@@ -10,33 +10,28 @@ import (
1010 "strings"
1111 "time"
1212
13+ "github.com/armosec/armoapi-go/apis"
14+ apitypes "github.com/armosec/armoapi-go/armotypes"
15+ "github.com/armosec/armoapi-go/identifiers"
1316 "github.com/armosec/registryx/interfaces"
1417 "github.com/armosec/registryx/registryclients"
15- metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
16- "k8s.io/utils/strings/slices"
17-
18+ "github.com/armosec/utils-go/httputils"
19+ "github.com/armosec/utils-k8s-go/armometadata"
1820 "github.com/distribution/reference"
1921 dockerregistry "github.com/docker/docker/api/types/registry"
22+ "github.com/google/uuid"
2023 "github.com/kubescape/go-logger"
2124 "github.com/kubescape/go-logger/helpers"
25+ "github.com/kubescape/k8s-interface/cloudsupport"
2226 "github.com/kubescape/k8s-interface/k8sinterface"
2327 "github.com/kubescape/operator/config"
2428 "github.com/kubescape/operator/utils"
2529 "go.opentelemetry.io/otel"
2630 "go.opentelemetry.io/otel/attribute"
2731 "go.opentelemetry.io/otel/trace"
28-
2932 corev1 "k8s.io/api/core/v1"
30-
31- "github.com/google/uuid"
32-
33- "github.com/armosec/armoapi-go/apis"
34- apitypes "github.com/armosec/armoapi-go/armotypes"
35- "github.com/armosec/armoapi-go/identifiers"
36- "github.com/armosec/utils-k8s-go/armometadata"
37-
38- "github.com/armosec/utils-go/httputils"
39- "github.com/kubescape/k8s-interface/cloudsupport"
33+ metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
34+ "k8s.io/utils/strings/slices"
4035)
4136
4237func getAPScanURL (config config.IConfig ) * url.URL {
@@ -100,7 +95,7 @@ func (actionHandler *ActionHandler) scanRegistriesV2AndUpdateStatus(ctx context.
10095 scanTime := time .Now ()
10196 imageRegistry , err := actionHandler .loadRegistryFromSessionObj ()
10297 if err != nil {
103- return fmt .Errorf ("failed to load registry from sessionObj with err %v " , err )
98+ return fmt .Errorf ("failed to load registry from sessionObj: %w " , err )
10499 }
105100
106101 err = actionHandler .scanRegistriesV2 (ctx , imageRegistry )
@@ -119,27 +114,27 @@ func (actionHandler *ActionHandler) scanRegistriesV2AndUpdateStatus(ctx context.
119114
120115func (actionHandler * ActionHandler ) scanRegistriesV2 (ctx context.Context , imageRegistry apitypes.ContainerImageRegistry ) error {
121116 if err := actionHandler .loadRegistrySecret (ctx , imageRegistry ); err != nil {
122- return fmt .Errorf ("failed to load secret with err %v " , err )
117+ return fmt .Errorf ("failed to load secret: %w " , err )
123118 }
124119
125120 client , err := registryclients .GetRegistryClient (imageRegistry )
126121 if err != nil {
127- return fmt .Errorf ("failed to get registry client with err %v " , err )
122+ return fmt .Errorf ("failed to get registry client: %w " , err )
128123 }
129124
130125 images , err := client .GetImagesToScan (ctx )
131126 if err != nil {
132- return fmt .Errorf ("failed to get registry images to scan with err %v " , err )
127+ return fmt .Errorf ("failed to get registry images to scan: %w " , err )
133128 } else if len (images ) == 0 {
134129 return errors .New (noImagesToScanError )
135130 }
136131
137132 registryScanCMDList , err := actionHandler .getRegistryImageScanCommands (client , imageRegistry , images )
138133 if err != nil {
139- return fmt .Errorf ("failed to get registry images scan commands with err %v " , err )
134+ return fmt .Errorf ("failed to get registry images scan commands: %w " , err )
140135 }
141136 if err = sendAllImagesToRegistryScan (ctx , actionHandler .config , registryScanCMDList ); err != nil {
142- return fmt .Errorf ("failed to send scan commands with err %v " , err )
137+ return fmt .Errorf ("failed to send scan commands: %w " , err )
143138 }
144139
145140 return nil
@@ -149,17 +144,17 @@ func (actionHandler *ActionHandler) loadRegistrySecret(ctx context.Context, imag
149144 secretName := actionHandler .sessionObj .Command .Args [apitypes .RegistrySecretNameArgKey ].(string )
150145 secret , err := actionHandler .k8sAPI .KubernetesClient .CoreV1 ().Secrets (actionHandler .config .Namespace ()).Get (ctx , secretName , metav1.GetOptions {})
151146 if err != nil {
152- return fmt .Errorf ("loadRegistrySecret failed to get secret with err %v " , err )
147+ return fmt .Errorf ("loadRegistrySecret failed to get secret: %w " , err )
153148 }
154149
155150 var secretMap map [string ]interface {}
156151 err = json .Unmarshal (secret .Data [apitypes .RegistryAuthFieldInSecret ], & secretMap )
157152 if err != nil {
158- return fmt .Errorf ("loadRegistrySecret failed to unmarshal registry secret with err %v " , err )
153+ return fmt .Errorf ("loadRegistrySecret failed to unmarshal registry secret: %w " , err )
159154 }
160155 err = imageRegistry .FillSecret (secretMap )
161156 if err != nil {
162- return fmt .Errorf ("loadRegistrySecret failed to fill registry secret with err %v " , err )
157+ return fmt .Errorf ("loadRegistrySecret failed to fill registry secret: %w " , err )
163158 }
164159 return nil
165160}
@@ -168,11 +163,11 @@ func (actionHandler *ActionHandler) loadRegistryFromSessionObj() (apitypes.Conta
168163 regInfo := actionHandler .sessionObj .Command .Args [apitypes .RegistryInfoArgKey ].(map [string ]interface {})
169164 regInfoBytes , err := json .Marshal (regInfo )
170165 if err != nil {
171- return nil , fmt .Errorf ("scanRegistriesV2 failed to marshal command arg with err %v " , err )
166+ return nil , fmt .Errorf ("scanRegistriesV2 failed to marshal command arg: %w " , err )
172167 }
173168 imageRegistry , err := apitypes .UnmarshalRegistry (regInfoBytes )
174169 if err != nil {
175- return nil , fmt .Errorf ("scanRegistriesV2 failed to unmarshal command with err %v " , err )
170+ return nil , fmt .Errorf ("scanRegistriesV2 failed to unmarshal command: %w " , err )
176171 }
177172 return imageRegistry , nil
178173}
@@ -206,7 +201,7 @@ func (actionHandler *ActionHandler) getRegistryImageScanCommands(client interfac
206201 }
207202 auth , err := client .GetDockerAuth ()
208203 if err != nil {
209- return nil , fmt .Errorf ("failed to get docker auth with err %v " , err )
204+ return nil , fmt .Errorf ("failed to get docker auth: %w " , err )
210205 }
211206 registryScanCommand .Credentialslist = append (registryScanCommand .Credentialslist , * auth )
212207 registryScanCMDList = append (registryScanCMDList , & apis.RegistryScanCommand {
@@ -240,7 +235,7 @@ func (actionHandler *ActionHandler) scanImage(ctx context.Context) error {
240235 cmd := actionHandler .getImageScanCommand (containerData , imageScanConfig )
241236
242237 if err := sendCommandToScanner (ctx , actionHandler .config , cmd , actionHandler .sessionObj .Command .CommandName ); err != nil {
243- return fmt .Errorf ("failed to send command to scanner with err %v " , err )
238+ return fmt .Errorf ("failed to send command to scanner: %w " , err )
244239 }
245240 return nil
246241}
@@ -253,6 +248,21 @@ func (actionHandler *ActionHandler) scanApplicationProfile(ctx context.Context)
253248 return errors .New ("kubevuln is not enabled" )
254249 }
255250
251+ // get the pod from the session object
252+ pod , _ := actionHandler .sessionObj .Command .Args [utils .ArgsPod ].(* corev1.Pod )
253+
254+ var authConfigs []dockerregistry.AuthConfig
255+ if pod != nil {
256+ // build a list of secrets from the registry secrets
257+ secrets , err := cloudsupport .GetImageRegistryCredentials (actionHandler .k8sAPI , "" , pod )
258+ if err != nil {
259+ return fmt .Errorf ("failed to get registry credentials: %w" , err )
260+ }
261+ for i := range secrets {
262+ authConfigs = append (authConfigs , secrets [i ]... )
263+ }
264+ }
265+
256266 span .AddEvent ("scanning" , trace .WithAttributes (attribute .String ("wlid" , actionHandler .wlid )))
257267 cmd := & apis.WebsocketScanCommand {
258268 Wlid : actionHandler .wlid ,
@@ -261,13 +271,14 @@ func (actionHandler *ActionHandler) scanApplicationProfile(ctx context.Context)
261271 "name" : actionHandler .sessionObj .Command .Args [utils .ArgsName ],
262272 "namespace" : actionHandler .sessionObj .Command .Args [utils .ArgsNamespace ],
263273 },
274+ Credentialslist : authConfigs ,
264275 },
265276 }
266277
267278 prepareSessionChain (actionHandler .sessionObj , cmd , actionHandler )
268279
269280 if err := sendCommandToScanner (ctx , actionHandler .config , cmd , apis .TypeScanApplicationProfile ); err != nil {
270- return fmt .Errorf ("failed to send command to scanner with err %v " , err )
281+ return fmt .Errorf ("failed to send command to scanner: %w " , err )
271282 }
272283 return nil
273284}
@@ -344,7 +355,7 @@ func getImageScanConfig(k8sAPI *k8sinterface.KubernetesApi, namespace string, po
344355
345356 if pod != nil {
346357 // TODO: this should not happen every scan
347- // build a list of secrets from the the registry secrets
358+ // build a list of secrets from the registry secrets
348359 secrets , err := cloudsupport .GetImageRegistryCredentials (k8sAPI , imageTag , pod )
349360 if err != nil {
350361 return nil , err
@@ -398,7 +409,7 @@ func sendWorkloadWithCredentials(ctx context.Context, scanUrl *url.URL, command
398409 }
399410
400411 if err != nil {
401- return fmt .Errorf ("failed to marshal websocketScanCommand with err %v " , err )
412+ return fmt .Errorf ("failed to marshal websocketScanCommand: %w " , err )
402413 }
403414 if command .GetWlid () == "" {
404415 logger .L ().Debug (fmt .Sprintf ("sending scan command to kubevuln: %s" , string (jsonScannerC )))
0 commit comments