Merge pull request #733 from controlplaneio/scan-specific-rules

feat: Add support for scanning specific rules

Author: gabriellavengeo

README.md

@@ -155,6 +155,16 @@ kubesec scan ./deployment.yaml --format table
 kubesec scan ./deployment.yaml --format template --template report-template.tmpl
 ```
 
+#### Scan specific rules
+
+```bash
+# One rule
+kubesec scan --rules CapSysAdmin kubesec-test.yaml
+
+# Multiple rules
+kubesec scan --rules RunAsNonRoot,SeccompAny,ApparmorAny kubesec-test.yaml
+```
+
 ##### Example JSON Output
 
 ```json
@@ -294,6 +304,9 @@ curl -sSX POST --data-binary @"deployment.yaml" https://v2.kubesec.io/scan
 
 # Parse the API output using jq to return a non-zero exit code if the score is <= 10
 curl -sSX POST --data-binary @"deployment.yaml" https://v2.kubesec.io/scan | jq --exit-status '.score > 10'
+
+# Use the "rule" query parameter to scan only specific rules (multiple supported)
+curl -sSX POST --data-binary @test/asset/score-0-cap-sys-admin.yml "http://localhost:8080/scan?rule=SeccompAny&rule=ApparmorAny"
 ```
 
 You may also define a Bash function, e.g.:

cmd/print-rules.go

@@ -27,7 +27,10 @@ func init() {
 		rootCmd.SilenceErrors = true
 		rootCmd.SilenceUsage = true
 
-		ruleSet := ruler.NewRuleset(logger)
+		ruleSet, err := ruler.NewRuleset(logger)
+		if err != nil {
+			return err
+		}
 
 		// Sort by rule ID
 		sort.Slice(ruleSet.Rules, func(i, j int) bool {

cmd/scan.go

@@ -31,6 +31,7 @@ var (
 	schemaLocations = []string{}
 	outputLocation  string
 	exitCode        int
+	rulesIDs        []string
 )
 
 func init() {
@@ -40,6 +41,7 @@ func init() {
 	scanCmd.Flags().StringVar(&k8sVersion, "kubernetes-version", "", "Kubernetes version to validate manifets")
 	scanCmd.Flags().StringSliceVar(&schemaLocations, "schema-location", []string{}, "Override schema location search path, local or http (can be specified multiple times)")
 	scanCmd.Flags().StringVarP(&template, "template", "t", "", "Set output template, it will check for a file or read input as the template")
+	scanCmd.Flags().StringSliceVarP(&rulesIDs, "rules", "r", []string{}, "Comma-separated list of rule IDs to scan (empty scans all rules). Run 'kubesec print-rules' to see all rules")
 	scanCmd.Flags().StringVarP(&outputLocation, "output", "o", "", "Set output location")
 	scanCmd.Flags().IntVar(&exitCode, "exit-code", 2, "Set the exit-code to use on failure")
 	rootCmd.AddCommand(scanCmd)
@@ -126,7 +128,11 @@ var scanCmd = &cobra.Command{
 		schemaConfig.Locations = schemaLocations
 		schemaConfig.ValidatorOpts.KubernetesVersion = k8sVersion
 
-		reports, err := ruler.NewRuleset(logger).Run(file.fileName, file.fileBytes, schemaConfig)
+		ruleset, err := ruler.NewRuleset(logger, rulesIDs...)
+		if err != nil {
+			return err
+		}
+		reports, err := ruleset.Run(file.fileName, file.fileBytes, schemaConfig)
 		if err != nil {
 			return err
 		}