Skip to content

Commit

Permalink
fix: address feedback
Browse files Browse the repository at this point in the history
Signed-off-by: Michael Fornaro <[email protected]>
  • Loading branch information
xunholy committed Nov 13, 2023
1 parent 7210bfb commit d599fd4
Show file tree
Hide file tree
Showing 3 changed files with 23 additions and 21 deletions.
13 changes: 10 additions & 3 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ Xentra is a powerful kubectl plugin designed to enhance the security of your Kub
- [📦 Installation](#-installation)
- [🔨 Usage](#-usage)
- [🔒 Generate Network Policies](#-generate-network-policies)
- [🛡️ Generate Seccomp Profiles](#️-generate-seccomp-profiles)
- [🤝 Contributing](#-contributing)
- [📄 License](#-license)
- [🙏 Acknowledgments](#-acknowledgments)
Expand Down Expand Up @@ -55,14 +54,22 @@ mv advisor /usr/local/bin/kubectl-advisor

### 🔒 Generate Network Policies

Create a network policy for a single pod in a namespace

```bash
kubectl advisor gen networkpolicy [pod-name] --namespace [namespace-name]
```

### 🛡️ Generate Seccomp Profiles
Create a network policy for a all pod(s) in a namespace

```bash
kubectl advisor gen networkpolicy --namespace [namespace-name] --all
```

Create a network policy for a all pod(s) in all namespace(s)

```bash
kubectl advisor gen seccomp [pod-name] --namespace [namespace-name]
kubectl advisor gen networkpolicy -A
```

For more details on the commands:
Expand Down
17 changes: 11 additions & 6 deletions advisor/pkg/api/pod_traffic.go
Original file line number Diff line number Diff line change
Expand Up @@ -66,15 +66,15 @@ func GetPodTraffic(podName string) ([]PodTraffic, error) {

// Parse the JSON response and unmarshal it into the Go struct.
if err := json.Unmarshal([]byte(body), &podTraffic); err != nil {
log.Warn().Err(err).Msg("Error unmarshal JSON")
log.Error().Err(err).Msg("Error unmarshal JSON")
return nil, err
}

// If no pod traffic is found, return nil
// If no pod traffic is found, return err
if len(podTraffic) == 0 {
log.Warn().Err(err).Msg("No pod traffic found in database")
return nil, nil
return nil, fmt.Errorf("No pod traffic found in database")
}

return podTraffic, nil
}

Expand All @@ -98,15 +98,20 @@ func GetPodSpec(ip string) (*PodDetail, error) {
return nil, nil
}

var details PodDetail
var details *PodDetail

// Parse the JSON response and unmarshal it into the Go struct.
if err := json.NewDecoder(resp.Body).Decode(&details); err != nil {
log.Error().Err(err).Msg("Error decoding JSON")
return nil, err
}

return &details, nil
// If no pod details are found, return err
if details == nil {
return nil, fmt.Errorf("no pod traffic found in database")
}

return details, nil
}

func GetSvcSpec(svcIp string) (*SvcDetail, error) {
Expand Down
14 changes: 2 additions & 12 deletions advisor/pkg/k8s/networkpolicies.go
Original file line number Diff line number Diff line change
Expand Up @@ -87,22 +87,12 @@ func GenerateNetworkPolicy(options GenerateOptions, config *Config) {
continue
}

if podTraffic == nil {
log.Error().Msgf("No pod traffic found for pod %s\n", pod.Name)
continue
}

podDetail, err := api.GetPodSpec(podTraffic[0].SrcIP)
if err != nil {
log.Error().Err(err).Msg("Error retrieving pod spec")
continue
}

if podDetail == nil {
log.Error().Msgf("No pod spec found for pod %s\n", podTraffic[0].SrcIP)
continue
}

policy, err := transformToNetworkPolicy(podTraffic, podDetail, config)
if err != nil {
log.Error().Err(err).Msg("Error transforming policy")
Expand Down Expand Up @@ -239,7 +229,7 @@ func determinePeerForTraffic(traffic api.PodTraffic, config *Config) (*networkin
}

if origin == nil {
log.Debug().Msgf("Could not find details for origin assuming IP is external %s", traffic.DstIP)
log.Warn().Msgf("Could not find details for origin assuming IP is external %s", traffic.DstIP)
return &networkingv1.NetworkPolicyPeer{
IPBlock: &networkingv1.IPBlock{
CIDR: traffic.DstIP + "/32",
Expand Down Expand Up @@ -302,9 +292,9 @@ func deduplicateEgressRules(rules []networkingv1.NetworkPolicyEgressRule) []netw
func fetchSinglePodInNamespace(podName, namespace string, config *Config) (*corev1.Pod, error) {
pod, err := config.Clientset.CoreV1().Pods(namespace).Get(context.TODO(), podName, metav1.GetOptions{})
if err != nil {
// Handle the error according to your application's requirements
return nil, err
}

return pod, nil
}

Expand Down

0 comments on commit d599fd4

Please sign in to comment.