The agent suggests the client's SBOB — you sign it

kubectl -n honey logs ds/node-agent -c node-agent --all-pods=true -f | sed -u 's/^\[[^]]*\] //' | jq -Rc --unbuffered 'fromjson? | if .RuleID then {t:.time, rule:.RuleID, alert:.BaseRuntimeMetadata.alertName, ns:.RuntimeK8sDetails.namespace, wl:.RuntimeK8sDetails.workloadName, msg:.message} else {t:.ts, level, msg} end'

cd ~/bob/example/redis
export CP=containerprofiles.spdx.softwarecomposition.kubescape.io
kubectl create ns redis
kubectl apply -f vendor/redis-base-signed.yaml
helm install redis oci://registry-1.docker.io/bitnamicharts/redis --version 27.0.18 -n redis --set architecture=standalone --set auth.enabled=false --set image.repository=bitnami/redis --set image.digest=sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98 \
  --set 'master.podLabels.kubescape\.io/user-defined-profile=redis'

sed '/kubescape.io\/user-defined-profile/d' client.yaml | kubectl apply -f -
kubectl -n redis rollout status deploy/redis-client --timeout=120s

watch -n5 "kubectl -n redis get $CP -l 'kubescape.io/profile-role=suggestion,!kubescape.io/delta-of'"

kubectl -n redis get events --field-selector reason=SBoBSuggested -o custom-columns=POD:.involvedObject.name,MSG:.message

~/sign-object generate-keypair --output operator.pem
N=$(kubectl -n redis get $CP -l 'kubescape.io/profile-role=suggestion,!kubescape.io/delta-of' -o jsonpath='{.items[0].metadata.name}')
kubectl -n redis get $CP "$N" -o json | python3 -c '
import sys,json
d=json.load(sys.stdin)
d["metadata"]={"name":"redis-client","namespace":"redis","annotations":{"kubescape.io/managed-by":"User"}}
json.dump(d,sys.stdout)' > client-sbob.json
~/bobctl validate --file client-sbob.json
~/sign-object sign --file client-sbob.json --key operator.pem --output client-sbob-signed.yaml
kubectl apply -f client-sbob-signed.yaml
kubectl -n redis patch deploy redis-client -p '{"spec":{"template":{"metadata":{"labels":{"kubescape.io/user-defined-profile":"redis-client"}}}}}'
kubectl -n redis rollout status deploy/redis-client --timeout=120s

kubectl -n redis get $CP -l kubescape.io/delta-of=redis -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.metadata.annotations.kubescape\.io/evidence}{"\n"}{end}'

kubectl -n redis get $CP redis -o json | jq --argjson add "$(kubectl -n redis get $CP redis-peer-redis-redis-client -o json | jq '.spec.ingress')" '.spec.ingress = ((.spec.ingress // []) + $add) | {apiVersion, kind, metadata: {name: .metadata.name, namespace: .metadata.namespace, annotations: {"kubescape.io/managed-by": "User"}}, spec}' > redis-healed.json
~/sign-object sign --file redis-healed.json --key operator.pem --output redis-healed-signed.yaml && kubectl apply -f redis-healed-signed.yaml

kubectl -n redis get $CP -l kubescape.io/delta-of=redis-client -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.metadata.annotations.kubescape\.io/suggestion-version}{"\n"}{end}'

kubectl -n redis get $CP redis-client -o json | jq --argjson add "$(kubectl -n redis get $CP redis-client-delta-overlay -o json | jq '{execs: (.spec.execs // []), opens: (.spec.opens // [])}')" '.spec.execs = ((.spec.execs // []) + $add.execs) | .spec.opens = ((.spec.opens // []) + $add.opens) | {apiVersion, kind, metadata: {name: .metadata.name, namespace: .metadata.namespace, annotations: {"kubescape.io/managed-by": "User"}}, spec}' > client-sbob.json
~/sign-object sign --file client-sbob.json --key operator.pem --output client-sbob-signed.yaml && kubectl apply -f client-sbob-signed.yaml

kubectl -n redis exec deploy/redis-client -- id

sed 's#signature.kubescape.io/signature: ME#signature.kubescape.io/signature: MF#' client-sbob-signed.yaml | kubectl apply -f -

kubectl apply -f client-sbob-signed.yaml

cd ~/bob/example/redis
export CP=containerprofiles.spdx.softwarecomposition.kubescape.io
kubectl create ns client
kubectl apply -f - <<'EOF'
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-client
  namespace: client
  labels: {app: web-client}
spec:
  replicas: 1
  selector:
    matchLabels: {app: web-client}
  template:
    metadata:
      labels: {app: web-client}
    spec:
      containers:
        - name: client
          image: redis:7-alpine
          command: ["/bin/sh", "-c"]
          args:
            - |
              i=0
              while true; do
                wget -qO /tmp/quote.txt https://labs.iximiuz.com/ || true
                redis-cli -h redis-master.redis.svc.cluster.local -p 6379 SET "quote:$i" "$(date -u +%s)" >/dev/null
                i=$((i+1)); sleep 3
              done
EOF
kubectl -n client rollout status deploy/web-client --timeout=120s

kubectl get $CP -A -l kubescape.io/profile-role=suggestion -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}{"\t"}{.metadata.labels.kubescape\.io/delta-of}{"\t"}{.metadata.annotations.kubescape\.io/evidence}{"\n"}{end}'

kubectl -n client get events --field-selector reason=SBoBPeerProposed -o jsonpath='{.items[0].note}{"\n"}'

N=$(kubectl -n client get $CP -l 'kubescape.io/profile-role=suggestion,!kubescape.io/delta-of' -o jsonpath='{.items[0].metadata.name}')
kubectl -n client get $CP "$N" -o json | jq '{apiVersion, kind, metadata: {name: "web-client", namespace: .metadata.namespace, annotations: {"kubescape.io/managed-by": "User"}}, spec}' > web-client-sbob.json
~/bobctl validate --file web-client-sbob.json
~/sign-object sign --file web-client-sbob.json --key operator.pem --output web-client-signed.yaml && kubectl apply -f web-client-signed.yaml
kubectl -n client patch deploy web-client -p '{"spec":{"template":{"metadata":{"labels":{"kubescape.io/user-defined-profile":"web-client"}}}}}'
kubectl -n client rollout status deploy/web-client --timeout=120s

kubectl -n redis get $CP redis -o json | jq --argjson add "$(kubectl -n redis get $CP redis-peer-client-web-client -o json | jq '.spec.ingress')" '.spec.ingress = ((.spec.ingress // []) + $add) | {apiVersion, kind, metadata: {name: .metadata.name, namespace: .metadata.namespace, annotations: {"kubescape.io/managed-by": "User"}}, spec}' > redis-healed.json
~/sign-object sign --file redis-healed.json --key operator.pem --output redis-healed-signed.yaml && kubectl apply -f redis-healed-signed.yaml

kubectl -n client exec deploy/web-client -- id

kubectl -n client get $CP -l kubescape.io/delta-of=web-client -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.metadata.annotations.kubescape\.io/suggestion-version}{"\n"}{end}'

sleep 120
kubectl get $CP -A -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}{"\t"}{.metadata.annotations.signature\.kubescape\.io/identity}{"\n"}{end}' | grep -v $'\t$'

export CP=containerprofiles.spdx.softwarecomposition.kubescape.io
cd ~/bob/example/redis && mkdir -p frags
kubectl create --dry-run=client -o json -f vendor/redis-base-signed.yaml | python3 -c '
import sys,json
d=json.load(sys.stdin)
d["metadata"]={"name":"redis-base","namespace":"redis","labels":{"signature.kubescape.io/bundle":"redis","signature.kubescape.io/fragment-class":"base"},"annotations":{"kubescape.io/managed-by":"User"}}
d["spec"]["ingress"]=None
json.dump(d,sys.stdout)' > frags/redis-base.json
~/sign-object sign --file frags/redis-base.json --key keys/vendor.pem --output frags/redis-base-signed.yaml
kubectl apply -f frags/redis-base-signed.yaml
kubectl -n redis delete $CP redis --ignore-not-found

cat > frags/redis-client-ingress.json <<'EOF'
{"apiVersion":"spdx.softwarecomposition.kubescape.io/v1beta1","kind":"ContainerProfile",
 "metadata":{"name":"redis-client-ingress","namespace":"redis","labels":{"signature.kubescape.io/bundle":"redis","signature.kubescape.io/fragment-class":"admission"},"annotations":{"kubescape.io/managed-by":"User"}},
 "spec":{"ingress":[{"identifier":"redis-client","type":"internal",
   "namespaceSelector":{"matchLabels":{"kubernetes.io/metadata.name":"redis"}},
   "podSelector":{"matchLabels":{"app":"redis-client"}},
   "ports":[{"name":"TCP-6379","port":6379,"protocol":"TCP"}]}]}}
EOF
~/sign-object sign --file frags/redis-client-ingress.json --key keys/operator.pem --output frags/redis-client-ingress-signed.yaml
kubectl apply -f frags/redis-client-ingress-signed.yaml

cat > frags/redis-ops-overlay.json <<'EOF'
{"apiVersion":"spdx.softwarecomposition.kubescape.io/v1beta1","kind":"ContainerProfile",
 "metadata":{"name":"redis-ops-overlay","namespace":"redis","labels":{"signature.kubescape.io/bundle":"redis","signature.kubescape.io/fragment-class":"overlay"},"annotations":{"kubescape.io/managed-by":"User"}},
 "spec":{"execs":[{"path":"/usr/bin/df","args":["/usr/bin/df","-h"]}]}}
EOF
~/sign-object sign --file frags/redis-ops-overlay.json --key keys/operator.pem --output frags/redis-ops-overlay-signed.yaml
kubectl apply -f frags/redis-ops-overlay-signed.yaml
sleep 60
kubectl -n redis exec sts/redis-master -- df -h >/dev/null
kubectl -n redis exec sts/redis-master -- id >/dev/null

~/sign-object sign --file frags/redis-client-ingress.json --key keys/vendor.pem --output frags/wrongkey.yaml
kubectl apply -f frags/wrongkey.yaml

python3 -c '
import json
d=json.load(open("frags/redis-client-ingress.json")); d["metadata"]["name"]="redis-sneaky"
d["spec"]["execs"]=[{"path":"/bin/bash","args":["/bin/bash"]}]
json.dump(d,open("frags/sneaky.json","w"))'
~/sign-object sign --file frags/sneaky.json --key keys/operator.pem --output frags/sneaky-signed.yaml
kubectl apply -f frags/sneaky-signed.yaml

kubectl -n redis get $CP redis-ops-overlay -o jsonpath='{.metadata.annotations.signature\.kubescape\.io/content}' \
  | python3 -c 'import sys,base64,gzip; d=gzip.decompress(base64.b64decode(sys.stdin.read())); print(base64.b64encode(gzip.compress(d.replace(b"/usr/bin/df", b"/bin/backdoor"))).decode())' \
  | xargs -I{} kubectl -n redis annotate $CP redis-ops-overlay --overwrite signature.kubescape.io/content={}

kubectl -n redis delete $CP redis-sneaky
kubectl apply -f frags/redis-client-ingress-signed.yaml
kubectl apply -f frags/redis-ops-overlay-signed.yaml

for f in redis-base redis-client-ingress redis-ops-overlay; do
  kubectl -n redis get $CP $f -o yaml > /tmp/leaf.yaml && ~/sign-object verify --file /tmp/leaf.yaml --strict=false >/dev/null && echo "leaf $f: OK"
done