Skip to content

Commit 1516123

Browse files
[Issue - 10441] Improved k8s cluster discovery (#5291)
* Skipping discovery of Assets when filter is not provided and go into Namespaces discovery instead. NewNamespacePlatformId also refactored in order to generate correct PlatformID. Some small changes to address redundancy in provider.go Signed-off-by: Aleksandr Chagochkin <[email protected]> * refactor platformids creation for manifests and api Signed-off-by: Ivan Milchev <[email protected]> * log meaningful error message when failing to list namespaces Signed-off-by: Ivan Milchev <[email protected]> --------- Signed-off-by: Aleksandr Chagochkin <[email protected]> Signed-off-by: Ivan Milchev <[email protected]> Co-authored-by: Ivan Milchev <[email protected]>
1 parent 7b18a23 commit 1516123

10 files changed

Lines changed: 172 additions & 114 deletions

File tree

providers/k8s/connection/admission/connection.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,10 @@ func (c *Connection) InventoryConfig() *inventory.Config {
7979
return c.asset.Connections[0]
8080
}
8181

82+
func (c *Connection) BasePlatformId() (string, error) {
83+
return c.AssetId()
84+
}
85+
8286
func (c *Connection) AssetId() (string, error) {
8387
reviews, err := c.AdmissionReviews()
8488
if err != nil {

providers/k8s/connection/api/connection.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -214,6 +214,10 @@ func (c *Connection) Platform() *inventory.Platform {
214214
}
215215
}
216216

217+
func (c *Connection) BasePlatformId() (string, error) {
218+
return shared.IdPrefix, nil
219+
}
220+
217221
func (c *Connection) AssetId() (string, error) {
218222
// we use "kube-system" namespace uid as identifier for the cluster
219223
// use the internal resources function to make sure we can get the right namespace

providers/k8s/connection/manifest/connection.go

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,14 @@ func (c *Connection) Asset() *inventory.Asset {
152152
return c.asset
153153
}
154154

155+
func (c *Connection) BasePlatformId() (string, error) {
156+
manifestHash, err := c.manifestHash()
157+
if err != nil {
158+
return "", err
159+
}
160+
return shared.IdPrefix + manifestHash, nil
161+
}
162+
155163
func (c *Connection) AssetId() (string, error) {
156164
// If we are doing an admission control scan, we have 1 resource in the manifest and it has a UID.
157165
// Instead of using the file path to generate the ID, use the resource UID. We do this because for
@@ -168,6 +176,14 @@ func (c *Connection) AssetId() (string, error) {
168176
}
169177
}
170178

179+
manifestHash, err := c.manifestHash()
180+
if err != nil {
181+
return "", err
182+
}
183+
return shared.NewPlatformId(manifestHash), nil
184+
}
185+
186+
func (c *Connection) manifestHash() (string, error) {
171187
h := sha256.New()
172188

173189
// special handling for embedded content (e.g. piped in via stdin)
@@ -187,7 +203,7 @@ func (c *Connection) AssetId() (string, error) {
187203
}
188204

189205
h.Write([]byte(absPath))
190-
return shared.NewPlatformId(hex.EncodeToString(h.Sum(nil))), nil
206+
return hex.EncodeToString(h.Sum(nil)), nil
191207
}
192208

193209
func (c *Connection) InventoryConfig() *inventory.Config {

providers/k8s/connection/manifest/connection_test.go

Lines changed: 16 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,7 @@ func TestManifestDiscovery(t *testing.T) {
9797
}
9898
inv, err := resources.Discover(pluginRuntime, cnquery.Features{})
9999
require.NoError(t, err)
100-
require.Len(t, inv.Spec.Assets, 2)
100+
require.Len(t, inv.Spec.Assets, 3)
101101

102102
conn.InventoryConfig().Discover.Targets = []string{"all"}
103103
pluginRuntime = &plugin.Runtime{
@@ -108,7 +108,7 @@ func TestManifestDiscovery(t *testing.T) {
108108
}
109109
inv, err = resources.Discover(pluginRuntime, cnquery.Features{})
110110
require.NoError(t, err)
111-
require.Len(t, inv.Spec.Assets, 2)
111+
require.Len(t, inv.Spec.Assets, 3)
112112

113113
conn.InventoryConfig().Discover.Targets = []string{"deployments"}
114114
pluginRuntime = &plugin.Runtime{
@@ -153,7 +153,7 @@ func TestOperatorManifest(t *testing.T) {
153153
}
154154
inv, err := resources.Discover(pluginRuntime, cnquery.Features{})
155155
require.NoError(t, err)
156-
require.Len(t, inv.Spec.Assets, 3)
156+
require.Len(t, inv.Spec.Assets, 4)
157157

158158
require.Len(t, inv.Spec.Assets[1].PlatformIds, 1)
159159

@@ -175,7 +175,8 @@ func TestOperatorManifest(t *testing.T) {
175175

176176
require.NotEqual(t, inv.Spec.Assets[0].PlatformIds[0], inv.Spec.Assets[1].PlatformIds[0])
177177
require.Equal(t, "//platformid.api.mondoo.app/runtime/k8s/uid/"+manifestHash, inv.Spec.Assets[0].PlatformIds[0])
178-
require.Equal(t, "//platformid.api.mondoo.app/runtime/k8s/uid/"+manifestHash+"/namespace/mondoo-operator/deployments/name/mondoo-operator-controller-manager", inv.Spec.Assets[2].PlatformIds[0])
178+
require.Equal(t, "//platformid.api.mondoo.app/runtime/k8s/uid/"+manifestHash+"/namespace/mondoo-operator/services/name/mondoo-operator-controller-manager-metrics-service", inv.Spec.Assets[2].PlatformIds[0])
179+
require.Equal(t, "//platformid.api.mondoo.app/runtime/k8s/uid/"+manifestHash+"/namespace/mondoo-operator/deployments/name/mondoo-operator-controller-manager", inv.Spec.Assets[3].PlatformIds[0])
179180
}
180181

181182
func TestOperatorManifestWithNamespaceFilter(t *testing.T) {
@@ -222,9 +223,17 @@ func TestOperatorManifestWithNamespaceFilter(t *testing.T) {
222223
require.NoError(t, err)
223224
require.NotEmpty(t, asset.PlatformIds[0])
224225
}
226+
227+
h := sha256.New()
228+
absPath, err := filepath.Abs(path)
229+
require.NoError(t, err)
230+
h.Write([]byte(absPath))
231+
manifestHash := hex.EncodeToString(h.Sum(nil))
232+
require.NoError(t, err)
233+
225234
require.NotEqual(t, inv.Spec.Assets[0].PlatformIds[0], inv.Spec.Assets[1].PlatformIds[0])
226-
require.Equal(t, "//platformid.api.mondoo.app/runtime/k8s/uid/namespace/mondoo-operator", inv.Spec.Assets[0].PlatformIds[0])
227-
require.Equal(t, "//platformid.api.mondoo.app/runtime/k8s/uid/namespace/mondoo-operator/deployments/name/mondoo-operator-controller-manager", inv.Spec.Assets[2].PlatformIds[0])
235+
require.Equal(t, "//platformid.api.mondoo.app/runtime/k8s/uid/"+manifestHash+"/namespace/mondoo-operator", inv.Spec.Assets[0].PlatformIds[0])
236+
require.Equal(t, "//platformid.api.mondoo.app/runtime/k8s/uid/"+manifestHash+"/namespace/mondoo-operator/deployments/name/mondoo-operator-controller-manager", inv.Spec.Assets[2].PlatformIds[0])
228237
}
229238

230239
func TestManifestNoObjects(t *testing.T) {
@@ -316,5 +325,5 @@ func TestManifestDir(t *testing.T) {
316325
}
317326
require.NotEmpty(t, inv.Spec.Assets[0].PlatformIds[0])
318327
// we have the operator deployment twice
319-
require.Equal(t, inv.Spec.Assets[1].PlatformIds[0], inv.Spec.Assets[2].PlatformIds[0])
328+
require.Equal(t, inv.Spec.Assets[3].PlatformIds[0], inv.Spec.Assets[4].PlatformIds[0])
320329
}

providers/k8s/connection/manifest/testdata/no-discovered-objects.yaml

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -319,19 +319,3 @@ kind: ConfigMap
319319
metadata:
320320
name: mondoo-operator-manager-config
321321
namespace: mondoo-operator
322-
---
323-
apiVersion: v1
324-
kind: Service
325-
metadata:
326-
labels:
327-
app.kubernetes.io/name: mondoo-operator
328-
name: mondoo-operator-controller-manager-metrics-service
329-
namespace: mondoo-operator
330-
spec:
331-
ports:
332-
- name: metrics
333-
port: 8080
334-
protocol: TCP
335-
targetPort: metrics
336-
selector:
337-
app.kubernetes.io/name: mondoo-operator

providers/k8s/connection/shared/connection.go

Lines changed: 7 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ const (
2626
OPTION_OBJECT_KIND = "object-kind"
2727
OPTION_CONTEXT = "context"
2828
OPTION_KUBELOGIN = "kubelogin"
29-
idPrefix = "//platformid.api.mondoo.app/runtime/k8s/uid/"
29+
IdPrefix = "//platformid.api.mondoo.app/runtime/k8s/uid/"
3030
)
3131

3232
type ConnectionType string
@@ -44,6 +44,7 @@ type Connection interface {
4444
Platform() *inventory.Platform
4545
Asset() *inventory.Asset
4646
AssetId() (string, error)
47+
BasePlatformId() (string, error)
4748

4849
AdmissionReviews() ([]admissionv1.AdmissionReview, error)
4950
Namespace(name string) (*v1.Namespace, error)
@@ -76,12 +77,12 @@ func sliceToPtrSlice[T any](items []T) []*T {
7677
}
7778

7879
func NewPlatformId(assetId string) string {
79-
return idPrefix + assetId
80+
return IdPrefix + assetId
8081
}
8182

82-
func NewWorkloadPlatformId(clusterIdentifier, workloadType, namespace, name, uid string) string {
83+
func NewWorkloadPlatformId(basePlatformId, clusterIdentifier, workloadType, namespace, name, uid string) string {
8384
if workloadType == "namespace" {
84-
return NewNamespacePlatformId(clusterIdentifier, name, uid)
85+
return NewNamespacePlatformId(basePlatformId, name, uid)
8586
}
8687

8788
platformIdentifier := clusterIdentifier
@@ -95,10 +96,6 @@ func NewWorkloadPlatformId(clusterIdentifier, workloadType, namespace, name, uid
9596
return platformIdentifier
9697
}
9798

98-
func NewNamespacePlatformId(clusterIdentifier, name, uid string) string {
99-
if clusterIdentifier == "" {
100-
return fmt.Sprintf("%snamespace/%s", idPrefix, name)
101-
}
102-
103-
return fmt.Sprintf("%s/namespace/%s/uid/%s", clusterIdentifier, name, uid)
99+
func NewNamespacePlatformId(basePlatformId, name, uid string) string {
100+
return fmt.Sprintf("%s%s/namespace/%s", basePlatformId, uid, name)
104101
}

providers/k8s/connection/shared/manifest_parser.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,9 @@ func (t *ManifestParser) Namespaces() ([]v1.Namespace, error) {
7171
o, err := meta.Accessor(res)
7272
if err == nil {
7373
ns := o.GetNamespace()
74+
if ns == "" {
75+
continue
76+
}
7477
// There are types of resources that do not have meta data. Instead of erroring
7578
// skip them.
7679
namespaceMap[ns] = struct{}{}

providers/k8s/provider/provider.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@ func (s *Service) ParseCLI(req *plugin.ParseCLIReq) (*plugin.ParseCLIRes, error)
108108
return &res, nil
109109
}
110110

111-
func (s *Service) MockConnect(req *plugin.ConnectReq, callback plugin.ProviderCallback) (*plugin.ConnectRes, error) {
111+
func (s *Service) MockConnect(_ *plugin.ConnectReq, _ plugin.ProviderCallback) (*plugin.ConnectRes, error) {
112112
return nil, errors.New("mock connect not yet implemented")
113113
}
114114

@@ -135,7 +135,7 @@ func (s *Service) Connect(req *plugin.ConnectReq, callback plugin.ProviderCallba
135135
}
136136

137137
return &plugin.ConnectRes{
138-
Id: uint32(conn.ID()),
138+
Id: conn.ID(),
139139
Name: conn.Name(),
140140
Asset: req.Asset,
141141
Inventory: inventory,

0 commit comments

Comments
 (0)