|
| 1 | +#!/busybox/sh |
| 2 | + |
| 3 | +# Checks if `string` contains `substring`. |
| 4 | +# |
| 5 | +# Arguments: |
| 6 | +# String to check. |
| 7 | +# |
| 8 | +# Returns: |
| 9 | +# 0 if `string` contains `substring`, otherwise 1. |
| 10 | +contains() { |
| 11 | + case "$1" in |
| 12 | + *$2*) return 0 ;; |
| 13 | + *) return 1 ;; |
| 14 | + esac |
| 15 | +} |
| 16 | + |
| 17 | +set -e |
| 18 | + |
| 19 | +# Kubescape uses the client name to make a request for checking for updates |
| 20 | +export KS_CLIENT="codefresh" |
| 21 | + |
| 22 | +if [ -n "${FRAMEWORKS}" ] && [ -n "${CONTROLS}" ]; then |
| 23 | + echo "Framework and Control are specified. Please specify either one of them" |
| 24 | + exit 1 |
| 25 | +fi |
| 26 | + |
| 27 | +if [ -z "${FRAMEWORKS}" ] && [ -z "${CONTROLS}" ] && [ -z "${IMAGE}" ]; then |
| 28 | + echo "Neither Framework, Control nor image are specified. Please specify one of them" |
| 29 | + exit 1 |
| 30 | +fi |
| 31 | + |
| 32 | + |
| 33 | +if [ -n "${FRAMEWORKS}" ] && [ -n "${IMAGE}" ] || [ -n "${CONTROLS}" ] && [ -n "${IMAGE}" ] ; then |
| 34 | + errmsg="Image and Framework / Control are specified. Kubescape does not support scanning both at the moment." |
| 35 | + errmsg="${errmsg} Please specify either one of them or neither." |
| 36 | + echo "${errmsg}" |
| 37 | + exit 1 |
| 38 | +fi |
| 39 | + |
| 40 | +if [ -n "${IMAGE}" ] && [ "${FIXFILES}" = "true" ]; then |
| 41 | + errmsg="The run requests both an image scan and file fix suggestions. Kubescape does not support fixing image scan results at the moment." |
| 42 | + errmsg="${errmsg} Please specify either one of them or neither." |
| 43 | + echo "${errmsg}" |
| 44 | + exit 1 |
| 45 | +fi |
| 46 | + |
| 47 | +# Split the controls by comma and concatenate with quotes around each control |
| 48 | +if [ -n "${CONTROLS}" ]; then |
| 49 | + controls="" |
| 50 | + set -f |
| 51 | + IFS=',' |
| 52 | + set -- "${CONTROLS}" |
| 53 | + set +f |
| 54 | + unset IFS |
| 55 | + for control in "$@"; do |
| 56 | + control=$(echo "${control}" | xargs) # Remove leading/trailing whitespaces |
| 57 | + controls="${controls}\"${control}\"," |
| 58 | + done |
| 59 | + controls=$(echo "${controls%?}") |
| 60 | +fi |
| 61 | + |
| 62 | +frameworks_cmd=$([ -n "${FRAMEWORKS}" ] && echo "framework ${FRAMEWORKS}" || echo "") |
| 63 | +controls_cmd=$([ -n "${CONTROLS}" ] && echo control "${controls}" || echo "") |
| 64 | + |
| 65 | +scan_input=$([ -n "${FILES}" ] && echo "${FILES}" || echo .) |
| 66 | + |
| 67 | +output_formats="${FORMAT}" |
| 68 | +have_json_format="false" |
| 69 | +if [ -n "${output_formats}" ] && contains "${output_formats}" "json"; then |
| 70 | + have_json_format="true" |
| 71 | +fi |
| 72 | + |
| 73 | +verbose="" |
| 74 | +if [ -n "${VERBOSE}" ] && [ "${VERBOSE}" != "false" ]; then |
| 75 | + verbose="--verbose" |
| 76 | +fi |
| 77 | + |
| 78 | +exceptions="" |
| 79 | +if [ -n "$EXCEPTIONS" ]; then |
| 80 | + exceptions="--exceptions ${EXCEPTIONS}" |
| 81 | +fi |
| 82 | + |
| 83 | +controls_config="" |
| 84 | +if [ -n "$CONTROLSCONFIG" ]; then |
| 85 | + controls_config="--controls-config ${CONTROLSCONFIG}" |
| 86 | +fi |
| 87 | + |
| 88 | +should_fix_files="false" |
| 89 | +if [ "${FIXFILES}" = "true" ]; then |
| 90 | + should_fix_files="true" |
| 91 | +fi |
| 92 | + |
| 93 | +# If a user requested Kubescape to fix their files, but forgot to ask for JSON |
| 94 | +# output, do it for them |
| 95 | +if [ "${should_fix_files}" = "true" ] && [ "${have_json_format}" != "true" ]; then |
| 96 | + output_formats="${output_formats},json" |
| 97 | +fi |
| 98 | + |
| 99 | +output_file=$([ -n "${OUTPUTFILE}" ] && echo "${OUTPUTFILE}" || echo "results") |
| 100 | + |
| 101 | +account_opt=$([ -n "${ACCOUNT}" ] && echo --account "${ACCOUNT}" || echo "") |
| 102 | +access_key_opt=$([ -n "${ACCESSKEY}" ] && echo --access-key "${ACCESSKEY}" || echo "") |
| 103 | +server_opt=$([ -n "${SERVER}" ] && echo --server "${SERVER}" || echo "") |
| 104 | + |
| 105 | +# If account ID is empty, we load artifacts from the local path, otherwise we |
| 106 | +# load from the cloud (this will enable custom framework support) |
| 107 | +artifacts_path="/home/ks/.kubescape" |
| 108 | +artifacts_opt=$([ -n "${ACCOUNT}" ] && echo "" || echo --use-artifacts-from "${artifacts_path}") |
| 109 | + |
| 110 | +if [ -n "${FAILEDTHRESHOLD}" ] && [ -n "${COMPLIANCETHRESHOLD}" ]; then |
| 111 | + echo "Both failedThreshold and complianceThreshold are specified. Please specify either one of them or neither" |
| 112 | + exit 1 |
| 113 | +fi |
| 114 | + |
| 115 | +fail_threshold_opt=$([ -n "${FAILEDTHRESHOLD}" ] && echo --fail-threshold "${FAILEDTHRESHOLD}" || echo "") |
| 116 | +compliance_threshold_opt=$([ -n "${COMPLIANCETHRESHOLD}" ] && echo --compliance-threshold "${COMPLIANCETHRESHOLD}" || echo "") |
| 117 | + |
| 118 | +# When a user requests to fix files, the action should not fail because the |
| 119 | +# results exceed severity. This is subject to change in the future. |
| 120 | +severity_threshold_opt=$( |
| 121 | + [ -n "${SEVERITYTHRESHOLD}" ] && |
| 122 | + [ "${should_fix_files}" = "false" ] && |
| 123 | + echo --severity-threshold "${SEVERITYTHRESHOLD}" || |
| 124 | + echo "" |
| 125 | +) |
| 126 | + |
| 127 | +# Handle image scanning request |
| 128 | +image_subcmd="" |
| 129 | +echo "image is <${IMAGE}>" |
| 130 | +if [ -n "${IMAGE}" ]; then |
| 131 | + |
| 132 | + # By default, assume we are not authenticated. This means we can pull public |
| 133 | + # images from the container runtime daemon |
| 134 | + image_arg="${IMAGE}" |
| 135 | + |
| 136 | + severity_threshold_opt=$( |
| 137 | + [ -n "${SEVERITYTHRESHOLD}" ] && |
| 138 | + echo --severity-threshold "${SEVERITYTHRESHOLD}" || |
| 139 | + echo "" |
| 140 | + ) |
| 141 | + |
| 142 | + auth_opts="" |
| 143 | + if [ -n "${REGISTRYUSERNAME}" ] && [ -n "${REGISTRYPASSWORD}" ]; then |
| 144 | + auth_opts="--username=${REGISTRYUSERNAME} --password=${REGISTRYPASSWORD}" |
| 145 | + |
| 146 | + # When trying to authenticate, we cannot assume that the runner has access |
| 147 | + # to an *authenticated* container runtime daemon, so we should always try |
| 148 | + # to pull images from the registry |
| 149 | + image_arg="registry://${image_arg}" |
| 150 | + else |
| 151 | + echo "NOTICE: Received no registry credentials, pulling without authentication." |
| 152 | + printf "Hint: If you provide credentials, make sure you include both the username and password.\n\n" |
| 153 | + fi |
| 154 | + |
| 155 | + # Build the image scanning subcommand with options |
| 156 | + image_subcmd="image ${auth_opts}" |
| 157 | + # Override the scan input |
| 158 | + scan_input="${image_arg}" |
| 159 | + echo "Scan subcommand: ${image_subcmd}" |
| 160 | +fi |
| 161 | + |
| 162 | +# TODO: include artifacts_opt once https://github.com/kubescape/kubescape/issues/1040 is resolved |
| 163 | +scan_command="kubescape scan ${image_subcmd} ${frameworks_cmd} ${controls_cmd} ${scan_input} ${account_opt} ${access_key_opt} ${server_opt} ${fail_threshold_opt} ${compliance_threshold_opt} ${severity_threshold_opt} --format ${output_formats} --output ${output_file} ${verbose} ${exceptions} ${controls_config}" |
| 164 | + |
| 165 | +echo "${scan_command}" |
| 166 | +eval "${scan_command}" |
| 167 | + |
| 168 | +if [ "$should_fix_files" = "true" ]; then |
| 169 | + fix_command="kubescape fix --no-confirm ${output_file}.json" |
| 170 | + eval "${fix_command}" |
| 171 | +fi |
0 commit comments