#!/usr/bin/env python3
"""Agent for performing Kubernetes CIS benchmark assessment with kube-bench."""

import json
import argparse
import subprocess
from datetime import datetime


def run_kube_bench(target="node", benchmark=None):
    """Execute kube-bench CIS benchmark scan."""
    cmd = ["kube-bench", "run", "--json"]
    if target in ("master", "controlplane"):
        cmd += ["--targets", "master"]
    elif target == "node":
        cmd += ["--targets", "node"]
    elif target == "etcd":
        cmd += ["--targets", "etcd"]
    elif target == "policies":
        cmd += ["--targets", "policies"]
    if benchmark:
        cmd += ["--benchmark", benchmark]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
        data = json.loads(result.stdout)
        tests = data.get("Tests", data.get("tests", []))
        summary = {"pass": 0, "fail": 0, "warn": 0, "info": 0}
        failures = []
        for section in tests:
            for test in section.get("results", section.get("Results", [])):
                status = test.get("status", "").lower()
                summary[status] = summary.get(status, 0) + 1
                if status == "fail":
                    failures.append({
                        "id": test.get("test_number", test.get("TestNumber", "")),
                        "desc": test.get("test_desc", test.get("TestDesc", ""))[:200],
                        "remediation": test.get("remediation", test.get("Remediation", ""))[:300],
                        "scored": test.get("scored", test.get("IsScored", True)),
                    })
        return {
            "target": target, "timestamp": datetime.utcnow().isoformat(),
            "summary": summary, "total_checks": sum(summary.values()),
            "compliance_pct": round(summary["pass"] / max(sum(summary.values()), 1) * 100, 1),
            "failures": failures,
        }
    except FileNotFoundError:
        return {"error": "kube-bench not found — install from github.com/aquasecurity/kube-bench"}
    except json.JSONDecodeError:
        return {"error": "Failed to parse kube-bench output", "raw": result.stdout[:500]}
    except Exception as e:
        return {"error": str(e)}


def check_pod_security(namespace="default"):
    """Check pod security settings via kubectl."""
    cmd = ["kubectl", "get", "pods", "-n", namespace, "-o", "json"]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        data = json.loads(result.stdout)
        pods = data.get("items", [])
        findings = []
        for pod in pods:
            name = pod.get("metadata", {}).get("name", "")
            for container in pod.get("spec", {}).get("containers", []):
                sc = container.get("securityContext", {})
                issues = []
                if sc.get("privileged"):
                    issues.append("PRIVILEGED_CONTAINER")
                if sc.get("runAsUser") == 0 or not sc.get("runAsNonRoot"):
                    issues.append("RUNS_AS_ROOT")
                if not sc.get("readOnlyRootFilesystem"):
                    issues.append("WRITABLE_ROOT_FS")
                caps = sc.get("capabilities", {})
                if caps.get("add") and any(c in caps["add"] for c in ["SYS_ADMIN", "NET_ADMIN", "ALL"]):
                    issues.append("DANGEROUS_CAPABILITIES")
                if not sc.get("allowPrivilegeEscalation") is False:
                    issues.append("PRIVILEGE_ESCALATION_ALLOWED")
                if issues:
                    findings.append({"pod": name, "container": container.get("name"), "issues": issues})
        return {
            "namespace": namespace, "total_pods": len(pods),
            "pods_with_issues": len(findings), "findings": findings,
        }
    except FileNotFoundError:
        return {"error": "kubectl not found"}
    except Exception as e:
        return {"error": str(e)}


def check_rbac_config():
    """Audit RBAC configuration for overly permissive roles."""
    findings = []
    for resource in ["clusterroles", "clusterrolebindings"]:
        cmd = ["kubectl", "get", resource, "-o", "json"]
        try:
            result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
            data = json.loads(result.stdout)
            for item in data.get("items", []):
                name = item.get("metadata", {}).get("name", "")
                if resource == "clusterroles":
                    for rule in item.get("rules", []):
                        verbs = rule.get("verbs", [])
                        resources = rule.get("resources", [])
                        if "*" in verbs and "*" in resources:
                            findings.append({"type": "clusterrole", "name": name, "issue": "WILDCARD_ALL_PERMISSIONS"})
                        elif "create" in verbs and "pods" in resources:
                            findings.append({"type": "clusterrole", "name": name, "issue": "CAN_CREATE_PODS"})
                elif resource == "clusterrolebindings":
                    subjects = item.get("subjects", [])
                    role_ref = item.get("roleRef", {}).get("name", "")
                    if role_ref == "cluster-admin":
                        for subj in subjects:
                            findings.append({
                                "type": "clusterrolebinding", "name": name,
                                "issue": f"CLUSTER_ADMIN_BOUND_TO_{subj.get('kind', '')}:{subj.get('name', '')}",
                            })
        except Exception as e:
            findings.append({"type": resource, "error": str(e)})
    return {"total_findings": len(findings), "findings": findings}


def check_network_policies(namespace="default"):
    """Verify network policies exist and cover pods."""
    cmd = ["kubectl", "get", "networkpolicies", "-n", namespace, "-o", "json"]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        data = json.loads(result.stdout)
        policies = data.get("items", [])
        if not policies:
            return {"namespace": namespace, "finding": "NO_NETWORK_POLICIES", "severity": "HIGH",
                    "recommendation": "Implement default-deny NetworkPolicy"}
        return {
            "namespace": namespace, "policy_count": len(policies),
            "policies": [{"name": p["metadata"]["name"],
                          "pod_selector": p.get("spec", {}).get("podSelector", {}),
                          "ingress_rules": len(p.get("spec", {}).get("ingress", [])),
                          "egress_rules": len(p.get("spec", {}).get("egress", []))}
                         for p in policies],
        }
    except Exception as e:
        return {"error": str(e)}


def main():
    parser = argparse.ArgumentParser(description="Kubernetes CIS Benchmark Agent (kube-bench)")
    sub = parser.add_subparsers(dest="command")
    b = sub.add_parser("bench", help="Run kube-bench CIS scan")
    b.add_argument("--target", default="node", choices=["master", "controlplane", "node", "etcd", "policies"])
    b.add_argument("--benchmark", help="CIS benchmark version")
    p = sub.add_parser("pods", help="Check pod security settings")
    p.add_argument("--namespace", default="default")
    sub.add_parser("rbac", help="Audit RBAC configuration")
    n = sub.add_parser("netpol", help="Check network policies")
    n.add_argument("--namespace", default="default")
    args = parser.parse_args()
    if args.command == "bench":
        result = run_kube_bench(args.target, args.benchmark)
    elif args.command == "pods":
        result = check_pod_security(args.namespace)
    elif args.command == "rbac":
        result = check_rbac_config()
    elif args.command == "netpol":
        result = check_network_policies(args.namespace)
    else:
        parser.print_help()
        return
    print(json.dumps(result, indent=2, default=str))


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
kube-bench CIS Benchmark Reporter - Parse kube-bench JSON output
and generate compliance reports with trend tracking.
"""

import json
import sys
import argparse
from pathlib import Path
from datetime import datetime
from collections import Counter


def parse_kube_bench_json(filepath: str) -> dict:
    """Parse kube-bench JSON output file."""
    path = Path(filepath)
    if not path.exists():
        print(f"File not found: {filepath}", file=sys.stderr)
        sys.exit(1)
    return json.loads(path.read_text())


def extract_checks(data: dict) -> list:
    """Extract all individual checks from kube-bench results."""
    checks = []
    for control in data.get("Controls", []):
        section = control.get("id", "")
        section_text = control.get("text", "")
        for group in control.get("tests", []):
            group_id = group.get("section", "")
            for result in group.get("results", []):
                checks.append({
                    "section": section,
                    "section_text": section_text,
                    "group": group_id,
                    "id": result.get("test_number", ""),
                    "description": result.get("test_desc", ""),
                    "status": result.get("status", ""),
                    "scored": result.get("scored", False),
                    "remediation": result.get("remediation", ""),
                    "reason": result.get("reason", ""),
                })
    return checks


def generate_summary(checks: list) -> dict:
    """Generate summary statistics."""
    status_counts = Counter(c["status"] for c in checks)
    section_counts = {}
    for c in checks:
        sec = c["section"]
        if sec not in section_counts:
            section_counts[sec] = {"section_text": c["section_text"], "PASS": 0, "FAIL": 0, "WARN": 0, "INFO": 0}
        status = c["status"]
        if status in section_counts[sec]:
            section_counts[sec][status] += 1

    total = len(checks)
    passed = status_counts.get("PASS", 0)
    score = (passed / total * 100) if total > 0 else 0

    return {
        "total_checks": total,
        "pass": status_counts.get("PASS", 0),
        "fail": status_counts.get("FAIL", 0),
        "warn": status_counts.get("WARN", 0),
        "info": status_counts.get("INFO", 0),
        "score_percent": round(score, 1),
        "by_section": section_counts,
    }


def generate_report(data: dict, output_path: str = None) -> str:
    """Generate markdown CIS benchmark report."""
    checks = extract_checks(data)
    summary = generate_summary(checks)
    timestamp = datetime.utcnow().strftime("%Y-%m-%d %H:%M:%S UTC")

    report = f"""# CIS Kubernetes Benchmark Report

**Date:** {timestamp}
**Total Checks:** {summary['total_checks']}
**Score:** {summary['score_percent']}%

## Summary

| Status | Count |
|--------|-------|
| PASS | {summary['pass']} |
| FAIL | {summary['fail']} |
| WARN | {summary['warn']} |
| INFO | {summary['info']} |

## Results by Section

| Section | Description | Pass | Fail | Warn |
|---------|-------------|------|------|------|
"""
    for sec_id, sec in sorted(summary["by_section"].items()):
        report += f"| {sec_id} | {sec['section_text']} | {sec['PASS']} | {sec['FAIL']} | {sec['WARN']} |\n"

    failed = [c for c in checks if c["status"] == "FAIL"]
    if failed:
        report += "\n## Failed Checks (Requires Remediation)\n\n"
        for c in failed:
            report += f"### {c['id']} - {c['description']}\n"
            report += f"- **Status:** FAIL\n"
            report += f"- **Scored:** {c['scored']}\n"
            if c['remediation']:
                report += f"- **Remediation:** {c['remediation']}\n"
            report += "\n"

    if output_path:
        Path(output_path).write_text(report)
        print(f"Report written to {output_path}")

    return report


def compare_scans(current_file: str, previous_file: str):
    """Compare two kube-bench scan results."""
    current = extract_checks(parse_kube_bench_json(current_file))
    previous = extract_checks(parse_kube_bench_json(previous_file))

    curr_summary = generate_summary(current)
    prev_summary = generate_summary(previous)

    print("\n=== CIS Benchmark Comparison ===\n")
    print(f"{'Metric':<20} {'Previous':<12} {'Current':<12} {'Change'}")
    print("-" * 55)

    for metric in ["pass", "fail", "warn"]:
        prev_val = prev_summary[metric]
        curr_val = curr_summary[metric]
        change = curr_val - prev_val
        sign = "+" if change > 0 else ""
        print(f"{metric.upper():<20} {prev_val:<12} {curr_val:<12} {sign}{change}")

    print(f"{'SCORE':<20} {prev_summary['score_percent']}%{'':<7} {curr_summary['score_percent']}%")


def main():
    parser = argparse.ArgumentParser(description="kube-bench CIS Benchmark Reporter")
    subparsers = parser.add_subparsers(dest="command")

    report_cmd = subparsers.add_parser("report", help="Generate report from kube-bench JSON")
    report_cmd.add_argument("input", help="kube-bench JSON output file")
    report_cmd.add_argument("--output", "-o", help="Output markdown report path")

    compare_cmd = subparsers.add_parser("compare", help="Compare two scan results")
    compare_cmd.add_argument("current", help="Current scan JSON")
    compare_cmd.add_argument("previous", help="Previous scan JSON")

    summary_cmd = subparsers.add_parser("summary", help="Print summary from JSON")
    summary_cmd.add_argument("input", help="kube-bench JSON output file")

    args = parser.parse_args()

    if args.command == "report":
        data = parse_kube_bench_json(args.input)
        report = generate_report(data, args.output)
        if not args.output:
            print(report)

    elif args.command == "compare":
        compare_scans(args.current, args.previous)

    elif args.command == "summary":
        data = parse_kube_bench_json(args.input)
        checks = extract_checks(data)
        summary = generate_summary(checks)
        print(json.dumps(summary, indent=2))

    else:
        parser.print_help()


if __name__ == "__main__":
    main()