add support for validating admission webhook in terrascan #620

kanchwala-yusuf · 2021-03-16T07:48:56Z

No description provided.

codecov · 2021-03-17T11:40:29Z

Codecov Report

Merging #620 (1911323) into master (6103c45) will decrease coverage by 2.67%.
The diff coverage is 57.59%.

@@            Coverage Diff             @@
##           master     #620      +/-   ##
==========================================
- Coverage   78.09%   75.41%   -2.68%     
==========================================
  Files         104      109       +5     
  Lines        2597     3002     +405     
==========================================
+ Hits         2028     2264     +236     
- Misses        422      570     +148     
- Partials      147      168      +21

Impacted Files	Coverage Δ
pkg/http-server/server.go	`100.00% <ø> (ø)`
pkg/http-server/start.go	`0.00% <0.00%> (ø)`
pkg/http-server/webhook-scan-logs.go	`0.00% <0.00%> (ø)`
pkg/utils/tempfile.go	`40.00% <40.00%> (ø)`
pkg/http-server/webhook-scan.go	`70.00% <70.00%> (ø)`
pkg/cli/server.go	`50.00% <75.00%> (+30.00%)`	⬆️
pkg/k8s/dblogs/webhook-scan-logger.go	`78.18% <78.18%> (ø)`
pkg/k8s/admission-webhook/validating-webhook.go	`81.48% <81.48%> (ø)`
pkg/config/config-reader.go	`86.95% <100.00%> (+0.59%)`	⬆️
pkg/http-server/handler.go	`100.00% <100.00%> (ø)`
... and 7 more

pkg/http-server/start.go

docs/getting-started/admission-controller-webhooks-usage.md

pkg/http-server/webhook-scan-logs.go

pkg/cli/server.go

pkg/http-server/webhook-scan-logs.go

pkg/http-server/webhook-scan.go

pkg/http-server/webhook-scan_test.go

pkg/k8s/admission-webhook/validating-webhook.go

pkg/k8s/admission-webhook/validating-webhook_test.go

docs/getting-started/admission-controller-webhooks-usage.md

devang-gaur · 2021-03-31T11:00:14Z

pkg/http-server/handler.go

-	return &APIHandler{}
+func NewAPIHandler(configFile string) *APIHandler {
+	return &APIHandler{
+		configFile: configFile,


we should change this logic. the configFile is loaded in the LoadGlobalConfig( ) call. by the cli framework itself here https://github.com/accurics/terrascan/blob/master/pkg/cli/register.go#L44

The config file changes are quite significant and can be handled as separate PR. adding those changes in this PR would just increase the bulk of this PR.

If you are okay, we can open a separate issue for this and address it as a part of it.

Sure. let's tackle this refactor seperately.

I'll also create one for helm charts.

pkg/http-server/start.go

devang-gaur · 2021-03-31T11:36:44Z

pkg/http-server/routes.go

@@ -29,13 +29,19 @@ type Route struct {

 // Routes returns a slice of routes of API endpoints to be registered with
 // http server
-func (g *APIServer) Routes() []*Route {
-	h := NewAPIHandler()
+func (g *APIServer) Routes(configFile string) []*Route {


and ofcourse we'll have to change the function a bit.. to consume the config values... config package can be used directly.

devang-gaur · 2021-03-31T11:36:57Z

pkg/http-server/routes.go

-func (g *APIServer) Routes() []*Route {
-	h := NewAPIHandler()
+func (g *APIServer) Routes(configFile string) []*Route {
+	h := NewAPIHandler(configFile)


same for this function

jlk

Overall LGTM. Wouldn't mind changing that CSS file, though.

pkg/http-server/templates/show.html

jlk · 2021-04-06T18:24:09Z

pkg/k8s/admission-webhook/validating-webhook.go

+		result   runtime.Output
+	)
+
+	if flag.Lookup("test.v") != nil {


Not looking for a change, but this feels strange as almost all the code uses Cobra...

patilpankaj212

LGTM!
We should add e2e tests for admission webhook later.

… package

Co-authored-by: Devang Gaur <devang.gaur@accurics.com>

devang-gaur

requested a small change in docs

docs/getting-started/admission-controller-webhooks-usage.md

sonarcloud · 2021-04-08T11:22:33Z

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
1 Security Hotspot
5 Code Smells

No Coverage information
0.0% Duplication

kanchwala-yusuf force-pushed the feature/k8s-validating-webhooks branch 3 times, most recently from d813f8f to a439fea Compare March 17, 2021 11:33

kanchwala-yusuf force-pushed the feature/k8s-validating-webhooks branch 4 times, most recently from 9f19b92 to f8106b9 Compare March 19, 2021 17:36

devang-gaur reviewed Mar 20, 2021

View reviewed changes

pkg/http-server/start.go Show resolved Hide resolved

cesar-rodriguez suggested changes Mar 21, 2021

View reviewed changes

docs/getting-started/admission-controller-webhooks-usage.md Show resolved Hide resolved

kanchwala-yusuf force-pushed the feature/k8s-validating-webhooks branch 2 times, most recently from 71126ca to 61162e2 Compare March 31, 2021 03:46

patilpankaj212 suggested changes Mar 31, 2021

View reviewed changes

devang-gaur suggested changes Mar 31, 2021

View reviewed changes

kanchwala-yusuf force-pushed the feature/k8s-validating-webhooks branch from df17b05 to 8bca20e Compare April 5, 2021 04:06

jlk previously approved these changes Apr 6, 2021

View reviewed changes

kanchwala-yusuf dismissed jlk’s stale review via 7a9d195 April 7, 2021 05:15

kanchwala-yusuf requested review from cesar-rodriguez, patilpankaj212 and devang-gaur April 7, 2021 06:52

patilpankaj212 previously approved these changes Apr 7, 2021

View reviewed changes

Yusuf Kanchwala added 9 commits April 7, 2021 20:21

add support for k8s validating webhooks

7c2c870

add cert and key file paths flags in server command

fa10ba9

add support to accept API server port from user

a5b4e5c

update API path for validating webhook

0ecddb2

fix goimports for k8s webhook files

eae0b64

add support for reading port from env variable

8df7693

refactor to move k8s specific methods into a dedicated package

3a24795

remove API key from webhook logs url

ad8f796

use AdmissionWebhook interface

1d5e6bc

Yusuf Kanchwala and others added 19 commits April 7, 2021 20:21

fixing html file for fetching all logs

e8f9dac

adding some unit tests

bfb84a2

refactor to move db logger into a separate dedicated package

be2255f

refactor validate handler to move specific functionality into webhook…

66fc76e

… package

making staticcheck happy

6a1cbef

improve error message send as part of kubernetes admission response

0f67bb1

fixing unit tests for http server

09e55dc

go mod tidy

ffad7ad

adding review comments

ef75299

sonar linter fixes

6863010

fixing code smells and bugs in UI

bdb11b5

trying to make sonar lint happy

5bb303c

fixing html file bugs

90b8429

Update docs/getting-started/admission-controller-webhooks-usage.md

056a9f2

Co-authored-by: Devang Gaur <devang.gaur@accurics.com>

Update pkg/http-server/start.go

0ef2a8d

Co-authored-by: Devang Gaur <devang.gaur@accurics.com>

fixing documentation bullets

e405999

updating documentation

d9e2a71

fix: admission request is saved in db logs

f31634c

fixing go mod files

a53ce45

kanchwala-yusuf dismissed patilpankaj212’s stale review via a53ce45 April 7, 2021 14:53

kanchwala-yusuf force-pushed the feature/k8s-validating-webhooks branch from 7a9d195 to a53ce45 Compare April 7, 2021 14:53

serving the CSS locally instead of fetching from internet

8d82d90

devang-gaur suggested changes Apr 8, 2021

View reviewed changes

docs/getting-started/admission-controller-webhooks-usage.md Outdated Show resolved Hide resolved

accommodating review comments on documentation

1911323

kanchwala-yusuf requested a review from devang-gaur April 8, 2021 12:18

cesar-rodriguez approved these changes Apr 8, 2021

View reviewed changes

devang-gaur approved these changes Apr 8, 2021

View reviewed changes

patilpankaj212 approved these changes Apr 12, 2021

View reviewed changes

patilpankaj212 merged commit dcfbd54 into tenable:master Apr 12, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

add support for validating admission webhook in terrascan #620

add support for validating admission webhook in terrascan #620

kanchwala-yusuf commented Mar 16, 2021

codecov bot commented Mar 17, 2021 •

edited

Loading

devang-gaur Mar 31, 2021

kanchwala-yusuf Apr 6, 2021

devang-gaur Apr 8, 2021

devang-gaur Mar 31, 2021

devang-gaur Mar 31, 2021

jlk left a comment

jlk Apr 6, 2021

patilpankaj212 left a comment

devang-gaur left a comment

sonarcloud bot commented Apr 8, 2021

add support for validating admission webhook in terrascan #620

add support for validating admission webhook in terrascan #620

Conversation

kanchwala-yusuf commented Mar 16, 2021

codecov bot commented Mar 17, 2021 • edited Loading

Codecov Report

devang-gaur Mar 31, 2021

Choose a reason for hiding this comment

kanchwala-yusuf Apr 6, 2021

Choose a reason for hiding this comment

devang-gaur Apr 8, 2021

Choose a reason for hiding this comment

devang-gaur Mar 31, 2021

Choose a reason for hiding this comment

devang-gaur Mar 31, 2021

Choose a reason for hiding this comment

jlk left a comment

Choose a reason for hiding this comment

jlk Apr 6, 2021

Choose a reason for hiding this comment

patilpankaj212 left a comment

Choose a reason for hiding this comment

devang-gaur left a comment

Choose a reason for hiding this comment

sonarcloud bot commented Apr 8, 2021

codecov bot commented Mar 17, 2021 •

edited

Loading