From 613399c6486093509decdd0e1a39dbb2f8f2da82 Mon Sep 17 00:00:00 2001 From: Eswar Rajan Subramanian Date: Tue, 19 Apr 2022 18:28:59 +0530 Subject: [PATCH 1/3] Network insight support Signed-off-by: Eswar Rajan Subramanian --- cmd/insight.go | 7 +++++-- go.mod | 7 +------ go.sum | 14 ++------------ insight/insight.go | 14 ++++++++++---- 4 files changed, 18 insertions(+), 24 deletions(-) diff --git a/cmd/insight.go b/cmd/insight.go index c3de3068..066ec7ee 100644 --- a/cmd/insight.go +++ b/cmd/insight.go @@ -13,8 +13,8 @@ var insightOptions insight.Options // insightCmd represents the insight command var insightCmd = &cobra.Command{ Use: "insight", - Short: "Observe policy from the discovery engine", - Long: `Observe policy from the discovery engine`, + Short: "Policy insight from discovery engine", + Long: `Policy insight from discovery engine`, RunE: func(cmd *cobra.Command, args []string) error { if err := insight.StartInsight(insightOptions); err != nil { return err @@ -27,9 +27,12 @@ func init() { rootCmd.AddCommand(insightCmd) insightCmd.Flags().StringVar(&insightOptions.GRPC, "gRPC", "", "gRPC server information") + insightCmd.Flags().StringVar(&insightOptions.Source, "source", "all", "The DB for insight : system|network") insightCmd.Flags().StringVar(&insightOptions.Labels, "labels", "", "Labels for resources") insightCmd.Flags().StringVar(&insightOptions.Containername, "containername", "", "Filter according to the Container name") insightCmd.Flags().StringVar(&insightOptions.Clustername, "clustername", "", "Filter according to the Cluster name") insightCmd.Flags().StringVar(&insightOptions.Fromsource, "fromsource", "", "Filter according to the source path") insightCmd.Flags().StringVarP(&insightOptions.Namespace, "namespace", "n", "", "Namespace for resources") + insightCmd.Flags().StringVar(&insightOptions.Type, "type", "", "NW packet type : ingress|egress") + insightCmd.Flags().StringVar(&insightOptions.Rule, "rule", "", "NW packet Rule") } diff --git a/go.mod b/go.mod index afd46eb1..2696166d 100644 --- a/go.mod +++ b/go.mod @@ -11,7 +11,7 @@ replace ( ) require ( - github.com/accuknox/auto-policy-discovery/src v0.0.0-20220412023742-5df1489d264b + github.com/accuknox/auto-policy-discovery/src v0.0.0-20220419113526-411a056ecebe github.com/cilium/cilium v1.10.0 github.com/kubearmor/KVMService/src/types v0.0.0-20220228115540-2211247620dd github.com/kubearmor/KubeArmor/KubeArmor v0.0.0-20220321102834-0971f727bd8a @@ -42,7 +42,6 @@ require ( github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect github.com/Azure/go-autorest/logger v0.2.1 // indirect github.com/Azure/go-autorest/tracing v0.6.0 // indirect - github.com/DATA-DOG/go-sqlmock v1.5.0 // indirect github.com/PuerkitoBio/purell v1.1.1 // indirect github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect github.com/StackExchange/wmi v1.2.1 // indirect @@ -51,7 +50,6 @@ require ( github.com/beorn7/perks v1.0.1 // indirect github.com/blang/semver/v4 v4.0.0 // indirect github.com/cespare/xxhash/v2 v2.1.2 // indirect - github.com/confluentinc/confluent-kafka-go v1.6.1 // indirect github.com/davecgh/go-spew v1.1.1 // indirect github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5 // indirect github.com/evanphx/json-patch v5.6.0+incompatible // indirect @@ -69,7 +67,6 @@ require ( github.com/go-openapi/strfmt v0.21.0 // indirect github.com/go-openapi/swag v0.19.15 // indirect github.com/go-openapi/validate v0.20.3 // indirect - github.com/go-sql-driver/mysql v1.5.0 // indirect github.com/go-stack/stack v1.8.1 // indirect github.com/gogo/protobuf v1.3.2 // indirect github.com/golang-jwt/jwt/v4 v4.1.0 // indirect @@ -115,7 +112,6 @@ require ( github.com/prometheus/client_model v0.2.1-0.20210607210712-147c58e9608a // indirect github.com/prometheus/common v0.32.1 // indirect github.com/prometheus/procfs v0.7.3 // indirect - github.com/robfig/cron v1.2.0 // indirect github.com/rogpeppe/go-internal v1.8.0 // indirect github.com/sasha-s/go-deadlock v0.3.1 // indirect github.com/shirou/gopsutil/v3 v3.21.10 // indirect @@ -143,7 +139,6 @@ require ( google.golang.org/genproto v0.0.0-20211208223120-3a66f561d7aa // indirect gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/ini.v1 v1.64.0 // indirect - gopkg.in/natefinch/lumberjack.v2 v2.0.0 // indirect gopkg.in/yaml.v2 v2.4.0 // indirect gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect k8s.io/klog/v2 v2.30.0 // indirect diff --git a/go.sum b/go.sum index 693604cf..b65ad4c3 100644 --- a/go.sum +++ b/go.sum @@ -85,8 +85,6 @@ github.com/Azure/go-autorest/tracing v0.6.0 h1:TYi4+3m5t6K48TGI9AUdb+IzbnSxvnvUM github.com/Azure/go-autorest/tracing v0.6.0/go.mod h1:+vhtPC754Xsa23ID7GlGsrdKBpUA79WCAKPPZVC2DeU= github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU= github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo= -github.com/DATA-DOG/go-sqlmock v1.5.0 h1:Shsta01QNfFxHCfpW6YH2STWB0MudeXXEWMr20OEh60= -github.com/DATA-DOG/go-sqlmock v1.5.0/go.mod h1:f/Ixk793poVmq4qj/V1dPUg2JEAKC73Q5eFN3EC/SaM= github.com/Knetic/govaluate v3.0.1-0.20171022003610-9aa49832a739+incompatible/go.mod h1:r7JcOSlj0wfOMncg0iLm8Leh48TZaKVeNIfJntJ2wa0= github.com/Microsoft/go-winio v0.4.11/go.mod h1:VhR8bwka0BXejwEJY73c50VrPtXAaKcyvVC4A4RozmA= github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA= @@ -122,10 +120,8 @@ github.com/StackExchange/wmi v0.0.0-20190523213315-cbe66965904d/go.mod h1:3eOhrU github.com/StackExchange/wmi v1.2.1 h1:VIkavFPXSjcnS+O8yTq7NI32k0R5Aj+v39y29VYDOSA= github.com/StackExchange/wmi v1.2.1/go.mod h1:rcmrprowKIVzvc+NUiLncP2uuArMWLCbu9SBzvHz7e8= github.com/VividCortex/gohistogram v1.0.0/go.mod h1:Pf5mBqqDxYaXu3hDrrU+w6nw50o/4+TcAqDqk/vUH7g= -github.com/accuknox/auto-policy-discovery/src v0.0.0-20220407062502-7a17738e4ebc h1:bmbqlL+2Nu4wnh53a1jq1hyW7KhjSXl3PqcbKtTeCeo= -github.com/accuknox/auto-policy-discovery/src v0.0.0-20220407062502-7a17738e4ebc/go.mod h1:PjyjUUBKD3cfU4a2FlUJfH3b+coUvOS8MovbZtf6xSk= -github.com/accuknox/auto-policy-discovery/src v0.0.0-20220412023742-5df1489d264b h1:r4Bw2IznyBivFgu0qrkls3vn+CowjXqtWagxp3qAHk4= -github.com/accuknox/auto-policy-discovery/src v0.0.0-20220412023742-5df1489d264b/go.mod h1:PjyjUUBKD3cfU4a2FlUJfH3b+coUvOS8MovbZtf6xSk= +github.com/accuknox/auto-policy-discovery/src v0.0.0-20220419113526-411a056ecebe h1:ngygWGYbUq5VqZy1ZUv5cOH11Q1Av/iIomhWlktOrug= +github.com/accuknox/auto-policy-discovery/src v0.0.0-20220419113526-411a056ecebe/go.mod h1:PjyjUUBKD3cfU4a2FlUJfH3b+coUvOS8MovbZtf6xSk= github.com/afex/hystrix-go v0.0.0-20180502004556-fa1af6a1f4f5/go.mod h1:SkGFH1ia65gfNATL8TAiHDNxPzPdmEL5uirI2Uyuz6c= github.com/agnivade/levenshtein v1.0.1/go.mod h1:CURSv5d9Uaml+FovSIICkLbAUZ9S4RqaHDIsdSBg7lM= github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc= @@ -233,8 +229,6 @@ github.com/cockroachdb/datadriven v0.0.0-20200714090401-bf6692d28da5/go.mod h1:h github.com/cockroachdb/errors v1.2.4/go.mod h1:rQD95gz6FARkaKkQXUksEje/d9a6wBJoCr5oaCLELYA= github.com/cockroachdb/logtags v0.0.0-20190617123548-eb05cc24525f/go.mod h1:i/u985jwjWRlyHXQbwatDASoW0RMlZ/3i9yJHE2xLkI= github.com/codahale/hdrhistogram v0.0.0-20161010025455-3a0bb77429bd/go.mod h1:sE/e/2PUdi/liOCUjSTXgM1o87ZssimdTWN964YiIeI= -github.com/confluentinc/confluent-kafka-go v1.6.1 h1:YxM/UtMQ2vgJX2gIgeJFUD0ANQYTEvfo4Cs4qKUlmGE= -github.com/confluentinc/confluent-kafka-go v1.6.1/go.mod h1:u2zNLny2xq+5rWeTQjFHbDzzNuba4P1vo31r9r4uAdg= github.com/containerd/aufs v0.0.0-20200908144142-dab0cbea06f4/go.mod h1:nukgQABAEopAHvB6j7cnP5zJ+/3aVcE7hCYqvIwAHyE= github.com/containerd/aufs v0.0.0-20201003224125-76a6863f2989/go.mod h1:AkGGQs9NM2vtYHaUen+NljV0/baGCAPELGm2q9ZXpWU= github.com/containerd/aufs v0.0.0-20210316121734-20793ff83c97/go.mod h1:kL5kd6KM5TzQjR79jljyi4olc1Vrx6XBlcyj3gNv2PU= @@ -556,7 +550,6 @@ github.com/go-openapi/validate v0.20.1/go.mod h1:b60iJT+xNNLfaQJUqLI7946tYiFEOuE github.com/go-openapi/validate v0.20.3 h1:GZPPhhKSZrE8HjB4eEkoYAZmoWA4+tCemSgINH1/vKw= github.com/go-openapi/validate v0.20.3/go.mod h1:goDdqVGiigM3jChcrYJxD2joalke3ZXeftD16byIjA4= github.com/go-sql-driver/mysql v1.4.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w= -github.com/go-sql-driver/mysql v1.5.0 h1:ozyZYNQW3x3HtqT1jira07DN2PArx2v7/mN66gGcHOs= github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg= github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY= github.com/go-stack/stack v1.8.1 h1:ntEHSVwIt7PNXNpgPmVfMrNhLtgjlmnZha2kOpuRiDw= @@ -1120,8 +1113,6 @@ github.com/prometheus/procfs v0.7.3 h1:4jVXhlkAyzOScmCkXBTOLRLTz8EeU+eyjrwB/EPq0 github.com/prometheus/procfs v0.7.3/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA= github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU= github.com/rcrowley/go-metrics v0.0.0-20181016184325-3113b8401b8a/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4= -github.com/robfig/cron v1.2.0 h1:ZjScXvvxeQ63Dbyxy76Fj3AT3Ut0aKsyd2/tl3DTMuQ= -github.com/robfig/cron v1.2.0/go.mod h1:JGuDeoQd7Z6yL4zQhZ3OPEVHB7fL6Ka6skscFHfmt2k= github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg= github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ= github.com/rogpeppe/go-internal v1.1.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4= @@ -1929,7 +1920,6 @@ gopkg.in/ini.v1 v1.62.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k= gopkg.in/ini.v1 v1.63.2/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k= gopkg.in/ini.v1 v1.64.0 h1:Mj2zXEXcNb5joEiSA0zc3HZpTst/iyjNiR4CN8tDzOg= gopkg.in/ini.v1 v1.64.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k= -gopkg.in/natefinch/lumberjack.v2 v2.0.0 h1:1Lc07Kr7qY4U2YPouBjpCLxpiyxIVoxqXgkXLknAOE8= gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k= gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo= gopkg.in/square/go-jose.v2 v2.2.2/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI= diff --git a/insight/insight.go b/insight/insight.go index 870c3a9c..93a6ab8c 100644 --- a/insight/insight.go +++ b/insight/insight.go @@ -11,7 +11,7 @@ import ( "log" "os" - opb "github.com/accuknox/auto-policy-discovery/src/protobuf/v1/observability" + ipb "github.com/accuknox/auto-policy-discovery/src/protobuf/v1/insight" "google.golang.org/grpc" ) @@ -23,6 +23,9 @@ type Options struct { Clustername string Fromsource string Namespace string + Source string + Type string + Rule string } // Get insights on observability data @@ -41,13 +44,16 @@ func StartInsight(o Options) error { fmt.Println("gRPC server: " + gRPC) - data := &opb.Data{ + data := &ipb.Request{ Request: "observe", + Source: o.Source, Labels: o.Labels, ContainerName: o.Containername, ClusterName: o.Clustername, FromSource: o.Fromsource, Namespace: o.Namespace, + Type: o.Type, + Rule: o.Rule, } // create a client @@ -57,10 +63,10 @@ func StartInsight(o Options) error { } defer conn.Close() - client := opb.NewObservabilityClient(conn) + client := ipb.NewInsightClient(conn) // var response opb.Response - response, err := client.SysObservabilityData(context.Background(), data) + response, err := client.GetInsightData(context.Background(), data) if err != nil { return errors.New("could not connect to the server. Possible troubleshooting:\n- Check if discovery engine is running\n- Create a portforward to discovery engine service using\n\t\033[1mkubectl port-forward -n explorer service/knoxautopolicy --address 0.0.0.0 --address :: 9089:9089\033[0m\n- Configure grpc server information using\n\t\033[1mkarmor log --grpc \033[0m") } From 5e6adc20f2eaa51faf0064b57a4fbbc89781fd15 Mon Sep 17 00:00:00 2001 From: Eswar Rajan Subramanian Date: Tue, 19 Apr 2022 18:30:21 +0530 Subject: [PATCH 2/3] Added support for discovery-engine insight data Signed-off-by: Eswar Rajan Subramanian --- cmd/insight.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cmd/insight.go b/cmd/insight.go index 066ec7ee..46f5b8d4 100644 --- a/cmd/insight.go +++ b/cmd/insight.go @@ -27,7 +27,7 @@ func init() { rootCmd.AddCommand(insightCmd) insightCmd.Flags().StringVar(&insightOptions.GRPC, "gRPC", "", "gRPC server information") - insightCmd.Flags().StringVar(&insightOptions.Source, "source", "all", "The DB for insight : system|network") + insightCmd.Flags().StringVar(&insightOptions.Source, "source", "all", "The DB for insight : system|network|all") insightCmd.Flags().StringVar(&insightOptions.Labels, "labels", "", "Labels for resources") insightCmd.Flags().StringVar(&insightOptions.Containername, "containername", "", "Filter according to the Container name") insightCmd.Flags().StringVar(&insightOptions.Clustername, "clustername", "", "Filter according to the Cluster name") From 710baab7119524e4f0895cb35cf66020ac70935c Mon Sep 17 00:00:00 2001 From: Eswar Rajan Subramanian Date: Tue, 19 Apr 2022 21:09:23 +0530 Subject: [PATCH 3/3] Command output updated to match the latest Signed-off-by: Eswar Rajan Subramanian --- README.md | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index b114296b..ea39fdc9 100644 --- a/README.md +++ b/README.md @@ -35,23 +35,25 @@ make install ``` CLI Utility to help manage KubeArmor +KubeArmor is a container-aware runtime security enforcement system that +restricts the behavior (such as process execution, file access, and networking +operation) of containers at the system level. + Usage: karmor [command] Available Commands: - completion generate the autocompletion script for the specified shell + completion Generate the autocompletion script for the specified shell + discover Discover applicable policies get Display specified resources help Help about any command + insight Policy insight from discovery engine install Install KubeArmor in a Kubernetes Cluster log Observe Logs from KubeArmor sysdump Collect system dump information for troubleshooting and error report uninstall Uninstall KubeArmor from a Kubernetes Cluster version Display version information - vm VM commands - -Available VM SubCommands: - getscript download vm installation script for nonk8s control plane - policy policy handling for vm nonk8s control plane + vm VM commands for kvmservice Flags: -h, --help help for karmor