Skip to content

Commit d963c79

Browse files
matthyxmatthyx
authored
Merge pull request #351 from k8sstormcenter/migrate/sbob
chore: deprecate old profiletypes in favor of containerprofiles
2 parents 8e1f3fe + 8291452 commit d963c79

110 files changed

Lines changed: 7438 additions & 14040 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎api-rules/sample_apiserver_violation_exceptions.list‎

Lines changed: 12 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,24 @@
1-
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ApplicationProfileContainer,Capabilities
2-
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ApplicationProfileContainer,Endpoints
3-
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ApplicationProfileContainer,Execs
4-
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ApplicationProfileContainer,IdentifiedCallStacks
5-
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ApplicationProfileContainer,Opens
6-
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ApplicationProfileContainer,Syscalls
7-
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ApplicationProfileSpec,Architectures
8-
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ApplicationProfileSpec,Containers
9-
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ApplicationProfileSpec,EphemeralContainers
10-
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ApplicationProfileSpec,InitContainers
111
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,CallStackNode,Children
122
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ConditionedStatus,Conditions
133
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ConfigurationScanSummarySpec,WorkloadConfigurationScanSummaryIdentifiers
4+
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ContainerProfileContainer,Capabilities
5+
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ContainerProfileContainer,Egress
6+
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ContainerProfileContainer,Endpoints
7+
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ContainerProfileContainer,Execs
8+
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ContainerProfileContainer,IdentifiedCallStacks
9+
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ContainerProfileContainer,Ingress
10+
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ContainerProfileContainer,Opens
11+
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ContainerProfileContainer,Syscalls
1412
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ContainerProfileSpec,Architectures
1513
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ContainerProfileSpec,Capabilities
14+
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ContainerProfileSpec,Containers
1615
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ContainerProfileSpec,Egress
1716
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ContainerProfileSpec,Endpoints
17+
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ContainerProfileSpec,EphemeralContainers
1818
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ContainerProfileSpec,Execs
1919
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ContainerProfileSpec,IdentifiedCallStacks
2020
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ContainerProfileSpec,Ingress
21+
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ContainerProfileSpec,InitContainers
2122
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ContainerProfileSpec,Opens
2223
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ContainerProfileSpec,Syscalls
2324
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,Distribution,IDLike
@@ -47,11 +48,6 @@ API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/soft
4748
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,NetworkNeighbor,DNSNames
4849
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,NetworkNeighbor,IPAddresses
4950
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,NetworkNeighbor,Ports
50-
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,NetworkNeighborhoodContainer,Egress
51-
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,NetworkNeighborhoodContainer,Ingress
52-
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,NetworkNeighborhoodSpec,Containers
53-
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,NetworkNeighborhoodSpec,EphemeralContainers
54-
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,NetworkNeighborhoodSpec,InitContainers
5551
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,NetworkPolicyEgressRule,Ports
5652
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,NetworkPolicyEgressRule,To
5753
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,NetworkPolicyIngressRule,From
@@ -90,10 +86,10 @@ API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/soft
9086
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,VulnerabilityMetadata,URLs
9187
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,VulnerabilitySummarySpec,WorkloadVulnerabilitiesObj
9288
API rule violation: list_type_missing,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,WorkloadConfigurationScanSpec,RelatedObjects
93-
API rule violation: names_match,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ApplicationProfileContainer,PolicyByRuleId
9489
API rule violation: names_match,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,CPE,Value
9590
API rule violation: names_match,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,Component,ID
9691
API rule violation: names_match,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ConfigurationScanSummarySpec,WorkloadConfigurationScanSummaryIdentifiers
92+
API rule violation: names_match,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ContainerProfileContainer,PolicyByRuleId
9793
API rule violation: names_match,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,ContainerProfileSpec,PolicyByRuleId
9894
API rule violation: names_match,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,Coordinates,FileSystemID
9995
API rule violation: names_match,github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1,Coordinates,RealPath

‎cmd/migration/main.go‎

Lines changed: 25 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
package main
22

33
// migration is a standalone utility to decode legacy Gob data into JSON.
4-
// It is used to handle breaking changes in the Gob format (e.g., transitioning
5-
// fields from uint64 to int64) that cannot be handled by the main service
4+
// It is used to handle breaking changes in the Gob format (e.g., transitioning
5+
// fields from uint64 to int64) that cannot be handled by the main service
66
// due to Go's global Gob type registration constraints.
77

88
import (
@@ -42,38 +42,6 @@ type LegacyOpenCalls struct {
4242
Flags []string `json:"Flags"`
4343
}
4444

45-
type LegacyApplicationProfileContainer struct {
46-
Name string `json:"Name"`
47-
Capabilities []string `json:"Capabilities"`
48-
Execs []LegacyExecCalls `json:"Execs"`
49-
Opens []LegacyOpenCalls `json:"Opens"`
50-
Syscalls []string `json:"Syscalls"`
51-
SeccompProfile LegacySingleSeccompProfile `json:"SeccompProfile"`
52-
Endpoints []softwarecomposition.HTTPEndpoint `json:"Endpoints"`
53-
ImageID string `json:"ImageID"`
54-
ImageTag string `json:"ImageTag"`
55-
PolicyByRuleId map[string]softwarecomposition.RulePolicy `json:"PolicyByRuleId"`
56-
IdentifiedCallStacks []softwarecomposition.IdentifiedCallStack `json:"IdentifiedCallStacks"`
57-
}
58-
59-
type LegacyApplicationProfileSpec struct {
60-
Architectures []string `json:"Architectures,omitempty"`
61-
Containers []LegacyApplicationProfileContainer `json:"Containers,omitempty"`
62-
InitContainers []LegacyApplicationProfileContainer `json:"InitContainers,omitempty"`
63-
EphemeralContainers []LegacyApplicationProfileContainer `json:"EphemeralContainers,omitempty"`
64-
}
65-
66-
type LegacyApplicationProfile struct {
67-
metav1.TypeMeta `json:",inline"`
68-
metav1.ObjectMeta `json:",inline"`
69-
70-
// +k8s:conversion-gen=false
71-
Parts map[string]string `json:"Parts,omitempty"`
72-
// +k8s:conversion-gen=false
73-
SchemaVersion int64 `json:"SchemaVersion,omitempty"`
74-
Spec LegacyApplicationProfileSpec `json:"Spec,omitempty"`
75-
}
76-
7745
type LegacySingleSeccompProfile struct {
7846
Name string `json:"Name"`
7947
Path string `json:"Path"`
@@ -100,34 +68,39 @@ type LegacyContainerProfileSpec struct {
10068
ImageID string `json:"ImageID"`
10169
ImageTag string `json:"ImageTag"`
10270
PolicyByRuleId map[string]softwarecomposition.RulePolicy `json:"PolicyByRuleId"`
103-
IdentifiedCallStacks []softwarecomposition.IdentifiedCallStack `json:"IdentifiedCallStacks"`
104-
metav1.LabelSelector `json:"LabelSelector"`
105-
Ingress []LegacyNetworkNeighbor `json:"Ingress"`
106-
Egress []LegacyNetworkNeighbor `json:"Egress"`
71+
IdentifiedCallStacks []softwarecomposition.IdentifiedCallStack `json:"IdentifiedCallStacks"`
72+
// Embedded WITHOUT a json tag, exactly like the destination
73+
// softwarecomposition.ContainerProfileSpec: encoding/json then promotes
74+
// MatchLabels/MatchExpressions to the Spec level, which is the shape the
75+
// storage Get path unmarshals (a nested "LabelSelector" key would be
76+
// silently dropped there, emptying the workload selector on rewrite).
77+
metav1.LabelSelector
78+
Ingress []LegacyNetworkNeighbor `json:"Ingress"`
79+
Egress []LegacyNetworkNeighbor `json:"Egress"`
10780
}
10881

10982
type LegacyContainerProfile struct {
11083
metav1.TypeMeta `json:",inline"`
11184
metav1.ObjectMeta `json:",inline"`
112-
Spec LegacyContainerProfileSpec `json:"Spec,omitempty"`
85+
Spec LegacyContainerProfileSpec `json:"Spec,omitempty"`
11386
Status softwarecomposition.ContainerProfileStatus `json:"Status,omitempty"`
11487
}
11588

11689
type LegacyNetworkPort struct {
11790
Name string `json:"Name"`
11891
Protocol string `json:"Protocol"`
119-
Port *int32 `json:"Port"`
92+
Port *int32 `json:"Port"`
12093
}
12194

12295
type LegacyNetworkNeighbor struct {
123-
Identifier string `json:"Identifier"`
124-
Type string `json:"Type"`
125-
DNS string `json:"DNS"`
126-
DNSNames []string `json:"DNSNames"`
127-
Ports []LegacyNetworkPort `json:"Ports"`
128-
PodSelector *metav1.LabelSelector `json:"PodSelector"`
129-
NamespaceSelector *metav1.LabelSelector `json:"NamespaceSelector"`
130-
IPAddress string `json:"IPAddress"`
96+
Identifier string `json:"Identifier"`
97+
Type string `json:"Type"`
98+
DNS string `json:"DNS"`
99+
DNSNames []string `json:"DNSNames"`
100+
Ports []LegacyNetworkPort `json:"Ports"`
101+
PodSelector *metav1.LabelSelector `json:"PodSelector"`
102+
NamespaceSelector *metav1.LabelSelector `json:"NamespaceSelector"`
103+
IPAddress string `json:"IPAddress"`
131104
}
132105

133106
type LegacySeccompProfileSpec struct {
@@ -139,17 +112,17 @@ type LegacySeccompProfileSpec struct {
139112
type LegacySeccompProfile struct {
140113
metav1.TypeMeta `json:",inline"`
141114
metav1.ObjectMeta `json:",inline"`
142-
Spec LegacySeccompProfileSpec `json:"Spec,omitempty"`
115+
Spec LegacySeccompProfileSpec `json:"Spec,omitempty"`
143116
Status softwarecomposition.SeccompProfileStatus `json:"Status,omitempty"`
144117
}
145118

146119
func main() {
147120
filePath := flag.String("file", "", "Path to the gob file to decode")
148-
typeName := flag.String("type", "ApplicationProfile", "Type to decode (ApplicationProfile, ContainerProfile, or SeccompProfile)")
121+
typeName := flag.String("type", "ContainerProfile", "Type to decode (ContainerProfile or SeccompProfile)")
149122
flag.Parse()
150123

151124
if *filePath == "" {
152-
fmt.Fprintf(os.Stderr, "Usage: migration -file <path> [-type <ApplicationProfile|ContainerProfile|SeccompProfile>]\n")
125+
fmt.Fprintf(os.Stderr, "Usage: migration -file <path> [-type <ContainerProfile|SeccompProfile>]\n")
153126
os.Exit(1)
154127
}
155128

@@ -162,8 +135,6 @@ func main() {
162135

163136
var result interface{}
164137
switch *typeName {
165-
case "ApplicationProfile":
166-
result = &LegacyApplicationProfile{}
167138
case "ContainerProfile":
168139
result = &LegacyContainerProfile{}
169140
case "SeccompProfile":
@@ -176,7 +147,7 @@ func main() {
176147
// Important: We need to register types that might be in the gob stream
177148
// but are defined locally in this 'main' package to avoid name mismatches
178149
// although gob name matching is usually package-scoped.
179-
// Since this is a separate binary, its 'main.LegacyApplicationProfile'
150+
// Since this is a separate binary, its 'main.LegacyContainerProfile'
180151
// registration is isolated from the storage binary's registration.
181152

182153
// Register common types that might be inside interface{} fields or nested structs

0 commit comments

Comments
 (0)