mirror of
https://github.com/kubeshark/kubeshark.git
synced 2026-08-09 08:22:50 +00:00
* deps: bump indirect deps to clear critical/high Dependabot alerts Bumps the vulnerable indirect dependencies flagged as critical or high severity in Dependabot: - golang.org/x/crypto v0.39.0 -> v0.54.0 (7 critical + 2 high: SSH agent constraint/key-constraint bypass, @revoked auth bypass, FIDO/U2F presence check bypass, VerifiedPublicKeyCallback permission skip, infinite loop on large channel writes, client-induced server deadlock, RSA/DSA DoS, byte arithmetic underflow panic) - google.golang.org/grpc v1.68.1 -> v1.83.0 (critical: authz bypass via missing leading slash in :path; high: xDS RBAC and HTTP/2 issues) - github.com/containerd/containerd v1.7.27 -> v1.7.34 (high: LABEL -> restart-monitor binary:// host-root RCE, runAsNonRoot evasion, local privesc via wide CRI directory permissions) - oras.land/oras-go/v2 v2.6.0 -> v2.6.2 (high: CVE-2026-50163 hardlink extract-dir escape, credential forwarding via unvalidated Location header) - github.com/moby/spdystream v0.5.0 -> v0.5.1 (high: DoS on CRI) Transitively pulls up x/net, x/sync, x/sys, x/term, x/text, x/time, x/oauth2, protobuf, filepath-securejoin, selinux and go-logr via go mod tidy. The go directive moves 1.24.0 -> 1.25.0 (required by the upgraded modules); the explicit toolchain pin is dropped. CI resolves Go from go.mod, so no workflow changes are needed. go build ./... and go test ./... pass. * ci: move golangci-lint to v2, fix resulting lint issues golangci-lint-action@v3 pins `latest` to v1.64.8, which is built with go1.24 and refuses to run now that go.mod targets 1.25.0: can't load config: the Go language version (go1.24) used to build golangci-lint is lower than the targeted Go version (1.25.0) Move the job to golangci-lint-action@v7 + v2.8.0 and add a .golangci.yml mirroring the hub repo's v2 config: govet, staticcheck, ineffassign and unused, plus gofmt/goimports as formatters. Fixes for the issues that surfaced: - ST1005: lowercase error strings, drop trailing '!' in connect/hub.go - SA4011: kubernetes/watch.go had a `break` inside a `select` default that broke the select rather than the loop, i.e. a no-op; removed - QF1008: drop the embedded ChartPathOptions selector in helm.go - QF1003: tagged switch on r.URL.Path in mcp_test.go - QF1004: strings.Replace(..., -1) -> strings.ReplaceAll - gofmt -s and goimports with a local prefix across the tree errcheck is not in the enabled set, matching hub. * cmd: clarify --time parse error in pcap dump The error neither named the offending flag/value nor separated the wrapped error from the message. Reported by Copilot on #1952. --------- Co-authored-by: Alon Girmonsky <1990761+alongir@users.noreply.github.com>
385 lines
9.0 KiB
Go
385 lines
9.0 KiB
Go
package cmd
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"errors"
|
|
"os"
|
|
"os/signal"
|
|
"strings"
|
|
"sync"
|
|
"time"
|
|
|
|
"github.com/creasty/defaults"
|
|
"github.com/fsnotify/fsnotify"
|
|
"github.com/rs/zerolog/log"
|
|
"github.com/spf13/cobra"
|
|
k8serrors "k8s.io/apimachinery/pkg/api/errors"
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
"k8s.io/apimachinery/pkg/watch"
|
|
|
|
"github.com/kubeshark/kubeshark/config"
|
|
"github.com/kubeshark/kubeshark/config/configStructs"
|
|
"github.com/kubeshark/kubeshark/kubernetes"
|
|
"github.com/kubeshark/kubeshark/misc"
|
|
)
|
|
|
|
var scriptsCmd = &cobra.Command{
|
|
Use: "scripts",
|
|
Short: "Watch the `scripting.source` and/or `scripting.sources` folders for changes and update the scripts",
|
|
RunE: func(cmd *cobra.Command, args []string) error {
|
|
runScripts()
|
|
return nil
|
|
},
|
|
}
|
|
|
|
func init() {
|
|
rootCmd.AddCommand(scriptsCmd)
|
|
|
|
defaultTapConfig := configStructs.TapConfig{}
|
|
if err := defaults.Set(&defaultTapConfig); err != nil {
|
|
log.Debug().Err(err).Send()
|
|
}
|
|
|
|
scriptsCmd.Flags().Uint16(configStructs.ProxyFrontPortLabel, defaultTapConfig.Proxy.Front.Port, "Provide a custom port for the Kubeshark")
|
|
scriptsCmd.Flags().String(configStructs.ProxyHostLabel, defaultTapConfig.Proxy.Host, "Provide a custom host for the Kubeshark")
|
|
scriptsCmd.Flags().StringP(configStructs.ReleaseNamespaceLabel, "s", defaultTapConfig.Release.Namespace, "Release namespace of Kubeshark")
|
|
}
|
|
|
|
func runScripts() {
|
|
if config.Config.Scripting.Source == "" && len(config.Config.Scripting.Sources) == 0 {
|
|
log.Error().Msg("Both `scripting.source` and `scripting.sources` fields are empty.")
|
|
return
|
|
}
|
|
|
|
kubernetesProvider, err := getKubernetesProviderForCli(false, false)
|
|
if err != nil {
|
|
log.Error().Err(err).Send()
|
|
return
|
|
}
|
|
|
|
var wg sync.WaitGroup
|
|
|
|
ctx, cancel := context.WithCancel(context.Background())
|
|
defer cancel()
|
|
|
|
signalChan := make(chan os.Signal, 1)
|
|
signal.Notify(signalChan, os.Interrupt)
|
|
|
|
wg.Add(1)
|
|
go func() {
|
|
defer wg.Done()
|
|
watchConfigMap(ctx, kubernetesProvider)
|
|
}()
|
|
|
|
wg.Add(1)
|
|
go func() {
|
|
defer wg.Done()
|
|
watchScripts(ctx, kubernetesProvider, true)
|
|
}()
|
|
|
|
go func() {
|
|
<-signalChan
|
|
log.Debug().Msg("Received interrupt, stopping watchers.")
|
|
cancel()
|
|
}()
|
|
|
|
wg.Wait()
|
|
|
|
}
|
|
|
|
func createScript(provider *kubernetes.Provider, script misc.ConfigMapScript) (index int64, err error) {
|
|
const maxRetries = 5
|
|
var scripts map[int64]misc.ConfigMapScript
|
|
|
|
for i := 0; i < maxRetries; i++ {
|
|
scripts, err = kubernetes.ConfigGetScripts(provider)
|
|
if err != nil {
|
|
return
|
|
}
|
|
script.Active = kubernetes.IsActiveScript(provider, script.Title)
|
|
index = 0
|
|
if script.Title != "New Script" {
|
|
for i, v := range scripts {
|
|
if index <= i {
|
|
index = i + 1
|
|
}
|
|
if v.Title == script.Title {
|
|
index = int64(i)
|
|
}
|
|
}
|
|
}
|
|
scripts[index] = script
|
|
|
|
log.Info().Str("title", script.Title).Bool("Active", script.Active).Int64("Index", index).Msg("Creating script")
|
|
var data []byte
|
|
data, err = json.Marshal(scripts)
|
|
if err != nil {
|
|
return
|
|
}
|
|
|
|
_, err = kubernetes.SetConfig(provider, kubernetes.CONFIG_SCRIPTING_SCRIPTS, string(data))
|
|
if err == nil {
|
|
return index, nil
|
|
}
|
|
|
|
if k8serrors.IsConflict(err) {
|
|
log.Debug().Err(err).Msg("Conflict detected, retrying update...")
|
|
time.Sleep(500 * time.Millisecond)
|
|
continue
|
|
}
|
|
|
|
return 0, err
|
|
}
|
|
|
|
log.Error().Msg("Max retries reached for creating script due to conflicts.")
|
|
return 0, errors.New("max retries reached due to conflicts while creating script")
|
|
}
|
|
|
|
func updateScript(provider *kubernetes.Provider, index int64, script misc.ConfigMapScript) (err error) {
|
|
var scripts map[int64]misc.ConfigMapScript
|
|
scripts, err = kubernetes.ConfigGetScripts(provider)
|
|
if err != nil {
|
|
return
|
|
}
|
|
script.Active = kubernetes.IsActiveScript(provider, script.Title)
|
|
scripts[index] = script
|
|
|
|
var data []byte
|
|
data, err = json.Marshal(scripts)
|
|
if err != nil {
|
|
return
|
|
}
|
|
|
|
_, err = kubernetes.SetConfig(provider, kubernetes.CONFIG_SCRIPTING_SCRIPTS, string(data))
|
|
if err != nil {
|
|
return
|
|
}
|
|
|
|
return
|
|
}
|
|
|
|
func deleteScript(provider *kubernetes.Provider, index int64) (err error) {
|
|
var scripts map[int64]misc.ConfigMapScript
|
|
scripts, err = kubernetes.ConfigGetScripts(provider)
|
|
if err != nil {
|
|
return
|
|
}
|
|
err = kubernetes.DeleteActiveScriptByTitle(provider, scripts[index].Title)
|
|
if err != nil {
|
|
return
|
|
}
|
|
delete(scripts, index)
|
|
|
|
var data []byte
|
|
data, err = json.Marshal(scripts)
|
|
if err != nil {
|
|
return
|
|
}
|
|
|
|
_, err = kubernetes.SetConfig(provider, kubernetes.CONFIG_SCRIPTING_SCRIPTS, string(data))
|
|
if err != nil {
|
|
return
|
|
}
|
|
|
|
return
|
|
}
|
|
|
|
func watchScripts(ctx context.Context, provider *kubernetes.Provider, block bool) {
|
|
files := make(map[string]int64)
|
|
|
|
scripts, err := config.Config.Scripting.GetScripts()
|
|
if err != nil {
|
|
log.Error().Err(err).Send()
|
|
return
|
|
}
|
|
|
|
for _, script := range scripts {
|
|
index, err := createScript(provider, script.ConfigMap())
|
|
if err != nil {
|
|
log.Error().Err(err).Send()
|
|
continue
|
|
}
|
|
|
|
files[script.Path] = index
|
|
}
|
|
|
|
watcher, err := fsnotify.NewWatcher()
|
|
if err != nil {
|
|
log.Error().Err(err).Send()
|
|
return
|
|
}
|
|
if block {
|
|
defer watcher.Close()
|
|
}
|
|
|
|
ctx, cancel := context.WithCancel(ctx)
|
|
defer cancel()
|
|
|
|
signalChan := make(chan os.Signal, 1)
|
|
signal.Notify(signalChan, os.Interrupt)
|
|
|
|
go func() {
|
|
<-signalChan
|
|
log.Debug().Msg("Received interrupt, stopping script watch.")
|
|
cancel()
|
|
watcher.Close()
|
|
}()
|
|
|
|
if err := watcher.Add(config.Config.Scripting.Source); err != nil {
|
|
log.Error().Err(err).Msg("Failed to add scripting source to watcher")
|
|
return
|
|
}
|
|
|
|
go func() {
|
|
for {
|
|
select {
|
|
case <-ctx.Done():
|
|
log.Debug().Msg("Script watcher exiting gracefully.")
|
|
return
|
|
|
|
// watch for events
|
|
case event := <-watcher.Events:
|
|
if !strings.HasSuffix(event.Name, "js") {
|
|
log.Info().Str("file", event.Name).Msg("Ignoring file")
|
|
continue
|
|
}
|
|
switch event.Op {
|
|
case fsnotify.Create:
|
|
script, err := misc.ReadScriptFile(event.Name)
|
|
if err != nil {
|
|
log.Error().Err(err).Send()
|
|
continue
|
|
}
|
|
|
|
index, err := createScript(provider, script.ConfigMap())
|
|
if err != nil {
|
|
log.Error().Err(err).Send()
|
|
continue
|
|
}
|
|
|
|
files[script.Path] = index
|
|
|
|
case fsnotify.Write:
|
|
index := files[event.Name]
|
|
script, err := misc.ReadScriptFile(event.Name)
|
|
if err != nil {
|
|
log.Error().Err(err).Send()
|
|
continue
|
|
}
|
|
|
|
err = updateScript(provider, index, script.ConfigMap())
|
|
if err != nil {
|
|
log.Error().Err(err).Send()
|
|
continue
|
|
}
|
|
|
|
case fsnotify.Rename:
|
|
index := files[event.Name]
|
|
err := deleteScript(provider, index)
|
|
if err != nil {
|
|
log.Error().Err(err).Send()
|
|
continue
|
|
}
|
|
|
|
default:
|
|
// pass
|
|
}
|
|
|
|
case err, ok := <-watcher.Errors:
|
|
if !ok {
|
|
log.Info().Msg("Watcher errors channel closed.")
|
|
return
|
|
}
|
|
log.Error().Err(err).Msg("Watcher error encountered")
|
|
}
|
|
}
|
|
}()
|
|
|
|
if err := watcher.Add(config.Config.Scripting.Source); err != nil {
|
|
log.Error().Err(err).Send()
|
|
}
|
|
|
|
for _, source := range config.Config.Scripting.Sources {
|
|
if err := watcher.Add(source); err != nil {
|
|
log.Error().Err(err).Send()
|
|
}
|
|
}
|
|
|
|
log.Info().Str("folder", config.Config.Scripting.Source).Interface("folders", config.Config.Scripting.Sources).Msg("Watching scripts against changes:")
|
|
|
|
if block {
|
|
<-ctx.Done()
|
|
}
|
|
}
|
|
|
|
func watchConfigMap(ctx context.Context, provider *kubernetes.Provider) {
|
|
clientset := provider.GetClientSet()
|
|
configMapName := kubernetes.SELF_RESOURCES_PREFIX + kubernetes.SUFFIX_CONFIG_MAP
|
|
|
|
for {
|
|
select {
|
|
case <-ctx.Done():
|
|
log.Info().Msg("ConfigMap watcher exiting gracefully.")
|
|
return
|
|
|
|
default:
|
|
watcher, err := clientset.CoreV1().ConfigMaps(config.Config.Tap.Release.Namespace).Watch(context.TODO(), metav1.ListOptions{
|
|
FieldSelector: "metadata.name=" + configMapName,
|
|
})
|
|
if err != nil {
|
|
log.Warn().Err(err).Msg("ConfigMap not found, retrying in 5 seconds...")
|
|
time.Sleep(5 * time.Second)
|
|
continue
|
|
}
|
|
|
|
// Create a goroutine to process events
|
|
watcherClosed := make(chan struct{})
|
|
go func() {
|
|
defer close(watcherClosed)
|
|
for event := range watcher.ResultChan() {
|
|
if event.Type == watch.Added {
|
|
log.Info().Msg("ConfigMap created or modified")
|
|
runScriptsSync(provider)
|
|
} else if event.Type == watch.Deleted {
|
|
log.Warn().Msg("ConfigMap deleted, waiting for recreation...")
|
|
break
|
|
}
|
|
}
|
|
}()
|
|
|
|
// Wait for either context cancellation or watcher completion
|
|
select {
|
|
case <-ctx.Done():
|
|
watcher.Stop()
|
|
log.Info().Msg("ConfigMap watcher stopping due to context cancellation")
|
|
return
|
|
case <-watcherClosed:
|
|
log.Info().Msg("Watcher closed, restarting...")
|
|
}
|
|
|
|
time.Sleep(5 * time.Second)
|
|
}
|
|
}
|
|
}
|
|
|
|
func runScriptsSync(provider *kubernetes.Provider) {
|
|
files := make(map[string]int64)
|
|
|
|
scripts, err := config.Config.Scripting.GetScripts()
|
|
if err != nil {
|
|
log.Error().Err(err).Send()
|
|
return
|
|
}
|
|
|
|
for _, script := range scripts {
|
|
index, err := createScript(provider, script.ConfigMap())
|
|
if err != nil {
|
|
log.Error().Err(err).Send()
|
|
continue
|
|
}
|
|
files[script.Path] = index
|
|
}
|
|
log.Info().Msg("Synchronized scripts with ConfigMap.")
|
|
}
|