fix for crds upload

components/security_apps/local_policy_mgmt_gen/include/ingress_data.h

@@ -79,6 +79,7 @@ class DefaultBackend
 {
 public:
     void load(cereal::JSONInputArchive &);
+    bool doesExist() const;
 
 private:
     bool is_exists = false;
@@ -90,6 +91,7 @@ public:
     void load(cereal::JSONInputArchive &archive_in);
 
     const std::vector<IngressDefinedRule> & getRules() const;
+    bool doesDefaultBackendExist() const;
 
 private:
     std::string ingress_class_name;

components/security_apps/local_policy_mgmt_gen/include/policy_maker_utils.h

@@ -111,7 +111,7 @@ private:
     SecurityAppsWrapper security_apps;
 };
 
-class PolicyMakerUtils
+class PolicyMakerUtils : Singleton::Consume<I_EnvDetails>
 {
 public:
     std::string proccesSingleAppsecPolicy(

components/security_apps/local_policy_mgmt_gen/ingress_data.cc

@@ -86,6 +86,12 @@ DefaultBackend::load(cereal::JSONInputArchive &)
     is_exists = true;
 }
 
+bool
+DefaultBackend::doesExist() const
+{
+    return is_exists;
+}
+
 void
 IngressSpec::load(cereal::JSONInputArchive &archive_in)
 {
@@ -101,6 +107,12 @@ IngressSpec::getRules() const
     return rules;
 }
 
+bool
+IngressSpec::doesDefaultBackendExist() const
+{
+    return default_backend.doesExist();
+}
+
 void
 SingleIngressData::load(cereal::JSONInputArchive &archive_in)
 {

components/security_apps/local_policy_mgmt_gen/k8s_policy_utils.cc

@@ -532,6 +532,16 @@ K8sPolicyUtils::createPolicy(
     map<AnnotationKeys, string> &annotations_values,
     const SingleIngressData &item) const
 {
+    if (policies.find(annotations_values[AnnotationKeys::PolicyKey]) == policies.end()) {
+        policies[annotations_values[AnnotationKeys::PolicyKey]] = appsec_policy;
+    }
+    if (item.getSpec().doesDefaultBackendExist()) {
+        dbgTrace(D_LOCAL_POLICY)
+            << "Inserting Any host rule to the specific asset set";
+        K ingress_rule = K("*");
+        policies[annotations_values[AnnotationKeys::PolicyKey]].addSpecificRule(ingress_rule);
+    }
+
     for (const IngressDefinedRule &rule : item.getSpec().getRules()) {
         string url = rule.getHost();
         for (const IngressRulePath &uri : rule.getPathsWrapper().getRulePaths()) {
@@ -544,14 +554,12 @@ K8sPolicyUtils::createPolicy(
                     << uri.getPath()
                     << "'";
                 K ingress_rule = K(url + uri.getPath());
-                appsec_policy.addSpecificRule(ingress_rule);
+                policies[annotations_values[AnnotationKeys::PolicyKey]].addSpecificRule(ingress_rule);
             }
         }
     }
-    policies[annotations_values[AnnotationKeys::PolicyKey]] = appsec_policy;
 }
 
-
 std::tuple<map<string, AppsecLinuxPolicy>, map<string, V1beta2AppsecLinuxPolicy>>
 K8sPolicyUtils::createAppsecPoliciesFromIngresses()
 {

components/security_apps/local_policy_mgmt_gen/new_appsec_policy_crd_parser.cc

@@ -126,6 +126,7 @@ NewAppsecPolicySpec::load(cereal::JSONInputArchive &archive_in)
     dbgTrace(D_LOCAL_POLICY) << "Loading AppSec policy spec";
     parseAppsecJSONKey<string>("appsecClassName", appsec_class_name, archive_in);
     parseAppsecJSONKey<NewParsedRule>("default", default_rule, archive_in);
+    default_rule.setHost("*");
     parseAppsecJSONKey<vector<NewParsedRule>>("specificRules", specific_rules, archive_in);
 }
 

components/security_apps/local_policy_mgmt_gen/policy_maker_utils.cc

@@ -1636,7 +1636,9 @@ PolicyMakerUtils::createAgentPolicyFromAppsecPolicy(const string &policy_name, c
     createPolicyElements<T, R>(specific_rules, default_rule, appsec_policy, policy_name);
 
     // add default rule to policy
-    createPolicyElementsByRule<T, R>(default_rule, default_rule, appsec_policy, policy_name);
+    if (Singleton::Consume<I_EnvDetails>::by<PolicyMakerUtils>()->getEnvType() != EnvType::K8S) {
+        createPolicyElementsByRule<T, R>(default_rule, default_rule, appsec_policy, policy_name);
+    }
 }
 
 // LCOV_EXCL_START Reason: no test exist
@@ -1659,11 +1661,13 @@ PolicyMakerUtils::createAgentPolicyFromAppsecPolicy<V1beta2AppsecLinuxPolicy, Ne
     );
 
     // add default rule to policy
-    createPolicyElementsByRule<V1beta2AppsecLinuxPolicy, NewParsedRule>(
+    if (Singleton::Consume<I_EnvDetails>::by<PolicyMakerUtils>()->getEnvType() != EnvType::K8S) {
-        default_rule,
+        createPolicyElementsByRule<V1beta2AppsecLinuxPolicy, NewParsedRule>(
-        default_rule,
+            default_rule,
-        appsec_policy,
+            default_rule,
-        policy_name);
+            appsec_policy,
+            policy_name);
+    }
 }
 // LCOV_EXCL_STOP
 

config/crds/open-appsec-crd-v1beta1.yaml

@@ -1,525 +0,0 @@
-Enter file contents hereapiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata :
-  name : customresponses.openappsec.io
-
-spec:
-  group: openappsec.io
-  versions:
-    - name: v1beta1
-      served: true
-      storage: true
-      schema:
-        openAPIV3Schema:
-          type: object
-          properties:
-            spec:
-              type: object
-              properties:
-                mode:
-                  type: string
-                  enum:
-                    - block-page
-                    #- redirect
-                    - response-code-only
-                message-title:
-                  type: string
-                message-body:
-                  type: string
-                http-response-code:
-                  type: integer
-                  minimum: 100
-                  maximum: 599
-
-  scope: Cluster
-  names:
-    plural: customresponses
-    singular: customresponse
-    kind: CustomResponse
-    shortNames:
-    - customresponse
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: exceptions.openappsec.io
-
-spec:
-  group: openappsec.io
-  versions:
-    - name: v1beta1
-      served: true
-      storage: true
-      schema:
-        openAPIV3Schema:
-          type: object
-          properties:
-            spec:
-              type: array
-              items:
-                type: object
-                required:
-                  - action
-                properties:
-                  action:
-                    type: string
-                    enum:
-                      - skip
-                      - accept
-                      - drop
-                      - suppressLog
-                  sourceIp:
-                    type: array
-                    items:
-                      type: string
-                  url:
-                    type: array
-                    items:
-                      type: string
-                  sourceIdentifier:
-                    type: array
-                    items:
-                      type: string
-                  protectionName:
-                    type: array
-                    items:
-                      type: string
-                  paramValue:
-                    type: array
-                    items:
-                      type: string
-                  paramName:
-                    type: array
-                    items:
-                      type: string
-                  hostName:
-                    type: array
-                    items:
-                      type: string
-                  countryCode:
-                    type: array
-                    items:
-                      type: string
-                  countryName:
-                    type: array
-                    items:
-                      type: string
-                  comment:
-                    type: string
-
-  scope: Cluster
-  names:
-    plural: exceptions
-    singular: exception
-    kind: Exception
-    shortNames:
-      - exception
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata :
-  name : logtriggers.openappsec.io
-
-spec:
-  group: openappsec.io
-  versions:
-    - name: v1beta1
-      # Each version can be enabled/disabled by Served flag.
-      served: true
-      # One and only one version must be marked as the storage version.
-      storage: true
-      schema:
-        openAPIV3Schema:
-          type: object
-          properties:
-            spec:
-              type: object
-              properties:
-                access-control-logging:
-                  type: object
-                  properties:
-                    allow-events:
-                      type: boolean
-                    drop-events:
-                      type: boolean
-                appsec-logging:
-                  type: object
-                  properties:
-                    detect-events:
-                      type: boolean
-                    prevent-events:
-                      type: boolean
-                    all-web-requests:
-                      type: boolean
-                additional-suspicious-events-logging:
-                  type: object
-                  properties:
-                    enabled:
-                      type: boolean
-                    minimum-severity:
-                      type: string
-                      enum:
-                        - high
-                        - critical
-                    response-body:
-                      type: boolean
-                    response-code:
-                      type: boolean
-                extended-logging:
-                  type: object
-                  properties:
-                    url-path:
-                      type: boolean
-                    url-query:
-                      type: boolean
-                    http-headers:
-                      type: boolean
-                    request-body:
-                      type: boolean
-                log-destination:
-                  type: object
-                  properties:
-                    cloud:
-                      type: boolean
-                    syslog-service: #change to object array
-                      type: array
-                      items:
-                        type: object
-                        properties:
-                          address:
-                            type: string
-                          port:
-                            type: integer
-                    file:
-                      type: string
-                    stdout:
-                      type: object
-                      properties:
-                        format:
-                          type: string
-                          enum:
-                            - json
-                            - json-formatted
-                    cef-service:
-                      type: array
-                      items:
-                        type: object
-                        properties:
-                          address:
-                            type: string
-                          port:
-                            type: integer
-                          proto:
-                            type: string
-                            enum:
-                              - tcp
-                              - udp
-
-  scope: Cluster
-  names:
-    plural: logtriggers
-    singular: logtrigger
-    kind: LogTrigger
-    shortNames:
-    - logtrigger
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata :
-  name : policies.openappsec.io
-
-spec:
-  group: openappsec.io
-  versions:
-    - name: v1beta1
-      # Each version can be enabled/disabled by Served flag.
-      served: true
-      # One and only one version must be marked as the storage version.
-      storage: true
-      schema:
-        openAPIV3Schema:
-          type: object
-          properties:
-            spec:
-              type: object
-              properties:
-                default:
-                  type: object
-                  properties:
-                    mode:
-                      type: string
-                      enum:
-                        - prevent-learn
-                        - detect-learn
-                        - prevent
-                        - detect
-                        - inactive
-                    practices:
-                      type: array
-                      items:
-                        type: string
-                    triggers:
-                      type: array
-                      items:
-                        type: string
-                    custom-response:
-                      type: string
-                    source-identifiers:
-                      type: string
-                    trusted-sources:
-                      type: string
-                    exceptions:
-                      type: array
-                      items:
-                        type: string
-                specific-rules:
-                  type: array
-                  items:
-                    type: object
-                    properties:
-                      host:
-                        type: string
-                      mode:
-                        type: string
-                        enum:
-                          - prevent-learn
-                          - detect-learn
-                          - prevent
-                          - detect
-                          - inactive
-                      practices:
-                        type: array
-                        items:
-                          type: string
-                      triggers:
-                        type: array
-                        items:
-                          type: string
-                      custom-response:
-                        type: string
-                      source-identifiers:
-                        type: string
-                      trusted-sources:
-                        type: string
-                      exceptions:
-                        type: array
-                        items:
-                          type: string
-
-  scope: Cluster
-  names:
-    plural: policies
-    singular: policy
-    kind: Policy
-    shortNames:
-    - policy
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata :
-  name : practices.openappsec.io
-
-spec:
-  group: openappsec.io
-  versions:
-    - name: v1beta1
-      served: true
-      storage: true
-      schema:
-        openAPIV3Schema:
-          type: object
-          properties:
-            spec:
-              type: object
-              properties:
-                web-attacks:
-                  type: object
-                  properties:
-                    override-mode:
-                      type: string
-                      enum:
-                        - prevent-learn
-                        - detect-learn
-                        - prevent
-                        - detect
-                        - inactive
-                    minimum-confidence:
-                      type: string
-                      enum:
-                        - medium
-                        - high
-                        - critical
-                    max-url-size-bytes:
-                      type: integer
-                    max-object-depth:
-                      type: integer
-                    max-body-size-kb:
-                      type: integer
-                    max-header-size-bytes:
-                      type: integer
-                    protections:
-                      type: object
-                      properties:
-                        csrf-enabled:
-                          type: string
-                          enum:
-                            - prevent-learn
-                            - detect-learn
-                            - prevent
-                            - detect
-                            - inactive
-                        error-disclosure-enabled:
-                          type: string
-                          enum:
-                            - prevent-learn
-                            - detect-learn
-                            - prevent
-                            - detect
-                            - inactive
-                        open-redirect-enabled:
-                          type: string
-                          enum:
-                            - prevent-learn
-                            - detect-learn
-                            - prevent
-                            - detect
-                            - inactive
-                        non-valid-http-methods:
-                          type: boolean
-                anti-bot:
-                  type: object
-                  properties:
-                    override-mode:
-                      type: string
-                      enum:
-                        - prevent-learn
-                        - detect-learn
-                        - prevent
-                        - detect
-                        - inactive
-                    injected-URIs:
-                      type: array
-                      items:
-                        type: object
-                        properties:
-                          uri:
-                            type: string
-                    validated-URIs:
-                      type: array
-                      items:
-                        type: object
-                        properties:
-                          uri:
-                            type: string
-                snort-signatures:
-                  type: object
-                  properties:
-                    override-mode:
-                      type: string
-                      enum:
-                        - prevent-learn
-                        - detect-learn
-                        - prevent
-                        - detect
-                        - inactive
-                    configmap:
-                      type: array
-                      items:
-                        type: string
-                openapi-schema-validation:
-                  type: object
-                  properties:
-                    override-mode:
-                      type: string
-                      enum:
-                        - prevent-learn
-                        - detect-learn
-                        - prevent
-                        - detect
-                        - inactive
-                    configmap:
-                      type: array
-                      items:
-                        type: string
-
-  scope: Cluster
-  names:
-    plural: practices
-    singular: practice
-    kind: Practice
-    shortNames:
-    - practice
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata :
-  name : sourcesidentifiers.openappsec.io
-
-spec:
-  group: openappsec.io
-  versions:
-    - name: v1beta1
-      served: true
-      storage: true
-      schema:
-        openAPIV3Schema:
-          type: object
-          properties:
-            spec:
-              type: array
-              items:
-                type: object
-                properties:
-                  sourceIdentifier:
-                    type: string
-                    enum:
-                      - headerkey
-                      - JWTKey
-                      - cookie
-                      - sourceip
-                      - x-forwarded-for
-                  value:
-                    type: array
-                    items:
-                      type: string
-
-  scope: Cluster
-  names:
-    plural: sourcesidentifiers
-    singular: sourcesidentifier
-    kind: SourcesIdentifier
-    shortNames:
-    - sourcesidentifier
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata :
-  name : trustedsources.openappsec.io
-
-spec:
-  group: openappsec.io
-  versions:
-    - name: v1beta1
-      served: true
-      storage: true
-      schema:
-        openAPIV3Schema:
-          type: object
-          properties:
-            spec:
-              type: object
-              properties:
-                minNumOfSources:
-                  type: integer
-                sourcesIdentifiers:
-                  type: array
-                  items:
-                    type: string
-
-  scope: Cluster
-  names:
-    plural: trustedsources
-    singular: trustedsource
-    kind: TrustedSource
-    shortNames:
-    - trustedsource

nodes/orchestration/package/open-appsec-cloud-mgmt-k8s

@@ -13,6 +13,10 @@ profile_id=
 cluster_id=
 latest_policy_version=1
 
+if [ -f $POLICY_CRDS_PATH ]; then
+    chmod 644 $POLICY_CRDS_PATH
+fi
+
 load_agent_details()
 {
     tenant_id=$(awk -F\" '/Tenant ID/{print $4}' /etc/cp/conf/agent_details.json)
@@ -29,7 +33,7 @@ get_latest_policy_version()
     bucket_list=$(curl -s -w "%{http_code}\n" --request GET \
         -H "user-agent: Infinity Next (a7030abf93a4c13)" -H "Authorization: Bearer ${ra_token}" \
         "$var_fog/agents-core/storage/?list-type=2&prefix=${tenant_id}/${profile_id}")
-    paths_list=$(echo $bucket_list  | /etc/cp/bin/yq -p xml | grep "/policy")
+    paths_list=$(echo $bucket_list  | awk -F'<Key>|</Key>' '/policy-/ {for (i = 1; i <= NF; i++) if ($i ~ /policy/) print $i}')
 
     prefix="${tenant_id}/${profile_id}"
     paths=$(echo $paths_list | tr " " "\n" | grep / )
@@ -257,6 +261,7 @@ usage()
     echo "Options:"
     echo "    --fog       <fog address>          : Namespace with the relevant Helm Chart"
     echo "    --upload_policy_only               : Upload policy to the fog, withput changing agent mode"
+    echo "    --debug                            : Keep the debuging files"
     exit 255
 }
 
@@ -277,6 +282,8 @@ validate_arg_value_exists()
     fi
 }
 
+debug_mode="false"
+
 while true; do
     if [ "$1" = "--token" ]; then
         validate_arg_value_exists "$1" "$#"
@@ -290,6 +297,8 @@ while true; do
         validate_arg_value_exists "$1" "$#"
         shift
         ra_token="$1"
+    elif [ "$1" = "--debug" ]; then
+        debug_mode="true"
     elif [ -z "$1" ]; then
         break
     fi
@@ -305,5 +314,8 @@ upload_crds_to_the_cloud
 if [ "$?" = "0" ]; then
     echo "SUCCESS"
 fi
+if [ "$debug_mode" = "false" ]; then
+    rm $POLICY_CRDS_PATH
+fi
 
 exit 0