Skip to content

Commit 066863f

Browse files
avrahamsavrahams
authored
Merge pull request kubescape#101 from kubescape/ignore_resourceID
Exception by resource id
2 parents abdda05 + 73510da commit 066863f

File tree

5 files changed

+65
-5
lines changed

5 files changed

+65
-5
lines changed

‎exceptions/comparator.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,10 @@ func (c *comparator) compareName(workload workloadinterface.IMetadata, name stri
4040
return c.regexCompare(name, workload.GetName())
4141
}
4242

43+
func (c *comparator) compareResourceID(workload workloadinterface.IMetadata, resourceID string) bool {
44+
return c.regexCompare(resourceID, workload.GetID())
45+
}
46+
4347
func (c *comparator) comparePath(workload workloadinterface.IMetadata, path string) bool {
4448
w := workload.GetObject()
4549
if !k8sinterface.IsTypeWorkload(w) {

‎exceptions/exceptionprocessor.go‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -163,7 +163,7 @@ func (p *Processor) hasException(clusterName string, designator *armotypes.Porta
163163
p.designatorCache.Set(designator, attributes)
164164
}
165165

166-
if attributes.GetCluster() == "" && attributes.GetNamespace() == "" && attributes.GetKind() == "" && attributes.GetName() == "" && attributes.GetPath() == "" && len(attributes.GetLabels()) == 0 {
166+
if attributes.GetCluster() == "" && attributes.GetNamespace() == "" && attributes.GetKind() == "" && attributes.GetName() == "" && attributes.GetResourceID() == "" && attributes.GetPath() == "" && len(attributes.GetLabels()) == 0 {
167167
return false // if designators are empty
168168
}
169169

@@ -183,6 +183,10 @@ func (p *Processor) hasException(clusterName string, designator *armotypes.Porta
183183
return false // names do not match
184184
}
185185

186+
if attributes.GetResourceID() != "" && !p.compareResourceID(workload, attributes.GetResourceID()) {
187+
return false // names do not match
188+
}
189+
186190
if attributes.GetPath() != "" && !p.comparePath(workload, attributes.GetPath()) {
187191
return false // paths do not match
188192
}

‎exceptions/exceptionprocessor_test.go‎

Lines changed: 50 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,30 @@ func postureLabelsRegexExceptionPolicyAlertOnlyMock() *armotypes.PostureExceptio
6363
}
6464
}
6565

66+
func postureResourceIDExceptionPolicyMock(resourceID string) *armotypes.PostureExceptionPolicy {
67+
return &armotypes.PostureExceptionPolicy{
68+
PortalBase: armotypes.PortalBase{
69+
Name: "postureResourceIDExceptionPolicyMock",
70+
},
71+
PolicyType: "postureExceptionPolicy",
72+
Actions: []armotypes.PostureExceptionPolicyActions{armotypes.AlertOnly},
73+
Resources: []armotypes.PortalDesignator{
74+
{
75+
DesignatorType: armotypes.DesignatorAttributes,
76+
Attributes: map[string]string{
77+
armotypes.AttributeCluster: "test",
78+
armotypes.AttributeResourceID: resourceID,
79+
},
80+
},
81+
},
82+
PosturePolicies: []armotypes.PosturePolicy{
83+
{
84+
FrameworkName: "MIT.*",
85+
},
86+
},
87+
}
88+
}
89+
6690
func emptyPostureExceptionPolicyAlertOnlyMock() *armotypes.PostureExceptionPolicy {
6791
return &armotypes.PostureExceptionPolicy{
6892
PortalBase: armotypes.PortalBase{
@@ -153,6 +177,13 @@ func TestGetResourceExceptions(t *testing.T) {
153177
withAnnotationObj, err := workloadinterface.NewBaseObjBytes([]byte(`{"apiVersion": "v1", "kind":"Deployment", "metadata": {"name": "test", "annotations": {"myLabelOrAnnotation" : "static_test"}}}`))
154178
require.NoError(t, err)
155179

180+
idObj, err := workloadinterface.NewBaseObjBytes([]byte(`{"apiVersion": "v1/core", "kind":"Deployment", "metadata": {"name": "test", "namespace": "default"}}`))
181+
require.NoError(t, err)
182+
183+
exceptionPolicyResourceID := postureResourceIDExceptionPolicyMock(idObj.GetID())
184+
exceptionPolicyResourceIDRegex := postureResourceIDExceptionPolicyMock("*")
185+
exceptionPolicyResourceOtherID := postureResourceIDExceptionPolicyMock("v1/core/default/ConfigMap/test")
186+
156187
exceptionPolicy := postureLabelsRegexExceptionPolicyAlertOnlyMock()
157188
exceptionPolicyRegex := postureLabelsRegexExceptionPolicyAlertOnlyMock()
158189
exceptionPolicyRegex.Resources[0].Attributes["myLabelOrAnnotation"] = "static_.*"
@@ -201,14 +232,32 @@ func TestGetResourceExceptions(t *testing.T) {
201232
workloadObj: withAnnotationObj,
202233
expectedExceptionsCount: 1,
203234
},
235+
{
236+
desc: "exception by ID",
237+
exceptionPolicy: exceptionPolicyResourceID,
238+
workloadObj: idObj,
239+
expectedExceptionsCount: 1,
240+
},
241+
{
242+
desc: "exception by ID regex",
243+
exceptionPolicy: exceptionPolicyResourceIDRegex,
244+
workloadObj: idObj,
245+
expectedExceptionsCount: 1,
246+
},
247+
{
248+
desc: "exception with not matching ID",
249+
exceptionPolicy: exceptionPolicyResourceOtherID,
250+
workloadObj: idObj,
251+
expectedExceptionsCount: 0,
252+
},
204253
}
205254

206255
for _, test := range testCases {
207256
test := test
208257
t.Run(test.desc, func(t *testing.T) {
209258
t.Parallel()
210259

211-
res := p.GetResourceExceptions([]armotypes.PostureExceptionPolicy{*exceptionPolicy}, test.workloadObj, "")
260+
res := p.GetResourceExceptions([]armotypes.PostureExceptionPolicy{*test.exceptionPolicy}, test.workloadObj, "test")
212261
assert.Equal(t, test.expectedExceptionsCount, len(res))
213262
})
214263
}

‎go.mod‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ module github.com/kubescape/opa-utils
33
go 1.19
44

55
require (
6-
github.com/armosec/armoapi-go v0.0.151
6+
github.com/armosec/armoapi-go v0.0.173
77
github.com/armosec/utils-go v0.0.12
88
github.com/francoispqt/gojay v1.2.13
99
github.com/kubescape/k8s-interface v0.0.99
@@ -92,6 +92,7 @@ require (
9292
github.com/pquerna/cachecontrol v0.1.0 // indirect
9393
github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0 // indirect
9494
github.com/spf13/pflag v1.0.5 // indirect
95+
github.com/stripe/stripe-go/v74 v74.8.0 // indirect
9596
github.com/vektah/gqlparser/v2 v2.4.5 // indirect
9697
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
9798
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect

‎go.sum‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -164,8 +164,8 @@ github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hC
164164
github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
165165
github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
166166
github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
167-
github.com/armosec/armoapi-go v0.0.151 h1:vyoQVk1y8cb4DHlfRKyFqDtiB1G13w4o5aoG8+YUMq0=
168-
github.com/armosec/armoapi-go v0.0.151/go.mod h1:5MQAHYUFm1JrTSgb4+EglR5vNsrqUD0krh/5xWm2RdI=
167+
github.com/armosec/armoapi-go v0.0.173 h1:TwNxmTxx9ATJPZBlld/53s/WvSVUfoF4gxgHT6UbFng=
168+
github.com/armosec/armoapi-go v0.0.173/go.mod h1:xlW8dGq0vVzbuk+kDZqMQIkfU9P/iiiiDavoCIboqgI=
169169
github.com/armosec/utils-go v0.0.12 h1:NXkG/BhbSVAmTVXr0qqsK02CmxEiXuJyPmdTRcZ4jAo=
170170
github.com/armosec/utils-go v0.0.12/go.mod h1:F/K1mI/qcj7fNuJl7xktoCeHM83azOF0Zq6eC2WuPyU=
171171
github.com/armosec/utils-k8s-go v0.0.12 h1:u7kHSUp4PpvPP3hEaRXMbM0Vw23IyLhAzzE+2TW6Jkk=
@@ -1088,6 +1088,8 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
10881088
github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
10891089
github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
10901090
github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
1091+
github.com/stripe/stripe-go/v74 v74.8.0 h1:0+3EfQSBhMg8SQ1+w+AP6Gxyko2crWbUG2uXbzYs8SU=
1092+
github.com/stripe/stripe-go/v74 v74.8.0/go.mod h1:5PoXNp30AJ3tGq57ZcFuaMylzNi8KpwlrYAFmO1fHZw=
10911093
github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
10921094
github.com/syndtr/gocapability v0.0.0-20170704070218-db04d3cc01c8/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
10931095
github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=

0 commit comments

Comments
 (0)