feat: add Anyi Cloud Native Security (DISS) service

services/anyi__cloud-native-security/README.md

@@ -0,0 +1,105 @@
+# Anyi Cloud Native Security (DISS) OctoBus Service
+
+OctoBus service package for [Anyi Technology](https://www.anyi.com.cn/) Cloud Native Security Platform (DISS).
+
+Import it into OctoBus with:
+
+```bash
+octobus service import --id anyi-cloud-native-security ./services//anyi__cloud-native-security
+```
+
+## Supported Version
+
+Tested against DISS API v1.0.0. The API uses apiKey authentication: the JWT token is sent directly in the `Authorization` header without a `Bearer` prefix (i.e., `Authorization: <token>`).
+
+## Package Files
+
+- `service.json`: OctoBus service manifest.
+- `proto/anyi_cloud_native_security.proto`: gRPC API definition.
+- `config.schema.json`: non-secret endpoint, timeout, TLS, and user settings.
+- `secret.schema.json`: DISS API token (sent as `Authorization: <token>`, no Bearer prefix).
+- `src/anyi-cloud-native-security.js`: DISS API implementation.
+- `src/service.js`: OctoBus SDK `defineService` wrapper.
+- `bin/anyi-cloud-native-security.js`: service-local executable entrypoint.
+- `test/anyi-cloud-native-security.test.js`: node:test coverage for validation, request/response mapping, error handling, and SDK handler invocation.
+- `test/mock_upstream.js`: local DISS API mock server.
+
+## Configuration
+
+Use `endpoint` for the DISS REST API base URL. `baseUrl` is accepted as a legacy alias.
+
+```json
+{
+  "endpoint": "https://diss.example.com:8543",
+  "timeoutMs": 15000,
+  "skipTlsVerify": false,
+  "defaultUser": "admin"
+}
+```
+
+Use `secret.token` for the DISS API token (placed directly in the `Authorization` header, no `Bearer` prefix):
+
+```json
+{
+  "token": "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJlbmMiOiJBMTI4Q0JDLUhTMjU2In0..."
+}
+```
+
+## RPC Methods
+
+| Method | Description |
+|---|---|
+| `Anyi_CloudNativeSecurity.Anyi_CloudNativeSecurity/ListWarnings` | List security warnings with pagination and filters |
+| `Anyi_CloudNativeSecurity.Anyi_CloudNativeSecurity/ListWarningGroups` | List aggregated warning groups |
+| `Anyi_CloudNativeSecurity.Anyi_CloudNativeSecurity/DisposeWarnings` | Dispose warnings (isolation/pause/stop/kill) |
+| `Anyi_CloudNativeSecurity.Anyi_CloudNativeSecurity/DisposeWarningGroups` | Dispose aggregated warning groups |
+| `Anyi_CloudNativeSecurity.Anyi_CloudNativeSecurity/ListVulnerabilities` | List image vulnerabilities |
+| `Anyi_CloudNativeSecurity.Anyi_CloudNativeSecurity/ListHosts` | List host assets |
+| `Anyi_CloudNativeSecurity.Anyi_CloudNativeSecurity/ListContainers` | List container assets |
+| `Anyi_CloudNativeSecurity.Anyi_CloudNativeSecurity/ListClusters` | List K8s clusters |
+| `Anyi_CloudNativeSecurity.Anyi_CloudNativeSecurity/ContainerControl` | Control container (resume/start/activate/deactivate) |
+| `Anyi_CloudNativeSecurity.Anyi_CloudNativeSecurity/UnblockNetwork` | Unblock container network isolation |
+
+## Behavior Notes
+
+- All list methods support `from`/`limit` pagination parameters (default: 0/20).
+- `ListHosts` uses `defaultUser` from config (default: `admin`); per-request `user` overrides it.
+- Filter fields use `google.protobuf.Struct` to pass through DISS API body parameters without hardcoding the full DISS schema.
+- `DisposeWarnings` and `DisposeWarningGroups` require `action` (one of: isolation, pause, stop, kill). These are write operations.
+- `ContainerControl` requires `action` (one of: resume, start, activate, deactivate) and `container_id`.
+- `UnblockNetwork` requires `container_id`.
+- HTTP 401 maps to gRPC UNAUTHENTICATED, 403 to PERMISSION_DENIED, 4xx to FAILED_PRECONDITION, 5xx/network to UNAVAILABLE.
+- When `skipTlsVerify` is true, TLS certificate verification is skipped (useful for self-signed certificates in private deployments).
+
+## Risk Notes
+
+- **Write operations**: `DisposeWarnings`, `DisposeWarningGroups`, `ContainerControl`, and `UnblockNetwork` modify system state.
+  - `isolation` action isolates a container network; use `UnblockNetwork` to reverse.
+  - `stop`/`kill` actions stop or kill containers; verify target before invocation.
+  - `deactivate` deactivates a container; use `activate` or `start` to reverse.
+- **Idempotency**: DISS disposal and control operations are idempotent for repeated identical requests.
+- **Rollback**: Container isolation can be reversed via `UnblockNetwork`. Stopped containers may require manual restart.
+- **Audit**: All write operations are logged by DISS with user context and timestamp.
+
+## Suggested Capset
+
+For a security monitoring agent:
+
+```
+ListWarnings, ListWarningGroups, ListVulnerabilities, ListHosts, ListContainers, ListClusters
+```
+
+For a security response agent (adds write operations):
+
+```
+ListWarnings, ListWarningGroups, DisposeWarnings, DisposeWarningGroups, ListVulnerabilities, ListHosts, ListContainers, ListClusters, ContainerControl, UnblockNetwork
+```
+
+## Local Checks
+
+```bash
+cd services
+npm run validate -- --service-dir anyi__cloud-native-security
+npm test -- --service-dir anyi__cloud-native-security --coverage
+npm run pack:check
+```

services/anyi__cloud-native-security/bin/anyi-cloud-native-security.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+
+import { runServiceMain } from "@chaitin-ai/octobus-sdk";
+
+import { service } from "../src/service.js";
+
+runServiceMain(service);

services/anyi__cloud-native-security/config.schema.json

@@ -0,0 +1,36 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "additionalProperties": true,
+  "properties": {
+    "endpoint": {
+      "type": "string",
+      "description": "Anyi DISS REST API base URL, for example https://diss.example.com:8543."
+    },
+    "baseUrl": {
+      "type": "string",
+      "description": "Legacy alias for endpoint."
+    },
+    "headers": {
+      "type": "object",
+      "additionalProperties": { "type": "string" },
+      "description": "Optional extra HTTP headers sent to DISS."
+    },
+    "timeoutMs": {
+      "type": "integer",
+      "minimum": 1,
+      "default": 15000,
+      "description": "HTTP timeout in milliseconds."
+    },
+    "skipTlsVerify": {
+      "type": "boolean",
+      "default": false,
+      "description": "Skip TLS certificate verification for private DISS deployments."
+    },
+    "defaultUser": {
+      "type": "string",
+      "default": "admin",
+      "description": "Default user parameter for DISS API queries that require a user context."
+    }
+  }
+}

services/anyi__cloud-native-security/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "anyi-cloud-native-security",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "bin": {
+    "anyi-cloud-native-security": "bin/anyi-cloud-native-security.js"
+  },
+  "dependencies": {
+    "@chaitin-ai/octobus-sdk": "^0.5.0",
+    "undici": "^7.16.0"
+  }
+}

services/anyi__cloud-native-security/proto/anyi_cloud_native_security.proto

@@ -0,0 +1,186 @@
+syntax = "proto3";
+
+package Anyi_CloudNativeSecurity;
+
+import "google/protobuf/struct.proto";
+
+option go_package = "miner/grpc-service/Anyi_CloudNativeSecurity";
+
+service Anyi_CloudNativeSecurity {
+  // 获取告警列表，支持分页和过滤
+  rpc ListWarnings(ListWarningsRequest) returns (ListWarningsResponse) {}
+
+  // 获取聚合告警列表，支持分页和过滤
+  rpc ListWarningGroups(ListWarningGroupsRequest) returns (ListWarningGroupsResponse) {}
+
+  // 告警处置：isolation 隔离、pause 暂停、stop 停止、kill 终止
+  rpc DisposeWarnings(DisposeWarningsRequest) returns (DisposeWarningsResponse) {}
+
+  // 聚合告警处置：isolation 隔离、pause 暂停、stop 停止、kill 终止
+  rpc DisposeWarningGroups(DisposeWarningGroupsRequest) returns (DisposeWarningGroupsResponse) {}
+
+  // 获取镜像漏洞列表
+  rpc ListVulnerabilities(ListVulnerabilitiesRequest) returns (ListVulnerabilitiesResponse) {}
+
+  // 获取主机列表
+  rpc ListHosts(ListHostsRequest) returns (ListHostsResponse) {}
+
+  // 获取容器列表
+  rpc ListContainers(ListContainersRequest) returns (ListContainersResponse) {}
+
+  // 获取集群列表
+  rpc ListClusters(ListClustersRequest) returns (ListClustersResponse) {}
+
+  // 容器控制操作：resume 恢复、start 启动、activate 激活、deactivate 停用
+  rpc ContainerControl(ContainerControlRequest) returns (ContainerControlResponse) {}
+
+  // 解除容器网络隔离
+  rpc UnblockNetwork(UnblockNetworkRequest) returns (UnblockNetworkResponse) {}
+}
+
+// --- ListWarnings ---
+
+message ListWarningsRequest {
+  google.protobuf.Struct filter = 1; // 过滤条件，透传至 DISS API body
+  int64 from = 2;  // 分页起始偏移，默认 0
+  int64 limit = 3; // 分页大小，默认 20
+}
+
+message ListWarningsResponse {
+  int64 code = 1;                // DISS 返回码，200 表示成功
+  string message = 2;            // DISS 返回消息
+  google.protobuf.Struct data = 3; // DISS 返回数据，含 items/total 等
+}
+
+// --- ListWarningGroups ---
+
+message ListWarningGroupsRequest {
+  google.protobuf.Struct filter = 1;
+  int64 from = 2;
+  int64 limit = 3;
+}
+
+message ListWarningGroupsResponse {
+  int64 code = 1;
+  string message = 2;
+  google.protobuf.Struct data = 3;
+}
+
+// --- DisposeWarnings ---
+
+message DisposeWarningsRequest {
+  string action = 1;                    // 处置方式：isolation / pause / stop / kill
+  string account = 2;                   // 租户，可选
+  repeated google.protobuf.Struct warnings = 3;   // 告警信息列表
+  repeated google.protobuf.Struct whitelist = 4;  // 白名单条目，可选
+}
+
+message DisposeWarningsResponse {
+  int64 code = 1;
+  string message = 2;
+  google.protobuf.Struct data = 3;
+}
+
+// --- DisposeWarningGroups ---
+
+message DisposeWarningGroupsRequest {
+  string action = 1;
+  string account = 2;
+  repeated google.protobuf.Struct warning_groups = 3;
+  repeated google.protobuf.Struct whitelist = 4;
+  bool ns_networkpolicy = 5; // 是否应用网络策略
+}
+
+message DisposeWarningGroupsResponse {
+  int64 code = 1;
+  string message = 2;
+  google.protobuf.Struct data = 3;
+}
+
+// --- ListVulnerabilities ---
+
+message ListVulnerabilitiesRequest {
+  google.protobuf.Struct filter = 1;
+  int64 from = 2;
+  int64 limit = 3;
+}
+
+message ListVulnerabilitiesResponse {
+  int64 code = 1;
+  string message = 2;
+  google.protobuf.Struct data = 3;
+}
+
+// --- ListHosts ---
+
+message ListHostsRequest {
+  google.protobuf.Struct filter = 1;
+  string user = 2; // DISS API 登录用户，默认 "admin"
+  int64 from = 3;
+  int64 limit = 4;
+}
+
+message ListHostsResponse {
+  int64 code = 1;
+  string message = 2;
+  google.protobuf.Struct data = 3;
+}
+
+// --- ListContainers ---
+
+message ListContainersRequest {
+  google.protobuf.Struct filter = 1;
+  int64 from = 2;
+  int64 limit = 3;
+}
+
+message ListContainersResponse {
+  int64 code = 1;
+  string message = 2;
+  google.protobuf.Struct data = 3;
+}
+
+// --- ListClusters ---
+
+message ListClustersRequest {
+  google.protobuf.Struct filter = 1;
+  int64 from = 2;
+  int64 limit = 3;
+}
+
+message ListClustersResponse {
+  int64 code = 1;
+  string message = 2;
+  google.protobuf.Struct data = 3;
+}
+
+// --- ContainerControl ---
+
+message ContainerControlRequest {
+  string action = 1;          // 操作：resume / start / activate / deactivate
+  string container_id = 2;    // 容器 ID
+  string container_name = 3;  // 容器名称，可选
+  string host_id = 4;         // 主机 ID，可选
+  string cluster_id = 5;      // 集群 ID，可选
+  string analysis = 6;        // 处置说明，可选
+}
+
+message ContainerControlResponse {
+  int64 code = 1;
+  string message = 2;
+  google.protobuf.Struct data = 3;
+}
+
+// --- UnblockNetwork ---
+
+message UnblockNetworkRequest {
+  string container_id = 1;    // 容器 ID
+  string host_id = 2;         // 主机 ID，可选
+  string cluster_id = 3;      // 集群 ID，可选
+}
+
+message UnblockNetworkResponse {
+  int64 code = 1;
+  string message = 2;
+  google.protobuf.Struct data = 3;
+}

services/anyi__cloud-native-security/secret.schema.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "additionalProperties": true,
+  "properties": {
+    "token": {
+      "type": "string",
+      "description": "Anyi DISS API JWT token for Authorization: Bearer <token>."
+    }
+  }
+}

services/anyi__cloud-native-security/service.json

@@ -0,0 +1,31 @@
+{
+  "schema": "chaitin.octobus.service.v1",
+  "name": "anyi-cloud-native-security",
+  "displayName": "Anyi Cloud Native Security",
+  "description": "OctoBus package for Anyi Cloud Native Security Platform (DISS) alert, vulnerability, asset, and container control APIs.",
+  "runtime": {
+    "mode": "long-running"
+  },
+  "proto": {
+    "roots": ["proto"],
+    "files": ["proto/anyi_cloud_native_security.proto"]
+  },
+  "configSchema": "config.schema.json",
+  "secretSchema": "secret.schema.json",
+  "sdk": {
+    "cli": {
+      "commands": {
+        "Anyi_CloudNativeSecurity.Anyi_CloudNativeSecurity/ListWarnings": { "name": "list-warnings", "description": "List security warnings from Anyi DISS." },
+        "Anyi_CloudNativeSecurity.Anyi_CloudNativeSecurity/ListWarningGroups": { "name": "list-warning-groups", "description": "List aggregated warning groups from Anyi DISS." },
+        "Anyi_CloudNativeSecurity.Anyi_CloudNativeSecurity/DisposeWarnings": { "name": "dispose-warnings", "description": "Dispose warnings (isolation/pause/stop/kill)." },
+        "Anyi_CloudNativeSecurity.Anyi_CloudNativeSecurity/DisposeWarningGroups": { "name": "dispose-warning-groups", "description": "Dispose aggregated warning groups." },
+        "Anyi_CloudNativeSecurity.Anyi_CloudNativeSecurity/ListVulnerabilities": { "name": "list-vulnerabilities", "description": "List image vulnerabilities from Anyi DISS." },
+        "Anyi_CloudNativeSecurity.Anyi_CloudNativeSecurity/ListHosts": { "name": "list-hosts", "description": "List host assets from Anyi DISS." },
+        "Anyi_CloudNativeSecurity.Anyi_CloudNativeSecurity/ListContainers": { "name": "list-containers", "description": "List container assets from Anyi DISS." },
+        "Anyi_CloudNativeSecurity.Anyi_CloudNativeSecurity/ListClusters": { "name": "list-clusters", "description": "List K8s clusters from Anyi DISS." },
+        "Anyi_CloudNativeSecurity.Anyi_CloudNativeSecurity/ContainerControl": { "name": "container-control", "description": "Control container (resume/start/activate/deactivate)." },
+        "Anyi_CloudNativeSecurity.Anyi_CloudNativeSecurity/UnblockNetwork": { "name": "unblock-network", "description": "Unblock container network isolation." }
+      }
+    }
+  }
+}