Add Support for Services (#353)

Co-authored-by: Dani <santos.adaniele@gmail.com>

internal/k8sinternal/client.go

@@ -101,6 +101,7 @@ func GetAllResources(clientset kubernetes.Interface, options ClientOptions) []k8
 	resources = append(resources, GetCronJobs(clientset, options)...)
 	resources = append(resources, GetServiceAccounts(clientset, options)...)
 	resources = append(resources, GetNamespaces(clientset, options)...)
+	resources = append(resources, GetServices(clientset, options)...)
 
 	resources = excludeGenerated(resources)
 
@@ -325,6 +326,25 @@ func GetNamespaces(clientset kubernetes.Interface, options ClientOptions) []k8s.
 	return namespaces
 }
 
+// GetServices gets all Service resources from a namespace in a cluster
+func GetServices(clientset kubernetes.Interface, option ClientOptions) []k8s.Resource {
+	serviceClient := clientset.CoreV1().Services(option.Namespace)
+	listOptions := k8s.ListOptionsV1{}
+
+	serviceList, err := serviceClient.List(context.Background(), listOptions)
+
+	if err != nil {
+		log.Error(err)
+		return nil
+	}
+	services := make([]k8s.Resource, 0, len(serviceList.Items))
+	for _, s := range serviceList.Items {
+		s.TypeMeta = k8s.NewService().TypeMeta
+		services = append(services, (&s).DeepCopyObject())
+	}
+	return services
+}
+
 // GetKubernetesVersion returns the kubernetes client version
 func GetKubernetesVersion(clientset kubernetes.Interface) (*version.Info, error) {
 	discoveryClient := clientset.Discovery()

internal/k8sinternal/client_test.go

@@ -79,6 +79,7 @@ func TestGetAllResources(t *testing.T) {
 		k8s.NewPodTemplate(),
 		k8s.NewCronJob(),
 		k8s.NewServiceAccount(),
+		k8s.NewService(),
 	}
 	namespaces := []string{"foo", "bar"}
 

internal/test/fixtures/service.yml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: test-service
+spec:
+  selector:
+    app: test-service
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 9376
+  clusterIP: 10.0.171.239
+  type: LoadBalancer

internal/test/fixtures/unknown_resource_type.yml

@@ -0,0 +1,14 @@
+apiVersion: networking.k8s.io
+kind: Ingress
+metadata:
+  name: unknown_resource_type
+spec:
+  rules:
+  - http:
+      paths:
+      - path: /test-unknownpath
+        backend:
+          service:
+            name: test-unknown
+            port:
+              number: 80

kubeaudit_test.go

@@ -63,7 +63,7 @@ func TestAuditCluster(t *testing.T) {
 
 func TestUnknownResource(t *testing.T) {
 	// Make sure we produce only warning results for resources kubeaudit doesn't know how to audit
-	files := []string{"unknown_type_v1.yml", "custom_resource_definition.yml"}
+	files := []string{"unknown_resource_type.yml", "custom_resource_definition.yml"}
 
 	allAuditors, err := all.Auditors(config.KubeauditConfig{})
 	require.NoError(t, err)

pkg/k8s/helpers.go

@@ -81,6 +81,8 @@ func GetObjectMeta(resource Resource) *ObjectMetaV1 {
 		return &kubeType.ObjectMeta
 	case *ServiceAccountV1:
 		return &kubeType.ObjectMeta
+	case *ServiceV1:
+		return &kubeType.ObjectMeta
 	}
 
 	return nil

pkg/k8s/resources.go

@@ -137,3 +137,14 @@ func NewServiceAccount() *ServiceAccountV1 {
 		ObjectMeta: ObjectMetaV1{},
 	}
 }
+
+// NewService creates a new Service resource
+func NewService() *ServiceV1 {
+	return &ServiceV1{
+		TypeMeta: TypeMetaV1{
+			Kind:       "Service",
+			APIVersion: "v1",
+		},
+		ObjectMeta: ObjectMetaV1{},
+	}
+}

pkg/k8s/types.go

@@ -109,6 +109,9 @@ type SecurityContextV1 = apiv1.SecurityContext
 // ServiceAccountV1 is a type alias for the v1 version of the k8s API.
 type ServiceAccountV1 = apiv1.ServiceAccount
 
+// ServiceV1 is a type alias for the v1 version of the k8s API.
+type ServiceV1 = apiv1.Service
+
 // StatefulSetSpecV1 is a type alias for the v1 version of the k8s apps API.
 type StatefulSetSpecV1 = appsv1.StatefulSetSpec
 
@@ -136,6 +139,7 @@ func IsSupportedResourceType(obj Resource) bool {
 		*PodTemplateV1,
 		*ReplicationControllerV1,
 		*ServiceAccountV1,
+		*ServiceV1,
 		*StatefulSetV1, *StatefulSetV1Beta1:
 		return true
 	default: