Skip to content

Commit 8f4b2eb

Browse files
matthyxmatthyx
authored
Merge pull request #298 from kubescape/pullsec
add pullsecrets from pod for scanAP
2 parents 1e005f2 + 4550ba3 commit 8f4b2eb

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

48 files changed

+353
-392
lines changed

‎admission/exporter/http_exporter.go

+1-2
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,10 @@ import (
99
"sync"
1010
"time"
1111

12+
apitypes "github.com/armosec/armoapi-go/armotypes"
1213
"github.com/kubescape/go-logger"
1314
"github.com/kubescape/go-logger/helpers"
1415
"github.com/kubescape/operator/admission/rules"
15-
16-
apitypes "github.com/armosec/armoapi-go/armotypes"
1716
)
1817

1918
type HTTPExporterConfig struct {

‎admission/rulebinding/cache/cache.go

+8-12
Original file line numberDiff line numberDiff line change
@@ -4,24 +4,20 @@ import (
44
"context"
55
"strings"
66

7-
typesv1 "github.com/kubescape/node-agent/pkg/rulebindingmanager/types/v1"
8-
"github.com/kubescape/node-agent/pkg/watcher"
9-
"k8s.io/apimachinery/pkg/runtime"
10-
11-
"github.com/kubescape/node-agent/pkg/k8sclient"
12-
13-
"github.com/kubescape/node-agent/pkg/rulebindingmanager"
14-
15-
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
16-
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
17-
"k8s.io/apimachinery/pkg/labels"
18-
197
"github.com/goradd/maps"
208
"github.com/kubescape/go-logger"
219
"github.com/kubescape/go-logger/helpers"
10+
"github.com/kubescape/node-agent/pkg/k8sclient"
11+
"github.com/kubescape/node-agent/pkg/rulebindingmanager"
12+
typesv1 "github.com/kubescape/node-agent/pkg/rulebindingmanager/types/v1"
13+
"github.com/kubescape/node-agent/pkg/watcher"
2214
"github.com/kubescape/operator/admission/rulebinding"
2315
"github.com/kubescape/operator/admission/rules"
2416
rulesv1 "github.com/kubescape/operator/admission/rules/v1"
17+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
18+
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
19+
"k8s.io/apimachinery/pkg/labels"
20+
"k8s.io/apimachinery/pkg/runtime"
2521
)
2622

2723
const (

‎admission/rulebinding/cache/cache_test.go

+1-2
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,9 @@ import (
44
"context"
55
"testing"
66

7-
typesv1 "github.com/kubescape/node-agent/pkg/rulebindingmanager/types/v1"
8-
97
"github.com/goradd/maps"
108
"github.com/kubescape/k8s-interface/k8sinterface"
9+
typesv1 "github.com/kubescape/node-agent/pkg/rulebindingmanager/types/v1"
1110
"github.com/kubescape/operator/admission/rules"
1211
"github.com/kubescape/operator/utils"
1312
"github.com/stretchr/testify/assert"

‎admission/rulebinding/cache/helpers.go

+1-3
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,10 @@ import (
44
typesv1 "github.com/kubescape/node-agent/pkg/rulebindingmanager/types/v1"
55
"github.com/kubescape/node-agent/pkg/utils"
66
"github.com/kubescape/node-agent/pkg/watcher"
7-
8-
k8sruntime "k8s.io/apimachinery/pkg/runtime"
9-
107
corev1 "k8s.io/api/core/v1"
118
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
129
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
10+
k8sruntime "k8s.io/apimachinery/pkg/runtime"
1311
)
1412

1513
func uniqueName(obj metav1.Object) string {

‎admission/rulebinding/cache/helpers_test.go

-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ import (
44
"testing"
55

66
typesv1 "github.com/kubescape/node-agent/pkg/rulebindingmanager/types/v1"
7-
87
"github.com/stretchr/testify/assert"
98
corev1 "k8s.io/api/core/v1"
109
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

‎admission/rules/v1/helpers.go

+7-7
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ import (
44
"context"
55
"fmt"
66

7-
v1 "k8s.io/api/core/v1"
7+
corev1 "k8s.io/api/core/v1"
88
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
99
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
1010
"k8s.io/apimachinery/pkg/runtime"
@@ -22,7 +22,7 @@ func GetControllerDetails(event admission.Attributes, clientset kubernetes.Inter
2222

2323
pod, err := GetPodDetails(clientset, podName, namespace)
2424
if err != nil {
25-
return "", "", "", "", fmt.Errorf("failed to get pod details: %v", err)
25+
return "", "", "", "", fmt.Errorf("failed to get pod details: %w", err)
2626
}
2727

2828
workloadKind, workloadName, workloadNamespace := ExtractPodOwner(pod, clientset)
@@ -32,16 +32,16 @@ func GetControllerDetails(event admission.Attributes, clientset kubernetes.Inter
3232
}
3333

3434
// GetPodDetails returns the pod details from the Kubernetes API server.
35-
func GetPodDetails(clientset kubernetes.Interface, podName, namespace string) (*v1.Pod, error) {
35+
func GetPodDetails(clientset kubernetes.Interface, podName, namespace string) (*corev1.Pod, error) {
3636
pod, err := clientset.CoreV1().Pods(namespace).Get(context.TODO(), podName, metav1.GetOptions{})
3737
if err != nil {
38-
return nil, fmt.Errorf("failed to get pod: %v", err)
38+
return nil, fmt.Errorf("failed to get pod: %w", err)
3939
}
4040
return pod, nil
4141
}
4242

4343
// ExtractPodOwner returns the kind, name, and namespace of the controller that owns the pod.
44-
func ExtractPodOwner(pod *v1.Pod, clientset kubernetes.Interface) (string, string, string) {
44+
func ExtractPodOwner(pod *corev1.Pod, clientset kubernetes.Interface) (string, string, string) {
4545
for _, ownerRef := range pod.OwnerReferences {
4646
switch ownerRef.Kind {
4747
case "ReplicaSet":
@@ -91,9 +91,9 @@ func GetContainerNameFromExecToPodEvent(event admission.Attributes) (string, err
9191
return "", fmt.Errorf("object is not of type *unstructured.Unstructured")
9292
}
9393

94-
podExecOptions := &v1.PodExecOptions{}
94+
podExecOptions := &corev1.PodExecOptions{}
9595
if err := runtime.DefaultUnstructuredConverter.FromUnstructured(unstructuredObj.Object, podExecOptions); err != nil {
96-
return "", fmt.Errorf("failed to decode PodExecOptions: %v", err)
96+
return "", fmt.Errorf("failed to decode PodExecOptions: %w", err)
9797
}
9898

9999
return podExecOptions.Container, nil

‎admission/rules/v1/r2000_exec_to_pod.go

+1-3
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,14 @@ import (
44
"fmt"
55
"time"
66

7+
apitypes "github.com/armosec/armoapi-go/armotypes"
78
"github.com/kubescape/go-logger"
89
"github.com/kubescape/go-logger/helpers"
910
"github.com/kubescape/operator/admission/rules"
1011
"github.com/kubescape/operator/objectcache"
11-
1212
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
1313
"k8s.io/apiserver/pkg/admission"
1414
"k8s.io/apiserver/pkg/authentication/user"
15-
16-
apitypes "github.com/armosec/armoapi-go/armotypes"
1715
)
1816

1917
const (

‎admission/rules/v1/r2001_portforward.go

+3-5
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,14 @@ import (
44
"fmt"
55
"time"
66

7-
"github.com/kubescape/operator/admission/rules"
8-
"github.com/kubescape/operator/objectcache"
9-
7+
apitypes "github.com/armosec/armoapi-go/armotypes"
108
"github.com/kubescape/go-logger"
119
"github.com/kubescape/go-logger/helpers"
10+
"github.com/kubescape/operator/admission/rules"
11+
"github.com/kubescape/operator/objectcache"
1212
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
1313
"k8s.io/apiserver/pkg/admission"
1414
"k8s.io/apiserver/pkg/authentication/user"
15-
16-
apitypes "github.com/armosec/armoapi-go/armotypes"
1715
)
1816

1917
const (

‎admission/rules/v1/rule.go

+1-2
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,8 @@
11
package rules
22

33
import (
4-
"github.com/kubescape/operator/admission/rules"
5-
64
"github.com/goradd/maps"
5+
"github.com/kubescape/operator/admission/rules"
76
)
87

98
const (

‎admission/webhook/server.go

+2-3
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,9 @@ import (
1212
"sync"
1313
"time"
1414

15-
"github.com/kubescape/node-agent/pkg/watcher"
16-
1715
"github.com/kubescape/go-logger"
1816
"github.com/kubescape/go-logger/helpers"
17+
"github.com/kubescape/node-agent/pkg/watcher"
1918
admissionv1 "k8s.io/api/admission/v1"
2019
authenticationv1 "k8s.io/api/authentication/v1"
2120
k8serrors "k8s.io/apimachinery/pkg/api/errors"
@@ -393,7 +392,7 @@ func parseRequest(r *http.Request) (*admissionv1.AdmissionReview, error) {
393392
var admissionReview admissionv1.AdmissionReview
394393

395394
if err := json.Unmarshal(body, &admissionReview); err != nil {
396-
return nil, fmt.Errorf("could not parse admission review request: %v", err)
395+
return nil, fmt.Errorf("could not parse admission review request: %w", err)
397396
}
398397

399398
if admissionReview.Request == nil {

‎admission/webhook/server_test.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ import (
1414
"github.com/kubescape/node-agent/pkg/watcher"
1515
"github.com/stretchr/testify/assert"
1616
admissionv1 "k8s.io/api/admission/v1"
17-
v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
17+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1818
"k8s.io/apimachinery/pkg/runtime"
1919
"k8s.io/apimachinery/pkg/runtime/serializer"
2020
"k8s.io/apiserver/pkg/admission"
@@ -59,7 +59,7 @@ func TestHandleWebhookValidate(t *testing.T) {
5959
review := admissionv1.AdmissionReview{
6060
Request: &admissionv1.AdmissionRequest{
6161
UID: "12345",
62-
Kind: v1.GroupVersionKind{Group: "apps", Version: "v1", Kind: "Deployment"},
62+
Kind: metav1.GroupVersionKind{Group: "apps", Version: "v1", Kind: "Deployment"},
6363
Object: runtime.RawExtension{
6464
Raw: []byte(`{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"name":"test"}}`),
6565
},

‎continuousscanning/handlers.go

+5-7
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,9 @@ import (
55
"errors"
66
"fmt"
77

8-
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
9-
"k8s.io/apimachinery/pkg/runtime"
10-
"k8s.io/apimachinery/pkg/watch"
11-
"k8s.io/utils/ptr"
12-
138
armoapi "github.com/armosec/armoapi-go/apis"
149
armowlid "github.com/armosec/utils-k8s-go/wlid"
10+
sets "github.com/deckarep/golang-set/v2"
1511
"github.com/kubescape/go-logger"
1612
"github.com/kubescape/go-logger/helpers"
1713
"github.com/kubescape/k8s-interface/k8sinterface"
@@ -24,8 +20,10 @@ import (
2420
kssc "github.com/kubescape/storage/pkg/generated/clientset/versioned"
2521
"github.com/panjf2000/ants/v2"
2622
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
27-
28-
sets "github.com/deckarep/golang-set/v2"
23+
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
24+
"k8s.io/apimachinery/pkg/runtime"
25+
"k8s.io/apimachinery/pkg/watch"
26+
"k8s.io/utils/ptr"
2927
)
3028

3129
var orphanableWorkloadTypes = sets.NewSet[string]("Pod", "ReplicaSet", "Job")

‎continuousscanning/service.go

+3-4
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,14 @@ package continuousscanning
33
import (
44
"context"
55

6+
armoapi "github.com/armosec/armoapi-go/apis"
7+
"github.com/kubescape/go-logger"
8+
"github.com/kubescape/go-logger/helpers"
69
"github.com/kubescape/operator/config"
710
"github.com/kubescape/operator/watcher"
811
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
912
"k8s.io/apimachinery/pkg/watch"
1013
"k8s.io/client-go/dynamic"
11-
12-
armoapi "github.com/armosec/armoapi-go/apis"
13-
"github.com/kubescape/go-logger"
14-
"github.com/kubescape/go-logger/helpers"
1514
)
1615

1716
type ContinuousScanningService struct {

‎continuousscanning/watchbuilder_test.go

+1-2
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,12 @@ import (
44
"context"
55
"testing"
66

7+
"github.com/stretchr/testify/assert"
78
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
89
"k8s.io/apimachinery/pkg/runtime"
910
"k8s.io/apimachinery/pkg/runtime/schema"
1011
dynamicfake "k8s.io/client-go/dynamic/fake"
1112
ktest "k8s.io/client-go/testing"
12-
13-
"github.com/stretchr/testify/assert"
1413
)
1514

1615
func assertWatchAction(t *testing.T, gotAction ktest.Action, wantGVR schema.GroupVersionResource) {

‎docs/server.go

+1-2
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,8 @@
11
package docs
22

33
import (
4-
"net/http"
5-
64
_ "embed"
5+
"net/http"
76

87
"github.com/go-openapi/runtime/middleware"
98
)

‎main.go

+9-13
Original file line numberDiff line numberDiff line change
@@ -5,36 +5,32 @@ import (
55
"flag"
66
"fmt"
77
"net/http"
8+
_ "net/http/pprof"
89
"net/url"
910
"os"
1011
"os/signal"
1112
"syscall"
1213
"time"
1314

14-
"github.com/kubescape/node-agent/pkg/rulebindingmanager"
15-
"github.com/kubescape/node-agent/pkg/watcher/dynamicwatcher"
16-
kssc "github.com/kubescape/storage/pkg/generated/clientset/versioned"
17-
18-
_ "net/http/pprof"
19-
15+
"github.com/armosec/utils-k8s-go/probes"
16+
beUtils "github.com/kubescape/backend/pkg/utils"
17+
"github.com/kubescape/go-logger"
2018
"github.com/kubescape/go-logger/helpers"
2119
"github.com/kubescape/k8s-interface/k8sinterface"
20+
"github.com/kubescape/node-agent/pkg/rulebindingmanager"
21+
"github.com/kubescape/node-agent/pkg/watcher/dynamicwatcher"
2222
exporters "github.com/kubescape/operator/admission/exporter"
2323
rulebindingcachev1 "github.com/kubescape/operator/admission/rulebinding/cache"
2424
"github.com/kubescape/operator/admission/webhook"
2525
"github.com/kubescape/operator/config"
2626
"github.com/kubescape/operator/mainhandler"
2727
"github.com/kubescape/operator/objectcache"
2828
"github.com/kubescape/operator/restapihandler"
29+
"github.com/kubescape/operator/servicehandler"
2930
"github.com/kubescape/operator/utils"
31+
kssc "github.com/kubescape/storage/pkg/generated/clientset/versioned"
3032
"k8s.io/apimachinery/pkg/runtime"
3133
restclient "k8s.io/client-go/rest"
32-
33-
"github.com/armosec/utils-k8s-go/probes"
34-
beUtils "github.com/kubescape/backend/pkg/utils"
35-
"github.com/kubescape/go-logger"
36-
37-
"github.com/kubescape/operator/servicehandler"
3834
)
3935

4036
//go:generate swagger generate spec -o ./docs/swagger.yaml
@@ -109,7 +105,7 @@ func main() {
109105
k8sConfig.ContentType = "application/vnd.kubernetes.protobuf"
110106
ksStorageClient, err := kssc.NewForConfig(k8sConfig)
111107
if err != nil {
112-
logger.L().Ctx(ctx).Fatal(fmt.Sprintf("Unable to initialize the storage client: %v", err))
108+
logger.L().Ctx(ctx).Fatal("unable to initialize the storage client", helpers.Error(err))
113109
}
114110

115111
kubernetesCache := objectcache.NewKubernetesCache(k8sApi)

0 commit comments

Comments
 (0)