feat(openstack): add Openstack provider #9811
Conversation
github-actions
bot
added
output/html
danibarranqueroo
added
no-merge
|
✅ Conflict Markers Resolved All conflict markers have been successfully resolved in this pull request. |
github-actions
bot
added
output/html
|
✅ All necessary |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
🔒 Container Security ScanImage: 📊 Vulnerability Summary
3 package(s) affected
|
🔒 Container Security ScanImage: 📊 Vulnerability Summary
10 package(s) affected
|
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #9811 +/- ##
==========================================
- Coverage 92.85% 84.56% -8.29%
==========================================
Files 137 1517 +1380
Lines 3387 47655 +44268
==========================================
+ Hits 3145 40300 +37155
- Misses 242 7355 +7113 Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
| def is_finding_muted( | ||
| self, | ||
| finding: CheckReportOpenStack, | ||
| project_id: str, | ||
| ) -> bool: |
Check warning
Code scanning / CodeQL
Signature mismatch in overriding method Warning
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 7 days ago
In general, this problem is fixed by ensuring that the overriding method in the subclass has a compatible signature with the base class method. The usual pattern is: match the base method’s parameters (names, order, and defaults) and then adapt them internally as needed without changing the method’s external contract.
Here, we must align OpenStackMutelist.is_finding_muted with Mutelist.is_finding_muted. CodeQL says the overridden method requires 1 positional argument (in addition to self), whereas the subclass currently defines two (finding and project_id). The most conservative, non-breaking fix (for callers) is to shrink the public signature to match the base class: accept only finding (besides self) and then obtain project_id from the finding object itself. Since CheckReportOpenStack is specific to OpenStack, it is reasonable that it carries a project identifier (typically something like finding.project_id, finding.account_id, or similar). To avoid assumptions about other files, we should access a likely attribute defensively, but we cannot edit other files, so the best we can do is use an attribute name that’s already evidently part of CheckReportOpenStack’s semantics. The file name and context strongly imply that project_id is available as finding.project_id.
Concretely, in prowler/providers/openstack/lib/mutelist/mutelist.py, change the method signature from:
def is_finding_muted(
self,
finding: CheckReportOpenStack,
project_id: str,
) -> bool:to:
def is_finding_muted(
self,
finding: CheckReportOpenStack,
) -> bool:
project_id = finding.project_idand then use project_id exactly as before in the calls to self.is_muted. The rest of the method body remains the same. This ensures that the override is compatible with the base class method: callers pass only the finding object as per the base-class contract, while the OpenStack-specific logic still has access to the project identifier.
| @@ -9,9 +9,9 @@ | ||
| def is_finding_muted( | ||
| self, | ||
| finding: CheckReportOpenStack, | ||
| project_id: str, | ||
| ) -> bool: | ||
| """Return True when the finding should be muted for the audited project.""" | ||
| project_id = finding.project_id | ||
| # Try matching with both resource_id and resource_name for better UX | ||
| # Users can specify either the UUID or the friendly name in the mutelist | ||
| muted_by_id = self.is_muted( |
| from pathlib import Path | ||
| from typing import Optional | ||
|
|
||
| import openstack |
Check notice
Code scanning / CodeQL
Module is imported with 'import' and 'import from' Note
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 7 days ago
In general, to fix this pattern you avoid importing the same module both with import module and from module import something. Instead, keep one style and, if needed, create aliases like something = module.something after a single import module.
For this file, the minimal, safest change is to remove the unused broad import import openstack on line 5 and rely solely on from openstack.connection import Connection as OpenStackConnection, which is already present and clearly used via the OpenStackConnection type annotation. Since we are not allowed to modify code beyond the shown snippet and we see no direct uses of the openstack package object here, the best assumption to preserve functionality is that import openstack is unnecessary in this file. No additional methods or imports are required to support this; we only delete that one import line in prowler/providers/openstack/openstack_provider.py.
| @@ -2,7 +2,6 @@ | ||
| from pathlib import Path | ||
| from typing import Optional | ||
|
|
||
| import openstack | ||
| import openstack.config | ||
| from colorama import Fore, Style | ||
| from openstack import exceptions as openstack_exceptions |
github-actions
bot
added
the
github_actions
danibarranqueroo
added
provider/openstack
and removed
no-merge
Context
This PR implements OpenStack provider support in the Prowler SDK/CLI, enabling security assessments for OpenStack cloud environments.
OpenStack is a widely-used open-source cloud computing platform, and this integration allows Prowler to perform security audits on OpenStack deployments, complementing the existing support for other cloud providers
Description
This PR adds comprehensive OpenStack provider integration to Prowler with the following components:
Core Provider Implementation:
OpenStackProviderclass with Keystone Identity v3 authenticationOS_AUTH_URL,OS_USERNAME,OS_PASSWORD,OS_PROJECT_ID,OS_REGION_NAMEOS_IDENTITY_API_VERSION,OS_USER_DOMAIN_NAME,OS_PROJECT_DOMAIN_NAMEtest_connection()method for credential validation without full provider initializationServices Implemented:
Security Checks:
compute_instance_security_groups_attached- Ensures compute instances have security groups attached for network protectionAdditional Changes:
CheckMetadataModelto support OpenStack-specific fieldsTesting Coverage:
Dependencies:
openstacksdkpackage to pyproject.toml for OpenStack API interactionsSteps to review
1. Run Tests:
poetry run pytest tests/providers/openstack/ -v # Expected: 57 tests passed2. Verify Provider Initialization:
3. Test Credential Validation:
4. Execute Security Checks:
5. Verify Code Quality:
6. Review Key Files:
prowler/providers/openstack/openstack_provider.py- Provider implementationprowler/providers/openstack/models.py- Session and identity modelsprowler/providers/openstack/services/*/- Service implementationstests/providers/openstack/*- Test coverageChecklist
Community Checklist
SDK/CLI
UI
API
License
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.