#!/usr/bin/env python3
"""Agent for securing Helm chart deployments.

Validates chart provenance, renders and scans templates for
security misconfigurations, checks security contexts, and
enforces Helm deployment security baselines.
"""

import json
import subprocess
import sys
import re
from pathlib import Path
from datetime import datetime

try:
    import yaml
except ImportError:
    yaml = None


class HelmSecurityAgent:
    """Audits Helm chart deployments for security issues."""

    def __init__(self, chart_path, output_dir="./helm_audit"):
        self.chart_path = Path(chart_path)
        self.output_dir = Path(output_dir)
        self.output_dir.mkdir(parents=True, exist_ok=True)
        self.findings = []

    def _run(self, cmd, timeout=60):
        try:
            result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
            return result.stdout, result.stderr, result.returncode
        except (FileNotFoundError, subprocess.TimeoutExpired) as e:
            return "", str(e), -1

    def lint_chart(self, values_file=None):
        """Run helm lint with strict mode."""
        cmd = ["helm", "lint", str(self.chart_path), "--strict"]
        if values_file:
            cmd.extend(["--values", values_file])
        stdout, stderr, rc = self._run(cmd)
        if rc != 0:
            self.findings.append({
                "severity": "medium",
                "type": "Lint Failure",
                "detail": stderr.strip() or stdout.strip(),
            })
        return {"returncode": rc, "output": stdout.strip(), "errors": stderr.strip()}

    def render_templates(self, values_file=None, release_name="audit"):
        """Render Helm templates without deploying."""
        cmd = ["helm", "template", release_name, str(self.chart_path)]
        if values_file:
            cmd.extend(["--values", values_file])
        stdout, stderr, rc = self._run(cmd)
        if rc == 0:
            rendered_path = self.output_dir / "rendered.yaml"
            rendered_path.write_text(stdout)
            return str(rendered_path)
        return None

    def check_security_contexts(self, rendered_path):
        """Check rendered manifests for security context issues."""
        issues = []
        content = Path(rendered_path).read_text()

        checks = [
            (r"privileged:\s*true", "high", "Privileged container detected"),
            (r"hostNetwork:\s*true", "high", "Host network access enabled"),
            (r"hostPID:\s*true", "high", "Host PID namespace shared"),
            (r"allowPrivilegeEscalation:\s*true", "medium", "Privilege escalation allowed"),
            (r"runAsUser:\s*0\b", "medium", "Running as root (UID 0)"),
        ]

        positive_checks = [
            (r"readOnlyRootFilesystem:\s*true", "readOnlyRootFilesystem"),
            (r"runAsNonRoot:\s*true", "runAsNonRoot"),
            (r"drop:\s*\n\s*-\s*ALL", "drop ALL capabilities"),
        ]

        for pattern, severity, msg in checks:
            if re.search(pattern, content):
                issues.append({"severity": severity, "issue": msg})
                self.findings.append({"severity": severity, "type": "Security Context", "detail": msg})

        for pattern, name in positive_checks:
            if not re.search(pattern, content):
                issues.append({"severity": "medium", "issue": f"Missing: {name}"})
                self.findings.append({"severity": "medium", "type": "Missing Hardening", "detail": f"Missing: {name}"})

        if "resources:" not in content:
            issues.append({"severity": "medium", "issue": "No resource limits defined"})
            self.findings.append({"severity": "medium", "type": "Missing Resources", "detail": "No CPU/memory limits"})

        return issues

    def verify_chart_signature(self, keyring=None):
        """Verify Helm chart provenance signature."""
        tgz = list(self.chart_path.parent.glob(f"{self.chart_path.name}-*.tgz"))
        if not tgz:
            return {"verified": False, "reason": "No packaged chart found"}
        cmd = ["helm", "verify", str(tgz[0])]
        if keyring:
            cmd.extend(["--keyring", keyring])
        stdout, stderr, rc = self._run(cmd)
        if rc != 0:
            self.findings.append({"severity": "medium", "type": "Unsigned Chart", "detail": "Chart signature not verified"})
        return {"verified": rc == 0, "output": stdout.strip() or stderr.strip()}

    def check_image_references(self, rendered_path):
        """Check if image references use digests or tags."""
        content = Path(rendered_path).read_text()
        issues = []
        for m in re.finditer(r'image:\s*["\']?([^"\'\s]+)["\']?', content):
            image = m.group(1)
            if ":latest" in image:
                issues.append({"image": image, "issue": "Uses :latest tag"})
                self.findings.append({"severity": "medium", "type": "Image Tag", "detail": f"latest tag: {image}"})
            elif "@sha256:" not in image and ":" not in image:
                issues.append({"image": image, "issue": "No tag or digest specified"})
        return issues

    def scan_with_kubesec(self, rendered_path):
        """Scan rendered templates with kubesec if available."""
        stdout, stderr, rc = self._run(["kubesec", "scan", rendered_path])
        if rc < 0:
            return {"available": False}
        try:
            return json.loads(stdout)
        except json.JSONDecodeError:
            return {"error": "Parse failed"}

    def generate_report(self, values_file=None):
        lint = self.lint_chart(values_file)
        rendered = self.render_templates(values_file)
        sec_ctx = []
        images = []
        if rendered:
            sec_ctx = self.check_security_contexts(rendered)
            images = self.check_image_references(rendered)

        report = {
            "report_date": datetime.utcnow().isoformat(),
            "chart": str(self.chart_path),
            "lint_result": lint,
            "security_context_issues": sec_ctx,
            "image_issues": images,
            "findings": self.findings,
            "total_findings": len(self.findings),
        }
        out = self.output_dir / "helm_security_report.json"
        with open(out, "w") as f:
            json.dump(report, f, indent=2)
        print(json.dumps(report, indent=2))
        return report


def main():
    if len(sys.argv) < 2:
        print("Usage: agent.py <chart_path> [--values values.yaml]")
        sys.exit(1)
    chart = sys.argv[1]
    values = None
    if "--values" in sys.argv:
        values = sys.argv[sys.argv.index("--values") + 1]
    agent = HelmSecurityAgent(chart)
    agent.generate_report(values)


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
Helm Chart Security Scanner - Render Helm templates and scan
for security misconfigurations in Kubernetes manifests.
"""

import json
import subprocess
import sys
import argparse
import re
from pathlib import Path


SECURITY_CHECKS = [
    {
        "id": "HELM-001",
        "name": "Container runs as root",
        "severity": "HIGH",
        "pattern": r"runAsNonRoot:\s*false|runAsUser:\s*0",
        "remediation": "Set securityContext.runAsNonRoot: true and runAsUser to non-zero",
    },
    {
        "id": "HELM-002",
        "name": "Privileged container",
        "severity": "CRITICAL",
        "pattern": r"privileged:\s*true",
        "remediation": "Set securityContext.privileged: false",
    },
    {
        "id": "HELM-003",
        "name": "Allow privilege escalation",
        "severity": "HIGH",
        "pattern": r"allowPrivilegeEscalation:\s*true",
        "remediation": "Set securityContext.allowPrivilegeEscalation: false",
    },
    {
        "id": "HELM-004",
        "name": "No resource limits",
        "severity": "MEDIUM",
        "pattern": r"resources:\s*\{\}|resources:\s*null",
        "remediation": "Set resources.limits.cpu and resources.limits.memory",
    },
    {
        "id": "HELM-005",
        "name": "Uses latest image tag",
        "severity": "MEDIUM",
        "pattern": r"image:.*:latest|image:\s*[^:]+\s*$",
        "remediation": "Use specific image tag or digest instead of :latest",
    },
    {
        "id": "HELM-006",
        "name": "HostPath volume mount",
        "severity": "HIGH",
        "pattern": r"hostPath:",
        "remediation": "Avoid hostPath volumes; use PersistentVolumeClaim instead",
    },
    {
        "id": "HELM-007",
        "name": "Host network enabled",
        "severity": "HIGH",
        "pattern": r"hostNetwork:\s*true",
        "remediation": "Set hostNetwork: false",
    },
    {
        "id": "HELM-008",
        "name": "Host PID namespace",
        "severity": "HIGH",
        "pattern": r"hostPID:\s*true",
        "remediation": "Set hostPID: false",
    },
    {
        "id": "HELM-009",
        "name": "Service account token auto-mounted",
        "severity": "MEDIUM",
        "pattern": r"automountServiceAccountToken:\s*true",
        "remediation": "Set automountServiceAccountToken: false unless needed",
    },
    {
        "id": "HELM-010",
        "name": "Writable root filesystem",
        "severity": "MEDIUM",
        "pattern": r"readOnlyRootFilesystem:\s*false",
        "remediation": "Set securityContext.readOnlyRootFilesystem: true",
    },
]


def render_chart(chart_path: str, values_file: str = None, release_name: str = "scan") -> str:
    """Render Helm chart templates."""
    cmd = ["helm", "template", release_name, chart_path]
    if values_file:
        cmd.extend(["-f", values_file])
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        print(f"Helm template error: {result.stderr}", file=sys.stderr)
        sys.exit(1)
    return result.stdout


def scan_rendered(content: str) -> list:
    """Scan rendered YAML for security issues."""
    findings = []
    lines = content.split("\n")
    for check in SECURITY_CHECKS:
        for i, line in enumerate(lines, 1):
            if re.search(check["pattern"], line):
                findings.append({
                    "id": check["id"],
                    "name": check["name"],
                    "severity": check["severity"],
                    "line": i,
                    "content": line.strip(),
                    "remediation": check["remediation"],
                })
    return findings


def lint_chart(chart_path: str) -> dict:
    """Run helm lint on chart."""
    result = subprocess.run(
        ["helm", "lint", chart_path, "--strict"],
        capture_output=True, text=True,
    )
    return {
        "passed": result.returncode == 0,
        "output": result.stdout + result.stderr,
    }


def generate_report(findings: list, chart_path: str) -> str:
    """Generate security scan report."""
    severity_counts = {"CRITICAL": 0, "HIGH": 0, "MEDIUM": 0, "LOW": 0}
    for f in findings:
        severity_counts[f["severity"]] = severity_counts.get(f["severity"], 0) + 1

    report = f"""# Helm Chart Security Scan Report

**Chart:** `{chart_path}`
**Findings:** {len(findings)}

## Summary

| Severity | Count |
|----------|-------|
| CRITICAL | {severity_counts['CRITICAL']} |
| HIGH | {severity_counts['HIGH']} |
| MEDIUM | {severity_counts['MEDIUM']} |
| LOW | {severity_counts['LOW']} |

## Findings

| ID | Severity | Finding | Line | Remediation |
|----|----------|---------|------|-------------|
"""
    for f in sorted(findings, key=lambda x: {"CRITICAL": 0, "HIGH": 1, "MEDIUM": 2, "LOW": 3}[x["severity"]]):
        report += f"| {f['id']} | {f['severity']} | {f['name']} | {f['line']} | {f['remediation']} |\n"

    return report


def main():
    parser = argparse.ArgumentParser(description="Helm Chart Security Scanner")
    parser.add_argument("chart", help="Path to Helm chart")
    parser.add_argument("--values", "-f", help="Values file path")
    parser.add_argument("--report", "-r", help="Output report file")
    parser.add_argument("--lint", action="store_true", help="Run helm lint")
    parser.add_argument("--fail-on", choices=["critical", "high", "medium"],
                       default="high", help="Fail threshold")

    args = parser.parse_args()

    if args.lint:
        lint_result = lint_chart(args.chart)
        print(lint_result["output"])
        if not lint_result["passed"]:
            print("Lint FAILED")
            sys.exit(1)

    rendered = render_chart(args.chart, args.values)
    findings = scan_rendered(rendered)
    report = generate_report(findings, args.chart)

    if args.report:
        Path(args.report).write_text(report)
        print(f"Report written to {args.report}")
    else:
        print(report)

    threshold = {"critical": ["CRITICAL"], "high": ["CRITICAL", "HIGH"],
                 "medium": ["CRITICAL", "HIGH", "MEDIUM"]}
    blocking = [f for f in findings if f["severity"] in threshold[args.fail_on]]
    if blocking:
        print(f"\nFAILED: {len(blocking)} findings at or above {args.fail_on} severity")
        sys.exit(1)


if __name__ == "__main__":
    main()