feat: Feature to select namespaces (match or exclude), resources within a namespace, and nodes in ClusterIntentBinding

[shivaccuknox]

Description

This pull request implements the design described in https://docs.google.com/document/d/1-zxAMBpX-ZdpmDTjS0qzmFk5pueOCtLaGa970KJLTNc/edit#heading=h.yr2q844nprgt

Fixes # #105

BREAKING CHANGE:

• The Nimbus API has changed since the CRD is modified. The API version is set to v1alpha1

Checklist

• PR title follows the <type>: <description> convention
• I use conventional commits in my commit messages
• I have updated the documentation accordingly
• I Keep It Small and Simple: The smaller the PR is, the easier it is to review and have it merged
• I have performed a self-review of my code
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

Additional information for reviewer

Mention if this PR is part of any design or a continuation of previous PRs

[VedRatan]

@shivaccuknox you need to run make test-doc to reflect your changes in e2e-tests and integration tests

[anurag-rajawat]

After applying csib-1-all-ns-selector.yaml, I observed the following issues

• NimbusPolicy status was not updated.

$ kubectl get si,sib,np,csib,cwnp,ksp,netpol,pol,cpol -A
NAME                                                       STATUS    AGE
securityintent.intent.security.nimbus.com/escape-to-host   Created   17m

NAMESPACE             NAME                                                                             STATUS   AGE   POLICIES
chainsaw-hardy-boar   nimbuspolicy.intent.security.nimbus.com/nimbus-ctlr-gen-escape-to-host-binding            17m   
default               nimbuspolicy.intent.security.nimbus.com/nimbus-ctlr-gen-escape-to-host-binding            17m   
istio-system          nimbuspolicy.intent.security.nimbus.com/nimbus-ctlr-gen-escape-to-host-binding            17m   
k0s-autopilot         nimbuspolicy.intent.security.nimbus.com/nimbus-ctlr-gen-escape-to-host-binding            17m   
kube-node-lease       nimbuspolicy.intent.security.nimbus.com/nimbus-ctlr-gen-escape-to-host-binding            17m   
kube-public           nimbuspolicy.intent.security.nimbus.com/nimbus-ctlr-gen-escape-to-host-binding            17m   
kubearmor             nimbuspolicy.intent.security.nimbus.com/nimbus-ctlr-gen-escape-to-host-binding            17m   
kyverno               nimbuspolicy.intent.security.nimbus.com/nimbus-ctlr-gen-escape-to-host-binding            17m   
nimbus                nimbuspolicy.intent.security.nimbus.com/nimbus-ctlr-gen-escape-to-host-binding            17m   

NAMESPACE   NAME                                                                             STATUS    AGE   INTENTS   CLUSTERNIMBUSPOLICY
            clustersecurityintentbinding.intent.security.nimbus.com/escape-to-host-binding   Created   17m   1         escape-to-host-binding

NAMESPACE   NAME                                                                    STATUS    AGE   POLICIES
            clusternimbuspolicy.intent.security.nimbus.com/escape-to-host-binding   Created   17m   0

• KubeArmor adapterdid not create any policies for any nimbuspolicy even though it supports escape-to-host securityintent:

nimbus/pkg/adapter/idpool/idpool.go

Line 27 in 5a42174

SwDeploymentTools, UnAuthorizedSaTokenAccess, DNSManipulation, EscapeToHost, ExploitPFA,

{"level":"info","ts":"2024-06-04T14:51:59+05:30","msg":"KubeArmor adapter started"}
{"level":"info","ts":"2024-06-04T14:51:59+05:30","msg":"KubeArmorPolicy watcher started"}
{"level":"info","ts":"2024-06-04T14:51:59+05:30","msg":"ClusterNimbusPolicy watcher started"}
{"level":"info","ts":"2024-06-04T14:51:59+05:30","msg":"NimbusPolicy watcher started"}
{"level":"info","ts":"2024-06-04T14:52:55+05:30","msg":"ClusterNimbusPolicy found","ClusterNimbusPolicy.Name":"escape-to-host-binding"}
No-op for ClusterNimbusPolicy
{"level":"info","ts":"2024-06-04T14:52:55+05:30","msg":"NimbusPolicy found","NimbusPolicy.Name":"nimbus-ctlr-gen-escape-to-host-binding","NimbusPolicy.Namespace":"istio-system"}
{"level":"info","ts":"2024-06-04T14:52:55+05:30","msg":"NimbusPolicy found","NimbusPolicy.Name":"nimbus-ctlr-gen-escape-to-host-binding","NimbusPolicy.Namespace":"kyverno"}
{"level":"info","ts":"2024-06-04T14:52:55+05:30","msg":"NimbusPolicy found","NimbusPolicy.Name":"nimbus-ctlr-gen-escape-to-host-binding","NimbusPolicy.Namespace":"nimbus"}
{"level":"info","ts":"2024-06-04T14:52:55+05:30","msg":"NimbusPolicy found","NimbusPolicy.Name":"nimbus-ctlr-gen-escape-to-host-binding","NimbusPolicy.Namespace":"kubearmor"}
{"level":"info","ts":"2024-06-04T14:52:55+05:30","msg":"NimbusPolicy found","NimbusPolicy.Name":"nimbus-ctlr-gen-escape-to-host-binding","NimbusPolicy.Namespace":"chainsaw-hardy-boar"}
{"level":"info","ts":"2024-06-04T14:52:55+05:30","msg":"NimbusPolicy found","NimbusPolicy.Name":"nimbus-ctlr-gen-escape-to-host-binding","NimbusPolicy.Namespace":"default"}
{"level":"info","ts":"2024-06-04T14:52:55+05:30","msg":"NimbusPolicy found","NimbusPolicy.Name":"nimbus-ctlr-gen-escape-to-host-binding","NimbusPolicy.Namespace":"k0s-autopilot"}
{"level":"info","ts":"2024-06-04T14:52:55+05:30","msg":"NimbusPolicy found","NimbusPolicy.Name":"nimbus-ctlr-gen-escape-to-host-binding","NimbusPolicy.Namespace":"kube-node-lease"}
{"level":"info","ts":"2024-06-04T14:52:55+05:30","msg":"NimbusPolicy found","NimbusPolicy.Name":"nimbus-ctlr-gen-escape-to-host-binding","NimbusPolicy.Namespace":"kube-public"}

• Kyverno adapter failed to create its KyvernoClusterPolicy. Additionally, it did not create any policies, including KyvernoPolicies (namespace-scoped) or KyvernoClusterPolicies (global-scoped). Again it also supports escape-to-host securityintent.

nimbus/pkg/adapter/idpool/idpool.go

Lines 44 to 47 in 5a42174

	// KyvIds are IDs supported by Kyverno.
	var KyvIds = []string{
	EscapeToHost,
	}

{"level":"info","ts":"2024-06-04T14:52:09+05:30","msg":"Kyverno adapter started"}
{"level":"info","ts":"2024-06-04T14:52:09+05:30","msg":"KyvernoClusterPolicy watcher started"}
{"level":"info","ts":"2024-06-04T14:52:09+05:30","msg":"KyvernoPolicy watcher started"}
{"level":"info","ts":"2024-06-04T14:52:09+05:30","msg":"ClusterNimbusPolicy watcher started"}
{"level":"info","ts":"2024-06-04T14:52:09+05:30","msg":"NimbusPolicy watcher started"}
{"level":"info","ts":"2024-06-04T14:52:55+05:30","msg":"ClusterNimbusPolicy found","ClusterNimbusPolicy.Name":"escape-to-host-binding"}
{"level":"error","ts":"2024-06-04T14:52:56+05:30","msg":"failed to create KyvernoClusterPolicy","KyvernoClusterPolicy.Name":"escape-to-host-binding-escapetohost","error":"admission webhook \"validate-policy.kyverno.svc\" denied the request: spec.rules[0].match.any[0].selector: Invalid value: v1.LabelSelector{MatchLabels:map[string]string(nil), MatchExpressions:[]v1.LabelSelectorRequirement(nil)}: The requirements are not specified in selector","stacktrace":"github.com/5GSEC/nimbus/pkg/adapter/nimbus-kyverno/manager.createOrUpdateKcp\n\t/Users/anurag/Projects/work/nimbus/pkg/adapter/nimbus-kyverno/manager/manager.go:220\ngithub.com/5GSEC/nimbus/pkg/adapter/nimbus-kyverno/manager.Run\n\t/Users/anurag/Projects/work/nimbus/pkg/adapter/nimbus-kyverno/manager/manager.go:75\nmain.main\n\t/Users/anurag/Projects/work/nimbus/pkg/adapter/nimbus-kyverno/main.go:34\nruntime.main\n\t/opt/homebrew/opt/go/libexec/src/runtime/proc.go:271"}

[anurag-rajawat]

@VedRatan the e2e-tests are passing, but I'm little surprised given the recent changes. Is there something I might be missing?