Merge pull request #35 from sysdiglabs/kh_psp_with_role_and_rolebindings

Kh psp with role and rolebindings

Author: Kaizhe

advisor/advisor.go

@@ -5,6 +5,8 @@ import (
 	"fmt"
 	"os"
 
+	"github.com/sysdiglabs/kube-psp-advisor/advisor/types"
+
 	"github.com/sysdiglabs/kube-psp-advisor/advisor/processor"
 	"github.com/sysdiglabs/kube-psp-advisor/advisor/report"
 
@@ -19,6 +21,8 @@ type Advisor struct {
 	k8sClient         *kubernetes.Clientset
 	processor         *processor.Processor
 	report            *report.Report
+	grants            []types.PSPGrant
+	grantWarnings     string
 }
 
 // Create an podSecurityPolicy advisor instance
@@ -33,6 +37,7 @@ func NewAdvisor(kubeconfig string) (*Advisor, error) {
 		podSecurityPolicy: nil,
 		processor:         p,
 		report:            nil,
+		grants:            []types.PSPGrant{},
 	}, nil
 }
 
@@ -49,6 +54,8 @@ func (advisor *Advisor) Process(namespace string) error {
 
 	advisor.report = advisor.processor.GenerateReport(cssList, pssList)
 
+	advisor.grants, advisor.grantWarnings = advisor.processor.GeneratePSPGrant(cssList, pssList)
+
 	return nil
 }
 
@@ -72,3 +79,41 @@ func (advisor *Advisor) PrintPodSecurityPolicy() error {
 func (advisor *Advisor) GetPodSecurityPolicy() *v1beta1.PodSecurityPolicy {
 	return advisor.podSecurityPolicy
 }
+
+func (advisor *Advisor) PrintPodSecurityPolicyWithGrants() error {
+	var err error
+	e := k8sJSON.NewYAMLSerializer(k8sJSON.DefaultMetaFactory, nil, nil)
+
+	if advisor.grantWarnings != "" {
+		fmt.Println(advisor.grantWarnings)
+		printYamlSeparator()
+	}
+
+	for _, pspGrant := range advisor.grants {
+		fmt.Println(pspGrant.Comment)
+
+		if err = e.Encode(pspGrant.PodSecurityPolicy, os.Stdout); err != nil {
+			return err
+		}
+
+		printYamlSeparator()
+
+		if err = e.Encode(pspGrant.Role, os.Stdout); err != nil {
+			return err
+		}
+
+		printYamlSeparator()
+
+		if err = e.Encode(pspGrant.RoleBinding, os.Stdout); err != nil {
+			return err
+		}
+
+		printYamlSeparator()
+	}
+
+	return nil
+}
+
+func printYamlSeparator() {
+	fmt.Println("---")
+}

advisor/processor/generate.go

@@ -2,6 +2,7 @@ package processor
 
 import (
 	"fmt"
+	"sort"
 
 	"github.com/sysdiglabs/kube-psp-advisor/advisor/report"
 	"github.com/sysdiglabs/kube-psp-advisor/advisor/types"
@@ -55,12 +56,60 @@ func (p *Processor) SetNamespace(ns string) {
 	p.namespace = ns
 }
 
-// GeneratePSP generate Pod Security Policy
+// GeneratePSP generates Pod Security Policy
 func (p *Processor) GeneratePSP(cssList []types.ContainerSecuritySpec, pssList []types.PodSecuritySpec) *v1beta1.PodSecurityPolicy {
-
 	return p.gen.GeneratePSP(cssList, pssList, p.namespace, p.serverGitVersion)
 }
 
+// GeneratePSPGrant generates Pod Security Policies, Roles, RoleBindings for service accounts to use PSP
+func (p *Processor) GeneratePSPGrant(cssList []types.ContainerSecuritySpec, pssList []types.PodSecuritySpec) ([]types.PSPGrant, string) {
+	saSecuritySpecMap := map[string]*types.SASecuritySpec{}
+	pspGrantList := []types.PSPGrant{}
+	grantWarnings := ""
+
+	for _, css := range cssList {
+		key := fmt.Sprintf("%s:%s", css.Namespace, css.ServiceAccount)
+		if _, exists := saSecuritySpecMap[key]; !exists {
+			saSecuritySpecMap[key] = types.NewSASecuritySpec(css.Namespace, css.ServiceAccount)
+		}
+		saSecuritySpecMap[key].AddContainerSecuritySpec(css)
+	}
+
+	for _, pss := range pssList {
+		key := fmt.Sprintf("%s:%s", pss.Namespace, pss.ServiceAccount)
+		if _, exists := saSecuritySpecMap[key]; !exists {
+			saSecuritySpecMap[key] = types.NewSASecuritySpec(pss.Namespace, pss.ServiceAccount)
+		}
+		saSecuritySpecMap[key].AddPodSecuritySpec(pss)
+	}
+
+	saSecuritySpecList := types.SASecuritySpecList{}
+
+	// convert saSecuritySpecMap into list and then sort
+	for _, saSecuritySpec := range saSecuritySpecMap {
+		saSecuritySpecList = append(saSecuritySpecList, saSecuritySpec)
+	}
+
+	sort.Sort(saSecuritySpecList)
+
+	for _, s := range saSecuritySpecList {
+		if !s.IsDefaultServiceAccount() {
+			pspGrant := types.PSPGrant{
+				Comment:           s.GenerateComment(),
+				Role:              s.GenerateRole(),
+				RoleBinding:       s.GenerateRoleBinding(),
+				PodSecurityPolicy: p.gen.GeneratePSPWithName(s.ContainerSecuritySpecList, s.PodSecuritySpecList, s.Namespace, p.serverGitVersion, s.GeneratePSPName()),
+			}
+
+			pspGrantList = append(pspGrantList, pspGrant)
+		} else {
+			grantWarnings += s.GenerateComment()
+		}
+	}
+
+	return pspGrantList, grantWarnings
+}
+
 // GenerateReport generate a JSON report
 func (p *Processor) GenerateReport(cssList []types.ContainerSecuritySpec, pssList []types.PodSecuritySpec) *report.Report {
 	r := report.NewReport()

advisor/processor/get.go

@@ -1,10 +1,12 @@
 package processor
 
 import (
+	"fmt"
+
 	"github.com/sysdiglabs/kube-psp-advisor/advisor/types"
 
 	"k8s.io/api/core/v1"
-	v12 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	v1meta "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
 const (
@@ -23,14 +25,15 @@ func (p *Processor) getSecuritySpecFromDaemonSets() ([]types.ContainerSecuritySp
 	cspList := []types.ContainerSecuritySpec{}
 	pspList := []types.PodSecuritySpec{}
 
-	daemonSetList, err := clientset.AppsV1().DaemonSets(p.namespace).List(v12.ListOptions{})
+	daemonSetList, err := clientset.AppsV1().DaemonSets(p.namespace).List(v1meta.ListOptions{})
 
 	if err != nil {
 		return cspList, pspList, err
 	}
 
 	for _, ds := range daemonSetList.Items {
-		sa := p.serviceAccountMap[ds.Spec.Template.Spec.ServiceAccountName]
+		sa := p.GetServiceAccount(ds.Namespace, ds.Spec.Template.Spec.ServiceAccountName)
+
 		cspList2, podSecurityPosture := p.gen.GetSecuritySpecFromPodSpec(types.Metadata{
 			Name: ds.Name,
 			Kind: DaemonSet,
@@ -48,7 +51,7 @@ func (p *Processor) getSecuritySpecFromReplicaSets() ([]types.ContainerSecurityS
 	cssList := []types.ContainerSecuritySpec{}
 	pssList := []types.PodSecuritySpec{}
 
-	replicaSetList, err := clientset.AppsV1().ReplicaSets(p.namespace).List(v12.ListOptions{})
+	replicaSetList, err := clientset.AppsV1().ReplicaSets(p.namespace).List(v1meta.ListOptions{})
 
 	if err != nil {
 		return cssList, pssList, err
@@ -59,7 +62,7 @@ func (p *Processor) getSecuritySpecFromReplicaSets() ([]types.ContainerSecurityS
 			continue
 		}
 
-		sa := p.serviceAccountMap[rs.Spec.Template.Spec.ServiceAccountName]
+		sa := p.GetServiceAccount(rs.Namespace, rs.Spec.Template.Spec.ServiceAccountName)
 		cspList2, psc := p.gen.GetSecuritySpecFromPodSpec(types.Metadata{
 			Name: rs.Name,
 			Kind: ReplicaSet,
@@ -77,14 +80,14 @@ func (p *Processor) getSecuritySpecFromStatefulSets() ([]types.ContainerSecurity
 	cssList := []types.ContainerSecuritySpec{}
 	pssList := []types.PodSecuritySpec{}
 
-	statefulSetList, err := clientset.AppsV1().StatefulSets(p.namespace).List(v12.ListOptions{})
+	statefulSetList, err := clientset.AppsV1().StatefulSets(p.namespace).List(v1meta.ListOptions{})
 
 	if err != nil {
 		return cssList, pssList, err
 	}
 
 	for _, sts := range statefulSetList.Items {
-		sa := p.serviceAccountMap[sts.Spec.Template.Spec.ServiceAccountName]
+		sa := p.GetServiceAccount(sts.Namespace, sts.Spec.Template.Spec.ServiceAccountName)
 		cspList2, pss := p.gen.GetSecuritySpecFromPodSpec(types.Metadata{
 			Name: sts.Name,
 			Kind: StatefulSet,
@@ -102,14 +105,14 @@ func (p *Processor) getSecuritySpecFromReplicationController() ([]types.Containe
 	cssList := []types.ContainerSecuritySpec{}
 	pssList := []types.PodSecuritySpec{}
 
-	replicationControllerList, err := clientset.CoreV1().ReplicationControllers(p.namespace).List(v12.ListOptions{})
+	replicationControllerList, err := clientset.CoreV1().ReplicationControllers(p.namespace).List(v1meta.ListOptions{})
 
 	if err != nil {
 		return cssList, pssList, err
 	}
 
 	for _, rc := range replicationControllerList.Items {
-		sa := p.serviceAccountMap[rc.Spec.Template.Spec.ServiceAccountName]
+		sa := p.GetServiceAccount(rc.Namespace, rc.Spec.Template.Spec.ServiceAccountName)
 		cspList2, pss := p.gen.GetSecuritySpecFromPodSpec(types.Metadata{
 			Name: rc.Name,
 			Kind: ReplicationController,
@@ -127,14 +130,14 @@ func (p *Processor) getSecuritySpecFromCronJobs() ([]types.ContainerSecuritySpec
 	cssList := []types.ContainerSecuritySpec{}
 	pssList := []types.PodSecuritySpec{}
 
-	jobList, err := clientset.BatchV1beta1().CronJobs(p.namespace).List(v12.ListOptions{})
+	jobList, err := clientset.BatchV1beta1().CronJobs(p.namespace).List(v1meta.ListOptions{})
 
 	if err != nil {
 		return cssList, pssList, err
 	}
 
 	for _, cronJob := range jobList.Items {
-		sa := p.serviceAccountMap[cronJob.Spec.JobTemplate.Spec.Template.Spec.ServiceAccountName]
+		sa := p.GetServiceAccount(cronJob.Namespace, cronJob.Spec.JobTemplate.Spec.Template.Spec.ServiceAccountName)
 		cspList2, pss := p.gen.GetSecuritySpecFromPodSpec(types.Metadata{
 			Name: cronJob.Name,
 			Kind: CronJob,
@@ -152,7 +155,7 @@ func (p *Processor) getSecuritySpecFromJobs() ([]types.ContainerSecuritySpec, []
 	cssList := []types.ContainerSecuritySpec{}
 	pssList := []types.PodSecuritySpec{}
 
-	jobList, err := clientset.BatchV1().Jobs(p.namespace).List(v12.ListOptions{})
+	jobList, err := clientset.BatchV1().Jobs(p.namespace).List(v1meta.ListOptions{})
 
 	if err != nil {
 		return cssList, pssList, err
@@ -162,7 +165,7 @@ func (p *Processor) getSecuritySpecFromJobs() ([]types.ContainerSecuritySpec, []
 		if len(job.OwnerReferences) > 0 {
 			continue
 		}
-		sa := p.serviceAccountMap[job.Spec.Template.Spec.ServiceAccountName]
+		sa := p.GetServiceAccount(job.Namespace, job.Spec.Template.Spec.ServiceAccountName)
 		cspList2, pss := p.gen.GetSecuritySpecFromPodSpec(types.Metadata{
 			Name: job.Name,
 			Kind: Job,
@@ -180,14 +183,14 @@ func (p *Processor) getSecuritySpecFromDeployments() ([]types.ContainerSecurityS
 	cssList := []types.ContainerSecuritySpec{}
 	pssList := []types.PodSecuritySpec{}
 
-	deployments, err := clientset.AppsV1().Deployments(p.namespace).List(v12.ListOptions{})
+	deployments, err := clientset.AppsV1().Deployments(p.namespace).List(v1meta.ListOptions{})
 
 	if err != nil {
 		return cssList, pssList, err
 	}
 
 	for _, deploy := range deployments.Items {
-		sa := p.serviceAccountMap[deploy.Spec.Template.Spec.ServiceAccountName]
+		sa := p.GetServiceAccount(deploy.Namespace, deploy.Spec.Template.Spec.ServiceAccountName)
 		cspList2, pss := p.gen.GetSecuritySpecFromPodSpec(types.Metadata{
 			Name: deploy.Name,
 			Kind: Deployment,
@@ -205,7 +208,7 @@ func (p *Processor) getSecuritySpecFromPods() ([]types.ContainerSecuritySpec, []
 	cssList := []types.ContainerSecuritySpec{}
 	pssList := []types.PodSecuritySpec{}
 
-	pods, err := clientset.CoreV1().Pods(p.namespace).List(v12.ListOptions{})
+	pods, err := clientset.CoreV1().Pods(p.namespace).List(v1meta.ListOptions{})
 
 	if err != nil {
 		return cssList, pssList, err
@@ -216,7 +219,7 @@ func (p *Processor) getSecuritySpecFromPods() ([]types.ContainerSecuritySpec, []
 			continue
 		}
 
-		sa := p.serviceAccountMap[pod.Spec.ServiceAccountName]
+		sa := p.GetServiceAccount(pod.Namespace, pod.Spec.ServiceAccountName)
 		cspList2, podSecurityPosture := p.gen.GetSecuritySpecFromPodSpec(types.Metadata{
 			Name: pod.Name,
 			Kind: Pod,
@@ -232,14 +235,32 @@ func (p *Processor) getSecuritySpecFromPods() ([]types.ContainerSecuritySpec, []
 func (p *Processor) getServiceAccountMap() (map[string]v1.ServiceAccount, error) {
 	serviceAccountMap := map[string]v1.ServiceAccount{}
 
-	serviceAccounts, err := p.k8sClient.CoreV1().ServiceAccounts(p.namespace).List(v12.ListOptions{})
+	serviceAccounts, err := p.k8sClient.CoreV1().ServiceAccounts(p.namespace).List(v1meta.ListOptions{})
 	if err != nil {
 		return serviceAccountMap, err
 	}
 
+	// service account is an namespaced object
 	for _, sa := range serviceAccounts.Items {
-		serviceAccountMap[sa.Name] = sa
+		key := fmt.Sprintf("%s:%s", sa.Namespace, sa.Name)
+		serviceAccountMap[key] = sa
 	}
 
 	return serviceAccountMap, nil
 }
+
+func (p *Processor) GetServiceAccount(ns, saName string) v1.ServiceAccount {
+	if saName == "" {
+		saName = "default"
+	}
+
+	key := fmt.Sprintf("%s:%s", ns, saName)
+
+	sa, exists := p.serviceAccountMap[key]
+
+	if !exists {
+		return v1.ServiceAccount{}
+	}
+
+	return sa
+}