Merge pull request #354 from acc-jon/master

Allow configuration of global policy config, fix some typos

pkg/cli/init.go

@@ -18,7 +18,6 @@ package cli
 
 import (
 	"github.com/accurics/terrascan/pkg/initialize"
-	"github.com/accurics/terrascan/pkg/logging"
 	"github.com/spf13/cobra"
 	"go.uber.org/zap"
 )
@@ -34,10 +33,6 @@ Initializes Terrascan and clones policies from the Terrascan GitHub repository.
 }
 
 func initial(cmd *cobra.Command, args []string) {
-
-	// initialize logger
-	logging.Init(LogType, LogLevel)
-
 	// initialize terrascan
 	if err := initialize.Run(); err != nil {
 		zap.S().Error("failed to initialize terrascan")

pkg/cli/register.go

@@ -21,6 +21,8 @@ import (
 	"fmt"
 	"os"
 
+	"github.com/accurics/terrascan/pkg/config"
+	"github.com/accurics/terrascan/pkg/logging"
 	"github.com/spf13/cobra"
 )
 
@@ -57,6 +59,14 @@ func Execute() {
 	rootCmd.PersistentFlags().StringVarP(&OutputType, "output", "o", "yaml", "output type (json, yaml, xml)")
 	rootCmd.PersistentFlags().StringVarP(&ConfigFile, "config-path", "c", "", "config file path")
 
+	// Function to execute before processing commands
+	cobra.OnInitialize(func() {
+		// Set up the logger
+		logging.Init(LogType, LogLevel)
+		// Make sure we load the global config from the specified config file
+		config.LoadGlobalConfig(ConfigFile)
+	})
+
 	// parse the flags but hack around to avoid exiting with error code 2 on help
 	// override usage so that flag.Parse uses root command's usage instead of default one when invoked with -h
 	flag.Usage = func() {

pkg/config/configfile.go

@@ -0,0 +1,60 @@
+/*
+    Copyright (C) 2020 Accurics, Inc.
+
+	Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
+
+		http://www.apache.org/licenses/LICENSE-2.0
+
+	Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+*/
+
+package config
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/pelletier/go-toml"
+	"go.uber.org/zap"
+)
+
+var (
+	// ErrTomlLoadConfig indicates error: Failed to load toml config
+	ErrTomlLoadConfig = fmt.Errorf("failed to load toml config")
+	// ErrNotPresent indicates error: Config file not present
+	ErrNotPresent = fmt.Errorf("config file not present")
+)
+
+// LoadConfig loads a configuration from specified path and
+// returns a *toml.Tree with the contents of the config file
+func LoadConfig(configFile string) (*toml.Tree, error) {
+
+	// empty config file path
+	if configFile == "" {
+		zap.S().Debug("no config file specified")
+		return nil, nil
+	}
+
+	// check if file exists
+	_, err := os.Stat(configFile)
+	if err != nil {
+		zap.S().Errorf("Can't find '%s'", configFile)
+		return nil, ErrNotPresent
+	}
+
+	// parse toml config file
+	config, err := toml.LoadFile(configFile)
+	if err != nil {
+		zap.S().Errorf("Error loading '%s': %v", configFile, err)
+		return nil, ErrTomlLoadConfig
+	}
+
+	// return config Tree
+	return config, nil
+}

pkg/config/global.go

@@ -17,26 +17,101 @@
 package config
 
 import (
+	"fmt"
+	"github.com/pelletier/go-toml"
+	"go.uber.org/zap"
 	"os"
 )
 
 const (
-	policyRepoURL = "https://github.com/accurics/terrascan.git"
-	policyBranch  = "master"
+	policyRepoURL    = "https://github.com/accurics/terrascan.git"
+	policyBranch     = "master"
+	configEnvvarName = "TERRASCAN_CONFIG"
+	policyConfigKey  = "policy"
 )
 
 var (
-	policyRepoPath = os.Getenv("HOME") + "/.terrascan"
-	policyBasePath = policyRepoPath + "/pkg/policies/opa/rego"
+	policyRepoPath       = os.Getenv("HOME") + "/.terrascan"
+	policyBasePath       = policyRepoPath + "/pkg/policies/opa/rego"
+	errTomlKeyNotPresent = fmt.Errorf("%s key not present in toml config", policyConfigKey)
 )
 
 func init() {
+	// If the user specifies a config file in TERRASCAN_CONFIG,
+	// overwrite the defaults with the values from that file.
+	// Retain the defaults for members not specified in the file.
+	LoadGlobalConfig(os.Getenv(configEnvvarName))
+}
+
+// LoadGlobalConfig loads policy configuration from specified configFile
+// into var Global.Policy.  Members of Global.Policy that are not specified
+// in configFile will get default values
+func LoadGlobalConfig(configFile string) {
+	// Start with the defaults
 	Global.Policy = PolicyConfig{
 		BasePath: policyBasePath,
 		RepoPath: policyRepoPath,
 		RepoURL:  policyRepoURL,
 		Branch:   policyBranch,
 	}
+
+	if len(configFile) > 0 {
+		p, err := loadConfigFile(configFile)
+		if err != nil {
+			zap.S().Error(err)
+			return
+		}
+		if len(p.Policy.BasePath) > 0 {
+			Global.Policy.BasePath = p.Policy.BasePath
+		}
+		if len(p.Policy.RepoPath) > 0 {
+			Global.Policy.RepoPath = p.Policy.RepoPath
+		}
+		if len(p.Policy.RepoURL) > 0 {
+			Global.Policy.RepoURL = p.Policy.RepoURL
+		}
+		if len(p.Policy.Branch) > 0 {
+			Global.Policy.Branch = p.Policy.Branch
+		}
+	}
+}
+
+func loadConfigFile(configFile string) (GlobalConfig, error) {
+	p := GlobalConfig{}
+
+	config, err := LoadConfig(configFile)
+	if err != nil {
+		return p, ErrNotPresent
+	}
+
+	keyConfig := config.Get(policyConfigKey)
+	if keyConfig == nil {
+		return p, errTomlKeyNotPresent
+	}
+
+	keyTomlConfig := keyConfig.(*toml.Tree)
+
+	// We want to treat missing keys as empty strings
+	str := func(x interface{}) string {
+		if x == nil {
+			return ""
+		}
+		return x.(string)
+	}
+
+	// path = path where repo will be checked out
+	p.Policy.BasePath = str(keyTomlConfig.Get("path"))
+
+	// repo_url = git url to policy repository
+	p.Policy.RepoURL = str(keyTomlConfig.Get("repo_url"))
+
+	// rego_subdir = subdir of <path> where rego files are located
+	p.Policy.RepoPath = str(keyTomlConfig.Get("rego_subdir"))
+
+	// branch = git branch where policies are stored
+	p.Policy.Branch = str(keyTomlConfig.Get("branch"))
+
+	return p, nil
 }
 
 // GetPolicyBasePath returns policy base path as set in global config

pkg/config/global_test.go

@@ -0,0 +1,51 @@
+/*
+    Copyright (C) 2020 Accurics, Inc.
+
+	Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
+
+		http://www.apache.org/licenses/LICENSE-2.0
+
+	Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+*/
+
+package config
+
+import (
+	"testing"
+)
+
+func testConfigEnv(configPath string, t *testing.T) {
+	// Load the test data to compare against
+	config, err := loadConfigFile(configPath)
+	if err != nil {
+		t.Error(err)
+	}
+
+	LoadGlobalConfig(configPath)
+
+	if Global.Policy.BasePath != config.Policy.BasePath {
+		t.Errorf("BasePath not overridden!  %v != %v", Global.Policy.BasePath, config.Policy.BasePath)
+	}
+
+	if Global.Policy.RepoPath != config.Policy.RepoPath {
+		t.Errorf("RepoPath not overridden!  %v != %v", Global.Policy.RepoPath, config.Policy.RepoPath)
+	}
+
+	if Global.Policy.RepoURL != config.Policy.RepoURL {
+		t.Errorf("RepoURL not overridden!  %v != %v", Global.Policy.RepoURL, config.Policy.RepoURL)
+	}
+
+	if Global.Policy.Branch != config.Policy.Branch {
+		t.Errorf("Branch not overridden!  %v != %v", Global.Policy.Branch, config.Policy.Branch)
+	}
+}
+
+func TestConfigFileLoadsCorrectly(t *testing.T) {
+	testConfigEnv("./testdata/terrascan-config.toml", t)
+}

pkg/config/testdata/terrascan-config.toml

@@ -0,0 +1,5 @@
+[policy]
+path = "custom-path"
+rego_subdir = "rego-subdir"
+repo_url = "https://repository/url"
+branch = "branch-name"

pkg/notifications/notifiers.go

@@ -18,9 +18,9 @@ package notifications
 
 import (
 	"fmt"
-	"os"
 	"reflect"
 
+	"github.com/accurics/terrascan/pkg/config"
 	"github.com/accurics/terrascan/pkg/utils"
 	"github.com/pelletier/go-toml"
 	"go.uber.org/zap"
@@ -31,9 +31,7 @@ const (
 )
 
 var (
-	errNotPresent           = fmt.Errorf("config file not present")
 	errNotifierNotSupported = fmt.Errorf("notifier not supported")
-	errTomlLoadConfig       = fmt.Errorf("failed to load toml config")
 	errTomlKeyNotPresent    = fmt.Errorf("key not present in toml config")
 )
 
@@ -56,24 +54,9 @@ func NewNotifiers(configFile string) ([]Notifier, error) {
 
 	var notifiers []Notifier
 
-	// empty config file path
-	if configFile == "" {
-		zap.S().Debug("no config file specified")
-		return notifiers, nil
-	}
-
-	// check if file exists
-	_, err := os.Stat(configFile)
-	if err != nil {
-		zap.S().Errorf("config file '%s' not present", configFile)
-		return notifiers, errNotPresent
-	}
-
-	// parse toml config file
-	config, err := toml.LoadFile(configFile)
-	if err != nil {
-		zap.S().Errorf("failed to load toml config file '%s'. error: '%v'", err)
-		return notifiers, errTomlLoadConfig
+	config, err := config.LoadConfig(configFile)
+	if err != nil || config == nil {
+		return notifiers, err
 	}
 
 	// get config for 'notifications'

pkg/notifications/notifiers_test.go

@@ -4,6 +4,7 @@ import (
 	"reflect"
 	"testing"
 
+	"github.com/accurics/terrascan/pkg/config"
 	"github.com/accurics/terrascan/pkg/notifications/webhook"
 )
 
@@ -51,12 +52,12 @@ func TestNewNotifiers(t *testing.T) {
 		{
 			name:       "config not present",
 			configFile: "notthere",
-			wantErr:    errNotPresent,
+			wantErr:    config.ErrNotPresent,
 		},
 		{
 			name:       "invalid toml",
 			configFile: "testdata/invalid.toml",
-			wantErr:    errTomlLoadConfig,
+			wantErr:    config.ErrTomlLoadConfig,
 		},
 		{
 			name:       "key not present",

pkg/runtime/executor_test.go

@@ -21,6 +21,7 @@ import (
 	"reflect"
 	"testing"
 
+	"github.com/accurics/terrascan/pkg/config"
 	iacProvider "github.com/accurics/terrascan/pkg/iac-providers"
 	"github.com/accurics/terrascan/pkg/iac-providers/output"
 	tfv12 "github.com/accurics/terrascan/pkg/iac-providers/terraform/v12"
@@ -226,7 +227,7 @@ func TestInit(t *testing.T) {
 				iacVersion: "v12",
 				configFile: "./testdata/does-not-exist",
 			},
-			wantErr:         fmt.Errorf("config file not present"),
+			wantErr:         config.ErrNotPresent,
 			wantIacProvider: &tfv12.TfV12{},
 		},
 		{

pkg/writer/writer.go

@@ -32,7 +32,7 @@ func Write(format string, data interface{}, writer io.Writer) error {
 
 	writerFunc, present := writerMap[supportedFormat(format)]
 	if !present {
-		zap.S().Error("output format '%s' not supported", format)
+		zap.S().Errorf("output format '%s' not supported", format)
 		return errNotSupported
 	}
 

scripts/validate-gofmt.sh

@@ -16,6 +16,7 @@ bad_files=$(find_files | xargs gofmt -d -s 2>&1)
 if [[ -n "${bad_files}" ]]; then
   echo "${bad_files}" >&2
   echo >&2
-  echo "fix gofmt errors by running:\n./hack/fix-gofmt.sh" >&2
+  echo "fix gofmt errors by running:" >&2
+  echo "./scripts/fix-gofmt.sh" >&2
   exit 1
 fi