Autofix Network Policy

[nschhina]

Description

Add autofix support for Network Policy auditing

For 🎩 try-

kubeaudit autofix -f  fixtures/namespace_missing_default_deny_netpol.yml

Add default egress/ingress deny network policy to namespace

#159 to be fixed later

Fixes (Autofix for Network Policies #156)

closes #156

Type of change

• Bug fix 🐛
• New feature ✨

How Has This Been Tested?

• TestAllResourcesFixV1
• TestExtraResourcesFixV1
• TestExtraResourcesIngressFixV1
• TestFixV1Beta2
• TestFixV1Beta1
• TestFixV1

Checklist:

• I have 🎩 my changes (A 🎩 specifically includes pulling down changes, setting them up, and manually testing the changed features and potential side effects to make sure nothing is broken)
• I have performed a self-review of my own code
• I have made corresponding changes to the documentation
• New and existing unit tests pass locally with my changes
• The test coverage did not decrease

[klautcomputing]

I have 2 nitpicks and the issue that comments are deleted here in fixtures/namespace_missing_default_deny_netpol.yml

-    - from:
-      - namespaceSelector:     # chooses all pods in namespaces labelled with team=operations
-          matchLabels:
-            team: operations
-        podSelector:           # chooses pods with type=monitoring
-          matchLabels:
-            type: monitoring
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          team: operations
+      podSelector:
+        matchLabels:
+          type: monitoring

I am fine with fixing this issue in a different PR since it's about comments and not about autofixing NPs

[klautcomputing]

The problem is this doesn't give you any idea where they diff. The other code gave you a diff, this doesn't anymore.

[nschhina]

I've moved the stat code to after the scan loop, now we'll get where the files don't match as well as it'd match length of both files at the end. Do you have a better way around this? One thing I thought of was to just set s1 to be the scanner of the larger file, but anyways if files dont match and we scan doesnt output an error but stat does we can imply that files don't match in length hence files missing some content after?

[klautcomputing]

It's not the cleanest solution, but I think given how complicated a different solution would be this is I guess the best solution.

[nschhina]

I have 2 nitpicks and the issue that comments are deleted here in fixtures/namespace_missing_default_deny_netpol.yml

-    - from:
-      - namespaceSelector:     # chooses all pods in namespaces labelled with team=operations
-          matchLabels:
-            team: operations
-        podSelector:           # chooses pods with type=monitoring
-          matchLabels:
-            type: monitoring
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          team: operations
+      podSelector:
+        matchLabels:
+          type: monitoring

I am fine with fixing this issue in a different PR since it's about comments and not about autofixing NPs

I am aware of this bug, I think it's just that we don't have support for namespaceSelector or from in our comment slices yet, I'll open an issue on this so I don't forget about it

[klautcomputing]

Let's open an issue for the comment thing and then merge this :)