diff --git a/pkg/kubehound/graph/edge/pod_create.go b/pkg/kubehound/graph/edge/pod_create.go index e0450ef5..fd31f3bf 100644 --- a/pkg/kubehound/graph/edge/pod_create.go +++ b/pkg/kubehound/graph/edge/pod_create.go @@ -86,7 +86,8 @@ func (e *PodCreate) Traversal() types.EdgeTraversal { } else { // In smaller clusters we can still show the (large set of) attack paths generated by this attack g.V(). - HasLabel("Node"). + Has("runID", e.runtime.RunID.String()). + Has("cluster", e.runtime.ClusterName). Has("class", "Node"). As("n"). V(inserts...). diff --git a/pkg/kubehound/graph/edge/pod_exec.go b/pkg/kubehound/graph/edge/pod_exec.go index a9a3d6b9..e200b922 100644 --- a/pkg/kubehound/graph/edge/pod_exec.go +++ b/pkg/kubehound/graph/edge/pod_exec.go @@ -86,7 +86,8 @@ func (e *PodExec) Traversal() types.EdgeTraversal { } else { // In smaller clusters we can still show the (large set of) attack paths generated by this attack g.V(). - HasLabel("Pod"). + Has("runID", e.runtime.RunID.String()). + Has("cluster", e.runtime.ClusterName). Has("class", "Pod"). As("p"). V(inserts...). diff --git a/pkg/kubehound/graph/edge/pod_patch.go b/pkg/kubehound/graph/edge/pod_patch.go index ff4627bf..18910368 100644 --- a/pkg/kubehound/graph/edge/pod_patch.go +++ b/pkg/kubehound/graph/edge/pod_patch.go @@ -86,7 +86,8 @@ func (e *PodPatch) Traversal() types.EdgeTraversal { } else { // In smaller clusters we can still show the (large set of) attack paths generated by this attack g.V(). - HasLabel("Pod"). + Has("runID", e.runtime.RunID.String()). + Has("cluster", e.runtime.ClusterName). Has("class", "Pod"). As("p"). V(inserts...). diff --git a/pkg/kubehound/graph/edge/token_bruteforce.go b/pkg/kubehound/graph/edge/token_bruteforce.go index e40fc36f..2f9b2a30 100644 --- a/pkg/kubehound/graph/edge/token_bruteforce.go +++ b/pkg/kubehound/graph/edge/token_bruteforce.go @@ -64,7 +64,9 @@ func (e *TokenBruteforce) Traversal() types.EdgeTraversal { if e.cfg.LargeClusterOptimizations { // For larger clusters simply target the system:masters group to reduce redundant attack paths g.V(). - HasLabel("Identity"). + Has("runID", e.runtime.RunID.String()). + Has("cluster", e.runtime.ClusterName). + Has("class", "Identity"). Has("name", "system:masters"). As("i"). V(inserts...). @@ -75,7 +77,8 @@ func (e *TokenBruteforce) Traversal() types.EdgeTraversal { } else { // In smaller clusters we can still show the (large set of) attack paths generated by this attack g.V(). - HasLabel("Identity"). + Has("runID", e.runtime.RunID.String()). + Has("cluster", e.runtime.ClusterName). Has("class", "Identity"). As("i"). V(inserts...). diff --git a/pkg/kubehound/graph/edge/token_list.go b/pkg/kubehound/graph/edge/token_list.go index beeea199..e3b97b9f 100644 --- a/pkg/kubehound/graph/edge/token_list.go +++ b/pkg/kubehound/graph/edge/token_list.go @@ -64,7 +64,9 @@ func (e *TokenList) Traversal() types.EdgeTraversal { if e.cfg.LargeClusterOptimizations { // For larger clusters simply target the system:masters group to reduce redundant attack paths g.V(). - HasLabel("Identity"). + Has("runID", e.runtime.RunID.String()). + Has("cluster", e.runtime.ClusterName). + Has("class", "Identity"). Has("name", "system:masters"). As("i"). V(inserts...). @@ -75,7 +77,8 @@ func (e *TokenList) Traversal() types.EdgeTraversal { } else { // In smaller clusters we can still show the (large set of) attack paths generated by this attack g.V(). - HasLabel("Identity"). + Has("runID", e.runtime.RunID.String()). + Has("cluster", e.runtime.ClusterName). Has("class", "Identity"). As("i"). V(inserts...).