diff --git a/auto-discovery/kubernetes/.helm-docs.gotmpl b/auto-discovery/kubernetes/.helm-docs.gotmpl index 29f26736d7..9d67d1d722 100644 --- a/auto-discovery/kubernetes/.helm-docs.gotmpl +++ b/auto-discovery/kubernetes/.helm-docs.gotmpl @@ -23,7 +23,7 @@ The Kubernetes AutoDiscovery needs to be deployed along side the secureCodeBox O The AutoDiscovery controller will automatically detect these new resources (services and containers) and start secureCodeBox _scans_ for them: -1. A ZAP Baseline Scan to detect basic web vulnerabilities in the service. (Using ZAP) +1. A ZAP Baseline Scan to detect basic web vulnerabilities in the service. (Using ZAP-automation-framework) 2. An image scan scanning for vulnerable libraries in the docker / container image of the deployment. (Using trivy) 3. (WIP) A TLS Scan against the certificate of the ingress for the host. (Using SSLyze) @@ -44,9 +44,9 @@ This example deploys [JuiceShop](https://owasp.org/www-project-juice-shop/) to a (You can find the kubernetes manifests for the deployment [here](./demo/juice-shop.yaml)) The AutoDiscovery will automatically pick up this new deployment and then starts a ZAP Scan against it. -The scan created uses our `zap-advanced` ScanType by default, this can be changed with the `config.serviceAutoDiscovery.scanConfig.scanType` config on the autoDiscovery helm release. +The scan created uses our `zap-automation-framework` ScanType by default, this can be changed with the `config.serviceAutoDiscovery.scanConfig.scanType` config on the autoDiscovery helm release. -When the ContainerAutoDiscovery is enabled, the AutoDiscovery can also create a trivy scan for each unique container image (having multiple pods with the same container will only create one scan). The scan type can be defined with `config.containerAutoDiscovery.scanConfig.scanType`. +When the ContainerAutoDiscovery is enabled, the AutoDiscovery can also create a trivy scan for each unique container image (having multiple pods with the same container will only create one scan). The ScanType can be defined with `config.containerAutoDiscovery.scanConfig.scanType`. {{- end }} {{- define "extra.scannerConfigurationSection" -}} diff --git a/auto-discovery/kubernetes/README.md b/auto-discovery/kubernetes/README.md index a65b4eefc7..cd172881b3 100644 --- a/auto-discovery/kubernetes/README.md +++ b/auto-discovery/kubernetes/README.md @@ -16,7 +16,7 @@ The Kubernetes AutoDiscovery needs to be deployed along side the secureCodeBox O The AutoDiscovery controller will automatically detect these new resources (services and containers) and start secureCodeBox _scans_ for them: -1. A ZAP Baseline Scan to detect basic web vulnerabilities in the service. (Using ZAP) +1. A ZAP Baseline Scan to detect basic web vulnerabilities in the service. (Using ZAP-automation-framework) 2. An image scan scanning for vulnerable libraries in the docker / container image of the deployment. (Using trivy) 3. (WIP) A TLS Scan against the certificate of the ingress for the host. (Using SSLyze) @@ -58,9 +58,9 @@ This example deploys [JuiceShop](https://owasp.org/www-project-juice-shop/) to a (You can find the kubernetes manifests for the deployment [here](./demo/juice-shop.yaml)) The AutoDiscovery will automatically pick up this new deployment and then starts a ZAP Scan against it. -The scan created uses our `zap-advanced` ScanType by default, this can be changed with the `config.serviceAutoDiscovery.scanConfig.scanType` config on the autoDiscovery helm release. +The scan created uses our `zap-automation-framework` ScanType by default, this can be changed with the `config.serviceAutoDiscovery.scanConfig.scanType` config on the autoDiscovery helm release. -When the ContainerAutoDiscovery is enabled, the AutoDiscovery can also create a trivy scan for each unique container image (having multiple pods with the same container will only create one scan). The scan type can be defined with `config.containerAutoDiscovery.scanConfig.scanType`. +When the ContainerAutoDiscovery is enabled, the AutoDiscovery can also create a trivy scan for each unique container image (having multiple pods with the same container will only create one scan). The ScanType can be defined with `config.containerAutoDiscovery.scanConfig.scanType`. ## Deployment The auto-discovery-kubernetes chart can be deployed via helm: @@ -157,16 +157,15 @@ kubectl -n juice-shop annotate service juice-shop auto-discovery.securecodebox.i | config.resourceInclusion.mode | string | `"enabled-per-namespace"` | | | config.serviceAutoDiscovery.enabled | bool | `true` | | | config.serviceAutoDiscovery.passiveReconcileInterval | string | `"1m"` | interval in which every service is re-checked for updated pods, if service object is updated directly this the service will get reconciled immediately | -| config.serviceAutoDiscovery.scanConfigs[0] | object | `{"annotations":{"defectdojo.securecodebox.io/engagement-name":"{{ .Target.Name }}","defectdojo.securecodebox.io/engagement-version":"{{if (index .Target.Labels `app.kubernetes.io/version`) }}{{ index .Target.Labels `app.kubernetes.io/version` }}{{end}}","defectdojo.securecodebox.io/product-name":"{{ .Cluster.Name }} | {{ .Namespace.Name }} | {{ .Target.Name }}","defectdojo.securecodebox.io/product-tags":"cluster/{{ .Cluster.Name }},namespace/{{ .Namespace.Name }}"},"env":[],"hookSelector":{},"labels":{},"name":"zap","parameters":["-t","{{ .Host.Type }}://{{ .Service.Name }}.{{ .Service.Namespace }}.svc:{{ .Host.Port }}"],"repeatInterval":"168h","scanType":"zap-advanced-scan","volumeMounts":[],"volumes":[]}` | scanType used for the scans created by the serviceAutoDiscovery | +| config.serviceAutoDiscovery.scanConfigs[0] | object | `{"annotations":{"defectdojo.securecodebox.io/engagement-name":"{{ .Target.Name }}","defectdojo.securecodebox.io/engagement-version":"{{if (index .Target.Labels `app.kubernetes.io/version`) }}{{ index .Target.Labels `app.kubernetes.io/version` }}{{end}}","defectdojo.securecodebox.io/product-name":"{{ .Cluster.Name }} | {{ .Namespace.Name }} | {{ .Target.Name }}","defectdojo.securecodebox.io/product-tags":"cluster/{{ .Cluster.Name }},namespace/{{ .Namespace.Name }}"},"env":[{"name":"TARGET_URL","value":"{{ .Host.Type }}://{{ .Service.Name }}.{{ .Service.Namespace }}.svc:{{ .Host.Port }}"}],"hookSelector":{},"labels":{},"name":"zap","parameters":["-autorun","/home/securecodebox/scb-automation/automation.yaml"],"repeatInterval":"168h","scanType":"zap-automation-framework","volumeMounts":[{"mountPath":"/home/securecodebox/scb-automation/automation.yaml","name":"zap-automation-framework-baseline-config","subPath":"automation.yaml"}],"volumes":[{"configMap":{"name":"zap-automation-framework-baseline-config"},"name":"zap-automation-framework-baseline-config"}]}` | scanType used for the scans created by the serviceAutoDiscovery | | config.serviceAutoDiscovery.scanConfigs[0].annotations | object | `{"defectdojo.securecodebox.io/engagement-name":"{{ .Target.Name }}","defectdojo.securecodebox.io/engagement-version":"{{if (index .Target.Labels `app.kubernetes.io/version`) }}{{ index .Target.Labels `app.kubernetes.io/version` }}{{end}}","defectdojo.securecodebox.io/product-name":"{{ .Cluster.Name }} | {{ .Namespace.Name }} | {{ .Target.Name }}","defectdojo.securecodebox.io/product-tags":"cluster/{{ .Cluster.Name }},namespace/{{ .Namespace.Name }}"}` | annotations to be added to the scans started by the auto-discovery, all annotation values support templating | -| config.serviceAutoDiscovery.scanConfigs[0].env | list | `[]` | allows to overwrite the env var list of the scan job. the value field supports templating. | +| config.serviceAutoDiscovery.scanConfigs[0].env | list | `[{"name":"TARGET_URL","value":"{{ .Host.Type }}://{{ .Service.Name }}.{{ .Service.Namespace }}.svc:{{ .Host.Port }}"}]` | allows to overwrite the env var list of the scan job. the value field supports templating. | | config.serviceAutoDiscovery.scanConfigs[0].hookSelector | object | `{}` | HookSelector allows to specify a LabelSelector with which the hooks are selected, see: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors Both matchLabels and matchExpressions are supported. All values in the matchLabels map support templating. MatchExpressions support templating in the `key` field and in every entry in the `values` list. If a value in the list renders to an empty string it is removed from the list. | | config.serviceAutoDiscovery.scanConfigs[0].labels | object | `{}` | labels to be added to the scans started by the auto-discovery, all label values support templating | | config.serviceAutoDiscovery.scanConfigs[0].name | string | `"zap"` | unique name to distinguish scans | -| config.serviceAutoDiscovery.scanConfigs[0].parameters | list | `["-t","{{ .Host.Type }}://{{ .Service.Name }}.{{ .Service.Namespace }}.svc:{{ .Host.Port }}"]` | parameters used for the scans created by the serviceAutoDiscovery, all parameters support templating | -| config.serviceAutoDiscovery.scanConfigs[0].repeatInterval | string | `"168h"` | interval in which scans are automatically repeated. If the target is updated (meaning a new image revision is deployed) the scan will repeated beforehand and the interval is reset. | -| config.serviceAutoDiscovery.scanConfigs[0].volumeMounts | list | `[]` | volumeMounts to add to the scan job, see: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes-1 the fields: `name`, `mountPath`, `subPath`, `subPathExpr` of each volumeMount support templating | -| config.serviceAutoDiscovery.scanConfigs[0].volumes | list | `[]` | volumes to add to the scan job, see: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes the fields: `name`, `secret.secretName`, `configMap.name` of each volume support templating | +| config.serviceAutoDiscovery.scanConfigs[0].parameters | list | `["-autorun","/home/securecodebox/scb-automation/automation.yaml"]` | parameters used for the scans created by the serviceAutoDiscovery, all parameters support templating | +| config.serviceAutoDiscovery.scanConfigs[0].volumeMounts | list | `[{"mountPath":"/home/securecodebox/scb-automation/automation.yaml","name":"zap-automation-framework-baseline-config","subPath":"automation.yaml"}]` | volumeMounts to add to the scan job, see: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes-1 the fields: `name`, `mountPath`, `subPath`, `subPathExpr` of each volumeMount support templating | +| config.serviceAutoDiscovery.scanConfigs[0].volumes | list | `[{"configMap":{"name":"zap-automation-framework-baseline-config"},"name":"zap-automation-framework-baseline-config"}]` | volumes to add to the scan job, see: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes the fields: `name`, `secret.secretName`, `configMap.name` of each volume support templating | | image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | image.repository | string | `"securecodebox/auto-discovery-kubernetes"` | | | image.tag | string | `nil` | | diff --git a/auto-discovery/kubernetes/demo/juice-shop.yaml b/auto-discovery/kubernetes/demo/juice-shop.yaml index 3afcee906d..63f97d930d 100644 --- a/auto-discovery/kubernetes/demo/juice-shop.yaml +++ b/auto-discovery/kubernetes/demo/juice-shop.yaml @@ -61,10 +61,10 @@ spec: apiVersion: helm.fluxcd.io/v1 kind: HelmRelease metadata: - name: zap-advanced + name: zap-automation-framework namespace: juice-shop spec: chart: repository: https://charts.securecodebox.io version: 3.2.0 - name: zap-advanced + name: zap-automation-framework diff --git a/auto-discovery/kubernetes/docs/README.ArtifactHub.md b/auto-discovery/kubernetes/docs/README.ArtifactHub.md index b3b692dfaa..19a24487d6 100644 --- a/auto-discovery/kubernetes/docs/README.ArtifactHub.md +++ b/auto-discovery/kubernetes/docs/README.ArtifactHub.md @@ -50,9 +50,9 @@ This example deploys [JuiceShop](https://owasp.org/www-project-juice-shop/) to a (You can find the kubernetes manifests for the deployment [here](./demo/juice-shop.yaml)) The AutoDiscovery will automatically pick up this new deployment and then starts a ZAP Scan against it. -The scan created uses our `zap-advanced` ScanType by default, this can be changed with the `config.serviceAutoDiscovery.scanConfig.scanType` config on the autoDiscovery helm release. +The scan created uses our `zap-automation-framework` ScanType by default, this can be changed with the `config.serviceAutoDiscovery.scanConfig.scanType` config on the autoDiscovery helm release. -When the ContainerAutoDiscovery is enabled, the AutoDiscovery can also create a trivy scan for each unique container image (having multiple pods with the same container will only create one scan). The scan type can be defined with `config.containerAutoDiscovery.scanConfig.scanType`. +When the ContainerAutoDiscovery is enabled, the AutoDiscovery can also create a trivy scan for each unique container image (having multiple pods with the same container will only create one scan). The ScanType can be defined with `config.containerAutoDiscovery.scanConfig.scanType`. ## Deployment The auto-discovery-kubernetes chart can be deployed via helm: @@ -149,16 +149,15 @@ kubectl -n juice-shop annotate service juice-shop auto-discovery.securecodebox.i | config.resourceInclusion.mode | string | `"enabled-per-namespace"` | | | config.serviceAutoDiscovery.enabled | bool | `true` | | | config.serviceAutoDiscovery.passiveReconcileInterval | string | `"1m"` | interval in which every service is re-checked for updated pods, if service object is updated directly this the service will get reconciled immediately | -| config.serviceAutoDiscovery.scanConfigs[0] | object | `{"annotations":{"defectdojo.securecodebox.io/engagement-name":"{{ .Target.Name }}","defectdojo.securecodebox.io/engagement-version":"{{if (index .Target.Labels `app.kubernetes.io/version`) }}{{ index .Target.Labels `app.kubernetes.io/version` }}{{end}}","defectdojo.securecodebox.io/product-name":"{{ .Cluster.Name }} | {{ .Namespace.Name }} | {{ .Target.Name }}","defectdojo.securecodebox.io/product-tags":"cluster/{{ .Cluster.Name }},namespace/{{ .Namespace.Name }}"},"env":[],"hookSelector":{},"labels":{},"name":"zap","parameters":["-t","{{ .Host.Type }}://{{ .Service.Name }}.{{ .Service.Namespace }}.svc:{{ .Host.Port }}"],"repeatInterval":"168h","scanType":"zap-advanced-scan","volumeMounts":[],"volumes":[]}` | scanType used for the scans created by the serviceAutoDiscovery | +| config.serviceAutoDiscovery.scanConfigs[0] | object | `{"annotations":{"defectdojo.securecodebox.io/engagement-name":"{{ .Target.Name }}","defectdojo.securecodebox.io/engagement-version":"{{if (index .Target.Labels `app.kubernetes.io/version`) }}{{ index .Target.Labels `app.kubernetes.io/version` }}{{end}}","defectdojo.securecodebox.io/product-name":"{{ .Cluster.Name }} | {{ .Namespace.Name }} | {{ .Target.Name }}","defectdojo.securecodebox.io/product-tags":"cluster/{{ .Cluster.Name }},namespace/{{ .Namespace.Name }}"},"env":[{"name":"TARGET_URL","value":"{{ .Host.Type }}://{{ .Service.Name }}.{{ .Service.Namespace }}.svc:{{ .Host.Port }}"}],"hookSelector":{},"labels":{},"name":"zap","parameters":["-autorun","/home/securecodebox/scb-automation/automation.yaml"],"repeatInterval":"168h","scanType":"zap-automation-framework","volumeMounts":[{"mountPath":"/home/securecodebox/scb-automation/automation.yaml","name":"zap-automation-framework-baseline-config","subPath":"automation.yaml"}],"volumes":[{"configMap":{"name":"zap-automation-framework-baseline-config"},"name":"zap-automation-framework-baseline-config"}]}` | scanType used for the scans created by the serviceAutoDiscovery | | config.serviceAutoDiscovery.scanConfigs[0].annotations | object | `{"defectdojo.securecodebox.io/engagement-name":"{{ .Target.Name }}","defectdojo.securecodebox.io/engagement-version":"{{if (index .Target.Labels `app.kubernetes.io/version`) }}{{ index .Target.Labels `app.kubernetes.io/version` }}{{end}}","defectdojo.securecodebox.io/product-name":"{{ .Cluster.Name }} | {{ .Namespace.Name }} | {{ .Target.Name }}","defectdojo.securecodebox.io/product-tags":"cluster/{{ .Cluster.Name }},namespace/{{ .Namespace.Name }}"}` | annotations to be added to the scans started by the auto-discovery, all annotation values support templating | -| config.serviceAutoDiscovery.scanConfigs[0].env | list | `[]` | allows to overwrite the env var list of the scan job. the value field supports templating. | +| config.serviceAutoDiscovery.scanConfigs[0].env | list | `[{"name":"TARGET_URL","value":"{{ .Host.Type }}://{{ .Service.Name }}.{{ .Service.Namespace }}.svc:{{ .Host.Port }}"}]` | allows to overwrite the env var list of the scan job. the value field supports templating. | | config.serviceAutoDiscovery.scanConfigs[0].hookSelector | object | `{}` | HookSelector allows to specify a LabelSelector with which the hooks are selected, see: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors Both matchLabels and matchExpressions are supported. All values in the matchLabels map support templating. MatchExpressions support templating in the `key` field and in every entry in the `values` list. If a value in the list renders to an empty string it is removed from the list. | | config.serviceAutoDiscovery.scanConfigs[0].labels | object | `{}` | labels to be added to the scans started by the auto-discovery, all label values support templating | | config.serviceAutoDiscovery.scanConfigs[0].name | string | `"zap"` | unique name to distinguish scans | -| config.serviceAutoDiscovery.scanConfigs[0].parameters | list | `["-t","{{ .Host.Type }}://{{ .Service.Name }}.{{ .Service.Namespace }}.svc:{{ .Host.Port }}"]` | parameters used for the scans created by the serviceAutoDiscovery, all parameters support templating | -| config.serviceAutoDiscovery.scanConfigs[0].repeatInterval | string | `"168h"` | interval in which scans are automatically repeated. If the target is updated (meaning a new image revision is deployed) the scan will repeated beforehand and the interval is reset. | -| config.serviceAutoDiscovery.scanConfigs[0].volumeMounts | list | `[]` | volumeMounts to add to the scan job, see: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes-1 the fields: `name`, `mountPath`, `subPath`, `subPathExpr` of each volumeMount support templating | -| config.serviceAutoDiscovery.scanConfigs[0].volumes | list | `[]` | volumes to add to the scan job, see: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes the fields: `name`, `secret.secretName`, `configMap.name` of each volume support templating | +| config.serviceAutoDiscovery.scanConfigs[0].parameters | list | `["-autorun","/home/securecodebox/scb-automation/automation.yaml"]` | parameters used for the scans created by the serviceAutoDiscovery, all parameters support templating | +| config.serviceAutoDiscovery.scanConfigs[0].volumeMounts | list | `[{"mountPath":"/home/securecodebox/scb-automation/automation.yaml","name":"zap-automation-framework-baseline-config","subPath":"automation.yaml"}]` | volumeMounts to add to the scan job, see: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes-1 the fields: `name`, `mountPath`, `subPath`, `subPathExpr` of each volumeMount support templating | +| config.serviceAutoDiscovery.scanConfigs[0].volumes | list | `[{"configMap":{"name":"zap-automation-framework-baseline-config"},"name":"zap-automation-framework-baseline-config"}]` | volumes to add to the scan job, see: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes the fields: `name`, `secret.secretName`, `configMap.name` of each volume support templating | | image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | image.repository | string | `"securecodebox/auto-discovery-kubernetes"` | | | image.tag | string | `nil` | | diff --git a/auto-discovery/kubernetes/docs/README.DockerHub-Core.md b/auto-discovery/kubernetes/docs/README.DockerHub-Core.md index 2668749495..4e7fcc3ad0 100644 --- a/auto-discovery/kubernetes/docs/README.DockerHub-Core.md +++ b/auto-discovery/kubernetes/docs/README.DockerHub-Core.md @@ -57,9 +57,9 @@ This example deploys [JuiceShop](https://owasp.org/www-project-juice-shop/) to a (You can find the kubernetes manifests for the deployment [here](./demo/juice-shop.yaml)) The AutoDiscovery will automatically pick up this new deployment and then starts a ZAP Scan against it. -The scan created uses our `zap-advanced` ScanType by default, this can be changed with the `config.serviceAutoDiscovery.scanConfig.scanType` config on the autoDiscovery helm release. +The scan created uses our `zap-automation-framework` ScanType by default, this can be changed with the `config.serviceAutoDiscovery.scanConfig.scanType` config on the autoDiscovery helm release. -When the ContainerAutoDiscovery is enabled, the AutoDiscovery can also create a trivy scan for each unique container image (having multiple pods with the same container will only create one scan). The scan type can be defined with `config.containerAutoDiscovery.scanConfig.scanType`. +When the ContainerAutoDiscovery is enabled, the AutoDiscovery can also create a trivy scan for each unique container image (having multiple pods with the same container will only create one scan). The ScanType can be defined with `config.containerAutoDiscovery.scanConfig.scanType`. ## Community diff --git a/auto-discovery/kubernetes/pkg/util/__testfiles__/valid_config_test.yaml b/auto-discovery/kubernetes/pkg/util/__testfiles__/valid_config_test.yaml index 706a5e8d44..36915a45dd 100644 --- a/auto-discovery/kubernetes/pkg/util/__testfiles__/valid_config_test.yaml +++ b/auto-discovery/kubernetes/pkg/util/__testfiles__/valid_config_test.yaml @@ -15,11 +15,11 @@ serviceAutoDiscovery: enabled: true passiveReconcileInterval: 1m scanConfigs: - - scanType: zap-advanced-scan + - scanType: zap-automation-framework name: "zap" parameters: - - "-t" - - "{{ .Host.Type }}://{{ .Service.Name }}.{{ .Service.Namespace }}.svc:{{ .Host.Port }}" + - "-autorun" + - "/home/securecodebox/scb-automation/automation.yaml" repeatInterval: "168h" labels: {} annotations: @@ -28,24 +28,24 @@ serviceAutoDiscovery: defectdojo.securecodebox.io/engagement-name: "{{ .Target.Name }}" defectdojo.securecodebox.io/engagement-version: "{{if (index .Target.Labels `app.kubernetes.io/version`) }}{{ index .Target.Labels `app.kubernetes.io/version` }}{{end}}" volumes: - - name: zap-advanced-scan-config + - name: zap-automation-framework-baseline-config configMap: - name: zap-advanced-scan-config + name: zap-automation-framework-baseline-config optional: true defaultMode: 420 items: - - key: "2-zap-advanced-scan.yaml" - path: "2-zap-advanced-scan.yaml" + - key: "automation.yaml" + path: "automation.yaml" mode: 420 - key: "extra-config.yaml" path: "extra-config.yaml" mode: 511 volumeMounts: - - name: zap-advanced-scan-config + - name: zap-automation-framework-baseline-config readOnly: true recursiveReadOnly: "Enabled" - mountPath: /home/securecodebox/configs/2-zap-advanced-scan.yaml - subPath: 2-zap-advanced-scan.yaml + mountPath: /home/securecodebox/configs/automation.yaml + subPath: automation.yaml mountPropagation: "Bidirectional" subPathExpr: "$(CONFIG_FILE_NAME)" hookSelector: @@ -99,24 +99,24 @@ containerAutoDiscovery: defectdojo.securecodebox.io/engagement-name: "{{ .Target.Name }}" defectdojo.securecodebox.io/engagement-version: "{{if (index .Target.Labels `app.kubernetes.io/version`) }}{{ index .Target.Labels `app.kubernetes.io/version` }}{{end}}" volumes: - - name: zap-advanced-scan-config + - name: zap-automation-framework-baseline-config configMap: - name: zap-advanced-scan-config + name: zap-automation-framework-baseline-config optional: true defaultMode: 420 items: - - key: "2-zap-advanced-scan.yaml" - path: "2-zap-advanced-scan.yaml" + - key: "automation.yaml" + path: "automation.yaml" mode: 420 - key: "extra-config.yaml" path: "extra-config.yaml" mode: 511 volumeMounts: - - name: zap-advanced-scan-config + - name: zap-automation-framework-baseline-config readOnly: true recursiveReadOnly: "Enabled" - mountPath: /home/securecodebox/configs/2-zap-advanced-scan.yaml - subPath: 2-zap-advanced-scan.yaml + mountPath: /home/securecodebox/configs/automation.yaml + subPath: automation.yaml mountPropagation: "Bidirectional" subPathExpr: "$(CONFIG_FILE_NAME)" hookSelector: diff --git a/auto-discovery/kubernetes/pkg/util/config_loader_test.go b/auto-discovery/kubernetes/pkg/util/config_loader_test.go index 3d4f4abd2a..e3866db5ec 100644 --- a/auto-discovery/kubernetes/pkg/util/config_loader_test.go +++ b/auto-discovery/kubernetes/pkg/util/config_loader_test.go @@ -45,11 +45,11 @@ var _ = Describe("LoadAutoDiscoveryConfig", func() { sc := sad.ScanConfigs[0] Expect(sc.Name).To(Equal("zap")) - Expect(sc.ScanType).To(Equal("zap-advanced-scan")) + Expect(sc.ScanType).To(Equal("zap-automation-framework")) Expect(sc.RepeatInterval.Duration).To(Equal(168 * time.Hour)) Expect(sc.Parameters).To(Equal([]string{ - "-t", - "{{ .Host.Type }}://{{ .Service.Name }}.{{ .Service.Namespace }}.svc:{{ .Host.Port }}", + "-autorun", + "/home/securecodebox/scb-automation/automation.yaml", })) Expect(sc.Labels).To(BeEmpty()) Expect(sc.Annotations).To(HaveKeyWithValue("defectdojo.securecodebox.io/product-name", "{{ .Cluster.Name }} | {{ .Namespace.Name }} | {{ .Target.Name }}")) @@ -60,19 +60,19 @@ var _ = Describe("LoadAutoDiscoveryConfig", func() { // Validate volumes of the service scan config. Expect(sc.Volumes).To(HaveLen(1)) vol := sc.Volumes[0] - Expect(vol.Name).To(Equal("zap-advanced-scan-config")) + Expect(vol.Name).To(Equal("zap-automation-framework-baseline-config")) Expect(vol.ConfigMap).NotTo(BeNil()) cm := vol.ConfigMap // The ConfigMap volume source. - Expect(cm.Name).To(Equal("zap-advanced-scan-config")) + Expect(cm.Name).To(Equal("zap-automation-framework-baseline-config")) // Optional is a pointer. Expect(*cm.Optional).To(BeTrue()) Expect(*cm.DefaultMode).To(Equal(int32(420))) Expect(cm.Items).To(HaveLen(2)) // First key-to-path mapping. firstItem := cm.Items[0] - Expect(firstItem.Key).To(Equal("2-zap-advanced-scan.yaml")) - Expect(firstItem.Path).To(Equal("2-zap-advanced-scan.yaml")) + Expect(firstItem.Key).To(Equal("automation.yaml")) + Expect(firstItem.Path).To(Equal("automation.yaml")) Expect(*firstItem.Mode).To(Equal(int32(420))) // Second key-to-path mapping. secondItem := cm.Items[1] @@ -83,12 +83,12 @@ var _ = Describe("LoadAutoDiscoveryConfig", func() { // Validate volumeMounts of the service scan config. Expect(sc.VolumeMounts).To(HaveLen(1)) vm := sc.VolumeMounts[0] - Expect(vm.Name).To(Equal("zap-advanced-scan-config")) + Expect(vm.Name).To(Equal("zap-automation-framework-baseline-config")) Expect(vm.ReadOnly).To(BeTrue()) // recursiveReadOnly is a pointer to a string in the struct. Expect(*vm.RecursiveReadOnly).To(Equal(corev1.RecursiveReadOnlyEnabled)) - Expect(vm.MountPath).To(Equal("/home/securecodebox/configs/2-zap-advanced-scan.yaml")) - Expect(vm.SubPath).To(Equal("2-zap-advanced-scan.yaml")) + Expect(vm.MountPath).To(Equal("/home/securecodebox/configs/automation.yaml")) + Expect(vm.SubPath).To(Equal("automation.yaml")) // mountPropagation is also a pointer. Expect(*vm.MountPropagation).To(Equal(corev1.MountPropagationBidirectional)) Expect(vm.SubPathExpr).To(Equal("$(CONFIG_FILE_NAME)")) @@ -179,16 +179,16 @@ var _ = Describe("LoadAutoDiscoveryConfig", func() { // Validate volumes of the container scan config. Expect(sc2.Volumes).To(HaveLen(1)) vol2 := sc2.Volumes[0] - Expect(vol2.Name).To(Equal("zap-advanced-scan-config")) + Expect(vol2.Name).To(Equal("zap-automation-framework-baseline-config")) Expect(vol2.ConfigMap).NotTo(BeNil()) cm2 := vol2.ConfigMap - Expect(cm2.Name).To(Equal("zap-advanced-scan-config")) + Expect(cm2.Name).To(Equal("zap-automation-framework-baseline-config")) Expect(*cm2.Optional).To(BeTrue()) Expect(*cm2.DefaultMode).To(Equal(int32(420))) Expect(cm2.Items).To(HaveLen(2)) firstItem = cm2.Items[0] - Expect(firstItem.Key).To(Equal("2-zap-advanced-scan.yaml")) - Expect(firstItem.Path).To(Equal("2-zap-advanced-scan.yaml")) + Expect(firstItem.Key).To(Equal("automation.yaml")) + Expect(firstItem.Path).To(Equal("automation.yaml")) Expect(*firstItem.Mode).To(Equal(int32(420))) secondItem = cm2.Items[1] Expect(secondItem.Key).To(Equal("extra-config.yaml")) @@ -198,11 +198,11 @@ var _ = Describe("LoadAutoDiscoveryConfig", func() { // Validate volumeMounts of the container scan config. Expect(sc2.VolumeMounts).To(HaveLen(1)) vm = sc2.VolumeMounts[0] - Expect(vm.Name).To(Equal("zap-advanced-scan-config")) + Expect(vm.Name).To(Equal("zap-automation-framework-baseline-config")) Expect(vm.ReadOnly).To(BeTrue()) Expect(*vm.RecursiveReadOnly).To(Equal(corev1.RecursiveReadOnlyEnabled)) - Expect(vm.MountPath).To(Equal("/home/securecodebox/configs/2-zap-advanced-scan.yaml")) - Expect(vm.SubPath).To(Equal("2-zap-advanced-scan.yaml")) + Expect(vm.MountPath).To(Equal("/home/securecodebox/configs/automation.yaml")) + Expect(vm.SubPath).To(Equal("automation.yaml")) Expect(*vm.MountPropagation).To(Equal(corev1.MountPropagationBidirectional)) Expect(vm.SubPathExpr).To(Equal("$(CONFIG_FILE_NAME)")) diff --git a/auto-discovery/kubernetes/tests/__snapshot__/auto-discovery_test.yaml.snap b/auto-discovery/kubernetes/tests/__snapshot__/auto-discovery_test.yaml.snap index 352a084a9a..21e6ce18d3 100644 --- a/auto-discovery/kubernetes/tests/__snapshot__/auto-discovery_test.yaml.snap +++ b/auto-discovery/kubernetes/tests/__snapshot__/auto-discovery_test.yaml.snap @@ -63,18 +63,36 @@ matches the snapshot: "defectdojo.securecodebox.io/product-name": "{{ .Cluster.Name }} | {{ .Namespace.Name }} | {{ .Target.Name }}", "defectdojo.securecodebox.io/product-tags": "cluster/{{ .Cluster.Name }},namespace/{{ .Namespace.Name }}" }, - "env": [], + "env": [ + { + "name": "TARGET_URL", + "value": "{{ .Host.Type }}://{{ .Service.Name }}.{{ .Service.Namespace }}.svc:{{ .Host.Port }}" + } + ], "hookSelector": {}, "labels": {}, "name": "zap", "parameters": [ - "-t", - "{{ .Host.Type }}://{{ .Service.Name }}.{{ .Service.Namespace }}.svc:{{ .Host.Port }}" + "-autorun", + "/home/securecodebox/scb-automation/automation.yaml" ], "repeatInterval": "168h", - "scanType": "zap-advanced-scan", - "volumeMounts": [], - "volumes": [] + "scanType": "zap-automation-framework", + "volumeMounts": [ + { + "mountPath": "/home/securecodebox/scb-automation/automation.yaml", + "name": "zap-automation-framework-baseline-config", + "subPath": "automation.yaml" + } + ], + "volumes": [ + { + "configMap": { + "name": "zap-automation-framework-baseline-config" + }, + "name": "zap-automation-framework-baseline-config" + } + ] } ] } diff --git a/auto-discovery/kubernetes/values.yaml b/auto-discovery/kubernetes/values.yaml index 13520f8fa4..2f2616aac7 100644 --- a/auto-discovery/kubernetes/values.yaml +++ b/auto-discovery/kubernetes/values.yaml @@ -27,14 +27,13 @@ config: passiveReconcileInterval: 1m scanConfigs: # -- scanType used for the scans created by the serviceAutoDiscovery - - scanType: zap-advanced-scan + - scanType: "zap-automation-framework" # -- unique name to distinguish scans name: "zap" # -- parameters used for the scans created by the serviceAutoDiscovery, all parameters support templating parameters: - - "-t" - - "{{ .Host.Type }}://{{ .Service.Name }}.{{ .Service.Namespace }}.svc:{{ .Host.Port }}" - # -- interval in which scans are automatically repeated. If the target is updated (meaning a new image revision is deployed) the scan will repeated beforehand and the interval is reset. + - "-autorun" + - "/home/securecodebox/scb-automation/automation.yaml" repeatInterval: "168h" # -- labels to be added to the scans started by the auto-discovery, all label values support templating labels: {} @@ -46,10 +45,17 @@ config: defectdojo.securecodebox.io/engagement-version: "{{if (index .Target.Labels `app.kubernetes.io/version`) }}{{ index .Target.Labels `app.kubernetes.io/version` }}{{end}}" # -- volumes to add to the scan job, see: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes # the fields: `name`, `secret.secretName`, `configMap.name` of each volume support templating - volumes: [] + volumes: + - name: zap-automation-framework-baseline-config + configMap: + name: "zap-automation-framework-baseline-config" + # -- volumeMounts to add to the scan job, see: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes-1 # the fields: `name`, `mountPath`, `subPath`, `subPathExpr` of each volumeMount support templating - volumeMounts: [] + volumeMounts: + - name: zap-automation-framework-baseline-config + mountPath: /home/securecodebox/scb-automation/automation.yaml + subPath: automation.yaml # -- HookSelector allows to specify a LabelSelector with which the hooks are selected, see: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors # Both matchLabels and matchExpressions are supported. # All values in the matchLabels map support templating. @@ -57,7 +63,10 @@ config: hookSelector: {} # -- allows to overwrite the env var list of the scan job. # the value field supports templating. - env: [] + env: + - name: TARGET_URL + value: "{{ .Host.Type }}://{{ .Service.Name }}.{{ .Service.Namespace }}.svc:{{ .Host.Port }}" + containerAutoDiscovery: enabled: false diff --git a/documentation/docs/auto-discovery/installation.md b/documentation/docs/auto-discovery/installation.md index 18c5420c28..10109835cc 100644 --- a/documentation/docs/auto-discovery/installation.md +++ b/documentation/docs/auto-discovery/installation.md @@ -32,9 +32,9 @@ To ease the rollout of the auto-discovery in already existing clusters the auto- This behavior can be configured using one of the following `resourceInclusion` modes: - enabled-per-namespace (default) : scans discovered resources in namespaces marked as enabled by an annotation -- enabled-per-resource : only scans resources marked as enabled by an annotation +- enabled-per-resource : only scans resources marked as enabled by an annotation - all (scans every resource in the whole cluster!) - + These modes can be set via the `config.resourceInclusion` parameter in the helm chart: ```bash @@ -52,6 +52,7 @@ Annotating a namespace can be done as follows. Here the default namespace is ann ```bash kubectl annotate namespace default auto-discovery.securecodebox.io/enabled=true ``` + Annotating a individual resource is done as follows. Here the deployment `juice-shop` in the namespace `default` is annotated. It is done by adding the annotation to the chart values, which is then passed to the deployment template. This results into the pod containing the service/deployment always having the annotation. The process may be different in your case: @@ -60,10 +61,10 @@ It is done by adding the annotation to the chart values, which is then passed to helm upgrade --install juice-shop oci://ghcr.io/securecodebox/helm/juice-shop --set-json='annotations={"auto-discovery.securecodebox.io/enabled":"true"}' ``` -You should now see a ZAP-advanced [ScheduledScan](/docs/api/crds/scheduled-scan) created for juice-shop or any other service that you have annotated. +You should now see a ZAP Automation Framework [ScheduledScan](/docs/api/crds/scheduled-scan) created for juice-shop or any other service that you have annotated. ```bash -$ kubectl get scheduledscans.execution.securecodebox.io +$ kubectl get scheduledscans.execution.securecodebox.io NAME TYPE INTERVAL FINDINGS -juice-shop-service-port-3000 zap-advanced-scan 168h0m0s 5 +juice-shop-service-port-3000 zap-automation-framework 168h0m0s 5 ``` \ No newline at end of file diff --git a/documentation/docs/auto-discovery/service-auto-discovery.md b/documentation/docs/auto-discovery/service-auto-discovery.md index fd78da0661..61169a523f 100644 --- a/documentation/docs/auto-discovery/service-auto-discovery.md +++ b/documentation/docs/auto-discovery/service-auto-discovery.md @@ -14,14 +14,14 @@ The Service AutoDiscovery will create a `ScheduledScan` with the given parameter The Service AutoDiscovery will ignore services where the underlying pods do not serve http(s). It does this by checking for open ports `80, 443, 3000, 5000, 8000, 8443, 8080`. It is also sufficient to name the ports `http` or `https` when a different port is used than the ports specified above. Services without a matching port number or name are currently ignored. -By default the Service AutoDiscovery creates [ZAP Advanced](../scanners/zap-advanced.md) for each service. These scans are relatively generic and don't include any configuration regarding authentication / authorization. As the setup and configuration of the ZAP-Advanced Chart is located in each namespace it is possible to tweak the default configuration to support authenticated and more highly configured scans. For guides on how to configure ZAP Advanced refer to the [ZAP Advanced Documentation](../scanners/zap-advanced.md). +By default the Service AutoDiscovery creates [ZAP Automation Framework](../scanners/zap-automation-framework.md) for each service. These scans are relatively generic and don't include any configuration regarding authentication / authorization. As the setup and configuration of the zap-automation-framework Chart is located in each namespace it is possible to tweak the default configuration to support authenticated and more highly configured scans. For guides on how to configure ZAP Automation Framework refer to the [ZAP Automation Framework Documentation](../scanners/zap-automation-framework.md). ### Setup -By default the Service AutoDiscovery creates ScheduledScans using the [ZAP Advanced](/docs/scanners/zap-advanced) `ScanType`. It must be installed in the same namespace as the containers you wish to scan. The following steps will install `zap-advanced` in the `default` namespace: +By default the Service AutoDiscovery creates ScheduledScans using the [ZAP Automation Framework](/docs/scanners/zap-automation-framework) `ScanType`. It must be installed in the same namespace as the containers you wish to scan. The following steps will install `zap-automation-framework` in the `default` namespace: ```bash -helm upgrade --install zap-advanced oci://ghcr.io/securecodebox/helm/zap-advanced +helm upgrade --install zap-automation-framework oci://ghcr.io/securecodebox/helm/zap-automation-framework ``` #### Deactivation diff --git a/documentation/docs/how-tos/autodiscovery.md b/documentation/docs/how-tos/autodiscovery.md index 4d7b303095..e93a9b10ef 100644 --- a/documentation/docs/how-tos/autodiscovery.md +++ b/documentation/docs/how-tos/autodiscovery.md @@ -29,7 +29,7 @@ If a pod consists of multiple containers, the above described logic will be appl ### Service AutoDiscovery -The Service AutoDiscovery will create a scheduled scan with the given parameters (see [readme](https://github.com/secureCodeBox/secureCodeBox/blob/main/auto-discovery/kubernetes/README.md) for config options) for each Kubernetes service it detects. (It is possible to scan APIs that require authentication, see the [ZAP Advanced](../scanners/zap-advanced.md) documentation). +The Service AutoDiscovery will create a scheduled scan with the given parameters (see [readme](https://github.com/secureCodeBox/secureCodeBox/blob/main/auto-discovery/kubernetes/README.md) for config options) for each Kubernetes service it detects. (It is possible to scan APIs that require authentication, see the [ZAP Automation Framework ](../scanners/zap-automation-framework.md) documentation). The Service AutoDiscovery is enabled by default but can be disabled manually. The Service AutoDiscovery will ignore services where the underlying pods do not serve http(s). It does this by checking for open ports `80, 443, 3000, 5000, 8000, 8443, 8080`. It is also sufficient to name the ports `http` or `https` when a different port is used than the ports specified above. @@ -40,10 +40,10 @@ Services without a matching port number or name are currently ignored. For the sake of the tutorial, it will be assumed that a Kubernetes cluster and the SCB operator is already up and running. If not, check out the [installation](/docs/getting-started/installation/) tutorial for more information. This tutorial will use the `default` and `securecodebox-system` namespaces. -First install the `zap-advanced` (for service AutoDiscovery) and `trivy` (for Container AutoDiscovery) scan types: +First install the `zap-automation-framework` (for service AutoDiscovery) and `trivy` (for Container AutoDiscovery) scan types: ```bash -helm upgrade --install zap-advanced oci://ghcr.io/securecodebox/helm/zap-advanced +helm upgrade --install zap-automation-framework oci://ghcr.io/securecodebox/helm/zap-automation-framework helm upgrade --install trivy oci://ghcr.io/securecodebox/helm/trivy ``` @@ -73,13 +73,13 @@ Then install juice-shop as a demo target: helm upgrade --install juice-shop oci://ghcr.io/securecodebox/helm/juice-shop ``` -The AutoDiscovery will create two scheduled scans after some time. One for the juice-shop service using `zap`, and one for the juice-shop container using `trivy`: +The AutoDiscovery will create two scheduled scans after some time. One for the juice-shop service using `zap-automation-framework`, and one for the juice-shop container using `trivy`: ```bash $ kubectl get scheduledscans -NAME TYPE INTERVAL FINDINGS -juice-shop-service-port-3000 zap-advanced-scan 168h0m0s -scan-juice-shop-at-350cf9a6ea37138b987a3968d046e61bcd3bb18d2ec trivy 168h0m0s +NAME TYPE INTERVAL FINDINGS +juice-shop-service-port-3000 zap-automation-framework 168h0m0s +scan-juice-shop-at-350cf9a6ea37138b987a3968d046e61bcd3bb18d2ec trivy 168h0m0s ``` Install a second juice-shop into the namespace: @@ -88,14 +88,14 @@ Install a second juice-shop into the namespace: helm upgrade --install juice-shop2 oci://ghcr.io/securecodebox/helm/juice-shop ``` -The AutoDiscovery will then create a second `zap` scan for the service, but no additional `trivy` container scan, as the juice-shop container is already being scanned. +The AutoDiscovery will then create a second `zap-automation-framework` scan for the service, but no additional `trivy` container scan, as the juice-shop container is already being scanned. ```bash $ kubectl get scheduledscans -NAME TYPE INTERVAL FINDINGS -juice-shop-service-port-3000 zap-advanced-scan 168h0m0s -juice-shop2-service-port-3000 zap-advanced-scan 168h0m0s -scan-juice-shop-at-350cf9a6ea37138b987a3968d046e61bcd3bb18d2ec trivy 168h0m0s +NAME TYPE INTERVAL FINDINGS +juice-shop-service-port-3000 zap-automation-framework 168h0m0s +juice-shop2-service-port-3000 zap-automation-framework 168h0m0s +scan-juice-shop-at-350cf9a6ea37138b987a3968d046e61bcd3bb18d2ec trivy 168h0m0s ``` Delete both juice-shop deployments. diff --git a/scanners/zap-automation-framework/examples/demo-nginx-automation-scan/README.md b/scanners/zap-automation-framework/examples/demo-nginx-automation-scan/README.md new file mode 100644 index 0000000000..44ae034042 --- /dev/null +++ b/scanners/zap-automation-framework/examples/demo-nginx-automation-scan/README.md @@ -0,0 +1,8 @@ + + +This example generates a scan with the target specified as an environment variable instead in the target section of the ConfigMap. This gives more flexibility to use the same ConfigMap for different scans. +You can find a template for a baseline scan with an active scan in the `template folder`. \ No newline at end of file diff --git a/scanners/zap-automation-framework/examples/demo-nginx-automation-scan/scan.yaml b/scanners/zap-automation-framework/examples/demo-nginx-automation-scan/scan.yaml index 72f78cf1b6..a502f69152 100644 --- a/scanners/zap-automation-framework/examples/demo-nginx-automation-scan/scan.yaml +++ b/scanners/zap-automation-framework/examples/demo-nginx-automation-scan/scan.yaml @@ -13,9 +13,9 @@ data: env: # The environment, mandatory contexts : # List of 1 or more contexts, mandatory - name: test-config # Name to be used to refer to this context in other jobs, mandatory - urls: ["http://nginx.demo-targets.svc"] # A mandatory list of top level urls, everything under each url will be included + urls: ["${TARGET_URL}"] # A mandatory list of top level urls, everything under each url will be included includePaths: - - "http://nginx.demo-targets.svc/.*" # An optional list of regexes to include + - "${TARGET_URL}" # An optional list of regexes to include excludePaths: - ".*socket\\.io.*" - ".*\\.png" @@ -74,4 +74,7 @@ spec: volumes: - name: zap-automation-framework-config configMap: - name: zap-automation-framework-config \ No newline at end of file + name: zap-automation-framework-config + env: + - name: TARGET_URL + value: "http://nginx.demo-targets.svc/.*" \ No newline at end of file diff --git a/scanners/zap-automation-framework/examples/demo-zap-advanced-scan/README.md b/scanners/zap-automation-framework/examples/demo-zap-advanced-scan/README.md new file mode 100644 index 0000000000..2a18a6ad18 --- /dev/null +++ b/scanners/zap-automation-framework/examples/demo-zap-advanced-scan/README.md @@ -0,0 +1,7 @@ + + +This example shows how to configure the `zap-automation-framework` to run an advanced scan. \ No newline at end of file diff --git a/scanners/zap-automation-framework/examples/demo-zap-baseline-scan/README.md b/scanners/zap-automation-framework/examples/demo-zap-baseline-scan/README.md new file mode 100644 index 0000000000..ff902be5d2 --- /dev/null +++ b/scanners/zap-automation-framework/examples/demo-zap-baseline-scan/README.md @@ -0,0 +1,8 @@ + + +This example generates a scan with the target specified as an environment variable instead in the target section of the ConfigMap. This gives more flexibility to use the same ConfigMap for different scans. +You can find a template for a baseline scan with an active scan in the `templates` folder. \ No newline at end of file diff --git a/scanners/zap-automation-framework/examples/demo-zap-baseline-scan/scan.yaml b/scanners/zap-automation-framework/examples/demo-zap-baseline-scan/scan.yaml index c0a0079fce..628b5dfed8 100644 --- a/scanners/zap-automation-framework/examples/demo-zap-baseline-scan/scan.yaml +++ b/scanners/zap-automation-framework/examples/demo-zap-baseline-scan/scan.yaml @@ -12,8 +12,8 @@ data: env: # The environment, mandatory contexts : # List of 1 or more contexts, mandatory - - name: zap-baseline-automation-scan # Name to be used to refer to this context in other jobs, mandatory - urls: ["http://juice-shop.demo-targets.svc:3000/"] # A mandatory list of top level urls, everything under each url will be included + - name: baseline-config # Name to be used to refer to this context in other jobs, mandatory + urls: ["${TARGET_URL}"] # A mandatory list of top level urls, everything under each url will be included jobs: - type: spider # The traditional spider - fast but doesnt handle modern apps so well parameters: @@ -24,9 +24,9 @@ data: maxDuration: 5 # Int: The max time to wait for the passive scanner, default: 0 unlimited - type: report # Report generation parameters: - template: traditional-xml # String: The template id, default : modern - reportDir: /home/securecodebox/ # String: The directory into which the report will be written - reportFile: zap-results # String: The report file name pattern, default: {{yyyy-MM-dd}}-ZAP-Report-[[site]] + template: traditional-xml # String: The template id, default : modern + reportDir: /home/securecodebox/ # String: The directory into which the report will be written + reportFile: zap-results # String: The report file name pattern, default: {{yyyy-MM-dd}}-ZAP-Report-[[site]] risks: # List: The risks to include in this report, default all - high - medium @@ -52,3 +52,6 @@ spec: - name: zap-baseline-automation-framework-config configMap: name: zap-baseline-automation-framework-config + env: + - name: TARGET_URL + value: "http://juice-shop.demo-targets.svc:3000/" diff --git a/scanners/zap-automation-framework/templates/baseline-config.yaml b/scanners/zap-automation-framework/templates/baseline-config.yaml new file mode 100644 index 0000000000..79cec909c6 --- /dev/null +++ b/scanners/zap-automation-framework/templates/baseline-config.yaml @@ -0,0 +1,33 @@ +# SPDX-FileCopyrightText: the secureCodeBox authors +# +# SPDX-License-Identifier: Apache-2.0 + + +apiVersion: v1 +kind: ConfigMap +metadata: + name: zap-automation-framework-baseline-config +data: + automation.yaml: |- + env: # The environment, mandatory + contexts : # List of 1 or more contexts, mandatory + - name: baseline-config # Name to be used to refer to this context in other jobs, mandatory + urls: ["${TARGET_URL}"] # A mandatory list of top level urls, everything under each url will be included + jobs: + - type: spider # The traditional spider - fast but doesnt handle modern apps so well + parameters: + context: baseline-config # String: Name of the context to spider, default: first context + maxDuration: 1 # Int: The max time in minutes the spider will be allowed to run for, default: 0 unlimited + - type: passiveScan-wait # Passive scan wait for the passive scanner to finish + parameters: + maxDuration: 5 # Int: The max time to wait for the passive scanner, default: 0 unlimited + - type: activeScan # The active scanner - this actively attacks the target so should only be used with permission + parameters: + context: baseline-config # String: Name of the context to attack, default: first context + maxRuleDurationInMins: 3 # Int: The max time in minutes any individual rule will be allowed to run for, default: 0 unlimited + maxScanDurationInMins: 10 # Int: The max time in minutes the active scanner will be allowed to run for, default: 0 unlimited + - type: report # Report generation + parameters: + template: traditional-xml # String: The template id, default : modern + reportDir: /home/securecodebox/ # String: The directory into which the report will be written + reportFile: zap-results # String: The report file name pattern \ No newline at end of file diff --git a/scanners/zap-automation-framework/tests/__snapshot__/scanner_test.yaml.snap b/scanners/zap-automation-framework/tests/__snapshot__/scanner_test.yaml.snap index 602f87a188..30e6519eb9 100644 --- a/scanners/zap-automation-framework/tests/__snapshot__/scanner_test.yaml.snap +++ b/scanners/zap-automation-framework/tests/__snapshot__/scanner_test.yaml.snap @@ -1,5 +1,34 @@ matches the snapshot: 1: | + apiVersion: v1 + data: + automation.yaml: |- + env: # The environment, mandatory + contexts : # List of 1 or more contexts, mandatory + - name: baseline-config # Name to be used to refer to this context in other jobs, mandatory + urls: ["${TARGET_URL}"] # A mandatory list of top level urls, everything under each url will be included + jobs: + - type: spider # The traditional spider - fast but doesnt handle modern apps so well + parameters: + context: baseline-config # String: Name of the context to spider, default: first context + maxDuration: 1 # Int: The max time in minutes the spider will be allowed to run for, default: 0 unlimited + - type: passiveScan-wait # Passive scan wait for the passive scanner to finish + parameters: + maxDuration: 5 # Int: The max time to wait for the passive scanner, default: 0 unlimited + - type: activeScan # The active scanner - this actively attacks the target so should only be used with permission + parameters: + context: baseline-config # String: Name of the context to attack, default: first context + maxRuleDurationInMins: 3 # Int: The max time in minutes any individual rule will be allowed to run for, default: 0 unlimited + maxScanDurationInMins: 10 # Int: The max time in minutes the active scanner will be allowed to run for, default: 0 unlimited + - type: report # Report generation + parameters: + template: traditional-xml # String: The template id, default : modern + reportDir: /home/securecodebox/ # String: The directory into which the report will be written + reportFile: zap-results # String: The report file name pattern + kind: ConfigMap + metadata: + name: zap-automation-framework-baseline-config + 2: | apiVersion: cascading.securecodebox.io/v1 kind: CascadingRule metadata: @@ -23,7 +52,7 @@ matches the snapshot: - -t - http://{{$.hostOrIP}}:{{attributes.port}} scanType: zap-automation-framework - 2: | + 3: | apiVersion: cascading.securecodebox.io/v1 kind: CascadingRule metadata: @@ -43,7 +72,7 @@ matches the snapshot: - -t - https://{{$.hostOrIP}}:{{attributes.port}} scanType: zap-automation-framework - 3: | + 4: | apiVersion: v1 data: zap-entrypoint.bash: |2 @@ -52,7 +81,7 @@ matches the snapshot: kind: ConfigMap metadata: name: zap-automation-framework-entrypoint - 4: | + 5: | apiVersion: execution.securecodebox.io/v1 kind: ParseDefinition metadata: @@ -72,7 +101,7 @@ matches the snapshot: tolerations: - foo: bar ttlSecondsAfterFinished: null - 5: | + 6: | apiVersion: execution.securecodebox.io/v1 kind: ScanType metadata: