INSIGHTS-329 - Convert kyverno plugin to go and fix policy title (#960)

* Convert kyverno to go

* Convert kyverno to go

* Fixing issues

* Preparing build

* Preparing build

* Preparing build

* Preparing build

* Added fatal

* Added fatal

fairwinds-insights.yaml

@@ -18,7 +18,7 @@ images:
     - quay.io/fairwinds/fw-kube-bench:0.4.16
     - quay.io/fairwinds/kubectl:0.20.5
     - quay.io/fairwinds/fw-kubesec:1.4.8
-    - quay.io/fairwinds/kyverno:0.2.1
+    - quay.io/fairwinds/kyverno:0.3.0
     - quay.io/fairwinds/fw-opa:2.5.0
     - quay.io/fairwinds/postgres-partman:16.0.0
     - quay.io/fairwinds/prometheus-collector:1.5.1

plugins/kyverno/.goreleaser.yml.envsubst

@@ -4,8 +4,19 @@ release:
   disable: true
 changelog:
   skip: true
+# This avoids creating .tar.gz archives.
+archives:
+- format: binary
+env:
+  - CGO_ENABLED=0
+  # Avoid contaminating workstation Go directories.
+  - GOMODCACHE={{ .Env.TMPDIR }}/kyverno-go-mod-cache
+  - GOBIN={{ .Env.TMPDIR }}/kyverno-go-bin
+before:
+  hooks:
+    - go mod download
 builds:
-- skip: true
+- main: ./cmd/main.go
   # goreleaser builds a matrix of the GOOS, GOArch, and GOARM listed below,
   # minus those under `ignore`.
   goarch:
@@ -21,19 +32,13 @@ dockers:
   use: buildx
   build_flag_templates:
   - "--platform=linux/amd64"
-  # These files will be available to a COPY Dockerfile command.
-  # Note there are additional extra_files repeated below.
-  extra_files:
-    - main.sh
 - image_templates:
   - "quay.io/fairwinds/kyverno:{{ .FullCommit }}-arm64"
   use: buildx
   goarch: arm64
   goos: linux
   build_flag_templates:
   - "--platform=linux/arm64"
-  extra_files:
-    - main.sh
 docker_manifests:
 # Create DOcker manifests that make multiple architectures available within a tag,
 # and provide partial-version tags like 2, and 2.2.

plugins/kyverno/CHANGELOG.md

@@ -1,5 +1,8 @@
 # Changelog
 
+## 0.3.0
+* Converted kyverno plugin to golang
+
 ## 0.2.1
 * Bump alpine to 3.20
 

plugins/kyverno/Dockerfile

@@ -1,17 +1,6 @@
 FROM alpine:3.20
-ARG TARGETARCH
-ARG TARGETOS
-
+WORKDIR /insights
 RUN apk -U upgrade
-RUN apk update && apk upgrade
-RUN apk add jq bash curl moreutils
-
-# curl -L -s https://dl.k8s.io/release/stable.txt
-ENV kubectlVersion=v1.29.0
-RUN curl -LO https://dl.k8s.io/release/$kubectlVersion/bin/${TARGETOS}/${TARGETARCH}/kubectl
-RUN chmod +x ./kubectl && mv ./kubectl /usr/local/bin/kubectl
-
-COPY main.sh .
+COPY kyverno /usr/local/bin/insights-kyverno
 
-USER 1000
-CMD ["/main.sh"]
+CMD ["insights-kyverno"]

plugins/kyverno/cmd/main.go

@@ -0,0 +1,161 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+
+	"github.com/sirupsen/logrus"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/restmapper"
+	ctrl "sigs.k8s.io/controller-runtime"
+)
+
+type Client struct {
+	RestMapper       meta.RESTMapper
+	DynamicInterface dynamic.Interface
+}
+
+func main() {
+	logrus.Info("Starting Kyverno plugin")
+	client, err := getKubeClient()
+	if err != nil {
+		logrus.Fatal("Error getting kube client: ", err)
+	}
+	policiesTitleAndDDescription, err := createPoliciesTitleAndDescriptionMap(client)
+	if err != nil {
+		logrus.Fatal("Error creating policies title and description map: ", err)
+	}
+	policyReports, err := client.ListPolicies(context.Background(), "PolicyReport", client.DynamicInterface, client.RestMapper)
+	if err != nil {
+		logrus.Fatal("Error listing policy reports: ", err)
+	}
+	clusterPolicyReports, err := client.ListPolicies(context.Background(), "ClusterPolicyReport", client.DynamicInterface, client.RestMapper)
+	if err != nil {
+		logrus.Fatal("Error listing cluster policy reports: ", err)
+	}
+	policyReportsViolations, err := filterViolations(policyReports, policiesTitleAndDDescription)
+	if err != nil {
+		logrus.Fatal("Error filtering violations: ", err)
+	}
+	logrus.Info("Policy reports violations found: ", len(policyReportsViolations))
+	clusterPolicyReportsViolations, err := filterViolations(clusterPolicyReports, policiesTitleAndDDescription)
+	if err != nil {
+		logrus.Fatal("Error filtering violations: ", err)
+	}
+	logrus.Info("Cluster policy reports violations found: ", len(clusterPolicyReportsViolations))
+	response := map[string]interface{}{
+		"policyReports":        policyReportsViolations,
+		"clusterPolicyReports": clusterPolicyReportsViolations,
+	}
+	jsonBytes, err := json.Marshal(response)
+	if err != nil {
+		logrus.Fatal("Error marshalling response: ", err)
+	}
+	logrus.Info("Writing Kyverno plugin output to /output/kyverno.json")
+	err = os.WriteFile("/output/kyverno.json", jsonBytes, 0644)
+	if err != nil {
+		logrus.Fatal("Error writing output file: ", err)
+	}
+	logrus.Info("Kyverno plugin finished")
+}
+
+func filterViolations(policies []unstructured.Unstructured, policiesTitleAndDDescription map[string]interface{}) ([]map[string]interface{}, error) {
+	allViolations := []map[string]interface{}{}
+	for _, p := range policies {
+		metadata := p.Object["metadata"].(map[string]interface{})
+		delete(metadata, "managedFields")
+		results := p.Object["results"].([]interface{})
+		violations := []map[string]interface{}{}
+		for _, r := range results {
+			result := r.(map[string]interface{})
+			if result["result"].(string) != "fail" && result["result"].(string) != "warn" {
+				continue
+			}
+			if titleAndDescription, ok := policiesTitleAndDDescription[result["policy"].(string)]; ok {
+				result["policyTitle"] = titleAndDescription.(map[string]interface{})["title"]
+				result["policyDescription"] = titleAndDescription.(map[string]interface{})["description"]
+			}
+			violations = append(violations, result)
+		}
+		if len(violations) == 0 {
+			continue
+		}
+		p.Object["results"] = violations
+		allViolations = append(allViolations, p.Object)
+	}
+	return allViolations, nil
+}
+
+func createPoliciesTitleAndDescriptionMap(client *Client) (map[string]interface{}, error) {
+	clusterPoliciesMetadata, err := client.ListPolicies(context.Background(), "ClusterPolicy", client.DynamicInterface, client.RestMapper)
+	if err != nil {
+		return nil, err
+	}
+	policiesTitleAndDDescription := map[string]interface{}{}
+	for _, p := range clusterPoliciesMetadata {
+		metadata := p.Object["metadata"].(map[string]interface{})
+		if annotations, ok := metadata["annotations"]; ok {
+			annotationsMap := annotations.(map[string]interface{})
+			title := ""
+			description := ""
+			if annotationsMap["policies.kyverno.io/title"] != nil {
+				title = annotationsMap["policies.kyverno.io/title"].(string)
+			}
+			if annotationsMap["policies.kyverno.io/description"] != nil {
+				description = annotationsMap["policies.kyverno.io/description"].(string)
+			}
+			policiesTitleAndDDescription[p.GetName()] = map[string]interface{}{
+				"title":       title,
+				"description": description,
+			}
+
+		}
+	}
+	return policiesTitleAndDDescription, nil
+}
+
+func getKubeClient() (*Client, error) {
+	config, err := ctrl.GetConfig()
+	if err != nil {
+		return nil, err
+	}
+	dynamicInterface, err := dynamic.NewForConfig(config)
+	if err != nil {
+		return nil, err
+	}
+	kube, err := kubernetes.NewForConfig(config)
+	if err != nil {
+		return nil, err
+	}
+	groupResources, err := restmapper.GetAPIGroupResources(kube.Discovery())
+	if err != nil {
+		return nil, err
+	}
+	restMapper := restmapper.NewDiscoveryRESTMapper(groupResources)
+
+	client := Client{
+		restMapper,
+		dynamicInterface,
+	}
+	return &client, nil
+}
+
+func (c *Client) ListPolicies(ctx context.Context, resourceType string, dynamicClient dynamic.Interface, restMapper meta.RESTMapper) ([]unstructured.Unstructured, error) {
+	gvr, err := restMapper.ResourceFor(schema.GroupVersionResource{
+		Resource: resourceType,
+	})
+	if err != nil {
+		return nil, err
+	}
+	list, err := dynamicClient.Resource(gvr).List(ctx, metav1.ListOptions{})
+	if err != nil {
+		return nil, err
+	}
+	return list.Items, nil
+}

plugins/kyverno/go.mod

@@ -0,0 +1,70 @@
+module github.com/fairwindsops/insights-plugins/plugins/kyverno
+
+go 1.22.1
+
+require (
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/emicklei/go-restful/v3 v3.11.3 // indirect
+	github.com/evanphx/json-patch v5.9.0+incompatible // indirect
+	github.com/evanphx/json-patch/v5 v5.9.0 // indirect
+	github.com/fsnotify/fsnotify v1.7.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/go-openapi/jsonpointer v0.20.3 // indirect
+	github.com/go-openapi/jsonreference v0.20.5 // indirect
+	github.com/go-openapi/swag v0.22.10 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+	github.com/google/gnostic-models v0.6.9-0.20230804172637-c7be7c783f49 // indirect
+	github.com/google/go-cmp v0.6.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/imdario/mergo v0.3.16 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/prometheus/client_golang v1.19.1 // indirect
+	github.com/prometheus/client_model v0.6.1 // indirect
+	github.com/prometheus/common v0.55.0 // indirect
+	github.com/prometheus/procfs v0.15.1 // indirect
+	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	go.uber.org/zap v1.27.0 // indirect
+	golang.org/x/exp v0.0.0-20240222234643-814bf88cf225 // indirect
+	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	k8s.io/apiextensions-apiserver v0.31.0 // indirect
+	k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 // indirect
+)
+
+require (
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/fairwindsops/insights-plugins/plugins/opa v0.0.0-20240909133638-8a9b3e6f456f
+	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/sirupsen/logrus v1.9.3
+	golang.org/x/net v0.26.0 // indirect
+	golang.org/x/oauth2 v0.21.0 // indirect
+	golang.org/x/sys v0.21.0 // indirect
+	golang.org/x/term v0.21.0 // indirect
+	golang.org/x/text v0.16.0 // indirect
+	golang.org/x/time v0.5.0 // indirect
+	google.golang.org/protobuf v1.34.2 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	k8s.io/api v0.31.0 // indirect
+	k8s.io/apimachinery v0.31.0
+	k8s.io/client-go v0.31.0
+	k8s.io/klog/v2 v2.130.1 // indirect
+	k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 // indirect
+	sigs.k8s.io/controller-runtime v0.19.0
+	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
+	sigs.k8s.io/yaml v1.4.0 // indirect
+)