feat: extract and send workload pod spec

pod spec object contains valuable information about pod's security configuration. such attributes may be the containers,  hostNetwork, serviceAccountName, securityContext and more.
by sending the whole spec to homebase, it would be easier to release new features based on that information without relying on kubernetes-monitor's version.

Author: talik077

src/kube-scanner/metadata-extractor.ts

@@ -13,11 +13,11 @@ export function buildImageMetadata(
   workloadMeta: KubeObjectMetadata,
   containerStatuses: V1ContainerStatus[],
   ): IWorkload[] {
-  const { kind, objectMeta, specMeta, containers, revision } = workloadMeta;
+  const { kind, objectMeta, specMeta, revision, podSpec } = workloadMeta;
   const { name, namespace, labels, annotations, uid } = objectMeta;
 
   const containerNameToSpec: {[key: string]: V1Container} = {};
-  for (const container of containers) {
+  for (const container of podSpec.containers) {
     containerNameToSpec[container.name] = container;
   }
 
@@ -40,6 +40,7 @@ export function buildImageMetadata(
       imageId: containerNameToStatus[containerName].imageID,
       cluster: currentClusterName,
       revision,
+      podSpec,
     } as IWorkload),
   );
   return images;
@@ -113,7 +114,7 @@ export async function buildMetadataForWorkload(pod: V1Pod): Promise<IWorkload[]
       // do not have the "template" property.
       specMeta: pod.metadata,
       ownerRefs: [],
-      containers: pod.spec.containers,
+      podSpec: pod.spec,
     },
     pod.status.containerStatuses,
     );

src/kube-scanner/types.ts

@@ -1,5 +1,5 @@
 import { AppsV1Api, BatchV1Api, BatchV1beta1Api, CoreV1Api, KubeConfig,
-  V1Container, V1ObjectMeta, V1OwnerReference } from '@kubernetes/client-node';
+  V1ObjectMeta, V1OwnerReference, V1PodSpec } from '@kubernetes/client-node';
 
 export enum WorkloadKind {
   Deployment = 'Deployment',
@@ -35,7 +35,7 @@ export interface KubeObjectMetadata {
   kind: string;
   objectMeta: V1ObjectMeta;
   specMeta: V1ObjectMeta;
-  containers: V1Container[];
+  podSpec: V1PodSpec;
   ownerRefs: V1OwnerReference[] | undefined;
   revision?: number;
 }

src/kube-scanner/watchers/handlers/cron-job.ts

@@ -16,7 +16,7 @@ export async function cronJobWatchHandler(cronJob: V1beta1CronJob) {
     kind: WorkloadKind.CronJob,
     objectMeta: cronJob.metadata,
     specMeta: cronJob.spec.jobTemplate.metadata,
-    containers: cronJob.spec.jobTemplate.spec.template.spec.containers,
     ownerRefs: cronJob.metadata.ownerReferences,
+    podSpec: cronJob.spec.jobTemplate.spec.template.spec,
   }, workloadName);
 }

src/kube-scanner/watchers/handlers/daemon-set.ts

@@ -16,8 +16,8 @@ export async function daemonSetWatchHandler(daemonSet: V1DaemonSet) {
     kind: WorkloadKind.DaemonSet,
     objectMeta: daemonSet.metadata,
     specMeta: daemonSet.spec.template.metadata,
-    containers: daemonSet.spec.template.spec.containers,
     ownerRefs: daemonSet.metadata.ownerReferences,
     revision: daemonSet.status.observedGeneration,
+    podSpec: daemonSet.spec.template.spec,
   }, workloadName);
 }

src/kube-scanner/watchers/handlers/deployment.ts

@@ -16,8 +16,8 @@ export async function deploymentWatchHandler(deployment: V1Deployment) {
     kind: WorkloadKind.Deployment,
     objectMeta: deployment.metadata,
     specMeta: deployment.spec.template.metadata,
-    containers: deployment.spec.template.spec.containers,
     ownerRefs: deployment.metadata.ownerReferences,
     revision: deployment.status.observedGeneration,
+    podSpec: deployment.spec.template.spec,
   }, workloadName);
 }

src/kube-scanner/watchers/handlers/job.ts

@@ -15,7 +15,7 @@ export async function jobWatchHandler(job: V1Job) {
     kind: WorkloadKind.Job,
     objectMeta: job.metadata,
     specMeta: job.spec.template.metadata,
-    containers: job.spec.template.spec.containers,
     ownerRefs: job.metadata.ownerReferences,
+    podSpec: job.spec.template.spec,
   }, workloadName);
 }

src/kube-scanner/watchers/handlers/replica-set.ts

@@ -16,8 +16,8 @@ export async function replicaSetWatchHandler(replicaSet: V1ReplicaSet) {
     kind: WorkloadKind.ReplicaSet,
     objectMeta: replicaSet.metadata,
     specMeta: replicaSet.spec.template.metadata,
-    containers: replicaSet.spec.template.spec.containers,
     ownerRefs: replicaSet.metadata.ownerReferences,
     revision: replicaSet.status.observedGeneration,
+    podSpec: replicaSet.spec.template.spec,
   }, workloadName);
 }

src/kube-scanner/watchers/handlers/replication-controller.ts

@@ -17,8 +17,8 @@ export async function replicationControllerWatchHandler(replicationController: V
     kind: WorkloadKind.ReplicationController,
     objectMeta: replicationController.metadata,
     specMeta: replicationController.spec.template.metadata,
-    containers: replicationController.spec.template.spec.containers,
     ownerRefs: replicationController.metadata.ownerReferences,
     revision: replicationController.status.observedGeneration,
+    podSpec: replicationController.spec.template.spec,
   }, workloadName);
 }

src/kube-scanner/watchers/handlers/stateful-set.ts

@@ -16,8 +16,8 @@ export async function statefulSetWatchHandler(statefulSet: V1StatefulSet) {
     kind: WorkloadKind.StatefulSet,
     objectMeta: statefulSet.metadata,
     specMeta: statefulSet.spec.template.metadata,
-    containers: statefulSet.spec.template.spec.containers,
     ownerRefs: statefulSet.metadata.ownerReferences,
     revision: statefulSet.status.observedGeneration,
+    podSpec: statefulSet.spec.template.spec,
   }, workloadName);
 }

src/kube-scanner/workload-reader.ts

@@ -22,9 +22,9 @@ const deploymentReader: IWorkloadReaderFunc = async (workloadName, namespace) =>
     kind: WorkloadKind.Deployment,
     objectMeta: deployment.metadata,
     specMeta: deployment.spec.template.metadata,
-    containers: deployment.spec.template.spec.containers,
     ownerRefs: deployment.metadata.ownerReferences,
     revision: deployment.status.observedGeneration,
+    podSpec: deployment.spec.template.spec,
   };
 };
 
@@ -43,9 +43,9 @@ const replicaSetReader: IWorkloadReaderFunc = async (workloadName, namespace) =>
     kind: WorkloadKind.ReplicaSet,
     objectMeta: replicaSet.metadata,
     specMeta: replicaSet.spec.template.metadata,
-    containers: replicaSet.spec.template.spec.containers,
     ownerRefs: replicaSet.metadata.ownerReferences,
     revision: replicaSet.status.observedGeneration,
+    podSpec: replicaSet.spec.template.spec,
   };
 };
 
@@ -64,9 +64,9 @@ const statefulSetReader: IWorkloadReaderFunc = async (workloadName, namespace) =
     kind: WorkloadKind.StatefulSet,
     objectMeta: statefulSet.metadata,
     specMeta: statefulSet.spec.template.metadata,
-    containers: statefulSet.spec.template.spec.containers,
     ownerRefs: statefulSet.metadata.ownerReferences,
     revision: statefulSet.status.observedGeneration,
+    podSpec: statefulSet.spec.template.spec,
   };
 };
 
@@ -85,9 +85,9 @@ const daemonSetReader: IWorkloadReaderFunc = async (workloadName, namespace) =>
     kind: WorkloadKind.DaemonSet,
     objectMeta: daemonSet.metadata,
     specMeta: daemonSet.spec.template.metadata,
-    containers: daemonSet.spec.template.spec.containers,
     ownerRefs: daemonSet.metadata.ownerReferences,
     revision: daemonSet.status.observedGeneration,
+    podSpec: daemonSet.spec.template.spec,
   };
 };
 
@@ -105,8 +105,8 @@ const jobReader: IWorkloadReaderFunc = async (workloadName, namespace) => {
     kind: WorkloadKind.Job,
     objectMeta: job.metadata,
     specMeta: job.spec.template.metadata,
-    containers: job.spec.template.spec.containers,
     ownerRefs: job.metadata.ownerReferences,
+    podSpec: job.spec.template.spec,
   };
 };
 
@@ -128,8 +128,8 @@ const cronJobReader: IWorkloadReaderFunc = async (workloadName, namespace) => {
     kind: WorkloadKind.CronJob,
     objectMeta: cronJob.metadata,
     specMeta: cronJob.spec.jobTemplate.metadata,
-    containers: cronJob.spec.jobTemplate.spec.template.spec.containers,
     ownerRefs: cronJob.metadata.ownerReferences,
+    podSpec: cronJob.spec.jobTemplate.spec.template.spec,
   };
 };
 
@@ -149,9 +149,9 @@ const replicationControllerReader: IWorkloadReaderFunc = async (workloadName, na
     kind: WorkloadKind.ReplicationController,
     objectMeta: replicationController.metadata,
     specMeta: replicationController.spec.template.metadata,
-    containers: replicationController.spec.template.spec.containers,
     ownerRefs: replicationController.metadata.ownerReferences,
     revision: replicationController.status.observedGeneration,
+    podSpec: replicationController.spec.template.spec,
   };
 };