#!/usr/bin/env python3
"""Agent for auditing and managing GCP Binary Authorization policies."""

import json
import argparse
import subprocess
from datetime import datetime


def run_gcloud(args_list):
    """Run a gcloud command and return parsed JSON output."""
    cmd = ["gcloud"] + args_list + ["--format=json"]
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=60)
    if result.returncode != 0:
        return {"error": result.stderr.strip()}
    try:
        return json.loads(result.stdout) if result.stdout.strip() else {}
    except json.JSONDecodeError:
        return {"raw": result.stdout.strip()}


def get_binauthz_policy(project):
    """Retrieve the Binary Authorization policy for a project."""
    return run_gcloud(["container", "binauthz", "policy", "export",
                       "--project", project])


def list_attestors(project):
    """List all attestors in the project."""
    return run_gcloud(["container", "binauthz", "attestors", "list",
                       "--project", project])


def list_attestations(project, attestor):
    """List attestations for a given attestor."""
    return run_gcloud(["container", "binauthz", "attestations", "list",
                       "--attestor", attestor, "--attestor-project", project])


def verify_image_attested(project, attestor, image_url):
    """Check if a container image has a valid attestation."""
    result = run_gcloud(["container", "binauthz", "attestations", "list",
                         "--attestor", attestor, "--attestor-project", project,
                         "--artifact-url", image_url])
    if isinstance(result, list) and len(result) > 0:
        return {"image": image_url, "attested": True, "attestation_count": len(result)}
    return {"image": image_url, "attested": False, "attestation_count": 0}


def audit_policy(policy):
    """Audit a Binary Authorization policy for security issues."""
    findings = []
    if isinstance(policy, dict) and "error" in policy:
        return [{"issue": "Cannot retrieve policy", "severity": "CRITICAL",
                 "detail": policy["error"]}]

    default_rule = policy.get("defaultAdmissionRule", {})
    eval_mode = default_rule.get("evaluationMode", "")
    enforce_mode = default_rule.get("enforcementMode", "")

    if eval_mode == "ALWAYS_ALLOW":
        findings.append({"issue": "Default rule allows all images",
                         "severity": "CRITICAL",
                         "recommendation": "Set evaluationMode to REQUIRE_ATTESTATION"})

    if enforce_mode == "DRYRUN_AUDIT_LOG_ONLY":
        findings.append({"issue": "Default rule is dry-run only",
                         "severity": "HIGH",
                         "recommendation": "Set enforcementMode to ENFORCED_BLOCK_AND_AUDIT_LOG"})

    attestors = default_rule.get("requireAttestationsBy", [])
    if eval_mode == "REQUIRE_ATTESTATION" and not attestors:
        findings.append({"issue": "Attestation required but no attestors configured",
                         "severity": "CRITICAL"})

    global_eval = policy.get("globalPolicyEvaluationMode", "")
    if global_eval != "ENABLE":
        findings.append({"issue": "Global policy evaluation not enabled",
                         "severity": "MEDIUM",
                         "recommendation": "Set globalPolicyEvaluationMode to ENABLE"})

    whitelist = policy.get("admissionWhitelistPatterns", [])
    for pattern in whitelist:
        name = pattern.get("namePattern", "")
        if name.endswith("/**") or name.endswith("/*"):
            if not any(safe in name for safe in ["gcr.io/google", "k8s.gcr.io", "gke.gcr.io"]):
                findings.append({"issue": f"Broad whitelist pattern: {name}",
                                 "severity": "HIGH",
                                 "recommendation": "Restrict whitelist to specific images"})

    cluster_rules = policy.get("clusterAdmissionRules", {})
    for cluster, rule in cluster_rules.items():
        if rule.get("evaluationMode") == "ALWAYS_ALLOW":
            findings.append({"issue": f"Cluster {cluster} allows all images",
                             "severity": "HIGH"})

    if not findings:
        findings.append({"issue": "No issues found", "severity": "INFO"})

    return findings


def generate_policy(project, attestors, allowed_patterns=None):
    """Generate a Binary Authorization policy YAML."""
    whitelist = allowed_patterns or [
        "gcr.io/google_containers/*", "gcr.io/google-containers/*",
        "k8s.gcr.io/**", "gke.gcr.io/**", "gcr.io/stackdriver-agents/*",
    ]
    policy = {
        "admissionWhitelistPatterns": [{"namePattern": p} for p in whitelist],
        "defaultAdmissionRule": {
            "evaluationMode": "REQUIRE_ATTESTATION",
            "enforcementMode": "ENFORCED_BLOCK_AND_AUDIT_LOG",
            "requireAttestationsBy": [
                f"projects/{project}/attestors/{a}" for a in attestors
            ],
        },
        "globalPolicyEvaluationMode": "ENABLE",
    }
    return policy


def check_cv_status(project, cluster, zone):
    """Check continuous validation status on a GKE cluster."""
    result = run_gcloud(["container", "clusters", "describe", cluster,
                         "--zone", zone, "--project", project])
    if isinstance(result, dict):
        binauthz = result.get("binaryAuthorization", {})
        return {
            "cluster": cluster,
            "enabled": binauthz.get("enabled", False),
            "evaluation_mode": binauthz.get("evaluationMode", ""),
        }
    return {"cluster": cluster, "error": "Cannot retrieve cluster info"}


def main():
    parser = argparse.ArgumentParser(description="GCP Binary Authorization Agent")
    parser.add_argument("--project", required=True, help="GCP project ID")
    parser.add_argument("--action", choices=["audit", "list-attestors", "verify",
                                              "generate", "cv-status"],
                        default="audit")
    parser.add_argument("--attestor", help="Attestor name")
    parser.add_argument("--image", help="Container image URL for verification")
    parser.add_argument("--cluster", help="GKE cluster name")
    parser.add_argument("--zone", default="us-central1-a")
    parser.add_argument("--output", default="binauthz_report.json")
    args = parser.parse_args()

    report = {"generated_at": datetime.utcnow().isoformat(), "project": args.project,
              "results": {}}

    if args.action == "audit":
        policy = get_binauthz_policy(args.project)
        findings = audit_policy(policy)
        report["results"]["policy"] = policy
        report["results"]["findings"] = findings
        for f in findings:
            print(f"[{f['severity']}] {f['issue']}")

    elif args.action == "list-attestors":
        attestors = list_attestors(args.project)
        report["results"]["attestors"] = attestors
        print(f"[+] Found {len(attestors) if isinstance(attestors, list) else 0} attestors")

    elif args.action == "verify" and args.attestor and args.image:
        result = verify_image_attested(args.project, args.attestor, args.image)
        report["results"]["verification"] = result
        status = "ATTESTED" if result["attested"] else "NOT ATTESTED"
        print(f"[+] {args.image}: {status}")

    elif args.action == "generate":
        attestors = [args.attestor] if args.attestor else ["prod-build-attestor"]
        policy = generate_policy(args.project, attestors)
        report["results"]["generated_policy"] = policy
        print("[+] Policy generated")

    elif args.action == "cv-status" and args.cluster:
        status = check_cv_status(args.project, args.cluster, args.zone)
        report["results"]["cv_status"] = status
        print(f"[+] CV enabled: {status.get('enabled', False)}")

    with open(args.output, "w") as f:
        json.dump(report, f, indent=2, default=str)
    print(f"[+] Report saved to {args.output}")


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
GCP Binary Authorization Management Script

Automates attestor management, policy configuration, and attestation
creation for container image supply chain security.
"""

import json
import subprocess
import sys


def run_gcloud(args):
    """Execute gcloud command and return parsed output."""
    cmd = ["gcloud"] + args + ["--format=json"]
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        return None, result.stderr
    try:
        return json.loads(result.stdout) if result.stdout.strip() else {}, None
    except json.JSONDecodeError:
        return result.stdout, None


def check_binauthz_status(project_id):
    """Check Binary Authorization configuration status."""
    print(f"[*] Checking Binary Authorization status for project: {project_id}")

    policy, err = run_gcloud([
        "container", "binauthz", "policy", "export",
        f"--project={project_id}"
    ])

    if err:
        print(f"[!] Error fetching policy: {err}")
        return None

    print(f"[+] Current policy retrieved")
    return policy


def list_attestors(project_id):
    """List all configured attestors."""
    attestors, err = run_gcloud([
        "container", "binauthz", "attestors", "list",
        f"--project={project_id}"
    ])

    if err:
        print(f"[!] Error listing attestors: {err}")
        return []

    if isinstance(attestors, list):
        print(f"[+] Found {len(attestors)} attestors:")
        for a in attestors:
            print(f"  - {a.get('name', 'unknown')}")
    return attestors or []


def verify_attestation(project_id, image_url, attestor):
    """Verify that an image has a valid attestation."""
    print(f"[*] Verifying attestation for: {image_url}")

    attestations, err = run_gcloud([
        "container", "binauthz", "attestations", "list",
        f"--attestor={attestor}",
        f"--attestor-project={project_id}",
        f"--artifact-url={image_url}"
    ])

    if err:
        print(f"[!] Error: {err}")
        return False

    if isinstance(attestations, list) and len(attestations) > 0:
        print(f"[+] Image has {len(attestations)} attestation(s)")
        return True
    else:
        print(f"[!] No attestations found for image")
        return False


def create_attestation(project_id, image_url, attestor, key_info):
    """Create an attestation for a container image."""
    print(f"[*] Creating attestation for: {image_url}")

    _, err = run_gcloud([
        "container", "binauthz", "attestations", "sign-and-create",
        f"--artifact-url={image_url}",
        f"--attestor={attestor}",
        f"--attestor-project={project_id}",
        f"--keyversion-project={key_info['project']}",
        f"--keyversion-location={key_info['location']}",
        f"--keyversion-keyring={key_info['keyring']}",
        f"--keyversion-key={key_info['key']}",
        f"--keyversion={key_info['version']}"
    ])

    if err:
        print(f"[!] Error creating attestation: {err}")
        return False

    print(f"[+] Attestation created successfully")
    return True


def audit_policy_compliance(project_id):
    """Audit Binary Authorization policy for security compliance."""
    policy, err = run_gcloud([
        "container", "binauthz", "policy", "export",
        f"--project={project_id}"
    ])

    if not policy:
        print("[!] Could not retrieve policy")
        return

    findings = []

    if isinstance(policy, str):
        import yaml
        policy = yaml.safe_load(policy)

    default_rule = policy.get("defaultAdmissionRule", {})
    if default_rule.get("evaluationMode") == "ALWAYS_ALLOW":
        findings.append({
            "severity": "HIGH",
            "finding": "Default admission rule allows all images",
            "recommendation": "Set to REQUIRE_ATTESTATION or ALWAYS_DENY"
        })

    if default_rule.get("enforcementMode") == "DRYRUN_AUDIT_LOG_ONLY":
        findings.append({
            "severity": "MEDIUM",
            "finding": "Default rule is in dry-run mode (not enforcing)",
            "recommendation": "Switch to ENFORCED_BLOCK_AND_AUDIT_LOG"
        })

    if not policy.get("globalPolicyEvaluationMode") == "ENABLE":
        findings.append({
            "severity": "LOW",
            "finding": "Global policy evaluation not explicitly enabled",
            "recommendation": "Enable globalPolicyEvaluationMode"
        })

    whitelist = policy.get("admissionWhitelistPatterns", [])
    for pattern in whitelist:
        name = pattern.get("namePattern", "")
        if name == "*" or name == "**":
            findings.append({
                "severity": "CRITICAL",
                "finding": f"Wildcard whitelist pattern: {name}",
                "recommendation": "Remove overly broad whitelist patterns"
            })

    print(f"\n[*] Policy Compliance Audit Results:")
    if findings:
        for f in findings:
            print(f"  [{f['severity']}] {f['finding']}")
            print(f"    Recommendation: {f['recommendation']}")
    else:
        print("  [OK] No issues found")

    return findings


if __name__ == "__main__":
    import argparse
    parser = argparse.ArgumentParser(description="GCP Binary Authorization Management")
    parser.add_argument("--project", required=True, help="GCP Project ID")
    parser.add_argument("--status", action="store_true", help="Check policy status")
    parser.add_argument("--list-attestors", action="store_true", help="List attestors")
    parser.add_argument("--verify", type=str, help="Verify attestation for image URL")
    parser.add_argument("--attestor", type=str, help="Attestor name")
    parser.add_argument("--audit", action="store_true", help="Audit policy compliance")
    args = parser.parse_args()

    if args.status:
        check_binauthz_status(args.project)
    if args.list_attestors:
        list_attestors(args.project)
    if args.verify and args.attestor:
        verify_attestation(args.project, args.verify, args.attestor)
    if args.audit:
        audit_policy_compliance(args.project)