Skip to content

Commit

Permalink
Merge pull request #151 from kubescape/versionlabel
Browse files Browse the repository at this point in the history 
add label with parent resource version
  • Loading branch information
@matthyx
matthyx authored Nov 30, 2023
2 parents 1e1ee79 + 9444d16 commit 5f429b4
Show file tree
Hide file tree
Showing 7 changed files with 58 additions and 59 deletions.
2 changes: 1 addition & 1 deletion go.mod
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ require (
github.com/kinbiko/jsonassert v1.1.1
github.com/kubescape/backend v0.0.13
github.com/kubescape/go-logger v0.0.21
github.com/kubescape/k8s-interface v0.0.148
github.com/kubescape/k8s-interface v0.0.150
github.com/kubescape/storage v0.0.38
github.com/panjf2000/ants/v2 v2.8.1
github.com/spf13/viper v1.17.0
Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Original file line number Diff line number Diff line change
Expand Up @@ -316,8 +316,8 @@ github.com/kubescape/backend v0.0.13 h1:N+fH8giGGqvy3ff2li2AwG5guVduhdiPWyvZaZxr
github.com/kubescape/backend v0.0.13/go.mod h1:ug9NFmmxT4DcQx3sgdLRzlLPWMKGHE/fpbcYUm5G5Qo=
github.com/kubescape/go-logger v0.0.21 h1:4ZRIEw3UGUH6BG/cH3yiqFipzQSfGAoCrxlsZuk37ys=
github.com/kubescape/go-logger v0.0.21/go.mod h1:x3HBpZo3cMT/WIdy18BxvVVd5D0e/PWFVk/HiwBNu3g=
github.com/kubescape/k8s-interface v0.0.148 h1:vtXDUjvCow5wMdDvb5c/Td9SpafeRqsV/LnOd0NVVsE=
github.com/kubescape/k8s-interface v0.0.148/go.mod h1:5sz+5Cjvo98lTbTVDiDA4MmlXxeHSVMW/wR0V3hV4K8=
github.com/kubescape/k8s-interface v0.0.150 h1:6lLRuqUVirpOnobZUz+I1g1RnW4fk88zOO26492Pn9E=
github.com/kubescape/k8s-interface v0.0.150/go.mod h1:5sz+5Cjvo98lTbTVDiDA4MmlXxeHSVMW/wR0V3hV4K8=
github.com/kubescape/storage v0.0.38 h1:LR+QTqjeYw4kM1repIltDLDQGqHgKmG196lQyHP+xUw=
github.com/kubescape/storage v0.0.38/go.mod h1:ObCIVOnVyWwRwU0iuKTzOnrJQScqPgkw0FgvSINwosY=
github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de h1:9TO3cAIGXtEhnIaL+V+BEER86oLrvS+kWobKpbJuye0=
Expand Down
1 change: 1 addition & 0 deletions pkg/applicationprofilemanager/v1/applicationprofile_manager.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,7 @@ func (am *ApplicationProfileManager) ensureInstanceID(ctx context.Context, conta
logger.L().Ctx(ctx).Error("ApplicationProfileManager - failed to validate WLID", helpers.Error(err))
return
}
watchedContainer.ParentResourceVersion = w.GetResourceVersion()
// find instanceID
instanceIDs, err := instanceidhandler.GenerateInstanceID(pod)
if err != nil {
Expand Down
19 changes: 5 additions & 14 deletions pkg/networkmanager/network_neighbors.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -53,21 +53,12 @@ func generateNetworkNeighborsNameFromWlid(parentWlid string) string {
}

func generateNetworkNeighborsLabels(workload k8sinterface.IWorkload) map[string]string {
var apiVersion, apiGroup string
apiVersionSplitted := strings.Split(workload.GetApiVersion(), "/")
if len(apiVersionSplitted) == 2 {
apiGroup = apiVersionSplitted[0]
apiVersion = apiVersionSplitted[1]
} else if len(apiVersionSplitted) == 1 {
apiVersion = apiVersionSplitted[0]
}

return map[string]string{
instanceidhandlerV1.ApiGroupMetadataKey: apiGroup,
instanceidhandlerV1.ApiVersionMetadataKey: apiVersion,
instanceidhandlerV1.NamespaceMetadataKey: workload.GetNamespace(),
instanceidhandlerV1.KindMetadataKey: strings.ToLower(workload.GetKind()),
instanceidhandlerV1.NameMetadataKey: workload.GetName(),
instanceidhandlerV1.ApiVersionMetadataKey: workload.GetApiVersion(),
instanceidhandlerV1.NamespaceMetadataKey: workload.GetNamespace(),
instanceidhandlerV1.KindMetadataKey: strings.ToLower(workload.GetKind()),
instanceidhandlerV1.NameMetadataKey: workload.GetName(),
instanceidhandlerV1.ResourceVersionMetadataKey: workload.GetResourceVersion(),
}
}

Expand Down
60 changes: 30 additions & 30 deletions pkg/networkmanager/network_neighbors_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -46,11 +46,11 @@ func TestGenerateNetworkNeighborsCRD(t *testing.T) {
Name: "deployment-nginx-deployment",
Namespace: "default",
Labels: map[string]string{
"kubescape.io/workload-api-group": "apps",
"kubescape.io/workload-api-version": "v1",
"kubescape.io/workload-namespace": "default",
"kubescape.io/workload-kind": "deployment",
"kubescape.io/workload-name": "nginx-deployment",
"kubescape.io/workload-api-version": "apps/v1",
"kubescape.io/workload-namespace": "default",
"kubescape.io/workload-kind": "deployment",
"kubescape.io/workload-name": "nginx-deployment",
"kubescape.io/workload-resource-version": "339815",
},
},
Spec: v1beta1.NetworkNeighborsSpec{
Expand Down Expand Up @@ -80,11 +80,11 @@ func TestGenerateNetworkNeighborsCRD(t *testing.T) {
Name: "daemonset-fluentd-elasticsearch",
Namespace: "kube-system",
Labels: map[string]string{
"kubescape.io/workload-api-group": "apps",
"kubescape.io/workload-api-version": "v1",
"kubescape.io/workload-namespace": "kube-system",
"kubescape.io/workload-kind": "daemonset",
"kubescape.io/workload-name": "fluentd-elasticsearch",
"kubescape.io/workload-api-version": "apps/v1",
"kubescape.io/workload-namespace": "kube-system",
"kubescape.io/workload-kind": "daemonset",
"kubescape.io/workload-name": "fluentd-elasticsearch",
"kubescape.io/workload-resource-version": "266406",
},
},
Spec: v1beta1.NetworkNeighborsSpec{
Expand Down Expand Up @@ -114,11 +114,11 @@ func TestGenerateNetworkNeighborsCRD(t *testing.T) {
Name: "pod-nginx-deployment-fcc867f7-dgjrg",
Namespace: "default",
Labels: map[string]string{
"kubescape.io/workload-api-group": "",
"kubescape.io/workload-api-version": "v1",
"kubescape.io/workload-namespace": "default",
"kubescape.io/workload-kind": "pod",
"kubescape.io/workload-name": "nginx-deployment-fcc867f7-dgjrg",
"kubescape.io/workload-api-version": "v1",
"kubescape.io/workload-namespace": "default",
"kubescape.io/workload-kind": "pod",
"kubescape.io/workload-name": "nginx-deployment-fcc867f7-dgjrg",
"kubescape.io/workload-resource-version": "339809",
},
},
Spec: v1beta1.NetworkNeighborsSpec{
Expand Down Expand Up @@ -225,35 +225,35 @@ func TestGenerateNetworkNeighborsLabels(t *testing.T) {
name: "deployment",
workload: deploymentJson,
expectedLabels: map[string]string{
"kubescape.io/workload-api-group": "apps",
"kubescape.io/workload-api-version": "v1",
"kubescape.io/workload-namespace": "default",
"kubescape.io/workload-kind": "deployment",
"kubescape.io/workload-name": "nginx-deployment",
"kubescape.io/workload-api-version": "apps/v1",
"kubescape.io/workload-namespace": "default",
"kubescape.io/workload-kind": "deployment",
"kubescape.io/workload-name": "nginx-deployment",
"kubescape.io/workload-resource-version": "339815",
},
},

{
name: "daemonset",
workload: daemonsetJson,
expectedLabels: map[string]string{
"kubescape.io/workload-api-group": "apps",
"kubescape.io/workload-api-version": "v1",
"kubescape.io/workload-namespace": "kube-system",
"kubescape.io/workload-kind": "daemonset",
"kubescape.io/workload-name": "fluentd-elasticsearch",
"kubescape.io/workload-api-version": "apps/v1",
"kubescape.io/workload-namespace": "kube-system",
"kubescape.io/workload-kind": "daemonset",
"kubescape.io/workload-name": "fluentd-elasticsearch",
"kubescape.io/workload-resource-version": "266406",
},
},

{
name: "pod",
workload: podJson,
expectedLabels: map[string]string{
"kubescape.io/workload-api-group": "",
"kubescape.io/workload-api-version": "v1",
"kubescape.io/workload-namespace": "default",
"kubescape.io/workload-kind": "pod",
"kubescape.io/workload-name": "nginx-deployment-fcc867f7-dgjrg",
"kubescape.io/workload-api-version": "v1",
"kubescape.io/workload-namespace": "default",
"kubescape.io/workload-kind": "pod",
"kubescape.io/workload-name": "nginx-deployment-fcc867f7-dgjrg",
"kubescape.io/workload-resource-version": "339809",
},
},
}
Expand Down
27 changes: 15 additions & 12 deletions pkg/relevancymanager/v1/relevancy_manager.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ func (rm *RelevancyManager) deleteResources(watchedContainer *utils.WatchedConta

func (rm *RelevancyManager) ensureImageInfo(container *containercollection.Container, watchedContainer *utils.WatchedContainerData) {
if watchedContainer.ImageID == "" || watchedContainer.ImageTag == "" || watchedContainer.InstanceID == nil || watchedContainer.Wlid == "" {
imageID, imageTag, parentWlid, instanceID, err := rm.getContainerInfo(container.K8s.Namespace, container.K8s.PodName, container.K8s.ContainerName)
imageID, imageTag, parentWlid, parentResourceVersion, instanceID, err := rm.getContainerInfo(container.K8s.Namespace, container.K8s.PodName, container.K8s.ContainerName)
if err != nil {
logger.L().Debug("failed to get image info", helpers.String("container ID", container.Runtime.ContainerID), helpers.String("k8s workload", watchedContainer.K8sContainerID), helpers.Error(err))
return
Expand All @@ -69,73 +69,76 @@ func (rm *RelevancyManager) ensureImageInfo(container *containercollection.Conta
watchedContainer.ImageTag = imageTag
watchedContainer.InstanceID = instanceID
watchedContainer.Wlid = parentWlid
watchedContainer.ParentResourceVersion = parentResourceVersion
rm.sbomHandler.IncrementImageUse(watchedContainer.ImageID)
}
}

func (rm *RelevancyManager) getContainerInfo(namespace, podName, containerName string) (string, string, string, instanceidhandler.IInstanceID, error) {
func (rm *RelevancyManager) getContainerInfo(namespace, podName, containerName string) (string, string, string, string, instanceidhandler.IInstanceID, error) {
imageID := ""
imageTag := ""
parentWlid := ""
parentResourceVersion := ""
var instanceID instanceidhandler.IInstanceID
wl, err := rm.k8sClient.GetWorkload(namespace, "Pod", podName)
if err != nil {
return imageID, imageTag, parentWlid, instanceID, fmt.Errorf("fail to get pod %s in namespace %s with error: %v", podName, namespace, err)
return imageID, imageTag, parentWlid, parentResourceVersion, instanceID, fmt.Errorf("fail to get pod %s in namespace %s with error: %v", podName, namespace, err)
}
pod := wl.(*workloadinterface.Workload)
// find parentWlid
kind, name, err := rm.k8sClient.CalculateWorkloadParentRecursive(pod)
if err != nil {
return imageID, imageTag, parentWlid, instanceID, fmt.Errorf("fail to get workload owner parent %s in namespace %s with error: %v", pod.GetName(), pod.GetNamespace(), err)
return imageID, imageTag, parentWlid, parentResourceVersion, instanceID, fmt.Errorf("fail to get workload owner parent %s in namespace %s with error: %v", pod.GetName(), pod.GetNamespace(), err)
}
parentWorkload, err := rm.k8sClient.GetWorkload(pod.GetNamespace(), kind, name)
if err != nil {
return imageID, imageTag, parentWlid, instanceID, fmt.Errorf("fail to get parent workload %s in namespace %s with error: %v", pod.GetName(), pod.GetNamespace(), err)
return imageID, imageTag, parentWlid, parentResourceVersion, instanceID, fmt.Errorf("fail to get parent workload %s in namespace %s with error: %v", pod.GetName(), pod.GetNamespace(), err)
}
w := parentWorkload.(*workloadinterface.Workload)
parentWlid = w.GenerateWlid(rm.clusterName)
parentResourceVersion = w.GetResourceVersion()
err = wlid.IsWlidValid(parentWlid)
if err != nil {
return imageID, imageTag, parentWlid, instanceID, fmt.Errorf("WLID of parent workload is not in the right %s in namespace %s with error: %v", pod.GetName(), pod.GetNamespace(), err)
return imageID, imageTag, parentWlid, parentResourceVersion, instanceID, fmt.Errorf("WLID of parent workload is not in the right %s in namespace %s with error: %v", pod.GetName(), pod.GetNamespace(), err)
}
// find imageTag
containers, err := pod.GetContainers()
if err != nil {
return imageID, imageTag, parentWlid, instanceID, fmt.Errorf("fail to get containers for pod %s in namespace %s with error: %v", podName, namespace, err)
return imageID, imageTag, parentWlid, parentResourceVersion, instanceID, fmt.Errorf("fail to get containers for pod %s in namespace %s with error: %v", podName, namespace, err)
}
for i := range containers {
if containers[i].Name == containerName {
imageTag = containers[i].Image
}
}
if imageTag == "" {
return imageID, imageTag, parentWlid, instanceID, fmt.Errorf("fail to find container %s in pod %s in namespace %s", containerName, podName, namespace)
return imageID, imageTag, parentWlid, parentResourceVersion, instanceID, fmt.Errorf("fail to find container %s in pod %s in namespace %s", containerName, podName, namespace)
}
// find imageID
status, err := pod.GetPodStatus() // Careful this is not available on container creation
if err != nil {
return imageID, imageTag, parentWlid, instanceID, fmt.Errorf("fail to get status for pod %s in namespace %s with error: %v", pod.GetName(), pod.GetNamespace(), err)
return imageID, imageTag, parentWlid, parentResourceVersion, instanceID, fmt.Errorf("fail to get status for pod %s in namespace %s with error: %v", pod.GetName(), pod.GetNamespace(), err)
}
for i := range status.ContainerStatuses {
if status.ContainerStatuses[i].Name == containerName {
imageID = status.ContainerStatuses[i].ImageID
}
}
if imageID == "" {
return imageID, imageTag, parentWlid, instanceID, fmt.Errorf("fail to find container status %s in pod %s in namespace %s", containerName, podName, namespace)
return imageID, imageTag, parentWlid, parentResourceVersion, instanceID, fmt.Errorf("fail to find container status %s in pod %s in namespace %s", containerName, podName, namespace)
}
// find instanceID
instanceIDs, err := instanceidhandlerV1.GenerateInstanceID(pod)
if err != nil {
return imageID, imageTag, parentWlid, instanceID, fmt.Errorf("fail to create InstanceID to pod %s in namespace %s with error: %v", pod.GetName(), pod.GetNamespace(), err)
return imageID, imageTag, parentWlid, parentResourceVersion, instanceID, fmt.Errorf("fail to create InstanceID to pod %s in namespace %s with error: %v", pod.GetName(), pod.GetNamespace(), err)
}
instanceID = instanceIDs[0]
for i := range instanceIDs {
if instanceIDs[i].GetContainerName() == containerName {
instanceID = instanceIDs[i]
}
}
return imageID, imageTag, parentWlid, instanceID, nil
return imageID, imageTag, parentWlid, parentResourceVersion, instanceID, nil
}

// Handle relevant data
Expand Down
4 changes: 4 additions & 0 deletions pkg/utils/utils.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,7 @@ type WatchedContainerData struct {
InitialDelayExpired bool
InstanceID instanceidhandler.IInstanceID
K8sContainerID string
ParentResourceVersion string
RelevantRealtimeFilesByPackageSourceInfo map[string]*PackageSourceInfoData
RelevantRealtimeFilesBySPDXIdentifier map[v1beta1.ElementID]bool
SBOMResourceVersion int
Expand Down Expand Up @@ -135,6 +136,9 @@ func GetLabels(watchedContainer *WatchedContainerData, stripContainer bool) map[
}
}
}
if watchedContainer.ParentResourceVersion != "" {
labels[instanceidhandler2.ResourceVersionMetadataKey] = watchedContainer.ParentResourceVersion
}
return labels
}

Expand Down

0 comments on commit 5f429b4

Please sign in to comment.