2017-05-26 09:25:29 +00:00
|
|
|
// Copyright © 2017 Aqua Security Software Ltd. <info@aquasec.com>
|
|
|
|
//
|
|
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
// you may not use this file except in compliance with the License.
|
|
|
|
// You may obtain a copy of the License at
|
|
|
|
//
|
|
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
//
|
|
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
// See the License for the specific language governing permissions and
|
|
|
|
// limitations under the License.
|
|
|
|
|
|
|
|
package cmd
|
|
|
|
|
|
|
|
import (
|
|
|
|
"fmt"
|
|
|
|
"io/ioutil"
|
|
|
|
"strings"
|
|
|
|
|
2017-06-20 08:38:15 +00:00
|
|
|
"github.com/aquasecurity/kube-bench/check"
|
2017-05-26 09:25:29 +00:00
|
|
|
"github.com/spf13/viper"
|
|
|
|
)
|
|
|
|
|
|
|
|
var (
|
2017-07-13 00:24:09 +00:00
|
|
|
apiserverBin string
|
|
|
|
apiserverConf string
|
|
|
|
schedulerBin string
|
|
|
|
schedulerConf string
|
|
|
|
controllerManagerBin string
|
|
|
|
controllerManagerConf string
|
|
|
|
config string
|
|
|
|
etcdBin string
|
|
|
|
etcdConf string
|
|
|
|
flanneldBin string
|
|
|
|
flanneldConf string
|
|
|
|
kubeletBin string
|
|
|
|
kubeletConf string
|
|
|
|
proxyBin string
|
|
|
|
proxyConf string
|
|
|
|
fedApiserverBin string
|
|
|
|
fedControllerManagerBin string
|
|
|
|
|
|
|
|
errmsgs string
|
2017-05-26 09:25:29 +00:00
|
|
|
|
|
|
|
// TODO: Consider specifying this in config file.
|
2017-07-24 17:30:13 +00:00
|
|
|
kubeVersion = "1.7.0"
|
2017-05-26 09:25:29 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
func runChecks(t check.NodeType) {
|
|
|
|
var summary check.Summary
|
|
|
|
var file string
|
|
|
|
|
2017-07-13 00:24:09 +00:00
|
|
|
// Master variables
|
|
|
|
apiserverBin = viper.GetString("installation." + installation + ".master.bin.apiserver")
|
|
|
|
apiserverConf = viper.GetString("installation." + installation + ".master.conf.apiserver")
|
|
|
|
schedulerBin = viper.GetString("installation." + installation + ".master.bin.scheduler")
|
|
|
|
schedulerConf = viper.GetString("installation." + installation + ".master.conf.scheduler")
|
|
|
|
controllerManagerBin = viper.GetString("installation." + installation + ".master.bin.controller-manager")
|
2017-07-25 00:34:07 +00:00
|
|
|
controllerManagerConf = viper.GetString("installation." + installation + ".master.conf.controller-manager")
|
2017-07-13 00:24:09 +00:00
|
|
|
config = viper.GetString("installation." + installation + ".config")
|
|
|
|
|
|
|
|
etcdBin = viper.GetString("etcd.bin")
|
|
|
|
etcdConf = viper.GetString("etcd.conf")
|
|
|
|
flanneldBin = viper.GetString("flanneld.bin")
|
|
|
|
flanneldConf = viper.GetString("flanneld.conf")
|
|
|
|
|
|
|
|
// Node variables
|
|
|
|
kubeletBin = viper.GetString("installation." + installation + ".node.bin.kubelet")
|
|
|
|
kubeletConf = viper.GetString("installation." + installation + ".node.conf.kubelet")
|
|
|
|
proxyBin = viper.GetString("installation." + installation + ".node.bin.proxy")
|
|
|
|
proxyConf = viper.GetString("installation." + installation + ".node.conf.proxy")
|
2017-07-10 00:02:39 +00:00
|
|
|
|
2017-07-13 00:24:09 +00:00
|
|
|
// Federated
|
|
|
|
fedApiserverBin = viper.GetString("installation." + installation + ".federated.bin.apiserver")
|
|
|
|
fedControllerManagerBin = viper.GetString("installation." + installation + ".federated.bin.controller-manager")
|
2017-07-10 00:02:39 +00:00
|
|
|
|
|
|
|
// Run kubernetes installation validation checks.
|
2017-07-25 00:34:07 +00:00
|
|
|
verifyNodeType(t)
|
2017-05-26 09:25:29 +00:00
|
|
|
|
|
|
|
switch t {
|
|
|
|
case check.MASTER:
|
|
|
|
file = masterFile
|
|
|
|
case check.NODE:
|
|
|
|
file = nodeFile
|
|
|
|
case check.FEDERATED:
|
|
|
|
file = federatedFile
|
|
|
|
}
|
|
|
|
|
|
|
|
in, err := ioutil.ReadFile(file)
|
|
|
|
if err != nil {
|
2017-07-25 00:34:07 +00:00
|
|
|
exitWithError(fmt.Errorf("error opening %s controls file: %v", t, err))
|
2017-05-26 09:25:29 +00:00
|
|
|
}
|
|
|
|
|
2017-07-13 00:24:09 +00:00
|
|
|
// Variable substitutions. Replace all occurrences of variables in controls files.
|
|
|
|
s := strings.Replace(string(in), "$apiserverbin", apiserverBin, -1)
|
|
|
|
s = strings.Replace(s, "$apiserverconf", apiserverConf, -1)
|
|
|
|
s = strings.Replace(s, "$schedulerbin", schedulerBin, -1)
|
|
|
|
s = strings.Replace(s, "$schedulerconf", schedulerConf, -1)
|
|
|
|
s = strings.Replace(s, "$controllermanagerbin", controllerManagerBin, -1)
|
|
|
|
s = strings.Replace(s, "$controllermanagerconf", controllerManagerConf, -1)
|
|
|
|
s = strings.Replace(s, "$config", config, -1)
|
2017-07-10 00:02:39 +00:00
|
|
|
|
2017-07-13 00:24:09 +00:00
|
|
|
s = strings.Replace(s, "$etcdbin", etcdBin, -1)
|
|
|
|
s = strings.Replace(s, "$etcdconf", etcdConf, -1)
|
|
|
|
s = strings.Replace(s, "$flanneldbin", flanneldBin, -1)
|
|
|
|
s = strings.Replace(s, "$flanneldconf", flanneldConf, -1)
|
2017-07-10 00:02:39 +00:00
|
|
|
|
2017-07-13 00:24:09 +00:00
|
|
|
s = strings.Replace(s, "$kubeletbin", kubeletBin, -1)
|
|
|
|
s = strings.Replace(s, "$kubeletconf", kubeletConf, -1)
|
|
|
|
s = strings.Replace(s, "$proxybin", proxyBin, -1)
|
|
|
|
s = strings.Replace(s, "$proxyconf", proxyConf, -1)
|
2017-07-10 00:02:39 +00:00
|
|
|
|
2017-07-13 00:24:09 +00:00
|
|
|
s = strings.Replace(s, "$fedapiserverbin", fedApiserverBin, -1)
|
|
|
|
s = strings.Replace(s, "$fedcontrollermanagerbin", fedControllerManagerBin, -1)
|
2017-05-26 09:25:29 +00:00
|
|
|
|
2017-06-23 11:04:46 +00:00
|
|
|
controls, err := check.NewControls(t, []byte(s))
|
|
|
|
if err != nil {
|
2017-07-25 00:34:07 +00:00
|
|
|
exitWithError(fmt.Errorf("error setting up %s controls: %v", t, err))
|
2017-06-23 11:04:46 +00:00
|
|
|
}
|
2017-05-26 09:25:29 +00:00
|
|
|
|
|
|
|
if groupList != "" && checkList == "" {
|
|
|
|
ids := cleanIDs(groupList)
|
2017-07-25 00:34:07 +00:00
|
|
|
summary = controls.RunGroup(ids...)
|
2017-05-26 09:25:29 +00:00
|
|
|
} else if checkList != "" && groupList == "" {
|
|
|
|
ids := cleanIDs(checkList)
|
2017-07-25 00:34:07 +00:00
|
|
|
summary = controls.RunChecks(ids...)
|
2017-05-26 09:25:29 +00:00
|
|
|
} else if checkList != "" && groupList != "" {
|
2017-07-25 00:34:07 +00:00
|
|
|
exitWithError(fmt.Errorf("group option and check option can't be used together"))
|
2017-05-26 09:25:29 +00:00
|
|
|
} else {
|
2017-07-25 00:34:07 +00:00
|
|
|
summary = controls.RunGroup()
|
2017-05-26 09:25:29 +00:00
|
|
|
}
|
|
|
|
|
2017-06-23 09:41:40 +00:00
|
|
|
// if we successfully ran some tests and it's json format, ignore the warnings
|
|
|
|
if (summary.Fail > 0 || summary.Warn > 0 || summary.Pass > 0) && jsonFmt {
|
2017-05-26 09:25:29 +00:00
|
|
|
out, err := controls.JSON()
|
|
|
|
if err != nil {
|
2017-07-25 00:34:07 +00:00
|
|
|
exitWithError(fmt.Errorf("failed to output in JSON format: %v", err))
|
2017-05-26 09:25:29 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
fmt.Println(string(out))
|
|
|
|
} else {
|
2017-07-25 00:34:07 +00:00
|
|
|
prettyPrint(controls, summary)
|
2017-05-26 09:25:29 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-06-30 11:40:39 +00:00
|
|
|
// verifyNodeType checks the executables and config files are as expected
|
|
|
|
// for the specified tests (master, node or federated).
|
2017-07-25 00:34:07 +00:00
|
|
|
func verifyNodeType(t check.NodeType) {
|
2017-06-30 11:40:39 +00:00
|
|
|
switch t {
|
|
|
|
case check.MASTER:
|
2017-07-25 00:34:07 +00:00
|
|
|
verifyKubeVersion(apiserverBin)
|
|
|
|
verifyBin(apiserverBin, schedulerBin, controllerManagerBin)
|
|
|
|
verifyConf(apiserverConf, schedulerConf, controllerManagerConf)
|
2017-06-30 11:40:39 +00:00
|
|
|
case check.NODE:
|
2017-07-25 00:34:07 +00:00
|
|
|
verifyKubeVersion(kubeletBin)
|
|
|
|
verifyBin(kubeletBin, proxyBin)
|
|
|
|
verifyConf(kubeletConf, proxyConf)
|
2017-07-13 00:24:09 +00:00
|
|
|
case check.FEDERATED:
|
2017-07-25 00:34:07 +00:00
|
|
|
verifyKubeVersion(fedApiserverBin)
|
|
|
|
verifyBin(fedApiserverBin, fedControllerManagerBin)
|
2017-07-07 17:01:30 +00:00
|
|
|
}
|
2017-05-26 09:25:29 +00:00
|
|
|
}
|
|
|
|
|
2017-06-20 08:54:17 +00:00
|
|
|
// colorPrint outputs the state in a specific colour, along with a message string
|
|
|
|
func colorPrint(state check.State, s string) {
|
|
|
|
colors[state].Printf("[%s] ", state)
|
|
|
|
fmt.Printf("%s", s)
|
|
|
|
}
|
2017-05-26 09:25:29 +00:00
|
|
|
|
2017-06-23 09:41:40 +00:00
|
|
|
// prettyPrint outputs the results to stdout in human-readable format
|
2017-07-25 00:34:07 +00:00
|
|
|
func prettyPrint(r *check.Controls, summary check.Summary) {
|
2017-06-23 09:48:49 +00:00
|
|
|
colorPrint(check.INFO, fmt.Sprintf("Using config file: %s\n", viper.ConfigFileUsed()))
|
|
|
|
|
2017-06-20 08:54:17 +00:00
|
|
|
colorPrint(check.INFO, fmt.Sprintf("%s %s\n", r.ID, r.Text))
|
2017-05-26 09:25:29 +00:00
|
|
|
for _, g := range r.Groups {
|
2017-06-20 10:09:44 +00:00
|
|
|
colorPrint(check.INFO, fmt.Sprintf("%s %s\n", g.ID, g.Text))
|
2017-05-26 09:25:29 +00:00
|
|
|
for _, c := range g.Checks {
|
2017-06-20 08:54:17 +00:00
|
|
|
colorPrint(c.State, fmt.Sprintf("%s %s\n", c.ID, c.Text))
|
2017-05-26 09:25:29 +00:00
|
|
|
}
|
|
|
|
}
|
2017-06-20 08:54:17 +00:00
|
|
|
|
2017-05-26 09:25:29 +00:00
|
|
|
fmt.Println()
|
|
|
|
|
|
|
|
// Print remediations.
|
|
|
|
if summary.Fail > 0 || summary.Warn > 0 {
|
|
|
|
colors[check.WARN].Printf("== Remediations ==\n")
|
|
|
|
for _, g := range r.Groups {
|
|
|
|
for _, c := range g.Checks {
|
|
|
|
if c.State != check.PASS {
|
|
|
|
fmt.Printf("%s %s\n", c.ID, c.Remediation)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
fmt.Println()
|
|
|
|
}
|
|
|
|
|
|
|
|
// Print summary setting output color to highest severity.
|
|
|
|
var res check.State
|
|
|
|
if summary.Fail > 0 {
|
|
|
|
res = check.FAIL
|
|
|
|
} else if summary.Warn > 0 {
|
|
|
|
res = check.WARN
|
|
|
|
} else {
|
|
|
|
res = check.PASS
|
|
|
|
}
|
|
|
|
|
|
|
|
colors[res].Printf("== Summary ==\n")
|
|
|
|
fmt.Printf("%d checks PASS\n%d checks FAIL\n%d checks WARN\n",
|
|
|
|
summary.Pass, summary.Fail, summary.Warn,
|
|
|
|
)
|
|
|
|
}
|