#!/usr/bin/env python3
"""Agent for auditing and generating Calico Kubernetes network policies."""

import json
import argparse
import subprocess
from datetime import datetime


def kubectl_get(resource, namespace=None, label_selector=None):
    """Get Kubernetes resources via kubectl."""
    cmd = ["kubectl", "get", resource, "-o", "json"]
    if namespace:
        cmd.extend(["-n", namespace])
    else:
        cmd.append("--all-namespaces")
    if label_selector:
        cmd.extend(["-l", label_selector])
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=60)
    if result.returncode != 0:
        return {"error": result.stderr.strip()}
    return json.loads(result.stdout) if result.stdout.strip() else {}


def list_network_policies():
    """List all NetworkPolicy and Calico GlobalNetworkPolicy resources."""
    k8s_np = kubectl_get("networkpolicy")
    calico_gnp = kubectl_get("globalnetworkpolicy")
    return {
        "k8s_network_policies": k8s_np.get("items", []) if isinstance(k8s_np, dict) else [],
        "calico_global_policies": calico_gnp.get("items", []) if isinstance(calico_gnp, dict) else [],
    }


def audit_network_policies(policies_path):
    """Audit network policies for security gaps."""
    with open(policies_path) as f:
        data = json.load(f)
    policies = data if isinstance(data, list) else data.get("items", data.get("policies", []))
    findings = []
    namespaces_covered = set()

    for policy in policies:
        metadata = policy.get("metadata", {})
        spec = policy.get("spec", {})
        ns = metadata.get("namespace", "default")
        namespaces_covered.add(ns)

        policy_types = spec.get("policyTypes", [])
        if "Ingress" not in policy_types and "Egress" not in policy_types:
            findings.append({
                "policy": metadata.get("name", ""),
                "namespace": ns,
                "issue": "No policyTypes defined (defaults to ingress-only)",
                "severity": "MEDIUM",
            })

        if "Egress" not in policy_types:
            findings.append({
                "policy": metadata.get("name", ""),
                "namespace": ns,
                "issue": "No egress policy - all outbound traffic allowed",
                "severity": "HIGH",
            })

        ingress_rules = spec.get("ingress", [])
        for rule in ingress_rules:
            if not rule.get("from"):
                findings.append({
                    "policy": metadata.get("name", ""),
                    "issue": "Ingress rule allows from all sources",
                    "severity": "HIGH",
                })

        egress_rules = spec.get("egress", [])
        for rule in egress_rules:
            if not rule.get("to"):
                findings.append({
                    "policy": metadata.get("name", ""),
                    "issue": "Egress rule allows to all destinations",
                    "severity": "MEDIUM",
                })

    return {"findings": findings, "namespaces_covered": list(namespaces_covered),
            "total_policies": len(policies)}


def generate_default_deny(namespace):
    """Generate a default deny-all NetworkPolicy for a namespace."""
    return {
        "apiVersion": "networking.k8s.io/v1",
        "kind": "NetworkPolicy",
        "metadata": {"name": "default-deny-all", "namespace": namespace},
        "spec": {
            "podSelector": {},
            "policyTypes": ["Ingress", "Egress"],
        },
    }


def generate_allow_dns_egress(namespace):
    """Generate a policy allowing DNS egress to kube-dns."""
    return {
        "apiVersion": "networking.k8s.io/v1",
        "kind": "NetworkPolicy",
        "metadata": {"name": "allow-dns-egress", "namespace": namespace},
        "spec": {
            "podSelector": {},
            "policyTypes": ["Egress"],
            "egress": [{
                "to": [{"namespaceSelector": {"matchLabels": {
                    "kubernetes.io/metadata.name": "kube-system"}}}],
                "ports": [{"protocol": "UDP", "port": 53},
                           {"protocol": "TCP", "port": 53}],
            }],
        },
    }


def generate_app_policy(namespace, app_label, allowed_ingress_labels=None,
                         allowed_egress_ports=None):
    """Generate a Calico-style network policy for an application."""
    policy = {
        "apiVersion": "networking.k8s.io/v1",
        "kind": "NetworkPolicy",
        "metadata": {"name": f"allow-{app_label}", "namespace": namespace},
        "spec": {
            "podSelector": {"matchLabels": {"app": app_label}},
            "policyTypes": ["Ingress", "Egress"],
            "ingress": [],
            "egress": [],
        },
    }
    if allowed_ingress_labels:
        for label in allowed_ingress_labels:
            policy["spec"]["ingress"].append({
                "from": [{"podSelector": {"matchLabels": {"app": label}}}],
            })
    if allowed_egress_ports:
        for port_info in allowed_egress_ports:
            policy["spec"]["egress"].append({
                "ports": [{"protocol": port_info.get("protocol", "TCP"),
                           "port": port_info["port"]}],
            })
    return policy


def check_unprotected_namespaces():
    """Find namespaces without any network policies."""
    namespaces = kubectl_get("namespaces")
    policies = kubectl_get("networkpolicy")
    if isinstance(namespaces, dict) and "error" not in namespaces:
        all_ns = {item["metadata"]["name"] for item in namespaces.get("items", [])}
    else:
        return {"error": "Cannot list namespaces"}

    protected_ns = set()
    if isinstance(policies, dict) and "error" not in policies:
        for item in policies.get("items", []):
            protected_ns.add(item.get("metadata", {}).get("namespace", "default"))

    system_ns = {"kube-system", "kube-public", "kube-node-lease"}
    unprotected = all_ns - protected_ns - system_ns
    return {
        "total_namespaces": len(all_ns),
        "protected": len(protected_ns),
        "unprotected": list(unprotected),
        "severity": "HIGH" if unprotected else "INFO",
    }


def main():
    parser = argparse.ArgumentParser(description="Calico Network Policy Agent")
    parser.add_argument("--audit", help="Network policies JSON to audit")
    parser.add_argument("--namespace", help="Namespace for policy generation")
    parser.add_argument("--app", help="App label for policy generation")
    parser.add_argument("--action", choices=["audit", "generate", "check", "full"],
                        default="full")
    parser.add_argument("--output", default="calico_netpol_report.json")
    args = parser.parse_args()

    report = {"generated_at": datetime.utcnow().isoformat(), "results": {}}

    if args.action in ("audit", "full") and args.audit:
        result = audit_network_policies(args.audit)
        report["results"]["audit"] = result
        print(f"[+] Audit: {len(result['findings'])} findings across {result['total_policies']} policies")

    if args.action in ("generate", "full") and args.namespace:
        policies = [
            generate_default_deny(args.namespace),
            generate_allow_dns_egress(args.namespace),
        ]
        if args.app:
            policies.append(generate_app_policy(args.namespace, args.app))
        report["results"]["generated"] = policies
        print(f"[+] Generated {len(policies)} policies for {args.namespace}")

    if args.action in ("check", "full"):
        result = check_unprotected_namespaces()
        report["results"]["unprotected"] = result
        print(f"[+] Unprotected namespaces: {result.get('unprotected', [])}")

    with open(args.output, "w") as f:
        json.dump(report, f, indent=2, default=str)
    print(f"[+] Report saved to {args.output}")


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
Calico Network Policy Manager - Generate, validate, and audit Kubernetes
network policies using Calico for zero-trust pod communication.
"""

import json
import subprocess
import sys
import argparse
import yaml
from typing import Optional


def run_kubectl(args: list, namespace: Optional[str] = None) -> str:
    """Execute kubectl command and return output."""
    cmd = ["kubectl"]
    if namespace:
        cmd.extend(["-n", namespace])
    cmd.extend(args)
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        print(f"kubectl error: {result.stderr}", file=sys.stderr)
    return result.stdout


def get_namespaces() -> list:
    """Get all non-system namespaces."""
    output = run_kubectl(["get", "namespaces", "-o", "json"])
    ns_data = json.loads(output)
    system_ns = {"kube-system", "kube-public", "kube-node-lease", "calico-system", "tigera-operator"}
    return [
        ns["metadata"]["name"]
        for ns in ns_data["items"]
        if ns["metadata"]["name"] not in system_ns
    ]


def get_network_policies(namespace: str) -> list:
    """Get all network policies in a namespace."""
    output = run_kubectl(["get", "networkpolicy", "-o", "json"], namespace=namespace)
    if not output.strip():
        return []
    data = json.loads(output)
    return data.get("items", [])


def check_default_deny(namespace: str) -> dict:
    """Check if default deny policies exist for a namespace."""
    policies = get_network_policies(namespace)
    has_ingress_deny = False
    has_egress_deny = False

    for pol in policies:
        spec = pol.get("spec", {})
        selector = spec.get("podSelector", {})
        policy_types = spec.get("policyTypes", [])

        if selector == {} or selector.get("matchLabels") is None:
            if "Ingress" in policy_types and not spec.get("ingress"):
                has_ingress_deny = True
            if "Egress" in policy_types and not spec.get("egress"):
                has_egress_deny = True

    return {
        "namespace": namespace,
        "default_deny_ingress": has_ingress_deny,
        "default_deny_egress": has_egress_deny,
        "policy_count": len(policies),
    }


def audit_all_namespaces() -> list:
    """Audit all namespaces for network policy coverage."""
    namespaces = get_namespaces()
    results = []
    for ns in namespaces:
        result = check_default_deny(ns)
        results.append(result)
    return results


def generate_default_deny(namespace: str) -> str:
    """Generate default deny ingress and egress policies for a namespace."""
    policies = [
        {
            "apiVersion": "networking.k8s.io/v1",
            "kind": "NetworkPolicy",
            "metadata": {
                "name": "default-deny-ingress",
                "namespace": namespace,
            },
            "spec": {
                "podSelector": {},
                "policyTypes": ["Ingress"],
            },
        },
        {
            "apiVersion": "networking.k8s.io/v1",
            "kind": "NetworkPolicy",
            "metadata": {
                "name": "default-deny-egress",
                "namespace": namespace,
            },
            "spec": {
                "podSelector": {},
                "policyTypes": ["Egress"],
            },
        },
        {
            "apiVersion": "networking.k8s.io/v1",
            "kind": "NetworkPolicy",
            "metadata": {
                "name": "allow-dns-egress",
                "namespace": namespace,
            },
            "spec": {
                "podSelector": {},
                "policyTypes": ["Egress"],
                "egress": [
                    {
                        "ports": [
                            {"protocol": "UDP", "port": 53},
                            {"protocol": "TCP", "port": 53},
                        ]
                    }
                ],
            },
        },
    ]

    return yaml.dump_all(policies, default_flow_style=False)


def generate_allow_policy(
    namespace: str,
    name: str,
    target_labels: dict,
    source_labels: dict,
    port: int,
    protocol: str = "TCP",
) -> str:
    """Generate an allow ingress policy."""
    policy = {
        "apiVersion": "networking.k8s.io/v1",
        "kind": "NetworkPolicy",
        "metadata": {
            "name": name,
            "namespace": namespace,
        },
        "spec": {
            "podSelector": {"matchLabels": target_labels},
            "policyTypes": ["Ingress"],
            "ingress": [
                {
                    "from": [{"podSelector": {"matchLabels": source_labels}}],
                    "ports": [{"protocol": protocol, "port": port}],
                }
            ],
        },
    }
    return yaml.dump(policy, default_flow_style=False)


def print_audit_report(results: list):
    """Print formatted audit report."""
    print("\n=== Kubernetes Network Policy Audit Report ===\n")
    print(f"{'Namespace':<30} {'Deny Ingress':<15} {'Deny Egress':<15} {'Policies':<10} {'Status'}")
    print("-" * 85)

    compliant = 0
    total = len(results)

    for r in results:
        ingress = "YES" if r["default_deny_ingress"] else "NO"
        egress = "YES" if r["default_deny_egress"] else "NO"
        status = "COMPLIANT" if r["default_deny_ingress"] and r["default_deny_egress"] else "NON-COMPLIANT"
        if status == "COMPLIANT":
            compliant += 1
        print(f"{r['namespace']:<30} {ingress:<15} {egress:<15} {r['policy_count']:<10} {status}")

    print(f"\n{compliant}/{total} namespaces compliant with default-deny policy")


def main():
    parser = argparse.ArgumentParser(description="Calico Network Policy Manager")
    subparsers = parser.add_subparsers(dest="command")

    # Audit command
    subparsers.add_parser("audit", help="Audit all namespaces for network policy coverage")

    # Generate deny command
    gen_deny = subparsers.add_parser("generate-deny", help="Generate default deny policies")
    gen_deny.add_argument("--namespace", "-n", required=True, help="Target namespace")
    gen_deny.add_argument("--apply", action="store_true", help="Apply policies directly")

    # Generate allow command
    gen_allow = subparsers.add_parser("generate-allow", help="Generate allow policy")
    gen_allow.add_argument("--namespace", "-n", required=True)
    gen_allow.add_argument("--name", required=True, help="Policy name")
    gen_allow.add_argument("--target-app", required=True, help="Target pod app label")
    gen_allow.add_argument("--source-app", required=True, help="Source pod app label")
    gen_allow.add_argument("--port", type=int, required=True, help="Allowed port")
    gen_allow.add_argument("--protocol", default="TCP", choices=["TCP", "UDP"])

    args = parser.parse_args()

    if args.command == "audit":
        results = audit_all_namespaces()
        print_audit_report(results)

    elif args.command == "generate-deny":
        policy_yaml = generate_default_deny(args.namespace)
        if args.apply:
            proc = subprocess.run(
                ["kubectl", "apply", "-f", "-"],
                input=policy_yaml,
                capture_output=True,
                text=True,
            )
            print(proc.stdout)
            if proc.stderr:
                print(proc.stderr, file=sys.stderr)
        else:
            print(policy_yaml)

    elif args.command == "generate-allow":
        policy_yaml = generate_allow_policy(
            namespace=args.namespace,
            name=args.name,
            target_labels={"app": args.target_app},
            source_labels={"app": args.source_app},
            port=args.port,
            protocol=args.protocol,
        )
        print(policy_yaml)

    else:
        parser.print_help()


if __name__ == "__main__":
    main()