Port kubesec to golang

[stefanprodan]

This PR implements the following:

• CLI commands version, scan [file], http [port]
• packages rules, ruler, server
• implement kind filter for rules
• add host network, PID and IPC rules
• add docker socket rule
• add security context rules (includes init containers)
• add CPU and memory requests/limits rules
• add rules tests
• CI with Travis, Docker and GoReleaser

To run the CLI:

• install go dep https://github.com/golang/dep#installation
• install goreleaser https://goreleaser.com/install/
• build with goreleaser --snapshot --rm-dist
• run the binary ./dist/linux_amd64/kubesec version

To run the HTTP server:

• download deps dep ensure -vendor-only
• build the image docker build -t kubesec .
• run it docker run -dp 9090:9090 --name=kubesec kubesec

[stefanprodan]

@sublimino you didn't apply for GitHub actions? Please try to run the version command and let me know if it works

[sublimino]

I did apply for GH actions, I'm still on the waitlist though 😿

All the above commands work ✔️

version v0.0.0-next
git commit bcf908b290579849705e0b428e0c4d1c5fc519da
build date 2019-01-29T13:25:22Z

[stefanprodan]

Scan command example:

go run cmd/kubesec/* scan ./test/asset/score-0-daemonset-host-network.yml 

Result:

{
  "error": "Failed with a score of -9 points",
  "score": -9,
  "scoring": {
    "critical": [
      {
        "selector": ".spec .hostNetwork",
        "reason": "Sharing the host's network namespace permits processes in the pod to communicate with processes bound to the host's loopback adapter",
        "weight": 0
      }
    ],
    "advise": [
      {
        "selector": "containers[] .securityContext .readOnlyRootFilesystem == true",
        "reason": "An immutable root filesystem can prevent malicious binaries being added to PATH and increase attack cost",
        "weight": 0
      },
      {
        "selector": "containers[] .securityContext .runAsNonRoot == true",
        "reason": "Force the running image to run as a non-root user to ensure least privilege",
        "weight": 0
      },
      {
        "selector": "containers[] .securityContext .runAsUser -gt 10000",
        "reason": "Run as a high-UID user to avoid conflicts with the host's user table",
        "weight": 0
      }
    ]
  }
}

[stefanprodan]

@sublimino the scoring logic from bash needs to be ported to Ruleset.Run. I'm having problems understanding what's going on there...

[stefanprodan]

HTTP server example:

Start server:

 go run cmd/kubesec/* http 9090

Or start it as a docker container:

docker build -t kubesec .

docker run -dp 9090:9090 --name=kubesec kubesec

Post file:

curl -sSX POST --data-binary @test/asset/score-0-daemonset-host-network.yml http://localhost:9090/scan 

Result:

{
  "error": "Failed with a score of -9 points",
  "score": -9,
  "scoring": {
    "critical": [
      {
        "selector": ".spec .hostNetwork",
        "reason": "Sharing the host's network namespace permits processes in the pod to communicate with processes bound to the host's loopback adapter",
        "weight": 0
      }
    ],
    "advise": [
      {
        "selector": "containers[] .securityContext .readOnlyRootFilesystem == true",
        "reason": "An immutable root filesystem can prevent malicious binaries being added to PATH and increase attack cost",
        "weight": 0
      },
      {
        "selector": "containers[] .securityContext .runAsNonRoot == true",
        "reason": "Force the running image to run as a non-root user to ensure least privilege",
        "weight": 0
      },
      {
        "selector": "containers[] .securityContext .runAsUser -gt 10000",
        "reason": "Run as a high-UID user to avoid conflicts with the host's user table",
        "weight": 0
      }
    ]
  }
}

[sublimino]

LVGTM 👍👍