feat: platfrom auto detect

.goreleaser.yaml

@@ -88,6 +88,7 @@ signs:
     certificate: "${artifact}.pem"
     args:
       - "sign-blob"
+      - "--yes"
       - "--oidc-issuer=https://token.actions.githubusercontent.com"
       - "--output-certificate=${certificate}"
       - "--output-signature=${signature}"
@@ -99,6 +100,7 @@ docker_signs:
   - cmd: cosign
     args:
       - "sign"
+      - "--yes"
       - "--oidc-issuer=https://token.actions.githubusercontent.com"
       - "${artifact}"
     artifacts: all

build/node-collector/Dockerfile

@@ -1,4 +1,5 @@
-FROM alpine:20230329
+FROM alpine:3.18.0
+RUN apk update && apk add --upgrade libcrypto3 libssl3
 
 COPY node-collector /usr/local/bin/node-collector
 

go.mod

@@ -7,12 +7,64 @@ require (
 	github.com/spf13/cobra v1.7.0
 	github.com/stretchr/testify v1.8.4
 	gopkg.in/yaml.v3 v3.0.1
+	k8s.io/apimachinery v0.27.3
+	k8s.io/cli-runtime v0.27.3
+	k8s.io/client-go v0.27.3
 )
 
 require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/emicklei/go-restful/v3 v3.9.0 // indirect
+	github.com/evanphx/json-patch v4.12.0+incompatible // indirect
+	github.com/go-errors/errors v1.4.2 // indirect
+	github.com/go-logr/logr v1.2.3 // indirect
+	github.com/go-openapi/jsonpointer v0.19.6 // indirect
+	github.com/go-openapi/jsonreference v0.20.1 // indirect
+	github.com/go-openapi/swag v0.22.3 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/google/btree v1.0.1 // indirect
+	github.com/google/gnostic v0.5.7-v3refs // indirect
+	github.com/google/go-cmp v0.5.9 // indirect
+	github.com/google/gofuzz v1.1.0 // indirect
+	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
+	github.com/google/uuid v1.3.0 // indirect
+	github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7 // indirect
+	github.com/imdario/mergo v0.3.6 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-runewidth v0.0.9 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
+	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/xlab/treeprint v1.1.0 // indirect
+	go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect
+	golang.org/x/net v0.9.0 // indirect
+	golang.org/x/oauth2 v0.7.0 // indirect
+	golang.org/x/sys v0.7.0 // indirect
+	golang.org/x/term v0.7.0 // indirect
+	golang.org/x/text v0.9.0 // indirect
+	golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect
+	golang.org/x/tools v0.8.0 // indirect
+	google.golang.org/appengine v1.6.7 // indirect
+	google.golang.org/protobuf v1.30.0 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	k8s.io/api v0.27.3 // indirect
+	k8s.io/klog/v2 v2.90.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f // indirect
+	k8s.io/utils v0.0.0-20230209194617-a36077c30491 // indirect
+	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
+	sigs.k8s.io/kustomize/api v0.13.2 // indirect
+	sigs.k8s.io/kustomize/kyaml v0.14.1 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
+	sigs.k8s.io/yaml v1.3.0 // indirect
 )

pkg/collector/cluster.go

@@ -0,0 +1,116 @@
+package collector
+
+import (
+	"context"
+	"fmt"
+	"regexp"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/cli-runtime/pkg/genericclioptions"
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/clientcmd"
+)
+
+type Cluster struct {
+	clientSet     *kubernetes.Clientset
+	cConfig       clientcmd.ClientConfig
+	restMapper    meta.RESTMapper
+	dynamicClient dynamic.Interface
+}
+
+type Platform struct {
+	Name    string
+	Version string
+}
+
+func NewCluster(clientSet *kubernetes.Clientset, clientConfig clientcmd.ClientConfig, restMApper meta.RESTMapper, dynamicClient dynamic.Interface) *Cluster {
+	return &Cluster{clientSet: clientSet, cConfig: clientConfig, restMapper: restMApper, dynamicClient: dynamicClient}
+}
+
+func GetCluster() (*Cluster, error) {
+	cf := genericclioptions.NewConfigFlags(true)
+	rest.SetDefaultWarningHandler(rest.NoWarnings{})
+	clientConfig := cf.ToRawKubeConfigLoader()
+	rc, err := clientConfig.ClientConfig()
+	if err != nil {
+		return nil, err
+	}
+	restMapper, err := cf.ToRESTMapper()
+	if err != nil {
+		return nil, err
+	}
+	clientset, err := kubernetes.NewForConfig(rc)
+	if err != nil {
+		return nil, err
+	}
+	k8sDynamicClient, err := dynamic.NewForConfig(rc)
+	if err != nil {
+		return nil, err
+	}
+	return NewCluster(clientset, clientConfig, restMapper, k8sDynamicClient), nil
+}
+
+func (cluster *Cluster) Platfrom() (Platform, error) {
+	v := cluster.getOpenShiftVersion(context.Background())
+	if len(v) != 0 {
+		return Platform{Name: "ocp", Version: majorVersion(v)}, nil
+	}
+	version, err := cluster.clientSet.ServerVersion()
+	if err != nil {
+		return Platform{}, err
+	}
+	return getPlatformInfoFromVersion(version.GitVersion), nil
+}
+
+func getPlatformInfoFromVersion(s string) Platform {
+	versionRe := regexp.MustCompile(`v(\d+\.\d+)\.\d+[-+](\w+)(?:[.\-])\w+`)
+	subs := versionRe.FindStringSubmatch(s)
+	if len(subs) < 3 {
+		return Platform{
+			Name:    "k8s",
+			Version: majorVersion(s),
+		}
+	}
+	return Platform{
+		Name:    subs[2],
+		Version: subs[1],
+	}
+}
+
+func (cluster *Cluster) getOpenShiftVersion(ctx context.Context) string {
+	gvr, err := cluster.restMapper.ResourceFor(schema.GroupVersionResource{Resource: "clusterversions"})
+	if err != nil {
+		return ""
+	}
+	dclient := cluster.getDynamicClient(gvr)
+	resources, err := dclient.List(ctx, v1.ListOptions{})
+	if err != nil {
+		return ""
+	}
+	var version string
+	for _, resource := range resources.Items {
+		version, _, _ = unstructured.NestedString(resource.Object, []string{"status", "desired", "version"}...)
+
+	}
+	return version
+}
+
+func (cluster *Cluster) getDynamicClient(gvr schema.GroupVersionResource) dynamic.ResourceInterface {
+	return cluster.dynamicClient.Resource(gvr).Namespace("")
+}
+
+func majorVersion(semanticVersion string) string {
+	versionRe := regexp.MustCompile(`v(\d+\.\d+)\.\d+`)
+	version := semanticVersion
+	if !strings.HasPrefix(semanticVersion, "v") {
+		version = fmt.Sprintf("v%s", semanticVersion)
+	}
+	subs := versionRe.FindStringSubmatch(version)
+	return subs[1]
+}

pkg/collector/collect.go

@@ -8,21 +8,46 @@ import (
 	"github.com/spf13/cobra"
 )
 
-// CollectNodeData run spec audit command and output it result data
-func CollectNodeData(cmd *cobra.Command) error {
-	specVersion := cmd.Flag("spec").Value.String()
+type SpecVersion struct {
+	Name    string
+	Version string
+}
+
+var platfromSpec = map[string]SpecVersion{
+	"k8s-1.23": {
+		Name:    "cis",
+		Version: "1.23",
+	},
+}
+
+// CollectData run spec audit command and output it result data
+func CollectData(cmd *cobra.Command, target string) error {
+	cluster, err := GetCluster()
+	if err != nil {
+		return err
+	}
+	p, err := cluster.Platfrom()
+	if err != nil {
+		return err
+	}
 	shellCmd := NewShellCmd()
 	nodeType, err := shellCmd.FindNodeType()
 	if err != nil {
 		return err
 	}
-	infoCollectorMap, err := LoadConfig()
+	infoCollectorMap, err := LoadConfig(target)
 	if err != nil {
 		return err
 	}
+	specName := cmd.Flag("spec").Value.String()
+	specVersion := cmd.Flag("version").Value.String()
+	sv := SpecVersion{Name: specName, Version: specVersion}
+	if len(sv.Name) == 0 || len(sv.Version) == 0 {
+		sv = specByPlatfromVersion(p.Name, p.Version)
+	}
 	for _, infoCollector := range infoCollectorMap {
 		nodeInfo := make(map[string]*Info)
-		if infoCollector.Version != specVersion {
+		if !(infoCollector.Version == sv.Version && infoCollector.Name == sv.Name) {
 			continue
 		}
 		for _, ci := range infoCollector.Collectors {
@@ -51,3 +76,7 @@ func CollectNodeData(cmd *cobra.Command) error {
 	}
 	return nil
 }
+
+func specByPlatfromVersion(platfrom string, version string) SpecVersion {
+	return platfromSpec[fmt.Sprintf("%s-%s", platfrom, platfrom)]
+}

pkg/collector/config/node-info-1.0.yaml → pkg/collector/config/k8s/cis-123.yaml

@@ -1,6 +1,6 @@
 ---
-version: "1.0"
-name: node-info-collector
+version: "1.23"
+name: cis
 title: Node Specification for info collector
 collectors:
   - key: kubeAPIServerSpecFilePermission

pkg/collector/info.go

@@ -19,14 +19,15 @@ const (
 var config embed.FS
 
 // LoadConfig load audit commands specification from config file
-func LoadConfig() (map[string]*SpecInfo, error) {
-	dirEntries, err := config.ReadDir(configFolder)
+func LoadConfig(target string) (map[string]*SpecInfo, error) {
+	fullPath := fmt.Sprintf("%s/%s", configFolder, target)
+	dirEntries, err := config.ReadDir(fullPath)
 	if err != nil {
 		return nil, err
 	}
 	specInfoMap := make(map[string]*SpecInfo)
 	for _, entry := range dirEntries {
-		fContent, err := config.ReadFile(fmt.Sprintf("%s/%s", configFolder, entry.Name()))
+		fContent, err := config.ReadFile(fmt.Sprintf("%s/%s", fullPath, entry.Name()))
 		if err != nil {
 			return nil, err
 		}

pkg/command/k8s.go

@@ -0,0 +1,25 @@
+package cmd
+
+import (
+	"github.com/aquasecurity/k8s-node-collector/pkg/collector"
+	"github.com/spf13/cobra"
+)
+
+const (
+	subCommandK8s = "k8s"
+)
+
+func init() {
+	rootCmd.AddCommand(k8sCmd)
+}
+
+var k8sCmd = &cobra.Command{
+	Use:   subCommandK8s,
+	Short: "k8s-node-collector extract file system info from cluster Node",
+	Long:  `A tool which provide a way to extract k8s info which is not accessible via apiserver from node cluster based on pre-define commands`,
+	RunE: func() func(cmd *cobra.Command, args []string) error {
+		return func(cmd *cobra.Command, args []string) error {
+			return collector.CollectData(cmd, subCommandK8s)
+		}
+	}(),
+}

pkg/command/root.go

@@ -4,22 +4,22 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/aquasecurity/k8s-node-collector/pkg/collector"
 	"github.com/spf13/cobra"
 )
 
 func init() {
 	rootCmd.PersistentFlags().StringP("output", "o", "json", "Output format. One of table|json")
-	rootCmd.PersistentFlags().StringP("spec", "s", "1.0", " spec version.  default: 1.0")
+	rootCmd.PersistentFlags().StringP("spec", "s", "cis", " spec name.  default: cis")
+	rootCmd.PersistentFlags().StringP("version", "v", "1.23", "spec version.  default: 1.23")
 }
 
 var rootCmd = &cobra.Command{
 	Use:   "node-collector",
-	Short: "k8s-node-collector extract file system info from cluster Node",
-	Long:  `A tool which provide a way to extract k8s info which is not accessible via apiserver from node cluster based on pre-define commands`,
+	Short: "trivy-collector extract file system info",
+	Long:  `A tool which provide a way to extract file info which is not accessible via pre-define commands`,
 	RunE: func() func(cmd *cobra.Command, args []string) error {
 		return func(cmd *cobra.Command, args []string) error {
-			return collector.CollectNodeData(cmd)
+			return cmd.Help()
 		}
 	}(),
 }