✨ Adds "deprecated apis" auditor #428

jerr · 2022-05-24T02:56:38Z

Description

Fixes #408

Adds a new command deprecatedapis to find deprecated APIs of resources. It reports for all resources defined with a deprecated API the version since when it is deprecated the deprecated version, the version where is removed and suggests the recommended API.

Here's a sample result:

$ kubeaudit deprecatedapis -f "auditors/deprecatedapis/fixtures/cronjob.yml"

---------------- Results for ---------------
  apiVersion: batch/v1beta1
  kind: CronJob
  metadata:
    name: hello
--------------------------------------------
-- [warning] DeprecatedAPIUsed
   Message: batch/v1beta1 CronJob is deprecated in v1.21+, unavailable in v1.25+; use batch/v1 CronJob
   Metadata:
      DeprecatedMajor: 1
      DeprecatedMinor: 21
      RemovedMajor: 1
      RemovedMinor: 25
      ReplacementKind: CronJob
      ReplacementGroup: batch/v1

This PR also brings the possibility to audit any type of resource using the dynamic client.

Type of change

New feature ✨
This change requires a documentation update 📖

How Has This Been Tested?

Automated tests
Manual tests (local mode and manifest files)

Checklist:

I have 🎩 my changes (A 🎩 specifically includes pulling down changes, setting them up, and manually testing the changed features and potential side effects to make sure nothing is broken)
I have performed a self-review of my own code
I have made corresponding changes to the documentation
I have added tests that prove my fix is effective or that my feature works
New and existing unit tests pass locally with my changes
The test coverage did not decrease
I have signed the appropriate Contributor License Agreement

jerr · 2022-06-08T15:42:02Z

👆 rebased on the main branch

jerr · 2022-06-08T19:25:21Z

🎩 Manually tested with a file and a cluster with the `local` mode

- The help message:

$ ./kubeaudit deprecatedapis --help                                              
This command determines which resource is defined with a deprecated API version.

An ERROR result is generated for API version not available in the targeted version
A WARN result is generated for API version deprecated in the current version
An INFO result is generated for API version not yet deprecated in the current version

Example usage:
kubeaudit deprecatedapis
kubeaudit deprecatedapis --current-k8s-version 1.22 --targeted-k8s-version 1.24

Usage:
  kubeaudit deprecatedapis [flags]

Flags:
      --current-k8s-version string    Kubernetes current version (eg 1.22)
  -h, --help                          help for deprecatedapis
      --targeted-k8s-version string   Kubernetes version to migrate to (eg 1.24)

Global Flags:
  -e, --exitcode int         Exit code to use if there are results with severity of "error". Conventionally, 0 is used for success and all non-zero codes for an error. (default 2)
  -p, --format string        The output format to use (one of "pretty", "logrus", "json") (default "pretty")
  -g, --includegenerated     Include generated resources in scan  (eg. pods generated by deployments).
  -c, --kubeconfig string    Path to local Kubernetes config file. Only used in local mode (default is $HOME/.kube/config)
  -f, --manifest string      Path to the yaml configuration to audit. Only used in manifest mode.
  -m, --minseverity string   Set the lowest severity level to report (one of "error", "warning", "info") (default "info")
  -n, --namespace string     Only audit resources in the specified namespace. Not currently supported in manifest mode.

- Audit of a file

$ ./kubeaudit deprecatedapis   -f auditors/deprecatedapis/fixtures/cronjob.yml

---------------- Results for ---------------

  apiVersion: batch/v1beta1
  kind: CronJob
  metadata:
    name: hello

--------------------------------------------

-- [warning] DeprecatedAPIUsed
   Message: batch/v1beta1 CronJob is deprecated in v1.21+, unavailable in v1.25+; use batch/v1 CronJob
   Metadata:
      ReplacementKind: CronJob
      DeprecatedMajor: 1
      DeprecatedMinor: 21
      RemovedMajor: 1
      RemovedMinor: 25
      ReplacementGroup: batch/v1

- Audit a file with the `json` output format option

$ ./kubeaudit deprecatedapis   -f auditors/deprecatedapis/fixtures/cronjob.yml -p json | jq 
{
  "AuditResultName": "DeprecatedAPIUsed",
  "DeprecatedMajor": "1",
  "DeprecatedMinor": "21",
  "RemovedMajor": "1",
  "RemovedMinor": "25",
  "ReplacementGroup": "batch/v1",
  "ReplacementKind": "CronJob",
  "ResourceApiVersion": "batch/v1beta1",
  "ResourceKind": "CronJob",
  "ResourceName": "hello",
  "level": "warning",
  "msg": "batch/v1beta1 CronJob is deprecated in v1.21+, unavailable in v1.25+; use batch/v1 CronJob",
  "time": "2022-06-08T11:51:52-04:00"
}

- Audit a file for a specific targeted Kubernetes versions:

The API version is not available on for the targeted version, an error is reported.

$  ./kubeaudit deprecatedapis --targeted-k8s-version 1.25 -f auditors/deprecatedapis/fixtures/cronjob.yml

---------------- Results for ---------------

  apiVersion: batch/v1beta1
  kind: CronJob
  metadata:
    name: hello

--------------------------------------------

-- [error] DeprecatedAPIUsed
   Message: batch/v1beta1 CronJob is deprecated in v1.21+, unavailable in v1.25+; use batch/v1 CronJob
   Metadata:
      RemovedMajor: 1
      RemovedMinor: 25
      ReplacementGroup: batch/v1
      ReplacementKind: CronJob
      DeprecatedMajor: 1
      DeprecatedMinor: 21

- Audit a cluster with the `local` mode:

$ ./kubeaudit deprecatedapis 

---------------- Results for ---------------

  apiVersion: v1
  kind: ComponentStatus
  metadata:
    name: scheduler

--------------------------------------------

-- [warning] DeprecatedAPIUsed
   Message: v1 ComponentStatus is deprecated in v1.19+
   Metadata:
      DeprecatedMinor: 19
      DeprecatedMajor: 1
...

jerr · 2022-06-08T20:42:45Z

internal/k8sinternal/client.go

+	// Ignore warnings from kubeclient as they are expected to be reported by the deprecatedapi auditor.
+	kubeconfig.WarningHandler = rest.NoWarnings{}
+


This will hide warning messages such as the following:

W0608 12:04:51.010357 30221 warnings.go:70] v1 ComponentStatus is deprecated in v1.19+ W0608 12:04:54.355517 30221 warnings.go:70] extensions/v1beta1 Ingress is deprecated in v1.14+, unavailable in v1.22+; use networking.k8s.io/v1 Ingress

Kubeaudit has to use the deprecated APIs to include them in the deprecatedapis reports.
See https://kubernetes.io/blog/2020/09/03/warnings/#customize-client-handling

genevieveluyt

No major concerns though I would like to put this in the next release, so will approve / merge when the current release it out!

genevieveluyt · 2022-06-09T21:52:51Z

README.md

+| `apparmor`       | Finds containers running without AppArmor.                                                                     | [docs](docs/auditors/apparmor.md)       |
+| `asat`           | Finds pods using an automatically mounted default service account                                              | [docs](docs/auditors/asat.md)           |
+| `capabilities`   | Finds containers that do not drop the recommended capabilities or add new ones.                                | [docs](docs/auditors/capabilities.md)   |
+| `deprecatedapis` | Finds containers that do not drop the recommended capabilities or add new ones.                                | [docs](docs/auditors/deprecatedapis.md) |


The description looks copy/pasted from the capabilities auditor

Finds containers that do not drop the recommended capabilities or add new ones.

genevieveluyt · 2022-06-09T21:54:54Z

auditors/deprecatedapis/depreceatedapis.go

+	}, nil
+}
+
+type apiLifecycleDeprecated interface {


Could we maybe add a comment with a reference link for these functions? I assume they're defined somewhere in the kubernetes codebase?

genevieveluyt · 2022-06-09T21:55:06Z

auditors/deprecatedapis/depreceatedapis.go

+	APILifecycleReplacement() schema.GroupVersionKind
+}
+
+type apiLifecycleIntroduced interface {


Is this interface used anywhere?

genevieveluyt · 2022-06-09T21:55:16Z

auditors/deprecatedapis/depreceatedapis.go

+	APILifecycleIntroduced() (major, minor int)
+}
+
+// Audit checks that the resource API version is not deprecetated


Suggested change

// Audit checks that the resource API version is not deprecetated

// Audit checks that the resource API version is not deprecated

genevieveluyt · 2022-06-09T21:55:29Z

auditors/deprecatedapis/depreceatedapis.go

+	var auditResults []*kubeaudit.AuditResult
+	lastApplied, ok := k8s.GetAnnotations(resource)[v1.LastAppliedConfigAnnotation]
+	if ok && len(lastApplied) > 0 {
+		resource, _ = k8sinternal.DecodeResource([]byte(lastApplied))


Why are we ignoring this error?

genevieveluyt · 2022-06-09T21:58:46Z