fix: update kubelet checks via kubelet config resource (#87)

* fix: kubelet checks via config resource Signed-off-by: chenk <[email protected]> * fix: kubelet checks via config resource Signed-off-by: chenk <[email protected]> * fix: kubelet checks via config resource Signed-off-by: chenk <[email protected]> --------- Signed-off-by: chenk <[email protected]>
aquasecurity · Dec 20, 2023 · 9bde47f · 9bde47f
1 parent 46290db
commit 9bde47f
Show file tree

Hide file tree

Showing 3 changed files with 67 additions and 1 deletion.
diff --git a/job.yaml b/job.yaml
@@ -14,6 +14,7 @@ spec:
  - name: node-collector
  image: ghcr.io/aquasecurity/node-collector:0.0.9
  command: ["node-collector"]
+ args: ["k8s", "--node", "minikube"]
  volumeMounts:
  - name: var-lib-etcd
  mountPath: /var/lib/etcd

diff --git a/pkg/collector/collect.go b/pkg/collector/collect.go
@@ -1,13 +1,29 @@
 package collector
 
 import (
+ "context"
+ "encoding/json"
+ "errors"
  "fmt"
+ "log"
  "os"
  "time"
 
  "github.com/spf13/cobra"
 )
 
+var configMapper = map[string]string{
+ "kubeletAnonymousAuthArgumentSet": "authentication.anonymous.enabled",
+ "kubeletAuthorizationModeArgumentSet": "authorization.mode",
+ "kubeletClientCaFileArgumentSet": "authentication.x509.clientCAFile",
+ "kubeletReadOnlyPortArgumentSet": "readOnlyPort",
+ "kubeletStreamingConnectionIdleTimeoutArgumentSet": "streamingConnectionIdleTimeout",
+ "kubeletProtectKernelDefaultsArgumentSet": "kernelMemcgNotification",
+ "kubeletMakeIptablesUtilChainsArgumentSet": "makeIPTablesUtilChains",
+ "kubeletEventQpsArgumentSet": "eventRecordQPS",
+ "kubeletRotateKubeletServerCertificateArgumentSet": "featureGates.RotateKubeletServerCertificate",
+}
+
 type SpecVersion struct {
  Name string
  Version string
@@ -22,10 +38,19 @@ var platfromSpec = map[string]SpecVersion{
 
 // CollectData run spec audit command and output it result data
 func CollectData(cmd *cobra.Command, target string) error {
+ log.SetFlags(log.LstdFlags | log.Lmicroseconds)
  cluster, err := GetCluster()
  if err != nil {
  return err
  }
+ ctx, cancel := context.WithTimeout(cmd.Context(), time.Duration(10)*time.Minute)
+ defer cancel()
+
+ defer func() {
+ if errors.Is(err, context.DeadlineExceeded) {
+ log.Println("Increase --timeout value")
+ }
+ }()
  p, err := cluster.Platfrom()
  if err != nil {
  return err
@@ -61,6 +86,12 @@ func CollectData(cmd *cobra.Command, target string) error {
  values := StringToArray(output, ",")
  nodeInfo[ci.Key] = &Info{Values: values}
  }
+ nodeName := cmd.Flag("node").Value.String()
+ configVal, err := getValuesFromkubeletConfig(ctx, nodeName, *cluster)
+ if err != nil {
+ return err
+ }
+ mergeConfigValues(nodeInfo, configVal)
  nodeData := Node{
  APIVersion: Version,
  Kind: Kind,
@@ -69,7 +100,7 @@ func CollectData(cmd *cobra.Command, target string) error {
  Info: nodeInfo,
  }
  outputFormat := cmd.Flag("output").Value.String()
- err := printOutput(nodeData, outputFormat, os.Stdout)
+ err = printOutput(nodeData, outputFormat, os.Stdout)
  if err != nil {
  return err
  }
@@ -80,3 +111,36 @@ func CollectData(cmd *cobra.Command, target string) error {
 func specByPlatfromVersion(platfrom string, version string) SpecVersion {
  return platfromSpec[fmt.Sprintf("%s-%s", platfrom, platfrom)]
 }
+
+func getValuesFromkubeletConfig(ctx context.Context, nodeName string, cluster Cluster) (map[string]*Info, error) {
+ overrideConfig := make(map[string]*Info)
+ data, err := cluster.clientSet.RESTClient().Get().AbsPath(fmt.Sprintf("/api/v1/nodes/%s/proxy/configz", nodeName)).DoRaw(ctx)
+ if err != nil {
+ return nil, err
+ }
+ nodeConfig := make(map[string]interface{})
+ err = json.Unmarshal(data, &nodeConfig)
+ if err != nil {
+ return nil, err
+ }
+ values := nodeConfig["kubeletconfig"]
+ for k, v := range configMapper {
+ p := values
+ splittedValues := StringToArray(v, ".")
+ for _, sv := range splittedValues {
+ next := p.(map[string]interface{})
+ if k, ok := next[sv.(string)]; ok {
+ p = k
+ }
+ }
+ overrideConfig[k] = &Info{Values: []interface{}{p}}
+ }
+ return overrideConfig, nil
+}
+
+func mergeConfigValues(configValues map[string]*Info, overrideConfig map[string]*Info) map[string]*Info {
+ for k, v := range overrideConfig {
+ configValues[k] = v
+ }
+ return configValues
+}
diff --git a/pkg/command/root.go b/pkg/command/root.go
@@ -11,6 +11,7 @@ func init() {
  rootCmd.PersistentFlags().StringP("output", "o", "json", "Output format. One of table|json")
  rootCmd.PersistentFlags().StringP("spec", "s", "cis", " spec name. default: cis")
  rootCmd.PersistentFlags().StringP("version", "v", "1.23", "spec version. default: 1.23")
+ rootCmd.PersistentFlags().StringP("node", "n", "minikube", "node name. default: minikube")
 }
 
 var rootCmd = &cobra.Command{