Skip to content

Commit d1236dc

Browse files
committed
feat: add admission command for testing Kubernetes admission controllers
1 parent 805861f commit d1236dc

12 files changed

Lines changed: 637 additions & 19 deletions

File tree

cmd/admission/admission.go

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
package admission
2+
3+
import (
4+
"errors"
5+
"fmt"
6+
command "github.com/esonhugh/k8spider/cmd"
7+
"github.com/esonhugh/k8spider/pkg/admission-webhook/reviewer"
8+
"github.com/guonaihong/gout"
9+
log "github.com/sirupsen/logrus"
10+
"github.com/spf13/cobra"
11+
v1 "k8s.io/api/admission/v1"
12+
"os"
13+
)
14+
15+
var Opts = struct {
16+
As string
17+
Group []string
18+
Indent int
19+
Action string
20+
SendToController bool
21+
ControllerEndpoint string
22+
23+
FileContent [][]byte
24+
}{}
25+
26+
func init() {
27+
AdmitCmd.Flags().StringVarP(&Opts.As, "as", "a", "", "as username ")
28+
AdmitCmd.Flags().StringSliceVarP(&Opts.Group, "group", "g", []string{}, "group")
29+
AdmitCmd.Flags().IntVarP(&Opts.Indent, "indent", "I", 2, "indent")
30+
AdmitCmd.Flags().StringVarP(&Opts.Action, "action", "A", "create", "action")
31+
AdmitCmd.Flags().BoolVarP(&Opts.SendToController, "send-to-controller", "s", false, "send to controller")
32+
AdmitCmd.Flags().StringVarP(&Opts.ControllerEndpoint, "controller-endpoint", "e", "", "controller endpoint")
33+
command.RootCmd.AddCommand(AdmitCmd)
34+
}
35+
36+
var AdmitCmd = &cobra.Command{
37+
Use: "admit [file]",
38+
Short: "admit is a tool to testing kubernetes admission controllers",
39+
Long: "admit is a tool to testing kubernetes admission controllers",
40+
PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
41+
if Opts.SendToController {
42+
if Opts.ControllerEndpoint == "" {
43+
return errors.New("if send to controller is ture, controller-endpoint can't be empty")
44+
}
45+
}
46+
if len(args) == 0 {
47+
return errors.New("file args can't be empty")
48+
}
49+
for _, file := range args {
50+
f, err := os.ReadFile(file)
51+
if err != nil {
52+
return err
53+
}
54+
Opts.FileContent = append(Opts.FileContent, f)
55+
}
56+
return nil
57+
},
58+
Run: func(cmd *cobra.Command, args []string) {
59+
for _, input := range Opts.FileContent {
60+
content, err := reviewer.CreateAdmissionReviewRequest(input, Opts.Action, Opts.As, Opts.Group, Opts.Indent)
61+
if err != nil {
62+
log.Errorf("create admission review request failed: %v", err)
63+
return
64+
}
65+
log.Debugf("admission review request: %v", string(content))
66+
if Opts.SendToController {
67+
log.Tracef("sending to the controller: %v", Opts.ControllerEndpoint)
68+
gp := gout.POST(Opts.ControllerEndpoint).SetJSON(content)
69+
if command.Opts.Verbose > 0 {
70+
gp.Debug(true)
71+
}
72+
var resp v1.AdmissionReview
73+
err := gp.BindJSON(&resp).Do()
74+
if err != nil {
75+
log.Errorf("send to controller failed: %v", err)
76+
}
77+
if resp.Response == nil {
78+
log.Errorf("get empty admission reviewed response")
79+
}
80+
log.Infof("get admission reviewed response")
81+
log.Infof("Allowed: %v", resp.Response.Allowed)
82+
log.Infof("UID: %v", resp.Response.UID)
83+
log.Infof("PatchType: %v", *resp.Response.PatchType)
84+
log.Infof("Patch: %v", string(resp.Response.Patch))
85+
for k, v := range resp.Response.AuditAnnotations {
86+
log.Infof("AuditAnnotation[%v]: %v", k, v)
87+
}
88+
for _, w := range resp.Response.Warnings {
89+
log.Infof("Warning: %v", w)
90+
}
91+
return
92+
} else {
93+
fmt.Println(string(content))
94+
if command.Opts.OutputFile != "" {
95+
err := os.WriteFile(command.Opts.OutputFile, content, 0644)
96+
if err != nil {
97+
log.Errorf("write to file failed: %v", err)
98+
}
99+
}
100+
}
101+
}
102+
},
103+
}

cmd/all/all.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,11 @@ func PostRun(finalRecord define.Records, file string) {
153153
log.Warnf("Checkout service %v, which maybe contains apps metrics information", svc)
154154
}
155155
}
156+
if strings.Contains(svc, "ingress-nginx-controller-admission") ||
157+
(strings.Contains(svc, "admission") &&
158+
(strings.Contains(svc, "nginx-ingress") || strings.Contains(svc, "ingress-nginx"))) {
159+
log.Warnf("Checkout service %v, which maybe effects CVE-2025-1974 nginx ingress controllor ", svc)
160+
}
156161
log.Infof("Service: %s", svc)
157162
writeString("// \t\t" + svc + "\n")
158163
}

cmd/root.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,15 +77,15 @@ func init() {
7777
RootCmd.PersistentFlags().StringSliceVarP(&Opts.FilterStrings, "filter-strings", "f", []string{}, "filter contained strings")
7878

7979
RootCmd.PersistentFlags().IntVarP(&Opts.Latency, "latency", "l", 0, "Latency control while each dns query in ms, default 0ms")
80+
// Set Log Levels
81+
SetLogLevel(Opts.Verbose)
8082
}
8183

8284
var RootCmd = &cobra.Command{
8385
Use: "k8spider",
8486
Short: "k8spider is a tool to discover k8s services",
8587
Long: "k8spider is Powerful+Fast+Low Privilege Kubernetes service discovery tools via kubernetes DNS service. Currently supported service ip-port BruteForcing / AXFR Domain Transfer Dump / Coredns WildCard Dump / Pod Verified IP discovery\n\nTopics\n",
8688
PersistentPreRun: func(cmd *cobra.Command, args []string) {
87-
// Set Log Levels
88-
SetLogLevel(Opts.Verbose)
8989
// Set pkg global config
9090
pkg.Zone = Opts.Zone
9191

go.mod

Lines changed: 45 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,60 @@
11
module github.com/esonhugh/k8spider
22

3-
go 1.21.0
3+
go 1.23.0
4+
5+
toolchain go1.23.4
46

57
require (
68
github.com/elastic/go-grok v0.3.1
9+
github.com/guonaihong/gout v0.3.10
710
github.com/miekg/dns v1.1.58
811
github.com/sirupsen/logrus v1.9.0
912
github.com/spf13/cobra v1.5.0
13+
k8s.io/api v0.32.3
14+
k8s.io/apimachinery v0.32.3
15+
k8s.io/client-go v0.32.3
1016
)
1117

1218
require (
19+
github.com/andybalholm/brotli v1.0.4 // indirect
20+
github.com/bytedance/sonic v1.7.0 // indirect
21+
github.com/chenzhuoyu/base64x v0.0.0-20221115062448-fe3a3abad311 // indirect
22+
github.com/fxamacker/cbor/v2 v2.7.0 // indirect
23+
github.com/go-logr/logr v1.4.2 // indirect
24+
github.com/go-playground/locales v0.13.0 // indirect
25+
github.com/go-playground/universal-translator v0.17.0 // indirect
26+
github.com/go-playground/validator/v10 v10.4.1 // indirect
27+
github.com/goccy/go-json v0.10.0 // indirect
28+
github.com/gogo/protobuf v1.3.2 // indirect
29+
github.com/google/gofuzz v1.2.0 // indirect
30+
github.com/google/uuid v1.6.0 // indirect
1331
github.com/inconshreveable/mousetrap v1.0.0 // indirect
32+
github.com/json-iterator/go v1.1.12 // indirect
33+
github.com/klauspost/cpuid/v2 v2.0.9 // indirect
34+
github.com/kr/text v0.2.0 // indirect
35+
github.com/leodido/go-urn v1.2.0 // indirect
1436
github.com/magefile/mage v1.15.0 // indirect
37+
github.com/mattn/go-isatty v0.0.14 // indirect
38+
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
39+
github.com/modern-go/reflect2 v1.0.2 // indirect
40+
github.com/pkg/errors v0.9.1 // indirect
1541
github.com/spf13/pflag v1.0.5 // indirect
16-
golang.org/x/mod v0.17.0 // indirect
17-
golang.org/x/net v0.20.0 // indirect
18-
golang.org/x/sys v0.16.0 // indirect
19-
golang.org/x/tools v0.17.0 // indirect
42+
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
43+
github.com/x448/float16 v0.8.4 // indirect
44+
golang.org/x/arch v0.0.0-20210923205945-b76863e36670 // indirect
45+
golang.org/x/crypto v0.28.0 // indirect
46+
golang.org/x/mod v0.21.0 // indirect
47+
golang.org/x/net v0.30.0 // indirect
48+
golang.org/x/sync v0.8.0 // indirect
49+
golang.org/x/sys v0.26.0 // indirect
50+
golang.org/x/text v0.19.0 // indirect
51+
golang.org/x/tools v0.26.0 // indirect
52+
google.golang.org/protobuf v1.35.1 // indirect
53+
gopkg.in/inf.v0 v0.9.1 // indirect
54+
gopkg.in/yaml.v2 v2.4.0 // indirect
55+
k8s.io/klog/v2 v2.130.1 // indirect
56+
k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 // indirect
57+
sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
58+
sigs.k8s.io/structured-merge-diff/v4 v4.4.2 // indirect
59+
sigs.k8s.io/yaml v1.4.0 // indirect
2060
)

0 commit comments

Comments
 (0)