kube_auto_analyzer 0.0.13 → 0.0.14

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 505335d6f2e3102fce7ab791cf9dbd0d425287f6
-  data.tar.gz: 2ae7b141f4b7fca4d37c3bf95a9f86d26ac8685b
+SHA256:
+  metadata.gz: 6942a3c49b753679c8a0e5f3822792ef6ff48eb9d4e053ef912f71e27a445fa2
+  data.tar.gz: 0a7721a4baf81d4655c76d264cc2a2a62358b9f4a1129441e8c9ae3bb6d1a42a
 SHA512:
-  metadata.gz: b8c7815f485ee0b1d293bc9e42a7f13d73a7c42cee38e5027394091e30040c50fc3631d1e0bc3ad9d5c17e7a106a2dd5946cdbe2080bb07a582f4f44180fdf38
-  data.tar.gz: c6c9ff8509a21c8d287b505f1c6e17b157c0adf61318b73326722885d7f17b044f1d46341a297c14cb63e8c7e7fbcada3a8220245ee31e5f659d48f3462eb766
+  metadata.gz: 304c20becfe0d4b891577ff79450b6160f66d9472b572ffc64c8ea9f60854cb687e4c447e9931936a53fbc54cc307256d3b73e656334f0a8a8e2c08f017def80
+  data.tar.gz: ec5669b731a1835a6dbde5a259b2f90a6ab418152dde5778a74d2c2024fa136f7249c52a1975629c6ca9047a300dee9759b6163759c2c9fd318fc37bde7f5531

data/bin/kubeautoanalyzer

@@ -17,6 +17,7 @@
   options.insecure = false
   options.context = false
   options.nosslverify = false
+  options.dump_config = false
 
   opts = OptionParser.new do |opts|
     opts.banner = "Kubernetes Auto Analyzer #{KubeAutoAnalyzer::VERSION}"
@@ -28,6 +29,10 @@
       options.config_file = file
     end
 
+    opts.on("-d", "--dump [DUMP]", "Dump cluster config into report") do |dump|
+      options.dump_config = true
+    end
+
     opts.on("--context [CONTEXT]", "context to use from kubeconfig") do |context|
       options.context = context
     end

data/lib/kube_auto_analyzer.rb

@@ -2,6 +2,7 @@ module KubeAutoAnalyzer
   attr_accessor :execute
   require "kube_auto_analyzer/version"
   require "kube_auto_analyzer/api_checks/master_node"
+  require "kube_auto_analyzer/api_checks/config_dumper"
   require "kube_auto_analyzer/reporting"
   require "kube_auto_analyzer/agent_checks/file_checks"
   require "kube_auto_analyzer/agent_checks/process_checks"
@@ -117,6 +118,9 @@ module KubeAutoAnalyzer
       check_kubelet_process
       check_amicontained
     end
+    if @options.dump_config
+      dump_config
+    end
     if @options.html_report
       html_report
     end

data/lib/kube_auto_analyzer/api_checks/config_dumper.rb

@@ -0,0 +1,30 @@
+module KubeAutoAnalyzer
+ def self.dump_config
+  @log.debug("Entering the config dumper module")
+  target = @options.target_server
+  @log.debug("dumping the config for #{target}")
+  @results[target][:config] = Hash.new
+  pods = @client.get_pods
+  docker_images = Array.new
+  #Specific requirement here in that it's useful to know what Docker images are in use on the cluster.
+  pods.each do |pod|
+    docker_images << pod.status[:containerStatuses][0][:image]
+  end
+  @log.debug("logged #{docker_images.length} docker images")
+  @results[target][:config][:docker_images] = docker_images.uniq
+
+  @results[target][:config][:pod_info] = Array.new
+
+  #Lets record some information about each pod
+  pods.each do |pod|
+    currpod = Hash.new
+    currpod[:name] = pod.metadata[:name]
+    currpod[:namespace] = pod.metadata[:namespace]
+    currpod[:service_account] = pod.spec[:serviceAccount]
+    currpod[:host_ip] = pod[:status][:hostIP]
+    currpod[:pod_ip] = pod[:status][:podIP]
+    @results[target][:config][:pod_info] << currpod
+  end
+
+ end
+end

data/lib/kube_auto_analyzer/reporting.rb

@@ -259,6 +259,27 @@ module KubeAutoAnalyzer
     @results[@options.target_server]['evidence'].each do |area, output|
       @html_report_file.puts "<tr><td>#{area}</td><td>#{output}</td></tr>"
     end
+    @html_report_file.puts "</table>"  
+
+    #Only show this section if we were asked to dump the config
+    if @options.dump_config
+      @html_report_file.puts "<br><br>"
+      @html_report_file.puts "<br><br><h2>Cluster Config Information</h2>"
+      @html_report_file.puts "<table><thead><tr><th>Docker Images In Use</th></tr></thead>"
+      @results[@options.target_server][:config][:docker_images].each do |image|
+        @html_report_file.puts "<tr><td>#{image}</td></tr>"
+      end
+      @html_report_file.puts "</table>"
+      @html_report_file.puts "<br><br>"
+      @html_report_file.puts "<table><thead><tr><th>Pod Name</th><th>Namespace</th><th>Service Account</th><th>Host IP</th><th>Pod IP</th></tr></thead>"
+      @results[@options.target_server][:config][:pod_info].each do |pod|
+        @html_report_file.puts "<tr><td>#{pod[:name]}</td><td>#{pod[:namespace]}</td><td>#{pod[:service_account]}</td><td>#{pod[:host_ip]}</td><td>#{pod[:pod_ip]}</td></tr>"
+      end
+      @html_report_file.puts "</table>"
+      @html_report_file.puts "<br><br>"
+    end
+
+
     #Close the master Node Div
     @html_report_file.puts "</table></div>"
     if @options.agent_checks
@@ -331,7 +352,7 @@ module KubeAutoAnalyzer
     @html_report_file.puts '<br><h3>External Unauthenticated Access to the Kubelet</h3>'
     @html_report_file.puts "<table><thead><tr><th>Node IP Address</th><th>Result</th></thead>"
     @results[@options.target_server]['vulns']['unauth_kubelet'].each do |node, result|
-      unless (result =~ /Forbidden/ || result =~ /Not Open/)
+      unless (result =~ /Forbidden/ || result =~ /Not Open/ || result =~ /Unauthorized/)
         output = "Vulnerable"
       else
         output = result

data/lib/kube_auto_analyzer/version.rb

@@ -1,3 +1,3 @@
 module KubeAutoAnalyzer
-  VERSION = "0.0.13"
+  VERSION = "0.0.14"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kube_auto_analyzer
 version: !ruby/object:Gem::Version
-  version: 0.0.13
+  version: 0.0.14
 platform: ruby
 authors:
 - Rory McCune
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-06-08 00:00:00.000000000 Z
+date: 2018-06-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -67,6 +67,7 @@ files:
 - lib/kube_auto_analyzer.rb
 - lib/kube_auto_analyzer/agent_checks/file_checks.rb
 - lib/kube_auto_analyzer/agent_checks/process_checks.rb
+- lib/kube_auto_analyzer/api_checks/config_dumper.rb
 - lib/kube_auto_analyzer/api_checks/master_node.rb
 - lib/kube_auto_analyzer/data-logo.b64
 - lib/kube_auto_analyzer/js_files/chartkick.js
@@ -99,7 +100,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.8
+rubygems_version: 2.7.7
 signing_key: 
 specification_version: 4
 summary: A Gem which provides a script and class analyze the security of a Kubernetes