From 6b223c9548d48675596eb0e9d1cc8a8e01435dfc Mon Sep 17 00:00:00 2001
From: Pawel Wieczorek <p.wieczorek2@samsung.com>
Date: Sun, 26 May 2019 15:35:02 +0200
Subject: k8s: Obtain relevant information from Rancher

This patch introduces Rancher queries using its CLI client. It depends
on having utility binary located in PATH and providing configuration
file prior first use.

Issue-ID: SECCOM-235
Change-Id: Idb011e27b4801c5700b4482656463849736298da
Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
---
 test/security/k8s/src/check/cmd/check/check.go |  8 +++
 test/security/k8s/src/check/rancher/rancher.go | 87 ++++++++++++++++++++++++++
 2 files changed, 95 insertions(+)
 create mode 100644 test/security/k8s/src/check/rancher/rancher.go

(limited to 'test/security/k8s')

diff --git a/test/security/k8s/src/check/cmd/check/check.go b/test/security/k8s/src/check/cmd/check/check.go
index 18487e29f..e48088a9e 100644
--- a/test/security/k8s/src/check/cmd/check/check.go
+++ b/test/security/k8s/src/check/cmd/check/check.go
@@ -2,8 +2,16 @@ package main
 
 import (
 	"flag"
+	"log"
+
+	"check/rancher"
 )
 
 func main() {
 	flag.Parse()
+	k8sParams, err := rancher.GetK8sParams()
+	if err != nil {
+		log.Fatal(err)
+	}
+	log.Printf("%s\n", k8sParams)
 }
diff --git a/test/security/k8s/src/check/rancher/rancher.go b/test/security/k8s/src/check/rancher/rancher.go
new file mode 100644
index 000000000..d60b73b65
--- /dev/null
+++ b/test/security/k8s/src/check/rancher/rancher.go
@@ -0,0 +1,87 @@
+// Package rancher wraps Rancher commands necessary for K8s inspection.
+package rancher
+
+import (
+	"bytes"
+	"errors"
+	"os/exec"
+)
+
+const (
+	bin                      = "rancher"
+	paramHost                = "--host"
+	cmdHosts                 = "hosts"
+	cmdHostsParams           = "--quiet"
+	cmdDocker                = "docker"
+	cmdDockerCmdPs           = "ps"
+	cmdDockerCmdPsParams     = "--no-trunc"
+	cmdDockerCmdPsFilter     = "--filter"
+	cmdDockerCmdPsFilterArgs = "label=io.rancher.stack_service.name=kubernetes/kubernetes"
+	cmdDockerCmdPsFormat     = "--format"
+	cmdDockerCmdPsFormatArgs = "{{.Command}}"
+	k8sProcess               = "kube-apiserver"
+)
+
+// GetK8sParams returns parameters of running Kubernetes API server.
+// It queries default environment set in configuration file.
+func GetK8sParams() ([]string, error) {
+	hosts, err := listHosts()
+	if err != nil {
+		return []string{}, err
+	}
+
+	for _, host := range hosts {
+		cmd, err := getK8sCmd(host)
+		if err != nil {
+			return []string{}, err
+		}
+
+		if len(cmd) > 0 {
+			i := bytes.Index(cmd, []byte(k8sProcess))
+			if i == -1 {
+				return []string{}, errors.New("missing " + k8sProcess + " command")
+			}
+			return btos(cmd[i+len(k8sProcess):]), nil
+		}
+	}
+	return []string{}, nil
+}
+
+// listHosts lists IDs of active hosts.
+// It queries default environment set in configuration file.
+func listHosts() ([]string, error) {
+	cmd := exec.Command(bin, cmdHosts, cmdHostsParams)
+	out, err := cmd.Output()
+	if err != nil {
+		return nil, err
+	}
+	return btos(out), nil
+}
+
+// getK8sCmd returns running Kubernetes API server command with its parameters.
+// It queries default environment set in configuration file.
+func getK8sCmd(host string) ([]byte, error) {
+	// Following is equivalent to:
+	// $ rancher --host $HOST \
+	//   docker ps --no-trunc \
+	//   --filter "label=io.rancher.stack_service.name=kubernetes/kubernetes" \
+	//   --format "{{.Command}}"
+	cmd := exec.Command(bin, paramHost, host,
+		cmdDocker, cmdDockerCmdPs, cmdDockerCmdPsParams,
+		cmdDockerCmdPsFilter, cmdDockerCmdPsFilterArgs,
+		cmdDockerCmdPsFormat, cmdDockerCmdPsFormatArgs)
+	out, err := cmd.Output()
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// btos converts slice of bytes to slice of strings split by white space characters.
+func btos(in []byte) []string {
+	var out []string
+	for _, b := range bytes.Fields(in) {
+		out = append(out, string(b))
+	}
+	return out
+}
-- 
cgit 1.2.3-korg