train-kubernetes 0.1.10 → 0.1.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7e4bbb998822377221a31b8839373f73d298d6f2bd4226300ff8428742ca247c
-  data.tar.gz: e87a4add57561718dc7780d20aa0741de23e9bc615108dd139609377edb4d05b
+  metadata.gz: fcca2f4cc7de5b099cb5a3ee64e8ec7e935fdb986234d4ca9a3659d73efa874e
+  data.tar.gz: 15006a25d2cc0a823e21025d0b9f02cdd75bcefcac6965a28b17735147c1a4df
 SHA512:
-  metadata.gz: dfd9ca8003441da0bb8abd13f6a5ceae755239f406201b76d94ec2088a07ea12cc29e2fbe0a7132e4e6745910752823c9753a3b17585b39de62e1a5527192c6c
-  data.tar.gz: c50d9c99fe60b9b51b71b789f7c233815cf0391a89d8ffa6bc2faaae3f5f74e416211400b02e273da1f8c4348f4e749ce368eba5148acefa91faf43a533610fc
+  metadata.gz: 17df60f7afdf0948ea15ce899b97b3aa33ba2173e87715c2b736783644a48aae037112188c570aab65f2cc3f40978e16c43c716c489623a7f556757b9204bfa6
+  data.tar.gz: 47f38cc6b1b41873f411da7a6fc3be723d2ead3cf5a0b225367a5bd6bfe518a57eb06f1805e1557d708d8e3c161881a4b4dbc6747aaaf0e760573795c5a43f38

data/README.md

@@ -28,6 +28,13 @@ describe k8sobject(api: 'v1', type: 'pod', namespace: 'default', name: 'my-pod')
 end
 ```
 
+## File resource
+```ruby
+inspec.backend.file('PATH', pod: 'POD', container: 'CONTAINER', namespace: 'NAMESPACE')
+```
+Currently it supports only Linux based containers
+
+
 ## Preconditions
 
 - InSpec 3.7+ or 4.x+

data/lib/train-kubernetes/connection.rb

@@ -36,7 +36,7 @@ module TrainPlugins
 
       def parse_kubeconfig
         kubeconfig_file = @options[:kubeconfig] if @options[:kubeconfig]
-        @client = K8s::Client.config(K8s::Config.load_file(File.expand_path(kubeconfig_file)))
+        @client = K8s::Client.config(K8s::Config.load_file(::File.expand_path(kubeconfig_file)))
       end
 
       private
@@ -49,6 +49,10 @@ module TrainPlugins
                           namespace: opts[:namespace] || namespace)
                      .execute(cmd)
       end
+
+      def file_via_connection(path, **args)
+        TrainPlugins::TrainKubernetes::File::Linux.new(self, path, pod: args[:pod], container: args[:container], namespace: args[:namespace])
+      end
     end
   end
 end

data/lib/train-kubernetes/file/linux.rb

@@ -0,0 +1,149 @@
+require 'train/file/remote/linux'
+require 'train/extras/stat'
+
+module TrainPlugins
+  module TrainKubernetes
+    module File
+      class Linux < ::Train::File::Remote::Linux
+        def initialize(backend, path, follow_symlink = true, pod:, **args)
+          @backend = backend
+          @path = path || ''
+          @follow_symlink = follow_symlink
+          @pod = pod
+          @container = args[:container]
+          @namespace = args[:namespace]
+
+          sanitize_filename(path)
+          super(backend, path, follow_symlink)
+        end
+
+        def content
+          return @content if defined?(@content)
+
+          @content = @backend.run_command("cat #{@spath} || echo -n",
+                                          { pod: pod, namespace: namespace, container: container })
+                             .stdout
+          return @content unless @content.empty?
+
+          @content = nil if directory? || size.nil? || (size > 0)
+          @content
+        end
+
+        def content=(new_content)
+          execute_result = @backend.run_command('base64 --help', { pod: pod, namespace: namespace, container: container })
+          if execute_result.exit_status != 0
+            raise TransportError, "#{self.class} found no base64 binary for file writes"
+          end
+
+          unix_cmd = format("echo '%<base64>s' | base64 --decode > %<file>s",
+                            base64: Base64.strict_encode64(new_content),
+                            file: @spath)
+
+          @backend.run_command(unix_cmd, { pod: pod, namespace: namespace, container: container })
+
+          @content = new_content
+        end
+
+        def exist?
+          @exist ||= begin
+            f = @follow_symlink ? '' : " || test -L #{@spath}"
+            @backend.run_command("test -e #{@spath}" + f,
+                                 { pod: pod, namespace: namespace, container: container })
+                    .exit_status == 0
+          end
+        end
+
+        def mounted
+          @mounted ||=
+            @backend.run_command("mount | grep -- ' on #{@path} '",
+                                 { pod: pod, namespace: namespace, container: container })
+        end
+
+        def path
+          return @path unless @follow_symlink && symlink?
+
+          @link_path ||= read_target_path
+        end
+
+        def shallow_link_path
+          return nil unless symlink?
+
+          @shallow_link_path ||=
+            @backend.run_command("readlink #{@spath}", { pod: pod, namespace: namespace, container: container })
+                    .stdout
+                    .chomp
+        end
+
+        def stat
+          @stat ||= begin
+            shell_escaped_path = @spath
+            backend = @backend
+            follow_symlink = @follow_symlink
+            lstat = follow_symlink ? ' -L' : ''
+            format = '--printf'
+            res = backend.run_command("stat#{lstat} #{shell_escaped_path} 2>/dev/null #{format} '%s\n%f\n%U\n%u\n%G\n%g\n%X\n%Y\n%C'",
+                                      { pod: pod, namespace: namespace, container: container })
+            # ignore the exit_code: it is != 0 if selinux labels are not supported
+            # on the system.
+
+            fields = res.stdout.split("\n")
+            return {} if fields.length != 9
+
+            tmask = fields[1].to_i(16)
+            selinux = fields[8]
+            ## selinux security context string not available on esxi
+            selinux = nil if (selinux == '?') || (selinux == '(null)') || (selinux == 'C')
+            {
+              type: Train::Extras::Stat.find_type(tmask),
+              mode: tmask & 07777,
+              owner: fields[2],
+              uid: fields[3].to_i,
+              group: fields[4],
+              gid: fields[5].to_i,
+              mtime: fields[7].to_i,
+              size: fields[0].to_i,
+              selinux_label: selinux
+            }
+          end
+        end
+
+        def source
+          if @follow_symlink
+            self.class.new(@backend, @path, false, pod: pod, container: container, namespace: namespace)
+          else
+            self
+          end
+        end
+
+        def user_permissions
+          return {} unless exist?
+
+          skip_reource '`user_permissions` is not supported on your Linux Containers yet.'
+        end
+
+        def inherited?
+          return false unless exist?
+
+          skip_resource '`inherited?` is not supported on your Linux Containers yet.'
+        end
+
+        private
+
+        # Returns full path of a symlink target(real dest) or '' on symlink loop
+        def read_target_path
+          full_path = @backend.run_command("readlink -n #{@spath} -f",
+                                           { pod: pod, namespace: namespace, container: container })
+                              .stdout
+          # Needed for some OSes like OSX that returns relative path
+          # when the link and target are in the same directory
+          if !full_path.start_with?('/') && full_path != ''
+            full_path = ::File.expand_path("../#{full_path}", @spath)
+          end
+          full_path
+        end
+
+        attr_reader :pod, :container, :namespace
+      end
+    end
+  end
+end

data/lib/train-kubernetes/file/linux_immutable_file_check.rb

@@ -0,0 +1,50 @@
+require 'inspec/resources/file'
+require 'inspec/exceptions'
+
+module TrainPlugins
+  module TrainKubernetes
+    module File
+      class LinuxImmutableFileCheck < Inspec::Resources::LinuxImmutableFlagCheck
+        def initialize(inspec, file, pod:, container: nil, namespace: nil)
+          @pod = pod
+          @container = container
+          @namespace = namespace
+          super(inspec, file)
+        end
+
+        def find_utility_or_error(utility_name)
+          %W(/usr/sbin/#{utility_name} /sbin/#{utility_name} /usr/bin/#{utility_name} /bin/#{utility_name} #{utility_name}).each do |cmd|
+            if inspec.backend
+                     .run_command("sh -c 'type \"#{cmd}\"'", { pod: pod, container: container, namespace: namespace })
+                     .exit_status.to_i == 0
+              return cmd
+            end
+          end
+
+          raise Inspec::Exceptions::ResourceFailed, "Could not find `#{utility_name}`"
+        end
+
+        def is_immutable?
+          # Check if lsattr is available. In general, all linux system has lsattr & chattr
+          # This logic check is valid for immutable flag set with chattr
+          utility = find_utility_or_error('lsattr')
+
+          utility_cmd = inspec.backend.run_command("#{utility} #{file_path}",
+                                                   { pod: pod, container: container, namespace: namespace })
+
+          raise Inspec::Exceptions::ResourceFailed, "Executing #{utility} #{file_path} failed: #{utility_cmd.stderr}" if utility_cmd.exit_status.to_i != 0
+
+          # General output for lsattr file_name is:
+          # ----i---------e----- file_name
+          # The fifth char resembles the immutable flag. Total 20 flags are allowed.
+          lsattr_info = utility_cmd.stdout.strip.squeeze(' ')
+          lsattr_info =~ /^.{4}i.{15} .*/
+        end
+
+        private
+
+        attr_reader :pod, :container, :namespace
+      end
+    end
+  end
+end

data/lib/train-kubernetes/file/linux_permissions.rb

@@ -0,0 +1,25 @@
+module TrainPlugins
+  module TrainKubernetes
+    module File
+      class LinuxPermissions < Inspec::Resources::UnixFilePermissions
+        def initialize(inspec, pod:, namespace: nil, container: nil)
+          @pod = pod
+          @namespace = namespace
+          @container = container
+          super(inspec)
+        end
+
+        def check_file_permission_by_user(access_type, user, path)
+          flag = permission_flag(access_type)
+          perm_cmd = "su -s /bin/sh -c \"test -#{flag} #{path}\" #{user}"
+          cmd = inspec.backend.run_command(perm_cmd, { pod: pod, namespace: namespace, container: container })
+          cmd.exit_status == 0
+        end
+
+        private
+
+        attr_reader :pod, :container, :namespace
+      end
+    end
+  end
+end

data/lib/train-kubernetes/kubectl_client.rb

@@ -1,9 +1,11 @@
 require 'mixlib/shellout'
+require 'train/extras'
 
 module TrainPlugins
   module TrainKubernetes
     class KubectlClient
       attr_reader :pod, :container, :namespace
+
       DEFAULT_NAMESPACE = 'default'.freeze
 
       def initialize(pod:, namespace: nil, container: nil)
@@ -15,7 +17,10 @@ module TrainPlugins
       def execute(command, stdin: true, tty: true)
         instruction = build_instruction(command, stdin, tty)
         shell = Mixlib::ShellOut.new(instruction)
-        shell.run_command
+        res = shell.run_command
+        Train::Extras::CommandResult.new(res.stdout, res.stderr, res.exitstatus)
+      rescue Errno::ENOENT => _e
+        Train::Extras::CommandResult.new('', '', 1)
       end
 
       private
@@ -24,7 +29,7 @@ module TrainPlugins
         @shell ||= Mixlib::ShellOut.new(instruction)
       end
 
-      def build_instruction(command, stdin, tty)
+      def build_instruction(command, stdin, _tty)
         ['kubectl exec'].tap do |arr|
           arr << '--stdin' if stdin
           arr << pod if pod

data/lib/train-kubernetes/version.rb

@@ -5,6 +5,6 @@
 
 module TrainPlugins
   module TrainKubernetes
-    VERSION = '0.1.10'.freeze
+    VERSION = '0.1.12'.freeze
   end
 end

data/lib/train-kubernetes.rb

@@ -18,3 +18,4 @@ require 'train-kubernetes/version'
 # Transport acts as the glue.
 require 'train-kubernetes/transport'
 require 'train-kubernetes/platform'
+require 'train-kubernetes/file/linux'

data/train-kubernetes.gemspec

@@ -45,6 +45,6 @@ Gem::Specification.new do |spec|
 
   # All plugins should mention train, > 1.4
   # pinning k8s-ruby to 0.10.5 to avoid broken dry-type gem upgrades from k8s-ruby
-  spec.add_dependency 'k8s-ruby', '0.10.5'
+  spec.add_dependency 'k8s-ruby', '~> 0.14.0'
   spec.add_dependency 'train', '~> 3.0'
 end

metadata

@@ -1,29 +1,29 @@
 --- !ruby/object:Gem::Specification
 name: train-kubernetes
 version: !ruby/object:Gem::Version
-  version: 0.1.10
+  version: 0.1.12
 platform: ruby
 authors:
 - Brad Geesaman
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-11-15 00:00:00.000000000 Z
+date: 2023-04-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: k8s-ruby
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.10.5
+        version: 0.14.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.10.5
+        version: 0.14.0
 - !ruby/object:Gem::Dependency
   name: train
   requirement: !ruby/object:Gem::Requirement
@@ -50,6 +50,9 @@ files:
 - README.md
 - lib/train-kubernetes.rb
 - lib/train-kubernetes/connection.rb
+- lib/train-kubernetes/file/linux.rb
+- lib/train-kubernetes/file/linux_immutable_file_check.rb
+- lib/train-kubernetes/file/linux_permissions.rb
 - lib/train-kubernetes/kubectl_client.rb
 - lib/train-kubernetes/platform.rb
 - lib/train-kubernetes/transport.rb
@@ -59,7 +62,7 @@ homepage: https://github.com/bgeesaman/train-kubernetes
 licenses:
 - Apache-2.0
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -74,8 +77,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.4
-signing_key: 
+rubygems_version: 3.3.7
+signing_key:
 specification_version: 4
 summary: Train Kubernetes
 test_files: []