-
Notifications
You must be signed in to change notification settings - Fork 10
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Signed-off-by: Anurag Rajawat <[email protected]>
- Loading branch information
1 parent
9405729
commit f6a9df0
Showing
30 changed files
with
521 additions
and
724 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -7,7 +7,6 @@ | |
| *.dylib | ||
| bin | ||
| Dockerfile.cross | ||
| nimbus-kubearmor | ||
|
|
||
| # Test binary, build with `go test -c` | ||
| *.test | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,5 +2,5 @@ go 1.21 | |
|
|
||
| use ( | ||
| ./ | ||
| ./pkg/nimbus-kubearmor | ||
| pkg/adapter/nimbus-kubearmor | ||
| ) | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| # SPDX-License-Identifier: Apache-2.0 | ||
| # Copyright 2023 Authors of Nimbus | ||
|
|
||
| # Build the nimbus-kubearmor binary | ||
| FROM golang:1.21 as builder | ||
| ARG TARGETOS | ||
| ARG TARGETARCH | ||
|
|
||
| WORKDIR /workspace | ||
| # Copy the Go Modules manifests | ||
| COPY go.mod go.mod | ||
| COPY go.sum go.sum | ||
| # cache deps before building and copying source so that we don't need to re-download as much | ||
| # and so that source changes don't invalidate our downloaded layer | ||
| RUN go mod download | ||
|
|
||
| # Copy the go source | ||
| COPY main.go main.go | ||
| COPY idpool/ idpool/ | ||
| COPY k8s/ k8s/ | ||
| COPY manager/ manager/ | ||
| COPY processor/ processor/ | ||
| COPY watcher/ watcher/ | ||
|
|
||
| # Build | ||
| # the GOARCH has not a default value to allow the binary be built according to the host where the command | ||
| # was called. For example, if we call make docker-build in a local env which has the Apple Silicon M1 SO | ||
| # the docker BUILDPLATFORM arg will be linux/arm64 when for Apple x86 it will be linux/amd64. Therefore, | ||
| # by leaving it empty we can ensure that the container and binary shipped on it will have the same platform. | ||
| RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o nimbus-kubearmor main.go | ||
|
|
||
| FROM gcr.io/distroless/static:nonroot | ||
| WORKDIR / | ||
| COPY --from=builder /workspace/nimbus-kubearmor . | ||
| USER 65532:65532 | ||
|
|
||
| ENTRYPOINT ["/nimbus-kubearmor"] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| # SPDX-License-Identifier: Apache-2.0 | ||
| # Copyright 2023 Authors of Nimbus | ||
|
|
||
| BINARY ?= bin/nimbus-kubearmor | ||
|
|
||
| build: | ||
| @go build -ldflags="-w" -o ${BINARY} main.go | ||
|
|
||
| run: build | ||
| @./bin/nimbus-kubearmor | ||
|
|
||
| deploy-rbac: | ||
| kubectl apply -f config/service_account.yaml | ||
| kubectl apply -f config/role.yaml | ||
| kubectl apply -f config/role_binding.yaml |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| # SPDX-License-Identifier: Apache-2.0 | ||
| # Copyright 2023 Authors of Nimbus | ||
|
|
||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: ClusterRole | ||
| metadata: | ||
| name: nimbus-kubearmor-role | ||
| rules: | ||
| - apiGroups: | ||
| - intent.security.nimbus.com | ||
| resources: | ||
| - nimbuspolicies | ||
| - clusternimbuspolicies | ||
| verbs: | ||
| - get | ||
| - list | ||
| - watch | ||
| - apiGroups: | ||
| - security.kubearmor.com | ||
| resources: | ||
| - kubearmorpolicies | ||
| verbs: | ||
| - create | ||
| - delete | ||
| - get | ||
| - list | ||
| - patch | ||
| - update | ||
| - watch |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| # SPDX-License-Identifier: Apache-2.0 | ||
| # Copyright 2023 Authors of Nimbus | ||
|
|
||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: ClusterRoleBinding | ||
| metadata: | ||
| name: nimbus-kubearmor-role-binding | ||
| roleRef: | ||
| apiGroup: rbac.authorization.k8s.io | ||
| kind: ClusterRole | ||
| name: nimbus-kubearmor-role | ||
| subjects: | ||
| - kind: ServiceAccount | ||
| name: nimbus-kubearmor | ||
| namespace: nimbus |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| # SPDX-License-Identifier: Apache-2.0 | ||
| # Copyright 2023 Authors of Nimbus | ||
|
|
||
| apiVersion: v1 | ||
| kind: ServiceAccount | ||
| metadata: | ||
| name: nimbus-kubearmor | ||
| namespace: nimbus |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
| // Copyright 2023 Authors of Nimbus | ||
|
|
||
| // Package idpool manages a pool of IDs for use by KubeArmor. | ||
| package idpool | ||
|
|
||
| const ( | ||
| SwDeploymentTools = "swDeploymentTools" | ||
| UnAuthorizedNEFAccess = "unAuthorizedNEFAccess" | ||
| NFServiceDiscovery = "nfServiceDiscovery" | ||
| DNSManipulation = "dnsManipulation" | ||
| NetPortExec = "netPortExec" | ||
| SysPathExec = "sysPathExec" | ||
| ) | ||
|
|
||
| // KaIds are IDs supported by KubeArmor. | ||
| var KaIds = []string{ | ||
| SwDeploymentTools, | ||
| } | ||
|
|
||
| // IsIdSupported determines whether a given ID is supported by KubeArmor. | ||
| func IsIdSupported(id string) bool { | ||
| for _, currId := range KaIds { | ||
| if currId == id { | ||
| return true | ||
| } | ||
| } | ||
| return false | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
| // Copyright 2023 Authors of Nimbus | ||
|
|
||
| package k8s | ||
|
|
||
| import ( | ||
| "errors" | ||
| "fmt" | ||
| "os" | ||
| "path/filepath" | ||
|
|
||
| "k8s.io/apimachinery/pkg/runtime" | ||
| "k8s.io/client-go/rest" | ||
| "k8s.io/client-go/tools/clientcmd" | ||
| "sigs.k8s.io/controller-runtime/pkg/client" | ||
| ) | ||
|
|
||
| // NewWithWatch returns a new Kubernetes client with Watch. | ||
| func NewWithWatch(scheme *runtime.Scheme) (client.WithWatch, error) { | ||
| config, err := rest.InClusterConfig() | ||
| if err != nil && errors.Is(err, rest.ErrNotInCluster) { | ||
| kubeconfig := filepath.Join(os.Getenv("HOME"), ".kube", "config") | ||
| config, err = clientcmd.BuildConfigFromFlags("", kubeconfig) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("failed to load kubeconfig '%v', error: %v", kubeconfig, err) | ||
| } | ||
| } | ||
| k8sClient, err := client.NewWithWatch(config, client.Options{ | ||
| Scheme: scheme, | ||
| }) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("failed to create client, error: %v", err) | ||
| } | ||
| return k8sClient, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
| // Copyright 2023 Authors of Nimbus | ||
|
|
||
| package main | ||
|
|
||
| import ( | ||
| "context" | ||
| "os" | ||
| "os/signal" | ||
| "syscall" | ||
|
|
||
| kubearmorv1 "github.com/kubearmor/KubeArmor/pkg/KubeArmorController/api/security.kubearmor.com/v1" | ||
| "k8s.io/apimachinery/pkg/runtime" | ||
| utilruntime "k8s.io/apimachinery/pkg/util/runtime" | ||
| ctrl "sigs.k8s.io/controller-runtime" | ||
| "sigs.k8s.io/controller-runtime/pkg/log/zap" | ||
|
|
||
| v1 "github.com/5GSEC/nimbus/api/v1" | ||
| "github.com/5GSEC/nimbus/pkg/adapter/nimbus-kubearmor/k8s" | ||
|
|
||
| "github.com/5GSEC/nimbus/pkg/adapter/nimbus-kubearmor/manager" | ||
| "github.com/5GSEC/nimbus/pkg/adapter/nimbus-kubearmor/watcher" | ||
| ) | ||
|
|
||
| // Initialize the global scheme variable | ||
| var ( | ||
| scheme = runtime.NewScheme() | ||
| ) | ||
|
|
||
| func init() { | ||
| utilruntime.Must(v1.AddToScheme(scheme)) | ||
| utilruntime.Must(kubearmorv1.AddToScheme(scheme)) | ||
| } | ||
|
|
||
| func main() { | ||
| ctrl.SetLogger(zap.New()) | ||
| logger := ctrl.Log | ||
|
|
||
| k8sClient, err := k8s.NewWithWatch(scheme) | ||
| if err != nil { | ||
| logger.Error(err, "") | ||
| } | ||
|
|
||
| ctx, cancelFunc := context.WithCancel(context.Background()) | ||
| ctrl.LoggerInto(ctx, logger) | ||
|
|
||
| nimbusPolicyChan := make(chan *v1.NimbusPolicy) | ||
| deletedNpChan := make(chan *v1.NimbusPolicy) | ||
|
|
||
| go watcher.WatchNimbusPolicies(ctx, k8sClient, nimbusPolicyChan, deletedNpChan) | ||
| go func() { | ||
| termChan := make(chan os.Signal) | ||
| signal.Notify(termChan, syscall.SIGHUP, syscall.SIGINT, syscall.SIGTERM, syscall.SIGQUIT) | ||
| <-termChan | ||
| logger.Info("Shutdown signal received, waiting for all workers to finish") | ||
| cancelFunc() | ||
| logger.Info("All workers finished, shutting down") | ||
| }() | ||
|
|
||
| logger.Info("KubeArmor Adapter started") | ||
| manager.ManageKsps(ctx, k8sClient, nimbusPolicyChan, deletedNpChan) | ||
| } |
Oops, something went wrong.