train-kubernetes 0.1.10 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7e4bbb998822377221a31b8839373f73d298d6f2bd4226300ff8428742ca247c
-  data.tar.gz: e87a4add57561718dc7780d20aa0741de23e9bc615108dd139609377edb4d05b
+  metadata.gz: f788de94eac3afedbc4427c3eae60e65993db25a5ce55e8797218f580f7a080a
+  data.tar.gz: 34a3701bdd160f580ac711b7cbfd61373205327431d90f617de7e566f0c4d6a6
 SHA512:
-  metadata.gz: dfd9ca8003441da0bb8abd13f6a5ceae755239f406201b76d94ec2088a07ea12cc29e2fbe0a7132e4e6745910752823c9753a3b17585b39de62e1a5527192c6c
-  data.tar.gz: c50d9c99fe60b9b51b71b789f7c233815cf0391a89d8ffa6bc2faaae3f5f74e416211400b02e273da1f8c4348f4e749ce368eba5148acefa91faf43a533610fc
+  metadata.gz: 337bd696715b5da5c78788eaa2d896d36275d43106c929376bfb8515ec7aeaf86b2a0581f360462762a7c42187e73178fbe031cf58f77513a87ad184653635b7
+  data.tar.gz: d50c0cd6308a3dc2d4fd5cd7b0648797e74d6f908146f725454639d9f670c8252705fe9f045931964c9a2d81274731583c166352f37804b6d7ddb2897e843ad7

data/README.md

@@ -4,7 +4,7 @@ This plugin allows applications that rely on Train to communicate with the Kuber
 
 ## Usage
 
-When used in combination with the [InSpec Kubernetes Resource Pack](https://github.com/bgeesaman/inspec-k8s) you can validate the spec of any Kubernetes resource you have access to:
+When used in combination with the [InSpec Kubernetes Resource Pack](https://github.com/inspec/inspec-k8s) you can validate the spec of any Kubernetes resource you have access to:
 
 ```ruby
 describe k8sobjects(api: 'v1', type: 'pods', namespace: 'default', labelSelector: 'run=nginx') do
@@ -28,15 +28,23 @@ describe k8sobject(api: 'v1', type: 'pod', namespace: 'default', name: 'my-pod')
 end
 ```
 
+## File resource
+```ruby
+inspec.backend.file('PATH', pod: 'POD', container: 'CONTAINER', namespace: 'NAMESPACE')
+```
+Currently it supports only Linux based containers
+
+
 ## Preconditions
 
 - InSpec 3.7+ or 4.x+
 - Ruby 2.4+
 - You have set the env var KUBECONFIG or have a valid ~/.kube/config
 
-
 ## Installation
 
+**_NOTE:_** **_The train-kubernetes plugin now comes included with InSpec 5.22.0 and later, and does not require installation separately._**
+
 Train plugins are distributed as gems.  You may choose to manage the gem yourself, but if you are an InSpec user, InSPec can handle it for you.
 
 First, run:
@@ -75,18 +83,18 @@ Families:  cloud, api
 Release:   0.1.3
 ```
 
-## Troubleshooting
+## Troubleshooting (Only applicable for InSpec version 5.21.* and earlier)
 
 If you run into issues installing via `inspec plugin install train-kubernetes`, try:
 
 * Try running `gem install train-kubernetes` before `inspec plugin install train-kubernetes`.
-* Ensure the `~/.inspec/plugins.json` has `"0.1.3"` and not `"= 0.1.3"` for the `version` value.  Modify it by hand if needed. 
+* Ensure the `~/.inspec/plugins.json` has `"0.1.3"` and not `"= 0.1.3"` for the `version` value.  Modify it by hand if needed.
 * Ensure you can cleanly install the `k8s-ruby` gem version `0.10.4` or greater.  e.g. `gem install k8s-ruby -v 0.10.4`
 * Ensure that only one version of the `excon` gem is installed.  e.g. `gem list | grep excon`.  If you see two versions, `gem uninstall excon` and remove the older version.
 
 ## Reporting Issues
 
-Bugs, typos, limitations, and frustrations are welcome to be reported through the [GitHub issues page for the train-kubernetes project](https://github.com/bgeesaman/train-kubernetes/issues).
+Bugs, typos, limitations, and frustrations are welcome to be reported through the [GitHub issues page for the train-kubernetes project](https://github.com/inspec/train-kubernetes/issues).
 
 You may also ask questions in the #inspec channel of the Chef Community Slack team.  However, for an issue to get traction, please report it as a github issue.
 

data/lib/train-kubernetes/connection.rb

@@ -36,7 +36,7 @@ module TrainPlugins
 
       def parse_kubeconfig
         kubeconfig_file = @options[:kubeconfig] if @options[:kubeconfig]
-        @client = K8s::Client.config(K8s::Config.load_file(File.expand_path(kubeconfig_file)))
+        @client = K8s::Client.config(K8s::Config.load_file(::File.expand_path(kubeconfig_file)))
       end
 
       private
@@ -49,6 +49,10 @@ module TrainPlugins
                           namespace: opts[:namespace] || namespace)
                      .execute(cmd)
       end
+
+      def file_via_connection(path, **args)
+        TrainPlugins::TrainKubernetes::File::Linux.new(self, path, pod: args[:pod], container: args[:container], namespace: args[:namespace])
+      end
     end
   end
 end

data/lib/train-kubernetes/file/linux.rb

@@ -0,0 +1,149 @@
+require 'train/file/remote/linux'
+require 'train/extras/stat'
+
+module TrainPlugins
+  module TrainKubernetes
+    module File
+      class Linux < ::Train::File::Remote::Linux
+        def initialize(backend, path, follow_symlink = true, pod:, **args)
+          @backend = backend
+          @path = path || ''
+          @follow_symlink = follow_symlink
+          @pod = pod
+          @container = args[:container]
+          @namespace = args[:namespace]
+
+          sanitize_filename(path)
+          super(backend, path, follow_symlink)
+        end
+
+        def content
+          return @content if defined?(@content)
+
+          @content = @backend.run_command("cat #{@spath} || echo -n",
+                                          { pod: pod, namespace: namespace, container: container })
+                             .stdout
+          return @content unless @content.empty?
+
+          @content = nil if directory? || size.nil? || (size > 0)
+          @content
+        end
+
+        def content=(new_content)
+          execute_result = @backend.run_command('base64 --help', { pod: pod, namespace: namespace, container: container })
+          if execute_result.exit_status != 0
+            raise TransportError, "#{self.class} found no base64 binary for file writes"
+          end
+
+          unix_cmd = format("echo '%<base64>s' | base64 --decode > %<file>s",
+                            base64: Base64.strict_encode64(new_content),
+                            file: @spath)
+
+          @backend.run_command(unix_cmd, { pod: pod, namespace: namespace, container: container })
+
+          @content = new_content
+        end
+
+        def exist?
+          @exist ||= begin
+            f = @follow_symlink ? '' : " || test -L #{@spath}"
+            @backend.run_command("test -e #{@spath}" + f,
+                                 { pod: pod, namespace: namespace, container: container })
+                    .exit_status == 0
+          end
+        end
+
+        def mounted
+          @mounted ||=
+            @backend.run_command("mount | grep -- ' on #{@path} '",
+                                 { pod: pod, namespace: namespace, container: container })
+        end
+
+        def path
+          return @path unless @follow_symlink && symlink?
+
+          @link_path ||= read_target_path
+        end
+
+        def shallow_link_path
+          return nil unless symlink?
+
+          @shallow_link_path ||=
+            @backend.run_command("readlink #{@spath}", { pod: pod, namespace: namespace, container: container })
+                    .stdout
+                    .chomp
+        end
+
+        def stat
+          @stat ||= begin
+            shell_escaped_path = @spath
+            backend = @backend
+            follow_symlink = @follow_symlink
+            lstat = follow_symlink ? ' -L' : ''
+            format = '--printf'
+            res = backend.run_command("stat#{lstat} #{shell_escaped_path} 2>/dev/null #{format} '%s\n%f\n%U\n%u\n%G\n%g\n%X\n%Y\n%C'",
+                                      { pod: pod, namespace: namespace, container: container })
+            # ignore the exit_code: it is != 0 if selinux labels are not supported
+            # on the system.
+
+            fields = res.stdout.split("\n")
+            return {} if fields.length != 9
+
+            tmask = fields[1].to_i(16)
+            selinux = fields[8]
+            ## selinux security context string not available on esxi
+            selinux = nil if (selinux == '?') || (selinux == '(null)') || (selinux == 'C')
+            {
+              type: Train::Extras::Stat.find_type(tmask),
+              mode: tmask & 07777,
+              owner: fields[2],
+              uid: fields[3].to_i,
+              group: fields[4],
+              gid: fields[5].to_i,
+              mtime: fields[7].to_i,
+              size: fields[0].to_i,
+              selinux_label: selinux
+            }
+          end
+        end
+
+        def source
+          if @follow_symlink
+            self.class.new(@backend, @path, false, pod: pod, container: container, namespace: namespace)
+          else
+            self
+          end
+        end
+
+        def user_permissions
+          return {} unless exist?
+
+          skip_reource '`user_permissions` is not supported on your Linux Containers yet.'
+        end
+
+        def inherited?
+          return false unless exist?
+
+          skip_resource '`inherited?` is not supported on your Linux Containers yet.'
+        end
+
+        private
+
+        # Returns full path of a symlink target(real dest) or '' on symlink loop
+        def read_target_path
+          full_path = @backend.run_command("readlink -n #{@spath} -f",
+                                           { pod: pod, namespace: namespace, container: container })
+                              .stdout
+          # Needed for some OSes like OSX that returns relative path
+          # when the link and target are in the same directory
+          if !full_path.start_with?('/') && full_path != ''
+            full_path = ::File.expand_path("../#{full_path}", @spath)
+          end
+          full_path
+        end
+
+        attr_reader :pod, :container, :namespace
+      end
+    end
+  end
+end

data/lib/train-kubernetes/file/linux_immutable_file_check.rb

@@ -0,0 +1,50 @@
+require 'inspec/resources/file'
+require 'inspec/exceptions'
+
+module TrainPlugins
+  module TrainKubernetes
+    module File
+      class LinuxImmutableFileCheck < Inspec::Resources::LinuxImmutableFlagCheck
+        def initialize(inspec, file, pod:, container: nil, namespace: nil)
+          @pod = pod
+          @container = container
+          @namespace = namespace
+          super(inspec, file)
+        end
+
+        def find_utility_or_error(utility_name)
+          %W(/usr/sbin/#{utility_name} /sbin/#{utility_name} /usr/bin/#{utility_name} /bin/#{utility_name} #{utility_name}).each do |cmd|
+            if inspec.backend
+                     .run_command("sh -c 'type \"#{cmd}\"'", { pod: pod, container: container, namespace: namespace })
+                     .exit_status.to_i == 0
+              return cmd
+            end
+          end
+
+          raise Inspec::Exceptions::ResourceFailed, "Could not find `#{utility_name}`"
+        end
+
+        def is_immutable?
+          # Check if lsattr is available. In general, all linux system has lsattr & chattr
+          # This logic check is valid for immutable flag set with chattr
+          utility = find_utility_or_error('lsattr')
+
+          utility_cmd = inspec.backend.run_command("#{utility} #{file_path}",
+                                                   { pod: pod, container: container, namespace: namespace })
+
+          raise Inspec::Exceptions::ResourceFailed, "Executing #{utility} #{file_path} failed: #{utility_cmd.stderr}" if utility_cmd.exit_status.to_i != 0
+
+          # General output for lsattr file_name is:
+          # ----i---------e----- file_name
+          # The fifth char resembles the immutable flag. Total 20 flags are allowed.
+          lsattr_info = utility_cmd.stdout.strip.squeeze(' ')
+          lsattr_info =~ /^.{4}i.{15} .*/
+        end
+
+        private
+
+        attr_reader :pod, :container, :namespace
+      end
+    end
+  end
+end

data/lib/train-kubernetes/file/linux_permissions.rb

@@ -0,0 +1,25 @@
+module TrainPlugins
+  module TrainKubernetes
+    module File
+      class LinuxPermissions < Inspec::Resources::UnixFilePermissions
+        def initialize(inspec, pod:, namespace: nil, container: nil)
+          @pod = pod
+          @namespace = namespace
+          @container = container
+          super(inspec)
+        end
+
+        def check_file_permission_by_user(access_type, user, path)
+          flag = permission_flag(access_type)
+          perm_cmd = "su -s /bin/sh -c \"test -#{flag} #{path}\" #{user}"
+          cmd = inspec.backend.run_command(perm_cmd, { pod: pod, namespace: namespace, container: container })
+          cmd.exit_status == 0
+        end
+
+        private
+
+        attr_reader :pod, :container, :namespace
+      end
+    end
+  end
+end

data/lib/train-kubernetes/kubectl_client.rb

@@ -1,9 +1,11 @@
 require 'mixlib/shellout'
+require 'train/extras'
 
 module TrainPlugins
   module TrainKubernetes
     class KubectlClient
       attr_reader :pod, :container, :namespace
+
       DEFAULT_NAMESPACE = 'default'.freeze
 
       def initialize(pod:, namespace: nil, container: nil)
@@ -15,7 +17,10 @@ module TrainPlugins
       def execute(command, stdin: true, tty: true)
         instruction = build_instruction(command, stdin, tty)
         shell = Mixlib::ShellOut.new(instruction)
-        shell.run_command
+        res = shell.run_command
+        Train::Extras::CommandResult.new(res.stdout, res.stderr, res.exitstatus)
+      rescue Errno::ENOENT => _e
+        Train::Extras::CommandResult.new('', '', 1)
       end
 
       private
@@ -24,7 +29,7 @@ module TrainPlugins
         @shell ||= Mixlib::ShellOut.new(instruction)
       end
 
-      def build_instruction(command, stdin, tty)
+      def build_instruction(command, stdin, _tty)
         ['kubectl exec'].tap do |arr|
           arr << '--stdin' if stdin
           arr << pod if pod

data/lib/train-kubernetes/version.rb

@@ -5,6 +5,6 @@
 
 module TrainPlugins
   module TrainKubernetes
-    VERSION = '0.1.10'.freeze
+    VERSION = "0.2.1".freeze
   end
 end

data/lib/train-kubernetes.rb

@@ -18,3 +18,4 @@ require 'train-kubernetes/version'
 # Transport acts as the glue.
 require 'train-kubernetes/transport'
 require 'train-kubernetes/platform'
+require 'train-kubernetes/file/linux'

data/train-kubernetes.gemspec

@@ -19,7 +19,7 @@ Gem::Specification.new do |spec|
   spec.email         = ['bradgeesaman@gmail.com']
   spec.summary       = 'Train Kubernetes'
   spec.description   = 'A Train "transport" plugin for Chef Inspec that allows testing of all Kubernetes API resources'
-  spec.homepage      = 'https://github.com/bgeesaman/train-kubernetes'
+  spec.homepage      = 'https://github.com/inspec/train-kubernetes'
   spec.license       = 'Apache-2.0'
 
   spec.required_ruby_version = '>= 2.4'
@@ -44,7 +44,7 @@ Gem::Specification.new do |spec|
   # Do not list inspec as a dependency of the train plugin.
 
   # All plugins should mention train, > 1.4
-  # pinning k8s-ruby to 0.10.5 to avoid broken dry-type gem upgrades from k8s-ruby
-  spec.add_dependency 'k8s-ruby', '0.10.5'
+  # pinning k8s-ruby to 0.16.0 since it has support for Ruby version 3.2
+  spec.add_dependency 'k8s-ruby', '~> 0.16.0'
   spec.add_dependency 'train', '~> 3.0'
 end

metadata

@@ -1,29 +1,29 @@
 --- !ruby/object:Gem::Specification
 name: train-kubernetes
 version: !ruby/object:Gem::Version
-  version: 0.1.10
+  version: 0.2.1
 platform: ruby
 authors:
 - Brad Geesaman
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-11-15 00:00:00.000000000 Z
+date: 2024-02-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: k8s-ruby
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.10.5
+        version: 0.16.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.10.5
+        version: 0.16.0
 - !ruby/object:Gem::Dependency
   name: train
   requirement: !ruby/object:Gem::Requirement
@@ -50,12 +50,15 @@ files:
 - README.md
 - lib/train-kubernetes.rb
 - lib/train-kubernetes/connection.rb
+- lib/train-kubernetes/file/linux.rb
+- lib/train-kubernetes/file/linux_immutable_file_check.rb
+- lib/train-kubernetes/file/linux_permissions.rb
 - lib/train-kubernetes/kubectl_client.rb
 - lib/train-kubernetes/platform.rb
 - lib/train-kubernetes/transport.rb
 - lib/train-kubernetes/version.rb
 - train-kubernetes.gemspec
-homepage: https://github.com/bgeesaman/train-kubernetes
+homepage: https://github.com/inspec/train-kubernetes
 licenses:
 - Apache-2.0
 metadata: {}