feat(adapter): Add k8tls adapter

Signed-off-by: Anurag Rajawat <anurag@accuknox.com>

deployments/nimbus-k8tls/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

deployments/nimbus-k8tls/Chart.yaml

@@ -0,0 +1,9 @@
+apiVersion: v2
+type: application
+name: nimbus-k8tls
+version: 0.1.0
+appVersion: "0.1.0"
+description: Nimbus adapter for k8tls
+sources:
+  - https://github.com/5GSEC/nimbus
+kubeVersion: ">=1.25.0-0"

deployments/nimbus-k8tls/Readme.md

@@ -0,0 +1,45 @@
+# Install [k8tls](https://github.com/kubearmor/k8tls) adapter
+
+Install `nimbus-k8tls` adapter using the official 5GSEC Helm charts.
+
+```shell
+helm repo add 5gsec https://5gsec.github.io/charts
+helm repo update 5gsec
+helm upgrade --install nimbus-k8tls 5gsec/nimbus-k8tls -n nimbus
+```
+
+Install `nimbus-k8tls` adapter using Helm charts locally (for testing)
+
+```bash
+cd deployments/nimbus-k8tls/
+helm upgrade --install nimbus-k8tls . -n nimbus
+```
+
+## Values
+
+| Key              | Type   | Default            | Description                                                            |
+|------------------|--------|--------------------|------------------------------------------------------------------------|
+| image.repository | string | 5gsec/nimbus-k8tls | Image repository from which to pull the `nimbus-k8tls` adapter's image |
+| image.pullPolicy | string | Always             | `nimbus-k8tls` adapter image pull policy                               |
+| image.tag        | string | latest             | `nimbus-k8tls` adapter image tag                                       |
+
+## Verify if all the resources are up and running
+
+Once done, the following resources will exist in your cluster:
+
+```shell
+$ kubectl get all -n nimbus -l app.kubernetes.io/instance=nimbus-k8tls
+NAME                     READY   STATUS    RESTARTS   AGE
+pod/nimbus-k8tls-q2tt7   1/1     Running   0          3m8s
+
+NAME                          DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE
+daemonset.apps/nimbus-k8tls   1         1         1       1            1           <none>          3m8s
+```
+
+## Uninstall the k8tls adapter
+
+To uninstall:
+
+```bash
+helm uninstall nimbus-k8tls -n nimbus
+```

deployments/nimbus-k8tls/templates/_helpers.tpl

@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "nimbus-k8tls.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "nimbus-k8tls.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "nimbus-k8tls.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "nimbus-k8tls.labels" -}}
+helm.sh/chart: {{ include "nimbus-k8tls.chart" . }}
+{{ include "nimbus-k8tls.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "nimbus-k8tls.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "nimbus-k8tls.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "nimbus-k8tls.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "nimbus-k8tls.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

deployments/nimbus-k8tls/templates/daemonset.yaml

@@ -0,0 +1,24 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ include "nimbus-k8tls.fullname" . }}
+  labels:
+    {{- include "nimbus-k8tls.labels" . | nindent 4 }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  selector:
+    matchLabels:
+      {{- include "nimbus-k8tls.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "nimbus-k8tls.labels" . | nindent 8 }}
+    spec:
+      serviceAccountName: {{ include "nimbus-k8tls.serviceAccountName" . }}
+      containers:
+        - name: {{ .Values.fullnameOverride }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+      terminationGracePeriodSeconds: 10

deployments/nimbus-k8tls/templates/role.yaml

@@ -0,0 +1,71 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: nimbus-k8tls-clusterrole
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  - serviceaccounts
+  verbs:
+  - create
+  - delete
+  - get
+  - update
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - get
+  - list
+- apiGroups:
+  - batch
+  resources:
+  - cronjobs
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - update
+  - watch
+- apiGroups:
+  - batch
+  resources:
+  - jobs
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - update
+  - watch
+- apiGroups:
+  - intent.security.nimbus.com
+  resources:
+  - clusternimbuspolicies
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - intent.security.nimbus.com
+  resources:
+  - clusternimbuspolicies/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - clusterrolebindings
+  - clusterroles
+  verbs:
+  - create
+  - delete
+  - get
+  - update

deployments/nimbus-k8tls/templates/rolebinding.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "nimbus-k8tls.fullname" . }}-clusterrole-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: nimbus-k8tls-clusterrole
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "nimbus-k8tls.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}

deployments/nimbus-k8tls/templates/serviceaccount.yaml

@@ -0,0 +1,10 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "nimbus-k8tls.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "nimbus-k8tls.labels" . | nindent 4 }}
+automountServiceAccountToken: {{ .Values.serviceAccount.automount }}
+{{- end }}

deployments/nimbus-k8tls/values.yaml

@@ -0,0 +1,18 @@
+# Default values for nimbus-k8tls.
+
+image:
+  repository: 5gsec/nimbus-k8tls
+  pullPolicy: Always
+  tag: "latest"
+
+nameOverride: ""
+fullnameOverride: "nimbus-k8tls"
+
+serviceAccount:
+  create: true
+  automount: true
+  name: "nimbus-k8tls"
+
+securityContext:
+  runAsNonRoot: true
+  runAsUser: 65533

pkg/adapter/idpool/idpool.go

@@ -11,14 +11,11 @@ import (
 const (
 	SwDeploymentTools         = "swDeploymentTools"
 	UnAuthorizedSaTokenAccess = "unAuthorizedSaTokenAccess"
-	UnAuthorizedNEFAccess     = "unAuthorizedNEFAccess"
-	NFServiceDiscovery        = "nfServiceDiscovery"
 	DNSManipulation           = "dnsManipulation"
-	NetPortExec               = "netPortExec"
-	SysPathExec               = "sysPathExec"
 	EscapeToHost              = "escapeToHost"
 	DisallowChRoot            = "disallowChRoot"
 	DisallowCapabilities      = "disallowCapabilities"
+	EnsureTLS                 = "ensureTLS"
 )
 
 // KaIds are IDs supported by KubeArmor.
@@ -45,6 +42,11 @@ var KyvIds = []string{
 	EscapeToHost,
 }
 
+// k8tlsIds are IDs supported by k8tls.
+var k8tlsIds = []string{
+	EnsureTLS,
+}
+
 // IsIdSupportedBy determines whether a given ID is supported by a security engine.
 func IsIdSupportedBy(id, securityEngine string) bool {
 	switch strings.ToLower(securityEngine) {
@@ -54,6 +56,8 @@ func IsIdSupportedBy(id, securityEngine string) bool {
 		return in(id, NetPolIDs)
 	case "kyverno":
 		return in(id, KyvIds)
+	case "k8tls":
+		return in(id, k8tlsIds)
 	default:
 		return false
 	}

pkg/adapter/k8s/client.go

@@ -11,6 +11,7 @@ import (
 
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/rest"
 	"k8s.io/client-go/tools/clientcmd"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -53,3 +54,21 @@ func NewDynamicClient() dynamic.Interface {
 	}
 	return clientSet
 }
+
+// NewOrDieStaticClient returns a new Kubernetes Clientset and panics if there is
+// an error in the config.
+func NewOrDieStaticClient() kubernetes.Interface {
+	config, err := rest.InClusterConfig()
+	if err != nil && errors.Is(err, rest.ErrNotInCluster) {
+		kubeconfig := filepath.Join(os.Getenv("HOME"), ".kube", "config")
+		config, err = clientcmd.BuildConfigFromFlags("", kubeconfig)
+		if err != nil {
+			panic(fmt.Sprintf("failed to load kubeconfig '%v', error: %v\n", kubeconfig, err))
+		}
+	}
+	clientSet, err := kubernetes.NewForConfig(config)
+	if err != nil {
+		panic(err)
+	}
+	return clientSet
+}

pkg/adapter/nimbus-k8tls/.dockerignore

@@ -0,0 +1 @@
+bin/

pkg/adapter/nimbus-k8tls/Dockerfile

@@ -0,0 +1,41 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2023 Authors of Nimbus
+
+FROM golang:1.22 as builder
+ARG TARGETOS
+ARG TARGETARCH
+
+WORKDIR /nimbus
+
+# relative deps requried by the adapter
+ADD api/ api/
+ADD pkg/ pkg/
+ADD go.mod go.mod
+ADD go.sum go.sum
+
+ARG ADAPTER_DIR=pkg/adapter/nimbus-k8tls
+WORKDIR /nimbus/$ADAPTER_DIR
+
+COPY $ADAPTER_DIR/go.mod go.mod
+# cache deps before building and copying source so that we don't need to re-download as much
+# and so that source changes don't invalidate our downloaded layer
+RUN go mod download
+
+COPY $ADAPTER_DIR/manager manager
+COPY $ADAPTER_DIR/builder builder
+COPY $ADAPTER_DIR/watcher watcher
+COPY $ADAPTER_DIR/main.go main.go
+
+# Build
+# the GOARCH has not a default value to allow the binary be built according to the host where the command
+# was called. For example, if we call make docker-build in a local env which has the Apple Silicon M1 SO
+# the docker BUILDPLATFORM arg will be linux/arm64 when for Apple x86 it will be linux/amd64. Therefore,
+# by leaving it empty we can ensure that the container and binary shipped on it will have the same platform.
+RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -ldflags="-s" -o bin/nimbus-k8tls main.go
+
+FROM gcr.io/distroless/static:nonroot
+WORKDIR /
+COPY --from=builder /nimbus/pkg/adapter/nimbus-k8tls/bin/nimbus-k8tls .
+USER 65532:65532
+
+ENTRYPOINT ["/nimbus-k8tls"]