kubescape-check-helm-chart

#!/usr/bin/env python3

import argparse
import glob
import re
import subprocess
import sys
from typing import Any

import yaml


class GitHubLogGroup:
    def __init__(self, message: str) -> None:
        self.message = message

    def __enter__(self) -> None:
        print(f"::group::{self.message}")
        sys.stdout.flush()

    def __exit__(self, exc_type: Any, exc_value: Any, traceback: Any) -> None:
        del traceback
        print("::endgroup::")
        if exc_type is not None:
            print(f"With {exc_value} error.")


def main() -> None:
    parser = argparse.ArgumentParser(description="Run the Kubescape scan on all the HELM charts.")
    parser.parse_args()

    for filename in [
        # "apps/int/allianz/allianz-zppv2/helmfile.yaml"
        *glob.glob("apps/int/**/helmfile.yaml", recursive=True),
        *glob.glob("apps/prod/**/helmfile.yaml", recursive=True),
    ]:
        print("Process file: ", filename)
        print('"' * 80)
        with open(filename, encoding="utf-8") as f:
            helmfile = yaml.safe_load(f.read())

        with GitHubLogGroup(f"Process file: {filename}"):
            for nb, release in enumerate(helmfile["releases"]):
                print("Index: ", nb)
                print('"' * 80)
                del release

                try:
                    filename_match = re.match(r"apps/(int|prod)/(.+)/(.+)/helmfile.yaml", filename)
                    subprocess.run(
                        [
                            "scripts/template-gen",
                            "--debug",
                            "--no-sops",
                            f"--index={nb}",
                            f"--output=kubescape/{filename_match.group(1)}-{filename_match.group(2)}-{filename_match.group(3)}-{nb}.yaml",
                            filename,
                        ],
                        check=True,
                    )
                except subprocess.CalledProcessError:
                    print("Error during templating.")
                    exit(1)

    process = subprocess.run(
        ["kubescape", "scan", "kubescape/", "--format=json", "--output=kubescape.json"],
    )
    sys.exit(process.returncode)


if __name__ == "__main__":
    main()