfg, cmd, workerPool)
6868
} else {
69-
notifyWatcherDown(sbomWatcherUnavailable)
69+
notifyWatcherDown(apWatcherUnavailable)
7070
}
7171
case err, ok := <-errorCh:
7272
if ok {
73-
logger.L().Ctx(ctx).Error(fmt.Sprintf("error in SBOMFilteredWatch: %v", err.Error()))
73+
logger.L().Ctx(ctx).Error(fmt.Sprintf("error in ApplicationProfileWatch: %v", err.Error()))
7474
} else {
75-
notifyWatcherDown(sbomWatcherUnavailable)
75+
notifyWatcherDown(apWatcherUnavailable)
7676
}
77-
case <-sbomWatcherUnavailable:
77+
case <-apWatcherUnavailable:
7878
if watcher != nil {
7979
watcher.Stop()
8080
}
8181

82-
watcher, err = wh.getSBOMFilteredWatcher()
82+
watcher, err = wh.getApplicationProfileWatcher()
8383
if err != nil {
84-
notifyWatcherDown(sbomWatcherUnavailable)
84+
notifyWatcherDown(apWatcherUnavailable)
8585
} else {
86-
sbomEvents = watcher.ResultChan()
86+
apEvents = watcher.ResultChan()
8787
}
8888
}
8989
}
9090

9191
}
9292

93-
func (wh *WatchHandler) HandleSBOMFilteredEvents(sfEvents <-chan watch.Event, producedCommands chan<- *apis.Command, errorCh chan<- error) {
93+
func (wh *WatchHandler) HandleApplicationProfileEvents(sfEvents <-chan watch.Event, producedCommands chan<- *apis.Command, errorCh chan<- error) {
9494
defer close(errorCh)
9595

9696
for e := range sfEvents {
97-
obj, ok := e.Object.(*spdxv1beta1.SBOMSyftFiltered)
97+
obj, ok := e.Object.(*spdxv1beta1.ApplicationProfile)
9898
if !ok {
9999
errorCh <- ErrUnsupportedObject
100100
continue
@@ -111,13 +111,13 @@ func (wh *WatchHandler) HandleSBOMFilteredEvents(sfEvents <-chan watch.Event, pr
111111
continue
112112
}
113113

114-
if skipSBOM(obj.ObjectMeta.Annotations) {
114+
if skipAP(obj.ObjectMeta.Annotations) {
115115
continue
116116
}
117117

118-
containerData, err := wh.getContainerDataFilteredSBOM(obj)
118+
containerData, err := wh.getContainerDataApplicationProfile(obj)
119119
if err != nil {
120-
logger.L().Error("failed to get container data from filtered SBOM",
120+
logger.L().Error("failed to get container data from application profile",
121121
helpers.String("name", obj.ObjectMeta.Name),
122122
helpers.String("namespace", obj.ObjectMeta.Namespace),
123123
helpers.Interface("annotations", obj.ObjectMeta.Annotations),
@@ -138,25 +138,25 @@ func (wh *WatchHandler) HandleSBOMFilteredEvents(sfEvents <-chan watch.Event, pr
138138

139139
cmd := &apis.Command{
140140
Wlid: containerData.Wlid,
141-
CommandName: utils.CommandScanFilteredSBOM,
141+
CommandName: utils.CommandScanApplicationProfile,
142142
Args: map[string]interface{}{
143143
utils.ArgsContainerData: containerData,
144144
},
145145
}
146146
// send
147-
logger.L().Info("scanning filtered SBOM", helpers.String("wlid", cmd.Wlid), helpers.String("slug", containerData.Slug), helpers.String("containerName", containerData.ContainerName), helpers.String("imageTag", containerData.ImageTag), helpers.String("imageID", containerData.ImageID))
147+
logger.L().Info("scanning application profile", helpers.String("wlid", cmd.Wlid), helpers.String("slug", containerData.Slug), helpers.String("containerName", containerData.ContainerName), helpers.String("imageTag", containerData.ImageTag), helpers.String("imageID", containerData.ImageID))
148148
producedCommands <- cmd
149149
}
150150
}
151151

152-
func (wh *WatchHandler) getContainerDataFilteredSBOM(obj *spdxv1beta1.SBOMSyftFiltered) (*utils.ContainerData, error) {
152+
func (wh *WatchHandler) getContainerDataApplicationProfile(obj *spdxv1beta1.ApplicationProfile) (*utils.ContainerData, error) {
153153

154154
containerData, err := annotationsToContainerData(obj.GetAnnotations())
155155
if err != nil {
156156
return nil, err
157157
}
158158

159-
if err := validateContainerDataFilteredSBOM(containerData); err != nil {
159+
if err := validateContainerDataApplicationProfiles(containerData); err != nil {
160160
return nil, err
161161
}
162162
return containerData, nil
@@ -183,14 +183,14 @@ func annotationsToContainerData(annotations map[string]string) (*utils.Container
183183
containerData.ContainerName = instanceID.GetContainerName()
184184
containerData.ContainerType = string(instanceID.GetInstanceType())
185185

186-
// FIXME: use the annotations after adding imageID and imageTag to the filtered SBOM
186+
// FIXME: use the annotations after adding imageID and imageTag to the application profile
187187
containerData.ImageID = annotations[helpersv1.ImageIDMetadataKey]
188188
containerData.ImageTag = annotations[helpersv1.ImageTagMetadataKey]
189189

190190
return containerData, nil
191191
}
192192

193-
func skipSBOM(annotations map[string]string) bool {
193+
func skipAP(annotations map[string]string) bool {
194194
ann := []string{
195195
"", // empty string for backward compatibility
196196
helpersv1.Ready,
@@ -207,12 +207,12 @@ func skipSBOM(annotations map[string]string) bool {
207207
return false // do not skip
208208
}
209209

210-
func (wh *WatchHandler) getSBOMFilteredWatcher() (watch.Interface, error) {
210+
func (wh *WatchHandler) getApplicationProfileWatcher() (watch.Interface, error) {
211211
// no need to support ExcludeNamespaces and IncludeNamespaces since node-agent will respect them as well
212-
return wh.storageClient.SpdxV1beta1().SBOMSyftFiltereds("").Watch(context.Background(), v1.ListOptions{})
212+
return wh.storageClient.SpdxV1beta1().ApplicationProfiles("").Watch(context.Background(), v1.ListOptions{})
213213
}
214214

215-
func validateContainerDataFilteredSBOM(containerData *utils.ContainerData) error {
215+
func validateContainerDataApplicationProfiles(containerData *utils.ContainerData) error {
216216
if containerData.ContainerName == "" {
217217
return ErrMissingContainerName
218218
}

‎watcher/filteredsbomwatcher_test.go ‎watcher/applicationprofilewatcher_test.go

+24-23
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ func TestNewWatchHandlerProducesValidResult(t *testing.T) {
6666
}
6767
}
6868

69-
func TestHandleSBOMFilteredEvents(t *testing.T) {
69+
func TestHandleApplicationProfileEvents(t *testing.T) {
7070
tt := []struct {
7171
name string
7272
inputEvents []watch.Event
@@ -77,11 +77,11 @@ func TestHandleSBOMFilteredEvents(t *testing.T) {
7777
expectedWlidAndImageIDMap []string
7878
}{
7979
{
80-
name: "Adding a new Filtered SBOM should produce a matching scan command",
80+
name: "Adding a new application profile should produce a matching scan command",
8181
inputEvents: []watch.Event{
8282
{
8383
Type: watch.Added,
84-
Object: &spdxv1beta1.SBOMSyftFiltered{
84+
Object: &spdxv1beta1.ApplicationProfile{
8585
ObjectMeta: v1.ObjectMeta{
8686
Name: "replicaset-nginx-6ccd565b7d-nginx-49d3-1861",
8787
Annotations: map[string]string{
@@ -96,7 +96,7 @@ func TestHandleSBOMFilteredEvents(t *testing.T) {
9696
},
9797
{
9898
Type: watch.Modified,
99-
Object: &spdxv1beta1.SBOMSyftFiltered{
99+
Object: &spdxv1beta1.ApplicationProfile{
100100
ObjectMeta: v1.ObjectMeta{
101101
Name: "replicaset-nginx-6ccd565b7d-nginx-e4ff-657a",
102102
Annotations: map[string]string{
@@ -112,7 +112,7 @@ func TestHandleSBOMFilteredEvents(t *testing.T) {
112112
},
113113
expectedCommands: []*apis.Command{
114114
{
115-
CommandName: utils.CommandScanFilteredSBOM,
115+
CommandName: utils.CommandScanApplicationProfile,
116116
Wlid: "wlid://cluster-gke_armo-test-clusters_us-central1-c_dwertent-syft/namespace-systest-ns-rarz/deployment-nginx",
117117
Args: map[string]interface{}{
118118
utils.ArgsContainerData: &utils.ContainerData{
@@ -126,7 +126,7 @@ func TestHandleSBOMFilteredEvents(t *testing.T) {
126126
},
127127
},
128128
{
129-
CommandName: utils.CommandScanFilteredSBOM,
129+
CommandName: utils.CommandScanApplicationProfile,
130130
Wlid: "wlid://cluster-gke_armo-test-clusters_us-central1-c_dwertent-syft/namespace-systest-ns-rarz/deployment-nginx",
131131
Args: map[string]interface{}{
132132
utils.ArgsContainerData: &utils.ContainerData{
@@ -158,7 +158,7 @@ func TestHandleSBOMFilteredEvents(t *testing.T) {
158158
inputEvents: []watch.Event{
159159
{
160160
Type: watch.Added,
161-
Object: &spdxv1beta1.SBOMSyftFiltered{
161+
Object: &spdxv1beta1.ApplicationProfile{
162162
ObjectMeta: v1.ObjectMeta{
163163
Name: "replicaset-nginx-6ccd565b7d-nginx-49d3-1861",
164164
Annotations: map[string]string{
@@ -185,7 +185,7 @@ func TestHandleSBOMFilteredEvents(t *testing.T) {
185185
inputEvents: []watch.Event{
186186
{
187187
Type: watch.Deleted,
188-
Object: &spdxv1beta1.SBOMSyftFiltered{},
188+
Object: &spdxv1beta1.ApplicationProfile{},
189189
},
190190
},
191191
expectedCommands: []*apis.Command{},
@@ -220,7 +220,7 @@ func TestHandleSBOMFilteredEvents(t *testing.T) {
220220

221221
wh := NewWatchHandler(ctx, operatorConfig, k8sAPI, storageClient, nil)
222222

223-
go wh.HandleSBOMFilteredEvents(inputEvents, cmdCh, errorCh)
223+
go wh.HandleApplicationProfileEvents(inputEvents, cmdCh, errorCh)
224224

225225
go func() {
226226
for _, e := range tc.inputEvents {
@@ -250,7 +250,7 @@ func TestHandleSBOMFilteredEvents(t *testing.T) {
250250
}
251251
}
252252

253-
actualObjects, _ := storageClient.SpdxV1beta1().SBOMSyftFiltereds("").List(ctx, v1.ListOptions{})
253+
actualObjects, _ := storageClient.SpdxV1beta1().ApplicationProfiles("").List(ctx, v1.ListOptions{})
254254

255255
actualObjectNames := []string{}
256256
for _, obj := range actualObjects.Items {
@@ -276,16 +276,16 @@ func TestHandleSBOMFilteredEvents(t *testing.T) {
276276

277277
}
278278
}
279-
func TestGetContainerDataFilteredSBOM(t *testing.T) {
279+
func TestGetContainerDataApplicationProfile(t *testing.T) {
280280
tests := []struct {
281-
obj *spdxv1beta1.SBOMSyftFiltered
281+
obj *spdxv1beta1.ApplicationProfile
282282
want *utils.ContainerData
283283
name string
284284
wantErr bool
285285
}{
286286
{
287-
name: "valid SBOMSyftFiltered object",
288-
obj: &spdxv1beta1.SBOMSyftFiltered{
287+
name: "valid ApplicationProfile object",
288+
obj: &spdxv1beta1.ApplicationProfile{
289289
ObjectMeta: v1.ObjectMeta{
290290
Annotations: map[string]string{
291291
helpersv1.InstanceIDMetadataKey: "apiVersion-apps/v1/namespace-systest-ns-rarz/kind-ReplicaSet/name-nginx-6ccd565b7d/containerName-nginx",
@@ -307,8 +307,8 @@ func TestGetContainerDataFilteredSBOM(t *testing.T) {
307307
wantErr: false,
308308
},
309309
{
310-
name: "invalid SBOMSyftFiltered object - missing instanceID",
311-
obj: &spdxv1beta1.SBOMSyftFiltered{
310+
name: "invalid ApplicationProfile object - missing instanceID",
311+
obj: &spdxv1beta1.ApplicationProfile{
312312
ObjectMeta: v1.ObjectMeta{
313313
Annotations: map[string]string{
314314
helpersv1.InstanceIDMetadataKey: "",
@@ -323,8 +323,8 @@ func TestGetContainerDataFilteredSBOM(t *testing.T) {
323323
wantErr: true,
324324
},
325325
{
326-
name: "invalid SBOMSyftFiltered object - missing other fields",
327-
obj: &spdxv1beta1.SBOMSyftFiltered{
326+
name: "invalid ApplicationProfile object - missing other fields",
327+
obj: &spdxv1beta1.ApplicationProfile{
328328
ObjectMeta: v1.ObjectMeta{
329329
Annotations: map[string]string{
330330
helpersv1.InstanceIDMetadataKey: "apiVersion-apps/v1/namespace-systest-ns-rarz/kind-ReplicaSet/name-nginx-6ccd565b7d/containerName-nginx",
@@ -344,7 +344,7 @@ func TestGetContainerDataFilteredSBOM(t *testing.T) {
344344

345345
for _, tt := range tests {
346346
t.Run(tt.name, func(t *testing.T) {
347-
got, err := wh.getContainerDataFilteredSBOM(tt.obj)
347+
got, err := wh.getContainerDataApplicationProfile(tt.obj)
348348
assert.Equal(t, tt.want, got)
349349
assert.Equal(t, tt.wantErr, err != nil)
350350
})
@@ -406,7 +406,7 @@ func TestAnnotationsToContainerData(t *testing.T) {
406406
})
407407
}
408408
}
409-
func TestSkipSBOM(t *testing.T) {
409+
func TestSkipAP(t *testing.T) {
410410
tests := []struct {
411411
annotations map[string]string
412412
name string
@@ -449,12 +449,13 @@ func TestSkipSBOM(t *testing.T) {
449449

450450
for _, tt := range tests {
451451
t.Run(tt.name, func(t *testing.T) {
452-
gotSkip := skipSBOM(tt.annotations)
452+
gotSkip := skipAP(tt.annotations)
453453
assert.Equal(t, tt.wantSkip, gotSkip)
454454
})
455455
}
456456
}
457-
func TestValidateContainerDataFilteredSBOM(t *testing.T) {
457+
458+
func TestValidateContainerDataApplicationProfile(t *testing.T) {
458459
tests := []struct {
459460
wantErr error
460461
containerData *utils.ContainerData
@@ -525,7 +526,7 @@ func TestValidateContainerDataFilteredSBOM(t *testing.T) {
525526

526527
for _, tt := range tests {
527528
t.Run(tt.name, func(t *testing.T) {
528-
err := validateContainerDataFilteredSBOM(tt.containerData)
529+
err := validateContainerDataApplicationProfiles(tt.containerData)
529530
assert.Equal(t, tt.wantErr, err)
530531
})
531532
}

0 commit comments

Comments
 (0)