feat: add kubescape patch command #1332

anubhav06 · 2023-08-04T19:15:25Z

Overview

Add kubescape patch command

Additional Information

The kubescape patch command can be used to patch container images with vulnerabilities.
It uses copa and buildkit under the hood for patching the images, and grype as its engine for scanning the images (at the moment)
The detailed documentation for this command can be found here.

TODO

Replace anubhav06/copacetic with project-copacetic/copacetic, when the copa team accepts the kubescape and copa integration support PR.

Usage

sudo buildkitd & 
sudo kubescape patch --image <image-name>

The patch command can also be run without sudo privileges. Refer to the documentation here.

Examples/Screenshots

Run sudo buildkitd in a separate terminal

Run sudo kubescape patch --image docker.io/library/nginx:1.22:

cc @craigbox @dwertent

Related issues/PRs:

Resolved #1227

Checklist before requesting a review

put an [x] in the box to get it checked

My code follows the style guidelines of this project
I have commented on my code, particularly in hard-to-understand areas
I have performed a self-review of my code
If it is a core feature, I have added thorough tests.
New and existing unit tests pass locally with my changes

Signed-off-by: Anubhav Gupta <mail.anubhav06@gmail.com>

ghost · 2023-08-04T19:16:15Z

👇 Click on the image for a new way to code review

Legend

craigbox · 2023-08-08T08:34:38Z

At the present, there's no assertion of levels of support in Kubescape. Everything just "is", in the most part.
I have proposed that we introduce feature gates (with the same syntax as the Kubernetes API server) in order to be able to only include Alpha or Labs-level features if someone enables a feature gate.

The alternative would be keeping it in a separate branch, which would require keeping it in sync, and making builds from it if we wanted anyone to actually use it.

/cc @rotemamsa

anubhav06 · 2023-08-09T13:02:17Z

The former sounds better to me. So this will be merged later, when the feature gates have been introduced, right?

dwertent · 2023-08-09T14:17:45Z

@anubhav06 Please pull from the master branch and run the kubescape scan image command.
This might help you to understand how Kubescape scans images (and there is no reason to develop another "image scanning" mechanism in Kubescape).
Also, you will see the CLI output, it is essential we keep it aligned.

What do you think?

…patch-cmd

Signed-off-by: Anubhav Gupta <mail.anubhav06@gmail.com>

anubhav06 · 2023-08-21T19:48:01Z

@dwertent I've updated the output to align with that of image scan command (screenshot in PR desc).
I've also removed the "image scanning" logic I'd added for results handling.
Please let me know if this is what's expected and if any other changes are required.

Daniel-GrunbergerCA · 2023-08-29T08:40:42Z

@anubhav06 This feature looks really cool and works smoothly! I'm very excited for this!

I have some general comments about the feature, which are mostly food for thought:

We should add the image name to the kubescape patch follow-up step (which is printed at the end)
Maybe we should add to the output some comparison between the old image and the new one, so it will become clear to the user the value he is getting from the patch command
Do we need to print the entire copa output? I think is best to have it in debug mode only
We shouldn't use the -r flag. We have the -f flag, where we can specify JSON output
Maybe the commands should be kubescape image scan and kubescape image patch

cc: @craigbox @dwertent

core/core/patch.go

cmd/patch/patch.go

core/pkg/resultshandling/printer/v2/jsonprinter.go

cmd/patch/patch.go

core/pkg/resultshandling/printer/v2/prettyprinter/utils.go

anubhav06 · 2023-08-29T15:43:01Z

@Daniel-GrunbergerCA Thanks! To answer your questions:

Even I agree with that. I had done that only previously (screenshot here). But since, David said that the output should align with that of the image scan command, I removed that.
Alright. So I'll try to remove the output of copa to STDOUT and display it only when running with debug mode, and see how it looks. (Personally I believe that it looks good right now, the way it is, because by default the user can see what's happening: copa is building the image, installing the pkg and exporting to docker). But yes, I'll try to do it the way you said and let's see how it looks.

Daniel-GrunbergerCA · 2023-08-30T06:50:12Z

You can wait with that, let's see what @craigbox and @dwertent think

dwertent · 2023-08-30T18:38:46Z

@Daniel-GrunbergerCA I think it is a good suggestion, but still, I believe we should print only the latest state so we don't overwhelm the terminal. Also, this way we can have the same function for printing the image scan command and image patch command.
As I'm writing this reply, I'm thinking we can print just the summary of the old image, but we can save this to the future.
Thenk you @anubhav06 . The reason Daniel asked to "hide" the logs is because it does not look good when using two different loggers when running a single command. I suggest we should use the spinner (form the kubescape logger repo) instead of printing the copa logs. I'm aware that we are less "verbose", but for now I think it's better :)

In general, thank you @anubhav06 for this PR!
Please merge the changes that have been pushed to the main so we will be able to properly test your PR before accepting it :)

Signed-off-by: Anubhav Gupta <mail.anubhav06@gmail.com>

…patch-cmd

anubhav06 · 2023-09-01T05:00:33Z

changes: (updated screenshot in PR desc)

By default, copa's output (logs) will not be shown.
If a user wants to see copa's logs, run kubescape in debug mode ( --logger='debug')
removed the --report flag as it was redundant & was not providing any real value
moved normalize_image_name from opaprocessor pkg to cautils pkg
removed the "try patching your image with..." text (for now)

dwertent · 2023-09-01T05:30:17Z

core/pkg/opaprocessor/utils.go

@@ -106,6 +106,6 @@ var imageNameNormalizeDefinition = func(bctx rego.BuiltinContext, a *ast.Term) (
 	if err != nil {
 		return nil, fmt.Errorf("invalid parameter type: %v", err)
 	}
-	normalizedName, err := normalize_image_name(string(aStr))
+	normalizedName, err := cautils.Normalize_image_name(string(aStr))


@YiscahLevySilas1 can this affect the controls that are using this function?

I don't think it will affect them

dwertent · 2023-09-01T05:31:44Z

core/pkg/resultshandling/printer/v2/sarifprinter.go

@@ -116,12 +116,7 @@ func (sp *SARIFPrinter) printImageScan(scanResults *models.PresenterConfig) erro
 		return fmt.Errorf("no no image vulnerability data provided")
 	}

-	presenterConfig, err := presenter.ValidatedConfig(printer.SARIFFormat, "", false)


was this accidentally removed?
cc @Daniel-GrunbergerCA

No. Because with the new version of grype, the previous syntax is not supported.
Similarly, in the jsonprinter, the ValidatedConfig method has been removed (here)

cmd/patch/README.md

core/cautils/normalize_image_name.go

core/core/patch.go

Signed-off-by: Anubhav Gupta <mail.anubhav06@gmail.com>

feat: add kubescape patch command

38aa8b0

Signed-off-by: Anubhav Gupta <mail.anubhav06@gmail.com>

dwertent requested review from vladklokun, craigbox and dwertent August 5, 2023 10:11

anubhav06 added 2 commits August 21, 2023 20:28

Merge branch 'master' of https://github.com/kubescape/kubescape into …

deff1c3

…patch-cmd

update patch command output format

18b4d3c

Signed-off-by: Anubhav Gupta <mail.anubhav06@gmail.com>

Daniel-GrunbergerCA reviewed Aug 29, 2023

View reviewed changes

core/core/patch.go Outdated Show resolved Hide resolved

cmd/patch/patch.go Outdated Show resolved Hide resolved

core/pkg/resultshandling/printer/v2/jsonprinter.go Outdated Show resolved Hide resolved

Daniel-GrunbergerCA reviewed Aug 29, 2023

View reviewed changes

cmd/patch/patch.go Outdated Show resolved Hide resolved

Daniel-GrunbergerCA reviewed Aug 29, 2023

View reviewed changes

core/pkg/resultshandling/printer/v2/prettyprinter/utils.go Outdated Show resolved Hide resolved

anubhav06 added 2 commits September 1, 2023 09:43

fix patch command logic

53f5667

Signed-off-by: Anubhav Gupta <mail.anubhav06@gmail.com>

Merge branch 'master' of https://github.com/kubescape/kubescape into …

7f889b8

…patch-cmd

dwertent reviewed Sep 1, 2023

View reviewed changes

dwertent requested a review from Daniel-GrunbergerCA September 1, 2023 05:32

Daniel-GrunbergerCA suggested changes Sep 4, 2023

View reviewed changes

dwertent changed the base branch from master to refactor-img-cmd September 4, 2023 06:38

update docs & minor changes

78ec661

Signed-off-by: Anubhav Gupta <mail.anubhav06@gmail.com>

anubhav06 force-pushed the patch-cmd branch from 121b573 to 78ec661 Compare September 4, 2023 07:33

Daniel-GrunbergerCA merged commit e091269 into kubescape:refactor-img-cmd Sep 4, 2023
8 checks passed

Daniel-GrunbergerCA mentioned this pull request Sep 4, 2023

Refactor image commands #1371

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add kubescape patch command #1332

feat: add kubescape patch command #1332

anubhav06 commented Aug 4, 2023 •

edited

Loading

ghost commented Aug 4, 2023 •

edited by ghost

Loading

Legend

craigbox commented Aug 8, 2023

anubhav06 commented Aug 9, 2023

dwertent commented Aug 9, 2023

anubhav06 commented Aug 21, 2023

Daniel-GrunbergerCA commented Aug 29, 2023 •

edited

Loading

anubhav06 commented Aug 29, 2023 •

edited

Loading

Daniel-GrunbergerCA commented Aug 30, 2023

dwertent commented Aug 30, 2023

anubhav06 commented Sep 1, 2023 •

edited

Loading

dwertent Sep 1, 2023

YiscahLevySilas1 Sep 3, 2023

dwertent Sep 1, 2023

anubhav06 Sep 1, 2023

feat: add kubescape patch command #1332

feat: add kubescape patch command #1332

Conversation

anubhav06 commented Aug 4, 2023 • edited Loading

Overview

Additional Information

TODO

Usage

Examples/Screenshots

Related issues/PRs:

Checklist before requesting a review

ghost commented Aug 4, 2023 • edited by ghost Loading

Legend

craigbox commented Aug 8, 2023

anubhav06 commented Aug 9, 2023

dwertent commented Aug 9, 2023

anubhav06 commented Aug 21, 2023

Daniel-GrunbergerCA commented Aug 29, 2023 • edited Loading

anubhav06 commented Aug 29, 2023 • edited Loading

Daniel-GrunbergerCA commented Aug 30, 2023

dwertent commented Aug 30, 2023

anubhav06 commented Sep 1, 2023 • edited Loading

dwertent Sep 1, 2023

Choose a reason for hiding this comment

YiscahLevySilas1 Sep 3, 2023

Choose a reason for hiding this comment

dwertent Sep 1, 2023

Choose a reason for hiding this comment

anubhav06 Sep 1, 2023

Choose a reason for hiding this comment

anubhav06 commented Aug 4, 2023 •

edited

Loading

ghost commented Aug 4, 2023 •

edited by ghost

Loading

Daniel-GrunbergerCA commented Aug 29, 2023 •

edited

Loading

anubhav06 commented Aug 29, 2023 •

edited

Loading

anubhav06 commented Sep 1, 2023 •

edited

Loading