Add a show command to the Diki CLI

cmd/diki/app/app.go

@@ -20,7 +20,9 @@ import (
 	"k8s.io/component-base/version"
 
 	"github.com/gardener/diki/pkg/config"
+	"github.com/gardener/diki/pkg/metadata"
 	"github.com/gardener/diki/pkg/provider"
+	"github.com/gardener/diki/pkg/provider/builder"
 	"github.com/gardener/diki/pkg/report"
 	"github.com/gardener/diki/pkg/ruleset"
 )
@@ -124,6 +126,28 @@ e.g. to check compliance of your hyperscaler accounts.`,
 	addReportGenerateDiffFlags(generateDiffCmd, &generateDiffOpts)
 	generateCmd.AddCommand(generateDiffCmd)
 
+	showCmd := &cobra.Command{
+		Use:   "show",
+		Short: "Show metadata of the providers that the current diki binary supports.",
+		Long:  "Show metadata of the providers that the current diki binary supports.",
+		RunE: func(_ *cobra.Command, _ []string) error {
+			return errors.New("show subcommand not selected")
+		},
+	}
+
+	rootCmd.AddCommand(showCmd)
+
+	showProviderCmd := &cobra.Command{
+		Use:   "provider",
+		Short: "",
+		Long:  "",
+		RunE: func(_ *cobra.Command, args []string) error {
+			return showProviderCmd(args)
+		},
+	}
+
+	showCmd.AddCommand(showProviderCmd)
+
 	return rootCmd
 }
 
@@ -156,6 +180,51 @@ func addReportGenerateDiffFlags(cmd *cobra.Command, opts *generateDiffOptions) {
 	cmd.PersistentFlags().Var(cliflag.NewMapStringString(&opts.identityAttributes), "identity-attributes", "The keys are the IDs of the providers that will be present in the generated difference report and the values are metadata attributes to be used as identifiers.")
 }
 
+func showProviderCmd(args []string) error {
+	if len(args) > 1 {
+		return errors.New("command `show provider` accepts at most one provider")
+	}
+
+	var (
+		providerFuncMap = map[string]func() metadata.ProviderMetadata{
+			"gardener":      builder.GardenerProviderMetadata,
+			"garden":        builder.GardenProviderMetadata,
+			"managedk8s":    builder.ManagedK8SProviderMetadata,
+			"virtualgarden": builder.VirtualGardenProviderMetadata,
+		}
+	)
+
+	if len(args) == 0 {
+		providersMetadata := []metadata.Provider{}
+
+		for providerID := range providerFuncMap {
+			providersMetadata = append(providersMetadata, metadata.Provider{ProviderID: providerID, ProviderName: providerFuncMap[providerID]().ProviderName})
+		}
+
+		if bytes, err := json.Marshal(providersMetadata); err != nil {
+			return err
+		} else {
+			fmt.Println(string(bytes))
+		}
+	} else {
+		var providerArg = args[0]
+
+		metadataFunc, ok := providerFuncMap[providerArg]
+		if !ok {
+			return fmt.Errorf("provider %s does not exist in the current diki binary", providerArg)
+		}
+
+		providerMetadata := metadataFunc()
+
+		if bytes, err := json.Marshal(providerMetadata); err != nil {
+			return err
+		} else {
+			fmt.Println(string(bytes))
+		}
+	}
+	return nil
+}
+
 func generateDiffCmd(args []string, generateDiffOpts generateDiffOptions, rootOpts reportOptions, logger *slog.Logger) error {
 	if len(args) == 0 {
 		return errors.New("generate diff command requires a minimum of one filepath argument")

pkg/metadata/metadata.go

@@ -0,0 +1,41 @@
+// SPDX-FileCopyrightText: 2023 SAP SE or an SAP affiliate company and Gardener contributors
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package metadata
+
+// Version is used to represent a specific version of a ruleset
+type Version struct {
+	// Version is the human-readable name of the ruleset release
+	Version string `json:"version"`
+	// Latest is a bool tag that showcases if the specific version is the latest one
+	Latest bool `json:"latest"`
+}
+
+// RulesetMetadata is used to represent a specific ruleset and it's metadata
+type RulesetMetadata struct {
+	// RulesetID is the unique identifier of the ruleset
+	RulesetID string `json:"rulesetID"`
+	// RulesetName is the user-friendly name of the ruleset
+	RulesetName string `json:"rulesetName"`
+	// Versions is used to showcase the supported versions of the specific ruleset
+	Versions []Version `json:"versions"`
+}
+
+// Provider is used to represent an available provider by it's name and unique identifier
+type Provider struct {
+	// ProviderID is the unique identifier of the provider
+	ProviderID string `json:"id"`
+	// ProviderName is the user-friendly name of the provider
+	ProviderName string `json:"name"`
+}
+
+// ProviderMetadata is used to represent a specific provider and it's metadata
+type ProviderMetadata struct {
+	// ProviderID is the unique identifier of the provider
+	ProviderID string `json:"providerID"`
+	// ProviderName is the user-friendly name of the provider
+	ProviderName string `json:"providerName"`
+	// ProviderRulesets is a list of rulesets supported by the specific provider
+	ProviderRulesets []RulesetMetadata `json:"rulesets"`
+}

pkg/provider/builder/garden.go

@@ -9,6 +9,7 @@ import (
 	"log/slog"
 
 	"github.com/gardener/diki/pkg/config"
+	"github.com/gardener/diki/pkg/metadata"
 	"github.com/gardener/diki/pkg/provider"
 	"github.com/gardener/diki/pkg/provider/garden"
 	"github.com/gardener/diki/pkg/provider/garden/ruleset/securityhardenedshoot"
@@ -48,3 +49,42 @@ func GardenProviderFromConfig(conf config.ProviderConfig) (provider.Provider, er
 
 	return p, nil
 }
+
+// gardenGetSupportedVersions returns the Supported Versions of a specific ruleset that is supported by the Garden provider.
+func gardenGetSupportedVersions(ruleset string) []string {
+	switch ruleset {
+	case securityhardenedshoot.RulesetID:
+		return securityhardenedshoot.SupportedVersions
+	default:
+		return nil
+	}
+}
+
+// GardenProviderMetadata returns available metadata for the Garden Provider and it's supported rulesets.
+func GardenProviderMetadata() metadata.ProviderMetadata {
+	providerMetadata := metadata.ProviderMetadata{}
+	providerMetadata.ProviderID = "garden"
+	providerMetadata.ProviderName = "Garden"
+
+	var availableRulesets = map[string]string{
+		securityhardenedshoot.RulesetID: securityhardenedshoot.RulesetName,
+	}
+
+	for rulesetID, rulesetName := range availableRulesets {
+		rulesetMetadata := &metadata.RulesetMetadata{}
+		rulesetMetadata.RulesetID = rulesetID
+		rulesetMetadata.RulesetName = rulesetName
+		rulesetSupportedVersions := gardenGetSupportedVersions(rulesetMetadata.RulesetID)
+
+		for index, supportedVersion := range rulesetSupportedVersions {
+			if index == 0 {
+				rulesetMetadata.Versions = append(rulesetMetadata.Versions, metadata.Version{Version: supportedVersion, Latest: true})
+			} else {
+				rulesetMetadata.Versions = append(rulesetMetadata.Versions, metadata.Version{Version: supportedVersion, Latest: false})
+			}
+		}
+		providerMetadata.ProviderRulesets = append(providerMetadata.ProviderRulesets, *rulesetMetadata)
+	}
+
+	return providerMetadata
+}

pkg/provider/builder/gardener.go

@@ -11,6 +11,7 @@ import (
 	"k8s.io/client-go/rest"
 
 	"github.com/gardener/diki/pkg/config"
+	"github.com/gardener/diki/pkg/metadata"
 	"github.com/gardener/diki/pkg/provider"
 	"github.com/gardener/diki/pkg/provider/gardener"
 	"github.com/gardener/diki/pkg/provider/gardener/ruleset/disak8sstig"
@@ -61,3 +62,42 @@ func setConfigDefaults(config *rest.Config) {
 		config.Burst = 40
 	}
 }
+
+// gardenerGetSupportedVersions returns the Supported Versions of a specific ruleset that is supported by the Gardener provider.
+func gardenerGetSupportedVersions(ruleset string) []string {
+	switch ruleset {
+	case disak8sstig.RulesetID:
+		return disak8sstig.SupportedVersions
+	default:
+		return nil
+	}
+}
+
+// GardenerProviderMetadata returns available metadata for the Gardener Provider and it's supported rulesets.
+func GardenerProviderMetadata() metadata.ProviderMetadata {
+	providerMetadata := metadata.ProviderMetadata{}
+	providerMetadata.ProviderID = "gardener"
+	providerMetadata.ProviderName = "Gardener"
+
+	var availableRulesets = map[string]string{
+		disak8sstig.RulesetID: disak8sstig.RulesetName,
+	}
+
+	for rulesetID, rulesetName := range availableRulesets {
+		rulesetMetadata := &metadata.RulesetMetadata{}
+		rulesetMetadata.RulesetID = rulesetID
+		rulesetMetadata.RulesetName = rulesetName
+		rulesetSupportedVersions := gardenerGetSupportedVersions(rulesetMetadata.RulesetID)
+
+		for index, supportedVersion := range rulesetSupportedVersions {
+			if index == 0 {
+				rulesetMetadata.Versions = append(rulesetMetadata.Versions, metadata.Version{Version: supportedVersion, Latest: true})
+			} else {
+				rulesetMetadata.Versions = append(rulesetMetadata.Versions, metadata.Version{Version: supportedVersion, Latest: false})
+			}
+		}
+		providerMetadata.ProviderRulesets = append(providerMetadata.ProviderRulesets, *rulesetMetadata)
+	}
+
+	return providerMetadata
+}

pkg/provider/builder/managedk8s.go

@@ -9,6 +9,7 @@ import (
 	"log/slog"
 
 	"github.com/gardener/diki/pkg/config"
+	"github.com/gardener/diki/pkg/metadata"
 	"github.com/gardener/diki/pkg/provider"
 	"github.com/gardener/diki/pkg/provider/managedk8s"
 	"github.com/gardener/diki/pkg/provider/managedk8s/ruleset/disak8sstig"
@@ -57,3 +58,44 @@ func ManagedK8SProviderFromConfig(conf config.ProviderConfig) (provider.Provider
 
 	return p, nil
 }
+
+// managedK8SGetSupportedVersions returns the supported versions of a specific ruleset that is supported by the Managed K8S provider.
+func managedK8SGetSupportedVersions(ruleset string) []string {
+	switch ruleset {
+	case securityhardenedk8s.RulesetID:
+		return securityhardenedk8s.SupportedVersions
+	case disak8sstig.RulesetID:
+		return disak8sstig.SupportedVersions
+	default:
+		return nil
+	}
+}
+
+// ManagedK8SProviderMetadata returns available metadata for the Managed Kubernetes Provider and it's supported rulesets.
+func ManagedK8SProviderMetadata() metadata.ProviderMetadata {
+	providerMetadata := metadata.ProviderMetadata{}
+	providerMetadata.ProviderID = "managedk8s"
+	providerMetadata.ProviderName = "Managed Kubernetes"
+
+	var availableRulesets = map[string]string{
+		securityhardenedk8s.RulesetID: securityhardenedk8s.RulesetName,
+		disak8sstig.RulesetID:         disak8sstig.RulesetName,
+	}
+
+	for rulesetID, rulesetName := range availableRulesets {
+		rulesetMetadata := &metadata.RulesetMetadata{}
+		rulesetMetadata.RulesetID = rulesetID
+		rulesetMetadata.RulesetName = rulesetName
+		rulesetSupportedVersions := managedK8SGetSupportedVersions(rulesetMetadata.RulesetID)
+
+		for index, supportedVersion := range rulesetSupportedVersions {
+			if index == 0 {
+				rulesetMetadata.Versions = append(rulesetMetadata.Versions, metadata.Version{Version: supportedVersion, Latest: true})
+			} else {
+				rulesetMetadata.Versions = append(rulesetMetadata.Versions, metadata.Version{Version: supportedVersion, Latest: false})
+			}
+		}
+		providerMetadata.ProviderRulesets = append(providerMetadata.ProviderRulesets, *rulesetMetadata)
+	}
+	return providerMetadata
+}

pkg/provider/builder/virtualgarden.go

@@ -9,6 +9,7 @@ import (
 	"log/slog"
 
 	"github.com/gardener/diki/pkg/config"
+	"github.com/gardener/diki/pkg/metadata"
 	"github.com/gardener/diki/pkg/provider"
 	"github.com/gardener/diki/pkg/provider/virtualgarden"
 	"github.com/gardener/diki/pkg/provider/virtualgarden/ruleset/disak8sstig"
@@ -48,3 +49,41 @@ func VirtualGardenProviderFromConfig(conf config.ProviderConfig) (provider.Provi
 
 	return p, nil
 }
+
+// virtualGardenGetSupportedVersions returns the supported versions of a specific ruleset that is supported by the Virtual Garden provider.
+func virtualGardenGetSupportedVersions(ruleset string) []string {
+	switch ruleset {
+	case disak8sstig.RulesetID:
+		return disak8sstig.SupportedVersions
+	default:
+		return nil
+	}
+}
+
+// VirtualGardenProviderMetadata returns available metadata for the Virtual Garden Provider and it's supported rulesets.
+func VirtualGardenProviderMetadata() metadata.ProviderMetadata {
+	providerMetadata := metadata.ProviderMetadata{}
+	providerMetadata.ProviderID = "virtualgarden"
+	providerMetadata.ProviderName = "Virtual Garden"
+
+	var availableRulesets = map[string]string{
+		disak8sstig.RulesetID: disak8sstig.RulesetName,
+	}
+
+	for rulesetID, rulesetName := range availableRulesets {
+		rulesetMetadata := &metadata.RulesetMetadata{}
+		rulesetMetadata.RulesetID = rulesetID
+		rulesetMetadata.RulesetName = rulesetName
+		rulesetSupportedVersions := virtualGardenGetSupportedVersions(rulesetMetadata.RulesetID)
+
+		for index, supportedVersion := range rulesetSupportedVersions {
+			if index == 0 {
+				rulesetMetadata.Versions = append(rulesetMetadata.Versions, metadata.Version{Version: supportedVersion, Latest: true})
+			} else {
+				rulesetMetadata.Versions = append(rulesetMetadata.Versions, metadata.Version{Version: supportedVersion, Latest: false})
+			}
+		}
+		providerMetadata.ProviderRulesets = append(providerMetadata.ProviderRulesets, *rulesetMetadata)
+	}
+	return providerMetadata
+}

pkg/provider/garden/ruleset/securityhardenedshoot/ruleset.go

@@ -19,11 +19,17 @@ import (
 )
 
 const (
-	// RulesetID is a constant containing the id of the Security Hardened Shoot Cluster Ruleset.
+	// RulesetID is a constant containing the id of the Security Hardened Shoot Cluster ruleset.
 	RulesetID = "security-hardened-shoot-cluster"
+	// RulesetName is a constant containing the user-friendly name of the Security Hardened Shoot Cluster ruleset.
+	RulesetName = "Security Hardened Shoot Cluster"
 )
 
-var _ ruleset.Ruleset = &Ruleset{}
+var (
+	_ ruleset.Ruleset = &Ruleset{}
+	// SupportedVersions is a list of available versions for the Security Hardened Shoot Cluster Ruleset.
+	SupportedVersions = []string{"v0.1.0"}
+)
 
 // Ruleset implements Security Hardened Shoot Cluster.
 type Ruleset struct {
@@ -62,7 +68,7 @@ func (r *Ruleset) ID() string {
 
 // Name returns the name of the Ruleset.
 func (r *Ruleset) Name() string {
-	return "Security Hardened Shoot Cluster"
+	return RulesetName
 }
 
 // Version returns the version of the Ruleset.

pkg/provider/gardener/ruleset/disak8sstig/ruleset.go

@@ -23,9 +23,15 @@ import (
 const (
 	// RulesetID is a constant containing the id of the DISA Kubernetes STIG Ruleset.
 	RulesetID = "disa-kubernetes-stig"
+	// RulesetName is a constant containing the user-friendly name of the DISA Kubernetes STIG ruleset.
+	RulesetName = "DISA Kubernetes Security Technical Implementation Guide"
 )
 
-var _ ruleset.Ruleset = &Ruleset{}
+var (
+	_ ruleset.Ruleset = &Ruleset{}
+	// SupportedVersions is a list of available versions for the DISA Kubernetes STIG Ruleset.
+	SupportedVersions = []string{"v2r1", "v1r11"}
+)
 
 // Ruleset implements DISA Kubernetes STIG.
 type Ruleset struct {
@@ -71,7 +77,7 @@ func (r *Ruleset) ID() string {
 
 // Name returns the name of the Ruleset.
 func (r *Ruleset) Name() string {
-	return "DISA Kubernetes Security Technical Implementation Guide"
+	return RulesetName
 }
 
 // Version returns the version of the Ruleset.