-
Notifications
You must be signed in to change notification settings - Fork 19
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
trigger AP scan in kubevuln whenever the application profile can be u…
…sed (#277) * trigger AP scan in kubevuln whenever the application profile can be used Signed-off-by: Amir Malka <[email protected]> * fix tests Signed-off-by: Amir Malka <[email protected]> --------- Signed-off-by: Amir Malka <[email protected]>
- Loading branch information
Showing
6 changed files
with
240 additions
and
97 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,69 @@ | ||
| package utils | ||
|
|
||
| import ( | ||
| "context" | ||
| "fmt" | ||
| "slices" | ||
|
|
||
| "github.com/armosec/armoapi-go/apis" | ||
| "github.com/kubescape/go-logger" | ||
| "github.com/kubescape/go-logger/helpers" | ||
| helpersv1 "github.com/kubescape/k8s-interface/instanceidhandler/v1/helpers" | ||
| "github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1" | ||
| kssc "github.com/kubescape/storage/pkg/generated/clientset/versioned" | ||
| metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
| ) | ||
|
|
||
| func SkipApplicationProfile(annotations map[string]string) (bool, error) { | ||
| ann := []string{ | ||
| "", // empty string for backward compatibility | ||
| helpersv1.Ready, | ||
| helpersv1.Completed, | ||
| } | ||
|
|
||
| if len(annotations) == 0 { | ||
| return true, fmt.Errorf("no annotations") // skip | ||
| } | ||
|
|
||
| if status, ok := annotations[helpersv1.StatusMetadataKey]; ok && !slices.Contains(ann, status) { | ||
| return true, fmt.Errorf("invalid status") | ||
| } | ||
| if val, ok := annotations[helpersv1.InstanceIDMetadataKey]; !ok || val == "" { | ||
| return true, fmt.Errorf("missing InstanceID annotation") // skip | ||
| } | ||
| if val, ok := annotations[helpersv1.WlidMetadataKey]; !ok || val == "" { | ||
| return true, fmt.Errorf("missing WLID annotation") // skip | ||
| } | ||
|
|
||
| return false, nil // do not skip | ||
| } | ||
|
|
||
| // GetApplicationProfileForRelevancyScan retrieves an application profile from the storage client based on the provided slug and namespace | ||
| // If the application profile is found, and it should not be skipped (i.e. correct status, InstanceID and WLID annotations), it is returned, otherwise nil | ||
| func GetApplicationProfileForRelevancyScan(ctx context.Context, storageClient kssc.Interface, slug, namespace string) *v1beta1.ApplicationProfile { | ||
| appProfile, err := storageClient.SpdxV1beta1().ApplicationProfiles(namespace).Get(ctx, slug, metav1.GetOptions{ResourceVersion: "metadata"}) | ||
| if err == nil && appProfile != nil { | ||
| if skip, err := SkipApplicationProfile(appProfile.Annotations); skip { | ||
| logger.L().Info("found application profile, but skipping", helpers.Error(err), helpers.String("id", slug), helpers.String("namespace", namespace), | ||
| helpers.Interface("annotations", appProfile.Annotations)) | ||
| return nil | ||
| } else { | ||
| logger.L().Info("found application profile", helpers.String("id", slug), helpers.String("namespace", namespace)) | ||
| return appProfile | ||
| } | ||
| } else { | ||
| logger.L().Info("application profile not found", helpers.String("id", slug), helpers.String("namespace", namespace)) | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| func GetApplicationProfileScanCommand(appProfile *v1beta1.ApplicationProfile) *apis.Command { | ||
| return &apis.Command{ | ||
| Wlid: appProfile.Annotations[helpersv1.WlidMetadataKey], | ||
| CommandName: apis.TypeScanApplicationProfile, | ||
| Args: map[string]interface{}{ | ||
| ArgsName: appProfile.Name, | ||
| ArgsNamespace: appProfile.Namespace, | ||
| }, | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,87 @@ | ||
| package utils | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "testing" | ||
|
|
||
| helpersv1 "github.com/kubescape/k8s-interface/instanceidhandler/v1/helpers" | ||
| "github.com/stretchr/testify/assert" | ||
| ) | ||
|
|
||
| func TestSkipApplicationProfile(t *testing.T) { | ||
| tests := []struct { | ||
| annotations map[string]string | ||
| name string | ||
| wantSkip bool | ||
| expectedErr error | ||
| }{ | ||
| { | ||
| name: "status is empty", | ||
| annotations: map[string]string{ | ||
| helpersv1.StatusMetadataKey: "", | ||
| helpersv1.WlidMetadataKey: "wlid", | ||
| helpersv1.InstanceIDMetadataKey: "instanceID", | ||
| }, | ||
| wantSkip: false, | ||
| }, | ||
| { | ||
| name: "status is Ready", | ||
| annotations: map[string]string{ | ||
| helpersv1.StatusMetadataKey: helpersv1.Ready, | ||
| helpersv1.WlidMetadataKey: "wlid", | ||
| helpersv1.InstanceIDMetadataKey: "instanceID", | ||
| }, | ||
| wantSkip: false, | ||
| }, | ||
| { | ||
| name: "status is Completed", | ||
| annotations: map[string]string{ | ||
| helpersv1.StatusMetadataKey: helpersv1.Completed, | ||
| helpersv1.WlidMetadataKey: "wlid", | ||
| helpersv1.InstanceIDMetadataKey: "instanceID", | ||
| }, | ||
| wantSkip: false, | ||
| }, | ||
| { | ||
| name: "status is not recognized", | ||
| annotations: map[string]string{ | ||
| helpersv1.StatusMetadataKey: "NotRecognized", | ||
| }, | ||
| wantSkip: true, | ||
| expectedErr: fmt.Errorf("invalid status"), | ||
| }, | ||
| { | ||
| name: "no status annotation", | ||
| annotations: map[string]string{}, | ||
| wantSkip: true, | ||
| expectedErr: fmt.Errorf("no annotations"), | ||
| }, | ||
| { | ||
| name: "missing instance WLID annotation", | ||
| annotations: map[string]string{ | ||
| helpersv1.StatusMetadataKey: helpersv1.Ready, | ||
| helpersv1.InstanceIDMetadataKey: "instanceID", | ||
| }, | ||
| wantSkip: true, | ||
| expectedErr: fmt.Errorf("missing WLID annotation"), | ||
| }, | ||
|
|
||
| { | ||
| name: "missing instance ID annotation", | ||
| annotations: map[string]string{ | ||
| helpersv1.StatusMetadataKey: helpersv1.Ready, | ||
| helpersv1.WlidMetadataKey: "wlid", | ||
| }, | ||
| wantSkip: true, | ||
| expectedErr: fmt.Errorf("missing InstanceID annotation"), | ||
| }, | ||
| } | ||
|
|
||
| for _, tt := range tests { | ||
| t.Run(tt.name, func(t *testing.T) { | ||
| gotSkip, err := SkipApplicationProfile(tt.annotations) | ||
| assert.Equal(t, tt.wantSkip, gotSkip) | ||
| assert.Equal(t, tt.expectedErr, err) | ||
| }) | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.