kubearmor-client/cmd/root.go
tesla59 ee40b91f0b feat: (recommend) Implement recommend functionality for Docker Client
cmd: rename k8s client to k8sclient

Signed-off-by: tesla59 <nishant@heim.id>

cmd: wrap k8sClient in interface to use in recommend package

Signed-off-by: tesla59 <nishant@heim.id>

k8s: fix ListDeployment method

Signed-off-by: tesla59 <nishant@heim.id>

recommend: refactor k8s policy generation
use a common interface to support other clients as well
also create common Object{} to support different k8s obejcts such as Deployment, Daemonset etc

Signed-off-by: tesla59 <nishant@heim.id>

recommend: use image name as Object's name while generating policy

Signed-off-by: tesla59 <nishant@heim.id>

recommend: remove DeploymentName Field from Object{}

Signed-off-by: tesla59 <nishant@heim.id>

recommend: use ListOptions to select deployment by labels

Signed-off-by: tesla59 <nishant@heim.id>

k8s: generate recommended policies for CronJob, DaemonSet and Jobs

Signed-off-by: tesla59 <nishant@heim.id>

k8s: generate recommend policy for statefulset and unowned replicaset

Signed-off-by: tesla59 <nishant@heim.id>

k8s: remove K8sClientWrapper abstraction

Signed-off-by: tesla59 <nishant@heim.id>

recommend: initialize dockerClient and generate policies for containers as well

Signed-off-by: tesla59 <nishant@heim.id>

recommend: add new flag k8s to specify which client to use
this removes dependency of recommend command on kubearmor

Signed-off-by: tesla59 <nishant@heim.id>

recommend: fallback to docker client if k8s client is not present

Signed-off-by: tesla59 <nishant@heim.id>

recommend: only log the client if images is not specified

Signed-off-by: tesla59 <nishant@heim.id>

recommend: generate policyDir based on image namespace set to null

Signed-off-by: tesla59 <nishant@heim.id>

recommend: trim \n in final report generation

Signed-off-by: tesla59 <nishant@heim.id>

recommend: handle err when listing objects

Signed-off-by: tesla59 <nishant@heim.id>

docker: Use API version negotiation to avoid version mismatch errors

Signed-off-by: tesla59 <nishant@heim.id>
2025-07-15 21:29:08 +05:30

58 lines
1.9 KiB
Go

// SPDX-License-Identifier: Apache-2.0
// Copyright 2021 Authors of KubeArmor
// Package cmd is the collection of all the subcommands available in kArmor while providing relevant options for the same
package cmd
import (
"github.com/kubearmor/kubearmor-client/docker"
"github.com/kubearmor/kubearmor-client/k8s"
"github.com/rs/zerolog/log"
"github.com/spf13/cobra"
)
var k8sClient *k8s.Client
var dockerClient *docker.Client
// rootCmd represents the base command when called without any subcommands
var rootCmd = &cobra.Command{
PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
var err error
//Initialise k8sClient for all child commands to inherit
k8sClient, err = k8s.ConnectK8sClient()
if err != nil {
log.Error().Msgf("unable to create Kubernetes clients: %s", err.Error())
return err
}
// Initialise dockerClient for all child commands to inherit
dockerClient, err = docker.ConnectDockerClient()
if err != nil {
log.Error().Msgf("unable to create Docker clients: %s", err.Error())
return err
}
return nil
},
Use: "karmor",
Short: "A CLI Utility to help manage KubeArmor",
Long: `CLI Utility to help manage KubeArmor
KubeArmor is a container-aware runtime security enforcement system that
restricts the behavior (such as process execution, file access, and networking
operation) of containers at the system level.
`,
SilenceUsage: true,
SilenceErrors: true,
}
func init() {
rootCmd.PersistentFlags().StringVar(&k8s.KubeConfig, "kubeconfig", "", "Path to the kubeconfig file to use")
rootCmd.PersistentFlags().StringVar(&k8s.ContextName, "context", "", "Name of the kubeconfig context to use")
}
// Execute adds all child commands to the root command and sets flags appropriately.
// This is called by main.main(). It only needs to happen once to the rootCmd.
func Execute() {
cobra.CheckErr(rootCmd.Execute())
}