feat(adapter): Add k8tls adapter

Signed-off-by: Anurag Rajawat <[email protected]>

pkg/adapter/idpool/idpool.go

@@ -11,14 +11,11 @@ import (
 const (
 	SwDeploymentTools         = "swDeploymentTools"
 	UnAuthorizedSaTokenAccess = "unAuthorizedSaTokenAccess"
-	UnAuthorizedNEFAccess     = "unAuthorizedNEFAccess"
-	NFServiceDiscovery        = "nfServiceDiscovery"
 	DNSManipulation           = "dnsManipulation"
-	NetPortExec               = "netPortExec"
-	SysPathExec               = "sysPathExec"
 	EscapeToHost              = "escapeToHost"
 	DisallowChRoot            = "disallowChRoot"
 	DisallowCapabilities      = "disallowCapabilities"
+	EnsureTLS                 = "ensureTLS"
 )
 
 // KaIds are IDs supported by KubeArmor.
@@ -45,6 +42,11 @@ var KyvIds = []string{
 	EscapeToHost,
 }
 
+// k8tlsIds are IDs supported by k8tls.
+var k8tlsIds = []string{
+	EnsureTLS,
+}
+
 // IsIdSupportedBy determines whether a given ID is supported by a security engine.
 func IsIdSupportedBy(id, securityEngine string) bool {
 	switch strings.ToLower(securityEngine) {
@@ -54,6 +56,8 @@ func IsIdSupportedBy(id, securityEngine string) bool {
 		return in(id, NetPolIDs)
 	case "kyverno":
 		return in(id, KyvIds)
+	case "k8tls":
+		return in(id, k8tlsIds)
 	default:
 		return false
 	}

pkg/adapter/k8s/client.go

@@ -11,6 +11,7 @@ import (
 
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/rest"
 	"k8s.io/client-go/tools/clientcmd"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -53,3 +54,21 @@ func NewDynamicClient() dynamic.Interface {
 	}
 	return clientSet
 }
+
+// NewOrDieStaticClient returns a new Kubernetes Clientset and panics if there is
+// an error in the config.
+func NewOrDieStaticClient() kubernetes.Interface {
+	config, err := rest.InClusterConfig()
+	if err != nil && errors.Is(err, rest.ErrNotInCluster) {
+		kubeconfig := filepath.Join(os.Getenv("HOME"), ".kube", "config")
+		config, err = clientcmd.BuildConfigFromFlags("", kubeconfig)
+		if err != nil {
+			panic(fmt.Sprintf("failed to load kubeconfig '%v', error: %v\n", kubeconfig, err))
+		}
+	}
+	clientSet, err := kubernetes.NewForConfig(config)
+	if err != nil {
+		panic(err)
+	}
+	return clientSet
+}

pkg/adapter/nimbus-k8tls/.dockerignore

@@ -0,0 +1 @@
+bin/

pkg/adapter/nimbus-k8tls/Dockerfile

@@ -0,0 +1,41 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2023 Authors of Nimbus
+
+FROM golang:1.22 as builder
+ARG TARGETOS
+ARG TARGETARCH
+
+WORKDIR /nimbus
+
+# relative deps requried by the adapter
+ADD api/ api/
+ADD pkg/ pkg/
+ADD go.mod go.mod
+ADD go.sum go.sum
+
+ARG ADAPTER_DIR=pkg/adapter/nimbus-k8tls
+WORKDIR /nimbus/$ADAPTER_DIR
+
+COPY $ADAPTER_DIR/go.mod go.mod
+# cache deps before building and copying source so that we don't need to re-download as much
+# and so that source changes don't invalidate our downloaded layer
+RUN go mod download
+
+COPY $ADAPTER_DIR/manager manager
+COPY $ADAPTER_DIR/builder builder
+COPY $ADAPTER_DIR/watcher watcher
+COPY $ADAPTER_DIR/main.go main.go
+
+# Build
+# the GOARCH has not a default value to allow the binary be built according to the host where the command
+# was called. For example, if we call make docker-build in a local env which has the Apple Silicon M1 SO
+# the docker BUILDPLATFORM arg will be linux/arm64 when for Apple x86 it will be linux/amd64. Therefore,
+# by leaving it empty we can ensure that the container and binary shipped on it will have the same platform.
+RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -ldflags="-s" -o bin/nimbus-k8tls main.go
+
+FROM gcr.io/distroless/static:nonroot
+WORKDIR /
+COPY --from=builder /nimbus/pkg/adapter/nimbus-k8tls/bin/nimbus-k8tls .
+USER 65532:65532
+
+ENTRYPOINT ["/nimbus-k8tls"]

pkg/adapter/nimbus-k8tls/Makefile

@@ -0,0 +1,34 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2023 Authors of Nimbus
+
+# Image URL to use all building/pushing image targets
+IMG ?= 5gsec/nimbus-k8tls
+# Image Tag to use all building/pushing image targets
+TAG ?= latest
+
+CONTAINER_TOOL ?= docker
+BINARY ?= bin/nimbus-k8tls
+
+build:
+	@go build -ldflags="-s" -o ${BINARY}  main.go
+
+run: build
+	@./${BINARY}
+
+.PHONY: docker-build
+docker-build:
+	$(CONTAINER_TOOL) build -t ${IMG}:${TAG} --build-arg VERSION=${TAG} -f ./Dockerfile ../../../
+
+.PHONY: docker-push
+docker-push:
+	$(CONTAINER_TOOL) push ${IMG}:${TAG}
+
+PLATFORMS ?= linux/arm64,linux/amd64
+.PHONY: docker-buildx
+docker-buildx:
+	sed -e '1 s/\(^FROM\)/FROM --platform=\$$\{BUILDPLATFORM\}/; t' -e ' 1,// s//FROM --platform=\$$\{BUILDPLATFORM\}/' Dockerfile > Dockerfile.cross
+	- $(CONTAINER_TOOL) buildx create --name project-v3-builder
+	$(CONTAINER_TOOL) buildx use project-v3-builder
+	- $(CONTAINER_TOOL) buildx build --push --platform=$(PLATFORMS) --build-arg VERSION=${TAG} --tag ${IMG}:${TAG} -f Dockerfile.cross ../../../ || { $(CONTAINER_TOOL) buildx rm project-v3-builder; rm Dockerfile.cross; exit 1; }
+	- $(CONTAINER_TOOL) buildx rm project-v3-builder
+	rm Dockerfile.cross

pkg/adapter/nimbus-k8tls/builder/builder.go

@@ -0,0 +1,91 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2023 Authors of Nimbus
+
+package builder
+
+import (
+	"strings"
+
+	"github.com/go-logr/logr"
+	batchv1 "k8s.io/api/batch/v1"
+	corev1 "k8s.io/api/core/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	intentv1 "github.com/5GSEC/nimbus/api/v1"
+	"github.com/5GSEC/nimbus/pkg/adapter/idpool"
+)
+
+func BuildJobOrCronJob(logger logr.Logger, cwnp intentv1.ClusterNimbusPolicy) client.Object {
+	for _, nimbusRule := range cwnp.Spec.NimbusRules {
+		id := nimbusRule.ID
+		if idpool.IsIdSupportedBy(id, "k8tls") {
+			obj := buildJobOrCronJobFor(id, nimbusRule)
+			obj.SetName(cwnp.Name + "-" + strings.ToLower(id))
+			obj.SetAnnotations(map[string]string{
+				"app.kubernetes.io/managed-by": "nimbus-k8tls",
+			})
+			obj.SetLabels(cwnp.Labels)
+			return obj
+		}
+		logger.Info("K8TLS adapter doesn't support this ID", "ID", id)
+	}
+	return nil
+}
+
+func buildJobOrCronJobFor(id string, rule intentv1.NimbusRules) client.Object {
+	switch id {
+	case idpool.EnsureTLS:
+		return ensureTlsJobOrCronJob(rule)
+	default:
+		return nil
+	}
+}
+
+func ensureTlsJobOrCronJob(rule intentv1.NimbusRules) client.Object {
+	schedule, keyExists := rule.Rule.Params["schedule"]
+	if keyExists {
+		return cronJobForEnsureTls(schedule[0])
+	}
+	return jobForEnsureTls()
+}
+
+var k8tlsPodSpec = corev1.PodSpec{
+	RestartPolicy: corev1.RestartPolicyNever,
+	Containers: []corev1.Container{
+		{
+			Name:            "k8tls",
+			Image:           "kubearmor/k8tls:latest",
+			Command:         []string{"./k8s_tlsscan"},
+			ImagePullPolicy: corev1.PullAlways,
+		},
+	},
+}
+
+func jobForEnsureTls() client.Object {
+	backOffLimit := int32(5)
+	return &batchv1.Job{
+		Spec: batchv1.JobSpec{
+			BackoffLimit: &backOffLimit,
+			Template: corev1.PodTemplateSpec{
+				Spec: k8tlsPodSpec,
+			},
+		},
+	}
+}
+
+func cronJobForEnsureTls(schedule string) client.Object {
+	backOffLimit := int32(5)
+	return &batchv1.CronJob{
+		Spec: batchv1.CronJobSpec{
+			Schedule: schedule,
+			JobTemplate: batchv1.JobTemplateSpec{
+				Spec: batchv1.JobSpec{
+					BackoffLimit: &backOffLimit,
+					Template: corev1.PodTemplateSpec{
+						Spec: k8tlsPodSpec,
+					},
+				},
+			},
+		},
+	}
+}

pkg/adapter/nimbus-k8tls/go.mod

@@ -0,0 +1,70 @@
+module github.com/5GSEC/nimbus/pkg/adapter/nimbus-k8tls
+
+go 1.22.0
+
+toolchain go1.22.3
+
+replace github.com/5GSEC/nimbus => ../../../../nimbus
+
+require (
+	github.com/5GSEC/nimbus v0.0.0-20240313065715-b91563b0ccd3
+	github.com/go-logr/logr v1.4.2
+	k8s.io/api v0.30.1
+	k8s.io/apimachinery v0.30.1
+	k8s.io/client-go v0.30.1
+	sigs.k8s.io/controller-runtime v0.18.2
+)
+
+require (
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/emicklei/go-restful/v3 v3.12.0 // indirect
+	github.com/evanphx/json-patch/v5 v5.9.0 // indirect
+	github.com/fsnotify/fsnotify v1.7.0 // indirect
+	github.com/go-logr/zapr v1.3.0 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/jsonreference v0.21.0 // indirect
+	github.com/go-openapi/swag v0.23.0 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/google/gnostic-models v0.6.9-0.20230804172637-c7be7c783f49 // indirect
+	github.com/google/go-cmp v0.6.0 // indirect
+	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/imdario/mergo v0.3.16 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/prometheus/client_golang v1.19.1 // indirect
+	github.com/prometheus/client_model v0.6.1 // indirect
+	github.com/prometheus/common v0.53.0 // indirect
+	github.com/prometheus/procfs v0.15.0 // indirect
+	github.com/spf13/pflag v1.0.5 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	go.uber.org/zap v1.27.0 // indirect
+	golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842 // indirect
+	golang.org/x/net v0.25.0 // indirect
+	golang.org/x/oauth2 v0.20.0 // indirect
+	golang.org/x/sys v0.20.0 // indirect
+	golang.org/x/term v0.20.0 // indirect
+	golang.org/x/text v0.15.0 // indirect
+	golang.org/x/time v0.5.0 // indirect
+	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
+	google.golang.org/protobuf v1.34.1 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	k8s.io/apiextensions-apiserver v0.30.1 // indirect
+	k8s.io/klog/v2 v2.120.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20240521193020-835d969ad83a // indirect
+	k8s.io/utils v0.0.0-20240502163921-fe8a2dddb1d0 // indirect
+	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
+	sigs.k8s.io/yaml v1.4.0 // indirect
+)