feat: Add the debugging ability for scanning Helm chart #1215
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
amirmalka
previously requested changes
May 3, 2023
dwertent
requested changes
Jun 5, 2023
There was a problem hiding this comment.
Thank you for this great work!
Here are my few comments:
- I see there are some linter issues, please resolve them
- We are missing here unit tests. Please add unit tests to the
cautilspackage and to theSARIFprinter. - Please keep your fork up-to-date with the master
- Please attach an example of the output. I suggest you set up a repository with a helm chart and a GitHub workflow so we can test this properly
- Please update the PR description
MMMMMMorty
changed the title
MMMMMMorty
changed the title
|
@MMMMMMorty can you rebase? |
Yes, I can do that. |
MMMMMMorty
force-pushed
the
master
branch
2 times, most recently
from
bf066e0
to
c6d0e48
Compare
|
@MMMMMMorty please notice the tests failed |
Yes, I noticed that. I guess it is the part in unit test, I will change them. |
MMMMMMorty
force-pushed
the
master
branch
6 times, most recently
from
49f3aa1
to
9bb1173
Compare
MMMMMMorty
force-pushed
the
master
branch
2 times, most recently
from
7ea6f4c
to
17d9323
Compare
MMMMMMorty
force-pushed
the
master
branch
5 times, most recently
from
48c25db
to
e2ffaf7
Compare
|
This is a great contribution that we would like to merge to Kubescape.
example
|
|
@dwertent For the printing problem, I will fix it soon. For the panic problem, I guess it mainly because I haven't updated this feature for a long time, I will fix it, too. |
|
Thank you! You can reproduce the panic by running |
Signed-off-by: MMMMMMorty <465346562@qq.com>
Signed-off-by: mmmmmmorty <mmmmmmorty@outlook.com>
Signed-off-by: mmmmmmorty <mmmmmmorty@outlook.com>
Signed-off-by: mmmmmmorty <mmmmmmorty@outlook.com>
Signed-off-by: mmmmmmorty <mmmmmmorty@outlook.com>
Signed-off-by: mmmmmmorty <mmmmmmorty@outlook.com>
Signed-off-by: mmmmmmorty <mmmmmmorty@outlook.com>
dwertent
previously approved these changes
Mar 1, 2024
Signed-off-by: mmmmmmorty <mmmmmmorty@outlook.com>
matthyx
approved these changes
Mar 1, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Overview
Mapping struct is defined in. 'mappingnode.go'. Three mapping objects are used, the connection among them is that one MappingNode represents one line in one template, MappingNodes represents one template, FileMapping represents one file, and one file can contain many template.
GetMapping function in GetWorkLoads function is to call yqlib package to form the FileMapping, which is the most important part.
Adding one more output FileMapping for GetWorkLoads function and change all the related functions which call it.
After that, I connect the Filemappingwith sarif Printer. After connecting, I can use the mapping to generate correct location and fixed object for helm chart.
Additional Information
Kubescape can scan helm chart files, however, Helm does not give information about which output line is coming from which input line.
For kubescape, there is no backward connection to the original sources file after the chart was templated.
More than that, Kubescape cannot not produce correct fixes for Helm charts.
How to Test
I have created the unit tests for filemapping in helmchart.go and sarif report.
In addition, I created a Github-action repository where I change docker image to my branch image, so I could test and use my branch there.
Examples
Here is the result example, the report format is sarif.
report.sarif.txt
For the helm chart object, it has correct locations and recommended fix objects