Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: opt-in creating wg-policy PolicyReport
- Loading branch information
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| package feature | ||
|
|
||
| import ( | ||
| "k8s.io/apimachinery/pkg/util/runtime" | ||
| "k8s.io/component-base/featuregate" | ||
|
|
||
| "github.com/statnett/image-scanner-operator/internal/config" | ||
| ) | ||
|
|
||
| // PolicyReport will ensure PolicyReport resources are created for completed scan jobs. | ||
| const PolicyReport featuregate.Feature = "PolicyReport" | ||
|
|
||
| func init() { | ||
| runtime.Must(config.DefaultMutableFeatureGate.Add(defaultFeatureGates)) | ||
| } | ||
|
|
||
| var defaultFeatureGates = map[featuregate.Feature]featuregate.FeatureSpec{ | ||
| PolicyReport: {Default: false, PreRelease: featuregate.Alpha}, | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| package config | ||
|
|
||
| import ( | ||
| "k8s.io/component-base/featuregate" | ||
| ) | ||
|
|
||
| var ( | ||
| // DefaultMutableFeatureGate is a mutable version of DefaultFeatureGate. | ||
| // Only top-level commands/options setup should make use of this. | ||
| DefaultMutableFeatureGate featuregate.MutableFeatureGate = featuregate.NewFeatureGate() | ||
|
|
||
| // DefaultFeatureGate is a shared global FeatureGate. | ||
| // Top-level commands/options setup that needs to modify this feature gate should use DefaultMutableFeatureGate. | ||
| DefaultFeatureGate featuregate.FeatureGate = DefaultMutableFeatureGate | ||
| ) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,130 @@ | ||
| package stas | ||
|
|
||
| import ( | ||
| "context" | ||
| "fmt" | ||
| "strings" | ||
|
|
||
| corev1 "k8s.io/api/core/v1" | ||
| "k8s.io/apimachinery/pkg/runtime" | ||
| "sigs.k8s.io/controller-runtime/pkg/client" | ||
| policyv1alpha2 "sigs.k8s.io/wg-policy-prototypes/policy-report/pkg/api/wgpolicyk8s.io/v1alpha2" | ||
|
|
||
| stasv1alpha1 "github.com/statnett/image-scanner-operator/api/stas/v1alpha1" | ||
| policyv1alpha2ac "github.com/statnett/image-scanner-operator/internal/wg-policy/applyconfiguration/wgpolicyk8s.io/v1alpha2" | ||
| ) | ||
|
|
||
| func newPolicyReportPatch(cis *stasv1alpha1.ContainerImageScan) *policyReportPatch { | ||
| return &policyReportPatch{ | ||
| cis: cis, | ||
| patch: policyv1alpha2ac.PolicyReport(cis.Name, cis.Namespace). | ||
| WithScope( | ||
| corev1.ObjectReference{ | ||
| Kind: cis.Spec.Workload.Kind, | ||
| Name: cis.Spec.Workload.Name, | ||
| }, | ||
| ), | ||
| } | ||
| } | ||
|
|
||
| type policyReportPatch struct { | ||
| cis *stasv1alpha1.ContainerImageScan | ||
| patch *policyv1alpha2ac.PolicyReportApplyConfiguration | ||
| vulnerabilities []stasv1alpha1.Vulnerability | ||
| minSeverity stasv1alpha1.Severity | ||
| } | ||
|
|
||
| func (p *policyReportPatch) withSummary(summary stasv1alpha1.VulnerabilitySummary) *policyReportPatch { | ||
| p.patch. | ||
| WithSummary( | ||
| policyv1alpha2ac.PolicyReportSummary(). | ||
| WithSkip(int(summary.SeverityCount[stasv1alpha1.SeverityUnknown.String()])). | ||
| WithWarn(int(summary.SeverityCount[stasv1alpha1.SeverityLow.String()] + summary.SeverityCount[stasv1alpha1.SeverityMedium.String()])). | ||
| WithFail(int(summary.SeverityCount[stasv1alpha1.SeverityHigh.String()] + summary.SeverityCount[stasv1alpha1.SeverityCritical.String()])), | ||
| ) | ||
|
|
||
| return p | ||
| } | ||
|
|
||
| func (p *policyReportPatch) withResults(vulnerabilities []stasv1alpha1.Vulnerability, minSeverity stasv1alpha1.Severity) *policyReportPatch { | ||
| p.vulnerabilities = vulnerabilities | ||
| p.minSeverity = minSeverity | ||
| return p | ||
| } | ||
|
|
||
| func (p *policyReportPatch) apply(ctx context.Context, c client.Client, scheme *runtime.Scheme) error { | ||
| if err := SetControllerReference(p.cis, p.patch.ObjectMetaApplyConfiguration, scheme); err != nil { | ||
| return err | ||
| } | ||
|
|
||
| var err error | ||
| // Repeat until resource fits in api-server by increasing minimum severity on failure. | ||
| for severity := p.minSeverity; severity <= stasv1alpha1.MaxSeverity; severity++ { | ||
| var vulnerabilities []stasv1alpha1.Vulnerability | ||
| vulnerabilities, err = filterVulnerabilities(p.vulnerabilities, severity) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| p.patch.Results = make([]policyv1alpha2ac.PolicyReportResultApplyConfiguration, len(vulnerabilities)) | ||
| for i, v := range vulnerabilities { | ||
| p.patch.Results[i] = *policyReportResultPatch(v) | ||
| } | ||
|
|
||
| err = c.Status().Patch(ctx, p.cis, applyPatch{p.patch}, FieldValidationStrict, client.ForceOwnership, fieldOwner) | ||
| if !isResourceTooLargeError(err) { | ||
| break | ||
| } | ||
| } | ||
|
|
||
| if err != nil { | ||
| return fmt.Errorf("when patching status: %w", err) | ||
| } | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| func policyReportResultPatch(v stasv1alpha1.Vulnerability) *policyv1alpha2ac.PolicyReportResultApplyConfiguration { | ||
| properties := map[string]string{ | ||
| "pkgName": v.PkgName, | ||
| "installedVersion": v.InstalledVersion, | ||
| } | ||
| if v.PkgPath != "" { | ||
| properties["pkgPath"] = v.PkgPath | ||
| } | ||
| if v.FixedVersion != "" { | ||
| properties["fixedVersion"] = v.FixedVersion | ||
| } | ||
| if v.PrimaryURL != "" { | ||
| properties["primaryURL"] = v.PrimaryURL | ||
| } | ||
|
|
||
| return policyv1alpha2ac.PolicyReportResult(). | ||
| WithCategory("vulnerability scan"). | ||
| WithSource("image-scanner"). | ||
| WithPolicy(v.VulnerabilityID). | ||
| WithResult(mapPolicyResult(v.Severity)). | ||
| WithSeverity(mapPolicyResultSeverity(v.Severity)). | ||
| WithDescription(v.Title). | ||
| WithProperties(properties) | ||
| } | ||
|
|
||
| func mapPolicyResult(severity string) policyv1alpha2.PolicyResult { | ||
| switch severity { | ||
| case "UNKNOWN": | ||
| return "" | ||
| default: | ||
| return policyv1alpha2.PolicyResult(strings.ToLower(severity)) | ||
| } | ||
| } | ||
|
|
||
| func mapPolicyResultSeverity(severity string) policyv1alpha2.PolicyResultSeverity { | ||
| switch severity { | ||
| case "UNKNOWN": | ||
| return "skip" | ||
| case "LOW", "MEDIUM": | ||
| return "warn" | ||
| default: | ||
| return "fail" | ||
| } | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters