From e7ab09fd35f21596cad5ff7884535cc48bc9c17a Mon Sep 17 00:00:00 2001 From: Samreet Singh Date: Mon, 26 May 2025 17:04:11 +0200 Subject: [PATCH 1/7] #2940 Replace ZAP-advanced with ZAP-automation-framework in auto-discovery Signed-off-by: Samreet Singh --- auto-discovery/kubernetes/values.yaml | 23 +++++++++---- .../templates/baseline-config.yaml | 33 +++++++++++++++++++ 2 files changed, 49 insertions(+), 7 deletions(-) create mode 100644 scanners/zap-automation-framework/templates/baseline-config.yaml diff --git a/auto-discovery/kubernetes/values.yaml b/auto-discovery/kubernetes/values.yaml index 13520f8fa4..2f2616aac7 100644 --- a/auto-discovery/kubernetes/values.yaml +++ b/auto-discovery/kubernetes/values.yaml @@ -27,14 +27,13 @@ config: passiveReconcileInterval: 1m scanConfigs: # -- scanType used for the scans created by the serviceAutoDiscovery - - scanType: zap-advanced-scan + - scanType: "zap-automation-framework" # -- unique name to distinguish scans name: "zap" # -- parameters used for the scans created by the serviceAutoDiscovery, all parameters support templating parameters: - - "-t" - - "{{ .Host.Type }}://{{ .Service.Name }}.{{ .Service.Namespace }}.svc:{{ .Host.Port }}" - # -- interval in which scans are automatically repeated. If the target is updated (meaning a new image revision is deployed) the scan will repeated beforehand and the interval is reset. + - "-autorun" + - "/home/securecodebox/scb-automation/automation.yaml" repeatInterval: "168h" # -- labels to be added to the scans started by the auto-discovery, all label values support templating labels: {} @@ -46,10 +45,17 @@ config: defectdojo.securecodebox.io/engagement-version: "{{if (index .Target.Labels `app.kubernetes.io/version`) }}{{ index .Target.Labels `app.kubernetes.io/version` }}{{end}}" # -- volumes to add to the scan job, see: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes # the fields: `name`, `secret.secretName`, `configMap.name` of each volume support templating - volumes: [] + volumes: + - name: zap-automation-framework-baseline-config + configMap: + name: "zap-automation-framework-baseline-config" + # -- volumeMounts to add to the scan job, see: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes-1 # the fields: `name`, `mountPath`, `subPath`, `subPathExpr` of each volumeMount support templating - volumeMounts: [] + volumeMounts: + - name: zap-automation-framework-baseline-config + mountPath: /home/securecodebox/scb-automation/automation.yaml + subPath: automation.yaml # -- HookSelector allows to specify a LabelSelector with which the hooks are selected, see: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors # Both matchLabels and matchExpressions are supported. # All values in the matchLabels map support templating. @@ -57,7 +63,10 @@ config: hookSelector: {} # -- allows to overwrite the env var list of the scan job. # the value field supports templating. - env: [] + env: + - name: TARGET_URL + value: "{{ .Host.Type }}://{{ .Service.Name }}.{{ .Service.Namespace }}.svc:{{ .Host.Port }}" + containerAutoDiscovery: enabled: false diff --git a/scanners/zap-automation-framework/templates/baseline-config.yaml b/scanners/zap-automation-framework/templates/baseline-config.yaml new file mode 100644 index 0000000000..79cec909c6 --- /dev/null +++ b/scanners/zap-automation-framework/templates/baseline-config.yaml @@ -0,0 +1,33 @@ +# SPDX-FileCopyrightText: the secureCodeBox authors +# +# SPDX-License-Identifier: Apache-2.0 + + +apiVersion: v1 +kind: ConfigMap +metadata: + name: zap-automation-framework-baseline-config +data: + automation.yaml: |- + env: # The environment, mandatory + contexts : # List of 1 or more contexts, mandatory + - name: baseline-config # Name to be used to refer to this context in other jobs, mandatory + urls: ["${TARGET_URL}"] # A mandatory list of top level urls, everything under each url will be included + jobs: + - type: spider # The traditional spider - fast but doesnt handle modern apps so well + parameters: + context: baseline-config # String: Name of the context to spider, default: first context + maxDuration: 1 # Int: The max time in minutes the spider will be allowed to run for, default: 0 unlimited + - type: passiveScan-wait # Passive scan wait for the passive scanner to finish + parameters: + maxDuration: 5 # Int: The max time to wait for the passive scanner, default: 0 unlimited + - type: activeScan # The active scanner - this actively attacks the target so should only be used with permission + parameters: + context: baseline-config # String: Name of the context to attack, default: first context + maxRuleDurationInMins: 3 # Int: The max time in minutes any individual rule will be allowed to run for, default: 0 unlimited + maxScanDurationInMins: 10 # Int: The max time in minutes the active scanner will be allowed to run for, default: 0 unlimited + - type: report # Report generation + parameters: + template: traditional-xml # String: The template id, default : modern + reportDir: /home/securecodebox/ # String: The directory into which the report will be written + reportFile: zap-results # String: The report file name pattern \ No newline at end of file From 2dadddb758bd0b3aca86edca0f614ce31ff4244f Mon Sep 17 00:00:00 2001 From: Samreet Singh Date: Mon, 26 May 2025 17:23:29 +0200 Subject: [PATCH 2/7] #2940 Update test and demo files for migration to ZAP-automation-framework Signed-off-by: Samreet Singh --- .../kubernetes/demo/juice-shop.yaml | 4 +-- .../util/__testfiles__/valid_config_test.yaml | 34 +++++++++---------- .../kubernetes/pkg/util/config_loader_test.go | 34 +++++++++---------- .../auto-discovery_test.yaml.snap | 30 ++++++++++++---- 4 files changed, 60 insertions(+), 42 deletions(-) diff --git a/auto-discovery/kubernetes/demo/juice-shop.yaml b/auto-discovery/kubernetes/demo/juice-shop.yaml index 3afcee906d..63f97d930d 100644 --- a/auto-discovery/kubernetes/demo/juice-shop.yaml +++ b/auto-discovery/kubernetes/demo/juice-shop.yaml @@ -61,10 +61,10 @@ spec: apiVersion: helm.fluxcd.io/v1 kind: HelmRelease metadata: - name: zap-advanced + name: zap-automation-framework namespace: juice-shop spec: chart: repository: https://charts.securecodebox.io version: 3.2.0 - name: zap-advanced + name: zap-automation-framework diff --git a/auto-discovery/kubernetes/pkg/util/__testfiles__/valid_config_test.yaml b/auto-discovery/kubernetes/pkg/util/__testfiles__/valid_config_test.yaml index 706a5e8d44..36915a45dd 100644 --- a/auto-discovery/kubernetes/pkg/util/__testfiles__/valid_config_test.yaml +++ b/auto-discovery/kubernetes/pkg/util/__testfiles__/valid_config_test.yaml @@ -15,11 +15,11 @@ serviceAutoDiscovery: enabled: true passiveReconcileInterval: 1m scanConfigs: - - scanType: zap-advanced-scan + - scanType: zap-automation-framework name: "zap" parameters: - - "-t" - - "{{ .Host.Type }}://{{ .Service.Name }}.{{ .Service.Namespace }}.svc:{{ .Host.Port }}" + - "-autorun" + - "/home/securecodebox/scb-automation/automation.yaml" repeatInterval: "168h" labels: {} annotations: @@ -28,24 +28,24 @@ serviceAutoDiscovery: defectdojo.securecodebox.io/engagement-name: "{{ .Target.Name }}" defectdojo.securecodebox.io/engagement-version: "{{if (index .Target.Labels `app.kubernetes.io/version`) }}{{ index .Target.Labels `app.kubernetes.io/version` }}{{end}}" volumes: - - name: zap-advanced-scan-config + - name: zap-automation-framework-baseline-config configMap: - name: zap-advanced-scan-config + name: zap-automation-framework-baseline-config optional: true defaultMode: 420 items: - - key: "2-zap-advanced-scan.yaml" - path: "2-zap-advanced-scan.yaml" + - key: "automation.yaml" + path: "automation.yaml" mode: 420 - key: "extra-config.yaml" path: "extra-config.yaml" mode: 511 volumeMounts: - - name: zap-advanced-scan-config + - name: zap-automation-framework-baseline-config readOnly: true recursiveReadOnly: "Enabled" - mountPath: /home/securecodebox/configs/2-zap-advanced-scan.yaml - subPath: 2-zap-advanced-scan.yaml + mountPath: /home/securecodebox/configs/automation.yaml + subPath: automation.yaml mountPropagation: "Bidirectional" subPathExpr: "$(CONFIG_FILE_NAME)" hookSelector: @@ -99,24 +99,24 @@ containerAutoDiscovery: defectdojo.securecodebox.io/engagement-name: "{{ .Target.Name }}" defectdojo.securecodebox.io/engagement-version: "{{if (index .Target.Labels `app.kubernetes.io/version`) }}{{ index .Target.Labels `app.kubernetes.io/version` }}{{end}}" volumes: - - name: zap-advanced-scan-config + - name: zap-automation-framework-baseline-config configMap: - name: zap-advanced-scan-config + name: zap-automation-framework-baseline-config optional: true defaultMode: 420 items: - - key: "2-zap-advanced-scan.yaml" - path: "2-zap-advanced-scan.yaml" + - key: "automation.yaml" + path: "automation.yaml" mode: 420 - key: "extra-config.yaml" path: "extra-config.yaml" mode: 511 volumeMounts: - - name: zap-advanced-scan-config + - name: zap-automation-framework-baseline-config readOnly: true recursiveReadOnly: "Enabled" - mountPath: /home/securecodebox/configs/2-zap-advanced-scan.yaml - subPath: 2-zap-advanced-scan.yaml + mountPath: /home/securecodebox/configs/automation.yaml + subPath: automation.yaml mountPropagation: "Bidirectional" subPathExpr: "$(CONFIG_FILE_NAME)" hookSelector: diff --git a/auto-discovery/kubernetes/pkg/util/config_loader_test.go b/auto-discovery/kubernetes/pkg/util/config_loader_test.go index 3d4f4abd2a..e3866db5ec 100644 --- a/auto-discovery/kubernetes/pkg/util/config_loader_test.go +++ b/auto-discovery/kubernetes/pkg/util/config_loader_test.go @@ -45,11 +45,11 @@ var _ = Describe("LoadAutoDiscoveryConfig", func() { sc := sad.ScanConfigs[0] Expect(sc.Name).To(Equal("zap")) - Expect(sc.ScanType).To(Equal("zap-advanced-scan")) + Expect(sc.ScanType).To(Equal("zap-automation-framework")) Expect(sc.RepeatInterval.Duration).To(Equal(168 * time.Hour)) Expect(sc.Parameters).To(Equal([]string{ - "-t", - "{{ .Host.Type }}://{{ .Service.Name }}.{{ .Service.Namespace }}.svc:{{ .Host.Port }}", + "-autorun", + "/home/securecodebox/scb-automation/automation.yaml", })) Expect(sc.Labels).To(BeEmpty()) Expect(sc.Annotations).To(HaveKeyWithValue("defectdojo.securecodebox.io/product-name", "{{ .Cluster.Name }} | {{ .Namespace.Name }} | {{ .Target.Name }}")) @@ -60,19 +60,19 @@ var _ = Describe("LoadAutoDiscoveryConfig", func() { // Validate volumes of the service scan config. Expect(sc.Volumes).To(HaveLen(1)) vol := sc.Volumes[0] - Expect(vol.Name).To(Equal("zap-advanced-scan-config")) + Expect(vol.Name).To(Equal("zap-automation-framework-baseline-config")) Expect(vol.ConfigMap).NotTo(BeNil()) cm := vol.ConfigMap // The ConfigMap volume source. - Expect(cm.Name).To(Equal("zap-advanced-scan-config")) + Expect(cm.Name).To(Equal("zap-automation-framework-baseline-config")) // Optional is a pointer. Expect(*cm.Optional).To(BeTrue()) Expect(*cm.DefaultMode).To(Equal(int32(420))) Expect(cm.Items).To(HaveLen(2)) // First key-to-path mapping. firstItem := cm.Items[0] - Expect(firstItem.Key).To(Equal("2-zap-advanced-scan.yaml")) - Expect(firstItem.Path).To(Equal("2-zap-advanced-scan.yaml")) + Expect(firstItem.Key).To(Equal("automation.yaml")) + Expect(firstItem.Path).To(Equal("automation.yaml")) Expect(*firstItem.Mode).To(Equal(int32(420))) // Second key-to-path mapping. secondItem := cm.Items[1] @@ -83,12 +83,12 @@ var _ = Describe("LoadAutoDiscoveryConfig", func() { // Validate volumeMounts of the service scan config. Expect(sc.VolumeMounts).To(HaveLen(1)) vm := sc.VolumeMounts[0] - Expect(vm.Name).To(Equal("zap-advanced-scan-config")) + Expect(vm.Name).To(Equal("zap-automation-framework-baseline-config")) Expect(vm.ReadOnly).To(BeTrue()) // recursiveReadOnly is a pointer to a string in the struct. Expect(*vm.RecursiveReadOnly).To(Equal(corev1.RecursiveReadOnlyEnabled)) - Expect(vm.MountPath).To(Equal("/home/securecodebox/configs/2-zap-advanced-scan.yaml")) - Expect(vm.SubPath).To(Equal("2-zap-advanced-scan.yaml")) + Expect(vm.MountPath).To(Equal("/home/securecodebox/configs/automation.yaml")) + Expect(vm.SubPath).To(Equal("automation.yaml")) // mountPropagation is also a pointer. Expect(*vm.MountPropagation).To(Equal(corev1.MountPropagationBidirectional)) Expect(vm.SubPathExpr).To(Equal("$(CONFIG_FILE_NAME)")) @@ -179,16 +179,16 @@ var _ = Describe("LoadAutoDiscoveryConfig", func() { // Validate volumes of the container scan config. Expect(sc2.Volumes).To(HaveLen(1)) vol2 := sc2.Volumes[0] - Expect(vol2.Name).To(Equal("zap-advanced-scan-config")) + Expect(vol2.Name).To(Equal("zap-automation-framework-baseline-config")) Expect(vol2.ConfigMap).NotTo(BeNil()) cm2 := vol2.ConfigMap - Expect(cm2.Name).To(Equal("zap-advanced-scan-config")) + Expect(cm2.Name).To(Equal("zap-automation-framework-baseline-config")) Expect(*cm2.Optional).To(BeTrue()) Expect(*cm2.DefaultMode).To(Equal(int32(420))) Expect(cm2.Items).To(HaveLen(2)) firstItem = cm2.Items[0] - Expect(firstItem.Key).To(Equal("2-zap-advanced-scan.yaml")) - Expect(firstItem.Path).To(Equal("2-zap-advanced-scan.yaml")) + Expect(firstItem.Key).To(Equal("automation.yaml")) + Expect(firstItem.Path).To(Equal("automation.yaml")) Expect(*firstItem.Mode).To(Equal(int32(420))) secondItem = cm2.Items[1] Expect(secondItem.Key).To(Equal("extra-config.yaml")) @@ -198,11 +198,11 @@ var _ = Describe("LoadAutoDiscoveryConfig", func() { // Validate volumeMounts of the container scan config. Expect(sc2.VolumeMounts).To(HaveLen(1)) vm = sc2.VolumeMounts[0] - Expect(vm.Name).To(Equal("zap-advanced-scan-config")) + Expect(vm.Name).To(Equal("zap-automation-framework-baseline-config")) Expect(vm.ReadOnly).To(BeTrue()) Expect(*vm.RecursiveReadOnly).To(Equal(corev1.RecursiveReadOnlyEnabled)) - Expect(vm.MountPath).To(Equal("/home/securecodebox/configs/2-zap-advanced-scan.yaml")) - Expect(vm.SubPath).To(Equal("2-zap-advanced-scan.yaml")) + Expect(vm.MountPath).To(Equal("/home/securecodebox/configs/automation.yaml")) + Expect(vm.SubPath).To(Equal("automation.yaml")) Expect(*vm.MountPropagation).To(Equal(corev1.MountPropagationBidirectional)) Expect(vm.SubPathExpr).To(Equal("$(CONFIG_FILE_NAME)")) diff --git a/auto-discovery/kubernetes/tests/__snapshot__/auto-discovery_test.yaml.snap b/auto-discovery/kubernetes/tests/__snapshot__/auto-discovery_test.yaml.snap index 352a084a9a..21e6ce18d3 100644 --- a/auto-discovery/kubernetes/tests/__snapshot__/auto-discovery_test.yaml.snap +++ b/auto-discovery/kubernetes/tests/__snapshot__/auto-discovery_test.yaml.snap @@ -63,18 +63,36 @@ matches the snapshot: "defectdojo.securecodebox.io/product-name": "{{ .Cluster.Name }} | {{ .Namespace.Name }} | {{ .Target.Name }}", "defectdojo.securecodebox.io/product-tags": "cluster/{{ .Cluster.Name }},namespace/{{ .Namespace.Name }}" }, - "env": [], + "env": [ + { + "name": "TARGET_URL", + "value": "{{ .Host.Type }}://{{ .Service.Name }}.{{ .Service.Namespace }}.svc:{{ .Host.Port }}" + } + ], "hookSelector": {}, "labels": {}, "name": "zap", "parameters": [ - "-t", - "{{ .Host.Type }}://{{ .Service.Name }}.{{ .Service.Namespace }}.svc:{{ .Host.Port }}" + "-autorun", + "/home/securecodebox/scb-automation/automation.yaml" ], "repeatInterval": "168h", - "scanType": "zap-advanced-scan", - "volumeMounts": [], - "volumes": [] + "scanType": "zap-automation-framework", + "volumeMounts": [ + { + "mountPath": "/home/securecodebox/scb-automation/automation.yaml", + "name": "zap-automation-framework-baseline-config", + "subPath": "automation.yaml" + } + ], + "volumes": [ + { + "configMap": { + "name": "zap-automation-framework-baseline-config" + }, + "name": "zap-automation-framework-baseline-config" + } + ] } ] } From f292d6b79a7bb2ed250d6aa5c6dcc056866093d8 Mon Sep 17 00:00:00 2001 From: Samreet Singh Date: Mon, 26 May 2025 17:35:11 +0200 Subject: [PATCH 3/7] #2940 Update zap-automation-framework examples Signed-off-by: Samreet Singh --- auto-discovery/kubernetes/.helm-docs.gotmpl | 2 +- .../examples/demo-nginx-automation-scan/README.md | 8 ++++++++ .../examples/demo-nginx-automation-scan/scan.yaml | 9 ++++++--- .../examples/demo-zap-advanced-scan/README.md | 7 +++++++ .../examples/demo-zap-baseline-scan/README.md | 8 ++++++++ .../examples/demo-zap-baseline-scan/scan.yaml | 13 ++++++++----- 6 files changed, 38 insertions(+), 9 deletions(-) create mode 100644 scanners/zap-automation-framework/examples/demo-nginx-automation-scan/README.md create mode 100644 scanners/zap-automation-framework/examples/demo-zap-advanced-scan/README.md create mode 100644 scanners/zap-automation-framework/examples/demo-zap-baseline-scan/README.md diff --git a/auto-discovery/kubernetes/.helm-docs.gotmpl b/auto-discovery/kubernetes/.helm-docs.gotmpl index 29f26736d7..fa3f20dd92 100644 --- a/auto-discovery/kubernetes/.helm-docs.gotmpl +++ b/auto-discovery/kubernetes/.helm-docs.gotmpl @@ -44,7 +44,7 @@ This example deploys [JuiceShop](https://owasp.org/www-project-juice-shop/) to a (You can find the kubernetes manifests for the deployment [here](./demo/juice-shop.yaml)) The AutoDiscovery will automatically pick up this new deployment and then starts a ZAP Scan against it. -The scan created uses our `zap-advanced` ScanType by default, this can be changed with the `config.serviceAutoDiscovery.scanConfig.scanType` config on the autoDiscovery helm release. +The scan created uses our `zap-automation-framework` ScanType by default, this can be changed with the `config.serviceAutoDiscovery.scanConfig.scanType` config on the autoDiscovery helm release. When the ContainerAutoDiscovery is enabled, the AutoDiscovery can also create a trivy scan for each unique container image (having multiple pods with the same container will only create one scan). The scan type can be defined with `config.containerAutoDiscovery.scanConfig.scanType`. {{- end }} diff --git a/scanners/zap-automation-framework/examples/demo-nginx-automation-scan/README.md b/scanners/zap-automation-framework/examples/demo-nginx-automation-scan/README.md new file mode 100644 index 0000000000..44ae034042 --- /dev/null +++ b/scanners/zap-automation-framework/examples/demo-nginx-automation-scan/README.md @@ -0,0 +1,8 @@ + + +This example generates a scan with the target specified as an environment variable instead in the target section of the ConfigMap. This gives more flexibility to use the same ConfigMap for different scans. +You can find a template for a baseline scan with an active scan in the `template folder`. \ No newline at end of file diff --git a/scanners/zap-automation-framework/examples/demo-nginx-automation-scan/scan.yaml b/scanners/zap-automation-framework/examples/demo-nginx-automation-scan/scan.yaml index 72f78cf1b6..a502f69152 100644 --- a/scanners/zap-automation-framework/examples/demo-nginx-automation-scan/scan.yaml +++ b/scanners/zap-automation-framework/examples/demo-nginx-automation-scan/scan.yaml @@ -13,9 +13,9 @@ data: env: # The environment, mandatory contexts : # List of 1 or more contexts, mandatory - name: test-config # Name to be used to refer to this context in other jobs, mandatory - urls: ["http://nginx.demo-targets.svc"] # A mandatory list of top level urls, everything under each url will be included + urls: ["${TARGET_URL}"] # A mandatory list of top level urls, everything under each url will be included includePaths: - - "http://nginx.demo-targets.svc/.*" # An optional list of regexes to include + - "${TARGET_URL}" # An optional list of regexes to include excludePaths: - ".*socket\\.io.*" - ".*\\.png" @@ -74,4 +74,7 @@ spec: volumes: - name: zap-automation-framework-config configMap: - name: zap-automation-framework-config \ No newline at end of file + name: zap-automation-framework-config + env: + - name: TARGET_URL + value: "http://nginx.demo-targets.svc/.*" \ No newline at end of file diff --git a/scanners/zap-automation-framework/examples/demo-zap-advanced-scan/README.md b/scanners/zap-automation-framework/examples/demo-zap-advanced-scan/README.md new file mode 100644 index 0000000000..2a18a6ad18 --- /dev/null +++ b/scanners/zap-automation-framework/examples/demo-zap-advanced-scan/README.md @@ -0,0 +1,7 @@ + + +This example shows how to configure the `zap-automation-framework` to run an advanced scan. \ No newline at end of file diff --git a/scanners/zap-automation-framework/examples/demo-zap-baseline-scan/README.md b/scanners/zap-automation-framework/examples/demo-zap-baseline-scan/README.md new file mode 100644 index 0000000000..ff902be5d2 --- /dev/null +++ b/scanners/zap-automation-framework/examples/demo-zap-baseline-scan/README.md @@ -0,0 +1,8 @@ + + +This example generates a scan with the target specified as an environment variable instead in the target section of the ConfigMap. This gives more flexibility to use the same ConfigMap for different scans. +You can find a template for a baseline scan with an active scan in the `templates` folder. \ No newline at end of file diff --git a/scanners/zap-automation-framework/examples/demo-zap-baseline-scan/scan.yaml b/scanners/zap-automation-framework/examples/demo-zap-baseline-scan/scan.yaml index c0a0079fce..628b5dfed8 100644 --- a/scanners/zap-automation-framework/examples/demo-zap-baseline-scan/scan.yaml +++ b/scanners/zap-automation-framework/examples/demo-zap-baseline-scan/scan.yaml @@ -12,8 +12,8 @@ data: env: # The environment, mandatory contexts : # List of 1 or more contexts, mandatory - - name: zap-baseline-automation-scan # Name to be used to refer to this context in other jobs, mandatory - urls: ["http://juice-shop.demo-targets.svc:3000/"] # A mandatory list of top level urls, everything under each url will be included + - name: baseline-config # Name to be used to refer to this context in other jobs, mandatory + urls: ["${TARGET_URL}"] # A mandatory list of top level urls, everything under each url will be included jobs: - type: spider # The traditional spider - fast but doesnt handle modern apps so well parameters: @@ -24,9 +24,9 @@ data: maxDuration: 5 # Int: The max time to wait for the passive scanner, default: 0 unlimited - type: report # Report generation parameters: - template: traditional-xml # String: The template id, default : modern - reportDir: /home/securecodebox/ # String: The directory into which the report will be written - reportFile: zap-results # String: The report file name pattern, default: {{yyyy-MM-dd}}-ZAP-Report-[[site]] + template: traditional-xml # String: The template id, default : modern + reportDir: /home/securecodebox/ # String: The directory into which the report will be written + reportFile: zap-results # String: The report file name pattern, default: {{yyyy-MM-dd}}-ZAP-Report-[[site]] risks: # List: The risks to include in this report, default all - high - medium @@ -52,3 +52,6 @@ spec: - name: zap-baseline-automation-framework-config configMap: name: zap-baseline-automation-framework-config + env: + - name: TARGET_URL + value: "http://juice-shop.demo-targets.svc:3000/" From a71c24f1307bfb837bfee8357d330381d652ae2e Mon Sep 17 00:00:00 2001 From: Samreet Singh Date: Mon, 26 May 2025 17:59:30 +0200 Subject: [PATCH 4/7] #2940 Change zap scantype in the documentation Signed-off-by: Samreet Singh --- auto-discovery/kubernetes/.helm-docs.gotmpl | 4 ++-- .../kubernetes/docs/README.ArtifactHub.md | 15 +++++++-------- .../kubernetes/docs/README.DockerHub-Core.md | 4 ++-- 3 files changed, 11 insertions(+), 12 deletions(-) diff --git a/auto-discovery/kubernetes/.helm-docs.gotmpl b/auto-discovery/kubernetes/.helm-docs.gotmpl index fa3f20dd92..9d67d1d722 100644 --- a/auto-discovery/kubernetes/.helm-docs.gotmpl +++ b/auto-discovery/kubernetes/.helm-docs.gotmpl @@ -23,7 +23,7 @@ The Kubernetes AutoDiscovery needs to be deployed along side the secureCodeBox O The AutoDiscovery controller will automatically detect these new resources (services and containers) and start secureCodeBox _scans_ for them: -1. A ZAP Baseline Scan to detect basic web vulnerabilities in the service. (Using ZAP) +1. A ZAP Baseline Scan to detect basic web vulnerabilities in the service. (Using ZAP-automation-framework) 2. An image scan scanning for vulnerable libraries in the docker / container image of the deployment. (Using trivy) 3. (WIP) A TLS Scan against the certificate of the ingress for the host. (Using SSLyze) @@ -46,7 +46,7 @@ This example deploys [JuiceShop](https://owasp.org/www-project-juice-shop/) to a The AutoDiscovery will automatically pick up this new deployment and then starts a ZAP Scan against it. The scan created uses our `zap-automation-framework` ScanType by default, this can be changed with the `config.serviceAutoDiscovery.scanConfig.scanType` config on the autoDiscovery helm release. -When the ContainerAutoDiscovery is enabled, the AutoDiscovery can also create a trivy scan for each unique container image (having multiple pods with the same container will only create one scan). The scan type can be defined with `config.containerAutoDiscovery.scanConfig.scanType`. +When the ContainerAutoDiscovery is enabled, the AutoDiscovery can also create a trivy scan for each unique container image (having multiple pods with the same container will only create one scan). The ScanType can be defined with `config.containerAutoDiscovery.scanConfig.scanType`. {{- end }} {{- define "extra.scannerConfigurationSection" -}} diff --git a/auto-discovery/kubernetes/docs/README.ArtifactHub.md b/auto-discovery/kubernetes/docs/README.ArtifactHub.md index b3b692dfaa..19a24487d6 100644 --- a/auto-discovery/kubernetes/docs/README.ArtifactHub.md +++ b/auto-discovery/kubernetes/docs/README.ArtifactHub.md @@ -50,9 +50,9 @@ This example deploys [JuiceShop](https://owasp.org/www-project-juice-shop/) to a (You can find the kubernetes manifests for the deployment [here](./demo/juice-shop.yaml)) The AutoDiscovery will automatically pick up this new deployment and then starts a ZAP Scan against it. -The scan created uses our `zap-advanced` ScanType by default, this can be changed with the `config.serviceAutoDiscovery.scanConfig.scanType` config on the autoDiscovery helm release. +The scan created uses our `zap-automation-framework` ScanType by default, this can be changed with the `config.serviceAutoDiscovery.scanConfig.scanType` config on the autoDiscovery helm release. -When the ContainerAutoDiscovery is enabled, the AutoDiscovery can also create a trivy scan for each unique container image (having multiple pods with the same container will only create one scan). The scan type can be defined with `config.containerAutoDiscovery.scanConfig.scanType`. +When the ContainerAutoDiscovery is enabled, the AutoDiscovery can also create a trivy scan for each unique container image (having multiple pods with the same container will only create one scan). The ScanType can be defined with `config.containerAutoDiscovery.scanConfig.scanType`. ## Deployment The auto-discovery-kubernetes chart can be deployed via helm: @@ -149,16 +149,15 @@ kubectl -n juice-shop annotate service juice-shop auto-discovery.securecodebox.i | config.resourceInclusion.mode | string | `"enabled-per-namespace"` | | | config.serviceAutoDiscovery.enabled | bool | `true` | | | config.serviceAutoDiscovery.passiveReconcileInterval | string | `"1m"` | interval in which every service is re-checked for updated pods, if service object is updated directly this the service will get reconciled immediately | -| config.serviceAutoDiscovery.scanConfigs[0] | object | `{"annotations":{"defectdojo.securecodebox.io/engagement-name":"{{ .Target.Name }}","defectdojo.securecodebox.io/engagement-version":"{{if (index .Target.Labels `app.kubernetes.io/version`) }}{{ index .Target.Labels `app.kubernetes.io/version` }}{{end}}","defectdojo.securecodebox.io/product-name":"{{ .Cluster.Name }} | {{ .Namespace.Name }} | {{ .Target.Name }}","defectdojo.securecodebox.io/product-tags":"cluster/{{ .Cluster.Name }},namespace/{{ .Namespace.Name }}"},"env":[],"hookSelector":{},"labels":{},"name":"zap","parameters":["-t","{{ .Host.Type }}://{{ .Service.Name }}.{{ .Service.Namespace }}.svc:{{ .Host.Port }}"],"repeatInterval":"168h","scanType":"zap-advanced-scan","volumeMounts":[],"volumes":[]}` | scanType used for the scans created by the serviceAutoDiscovery | +| config.serviceAutoDiscovery.scanConfigs[0] | object | `{"annotations":{"defectdojo.securecodebox.io/engagement-name":"{{ .Target.Name }}","defectdojo.securecodebox.io/engagement-version":"{{if (index .Target.Labels `app.kubernetes.io/version`) }}{{ index .Target.Labels `app.kubernetes.io/version` }}{{end}}","defectdojo.securecodebox.io/product-name":"{{ .Cluster.Name }} | {{ .Namespace.Name }} | {{ .Target.Name }}","defectdojo.securecodebox.io/product-tags":"cluster/{{ .Cluster.Name }},namespace/{{ .Namespace.Name }}"},"env":[{"name":"TARGET_URL","value":"{{ .Host.Type }}://{{ .Service.Name }}.{{ .Service.Namespace }}.svc:{{ .Host.Port }}"}],"hookSelector":{},"labels":{},"name":"zap","parameters":["-autorun","/home/securecodebox/scb-automation/automation.yaml"],"repeatInterval":"168h","scanType":"zap-automation-framework","volumeMounts":[{"mountPath":"/home/securecodebox/scb-automation/automation.yaml","name":"zap-automation-framework-baseline-config","subPath":"automation.yaml"}],"volumes":[{"configMap":{"name":"zap-automation-framework-baseline-config"},"name":"zap-automation-framework-baseline-config"}]}` | scanType used for the scans created by the serviceAutoDiscovery | | config.serviceAutoDiscovery.scanConfigs[0].annotations | object | `{"defectdojo.securecodebox.io/engagement-name":"{{ .Target.Name }}","defectdojo.securecodebox.io/engagement-version":"{{if (index .Target.Labels `app.kubernetes.io/version`) }}{{ index .Target.Labels `app.kubernetes.io/version` }}{{end}}","defectdojo.securecodebox.io/product-name":"{{ .Cluster.Name }} | {{ .Namespace.Name }} | {{ .Target.Name }}","defectdojo.securecodebox.io/product-tags":"cluster/{{ .Cluster.Name }},namespace/{{ .Namespace.Name }}"}` | annotations to be added to the scans started by the auto-discovery, all annotation values support templating | -| config.serviceAutoDiscovery.scanConfigs[0].env | list | `[]` | allows to overwrite the env var list of the scan job. the value field supports templating. | +| config.serviceAutoDiscovery.scanConfigs[0].env | list | `[{"name":"TARGET_URL","value":"{{ .Host.Type }}://{{ .Service.Name }}.{{ .Service.Namespace }}.svc:{{ .Host.Port }}"}]` | allows to overwrite the env var list of the scan job. the value field supports templating. | | config.serviceAutoDiscovery.scanConfigs[0].hookSelector | object | `{}` | HookSelector allows to specify a LabelSelector with which the hooks are selected, see: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors Both matchLabels and matchExpressions are supported. All values in the matchLabels map support templating. MatchExpressions support templating in the `key` field and in every entry in the `values` list. If a value in the list renders to an empty string it is removed from the list. | | config.serviceAutoDiscovery.scanConfigs[0].labels | object | `{}` | labels to be added to the scans started by the auto-discovery, all label values support templating | | config.serviceAutoDiscovery.scanConfigs[0].name | string | `"zap"` | unique name to distinguish scans | -| config.serviceAutoDiscovery.scanConfigs[0].parameters | list | `["-t","{{ .Host.Type }}://{{ .Service.Name }}.{{ .Service.Namespace }}.svc:{{ .Host.Port }}"]` | parameters used for the scans created by the serviceAutoDiscovery, all parameters support templating | -| config.serviceAutoDiscovery.scanConfigs[0].repeatInterval | string | `"168h"` | interval in which scans are automatically repeated. If the target is updated (meaning a new image revision is deployed) the scan will repeated beforehand and the interval is reset. | -| config.serviceAutoDiscovery.scanConfigs[0].volumeMounts | list | `[]` | volumeMounts to add to the scan job, see: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes-1 the fields: `name`, `mountPath`, `subPath`, `subPathExpr` of each volumeMount support templating | -| config.serviceAutoDiscovery.scanConfigs[0].volumes | list | `[]` | volumes to add to the scan job, see: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes the fields: `name`, `secret.secretName`, `configMap.name` of each volume support templating | +| config.serviceAutoDiscovery.scanConfigs[0].parameters | list | `["-autorun","/home/securecodebox/scb-automation/automation.yaml"]` | parameters used for the scans created by the serviceAutoDiscovery, all parameters support templating | +| config.serviceAutoDiscovery.scanConfigs[0].volumeMounts | list | `[{"mountPath":"/home/securecodebox/scb-automation/automation.yaml","name":"zap-automation-framework-baseline-config","subPath":"automation.yaml"}]` | volumeMounts to add to the scan job, see: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes-1 the fields: `name`, `mountPath`, `subPath`, `subPathExpr` of each volumeMount support templating | +| config.serviceAutoDiscovery.scanConfigs[0].volumes | list | `[{"configMap":{"name":"zap-automation-framework-baseline-config"},"name":"zap-automation-framework-baseline-config"}]` | volumes to add to the scan job, see: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes the fields: `name`, `secret.secretName`, `configMap.name` of each volume support templating | | image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | image.repository | string | `"securecodebox/auto-discovery-kubernetes"` | | | image.tag | string | `nil` | | diff --git a/auto-discovery/kubernetes/docs/README.DockerHub-Core.md b/auto-discovery/kubernetes/docs/README.DockerHub-Core.md index 2668749495..4e7fcc3ad0 100644 --- a/auto-discovery/kubernetes/docs/README.DockerHub-Core.md +++ b/auto-discovery/kubernetes/docs/README.DockerHub-Core.md @@ -57,9 +57,9 @@ This example deploys [JuiceShop](https://owasp.org/www-project-juice-shop/) to a (You can find the kubernetes manifests for the deployment [here](./demo/juice-shop.yaml)) The AutoDiscovery will automatically pick up this new deployment and then starts a ZAP Scan against it. -The scan created uses our `zap-advanced` ScanType by default, this can be changed with the `config.serviceAutoDiscovery.scanConfig.scanType` config on the autoDiscovery helm release. +The scan created uses our `zap-automation-framework` ScanType by default, this can be changed with the `config.serviceAutoDiscovery.scanConfig.scanType` config on the autoDiscovery helm release. -When the ContainerAutoDiscovery is enabled, the AutoDiscovery can also create a trivy scan for each unique container image (having multiple pods with the same container will only create one scan). The scan type can be defined with `config.containerAutoDiscovery.scanConfig.scanType`. +When the ContainerAutoDiscovery is enabled, the AutoDiscovery can also create a trivy scan for each unique container image (having multiple pods with the same container will only create one scan). The ScanType can be defined with `config.containerAutoDiscovery.scanConfig.scanType`. ## Community From 804d3e90fe027220b6bf065f75ce165e3ee6f2e7 Mon Sep 17 00:00:00 2001 From: Samreet Singh Date: Tue, 27 May 2025 13:45:21 +0200 Subject: [PATCH 5/7] #2940 Fix Scantype in Readme Signed-off-by: Samreet Singh --- auto-discovery/kubernetes/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/auto-discovery/kubernetes/README.md b/auto-discovery/kubernetes/README.md index a65b4eefc7..3a210c4be6 100644 --- a/auto-discovery/kubernetes/README.md +++ b/auto-discovery/kubernetes/README.md @@ -58,7 +58,7 @@ This example deploys [JuiceShop](https://owasp.org/www-project-juice-shop/) to a (You can find the kubernetes manifests for the deployment [here](./demo/juice-shop.yaml)) The AutoDiscovery will automatically pick up this new deployment and then starts a ZAP Scan against it. -The scan created uses our `zap-advanced` ScanType by default, this can be changed with the `config.serviceAutoDiscovery.scanConfig.scanType` config on the autoDiscovery helm release. +The scan created uses our `zap-automation-framework` ScanType by default, this can be changed with the `config.serviceAutoDiscovery.scanConfig.scanType` config on the autoDiscovery helm release. When the ContainerAutoDiscovery is enabled, the AutoDiscovery can also create a trivy scan for each unique container image (having multiple pods with the same container will only create one scan). The scan type can be defined with `config.containerAutoDiscovery.scanConfig.scanType`. From 57e229db4ce8cd3d87fefb580f91d6b212e1857e Mon Sep 17 00:00:00 2001 From: Samreet Singh Date: Tue, 27 May 2025 13:47:31 +0200 Subject: [PATCH 6/7] #2940 Update helm unit tests for zap-automation-framework Signed-off-by: Samreet Singh --- .../tests/__snapshot__/scanner_test.yaml.snap | 37 +++++++++++++++++-- 1 file changed, 33 insertions(+), 4 deletions(-) diff --git a/scanners/zap-automation-framework/tests/__snapshot__/scanner_test.yaml.snap b/scanners/zap-automation-framework/tests/__snapshot__/scanner_test.yaml.snap index 602f87a188..30e6519eb9 100644 --- a/scanners/zap-automation-framework/tests/__snapshot__/scanner_test.yaml.snap +++ b/scanners/zap-automation-framework/tests/__snapshot__/scanner_test.yaml.snap @@ -1,5 +1,34 @@ matches the snapshot: 1: | + apiVersion: v1 + data: + automation.yaml: |- + env: # The environment, mandatory + contexts : # List of 1 or more contexts, mandatory + - name: baseline-config # Name to be used to refer to this context in other jobs, mandatory + urls: ["${TARGET_URL}"] # A mandatory list of top level urls, everything under each url will be included + jobs: + - type: spider # The traditional spider - fast but doesnt handle modern apps so well + parameters: + context: baseline-config # String: Name of the context to spider, default: first context + maxDuration: 1 # Int: The max time in minutes the spider will be allowed to run for, default: 0 unlimited + - type: passiveScan-wait # Passive scan wait for the passive scanner to finish + parameters: + maxDuration: 5 # Int: The max time to wait for the passive scanner, default: 0 unlimited + - type: activeScan # The active scanner - this actively attacks the target so should only be used with permission + parameters: + context: baseline-config # String: Name of the context to attack, default: first context + maxRuleDurationInMins: 3 # Int: The max time in minutes any individual rule will be allowed to run for, default: 0 unlimited + maxScanDurationInMins: 10 # Int: The max time in minutes the active scanner will be allowed to run for, default: 0 unlimited + - type: report # Report generation + parameters: + template: traditional-xml # String: The template id, default : modern + reportDir: /home/securecodebox/ # String: The directory into which the report will be written + reportFile: zap-results # String: The report file name pattern + kind: ConfigMap + metadata: + name: zap-automation-framework-baseline-config + 2: | apiVersion: cascading.securecodebox.io/v1 kind: CascadingRule metadata: @@ -23,7 +52,7 @@ matches the snapshot: - -t - http://{{$.hostOrIP}}:{{attributes.port}} scanType: zap-automation-framework - 2: | + 3: | apiVersion: cascading.securecodebox.io/v1 kind: CascadingRule metadata: @@ -43,7 +72,7 @@ matches the snapshot: - -t - https://{{$.hostOrIP}}:{{attributes.port}} scanType: zap-automation-framework - 3: | + 4: | apiVersion: v1 data: zap-entrypoint.bash: |2 @@ -52,7 +81,7 @@ matches the snapshot: kind: ConfigMap metadata: name: zap-automation-framework-entrypoint - 4: | + 5: | apiVersion: execution.securecodebox.io/v1 kind: ParseDefinition metadata: @@ -72,7 +101,7 @@ matches the snapshot: tolerations: - foo: bar ttlSecondsAfterFinished: null - 5: | + 6: | apiVersion: execution.securecodebox.io/v1 kind: ScanType metadata: From 78d95480953adc690930ce0c541d717dee0b625a Mon Sep 17 00:00:00 2001 From: Samreet Singh Date: Fri, 30 May 2025 14:28:25 +0200 Subject: [PATCH 7/7] #2940 Update zap-scantyoe in the auto-discovery documentation Signed-off-by: Samreet Singh --- auto-discovery/kubernetes/README.md | 15 ++++++------ .../docs/auto-discovery/installation.md | 11 +++++---- .../auto-discovery/service-auto-discovery.md | 6 ++--- documentation/docs/how-tos/autodiscovery.md | 24 +++++++++---------- 4 files changed, 28 insertions(+), 28 deletions(-) diff --git a/auto-discovery/kubernetes/README.md b/auto-discovery/kubernetes/README.md index 3a210c4be6..cd172881b3 100644 --- a/auto-discovery/kubernetes/README.md +++ b/auto-discovery/kubernetes/README.md @@ -16,7 +16,7 @@ The Kubernetes AutoDiscovery needs to be deployed along side the secureCodeBox O The AutoDiscovery controller will automatically detect these new resources (services and containers) and start secureCodeBox _scans_ for them: -1. A ZAP Baseline Scan to detect basic web vulnerabilities in the service. (Using ZAP) +1. A ZAP Baseline Scan to detect basic web vulnerabilities in the service. (Using ZAP-automation-framework) 2. An image scan scanning for vulnerable libraries in the docker / container image of the deployment. (Using trivy) 3. (WIP) A TLS Scan against the certificate of the ingress for the host. (Using SSLyze) @@ -60,7 +60,7 @@ This example deploys [JuiceShop](https://owasp.org/www-project-juice-shop/) to a The AutoDiscovery will automatically pick up this new deployment and then starts a ZAP Scan against it. The scan created uses our `zap-automation-framework` ScanType by default, this can be changed with the `config.serviceAutoDiscovery.scanConfig.scanType` config on the autoDiscovery helm release. -When the ContainerAutoDiscovery is enabled, the AutoDiscovery can also create a trivy scan for each unique container image (having multiple pods with the same container will only create one scan). The scan type can be defined with `config.containerAutoDiscovery.scanConfig.scanType`. +When the ContainerAutoDiscovery is enabled, the AutoDiscovery can also create a trivy scan for each unique container image (having multiple pods with the same container will only create one scan). The ScanType can be defined with `config.containerAutoDiscovery.scanConfig.scanType`. ## Deployment The auto-discovery-kubernetes chart can be deployed via helm: @@ -157,16 +157,15 @@ kubectl -n juice-shop annotate service juice-shop auto-discovery.securecodebox.i | config.resourceInclusion.mode | string | `"enabled-per-namespace"` | | | config.serviceAutoDiscovery.enabled | bool | `true` | | | config.serviceAutoDiscovery.passiveReconcileInterval | string | `"1m"` | interval in which every service is re-checked for updated pods, if service object is updated directly this the service will get reconciled immediately | -| config.serviceAutoDiscovery.scanConfigs[0] | object | `{"annotations":{"defectdojo.securecodebox.io/engagement-name":"{{ .Target.Name }}","defectdojo.securecodebox.io/engagement-version":"{{if (index .Target.Labels `app.kubernetes.io/version`) }}{{ index .Target.Labels `app.kubernetes.io/version` }}{{end}}","defectdojo.securecodebox.io/product-name":"{{ .Cluster.Name }} | {{ .Namespace.Name }} | {{ .Target.Name }}","defectdojo.securecodebox.io/product-tags":"cluster/{{ .Cluster.Name }},namespace/{{ .Namespace.Name }}"},"env":[],"hookSelector":{},"labels":{},"name":"zap","parameters":["-t","{{ .Host.Type }}://{{ .Service.Name }}.{{ .Service.Namespace }}.svc:{{ .Host.Port }}"],"repeatInterval":"168h","scanType":"zap-advanced-scan","volumeMounts":[],"volumes":[]}` | scanType used for the scans created by the serviceAutoDiscovery | +| config.serviceAutoDiscovery.scanConfigs[0] | object | `{"annotations":{"defectdojo.securecodebox.io/engagement-name":"{{ .Target.Name }}","defectdojo.securecodebox.io/engagement-version":"{{if (index .Target.Labels `app.kubernetes.io/version`) }}{{ index .Target.Labels `app.kubernetes.io/version` }}{{end}}","defectdojo.securecodebox.io/product-name":"{{ .Cluster.Name }} | {{ .Namespace.Name }} | {{ .Target.Name }}","defectdojo.securecodebox.io/product-tags":"cluster/{{ .Cluster.Name }},namespace/{{ .Namespace.Name }}"},"env":[{"name":"TARGET_URL","value":"{{ .Host.Type }}://{{ .Service.Name }}.{{ .Service.Namespace }}.svc:{{ .Host.Port }}"}],"hookSelector":{},"labels":{},"name":"zap","parameters":["-autorun","/home/securecodebox/scb-automation/automation.yaml"],"repeatInterval":"168h","scanType":"zap-automation-framework","volumeMounts":[{"mountPath":"/home/securecodebox/scb-automation/automation.yaml","name":"zap-automation-framework-baseline-config","subPath":"automation.yaml"}],"volumes":[{"configMap":{"name":"zap-automation-framework-baseline-config"},"name":"zap-automation-framework-baseline-config"}]}` | scanType used for the scans created by the serviceAutoDiscovery | | config.serviceAutoDiscovery.scanConfigs[0].annotations | object | `{"defectdojo.securecodebox.io/engagement-name":"{{ .Target.Name }}","defectdojo.securecodebox.io/engagement-version":"{{if (index .Target.Labels `app.kubernetes.io/version`) }}{{ index .Target.Labels `app.kubernetes.io/version` }}{{end}}","defectdojo.securecodebox.io/product-name":"{{ .Cluster.Name }} | {{ .Namespace.Name }} | {{ .Target.Name }}","defectdojo.securecodebox.io/product-tags":"cluster/{{ .Cluster.Name }},namespace/{{ .Namespace.Name }}"}` | annotations to be added to the scans started by the auto-discovery, all annotation values support templating | -| config.serviceAutoDiscovery.scanConfigs[0].env | list | `[]` | allows to overwrite the env var list of the scan job. the value field supports templating. | +| config.serviceAutoDiscovery.scanConfigs[0].env | list | `[{"name":"TARGET_URL","value":"{{ .Host.Type }}://{{ .Service.Name }}.{{ .Service.Namespace }}.svc:{{ .Host.Port }}"}]` | allows to overwrite the env var list of the scan job. the value field supports templating. | | config.serviceAutoDiscovery.scanConfigs[0].hookSelector | object | `{}` | HookSelector allows to specify a LabelSelector with which the hooks are selected, see: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors Both matchLabels and matchExpressions are supported. All values in the matchLabels map support templating. MatchExpressions support templating in the `key` field and in every entry in the `values` list. If a value in the list renders to an empty string it is removed from the list. | | config.serviceAutoDiscovery.scanConfigs[0].labels | object | `{}` | labels to be added to the scans started by the auto-discovery, all label values support templating | | config.serviceAutoDiscovery.scanConfigs[0].name | string | `"zap"` | unique name to distinguish scans | -| config.serviceAutoDiscovery.scanConfigs[0].parameters | list | `["-t","{{ .Host.Type }}://{{ .Service.Name }}.{{ .Service.Namespace }}.svc:{{ .Host.Port }}"]` | parameters used for the scans created by the serviceAutoDiscovery, all parameters support templating | -| config.serviceAutoDiscovery.scanConfigs[0].repeatInterval | string | `"168h"` | interval in which scans are automatically repeated. If the target is updated (meaning a new image revision is deployed) the scan will repeated beforehand and the interval is reset. | -| config.serviceAutoDiscovery.scanConfigs[0].volumeMounts | list | `[]` | volumeMounts to add to the scan job, see: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes-1 the fields: `name`, `mountPath`, `subPath`, `subPathExpr` of each volumeMount support templating | -| config.serviceAutoDiscovery.scanConfigs[0].volumes | list | `[]` | volumes to add to the scan job, see: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes the fields: `name`, `secret.secretName`, `configMap.name` of each volume support templating | +| config.serviceAutoDiscovery.scanConfigs[0].parameters | list | `["-autorun","/home/securecodebox/scb-automation/automation.yaml"]` | parameters used for the scans created by the serviceAutoDiscovery, all parameters support templating | +| config.serviceAutoDiscovery.scanConfigs[0].volumeMounts | list | `[{"mountPath":"/home/securecodebox/scb-automation/automation.yaml","name":"zap-automation-framework-baseline-config","subPath":"automation.yaml"}]` | volumeMounts to add to the scan job, see: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes-1 the fields: `name`, `mountPath`, `subPath`, `subPathExpr` of each volumeMount support templating | +| config.serviceAutoDiscovery.scanConfigs[0].volumes | list | `[{"configMap":{"name":"zap-automation-framework-baseline-config"},"name":"zap-automation-framework-baseline-config"}]` | volumes to add to the scan job, see: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes the fields: `name`, `secret.secretName`, `configMap.name` of each volume support templating | | image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | image.repository | string | `"securecodebox/auto-discovery-kubernetes"` | | | image.tag | string | `nil` | | diff --git a/documentation/docs/auto-discovery/installation.md b/documentation/docs/auto-discovery/installation.md index 18c5420c28..10109835cc 100644 --- a/documentation/docs/auto-discovery/installation.md +++ b/documentation/docs/auto-discovery/installation.md @@ -32,9 +32,9 @@ To ease the rollout of the auto-discovery in already existing clusters the auto- This behavior can be configured using one of the following `resourceInclusion` modes: - enabled-per-namespace (default) : scans discovered resources in namespaces marked as enabled by an annotation -- enabled-per-resource : only scans resources marked as enabled by an annotation +- enabled-per-resource : only scans resources marked as enabled by an annotation - all (scans every resource in the whole cluster!) - + These modes can be set via the `config.resourceInclusion` parameter in the helm chart: ```bash @@ -52,6 +52,7 @@ Annotating a namespace can be done as follows. Here the default namespace is ann ```bash kubectl annotate namespace default auto-discovery.securecodebox.io/enabled=true ``` + Annotating a individual resource is done as follows. Here the deployment `juice-shop` in the namespace `default` is annotated. It is done by adding the annotation to the chart values, which is then passed to the deployment template. This results into the pod containing the service/deployment always having the annotation. The process may be different in your case: @@ -60,10 +61,10 @@ It is done by adding the annotation to the chart values, which is then passed to helm upgrade --install juice-shop oci://ghcr.io/securecodebox/helm/juice-shop --set-json='annotations={"auto-discovery.securecodebox.io/enabled":"true"}' ``` -You should now see a ZAP-advanced [ScheduledScan](/docs/api/crds/scheduled-scan) created for juice-shop or any other service that you have annotated. +You should now see a ZAP Automation Framework [ScheduledScan](/docs/api/crds/scheduled-scan) created for juice-shop or any other service that you have annotated. ```bash -$ kubectl get scheduledscans.execution.securecodebox.io +$ kubectl get scheduledscans.execution.securecodebox.io NAME TYPE INTERVAL FINDINGS -juice-shop-service-port-3000 zap-advanced-scan 168h0m0s 5 +juice-shop-service-port-3000 zap-automation-framework 168h0m0s 5 ``` \ No newline at end of file diff --git a/documentation/docs/auto-discovery/service-auto-discovery.md b/documentation/docs/auto-discovery/service-auto-discovery.md index fd78da0661..61169a523f 100644 --- a/documentation/docs/auto-discovery/service-auto-discovery.md +++ b/documentation/docs/auto-discovery/service-auto-discovery.md @@ -14,14 +14,14 @@ The Service AutoDiscovery will create a `ScheduledScan` with the given parameter The Service AutoDiscovery will ignore services where the underlying pods do not serve http(s). It does this by checking for open ports `80, 443, 3000, 5000, 8000, 8443, 8080`. It is also sufficient to name the ports `http` or `https` when a different port is used than the ports specified above. Services without a matching port number or name are currently ignored. -By default the Service AutoDiscovery creates [ZAP Advanced](../scanners/zap-advanced.md) for each service. These scans are relatively generic and don't include any configuration regarding authentication / authorization. As the setup and configuration of the ZAP-Advanced Chart is located in each namespace it is possible to tweak the default configuration to support authenticated and more highly configured scans. For guides on how to configure ZAP Advanced refer to the [ZAP Advanced Documentation](../scanners/zap-advanced.md). +By default the Service AutoDiscovery creates [ZAP Automation Framework](../scanners/zap-automation-framework.md) for each service. These scans are relatively generic and don't include any configuration regarding authentication / authorization. As the setup and configuration of the zap-automation-framework Chart is located in each namespace it is possible to tweak the default configuration to support authenticated and more highly configured scans. For guides on how to configure ZAP Automation Framework refer to the [ZAP Automation Framework Documentation](../scanners/zap-automation-framework.md). ### Setup -By default the Service AutoDiscovery creates ScheduledScans using the [ZAP Advanced](/docs/scanners/zap-advanced) `ScanType`. It must be installed in the same namespace as the containers you wish to scan. The following steps will install `zap-advanced` in the `default` namespace: +By default the Service AutoDiscovery creates ScheduledScans using the [ZAP Automation Framework](/docs/scanners/zap-automation-framework) `ScanType`. It must be installed in the same namespace as the containers you wish to scan. The following steps will install `zap-automation-framework` in the `default` namespace: ```bash -helm upgrade --install zap-advanced oci://ghcr.io/securecodebox/helm/zap-advanced +helm upgrade --install zap-automation-framework oci://ghcr.io/securecodebox/helm/zap-automation-framework ``` #### Deactivation diff --git a/documentation/docs/how-tos/autodiscovery.md b/documentation/docs/how-tos/autodiscovery.md index 4d7b303095..e93a9b10ef 100644 --- a/documentation/docs/how-tos/autodiscovery.md +++ b/documentation/docs/how-tos/autodiscovery.md @@ -29,7 +29,7 @@ If a pod consists of multiple containers, the above described logic will be appl ### Service AutoDiscovery -The Service AutoDiscovery will create a scheduled scan with the given parameters (see [readme](https://github.com/secureCodeBox/secureCodeBox/blob/main/auto-discovery/kubernetes/README.md) for config options) for each Kubernetes service it detects. (It is possible to scan APIs that require authentication, see the [ZAP Advanced](../scanners/zap-advanced.md) documentation). +The Service AutoDiscovery will create a scheduled scan with the given parameters (see [readme](https://github.com/secureCodeBox/secureCodeBox/blob/main/auto-discovery/kubernetes/README.md) for config options) for each Kubernetes service it detects. (It is possible to scan APIs that require authentication, see the [ZAP Automation Framework ](../scanners/zap-automation-framework.md) documentation). The Service AutoDiscovery is enabled by default but can be disabled manually. The Service AutoDiscovery will ignore services where the underlying pods do not serve http(s). It does this by checking for open ports `80, 443, 3000, 5000, 8000, 8443, 8080`. It is also sufficient to name the ports `http` or `https` when a different port is used than the ports specified above. @@ -40,10 +40,10 @@ Services without a matching port number or name are currently ignored. For the sake of the tutorial, it will be assumed that a Kubernetes cluster and the SCB operator is already up and running. If not, check out the [installation](/docs/getting-started/installation/) tutorial for more information. This tutorial will use the `default` and `securecodebox-system` namespaces. -First install the `zap-advanced` (for service AutoDiscovery) and `trivy` (for Container AutoDiscovery) scan types: +First install the `zap-automation-framework` (for service AutoDiscovery) and `trivy` (for Container AutoDiscovery) scan types: ```bash -helm upgrade --install zap-advanced oci://ghcr.io/securecodebox/helm/zap-advanced +helm upgrade --install zap-automation-framework oci://ghcr.io/securecodebox/helm/zap-automation-framework helm upgrade --install trivy oci://ghcr.io/securecodebox/helm/trivy ``` @@ -73,13 +73,13 @@ Then install juice-shop as a demo target: helm upgrade --install juice-shop oci://ghcr.io/securecodebox/helm/juice-shop ``` -The AutoDiscovery will create two scheduled scans after some time. One for the juice-shop service using `zap`, and one for the juice-shop container using `trivy`: +The AutoDiscovery will create two scheduled scans after some time. One for the juice-shop service using `zap-automation-framework`, and one for the juice-shop container using `trivy`: ```bash $ kubectl get scheduledscans -NAME TYPE INTERVAL FINDINGS -juice-shop-service-port-3000 zap-advanced-scan 168h0m0s -scan-juice-shop-at-350cf9a6ea37138b987a3968d046e61bcd3bb18d2ec trivy 168h0m0s +NAME TYPE INTERVAL FINDINGS +juice-shop-service-port-3000 zap-automation-framework 168h0m0s +scan-juice-shop-at-350cf9a6ea37138b987a3968d046e61bcd3bb18d2ec trivy 168h0m0s ``` Install a second juice-shop into the namespace: @@ -88,14 +88,14 @@ Install a second juice-shop into the namespace: helm upgrade --install juice-shop2 oci://ghcr.io/securecodebox/helm/juice-shop ``` -The AutoDiscovery will then create a second `zap` scan for the service, but no additional `trivy` container scan, as the juice-shop container is already being scanned. +The AutoDiscovery will then create a second `zap-automation-framework` scan for the service, but no additional `trivy` container scan, as the juice-shop container is already being scanned. ```bash $ kubectl get scheduledscans -NAME TYPE INTERVAL FINDINGS -juice-shop-service-port-3000 zap-advanced-scan 168h0m0s -juice-shop2-service-port-3000 zap-advanced-scan 168h0m0s -scan-juice-shop-at-350cf9a6ea37138b987a3968d046e61bcd3bb18d2ec trivy 168h0m0s +NAME TYPE INTERVAL FINDINGS +juice-shop-service-port-3000 zap-automation-framework 168h0m0s +juice-shop2-service-port-3000 zap-automation-framework 168h0m0s +scan-juice-shop-at-350cf9a6ea37138b987a3968d046e61bcd3bb18d2ec trivy 168h0m0s ``` Delete both juice-shop deployments.