Merge pull request rancher#46977 from markusewalker/markus/update-har…

…dening [Main] Update hardening action to include YAML and bash scripts
HarrisonWAffel · Sep 6, 2024 · 4bb7bab · 4bb7bab
2 parents 7f7897b + 1ceabad
commit 4bb7bab
Show file tree

Hide file tree

Showing 8 changed files with 81 additions and 30 deletions.
diff --git a/tests/v2/actions/hardening/k3s/audit.yaml b/tests/v2/actions/hardening/k3s/audit.yaml
@@ -0,0 +1,4 @@
+apiVersion: audit.k8s.io/v1
+kind: Policy
+rules:
+- level: Metadata
diff --git a/tests/v2/actions/hardening/k3s/harden_nodes.go b/tests/v2/actions/hardening/k3s/harden_nodes.go
@@ -1,6 +1,8 @@
 package k3s
 
 import (
+	"os/user"
+	"path/filepath"
 	"strings"
 
 	"github.com/rancher/shepherd/pkg/nodes"
@@ -41,12 +43,14 @@ func HardenK3SNodes(nodes []*nodes.Node, nodeRoles []string, kubeVersion string)
 		}
 
 		if strings.Contains(nodeRoles[key], "--controlplane") {
-			_, err = node.ExecuteCommand(`sudo bash -c 'cat << EOF > /home/` + node.SSHUser + `/audit.yaml
-apiVersion: audit.k8s.io/v1
-kind: Policy
-rules:
-- level: Metadata
-EOF'`)
+			logrus.Infof("Copying over files to node %s", node.NodeID)
+			user, err := user.Current()
+			if err != nil {
+				return nil
+			}
+
+			dirPath := filepath.Join(user.HomeDir, "go/src/github.com/rancher/rancher/tests/v2/actions/hardening/k3s")
+			err = node.SCPFileToNode(dirPath+"/audit.yaml", "/home/"+node.SSHUser+"/audit.yaml")
 			if err != nil {
 				return err
 			}

diff --git a/tests/v2/actions/hardening/rke1/account-update.sh b/tests/v2/actions/hardening/rke1/account-update.sh
@@ -0,0 +1,6 @@
+#!/bin/bash -e
+
+for namespace in $(kubectl get namespaces -A -o=jsonpath="{.items[*]['metadata.name']}"); do
+  echo -n "Patching namespace $namespace - "; 
+  kubectl patch serviceaccount default -n ${namespace} -p "$(cat account_update.yaml)"; 
+done
diff --git a/tests/v2/actions/hardening/rke1/account-update.yaml b/tests/v2/actions/hardening/rke1/account-update.yaml
@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: default
+automountServiceAccountToken: false
diff --git a/tests/v2/actions/hardening/rke1/harden_nodes.go b/tests/v2/actions/hardening/rke1/harden_nodes.go
@@ -1,6 +1,8 @@
 package rke1
 
 import (
+	"os/user"
+	"path/filepath"
 	"strings"
 
 	"github.com/rancher/shepherd/pkg/nodes"
@@ -69,23 +71,29 @@ func PostRKE1HardeningConfig(nodes []*nodes.Node, nodeRoles []string) error {
 		}
 
 		if strings.Contains(nodeRoles[key], "--controlplane") {
-			_, err := node.ExecuteCommand(`sudo bash -c 'cat << EOF > /home/` + node.SSHUser + `/account-update.yaml
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: default
-automountServiceAccountToken: false
-EOF'`)
+			logrus.Infof("Copying over files to node %s", node.NodeID)
+			user, err := user.Current()
+			if err != nil {
+				return nil
+			}
+
+			dirPath := filepath.Join(user.HomeDir, "go/src/github.com/rancher/rancher/tests/v2/actions/hardening/rke1")
+			err = node.SCPFileToNode(dirPath+"/account-update.yaml", "/home/"+node.SSHUser+"/account-update.yaml")
+			if err != nil {
+				return err
+			}
+
+			err = node.SCPFileToNode(dirPath+"/account-update.sh", "/home/"+node.SSHUser+"/account-update.sh")
 			if err != nil {
 				return err
 			}
 
-			command := `for namespace in $(kubectl get namespaces -A -o=jsonpath="{.items[*]['metadata.name']}"); do 
-							echo -n "Patching namespace $namespace - "; 
-							kubectl patch serviceaccount default -n ${namespace} -p "$(cat /home/` + node.SSHUser + `/account_update.yaml)"; 
-						done`
+			_, err = node.ExecuteCommand("sudo bash -c 'chmod +x /home/" + node.SSHUser + "/account-update.sh'")
+			if err != nil {
+				return err
+			}
 
-			_, err = node.ExecuteCommand("sudo bash -c '" + command + "'")
+			_, err = node.ExecuteCommand("sudo bash -c '/home/" + node.SSHUser + "/account-update.sh'")
 			if err != nil {
 				return err
 			}

diff --git a/tests/v2/actions/hardening/rke2/account-update.sh b/tests/v2/actions/hardening/rke2/account-update.sh
@@ -0,0 +1,6 @@
+#!/bin/bash -e
+
+for namespace in $(kubectl get namespaces -A -o=jsonpath="{.items[*]['metadata.name']}"); do
+  echo -n "Patching namespace $namespace - "
+  kubectl patch serviceaccount default -n ${namespace} -p "$(cat /var/lib/rancher/rke2/server/account-update.yaml)"
+done
diff --git a/tests/v2/actions/hardening/rke2/account-update.yaml b/tests/v2/actions/hardening/rke2/account-update.yaml
@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: default
+automountServiceAccountToken: false
diff --git a/tests/v2/actions/hardening/rke2/harden_nodes.go b/tests/v2/actions/hardening/rke2/harden_nodes.go
@@ -1,6 +1,8 @@
 package rke2
 
 import (
+	"os/user"
+	"path/filepath"
 	"strings"
 
 	"github.com/rancher/shepherd/pkg/nodes"
@@ -55,13 +57,19 @@ func HardenRKE2Nodes(nodes []*nodes.Node, nodeRoles []string) error {
 func PostRKE2HardeningConfig(nodes []*nodes.Node, nodeRoles []string) error {
 	for key, node := range nodes {
 		if strings.Contains(nodeRoles[key], "--controlplane") {
-			_, err := node.ExecuteCommand(`sudo bash -c 'cat << EOF > /home/` + node.SSHUser + `/account-update.yaml
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: default
-automountServiceAccountToken: false
-EOF'`)
+			logrus.Infof("Copying over files to node %s", node.NodeID)
+			user, err := user.Current()
+			if err != nil {
+				return nil
+			}
+
+			dirPath := filepath.Join(user.HomeDir, "go/src/github.com/rancher/rancher/tests/v2/actions/hardening/rke2")
+			err = node.SCPFileToNode(dirPath+"/account-update.yaml", "/home/"+node.SSHUser+"/account-update.yaml")
+			if err != nil {
+				return err
+			}
+
+			err = node.SCPFileToNode(dirPath+"/account-update.sh", "/home/"+node.SSHUser+"/account-update.sh")
 			if err != nil {
 				return err
 			}
@@ -71,12 +79,17 @@ EOF'`)
 				return err
 			}
 
-			command := `for namespace in $(kubectl get namespaces -A -o=jsonpath="{.items[*]['metadata.name']}"); do 
-    						echo -n "Patching namespace $namespace - "; 
-    						kubectl patch serviceaccount default -n ${namespace} -p "$(cat /var/lib/rancher/rke2/server/account-update.yaml)"; 
-						done`
+			_, err = node.ExecuteCommand("sudo bash -c 'mv /home/" + node.SSHUser + "/account-update.sh /var/lib/rancher/rke2/server/account-update.sh'")
+			if err != nil {
+				return err
+			}
+
+			_, err = node.ExecuteCommand("sudo bash -c 'chmod +x /var/lib/rancher/rke2/server/account-update.sh'")
+			if err != nil {
+				return err
+			}
 
-			_, err = node.ExecuteCommand("sudo bash -c '" + command + "'")
+			_, err = node.ExecuteCommand("sudo bash -c 'export KUBECONFIG=/etc/rancher/rke2/rke2.yaml && /var/lib/rancher/rke2/server/account-update.sh'")
 			if err != nil {
 				return err
 			}