aquasecurity / kube-hunter

Hunt for security weaknesses in Kubernetes clusters
Apache License 2.0
4.66k stars 578 forks source link

Make gateway discovery always run when running as pod #471

Closed danielsagi closed 2 years ago

danielsagi commented 2 years ago

The old method was to check if we can access metadata api, if so, we extracted a subnet from it and only scanned this subnet This made us sometimes miss important internal kuberentes components.

Metadata api discovery should only be as a bonus, and we should rely on gateway discovery.

This PR also adds more verbose debug output when discovering aws metadata.

Fixed Issues

fixes #467

Contribution checklist

codecov[bot] commented 2 years ago

Codecov Report

Merging #471 (6808adf) into main (f67f082) will increase coverage by 0.02%. The diff coverage is 0.00%.

Impacted file tree graph

@@            Coverage Diff             @@
##             main     #471      +/-   ##
==========================================
+ Coverage   63.86%   63.88%   +0.02%     
==========================================
  Files          43       43              
  Lines        2424     2431       +7     
==========================================
+ Hits         1548     1553       +5     
- Misses        876      878       +2     
Impacted Files Coverage Δ
kube_hunter/modules/discovery/hosts.py 53.26% <0.00%> (-2.11%) :arrow_down:
kube_hunter/core/events/handler.py 89.86% <0.00%> (-0.68%) :arrow_down:
kube_hunter/modules/hunting/apiserver.py 72.34% <0.00%> (+1.92%) :arrow_up:

Continue to review full report at Codecov.

Legend - Click here to learn more Δ = absolute <relative> (impact), ø = not affected, ? = missing data Powered by Codecov. Last update f67f082...6808adf. Read the comment docs.