-
Notifications
You must be signed in to change notification settings - Fork 532
add support for validating admission webhook in terrascan #620
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
patilpankaj212
merged 38 commits into
tenable:master
from
kanchwala-yusuf:feature/k8s-validating-webhooks
Apr 12, 2021
Merged
Changes from all commits
Commits
Show all changes
38 commits
Select commit
Hold shift + click to select a range
7c2c870
add support for k8s validating webhooks
fa10ba9
add cert and key file paths flags in server command
a5b4e5c
add support to accept API server port from user
0ecddb2
update API path for validating webhook
eae0b64
fix goimports for k8s webhook files
8df7693
add support for reading port from env variable
3a24795
refactor to move k8s specific methods into a dedicated package
ad8f796
remove API key from webhook logs url
1d5e6bc
use AdmissionWebhook interface
c91a31c
override default server port with port from env variable
814b623
fixing typos, handling pointers, refactoring some code
fc640ec
fixing unit tests
4292f1e
fixing linter issues
a2f211a
fixing go import issues
ebcba45
fix staticheck errors
e487102
removing redundant repos
6aceaa7
removing unnecessary file changes
e8f9dac
fixing html file for fetching all logs
bfb84a2
adding some unit tests
be2255f
refactor to move db logger into a separate dedicated package
66fc76e
refactor validate handler to move specific functionality into webhook…
6a1cbef
making staticcheck happy
0f67bb1
improve error message send as part of kubernetes admission response
09e55dc
fixing unit tests for http server
ffad7ad
go mod tidy
ef75299
adding review comments
6863010
sonar linter fixes
bdb11b5
fixing code smells and bugs in UI
5bb303c
trying to make sonar lint happy
90b8429
fixing html file bugs
056a9f2
Update docs/getting-started/admission-controller-webhooks-usage.md
kanchwala-yusuf 0ef2a8d
Update pkg/http-server/start.go
kanchwala-yusuf e405999
fixing documentation bullets
d9e2a71
updating documentation
f31634c
fix: admission request is saved in db logs
a53ce45
fixing go mod files
8d82d90
serving the CSS locally instead of fetching from internet
1911323
accommodating review comments on documentation
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -30,4 +30,4 @@ docs/_build/ | |
|
|
||
| .DS_Store | ||
|
|
||
| vendor/ | ||
| vendor/ | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
104 changes: 104 additions & 0 deletions
104
docs/getting-started/admission-controller-webhooks-usage.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,104 @@ | ||
| # Using Terrascan as a Kubernetes Admission Controller | ||
|
|
||
| ## Overview | ||
| Terrascan can be integrated with K8s [admissions webhooks](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/). | ||
| It can be used as one of the validating webhooks to be used and scan new configurations. | ||
|
|
||
| In this guide, we'll demonstrate how Terrascan can be configured to: | ||
| * Scan configuration changes policies when an object is being created or updated | ||
| * Allow / reject the request in case a violation is detected | ||
|
|
||
|
|
||
| ## Installation Guide | ||
|
|
||
| ### Create an instance | ||
| Your Terrascan instance has the following requirements for being able to scan K8s configurations. | ||
|
|
||
| 1. Be accessible via HTTPS. Make sure your cloud firewall is configured to allow this. | ||
| 2. Have a valid SSL certificate for the served domain name. To do that, choose one of our suggested methods: | ||
| - Use a subdomain of your choosing (e.g dev-terrascan-k8s.accurics.com) and create a valid certificate for this subdomain through your SSL certificate provider. [Let's Encrypt](https://letsencrypt.org/) is a free, simple to use certificate authority you can use. | ||
| - Use a reverse-proxy to serve SSL requests; for example, use Cloudflare Flexible to get a certificate by a trusted-CA to your [self-signed certificate](https://www.digitalocean.com/community/tutorials/openssl-essentials-working-with-ssl-certificates-private-keys-and-csrs). | ||
| - Generate a self-signed certificate and have your K8s cluster trust it. To add a trusted CA to ca-pemstore, as demonstrated in [paraspatidar's blog post](https://medium.com/@paraspatidar/add-ssl-tls-certificate-or-pem-file-to-kubernetes-pod-s-trusted-root-ca-store-7bed5cd683d). | ||
| 3. Use the Terrascan docker as demonstrated in this document, or run it from the sources. | ||
|
|
||
| ### Run Terrascan webhook service | ||
| Run Terrascan docker image in your server using the following command: | ||
| ```bash | ||
| sudo docker run -p 443:9443 -v <DATA_PATH>:/data -u root -e K8S_WEBHOOK_API_KEY=<API_KEY> accurics/terrascan server --cert-path /data/cert.pem --key-path /data/key.pem -c /data/config.toml | ||
| ``` | ||
| `<API_KEY>` is a key used for authentication between your K8s environment and the Terrascan server. Generate your preferred key and use it here. | ||
|
|
||
| `<DATA_PATH>` is a directory path in your server where both the certificate and the private key .pem files are stored. | ||
| In addition, this directory is used to save the webhook logs. (An SQLite file) | ||
|
|
||
| You can specify a config file that specifies which policies to use in the scan and which violations should lead to rejection. | ||
|
|
||
| A config file example: ```config.toml``` | ||
| ```bash | ||
| [severity] | ||
| level = "medium" | ||
| [rules] | ||
| skip-rules = [ | ||
| "accurics.kubernetes.IAM.107" | ||
| ] | ||
|
|
||
| [k8s-deny-rules] | ||
| denied-categories = [ | ||
| "Network Ports Security" | ||
| ] | ||
| denied-severity = "high" | ||
| ``` | ||
|
|
||
| You can specify the following configurations: | ||
| * **scan-rules** - one or more rules to scan | ||
| * **skip-rules** - one or more rules to skip while scanning | ||
| * **severity** - the minimal level of severity of the policies to be scanned | ||
| * **category** - the list of type of categories of the policies to be scanned | ||
|
|
||
kanchwala-yusuf marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| * **k8s-deny-rules** - specify the rules that should cause a rejection of the admission request | ||
| * **denied-categories** - one or more policy categories that are not allowed in the detected violations | ||
| * **denied-severity** - the minimal level of severity that should cause a rejection | ||
|
|
||
| ### Configure K8s to send webhooks | ||
| Configure a new ```ValidatingWebhookConfiguration``` in your Kubernetes environment and specify your Terrascan server endpoint. | ||
|
|
||
| Example: | ||
| ```bash | ||
| cat <<EOF | kubectl apply -f - | ||
| apiVersion: admissionregistration.k8s.io/v1 | ||
| kind: ValidatingWebhookConfiguration | ||
| metadata: | ||
| name: my.validation.example.check | ||
| webhooks: | ||
| - name: my.validation.example.check | ||
| rules: | ||
| - apiGroups: | ||
| - "" | ||
| apiVersions: | ||
| - v1 | ||
| operations: | ||
| - CREATE | ||
| - UPDATE | ||
| resources: | ||
| - pods | ||
| - services | ||
| failurePolicy: Fail | ||
| clientConfig: | ||
| url: https://<SERVER_ADDRESS>/v1/k8s/webhooks/<API_KEY>/scan | ||
| sideEffects: None | ||
| admissionReviewVersions: ["v1"] | ||
| EOF | ||
| ``` | ||
|
|
||
| * You can modify the `rules` that trigger the webhook according to your preferences. | ||
| * Update the ```clientConfig``` URL with your terrascan server address and the API key you generated before. | ||
|
|
||
|
|
||
| ### Test your settings | ||
| Try to run a new pod / service. For example: | ||
| ``` Bash | ||
| kubectl run mynginx --image=nginx | ||
| ``` | ||
|
|
||
| Go to ```https://<SERVER_ADDRESS>/k8s/webhooks/<API_KEY>/logs``` and verify your request is logged. | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Large diffs are not rendered by default.
Oops, something went wrong.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.