-
Notifications
You must be signed in to change notification settings - Fork 97
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: find unused networkpolicies (#296)
* feat: find unused networkpolicies Signed-off-by: Thuan Vo <[email protected]> * build: bump chart versions * chore: fix remaining lint issue * docs: update chart readme * chore: bump appVersion to 0.4.3 * chore: address reviews on naming & typos * chore: plural name for all command * chore: revert import fix to metav1 * chore: use singular name for doc * feat: show unused reason --------- Signed-off-by: Thuan Vo <[email protected]>
- Loading branch information
Showing
11 changed files
with
317 additions
and
3 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| package kor | ||
|
|
||
| import ( | ||
| "fmt" | ||
|
|
||
| "github.com/spf13/cobra" | ||
|
|
||
| "github.com/yonahd/kor/pkg/kor" | ||
| "github.com/yonahd/kor/pkg/utils" | ||
| ) | ||
|
|
||
| var netpolCmd = &cobra.Command{ | ||
| Use: "networkpolicy", | ||
| Aliases: []string{"netpol", "networkpolicies"}, | ||
| Short: "Gets unused networkpolicies", | ||
| Args: cobra.ExactArgs(0), | ||
| Run: func(cmd *cobra.Command, args []string) { | ||
| clientset := kor.GetKubeClient(kubeconfig) | ||
| if response, err := kor.GetUnusedNetworkPolicies(filterOptions, clientset, outputFormat, opts); err != nil { | ||
| fmt.Println(err) | ||
| } else { | ||
| utils.PrintLogo(outputFormat) | ||
| fmt.Println(response) | ||
| } | ||
| }, | ||
| } | ||
|
|
||
| func init() { | ||
| rootCmd.AddCommand(netpolCmd) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,100 @@ | ||
| package kor | ||
|
|
||
| import ( | ||
| "bytes" | ||
| "context" | ||
| "encoding/json" | ||
| "fmt" | ||
| "os" | ||
|
|
||
| metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
| "k8s.io/client-go/kubernetes" | ||
|
|
||
| "github.com/yonahd/kor/pkg/filters" | ||
| ) | ||
|
|
||
| func processNamespaceNetworkPolicies(clientset kubernetes.Interface, namespace string, filterOpts *filters.Options) ([]ResourceInfo, error) { | ||
| netpolList, err := clientset.NetworkingV1().NetworkPolicies(namespace).List(context.TODO(), metav1.ListOptions{LabelSelector: filterOpts.IncludeLabels}) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| var unusedNetpols []ResourceInfo | ||
|
|
||
| for _, netpol := range netpolList.Items { | ||
| if pass, _ := filter.SetObject(&netpol).Run(filterOpts); pass { | ||
| continue | ||
| } | ||
|
|
||
| if netpol.Labels["kor/used"] == "false" { | ||
| reason := "Marked with unused label" | ||
| unusedNetpols = append(unusedNetpols, ResourceInfo{Name: netpol.Name, Reason: reason}) | ||
| continue | ||
| } | ||
|
|
||
| // retrieve pods selected by the NetworkPolicy | ||
| labelSelector, err := metav1.LabelSelectorAsSelector(&netpol.Spec.PodSelector) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| podList, err := clientset.CoreV1().Pods(namespace).List(context.TODO(), metav1.ListOptions{ | ||
| LabelSelector: labelSelector.String(), | ||
| }) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| if len(podList.Items) == 0 { | ||
| reason := "NetworkPolicy selects no pods" | ||
| unusedNetpols = append(unusedNetpols, ResourceInfo{Name: netpol.Name, Reason: reason}) | ||
| } | ||
| } | ||
|
|
||
| return unusedNetpols, nil | ||
| } | ||
|
|
||
| func GetUnusedNetworkPolicies(filterOpts *filters.Options, clientset kubernetes.Interface, outputFormat string, opts Opts) (string, error) { | ||
| resources := make(map[string]map[string][]ResourceInfo) | ||
|
|
||
| for _, namespace := range filterOpts.Namespaces(clientset) { | ||
| diff, err := processNamespaceNetworkPolicies(clientset, namespace, filterOpts) | ||
| if err != nil { | ||
| fmt.Fprintf(os.Stderr, "Failed to process namespace %s: %v\n", namespace, err) | ||
| continue | ||
| } | ||
|
|
||
| switch opts.GroupBy { | ||
| case "namespace": | ||
| resources[namespace] = make(map[string][]ResourceInfo) | ||
| resources[namespace]["NetworkPolicy"] = diff | ||
| case "resource": | ||
| appendResources(resources, "NetworkPolicy", namespace, diff) | ||
| } | ||
|
|
||
| if opts.DeleteFlag { | ||
| if diff, err := DeleteResource2(diff, clientset, namespace, "NetworkPolicy", opts.NoInteractive); err != nil { | ||
| fmt.Fprintf(os.Stderr, "Failed to delete NetworkPolicy %s in namespace %s: %v\n", diff, namespace, err) | ||
| } | ||
| } | ||
| } | ||
|
|
||
| var outputBuffer bytes.Buffer | ||
| var jsonResponse []byte | ||
|
|
||
| switch outputFormat { | ||
| case "table": | ||
| outputBuffer = FormatOutput(resources, opts) | ||
| case "json", "yaml": | ||
| var err error | ||
| if jsonResponse, err = json.MarshalIndent(resources, "", " "); err != nil { | ||
| return "", err | ||
| } | ||
| } | ||
|
|
||
| unusedNetworkPolicies, err := unusedResourceFormatter(outputFormat, outputBuffer, opts, jsonResponse) | ||
| if err != nil { | ||
| fmt.Printf("err: %v\n", err) | ||
| } | ||
|
|
||
| return unusedNetworkPolicies, nil | ||
| } |
Oops, something went wrong.