From 41f89dd03a92c0b8f9b9263df0a9fae89b85e949 Mon Sep 17 00:00:00 2001 From: npecka Date: Mon, 25 Oct 2021 11:31:07 -0400 Subject: [PATCH 1/4] WIP: Add check for too many of a kind Signed-off-by: npecka --- docs/generated/checks.md | 16 ++++++++++++++++ docs/generated/templates.md | 14 ++++++++++++++ 2 files changed, 30 insertions(+) diff --git a/docs/generated/checks.md b/docs/generated/checks.md index 045f79491..c17f7ab05 100644 --- a/docs/generated/checks.md +++ b/docs/generated/checks.md @@ -530,6 +530,22 @@ KubeLinter includes the following built-in checks: {"port":22,"protocol":"TCP"} ``` +## too-many-of-a-kind + +**Enabled by default**: Yes + +**Description**: Indicates when too many of a single kind exist within a cluster + +**Remediation**: Ensure to not have duplicate's of a single kind + +**Template**: [Too many kind](generated/templates.md#too-many-kind) + +**Parameters**: + +````json +{} +```` + ## unsafe-proc-mount **Enabled by default**: No diff --git a/docs/generated/templates.md b/docs/generated/templates.md index 3d2baf3f8..a988b006b 100644 --- a/docs/generated/templates.md +++ b/docs/generated/templates.md @@ -699,6 +699,20 @@ KubeLinter supports the following templates: ] ``` +## Too many kind + +**Key**: `too-many-of-a-kind` + +**Description**: Flag containers that have duplicates of a single kind + +**Supported Objects**: DeploymentLike + +**Parameters**: + +```json +[] +``` + ## Unsafe Proc Mount **Key**: `unsafe-proc-mount` From 838b1570c8d4d1d8eff9b08e10e028d6fd6aaba8 Mon Sep 17 00:00:00 2001 From: npecka Date: Mon, 25 Oct 2021 13:29:12 -0400 Subject: [PATCH 2/4] Renamed check Signed-off-by: npecka --- docs/generated/checks.md | 4 ++-- docs/generated/templates.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/generated/checks.md b/docs/generated/checks.md index c17f7ab05..44770a643 100644 --- a/docs/generated/checks.md +++ b/docs/generated/checks.md @@ -530,7 +530,7 @@ KubeLinter includes the following built-in checks: {"port":22,"protocol":"TCP"} ``` -## too-many-of-a-kind +## duplicate-kinds **Enabled by default**: Yes @@ -538,7 +538,7 @@ KubeLinter includes the following built-in checks: **Remediation**: Ensure to not have duplicate's of a single kind -**Template**: [Too many kind](generated/templates.md#too-many-kind) +**Template**: [Duplicate Kinds](generated/templates.md#duplicate-kinds) **Parameters**: diff --git a/docs/generated/templates.md b/docs/generated/templates.md index a988b006b..98399fca5 100644 --- a/docs/generated/templates.md +++ b/docs/generated/templates.md @@ -699,9 +699,9 @@ KubeLinter supports the following templates: ] ``` -## Too many kind +## Duplicate Kinds -**Key**: `too-many-of-a-kind` +**Key**: `duplicate-kinds` **Description**: Flag containers that have duplicates of a single kind From 58119a5841bec309e282e7272be52529e7c70fc4 Mon Sep 17 00:00:00 2001 From: npecka Date: Mon, 25 Oct 2021 13:32:56 -0400 Subject: [PATCH 3/4] Added built in check Signed-off-by: npecka --- docs/generated/checks.md | 4 ++-- docs/generated/templates.md | 2 +- pkg/builtinchecks/yamls/duplicate-kinds.yaml | 7 +++++++ 3 files changed, 10 insertions(+), 3 deletions(-) create mode 100644 pkg/builtinchecks/yamls/duplicate-kinds.yaml diff --git a/docs/generated/checks.md b/docs/generated/checks.md index 44770a643..03254519a 100644 --- a/docs/generated/checks.md +++ b/docs/generated/checks.md @@ -534,9 +534,9 @@ KubeLinter includes the following built-in checks: **Enabled by default**: Yes -**Description**: Indicates when too many of a single kind exist within a cluster +**Description**: Indicates when too many of a kind exist within a cluster -**Remediation**: Ensure to not have duplicate's of a single kind +**Remediation**: Ensure to not have duplicate's of a kind **Template**: [Duplicate Kinds](generated/templates.md#duplicate-kinds) diff --git a/docs/generated/templates.md b/docs/generated/templates.md index 98399fca5..1f85e44ab 100644 --- a/docs/generated/templates.md +++ b/docs/generated/templates.md @@ -703,7 +703,7 @@ KubeLinter supports the following templates: **Key**: `duplicate-kinds` -**Description**: Flag containers that have duplicates of a single kind +**Description**: Flag containers that have duplicates of a kind **Supported Objects**: DeploymentLike diff --git a/pkg/builtinchecks/yamls/duplicate-kinds.yaml b/pkg/builtinchecks/yamls/duplicate-kinds.yaml new file mode 100644 index 000000000..44d4e16a5 --- /dev/null +++ b/pkg/builtinchecks/yamls/duplicate-kinds.yaml @@ -0,0 +1,7 @@ +name: "duplicate-kinds" +description: "Indicates when too many of a kind exist within a cluster" +remediation: "Ensure to not have duplicate's of a kind" +scope: + objectKinds: + - DeploymentLike +template: "duplicate-kinds" \ No newline at end of file From 7b43af9739b6b095e254ffb636e0bd0325a1eb09 Mon Sep 17 00:00:00 2001 From: npecka Date: Mon, 25 Oct 2021 16:22:05 -0400 Subject: [PATCH 4/4] Added logic for figuring out kinds Signed-off-by: npecka --- .../duplicatekinds/internal/params/params.go | 5 ++ pkg/templates/duplicatekinds/template.go | 60 +++++++++++++++++++ 2 files changed, 65 insertions(+) create mode 100644 pkg/templates/duplicatekinds/internal/params/params.go create mode 100644 pkg/templates/duplicatekinds/template.go diff --git a/pkg/templates/duplicatekinds/internal/params/params.go b/pkg/templates/duplicatekinds/internal/params/params.go new file mode 100644 index 000000000..578cc3aa8 --- /dev/null +++ b/pkg/templates/duplicatekinds/internal/params/params.go @@ -0,0 +1,5 @@ +package params + +// Params represents the params accepted by this template. +type Params struct { +} diff --git a/pkg/templates/duplicatekinds/template.go b/pkg/templates/duplicatekinds/template.go new file mode 100644 index 000000000..eb9703ca7 --- /dev/null +++ b/pkg/templates/duplicatekinds/template.go @@ -0,0 +1,60 @@ +package duplicatekinds + + +import ( + "fmt" + + "golang.stackrox.io/kube-linter/pkg/check" + "golang.stackrox.io/kube-linter/pkg/config" + "golang.stackrox.io/kube-linter/pkg/diagnostic" + "golang.stackrox.io/kube-linter/pkg/extract" + "golang.stackrox.io/kube-linter/pkg/lintcontext" + "golang.stackrox.io/kube-linter/pkg/objectkinds" + "golang.stackrox.io/kube-linter/pkg/templates" + "golang.stackrox.io/kube-linter/pkg/templates/duplicatekinds/internal/params" + v1 "k8s.io/api/core/v1" +) + +type kindStruct struct{ + str string + num int +} + +/*{ + {"deployment", 0}, + {"daemonset", 0}, + {"statefulset", 0}, + {"service", 0}, +}*/ + +func checkKindDuplicate(){ + +} + +func init() { + templates.Register(check.Template{ + HumanName: "Duplicate Kind found", + Key: "duplicate-kinds", + Description: "Flag when too many of a kind exist within a cluster", + SupportedObjectKinds: config.ObjectKindsDesc{ + ObjectKinds: []string{objectkinds.*}, + }, + Parameters: params.ParamDescs, + ParseAndValidateParams: params.ParseAndValidate, + Instantiate: params.WrapInstantiateFunc(func(_ params.Params) (check.Func, error) { + return func(_ lintcontext.LintContext, object lintcontext.Object) []diagnostic.Diagnostic { + kind, found := object.K8sObject.(*v1.kind) + if !found { + return nil + } + var results []diagnostic.Diagnostic + for _, duplicatekinds := range p.ForbiddenServiceTypes { + if strings.EqualFold(string(service.Spec.Type), servicetype) { + results = append(results, diagnostic.Diagnostic{Message: fmt.Sprintf("%q Duplicate Kind found.", duplicatekinds)}) + } + } + return results + }, nil + }), + }) +}