kube_auto_analyzer 0.0.14 → 0.0.15

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6942a3c49b753679c8a0e5f3822792ef6ff48eb9d4e053ef912f71e27a445fa2
-  data.tar.gz: 0a7721a4baf81d4655c76d264cc2a2a62358b9f4a1129441e8c9ae3bb6d1a42a
+  metadata.gz: 3821dec919c2353aae2223cc7650ddbe2c433a600f4c985423a5e3b42290ce06
+  data.tar.gz: 6252e63c3a26e503a2074990c8ad0a791634b742d898fded95311714e23ebaf6
 SHA512:
-  metadata.gz: 304c20becfe0d4b891577ff79450b6160f66d9472b572ffc64c8ea9f60854cb687e4c447e9931936a53fbc54cc307256d3b73e656334f0a8a8e2c08f017def80
-  data.tar.gz: ec5669b731a1835a6dbde5a259b2f90a6ab418152dde5778a74d2c2024fa136f7249c52a1975629c6ca9047a300dee9759b6163759c2c9fd318fc37bde7f5531
+  metadata.gz: 60780447ef3aa3769590660344d0f64fe6b8459ba5790c3b302bd929a39b5b0477e50c491cf7a7f3af8eadc5a3812718e12b0b027d1ef19df1161ce977dc7df3
+  data.tar.gz: b525c4f4862b6cedae986dce2249f9cab86dd549383a565da548c6aada26ce9424e3e9b052b4ea6e0c1240aac176a5c4c7d3293254059cd4afd48149eb88379f

data/bin/kubeautoanalyzer

@@ -18,6 +18,7 @@
   options.context = false
   options.nosslverify = false
   options.dump_config = false
+  options.audit_rbac = false
 
   opts = OptionParser.new do |opts|
     opts.banner = "Kubernetes Auto Analyzer #{KubeAutoAnalyzer::VERSION}"
@@ -37,6 +38,10 @@
       options.context = context
     end
 
+    opts.on("--rbac", "Audit RBAC") do |rbac|
+      options.audit_rbac = true
+    end
+
     opts.on("--nosslverify [NOVERIFY]", "disable SSL verification") do |noverify|
       options.nosslverify = true
     end

data/lib/kube_auto_analyzer/api_checks/rbac_auditor.rb

@@ -0,0 +1,52 @@
+module KubeAutoAnalyzer
+  def self.audit_rbac
+    @log.debug("Entering the RBAC Auditor")
+    target = @options.target_server
+    @log.debug("Auditing RBAC on #{target}")
+    @results[target][:rbac] = Hash.new
+    cluster_roles = @rbac_client.get_cluster_roles
+    @log.debug("got #{cluster_roles.length.to_s} cluster roles")
+    cluster_role_bindings = @rbac_client.get_cluster_role_bindings
+    @log.debug("got #{cluster_role_bindings.length.to_s} cluster role bindings")
+    @results[target][:rbac][:cluster_roles] = Hash.new
+    cluster_roles.each do |role|
+      role_output = Hash.new
+      role_output[:rules] = role.rules
+
+      @log.debug("metadata in #{role.metadata[:name]} , #{role.metadata}")
+      begin
+        if role.metadata[:labels]['kubernetes.io/bootstrapping'] == "rbac-defaults"
+          role_output[:default] = true
+        else
+          role_output[:default] = false
+        end
+      rescue NoMethodError
+        #If there's no method, it can't be a default...
+        role_output[:default] = false
+      end
+      role_output[:subjects] = Array.new
+      cluster_role_bindings.each do |binding|
+        #So we're testing if the binding has any subjects and if so whether they apply to this role or not
+        if binding.subjects 
+          @log.debug("#{binding.roleRef[:name]} binding has #{binding.subjects.length.to_s} bindings")
+        else
+          @log.debug("#{binding.roleRef[:name]} has no subjects")
+        end
+        @log.debug(binding.roleRef[:kind] + ", " + role.metadata[:name] + ", " + binding.roleRef[:name] + ", " + (binding.subjects ? binding.subjects.length.to_s : "0") )
+        if binding.roleRef[:kind] == "ClusterRole"
+          @log.debug("Matched the cluster role")
+          if binding.roleRef[:name] == role.metadata[:name]
+            @log.debug("matched the role name")
+            if binding.subjects
+              binding.subjects.each do |subject|
+                @log.debug("added a subject to the list")
+                role_output[:subjects] << subject
+              end
+            end
+          end
+        end
+      end
+      @results[target][:rbac][:cluster_roles][role.metadata[:name]] = role_output
+    end
+  end
+end

data/lib/kube_auto_analyzer/reporting.rb

@@ -279,6 +279,35 @@ module KubeAutoAnalyzer
       @html_report_file.puts "<br><br>"
     end
 
+    #Only show this section if we were asked to dump RBAC
+    if @options.audit_rbac
+      @html_report_file.puts "<br><br>"
+      @html_report_file.puts "<br><br><h2>Cluster Role Information</h2>"
+      @html_report_file.puts "<table><thead><tr><th>Name</th><th>Default?</th><th>Subjects</th><th>Rules</th></tr></thead>"
+      @results[@options.target_server][:rbac][:cluster_roles].each do |name, info|
+        subjects = ''
+        info[:subjects].each do |subject|
+          subjects << "#{subject[:kind]}:#{subject[:namespace]}:#{subject[:name]}<br>"
+        end
+        rules = ''
+        info[:rules].each do |rule|
+          unless rule.verbs
+            rule.verbs = Array.new
+          end
+          unless rule.apiGroups
+            rule.apiGroups = Array.new
+          end
+          unless rule.resources
+            rule.resources = Array.new
+          end
+          rules << "Verbs : #{rule.verbs.join(', ')}<br>API Groups : #{rule.apiGroups.join(', ')}<br>Resources : #{rule.resources.join(', ')}<br><hr>"
+        end
+        @html_report_file.puts "<tr><td>#{name}</td><td>#{info[:default]}</td><td>#{subjects}</td><td>#{rules}</td></tr>"
+      end
+      @html_report_file.puts "</table>"
+      @html_report_file.puts "<br><br>"
+    end
+
 
     #Close the master Node Div
     @html_report_file.puts "</table></div>"

data/lib/kube_auto_analyzer/version.rb

@@ -1,3 +1,3 @@
 module KubeAutoAnalyzer
-  VERSION = "0.0.14"
+  VERSION = "0.0.15"
 end

data/lib/kube_auto_analyzer.rb

@@ -3,6 +3,7 @@ module KubeAutoAnalyzer
   require "kube_auto_analyzer/version"
   require "kube_auto_analyzer/api_checks/master_node"
   require "kube_auto_analyzer/api_checks/config_dumper"
+  require "kube_auto_analyzer/api_checks/rbac_auditor"
   require "kube_auto_analyzer/reporting"
   require "kube_auto_analyzer/agent_checks/file_checks"
   require "kube_auto_analyzer/agent_checks/process_checks"
@@ -58,6 +59,7 @@ module KubeAutoAnalyzer
       end
       @results[@options.target_server] = Hash.new
       @client = Kubeclient::Client.new @options.target_server, 'v1', auth_options: auth_options, ssl_options: ssl_options
+      @rbac_client = Kubeclient::Client.new @options.target_server + '/apis/rbac.authorization.k8s.io', 'v1', auth_options: auth_options, ssl_options: ssl_options
     else
       begin
         config = Kubeclient::Config.read(@options.config_file)
@@ -79,6 +81,14 @@ module KubeAutoAnalyzer
             auth_options: context.auth_options
           }
         )
+        @rbac_client = Kubeclient::Client.new(
+          context.api_endpoint + '/apis/rbac.authorization.k8s.io',
+          context.api_version,
+          {
+            ssl_options: {client_cert: context.ssl_options[:client_cert], client_key: context.ssl_options[:client_key],verify_ssl: OpenSSL::SSL::VERIFY_NONE},
+            auth_options: context.auth_options
+          }
+        )
       else
         @client = Kubeclient::Client.new(
           context.api_endpoint,
@@ -88,6 +98,14 @@ module KubeAutoAnalyzer
             auth_options: context.auth_options
           }
         )
+        @rbac_client = Kubeclient::Client.new(
+          context.api_endpoint + '/apis/rbac.authorization.k8s.io',
+          context.api_version,
+          {
+            ssl_options: context.ssl_options,
+            auth_options: context.auth_options
+          }
+        )
       end
       #We didn't specify the target on the command line so lets get it from the config file
       @options.target_server = context.api_endpoint
@@ -121,6 +139,9 @@ module KubeAutoAnalyzer
     if @options.dump_config
       dump_config
     end
+    if @options.audit_rbac
+      audit_rbac
+    end
     if @options.html_report
       html_report
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kube_auto_analyzer
 version: !ruby/object:Gem::Version
-  version: 0.0.14
+  version: 0.0.15
 platform: ruby
 authors:
 - Rory McCune
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-06-12 00:00:00.000000000 Z
+date: 2018-06-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -69,6 +69,7 @@ files:
 - lib/kube_auto_analyzer/agent_checks/process_checks.rb
 - lib/kube_auto_analyzer/api_checks/config_dumper.rb
 - lib/kube_auto_analyzer/api_checks/master_node.rb
+- lib/kube_auto_analyzer/api_checks/rbac_auditor.rb
 - lib/kube_auto_analyzer/data-logo.b64
 - lib/kube_auto_analyzer/js_files/chartkick.js
 - lib/kube_auto_analyzer/js_files/highcharts.js