Add Kubescape to packages management for easier installation

[dwertent]

Songlin Jiang (@HollowMan6) is an LFX mentee for the Kubescape project for Term 1 2023.

The primary goal is to ensure that when a new release is made in this repo, the most commonly used installation methods are available:

• Overall & curl | bash:
  • Provide ARM64 release binaries #195
  • kubescape installed in first directory in $PATH under $HOME #1015
• Homebrew (Working, with bugs:)
  • Package manager support: homebrew #1014
• krew (Complete, with bugs:)
  • can't install Kubescape with krew on Apple Silicon Mac #1112
• apt/deb, for Debian and Ubuntu (New)
  • Package manager support: deb #1143
• yum/RPM, for Red Hat and SUSE (New)
  • Package manager support: RPM #1142

A second deliverable may include support for some other useful formats:

• Chocolatey
• Scoop
• nixpkgs
• Any fixes required to the kubescape Docker container

The third phase will involve improvements to the Helm components, if time allows.

[avinashupadhya99]

Isn't brew already supported in https://github.com/armosec/homebrew-kubescape ?

[dwertent]

@avinashupadhya99 It is, but we are having issues with it as you noticed 😏

[Atharva-Shinde]

@dwertent I'm down to fix this issue. So, what exactly needs to be done to fix this and where could I possibly start?

[glunkad]

Hi @dwertent ,
I'm interested in contributing to this issue, so before I start working
it, would you mind sparing your time explaining what the issue is about and pointing me to some resources to get started.

[rahulsurwade08]

Hey @dwertent , I am interested to contribute in this issue. How can i get started?

[ryuusama09]

hi @dwertent , I want to fix this issue, please tell me where exactly can i start from and what needs to be possibly done ?

[Csrivastava003]

Hey, I would like to work on this issue!

[craigbox]

Thank you to everyone who has expressed an interest in packaging kubescape.

Homebrew support is underway again, so the outstanding actions are Debian and Red Hat packages.

If you're interested in getting started, please look at:

• Debian Packaging For The Modern Developer
• RPM Packaging Guide

The correct integration would probably be a GitHub Action to generate new debs/rpms on each release.

If you're interested in contributing either package, please create an issue and link back to this one. I'll link your issue to the description.

[0saurabh0]

Hi @craigbox I'm very interesting on working on this issue as previously, I've worked with bash scripts.
I do have one question though, are the RPM and DEB packages going to be GitHub release?

[craigbox]

This issue is being submitted for the 2023 Mar-May LFX Mentorship program.

We've specified an end state. It will be up to the mentee selected for the project to come up with the design proposal on how to get there! The integration would definitely be with our current release pipeline which is driven by GitHub.

[HollowMan6]

Hi community! I would like to apply for the 2023 Mar-May LFX Mentorship program to resolve this issue. I have completed my initial investigation and here's my proposal. Any feedback is welcomed.
I have tried packaging both the rpm and the Debian packages for demoing by using the binary from kubescape-ubuntu-latest.tar.gz and building directly from the source code. Here is the packaging scripts' source code. I have packed the auto-completion for bash, zsh and fish besides the main program. In addition, I have added a test to ensure that the binary we built during the packaging process can run and have the correct version with git enabled in the build. I have also written a GitHub Actions workflow for automating the whole process with both rpm and deb in both amd64 and arm64 (so #195 will also get resolved). You can get the build artifacts from binary directly and from source code.

For distributing the packages, of course, we can build that manually, just like one of my previous projects. However, I highly recommend openSUSE's open build service (OBS). I have also created a demo. OBS allows easy distribution of the packages. Users can add a repository according to the guide here. The Linux package manager in their system will ensure that users can get the update quickly. One thing to note is that OBS doesn't support Internet connections when building, so it can't fetch dependencies directly from the Internet. As a result, I pre-fetch the dependencies and used golang vendor build mode to resolve the dependencies issue. Now OBS supports operating systems such as Debian, Ubuntu, Fedora, Mageia, openSUSE, and SLE, with architectures like x86_64, aarch64, i586, s390x, armv6l, armv7l, and ppc64le. What is more, I have also uploaded the packages to Ubuntu PPA, so users can easily configure the repository for Ubuntu's package manager.

The work I would do during the mentorship will include adding more tests to ensure the packaging is OK. I would also integrate the OBS repository update feature (automate osc addremove *; osc commit) into the workflow. Finally, I will integrate the GitHub Actions workflow into the release workflow of kubescape.

Thank you!

[0saurabh0]

@HollowMan6 I think you have to propose all of that in your application.

[HollowMan6]

@HollowMan6 I think you have to propose all of that in your application.

Yes, I will. I post here just to receive feedback, like if there're any potential things that I didn't cover.

[craigbox]

(For the record, every time I see your handle I sing this song in my head 😊)

That seems like a good scope of work, and depending on how quickly it was completed, I would look to applying similar rigour to platforms such as Nix, krew, and our client container (used by a GitHub action to run Kubescape).

[HollowMan6]

Thank you for your feedback! I think I can manage to add kubescape to platforms such as Nix, krew, and also the client container with similar rigour. I have experience maintaining several nixpkgs as well, and I would only need to figure out how to add kubescape into krew when all the others are completed. Looking forward to working with you!

[matthyx]

Krew is already being handled. Thanks for your help!

[HollowMan6]

I would look to applying similar rigour to platforms such as Nix, krew, and our client container (used by a GitHub action to run Kubescape)

I can see that actually kubescape is already available in nixpkgs. Then just as mentioned, krew has already been handled, the docker container is also available, I will try my best to see if there are any room for improvement once the rpm and deb work have been completed as proposed.

[HollowMan6]

Let's close this as everything mentioned on this issue is done, and I have graduated from LFX. 😊