train-kubernetes 0.1.7 → 0.1.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8986e6c4d497daf88599d830bcad43f9206936666311c6c0c0fab15002e41985
-  data.tar.gz: d1c56b619bceddf1c957ae6b29dfebfa583177202c9f6412616d519ee9e2ad26
+  metadata.gz: fcca2f4cc7de5b099cb5a3ee64e8ec7e935fdb986234d4ca9a3659d73efa874e
+  data.tar.gz: 15006a25d2cc0a823e21025d0b9f02cdd75bcefcac6965a28b17735147c1a4df
 SHA512:
-  metadata.gz: e2cc0de3cded1306ef5edd69c47b8c66ee49dfd517ec9f50223d152c08debe4e01ed95d9d2d8714bf7dd30865b45d9db86422e284ec0ae1a7ba271495de9a03a
-  data.tar.gz: 8399e9ab6d48cbd741ff42208ca400a7e91f7b86bd76f0c4593b7e95c2c7daecc47135fead6faf0dd839e3cbe5bc2be2ed8cd4e7e5f4a998eed58be94eeb2d4d
+  metadata.gz: 17df60f7afdf0948ea15ce899b97b3aa33ba2173e87715c2b736783644a48aae037112188c570aab65f2cc3f40978e16c43c716c489623a7f556757b9204bfa6
+  data.tar.gz: 47f38cc6b1b41873f411da7a6fc3be723d2ead3cf5a0b225367a5bd6bfe518a57eb06f1805e1557d708d8e3c161881a4b4dbc6747aaaf0e760573795c5a43f38

data/README.md

@@ -28,6 +28,13 @@ describe k8sobject(api: 'v1', type: 'pod', namespace: 'default', name: 'my-pod')
 end
 ```
 
+## File resource
+```ruby
+inspec.backend.file('PATH', pod: 'POD', container: 'CONTAINER', namespace: 'NAMESPACE')
+```
+Currently it supports only Linux based containers
+
+
 ## Preconditions
 
 - InSpec 3.7+ or 4.x+

data/lib/train-kubernetes/connection.rb

@@ -1,6 +1,7 @@
 require 'train'
 require 'k8s-ruby'
 require 'train-kubernetes/platform'
+require 'train-kubernetes/kubectl_client'
 
 module TrainPlugins
   module TrainKubernetes
@@ -9,8 +10,9 @@ module TrainPlugins
 
       def initialize(options)
         super(options)
-        @pod = options[:pod]
+        @pod = options[:pod] || options[:path]&.gsub('/', '')
         @container = options[:container]
+        @namespace = options[:namespace] || options[:host]
         parse_kubeconfig
         connect
       end
@@ -34,15 +36,22 @@ module TrainPlugins
 
       def parse_kubeconfig
         kubeconfig_file = @options[:kubeconfig] if @options[:kubeconfig]
-        @client = K8s::Client.config(K8s::Config.load_file(File.expand_path(kubeconfig_file)))
+        @client = K8s::Client.config(K8s::Config.load_file(::File.expand_path(kubeconfig_file)))
       end
 
       private
 
-      attr_reader :pod, :container
+      attr_reader :pod, :container, :namespace
 
-      def run_command_via_connection(cmd, &_data_handler)
-        KubectlClient.new(pod: pod, container: container).execute(cmd)
+      def run_command_via_connection(cmd, opts = {}, &_data_handler)
+        KubectlClient.new(pod: opts[:pod] || pod,
+                          container: opts[:container] || container,
+                          namespace: opts[:namespace] || namespace)
+                     .execute(cmd)
+      end
+
+      def file_via_connection(path, **args)
+        TrainPlugins::TrainKubernetes::File::Linux.new(self, path, pod: args[:pod], container: args[:container], namespace: args[:namespace])
       end
     end
   end

data/lib/train-kubernetes/file/linux.rb

@@ -0,0 +1,149 @@
+require 'train/file/remote/linux'
+require 'train/extras/stat'
+
+module TrainPlugins
+  module TrainKubernetes
+    module File
+      class Linux < ::Train::File::Remote::Linux
+        def initialize(backend, path, follow_symlink = true, pod:, **args)
+          @backend = backend
+          @path = path || ''
+          @follow_symlink = follow_symlink
+          @pod = pod
+          @container = args[:container]
+          @namespace = args[:namespace]
+
+          sanitize_filename(path)
+          super(backend, path, follow_symlink)
+        end
+
+        def content
+          return @content if defined?(@content)
+
+          @content = @backend.run_command("cat #{@spath} || echo -n",
+                                          { pod: pod, namespace: namespace, container: container })
+                             .stdout
+          return @content unless @content.empty?
+
+          @content = nil if directory? || size.nil? || (size > 0)
+          @content
+        end
+
+        def content=(new_content)
+          execute_result = @backend.run_command('base64 --help', { pod: pod, namespace: namespace, container: container })
+          if execute_result.exit_status != 0
+            raise TransportError, "#{self.class} found no base64 binary for file writes"
+          end
+
+          unix_cmd = format("echo '%<base64>s' | base64 --decode > %<file>s",
+                            base64: Base64.strict_encode64(new_content),
+                            file: @spath)
+
+          @backend.run_command(unix_cmd, { pod: pod, namespace: namespace, container: container })
+
+          @content = new_content
+        end
+
+        def exist?
+          @exist ||= begin
+            f = @follow_symlink ? '' : " || test -L #{@spath}"
+            @backend.run_command("test -e #{@spath}" + f,
+                                 { pod: pod, namespace: namespace, container: container })
+                    .exit_status == 0
+          end
+        end
+
+        def mounted
+          @mounted ||=
+            @backend.run_command("mount | grep -- ' on #{@path} '",
+                                 { pod: pod, namespace: namespace, container: container })
+        end
+
+        def path
+          return @path unless @follow_symlink && symlink?
+
+          @link_path ||= read_target_path
+        end
+
+        def shallow_link_path
+          return nil unless symlink?
+
+          @shallow_link_path ||=
+            @backend.run_command("readlink #{@spath}", { pod: pod, namespace: namespace, container: container })
+                    .stdout
+                    .chomp
+        end
+
+        def stat
+          @stat ||= begin
+            shell_escaped_path = @spath
+            backend = @backend
+            follow_symlink = @follow_symlink
+            lstat = follow_symlink ? ' -L' : ''
+            format = '--printf'
+            res = backend.run_command("stat#{lstat} #{shell_escaped_path} 2>/dev/null #{format} '%s\n%f\n%U\n%u\n%G\n%g\n%X\n%Y\n%C'",
+                                      { pod: pod, namespace: namespace, container: container })
+            # ignore the exit_code: it is != 0 if selinux labels are not supported
+            # on the system.
+
+            fields = res.stdout.split("\n")
+            return {} if fields.length != 9
+
+            tmask = fields[1].to_i(16)
+            selinux = fields[8]
+            ## selinux security context string not available on esxi
+            selinux = nil if (selinux == '?') || (selinux == '(null)') || (selinux == 'C')
+            {
+              type: Train::Extras::Stat.find_type(tmask),
+              mode: tmask & 07777,
+              owner: fields[2],
+              uid: fields[3].to_i,
+              group: fields[4],
+              gid: fields[5].to_i,
+              mtime: fields[7].to_i,
+              size: fields[0].to_i,
+              selinux_label: selinux
+            }
+          end
+        end
+
+        def source
+          if @follow_symlink
+            self.class.new(@backend, @path, false, pod: pod, container: container, namespace: namespace)
+          else
+            self
+          end
+        end
+
+        def user_permissions
+          return {} unless exist?
+
+          skip_reource '`user_permissions` is not supported on your Linux Containers yet.'
+        end
+
+        def inherited?
+          return false unless exist?
+
+          skip_resource '`inherited?` is not supported on your Linux Containers yet.'
+        end
+
+        private
+
+        # Returns full path of a symlink target(real dest) or '' on symlink loop
+        def read_target_path
+          full_path = @backend.run_command("readlink -n #{@spath} -f",
+                                           { pod: pod, namespace: namespace, container: container })
+                              .stdout
+          # Needed for some OSes like OSX that returns relative path
+          # when the link and target are in the same directory
+          if !full_path.start_with?('/') && full_path != ''
+            full_path = ::File.expand_path("../#{full_path}", @spath)
+          end
+          full_path
+        end
+
+        attr_reader :pod, :container, :namespace
+      end
+    end
+  end
+end

data/lib/train-kubernetes/file/linux_immutable_file_check.rb

@@ -0,0 +1,50 @@
+require 'inspec/resources/file'
+require 'inspec/exceptions'
+
+module TrainPlugins
+  module TrainKubernetes
+    module File
+      class LinuxImmutableFileCheck < Inspec::Resources::LinuxImmutableFlagCheck
+        def initialize(inspec, file, pod:, container: nil, namespace: nil)
+          @pod = pod
+          @container = container
+          @namespace = namespace
+          super(inspec, file)
+        end
+
+        def find_utility_or_error(utility_name)
+          %W(/usr/sbin/#{utility_name} /sbin/#{utility_name} /usr/bin/#{utility_name} /bin/#{utility_name} #{utility_name}).each do |cmd|
+            if inspec.backend
+                     .run_command("sh -c 'type \"#{cmd}\"'", { pod: pod, container: container, namespace: namespace })
+                     .exit_status.to_i == 0
+              return cmd
+            end
+          end
+
+          raise Inspec::Exceptions::ResourceFailed, "Could not find `#{utility_name}`"
+        end
+
+        def is_immutable?
+          # Check if lsattr is available. In general, all linux system has lsattr & chattr
+          # This logic check is valid for immutable flag set with chattr
+          utility = find_utility_or_error('lsattr')
+
+          utility_cmd = inspec.backend.run_command("#{utility} #{file_path}",
+                                                   { pod: pod, container: container, namespace: namespace })
+
+          raise Inspec::Exceptions::ResourceFailed, "Executing #{utility} #{file_path} failed: #{utility_cmd.stderr}" if utility_cmd.exit_status.to_i != 0
+
+          # General output for lsattr file_name is:
+          # ----i---------e----- file_name
+          # The fifth char resembles the immutable flag. Total 20 flags are allowed.
+          lsattr_info = utility_cmd.stdout.strip.squeeze(' ')
+          lsattr_info =~ /^.{4}i.{15} .*/
+        end
+
+        private
+
+        attr_reader :pod, :container, :namespace
+      end
+    end
+  end
+end

data/lib/train-kubernetes/file/linux_permissions.rb

@@ -0,0 +1,25 @@
+module TrainPlugins
+  module TrainKubernetes
+    module File
+      class LinuxPermissions < Inspec::Resources::UnixFilePermissions
+        def initialize(inspec, pod:, namespace: nil, container: nil)
+          @pod = pod
+          @namespace = namespace
+          @container = container
+          super(inspec)
+        end
+
+        def check_file_permission_by_user(access_type, user, path)
+          flag = permission_flag(access_type)
+          perm_cmd = "su -s /bin/sh -c \"test -#{flag} #{path}\" #{user}"
+          cmd = inspec.backend.run_command(perm_cmd, { pod: pod, namespace: namespace, container: container })
+          cmd.exit_status == 0
+        end
+
+        private
+
+        attr_reader :pod, :container, :namespace
+      end
+    end
+  end
+end

data/lib/train-kubernetes/kubectl_client.rb

@@ -1,18 +1,26 @@
 require 'mixlib/shellout'
+require 'train/extras'
 
 module TrainPlugins
   module TrainKubernetes
     class KubectlClient
-      attr_reader :pod, :container
-      def initialize(pod:, container: nil)
+      attr_reader :pod, :container, :namespace
+
+      DEFAULT_NAMESPACE = 'default'.freeze
+
+      def initialize(pod:, namespace: nil, container: nil)
         @pod = pod
         @container = container
+        @namespace = namespace || DEFAULT_NAMESPACE
       end
 
       def execute(command, stdin: true, tty: true)
         instruction = build_instruction(command, stdin, tty)
         shell = Mixlib::ShellOut.new(instruction)
-        shell.run_command
+        res = shell.run_command
+        Train::Extras::CommandResult.new(res.stdout, res.stderr, res.exitstatus)
+      rescue Errno::ENOENT => _e
+        Train::Extras::CommandResult.new('', '', 1)
       end
 
       private
@@ -21,14 +29,16 @@ module TrainPlugins
         @shell ||= Mixlib::ShellOut.new(instruction)
       end
 
-      def build_instruction(command, stdin, tty)
-        ["kubectl exec"].tap do |arr|
+      def build_instruction(command, stdin, _tty)
+        ['kubectl exec'].tap do |arr|
           arr << '--stdin' if stdin
-          arr << "--tty" if tty
           arr << pod if pod
+          arr << '-n'
+          arr << namespace
+          arr << '--'
           arr << command
         end.join("\s")
       end
     end
   end
-end
+end

data/lib/train-kubernetes/transport.rb

@@ -5,6 +5,9 @@ module TrainPlugins
     class Transport < Train.plugin(1)
       name 'k8s'
       option :kubeconfig, default: ENV['KUBECONFIG'] || '~/.kube/config'
+      option :pod, default: nil
+      option :container, default: nil
+      option :namespace, default: nil
       def connection(_instance_opts = nil)
         @connection ||= TrainPlugins::TrainKubernetes::Connection.new(@options)
       end

data/lib/train-kubernetes/version.rb

@@ -5,6 +5,6 @@
 
 module TrainPlugins
   module TrainKubernetes
-    VERSION = '0.1.7'.freeze
+    VERSION = '0.1.12'.freeze
   end
 end

data/lib/train-kubernetes.rb

@@ -18,3 +18,4 @@ require 'train-kubernetes/version'
 # Transport acts as the glue.
 require 'train-kubernetes/transport'
 require 'train-kubernetes/platform'
+require 'train-kubernetes/file/linux'

data/train-kubernetes.gemspec

@@ -44,6 +44,7 @@ Gem::Specification.new do |spec|
   # Do not list inspec as a dependency of the train plugin.
 
   # All plugins should mention train, > 1.4
-  spec.add_dependency 'k8s-ruby', '~> 0.10'
+  # pinning k8s-ruby to 0.10.5 to avoid broken dry-type gem upgrades from k8s-ruby
+  spec.add_dependency 'k8s-ruby', '~> 0.14.0'
   spec.add_dependency 'train', '~> 3.0'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: train-kubernetes
 version: !ruby/object:Gem::Version
-  version: 0.1.7
+  version: 0.1.12
 platform: ruby
 authors:
 - Brad Geesaman
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-09-08 00:00:00.000000000 Z
+date: 2023-04-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: k8s-ruby
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.10'
+        version: 0.14.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.10'
+        version: 0.14.0
 - !ruby/object:Gem::Dependency
   name: train
   requirement: !ruby/object:Gem::Requirement
@@ -50,6 +50,9 @@ files:
 - README.md
 - lib/train-kubernetes.rb
 - lib/train-kubernetes/connection.rb
+- lib/train-kubernetes/file/linux.rb
+- lib/train-kubernetes/file/linux_immutable_file_check.rb
+- lib/train-kubernetes/file/linux_permissions.rb
 - lib/train-kubernetes/kubectl_client.rb
 - lib/train-kubernetes/platform.rb
 - lib/train-kubernetes/transport.rb
@@ -74,7 +77,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.8
+rubygems_version: 3.3.7
 signing_key:
 specification_version: 4
 summary: Train Kubernetes