feat: Kubernetes Linking

scrapers/kubernetes/kubernetes.go

@@ -2,6 +2,7 @@ package kubernetes
 
 import (
 	"fmt"
+	"regexp"
 	"strconv"
 	"strings"
 	"time"
@@ -50,7 +51,7 @@ func (kubernetes KubernetesScraper) Scrape(ctx api.ScrapeContext) v1.ScrapeResul
 			Name:        config.ClusterName,
 			ConfigClass: "Cluster",
 			Type:        ConfigTypePrefix + "Cluster",
-			Config:      make(map[string]string),
+			Config:      make(map[string]any),
 			ID:          clusterID,
 		})
 
@@ -66,6 +67,9 @@ func (kubernetes KubernetesScraper) Scrape(ctx api.ScrapeContext) v1.ScrapeResul
 		resourceIDMap[""]["Cluster"][config.ClusterName] = clusterID
 		resourceIDMap[""]["Cluster"]["selfRef"] = clusterID // For shorthand
 
+		// Labels that are added to the kubernetes nodes once all the objects are visited
+		var labelsToAddToNode = map[string]map[string]string{}
+
 		for _, obj := range objs {
 			if string(obj.GetUID()) == "" {
 				logger.Warnf("Found kubernetes object with no resource ID: %s/%s/%s", obj.GetKind(), obj.GetNamespace(), obj.GetName())
@@ -93,8 +97,9 @@ func (kubernetes KubernetesScraper) Scrape(ctx api.ScrapeContext) v1.ScrapeResul
 			var relationships v1.RelationshipResults
 			if obj.GetKind() == "Pod" {
 				spec := obj.Object["spec"].(map[string]interface{})
+				var nodeName string
 				if spec["nodeName"] != nil {
-					nodeName := spec["nodeName"].(string)
+					nodeName = spec["nodeName"].(string)
 					nodeID := resourceIDMap[""]["Node"][nodeName]
 					relationships = append(relationships, v1.RelationshipResult{
 						ConfigExternalID: v1.ExternalID{
@@ -108,6 +113,119 @@ func (kubernetes KubernetesScraper) Scrape(ctx api.ScrapeContext) v1.ScrapeResul
 						Relationship: "NodePod",
 					})
 				}
+
+				if obj.GetLabels()["app.kubernetes.io/name"] == "aws-node" {
+					for _, ownerRef := range obj.GetOwnerReferences() {
+						if ownerRef.Kind == "DaemonSet" && ownerRef.Name == "aws-node" {
+							var (
+								awsRoleARN  string
+								vpcID       string
+								clusterName string
+								awsRegion   string
+							)
+
+							for _, env := range spec["env"].([]any) {
+								if arn, ok := env.(map[string]any)["AWS_ROLE_ARN"]; ok {
+									awsRoleARN = arn.(string)
+								}
+
+								if vpc, ok := env.(map[string]any)["VPC_ID"]; ok {
+									vpcID = vpc.(string)
+								}
+
+								if cluster, ok := env.(map[string]any)["CLUSTER_NAME"]; ok {
+									clusterName = cluster.(string)
+								}
+
+								if region, ok := env.(map[string]any)["AWS_REGION"]; ok {
+									awsRegion = region.(string)
+								}
+							}
+
+							if awsRoleARN != "" {
+								relationships = append(relationships, v1.RelationshipResult{
+									ConfigExternalID:  v1.ExternalID{ExternalID: []string{string(obj.GetUID())}, ConfigType: ConfigTypePrefix + "Pod"},
+									RelatedExternalID: v1.ExternalID{ExternalID: []string{awsRoleARN}, ConfigType: "AWS::IAM::Role"},
+									Relationship:      "IAMRoleNode",
+								})
+							}
+
+							if vpcID != "" {
+								labelsToAddToNode[nodeName] = map[string]string{
+									"vpc-id": vpcID,
+								}
+
+								if clusterScrapeResult, ok := results[0].Config.(map[string]any); ok {
+									clusterScrapeResult["vpc-id"] = vpcID
+								}
+
+								relationships = append(relationships, v1.RelationshipResult{
+									ConfigExternalID:  v1.ExternalID{ExternalID: []string{string(obj.GetUID())}, ConfigType: ConfigTypePrefix + "Pod"},
+									RelatedExternalID: v1.ExternalID{ExternalID: []string{clusterName}, ConfigType: ConfigTypePrefix + "Cluster"},
+									Relationship:      "ClusterPod",
+								})
+
+								relationships = append(relationships, v1.RelationshipResult{
+									ConfigExternalID:  v1.ExternalID{ExternalID: []string{string(obj.GetUID())}, ConfigType: ConfigTypePrefix + "Pod"},
+									RelatedExternalID: v1.ExternalID{ExternalID: []string{fmt.Sprintf("Kubernetes/Node//%s", nodeName)}, ConfigType: ConfigTypePrefix + "Node"},
+									Relationship:      "NodePod",
+								})
+							}
+
+							if clusterName != "" {
+								if clusterScrapeResult, ok := results[0].Config.(map[string]any); ok {
+									clusterScrapeResult["cluster-name"] = clusterName
+								}
+
+								awsAccountID := extractAccountIDFromARN(awsRoleARN)
+								if awsAccountID != "" && awsRegion != "" {
+									relationships = append(relationships, v1.RelationshipResult{
+										ConfigExternalID:  v1.ExternalID{ExternalID: []string{clusterID}, ConfigType: ConfigTypePrefix + "Cluster"},
+										RelatedExternalID: v1.ExternalID{ExternalID: []string{fmt.Sprintf("arn:aws:eks:%s:%s:cluster/%s", awsRegion, awsAccountID, clusterName)}, ConfigType: "AWS::EKS::Cluster"},
+										Relationship:      "EKSClusterKubernetesCluster",
+									})
+								}
+							}
+						}
+					}
+				}
+			}
+
+			if obj.GetKind() == "Node" {
+				if clusterName, ok := obj.GetLabels()["alpha.eksctl.io/cluster-name"]; ok {
+					if clusterScrapeResult, ok := results[0].Config.(map[string]any); ok {
+						clusterScrapeResult["cluster-name"] = clusterName
+					}
+
+					relationships = append(relationships, v1.RelationshipResult{
+						ConfigExternalID: v1.ExternalID{
+							ExternalID: []string{string(obj.GetUID())},
+							ConfigType: ConfigTypePrefix + "Node",
+						},
+						RelatedExternalID: v1.ExternalID{
+							ExternalID: []string{clusterName},
+							ConfigType: "AWS::EKS::Cluster",
+						},
+						Relationship: "EKSClusterNode",
+					})
+				}
+
+				if computeType, ok := obj.GetLabels()["eks.amazonaws.com/compute-type"]; ok && computeType == "ec2" {
+					if spec, ok := obj.Object["spec"].(map[string]any); ok {
+						if providerID, ok := spec["providerID"].(string); ok {
+							// providerID is expected to be in the format "aws:///eu-west-1a/i-06ec81231075dd597"
+							splits := strings.Split(providerID, "/")
+							if len(splits) > 0 && strings.HasPrefix(splits[len(splits)-1], "i-") {
+								ec2InstanceID := splits[len(splits)-1]
+								relationships = append(relationships, v1.RelationshipResult{
+									ConfigExternalID:  v1.ExternalID{ExternalID: []string{string(obj.GetUID())}, ConfigType: ConfigTypePrefix + "Node"},
+									RelatedExternalID: v1.ExternalID{ExternalID: []string{ec2InstanceID}, ConfigType: "AWS::EC2::Instance"},
+									Relationship:      "EC2InstanceNode",
+								})
+							}
+						}
+					}
+				}
 			}
 
 			if obj.GetNamespace() != "" {
@@ -180,6 +298,21 @@ func (kubernetes KubernetesScraper) Scrape(ctx api.ScrapeContext) v1.ScrapeResul
 				}
 			}
 
+			if obj.GetKind() == "ConfigMap" && obj.GetName() == "aws-auth" {
+				cm, ok := obj.Object["data"].(map[string]any)
+				if ok {
+					var accountID string
+					if mapRolesYAML, ok := cm["mapRoles"].(string); ok {
+						accountID = extractAccountIDFromARN(mapRolesYAML)
+					}
+
+					if clusterScrapeResult, ok := results[0].Config.(map[string]any); ok {
+						clusterScrapeResult["aws-auth"] = cm
+						clusterScrapeResult["account-id"] = accountID
+					}
+				}
+			}
+
 			tags := make(map[string]string)
 			if obj.GetLabels() != nil {
 				tags = obj.GetLabels()
@@ -238,6 +371,14 @@ func (kubernetes KubernetesScraper) Scrape(ctx api.ScrapeContext) v1.ScrapeResul
 				RelationshipResults: relationships,
 			})
 		}
+
+		if len(labelsToAddToNode) != 0 {
+			for i := range results {
+				if labels, ok := labelsToAddToNode[results[i].Name]; ok {
+					results[i].Tags = collections.MergeMap(map[string]string(results[i].Tags), labels)
+				}
+			}
+		}
 	}
 
 	results = append(results, changeResults...)
@@ -362,3 +503,14 @@ func cleanKubernetesObject(obj map[string]any) string {
 
 	return o.String()
 }
+
+var arnRegexp = regexp.MustCompile(`arn:aws:iam::(\d+):role/`)
+
+func extractAccountIDFromARN(input string) string {
+	matches := arnRegexp.FindStringSubmatch(input)
+	if len(matches) >= 2 {
+		return matches[1]
+	}
+
+	return ""
+}

scrapers/kubernetes/kubernetes_test.go

@@ -0,0 +1,27 @@
+package kubernetes
+
+import "testing"
+
+func Test_extractAccountIDFromARN(t *testing.T) {
+	type args struct {
+		input string
+	}
+	tests := []struct {
+		name string
+		args args
+		want string
+	}{
+		{
+			name: "xx",
+			args: args{input: `- groups:\n  - system:masters\n  rolearn: arn:aws:iam::123456789:role/kubernetes-admin\n  username: admin\n- groups:\n  - system:bootstrappers\n  - system:nodes\n  rolearn: arn:aws:iam::123456789:role/eksctl-mission-control-demo-clust-NodeInstanceRole-VRLF7VBIVK3M\n  username: system:node:{{EC2PrivateDNSName}}\n`},
+			want: "123456789",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := extractAccountIDFromARN(tt.args.input); got != tt.want {
+				t.Errorf("extractAccountIDFromARN() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}