google / cloud-forensics-utils

Python library to carry out DFIR analysis on the Cloud
Apache License 2.0
453 stars 89 forks source link

FindWorkload method for K8sCluster #404

Closed zkck closed 2 years ago

zkck commented 2 years ago

This PR adds a method to find a workload in a Kubernetes cluster by name and namespace, together with its supporting methods.

Notes

K8sControlledWorkload.OrphanPods

This method needed to be moved higher up the hierarchy, to K8sWorkload, to be compatible with the returned type of FindWorkload. This meant having to implement it in K8sPod.

I chose that OrphanPods have no effect in K8sPod as opposed to deleting the pod. The reasoning for this decision was that the analyst may choose the Preserve evidence and delete workload prompt option with a pod workload specified, and if OrphanPods deletes the pod, then it will be deleting evidence, contradicting the prompt option. I added a warning to notify the user about this behavior.