Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(bicep): make ARM AKS checks compatible with Bicep #3836

Merged
merged 2 commits into from
Nov 10, 2022
Merged

fix(bicep): make ARM AKS checks compatible with Bicep #3836

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
06f6d95
make ARM AKS checks compatible with Bicep
gruebel Nov 9, 2022
2c8f747
fix linting
gruebel Nov 10, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions checkov/arm/base_resource_check.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResul
return CheckResult.UNKNOWN

self.api_version = conf["api_version"]
conf["config"]["apiVersion"] = conf["api_version"] # set for better reusability of existing ARM checks

return self.scan_resource_conf(conf["config"], entity_type)

Expand Down
3 changes: 1 addition & 2 deletions checkov/arm/checks/resource/AKSApiServerAuthorizedIpRanges.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@

from checkov.common.models.enums import CheckResult, CheckCategories
from checkov.arm.base_resource_check import BaseResourceCheck
from checkov.common.parsers.node import DictNode


class AKSApiServerAuthorizedIpRanges(BaseResourceCheck):
Expand Down Expand Up @@ -32,7 +31,7 @@ def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult:
else:
# ApiServerAuthorizedIpRanges fully supported in all future API versions
properties = conf.get('properties')
if not properties or not isinstance(properties, DictNode):
if not properties or not isinstance(properties, dict):
return CheckResult.FAILED
api_server_access_profile = properties.get('apiServerAccessProfile')
if not api_server_access_profile:
Expand Down
7 changes: 3 additions & 4 deletions checkov/arm/checks/resource/AKSDashboardDisabled.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@

from checkov.common.models.enums import CheckResult, CheckCategories
from checkov.arm.base_resource_check import BaseResourceCheck
from checkov.common.parsers.node import DictNode


class AKSDashboardDisabled(BaseResourceCheck):
Expand All @@ -23,13 +22,13 @@ def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult:
return CheckResult.FAILED

properties = conf.get("properties")
if properties is None or not isinstance(properties, DictNode):
if properties is None or not isinstance(properties, dict):
return CheckResult.FAILED
addon_profiles = conf["properties"].get("addonProfiles")
if not isinstance(addon_profiles, DictNode):
if not isinstance(addon_profiles, dict):
return CheckResult.FAILED
kube_dashboard = addon_profiles.get("kubeDashboard")
if not isinstance(kube_dashboard, DictNode):
if not isinstance(kube_dashboard, dict):
return CheckResult.FAILED
enabled = kube_dashboard.get("enabled")
if enabled is not None and str(enabled).lower() == "false":
Expand Down
3 changes: 1 addition & 2 deletions checkov/arm/checks/resource/AKSNetworkPolicy.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@

from checkov.common.models.enums import CheckResult, CheckCategories
from checkov.arm.base_resource_check import BaseResourceCheck
from checkov.common.parsers.node import DictNode


class AKSNetworkPolicy(BaseResourceCheck):
Expand All @@ -23,7 +22,7 @@ def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult:
return CheckResult.FAILED

properties = conf.get('properties')
if not properties or not isinstance(properties, DictNode):
if not properties or not isinstance(properties, dict):
return CheckResult.FAILED
network_profile = properties.get('networkProfile')
if not network_profile:
Expand Down
3 changes: 1 addition & 2 deletions checkov/arm/checks/resource/AKSRbacEnabled.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@

from checkov.common.models.enums import CheckResult, CheckCategories
from checkov.arm.base_resource_check import BaseResourceCheck
from checkov.common.parsers.node import DictNode


class AKSRbacEnabled(BaseResourceCheck):
Expand All @@ -23,7 +22,7 @@ def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult:
return CheckResult.FAILED

properties = conf.get('properties')
if not properties or not isinstance(properties, DictNode):
if not properties or not isinstance(properties, dict):
return CheckResult.FAILED
enable_RBAC = properties.get('enableRBAC')
if str(enable_RBAC).lower() == "true":
Expand Down
98 changes: 98 additions & 0 deletions tests/bicep/checks/resource/azure/example_AKSApiServerAuthorizedIpRanges/main.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,98 @@
// pass

resource enabled 'Microsoft.ContainerService/managedClusters@2022-08-03-preview' = {
name: 'string'
location: resourceGroup().location
identity: {
type: 'SystemAssigned'
}
properties: {
enableRBAC: true
agentPoolProfiles: [
{
name: 'agentpool'
osDiskSizeGB: osDiskSizeGB
osSKU: 'Ubuntu'
osType: 'Linux'
}
]
addonProfiles: {
omsagent: {
config: {
logAnalyticsWorkspaceResourceID: logAnalyticsWorkspace.id
}
enabled: true
}
kubeDashboard: {
enabled: false
}
}
apiServerAccessProfile: {
authorizedIPRanges: [
'10.0.0.0/8'
]
}
networkProfile: {
networkPlugin: 'azure'
networkPolicy: 'azure'
}
linuxProfile: {
adminUsername: linuxAdminUsername
ssh: {
publicKeys: [
{
keyData: sshRSAPublicKey
}
]
}
}
}
}

// fail

resource default 'Microsoft.ContainerService/managedClusters@2022-08-03-preview' = {
name: 'string'
location: resourceGroup().location
identity: {
type: 'SystemAssigned'
}
properties: {
agentPoolProfiles: [
{
name: 'agentpool'
osDiskSizeGB: osDiskSizeGB
osSKU: 'Ubuntu'
osType: 'Linux'
}
]
addonProfiles: {
omsagent: {
config: {
logAnalyticsWorkspaceResourceID: logAnalyticsWorkspace.id
}
enabled: true
}
kubeDashboard: {
enabled: false
}
}
apiServerAccessProfile: {
disableRunCommand: true
}
networkProfile: {
networkPlugin: 'azure'
networkPolicy: 'azure'
}
linuxProfile: {
adminUsername: linuxAdminUsername
ssh: {
publicKeys: [
{
keyData: sshRSAPublicKey
}
]
}
}
}
}
95 changes: 95 additions & 0 deletions tests/bicep/checks/resource/azure/example_AKSDashboardDisabled/main.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,95 @@
// pass

resource enabled 'Microsoft.ContainerService/managedClusters@2022-08-03-preview' = {
name: 'string'
location: resourceGroup().location
identity: {
type: 'SystemAssigned'
}
properties: {
enableRBAC: true
agentPoolProfiles: [
{
name: 'agentpool'
osDiskSizeGB: osDiskSizeGB
osSKU: 'Ubuntu'
osType: 'Linux'
}
]
addonProfiles: {
omsagent: {
config: {
logAnalyticsWorkspaceResourceID: logAnalyticsWorkspace.id
}
enabled: true
}
kubeDashboard: {
enabled: false
}
}
apiServerAccessProfile: {
authorizedIPRanges: [
'10.0.0.0/8'
]
}
networkProfile: {
networkPlugin: 'azure'
networkPolicy: 'azure'
}
linuxProfile: {
adminUsername: linuxAdminUsername
ssh: {
publicKeys: [
{
keyData: sshRSAPublicKey
}
]
}
}
}
}

// fail

resource default 'Microsoft.ContainerService/managedClusters@2022-08-03-preview' = {
name: 'string'
location: resourceGroup().location
identity: {
type: 'SystemAssigned'
}
properties: {
agentPoolProfiles: [
{
name: 'agentpool'
osDiskSizeGB: osDiskSizeGB
osSKU: 'Ubuntu'
osType: 'Linux'
}
]
addonProfiles: {
omsagent: {
config: {
logAnalyticsWorkspaceResourceID: logAnalyticsWorkspace.id
}
enabled: true
}
}
apiServerAccessProfile: {
disableRunCommand: true
}
networkProfile: {
networkPlugin: 'azure'
networkPolicy: 'azure'
}
linuxProfile: {
adminUsername: linuxAdminUsername
ssh: {
publicKeys: [
{
keyData: sshRSAPublicKey
}
]
}
}
}
}
92 changes: 92 additions & 0 deletions tests/bicep/checks/resource/azure/example_AKSLoggingEnabled/main.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,92 @@
// pass

resource enabled 'Microsoft.ContainerService/managedClusters@2022-08-03-preview' = {
name: 'string'
location: resourceGroup().location
identity: {
type: 'SystemAssigned'
}
properties: {
enableRBAC: true
agentPoolProfiles: [
{
name: 'agentpool'
osDiskSizeGB: osDiskSizeGB
osSKU: 'Ubuntu'
osType: 'Linux'
}
]
addonProfiles: {
omsagent: {
config: {
logAnalyticsWorkspaceResourceID: logAnalyticsWorkspace.id
}
enabled: true
}
kubeDashboard: {
enabled: false
}
}
apiServerAccessProfile: {
authorizedIPRanges: [
'10.0.0.0/8'
]
}
networkProfile: {
networkPlugin: 'azure'
networkPolicy: 'azure'
}
linuxProfile: {
adminUsername: linuxAdminUsername
ssh: {
publicKeys: [
{
keyData: sshRSAPublicKey
}
]
}
}
}
}

// fail

resource default 'Microsoft.ContainerService/managedClusters@2022-08-03-preview' = {
name: 'string'
location: resourceGroup().location
identity: {
type: 'SystemAssigned'
}
properties: {
agentPoolProfiles: [
{
name: 'agentpool'
osDiskSizeGB: osDiskSizeGB
osSKU: 'Ubuntu'
osType: 'Linux'
}
]
addonProfiles: {
kubeDashboard: {
enabled: false
}
}
apiServerAccessProfile: {
disableRunCommand: true
}
networkProfile: {
networkPlugin: 'azure'
networkPolicy: 'azure'
}
linuxProfile: {
adminUsername: linuxAdminUsername
ssh: {
publicKeys: [
{
keyData: sshRSAPublicKey
}
]
}
}
}
}
Loading