Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Rule class #21

Merged
merged 14 commits into from
Mar 31, 2023
Merged

Rule class #21

merged 14 commits into from
Mar 31, 2023

Conversation

dorukozturk
Copy link
Contributor

Issue #, if available:

Description of changes:

  1. Implemented a Rule class for easier extension of rules
  2. Created a consolidated view of rules
  3. Filtered out false positives with cluster roles
  4. Added an option to export json

Screen Shot 2023-03-16 at 10 32 10 AM

@dorukozturk dorukozturk mentioned this pull request Mar 16, 2023
Copy link
Contributor

@joshkurz joshkurz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Really excellent PR. Nice Job!

namespace_based_results = harden(resources, rules, "namespace_based")
results = results + namespace_based_results

print_consolidated_results(results)

if export_txt:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we want users to be able to add all three export options at once? Or do we only want to allow one at a time?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it is ok for them to do all three export at once? I did it that way assuming if someone needs to see different outputs but run the tool only once

@@ -39,184 +37,216 @@ def _get_policy_documents_for_role(role_name, iam_client):
return actions


def check_any_cluster_autoscaler_exists(resources: Resources):
class check_any_cluster_autoscaler_exists(Rule):
_type = "cluster_wide"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So I really like this method of setting the metadata. I'm wondering, should we take it further and put this into the config? each test we run in the config would have its own set of metadata? Possibly could allow for extensions that users could write on their own.

Just a thought maybe another iteration we do something like that.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

definitely. That is where I was going :) This is to make the extension easier.

@dorukozturk dorukozturk merged commit ca82039 into main Mar 31, 2023
@dorukozturk dorukozturk deleted the rule-class branch March 31, 2023 18:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants