-
Notifications
You must be signed in to change notification settings - Fork 179
Add cascade CLI Command To Visualize Cascaded Scans Hierarchy
#2608
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
15 commits
Select commit
Hold shift + click to select a range
ff13d40
feat: setup cascading command
Freedisch 54592c8
feat: add `cascade` command to display scan tree
Freedisch c734372
fix register cascadingRule in schema
Freedisch 0806db6
bug: fix scans rendering issue
Freedisch ab1c1ba
bug: fix tree to render cascading rules based on findings
Freedisch 530370d
feat: add test cases
Freedisch 9758fc4
bug: fix cascade command to target scans annotations
Freedisch a69ac4f
update test cases
Freedisch f333184
bug: fix failing test cases and update format
Freedisch 17ea8b1
fix failing license CI
Freedisch d6569a6
Merge branch 'main' into cascading_rule
Freedisch ed2471f
Update scbctl/cmd/cascading.go
Freedisch 5db8dd4
Update scbctl/cmd/cascading_test.go
Freedisch cd9639d
update test cases expected response
Freedisch 284dbe3
remove unused testcases
Freedisch File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,92 @@ | ||
| // SPDX-FileCopyrightText: the secureCodeBox authors | ||
| // | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
| package cmd | ||
|
|
||
| import ( | ||
| "fmt" | ||
|
|
||
| "github.com/ddddddO/gtree" | ||
| v1 "github.com/secureCodeBox/secureCodeBox/operator/apis/execution/v1" | ||
| "github.com/spf13/cobra" | ||
| "k8s.io/cli-runtime/pkg/genericclioptions" | ||
| "sigs.k8s.io/controller-runtime/pkg/client" | ||
| ) | ||
|
|
||
| type cascadeOptions struct { | ||
| configFlags *genericclioptions.ConfigFlags | ||
| genericclioptions.IOStreams | ||
|
|
||
| namespace string | ||
| } | ||
|
|
||
| func NewCascadeCommand() *cobra.Command { | ||
| cascadeCmd := &cobra.Command{ | ||
| Use: "cascade", | ||
| Short: "Visualize cascading scans", | ||
| Long: `Visualize the relationships between scans based on their cascading relationships`, | ||
| RunE: func(cmd *cobra.Command, args []string) error { | ||
| kubeclient, namespace, err := clientProvider.GetClient(kubeconfigArgs) | ||
| if err != nil { | ||
| return fmt.Errorf("error initializing kubernetes client: %w", err) | ||
| } | ||
|
|
||
| if namespaceFlag, err := cmd.Flags().GetString("namespace"); err == nil && namespaceFlag != "" { | ||
| namespace = namespaceFlag | ||
| } | ||
|
|
||
| var scans v1.ScanList | ||
| if err := kubeclient.List(cmd.Context(), &scans, client.InNamespace(namespace)); err != nil { | ||
| return fmt.Errorf("error listing Scans: %w", err) | ||
| } | ||
|
|
||
| root := buildTree(scans.Items) | ||
|
|
||
| return gtree.OutputProgrammably(cmd.OutOrStdout(), root) | ||
| }, | ||
| } | ||
|
|
||
| return cascadeCmd | ||
| } | ||
|
|
||
| const ( | ||
| ParentScanAnnotation = "cascading.securecodebox.io/parent-scan" | ||
| ) | ||
|
|
||
| func buildTree(scans []v1.Scan) *gtree.Node { | ||
| root := gtree.NewRoot("Scans") | ||
|
|
||
| scanMap := make(map[string]*v1.Scan) | ||
| for i := range scans { | ||
| scanMap[scans[i].Name] = &scans[i] | ||
| } | ||
Freedisch marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| for _, scan := range scans { | ||
| scanMap[scan.Name] = &scan | ||
| } | ||
|
|
||
| for _, scan := range scans { | ||
| if isInitialScan(&scan) { | ||
| scanNode := root.Add(scan.Name) | ||
| buildScanSubtree(scanNode, &scan, scanMap) | ||
| } | ||
| } | ||
|
|
||
| return root | ||
| } | ||
|
|
||
| func isInitialScan(scan *v1.Scan) bool { | ||
| return scan.Annotations[ParentScanAnnotation] == "" | ||
| } | ||
|
|
||
| func buildScanSubtree(node *gtree.Node, scan *v1.Scan, scanMap map[string]*v1.Scan) { | ||
| for _, childScan := range scanMap { | ||
| if isCascadedFrom(childScan, scan) { | ||
| childNode := node.Add(childScan.Name) | ||
| buildScanSubtree(childNode, childScan, scanMap) | ||
| } | ||
| } | ||
| } | ||
|
|
||
| func isCascadedFrom(childScan *v1.Scan, parentScan *v1.Scan) bool { | ||
| return childScan.Annotations[ParentScanAnnotation] == parentScan.Name | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,213 @@ | ||
| // SPDX-FileCopyrightText: the secureCodeBox authors | ||
| // | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
| package cmd | ||
|
|
||
| import ( | ||
| "bytes" | ||
| "testing" | ||
|
|
||
| "github.com/ddddddO/gtree" | ||
| v1 "github.com/secureCodeBox/secureCodeBox/operator/apis/execution/v1" | ||
| "github.com/stretchr/testify/assert" | ||
| metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
| ) | ||
|
|
||
| func TestBuildTree(t *testing.T) { | ||
| tests := []struct { | ||
| name string | ||
| scans []v1.Scan | ||
| expected string | ||
| }{ | ||
| { | ||
| name: "Single scan", | ||
| scans: []v1.Scan{ | ||
| { | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Name: "scan1", | ||
| }, | ||
| }, | ||
| }, | ||
| expected: `Scans | ||
| └── scan1 | ||
| `, | ||
| }, | ||
Freedisch marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| { | ||
| name: "Two unrelated scans", | ||
| scans: []v1.Scan{ | ||
| { | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Name: "scan1", | ||
| }, | ||
| }, | ||
| { | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Name: "scan2", | ||
| }, | ||
| }, | ||
| }, | ||
| expected: `Scans | ||
| ├── scan1 | ||
| └── scan2 | ||
| `, | ||
| }, | ||
Freedisch marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| { | ||
| name: "One parent, one child", | ||
| scans: []v1.Scan{ | ||
| { | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Name: "parent", | ||
| }, | ||
| }, | ||
| { | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Name: "child", | ||
| Annotations: map[string]string{ | ||
| ParentScanAnnotation: "parent", | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| expected: `Scans | ||
| └── parent | ||
| └── child | ||
| `, | ||
| }, | ||
Freedisch marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| { | ||
| name: "Complex cascade", | ||
| scans: []v1.Scan{ | ||
| { | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Name: "root", | ||
| }, | ||
| }, | ||
| { | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Name: "child1", | ||
| Annotations: map[string]string{ | ||
| ParentScanAnnotation: "root", | ||
| }, | ||
| }, | ||
| }, | ||
| { | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Name: "child2", | ||
| Annotations: map[string]string{ | ||
| ParentScanAnnotation: "root", | ||
| }, | ||
| }, | ||
| }, | ||
| { | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Name: "grandchild", | ||
| Annotations: map[string]string{ | ||
| ParentScanAnnotation: "child1", | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| expected: `Scans | ||
| └── root | ||
| ├── child1 | ||
| │ └── grandchild | ||
| └── child2 | ||
| `, | ||
| }, | ||
Freedisch marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| } | ||
|
|
||
| for _, tt := range tests { | ||
| t.Run(tt.name, func(t *testing.T) { | ||
| root := buildTree(tt.scans) | ||
| var buf bytes.Buffer | ||
| err := gtree.OutputProgrammably(&buf, root) | ||
| assert.NoError(t, err) | ||
| result := buf.String() | ||
| assert.Equal(t, tt.expected, result) | ||
| }) | ||
| } | ||
| } | ||
|
|
||
| func TestIsInitialScan(t *testing.T) { | ||
| tests := []struct { | ||
| name string | ||
| scan v1.Scan | ||
| expected bool | ||
| }{ | ||
| { | ||
| name: "Initial scan", | ||
| scan: v1.Scan{ | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Name: "initial", | ||
| }, | ||
| }, | ||
| expected: true, | ||
| }, | ||
| { | ||
| name: "Child scan", | ||
| scan: v1.Scan{ | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Name: "child", | ||
| Annotations: map[string]string{ | ||
| ParentScanAnnotation: "parent", | ||
| }, | ||
| }, | ||
| }, | ||
| expected: false, | ||
| }, | ||
| } | ||
|
|
||
| for _, tt := range tests { | ||
| t.Run(tt.name, func(t *testing.T) { | ||
| result := isInitialScan(&tt.scan) | ||
| assert.Equal(t, tt.expected, result) | ||
| }) | ||
| } | ||
| } | ||
|
|
||
| func TestIsCascadedFrom(t *testing.T) { | ||
| tests := []struct { | ||
| name string | ||
| childScan v1.Scan | ||
| parentScan v1.Scan | ||
| expected bool | ||
| }{ | ||
| { | ||
| name: "Direct child", | ||
| childScan: v1.Scan{ | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Name: "child", | ||
| Annotations: map[string]string{ | ||
| ParentScanAnnotation: "parent", | ||
| }, | ||
| }, | ||
| }, | ||
| parentScan: v1.Scan{ | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Name: "parent", | ||
| }, | ||
| }, | ||
| expected: true, | ||
| }, | ||
| { | ||
| name: "Unrelated scans", | ||
| childScan: v1.Scan{ | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Name: "scan1", | ||
| }, | ||
| }, | ||
| parentScan: v1.Scan{ | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Name: "scan2", | ||
| }, | ||
| }, | ||
| expected: false, | ||
| }, | ||
| } | ||
|
|
||
| for _, tt := range tests { | ||
| t.Run(tt.name, func(t *testing.T) { | ||
| result := isCascadedFrom(&tt.childScan, &tt.parentScan) | ||
| assert.Equal(t, tt.expected, result) | ||
| }) | ||
| } | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.