feat: add support any kinds for policy checks

pkg/configauditreport/builder.go

@@ -30,6 +30,7 @@ type ReportBuilder struct {
 	resourceLabelsToInclude []string
 	additionalReportLabels  labels.Set
 	etc.Config
+	scopeResolver *kube.K8sScope
 }
 
 func NewReportBuilder(scheme *runtime.Scheme) *ReportBuilder {
@@ -38,6 +39,11 @@ func NewReportBuilder(scheme *runtime.Scheme) *ReportBuilder {
 	}
 }
 
+func (b *ReportBuilder) ScopeResolver(sr *kube.K8sScope) *ReportBuilder {
+	b.scopeResolver = sr
+	return b
+}
+
 func (b *ReportBuilder) Controller(controller client.Object) *ReportBuilder {
 	b.controller = controller
 	return b
@@ -170,7 +176,7 @@ func (b *ReportBuilder) GetReport() (v1alpha1.ConfigAuditReport, error) {
 }
 
 func (b *ReportBuilder) Write(ctx context.Context, writer Writer) error {
-	if kube.IsClusterScopedKind(b.controller.GetObjectKind().GroupVersionKind().Kind) {
+	if b.scopeResolver != nil && b.scopeResolver.IsClusterScope(b.controller.GetObjectKind().GroupVersionKind().Kind) {
 		report, err := b.GetClusterReport()
 		if err != nil {
 			return err

pkg/configauditreport/controller/nodecollector.go

@@ -160,6 +160,7 @@ func (r *NodeCollectorJobController) processCompleteScanJob(ctx context.Context,
 		return fmt.Errorf("failed to evaluate policies on Node : %w", err)
 	}
 	infraReportBuilder := infraassessment.NewReportBuilder(r.Client.Scheme()).
+		ScopeResolver(&r.ObjectResolver.K8sScope).
 		Controller(node).
 		ResourceSpecHash(resourceHash).
 		PluginConfigHash(policiesHash).

pkg/configauditreport/controller/policyconfig.go

@@ -6,9 +6,6 @@ import (
 
 	"github.com/go-logr/logr"
 	corev1 "k8s.io/api/core/v1"
-	networkingv1 "k8s.io/api/networking/v1"
-	rbacv1 "k8s.io/api/rbac/v1"
-	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
 	ctrl "sigs.k8s.io/controller-runtime"
@@ -41,32 +38,14 @@ type PolicyConfigController struct {
 
 // Controller for trivy-operator-policies-config in the operator namespace; must be cluster scoped even with namespace predicate
 // +kubebuilder:rbac:groups="",resources=configmaps,verbs=get;list;watch
-
 func (r *PolicyConfigController) SetupWithManager(mgr ctrl.Manager) error {
-
-	// Determine which Kubernetes workloads the controller will reconcile and add them to resources
 	targetWorkloads := r.Config.GetTargetWorkloads()
-	workloadResources := make([]kube.Resource, 0)
-	for _, tw := range targetWorkloads {
-		var resource kube.Resource
-		if err := resource.GetWorkloadResource(tw, &v1alpha1.ConfigAuditReport{}, r.ObjectResolver); err != nil {
-			return err
-		}
-		workloadResources = append(workloadResources, resource)
-	}
 
-	// Add non workload related resources
-	resources := []kube.Resource{
-		{Kind: kube.KindService, ForObject: &corev1.Service{}, OwnsObject: &v1alpha1.ConfigAuditReport{}},
-		{Kind: kube.KindConfigMap, ForObject: &corev1.ConfigMap{}, OwnsObject: &v1alpha1.ConfigAuditReport{}},
-		{Kind: kube.KindRole, ForObject: &rbacv1.Role{}, OwnsObject: &v1alpha1.RbacAssessmentReport{}},
-		{Kind: kube.KindRoleBinding, ForObject: &rbacv1.RoleBinding{}, OwnsObject: &v1alpha1.RbacAssessmentReport{}},
-		{Kind: kube.KindNetworkPolicy, ForObject: &networkingv1.NetworkPolicy{}, OwnsObject: &v1alpha1.ConfigAuditReport{}},
-		{Kind: kube.KindResourceQuota, ForObject: &corev1.ResourceQuota{}, OwnsObject: &v1alpha1.ConfigAuditReport{}},
-		{Kind: kube.KindLimitRange, ForObject: &corev1.LimitRange{}, OwnsObject: &v1alpha1.ConfigAuditReport{}},
+	resources, clusterResources, err := kube.GetActiveResource(targetWorkloads, r.ObjectResolver, r.Scheme())
+	if err != nil {
+		return fmt.Errorf("unable to setup resources for PolicyConfigController: %w", err)
 	}
 
-	resources = append(resources, workloadResources...)
 	for _, configResource := range resources {
 		if err := ctrl.NewControllerManagedBy(mgr).
 			For(&corev1.ConfigMap{}, builder.WithPredicates(
@@ -77,13 +56,6 @@ func (r *PolicyConfigController) SetupWithManager(mgr ctrl.Manager) error {
 			Complete(r.reconcileConfig(configResource.Kind)); err != nil {
 			return fmt.Errorf("constructing controller for %s: %w", configResource.Kind, err)
 		}
-
-	}
-
-	clusterResources := []kube.Resource{
-		{Kind: kube.KindClusterRole, ForObject: &rbacv1.ClusterRole{}, OwnsObject: &v1alpha1.ClusterRbacAssessmentReport{}},
-		{Kind: kube.KindClusterRoleBindings, ForObject: &rbacv1.ClusterRoleBinding{}, OwnsObject: &v1alpha1.ClusterRbacAssessmentReport{}},
-		{Kind: kube.KindCustomResourceDefinition, ForObject: &apiextensionsv1.CustomResourceDefinition{}, OwnsObject: &v1alpha1.ClusterConfigAuditReport{}},
 	}
 
 	for _, resource := range clusterResources {
@@ -97,9 +69,7 @@ func (r *PolicyConfigController) SetupWithManager(mgr ctrl.Manager) error {
 			return err
 		}
 	}
-
 	return nil
-
 }
 
 func (r *PolicyConfigController) reconcileConfig(kind kube.Kind) reconcile.Func {

pkg/configauditreport/controller/resource.go

@@ -10,10 +10,6 @@ import (
 	"time"
 
 	"github.com/go-logr/logr"
-	corev1 "k8s.io/api/core/v1"
-	networkingv1 "k8s.io/api/networking/v1"
-	rbacv1 "k8s.io/api/rbac/v1"
-	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/builder"
@@ -88,13 +84,13 @@ func (r *ResourceController) SetupWithManager(mgr ctrl.Manager) error {
 
 	// Determine which Kubernetes workloads the controller will reconcile and add them to resources
 	targetWorkloads := r.Config.GetTargetWorkloads()
-	targetWorkloads = append(targetWorkloads, strings.ToLower(string(kube.KindIngress)))
-	for _, tw := range targetWorkloads {
-		var resource kube.Resource
-		err = resource.GetWorkloadResource(tw, &v1alpha1.ConfigAuditReport{}, r.ObjectResolver)
-		if err != nil {
-			return err
-		}
+
+	resources, clusterResources, err := kube.GetActiveResource(targetWorkloads, r.ObjectResolver, r.Scheme())
+	if err != nil {
+		return fmt.Errorf("unable to setup resources for ResourceController: %w", err)
+	}
+
+	for _, resource := range resources {
 		resourceBuilder := r.buildControlMgr(mgr, resource, installModePredicate)
 		if r.Config.InfraAssessmentScannerEnabled {
 			resourceBuilder.Owns(&v1alpha1.InfraAssessmentReport{})
@@ -104,30 +100,6 @@ func (r *ResourceController) SetupWithManager(mgr ctrl.Manager) error {
 		}
 	}
 
-	// Add non workload related resources
-	resources := []kube.Resource{
-		{Kind: kube.KindService, ForObject: &corev1.Service{}, OwnsObject: &v1alpha1.ConfigAuditReport{}},
-		{Kind: kube.KindConfigMap, ForObject: &corev1.ConfigMap{}, OwnsObject: &v1alpha1.ConfigAuditReport{}},
-		{Kind: kube.KindRole, ForObject: &rbacv1.Role{}, OwnsObject: &v1alpha1.RbacAssessmentReport{}},
-		{Kind: kube.KindRoleBinding, ForObject: &rbacv1.RoleBinding{}, OwnsObject: &v1alpha1.RbacAssessmentReport{}},
-		{Kind: kube.KindNetworkPolicy, ForObject: &networkingv1.NetworkPolicy{}, OwnsObject: &v1alpha1.ConfigAuditReport{}},
-		{Kind: kube.KindResourceQuota, ForObject: &corev1.ResourceQuota{}, OwnsObject: &v1alpha1.ConfigAuditReport{}},
-		{Kind: kube.KindLimitRange, ForObject: &corev1.LimitRange{}, OwnsObject: &v1alpha1.ConfigAuditReport{}},
-	}
-
-	for _, configResource := range resources {
-		if err := r.buildControlMgr(mgr, configResource, installModePredicate).
-			Complete(r.reconcileResource(configResource.Kind)); err != nil {
-			return fmt.Errorf("constructing controller for %s: %w", configResource.Kind, err)
-		}
-	}
-
-	clusterResources := []kube.Resource{
-		{Kind: kube.KindClusterRole, ForObject: &rbacv1.ClusterRole{}, OwnsObject: &v1alpha1.ClusterRbacAssessmentReport{}},
-		{Kind: kube.KindClusterRoleBindings, ForObject: &rbacv1.ClusterRoleBinding{}, OwnsObject: &v1alpha1.ClusterRbacAssessmentReport{}},
-		{Kind: kube.KindCustomResourceDefinition, ForObject: &apiextensionsv1.CustomResourceDefinition{}, OwnsObject: &v1alpha1.ClusterConfigAuditReport{}},
-	}
-
 	for _, resource := range clusterResources {
 		if err = ctrl.NewControllerManagedBy(mgr).WithOptions(controller.Options{
 			CacheSyncTimeout: r.CacheSyncTimeout,
@@ -246,6 +218,7 @@ func (r *ResourceController) reconcileResource(resourceKind kube.Kind) reconcile
 		// create config-audit report
 		if !kube.IsRoleTypes(kube.Kind(kind)) || r.MergeRbacFindingWithConfigAudit {
 			reportBuilder := configauditreport.NewReportBuilder(r.Client.Scheme()).
+				ScopeResolver(&r.ObjectResolver.K8sScope).
 				Controller(resource).
 				ResourceSpecHash(resourceHash).
 				PluginConfigHash(policiesHash).
@@ -261,6 +234,7 @@ func (r *ResourceController) reconcileResource(resourceKind kube.Kind) reconcile
 			// create infra-assessment report
 			if k8sCoreComponent(resource) && r.Config.InfraAssessmentScannerEnabled {
 				infraReportBuilder := infraassessment.NewReportBuilder(r.Client.Scheme()).
+					ScopeResolver(&r.ObjectResolver.K8sScope).
 					Controller(resource).
 					ResourceSpecHash(resourceHash).
 					PluginConfigHash(policiesHash).
@@ -278,6 +252,7 @@ func (r *ResourceController) reconcileResource(resourceKind kube.Kind) reconcile
 		// create rbac-assessment report
 		if kube.IsRoleTypes(kube.Kind(kind)) && r.Config.RbacAssessmentScannerEnabled && !r.MergeRbacFindingWithConfigAudit {
 			rbacReportBuilder := rbacassessment.NewReportBuilder(r.Client.Scheme()).
+				ScopeResolver(&r.ObjectResolver.K8sScope).
 				Controller(resource).
 				ResourceSpecHash(resourceHash).
 				PluginConfigHash(policiesHash).
@@ -366,7 +341,7 @@ func (r *ResourceController) hasReport(ctx context.Context, owner kube.ObjectRef
 	if kube.IsRoleTypes(owner.Kind) {
 		io = r.RbacReadWriter
 	}
-	if kube.IsClusterScopedKind(string(owner.Kind)) {
+	if r.ObjectResolver.IsClusterScope(string(owner.Kind)) {
 		hasClusterReport, err := r.hasClusterReport(ctx, owner, podSpecHash, pluginConfigHash, io)
 		if err != nil {
 			return false, err

pkg/infraassessment/builder.go

@@ -35,6 +35,7 @@ type ReportBuilder struct {
 	reportTTL               *time.Duration
 	resourceLabelsToInclude []string
 	additionalReportLabels  labels.Set
+	scopeResolver           *kube.K8sScope
 }
 
 func NewReportBuilder(scheme *runtime.Scheme) *ReportBuilder {
@@ -43,6 +44,11 @@ func NewReportBuilder(scheme *runtime.Scheme) *ReportBuilder {
 	}
 }
 
+func (b *ReportBuilder) ScopeResolver(sr *kube.K8sScope) *ReportBuilder {
+	b.scopeResolver = sr
+	return b
+}
+
 func (b *ReportBuilder) Controller(controller client.Object) *ReportBuilder {
 	b.controller = controller
 	return b
@@ -175,7 +181,7 @@ func (b *ReportBuilder) GetClusterReport() (v1alpha1.ClusterInfraAssessmentRepor
 }
 
 func (b *ReportBuilder) Write(ctx context.Context, writer Writer) error {
-	if kube.IsClusterScopedKind(b.controller.GetObjectKind().GroupVersionKind().Kind) {
+	if b.scopeResolver.IsClusterScope(b.controller.GetObjectKind().GroupVersionKind().Kind) {
 		report, err := b.GetClusterReport()
 		if err != nil {
 			return err