google / cloud-forensics-utils

Python library to carry out DFIR analysis on the Cloud
Apache License 2.0
453 stars 89 forks source link

CLI hooks for GKE mitigation/enumeration #408

Closed zkck closed 2 years ago

zkck commented 2 years ago

Sample usage for gkequarantine

# Trigger quarantining process for "nginx" workload in namespace "default"
cloudforensics gcp gkequarantine cluster-id us-central1-f nginx default
# Trigger quarantining process for "nginx" workload in namespace "default", exempting source IPs when isolating nodes
cloudforensics gcp gkequarantine cluster-id us-central1-f nginx default --exempted_src_ips 8.8.8.8,1.1.1.1

Sample usage for gkeenumerate:

# Enumerate the cluster in "default" namespace
cloudforensics gcp gkeenumerate cluster-id us-central1-f --namespace default
# Enumerate the cluster in all namespaces
cloudforensics gcp gkeenumerate cluster-id us-central1-f
# Enumerate the "nginx" workload
cloudforensics gcp gkeenumerate cluster-id us-central1-f --workload nginx --namespace default
# Enumerate the "nginx-service" service
cloudforensics gcp gkeenumerate cluster-id us-central1-f --service nginx-service --namespace default
# Enumerate objects on the "gke-cluster-id-default-pool-abcd1234-abcd" node, in all namespaces
cloudforensics gcp gkeenumerate cluster-id us-central1-f --node gke-cluster-id-default-pool-abcd1234-abcd
# Enumerate objects on the "gke-cluster-id-default-pool-abcd1234-abcd" node, in "default" namespace
cloudforensics gcp gkeenumerate cluster-id us-central1-f --node gke-cluster-id-default-pool-abcd1234-abcd --namespace default
# Enumerate in JSON format to stdout
cloudforensics gcp gkeenumerate cluster-id us-central1-f --namespace default --as_json
codecov-commenter commented 2 years ago

Codecov Report

:exclamation: No coverage uploaded for pull request base (main@0fd41b6). Click here to learn what that means. The diff coverage is n/a.

Impacted file tree graph

@@           Coverage Diff           @@
##             main     #408   +/-   ##
=======================================
  Coverage        ?   59.13%           
=======================================
  Files           ?       48           
  Lines           ?     3820           
  Branches        ?        0           
=======================================
  Hits            ?     2259           
  Misses          ?     1561           
  Partials        ?        0           
Flag Coverage Δ
nosetests 59.13% <0.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.


Continue to review full report at Codecov.

Legend - Click here to learn more Δ = absolute <relative> (impact), ø = not affected, ? = missing data Powered by Codecov. Last update 0fd41b6...8bbac10. Read the comment docs.

zkck commented 2 years ago

Converting to draft to add the exempt_source_ips parameter to gkequarantine