From 4ec547e30908946327e64eecc9aec076bec73686 Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Thu, 3 Jun 2021 16:36:05 +0200 Subject: [PATCH 1/3] Nmap: replace release name with fixed "nmap" --- scanners/nmap/templates/nmap-scan-type.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scanners/nmap/templates/nmap-scan-type.yaml b/scanners/nmap/templates/nmap-scan-type.yaml index 1107323cee..b3563b62c6 100644 --- a/scanners/nmap/templates/nmap-scan-type.yaml +++ b/scanners/nmap/templates/nmap-scan-type.yaml @@ -5,7 +5,7 @@ apiVersion: "execution.securecodebox.io/v1" kind: ScanType metadata: - name: {{ .Release.Name }} + name: "nmap" spec: extractResults: type: nmap-xml From 630b56a4c8179e1664e1b74d661d49e6364c754d Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Thu, 10 Jun 2021 09:36:21 +0200 Subject: [PATCH 2/3] Scanners: add `scanner.nameAppend` to every scanner chart Signed-off-by: Jop Zitman --- scanners/amass/README.md | 1 + scanners/amass/templates/amass-scan-type.yaml | 2 +- scanners/amass/values.yaml | 4 ++++ scanners/angularjs-csti-scanner/README.md | 1 + .../templates/angularjs-csti-scanner-scan-type.yaml | 2 +- scanners/angularjs-csti-scanner/values.yaml | 3 +++ scanners/git-repo-scanner/README.md | 1 + .../templates/git-repo-scanner-scan-type.yaml | 2 +- scanners/git-repo-scanner/values.yaml | 3 +++ scanners/gitleaks/README.md | 1 + scanners/gitleaks/templates/gitleaks-scan-type.yaml | 2 +- scanners/gitleaks/values.yaml | 3 +++ scanners/kube-hunter/README.md | 1 + scanners/kube-hunter/templates/kubehunter-scan-type.yaml | 2 +- scanners/kube-hunter/values.yaml | 3 +++ scanners/kubeaudit/README.md | 1 + scanners/kubeaudit/templates/kubeaudit-scan-type.yaml | 2 +- scanners/kubeaudit/values.yaml | 3 +++ scanners/ncrack/README.md | 1 + scanners/ncrack/templates/ncrack-scan-type.yaml | 2 +- scanners/ncrack/values.yaml | 3 +++ scanners/nikto/README.md | 1 + scanners/nikto/templates/nikto-scan-type.yaml | 2 +- scanners/nikto/values.yaml | 3 +++ scanners/nmap/README.md | 1 + scanners/nmap/templates/nmap-scan-type.yaml | 2 +- scanners/nmap/values.yaml | 3 +++ scanners/screenshooter/README.md | 1 + .../screenshooter/templates/screenshooter-scan-type.yaml | 2 +- scanners/screenshooter/values.yaml | 4 ++++ scanners/ssh-scan/README.md | 1 + scanners/ssh-scan/templates/ssh-scan-scan-type.yaml | 2 +- scanners/ssh-scan/values.yaml | 4 ++++ scanners/sslyze/README.md | 1 + scanners/sslyze/templates/sslyze-scan-type.yaml | 2 +- scanners/sslyze/values.yaml | 3 +++ scanners/test-scan/README.md | 1 + scanners/test-scan/templates/test-scan-scan-type.yaml | 2 +- scanners/test-scan/values.yaml | 4 ++++ scanners/trivy/README.md | 1 + scanners/trivy/templates/trivy-scan-type.yaml | 2 +- scanners/trivy/values.yaml | 3 +++ scanners/wpscan/README.md | 1 + scanners/wpscan/templates/wpscan-scan-type.yaml | 2 +- scanners/wpscan/values.yaml | 3 +++ scanners/zap-advanced/README.md | 1 + scanners/zap-advanced/templates/zap-advanced-scan-type.yaml | 2 +- scanners/zap-advanced/values.yaml | 3 +++ scanners/zap/README.md | 1 + scanners/zap/templates/zap-scan-type.yaml | 6 +++--- scanners/zap/values.yaml | 3 +++ 51 files changed, 91 insertions(+), 19 deletions(-) diff --git a/scanners/amass/README.md b/scanners/amass/README.md index c51df90630..207c5b801c 100644 --- a/scanners/amass/README.md +++ b/scanners/amass/README.md @@ -49,6 +49,7 @@ Special command line options: | scanner.extraVolumes | list | `[{"configMap":{"name":"amass-config"},"name":"amass-config"}]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.repository | string | `"caffix/amass"` | Container Image to run the scan | | scanner.image.tag | string | `nil` | defaults to the charts appVersion | +| scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | | scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | diff --git a/scanners/amass/templates/amass-scan-type.yaml b/scanners/amass/templates/amass-scan-type.yaml index d7b19b5ead..fb55ed6b0a 100644 --- a/scanners/amass/templates/amass-scan-type.yaml +++ b/scanners/amass/templates/amass-scan-type.yaml @@ -4,7 +4,7 @@ apiVersion: "execution.securecodebox.io/v1" kind: ScanType metadata: - name: "amass" + name: "amass{{ .Values.scanner.nameAppend | default ""}}" spec: extractResults: # amass saves it's result now in json but in "json lines" format diff --git a/scanners/amass/values.yaml b/scanners/amass/values.yaml index 0664e36f5b..7ac9fd6719 100644 --- a/scanners/amass/values.yaml +++ b/scanners/amass/values.yaml @@ -19,6 +19,10 @@ scanner: repository: caffix/amass # scanner.image.tag -- defaults to the charts appVersion tag: null + + # scanner.nameAppend -- append a string to the default scantype name. + nameAppend: null + # scanner.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null # scanner.backoffLimit -- There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) diff --git a/scanners/angularjs-csti-scanner/README.md b/scanners/angularjs-csti-scanner/README.md index 49171a04df..6bf259fcb8 100644 --- a/scanners/angularjs-csti-scanner/README.md +++ b/scanners/angularjs-csti-scanner/README.md @@ -143,6 +143,7 @@ options.scope.request_methods = [ | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.repository | string | `"docker.io/securecodebox/scanner-angularjs-csti-scanner"` | Container Image to run the scan | | scanner.image.tag | string | `nil` | defaults to the charts version | +| scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | | scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | diff --git a/scanners/angularjs-csti-scanner/templates/angularjs-csti-scanner-scan-type.yaml b/scanners/angularjs-csti-scanner/templates/angularjs-csti-scanner-scan-type.yaml index a7c0285f95..97552e3917 100644 --- a/scanners/angularjs-csti-scanner/templates/angularjs-csti-scanner-scan-type.yaml +++ b/scanners/angularjs-csti-scanner/templates/angularjs-csti-scanner-scan-type.yaml @@ -5,7 +5,7 @@ apiVersion: "execution.securecodebox.io/v1" kind: ScanType metadata: - name: "angularjs-csti-scanner" + name: "angularjs-csti-scanner{{ .Values.scanner.nameAppend | default ""}}" spec: extractResults: type: acstis-log diff --git a/scanners/angularjs-csti-scanner/values.yaml b/scanners/angularjs-csti-scanner/values.yaml index fe8820b2a1..6abf93370d 100644 --- a/scanners/angularjs-csti-scanner/values.yaml +++ b/scanners/angularjs-csti-scanner/values.yaml @@ -19,6 +19,9 @@ scanner: # scanner.image.tag -- defaults to the charts version tag: null + # scanner.nameAppend -- append a string to the default scantype name. + nameAppend: null + # scanner.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null diff --git a/scanners/git-repo-scanner/README.md b/scanners/git-repo-scanner/README.md index 42b33d1974..5a133090b0 100644 --- a/scanners/git-repo-scanner/README.md +++ b/scanners/git-repo-scanner/README.md @@ -75,6 +75,7 @@ on the Gitlab server are going to be discovered. | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.repository | string | `"docker.io/securecodebox/scanner-git-repo-scanner"` | Container Image to run the scan | | scanner.image.tag | string | `nil` | defaults to the charts version | +| scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | | scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | diff --git a/scanners/git-repo-scanner/templates/git-repo-scanner-scan-type.yaml b/scanners/git-repo-scanner/templates/git-repo-scanner-scan-type.yaml index 5707bb6e50..bfdc2be49b 100644 --- a/scanners/git-repo-scanner/templates/git-repo-scanner-scan-type.yaml +++ b/scanners/git-repo-scanner/templates/git-repo-scanner-scan-type.yaml @@ -5,7 +5,7 @@ apiVersion: "execution.securecodebox.io/v1" kind: ScanType metadata: - name: "git-repo-scanner" + name: "git-repo-scanner{{ .Values.scanner.nameAppend | default ""}}" spec: extractResults: type: git-repo-scanner-json diff --git a/scanners/git-repo-scanner/values.yaml b/scanners/git-repo-scanner/values.yaml index 733bb62b2e..1ecdc4b7ca 100644 --- a/scanners/git-repo-scanner/values.yaml +++ b/scanners/git-repo-scanner/values.yaml @@ -21,6 +21,9 @@ scanner: # scanner.image.tag -- defaults to the charts version tag: null + # scanner.nameAppend -- append a string to the default scantype name. + nameAppend: null + # scanner.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null # scanner.backoffLimit -- There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) diff --git a/scanners/gitleaks/README.md b/scanners/gitleaks/README.md index 1db60e3af1..67a5004aa0 100644 --- a/scanners/gitleaks/README.md +++ b/scanners/gitleaks/README.md @@ -140,6 +140,7 @@ For more information on how to use cascades take a look at | scanner.extraVolumes | list | `[{"configMap":{"name":"gitleaks-config"},"name":"gitleaks-config"}]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.repository | string | `"docker.io/securecodebox/scanner-gitleaks"` | Container Image to run the scan | | scanner.image.tag | string | `nil` | defaults to the app version | +| scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | | scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | diff --git a/scanners/gitleaks/templates/gitleaks-scan-type.yaml b/scanners/gitleaks/templates/gitleaks-scan-type.yaml index 3bb7fbf643..4c4191b502 100644 --- a/scanners/gitleaks/templates/gitleaks-scan-type.yaml +++ b/scanners/gitleaks/templates/gitleaks-scan-type.yaml @@ -5,7 +5,7 @@ apiVersion: "execution.securecodebox.io/v1" kind: ScanType metadata: - name: "gitleaks" + name: "gitleaks{{ .Values.scanner.nameAppend | default ""}}" spec: extractResults: type: gitleaks-json diff --git a/scanners/gitleaks/values.yaml b/scanners/gitleaks/values.yaml index e0ab599b43..e610308444 100644 --- a/scanners/gitleaks/values.yaml +++ b/scanners/gitleaks/values.yaml @@ -20,6 +20,9 @@ scanner: # scanner.image.tag -- defaults to the app version tag: null + # scanner.nameAppend -- append a string to the default scantype name. + nameAppend: null + # scanner.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null # scanner.backoffLimit -- There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) diff --git a/scanners/kube-hunter/README.md b/scanners/kube-hunter/README.md index 3233ea467a..80964c4190 100644 --- a/scanners/kube-hunter/README.md +++ b/scanners/kube-hunter/README.md @@ -44,6 +44,7 @@ The following security scan configuration example are based on the [kube-hunter | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.repository | string | `"docker.io/securecodebox/scanner-kube-hunter"` | Container Image to run the scan | | scanner.image.tag | string | `nil` | defaults to the charts version | +| scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | | scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | diff --git a/scanners/kube-hunter/templates/kubehunter-scan-type.yaml b/scanners/kube-hunter/templates/kubehunter-scan-type.yaml index 974f21f2d9..b75c7f6ad3 100644 --- a/scanners/kube-hunter/templates/kubehunter-scan-type.yaml +++ b/scanners/kube-hunter/templates/kubehunter-scan-type.yaml @@ -5,7 +5,7 @@ apiVersion: 'execution.securecodebox.io/v1' kind: ScanType metadata: - name: 'kube-hunter' + name: 'kube-hunter{{ .Values.scanner.nameAppend | default ""}}' spec: extractResults: type: kube-hunter-json diff --git a/scanners/kube-hunter/values.yaml b/scanners/kube-hunter/values.yaml index b3d7acbed3..33578b4e39 100644 --- a/scanners/kube-hunter/values.yaml +++ b/scanners/kube-hunter/values.yaml @@ -20,6 +20,9 @@ scanner: # scanner.image.tag -- defaults to the charts version tag: null + # scanner.nameAppend -- append a string to the default scantype name. + nameAppend: null + # scanner.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null # scanner.backoffLimit -- There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) diff --git a/scanners/kubeaudit/README.md b/scanners/kubeaudit/README.md index 4ca2d200cd..c7eaf042bc 100644 --- a/scanners/kubeaudit/README.md +++ b/scanners/kubeaudit/README.md @@ -37,6 +37,7 @@ helm upgrade --install kubeaudit secureCodeBox/kubeaudit | scanner.extraContainers | list | `[]` | Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) | | scanner.extraVolumeMounts | list | `[]` | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | +| scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | | scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | diff --git a/scanners/kubeaudit/templates/kubeaudit-scan-type.yaml b/scanners/kubeaudit/templates/kubeaudit-scan-type.yaml index 9d398ade59..1201da1192 100644 --- a/scanners/kubeaudit/templates/kubeaudit-scan-type.yaml +++ b/scanners/kubeaudit/templates/kubeaudit-scan-type.yaml @@ -5,7 +5,7 @@ apiVersion: "execution.securecodebox.io/v1" kind: ScanType metadata: - name: "kubeaudit" + name: "kubeaudit{{ .Values.scanner.nameAppend | default ""}}" spec: extractResults: type: kubeaudit-jsonl diff --git a/scanners/kubeaudit/values.yaml b/scanners/kubeaudit/values.yaml index 6a21963f88..ef3150b826 100644 --- a/scanners/kubeaudit/values.yaml +++ b/scanners/kubeaudit/values.yaml @@ -15,6 +15,9 @@ parser: ttlSecondsAfterFinished: null scanner: + # scanner.nameAppend -- append a string to the default scantype name. + nameAppend: null + # scanner.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null # scanner.backoffLimit -- There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) diff --git a/scanners/ncrack/README.md b/scanners/ncrack/README.md index 1f9a4fbd06..735d5f3488 100644 --- a/scanners/ncrack/README.md +++ b/scanners/ncrack/README.md @@ -183,6 +183,7 @@ base64 encryptedPassword -d | openssl rsautl -decrypt -inkey key.pem -out decryp | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.repository | string | `"docker.io/securecodebox/scanner-ncrack"` | Container Image to run the scan | | scanner.image.tag | string | `nil` | defaults to the charts appVersion | +| scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | | scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | diff --git a/scanners/ncrack/templates/ncrack-scan-type.yaml b/scanners/ncrack/templates/ncrack-scan-type.yaml index 51c839ca9b..5491a45d5a 100644 --- a/scanners/ncrack/templates/ncrack-scan-type.yaml +++ b/scanners/ncrack/templates/ncrack-scan-type.yaml @@ -5,7 +5,7 @@ apiVersion: "execution.securecodebox.io/v1" kind: ScanType metadata: - name: "ncrack" + name: "ncrack{{ .Values.scanner.nameAppend | default ""}}" spec: extractResults: type: ncrack-xml diff --git a/scanners/ncrack/values.yaml b/scanners/ncrack/values.yaml index 45c164314a..40942ca373 100644 --- a/scanners/ncrack/values.yaml +++ b/scanners/ncrack/values.yaml @@ -25,6 +25,9 @@ scanner: # scanner.image.tag -- defaults to the charts appVersion tag: null + # scanner.nameAppend -- append a string to the default scantype name. + nameAppend: null + # scanner.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null # scanner.backoffLimit -- There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) diff --git a/scanners/nikto/README.md b/scanners/nikto/README.md index 68e9e60d71..65885cdf95 100644 --- a/scanners/nikto/README.md +++ b/scanners/nikto/README.md @@ -63,6 +63,7 @@ Nikto also has a comprehensive list of [command line options documented](https:/ | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.repository | string | `"docker.io/securecodebox/scanner-nikto"` | Container Image to run the scan | | scanner.image.tag | string | `nil` | defaults to the charts appVersion | +| scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | | scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | diff --git a/scanners/nikto/templates/nikto-scan-type.yaml b/scanners/nikto/templates/nikto-scan-type.yaml index 91cb055afe..b9da290b19 100644 --- a/scanners/nikto/templates/nikto-scan-type.yaml +++ b/scanners/nikto/templates/nikto-scan-type.yaml @@ -5,7 +5,7 @@ apiVersion: 'execution.securecodebox.io/v1' kind: ScanType metadata: - name: 'nikto' + name: 'nikto{{ .Values.scanner.nameAppend | default ""}}' spec: extractResults: type: nikto-json diff --git a/scanners/nikto/values.yaml b/scanners/nikto/values.yaml index 29e3efceb9..afe97f29a2 100644 --- a/scanners/nikto/values.yaml +++ b/scanners/nikto/values.yaml @@ -19,6 +19,9 @@ scanner: # scanner.image.tag -- defaults to the charts appVersion tag: null + # scanner.nameAppend -- append a string to the default scantype name. + nameAppend: null + # scanner.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null # scanner.backoffLimit -- There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) diff --git a/scanners/nmap/README.md b/scanners/nmap/README.md index 2eb9731937..e786f20969 100644 --- a/scanners/nmap/README.md +++ b/scanners/nmap/README.md @@ -97,6 +97,7 @@ spec: | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.repository | string | `"docker.io/securecodebox/scanner-nmap"` | Container Image to run the scan | | scanner.image.tag | string | `nil` | defaults to the charts version | +| scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | | scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | diff --git a/scanners/nmap/templates/nmap-scan-type.yaml b/scanners/nmap/templates/nmap-scan-type.yaml index 69f8dbd98c..ee9b39eddc 100644 --- a/scanners/nmap/templates/nmap-scan-type.yaml +++ b/scanners/nmap/templates/nmap-scan-type.yaml @@ -5,7 +5,7 @@ apiVersion: "execution.securecodebox.io/v1" kind: ScanType metadata: - name: {{ .Release.Name }} + name: "nmap{{ .Values.scanner.nameAppend | default ""}}" spec: extractResults: type: nmap-xml diff --git a/scanners/nmap/values.yaml b/scanners/nmap/values.yaml index c76246b64a..164220061a 100644 --- a/scanners/nmap/values.yaml +++ b/scanners/nmap/values.yaml @@ -19,6 +19,9 @@ scanner: # scanner.image.tag -- defaults to the charts version tag: null + # scanner.nameAppend -- append a string to the default scantype name. + nameAppend: null + # scanner.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null # scanner.backoffLimit -- There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) diff --git a/scanners/screenshooter/README.md b/scanners/screenshooter/README.md index a163654bfa..1ed5a5a3e6 100644 --- a/scanners/screenshooter/README.md +++ b/scanners/screenshooter/README.md @@ -38,6 +38,7 @@ You have to provide only the URL to the screenshooter. Be careful, the protocol | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.repository | string | `"docker.io/securecodebox/scanner-screenshooter"` | Container Image to run the scan | | scanner.image.tag | string | `nil` | defaults to the charts version | +| scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | | scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | diff --git a/scanners/screenshooter/templates/screenshooter-scan-type.yaml b/scanners/screenshooter/templates/screenshooter-scan-type.yaml index f97c4c4a9b..bf6c252829 100644 --- a/scanners/screenshooter/templates/screenshooter-scan-type.yaml +++ b/scanners/screenshooter/templates/screenshooter-scan-type.yaml @@ -5,7 +5,7 @@ apiVersion: "execution.securecodebox.io/v1" kind: ScanType metadata: - name: "screenshooter" + name: "screenshooter{{ .Values.scanner.nameAppend | default ""}}" spec: extractResults: type: screenshot-png diff --git a/scanners/screenshooter/values.yaml b/scanners/screenshooter/values.yaml index 632b2f3a8d..253c67cc01 100644 --- a/scanners/screenshooter/values.yaml +++ b/scanners/screenshooter/values.yaml @@ -18,6 +18,10 @@ scanner: repository: docker.io/securecodebox/scanner-screenshooter # scanner.image.tag -- defaults to the charts version tag: null + + # scanner.nameAppend -- append a string to the default scantype name. + nameAppend: null + # scanner.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null # scanner.backoffLimit -- There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) diff --git a/scanners/ssh-scan/README.md b/scanners/ssh-scan/README.md index 20a1b3d79f..0b7f23c1e2 100644 --- a/scanners/ssh-scan/README.md +++ b/scanners/ssh-scan/README.md @@ -76,6 +76,7 @@ Examples: | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.repository | string | `"mozilla/ssh_scan"` | Container Image to run the scan | | scanner.image.tag | string | `"latest@sha256:d6f41c2c328223931b97a4ae5d35d3bb91b5c8d91871ced3d2e0cde06b1edf1f"` | defaults to the charts appVersion | +| scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | | scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | diff --git a/scanners/ssh-scan/templates/ssh-scan-scan-type.yaml b/scanners/ssh-scan/templates/ssh-scan-scan-type.yaml index ccbeadbe85..eeb9333d7a 100644 --- a/scanners/ssh-scan/templates/ssh-scan-scan-type.yaml +++ b/scanners/ssh-scan/templates/ssh-scan-scan-type.yaml @@ -5,7 +5,7 @@ apiVersion: "execution.securecodebox.io/v1" kind: ScanType metadata: - name: "ssh-scan" + name: "ssh-scan{{ .Values.scanner.nameAppend | default ""}}" spec: extractResults: type: ssh-scan-json diff --git a/scanners/ssh-scan/values.yaml b/scanners/ssh-scan/values.yaml index d70079d081..d35f1aee28 100644 --- a/scanners/ssh-scan/values.yaml +++ b/scanners/ssh-scan/values.yaml @@ -18,6 +18,10 @@ scanner: repository: mozilla/ssh_scan # scanner.image.tag -- defaults to the charts appVersion tag: "latest@sha256:d6f41c2c328223931b97a4ae5d35d3bb91b5c8d91871ced3d2e0cde06b1edf1f" + + # scanner.nameAppend -- append a string to the default scantype name. + nameAppend: null + # scanner.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null # scanner.backoffLimit -- There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) diff --git a/scanners/sslyze/README.md b/scanners/sslyze/README.md index 23fce62b00..ebb698f056 100644 --- a/scanners/sslyze/README.md +++ b/scanners/sslyze/README.md @@ -143,6 +143,7 @@ Options: | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.repository | string | `"nablac0d3/sslyze"` | Container Image to run the scan | | scanner.image.tag | string | `"latest@sha256:ff2c5c626401b1961736a5b2ae6e35a41d213e8b2712102100abf5ee46dcca71"` | defaults to the charts appVersion | +| scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | | scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | diff --git a/scanners/sslyze/templates/sslyze-scan-type.yaml b/scanners/sslyze/templates/sslyze-scan-type.yaml index 923952a65a..6ee9218aad 100644 --- a/scanners/sslyze/templates/sslyze-scan-type.yaml +++ b/scanners/sslyze/templates/sslyze-scan-type.yaml @@ -5,7 +5,7 @@ apiVersion: 'execution.securecodebox.io/v1' kind: ScanType metadata: - name: 'sslyze' + name: 'sslyze{{ .Values.scanner.nameAppend | default ""}}' spec: extractResults: type: sslyze-json diff --git a/scanners/sslyze/values.yaml b/scanners/sslyze/values.yaml index 67a2e49ed7..996773d26a 100644 --- a/scanners/sslyze/values.yaml +++ b/scanners/sslyze/values.yaml @@ -20,6 +20,9 @@ scanner: # scanner.image.tag -- defaults to the charts appVersion tag: "latest@sha256:ff2c5c626401b1961736a5b2ae6e35a41d213e8b2712102100abf5ee46dcca71" + # scanner.nameAppend -- append a string to the default scantype name. + nameAppend: null + # scanner.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null # scanner.backoffLimit -- There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) diff --git a/scanners/test-scan/README.md b/scanners/test-scan/README.md index 6362a77b90..540bfce674 100644 --- a/scanners/test-scan/README.md +++ b/scanners/test-scan/README.md @@ -22,6 +22,7 @@ It's rather unlikely that you'll need this outside of testing usecases, as it do | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.repository | string | `"docker.io/securecodebox/scanner-test-scan"` | Container Image to run the scan | | scanner.image.tag | string | `nil` | | +| scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | | scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | diff --git a/scanners/test-scan/templates/test-scan-scan-type.yaml b/scanners/test-scan/templates/test-scan-scan-type.yaml index 62cc4328e5..a66906df72 100644 --- a/scanners/test-scan/templates/test-scan-scan-type.yaml +++ b/scanners/test-scan/templates/test-scan-scan-type.yaml @@ -5,7 +5,7 @@ apiVersion: "execution.securecodebox.io/v1" kind: ScanType metadata: - name: "test-scan" + name: "test-scan{{ .Values.scanner.nameAppend | default ""}}" spec: extractResults: type: test-txt diff --git a/scanners/test-scan/values.yaml b/scanners/test-scan/values.yaml index a7c851075e..7d9150cedb 100644 --- a/scanners/test-scan/values.yaml +++ b/scanners/test-scan/values.yaml @@ -18,6 +18,10 @@ scanner: repository: docker.io/securecodebox/scanner-test-scan # scanner.image.tag - defaults to the charts version tag: null + + # scanner.nameAppend -- append a string to the default scantype name. + nameAppend: null + # scanner.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null # scanner.backoffLimit -- There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) diff --git a/scanners/trivy/README.md b/scanners/trivy/README.md index 6b175c2971..83cdba6a19 100644 --- a/scanners/trivy/README.md +++ b/scanners/trivy/README.md @@ -47,6 +47,7 @@ The following security scan configuration example are based on the [Trivy Docume | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.repository | string | `"docker.io/aquasec/trivy"` | Container Image to run the scan | | scanner.image.tag | string | `nil` | defaults to the charts appVersion | +| scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | | scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | diff --git a/scanners/trivy/templates/trivy-scan-type.yaml b/scanners/trivy/templates/trivy-scan-type.yaml index 8085a35524..67ea06c586 100644 --- a/scanners/trivy/templates/trivy-scan-type.yaml +++ b/scanners/trivy/templates/trivy-scan-type.yaml @@ -5,7 +5,7 @@ apiVersion: "execution.securecodebox.io/v1" kind: ScanType metadata: - name: "trivy" + name: "trivy{{ .Values.scanner.nameAppend | default ""}}" spec: name: "trivy" extractResults: diff --git a/scanners/trivy/values.yaml b/scanners/trivy/values.yaml index df0f068cb0..81cc7c6b54 100644 --- a/scanners/trivy/values.yaml +++ b/scanners/trivy/values.yaml @@ -20,6 +20,9 @@ scanner: # scanner.image.tag -- defaults to the charts appVersion tag: null + # scanner.nameAppend -- append a string to the default scantype name. + nameAppend: null + # scanner.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null # scanner.backoffLimit -- There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) diff --git a/scanners/wpscan/README.md b/scanners/wpscan/README.md index 99d686a1ce..4469c30ea7 100644 --- a/scanners/wpscan/README.md +++ b/scanners/wpscan/README.md @@ -82,6 +82,7 @@ Incompatible choices (only one of each group/s can be used): | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.repository | string | `"wpscanteam/wpscan"` | Container Image to run the scan | | scanner.image.tag | string | `nil` | defaults to the charts appVersion | +| scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | | scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | diff --git a/scanners/wpscan/templates/wpscan-scan-type.yaml b/scanners/wpscan/templates/wpscan-scan-type.yaml index 7b48e5acc7..7247ea6c89 100644 --- a/scanners/wpscan/templates/wpscan-scan-type.yaml +++ b/scanners/wpscan/templates/wpscan-scan-type.yaml @@ -5,7 +5,7 @@ apiVersion: "execution.securecodebox.io/v1" kind: ScanType metadata: - name: "wpscan" + name: "wpscan{{ .Values.scanner.nameAppend | default ""}}" spec: extractResults: type: wpscan-json diff --git a/scanners/wpscan/values.yaml b/scanners/wpscan/values.yaml index ca9beec707..b3b7dc9cca 100644 --- a/scanners/wpscan/values.yaml +++ b/scanners/wpscan/values.yaml @@ -20,6 +20,9 @@ scanner: # scanner.image.tag -- defaults to the charts appVersion tag: null + # scanner.nameAppend -- append a string to the default scantype name. + nameAppend: null + # scanner.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null # scanner.backoffLimit -- There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) diff --git a/scanners/zap-advanced/README.md b/scanners/zap-advanced/README.md index e059dd4d68..6d0169b258 100644 --- a/scanners/zap-advanced/README.md +++ b/scanners/zap-advanced/README.md @@ -474,6 +474,7 @@ optional arguments: | scanner.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | scanner.image.repository | string | `"docker.io/securecodebox/scanner-zap-advanced"` | Container Image to run the scan | | scanner.image.tag | string | `nil` | defaults to the charts appVersion | +| scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | | scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | diff --git a/scanners/zap-advanced/templates/zap-advanced-scan-type.yaml b/scanners/zap-advanced/templates/zap-advanced-scan-type.yaml index 54a9e99217..9bc97049af 100644 --- a/scanners/zap-advanced/templates/zap-advanced-scan-type.yaml +++ b/scanners/zap-advanced/templates/zap-advanced-scan-type.yaml @@ -17,7 +17,7 @@ data: apiVersion: "execution.securecodebox.io/v1" kind: ScanType metadata: - name: zap-advanced-scan + name: "zap-advanced-scan{{ .Values.scanner.nameAppend | default ""}}" labels: {{- include "zap.labels" . | nindent 4 }} spec: diff --git a/scanners/zap-advanced/values.yaml b/scanners/zap-advanced/values.yaml index 7e36928529..ce6afdb0a4 100644 --- a/scanners/zap-advanced/values.yaml +++ b/scanners/zap-advanced/values.yaml @@ -24,6 +24,9 @@ scanner: # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images pullPolicy: IfNotPresent + # scanner.nameAppend -- append a string to the default scantype name. + nameAppend: null + # -- seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null # -- There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) diff --git a/scanners/zap/README.md b/scanners/zap/README.md index 87c334ff91..ca4261d55d 100644 --- a/scanners/zap/README.md +++ b/scanners/zap/README.md @@ -74,6 +74,7 @@ Options: | scanner.extraVolumes | list | `[{"emptyDir":{},"name":"zap-workdir"}]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.repository | string | `"owasp/zap2docker-stable"` | Container Image to run the scan | | scanner.image.tag | string | `nil` | defaults to the charts appVersion | +| scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | | scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | diff --git a/scanners/zap/templates/zap-scan-type.yaml b/scanners/zap/templates/zap-scan-type.yaml index f2b4d07d56..d5fe20beea 100644 --- a/scanners/zap/templates/zap-scan-type.yaml +++ b/scanners/zap/templates/zap-scan-type.yaml @@ -5,7 +5,7 @@ apiVersion: "execution.securecodebox.io/v1" kind: ScanType metadata: - name: "zap-baseline-scan" + name: "zap-baseline-scan{{ .Values.scanner.nameAppend | default ""}}" spec: extractResults: type: zap-xml @@ -49,7 +49,7 @@ spec: apiVersion: "execution.securecodebox.io/v1" kind: ScanType metadata: - name: "zap-api-scan" + name: "zap-api-scan{{ .Values.scanner.nameAppend | default ""}}" spec: extractResults: type: zap-xml @@ -92,7 +92,7 @@ spec: apiVersion: "execution.securecodebox.io/v1" kind: ScanType metadata: - name: "zap-full-scan" + name: "zap-full-scan{{ .Values.scanner.nameAppend | default ""}}" spec: extractResults: type: zap-xml diff --git a/scanners/zap/values.yaml b/scanners/zap/values.yaml index 3069aa1562..cad421debb 100644 --- a/scanners/zap/values.yaml +++ b/scanners/zap/values.yaml @@ -19,6 +19,9 @@ scanner: # scanner.image.tag -- defaults to the charts appVersion tag: null + # scanner.nameAppend -- append a string to the default scantype name. + nameAppend: null + # scanner.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null # scanner.backoffLimit -- There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) From 2ca9a3e0dd7feaa26932149dd1f19f28dc990cc8 Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Thu, 10 Jun 2021 09:40:24 +0200 Subject: [PATCH 3/3] Nmap: fix -privileged example Signed-off-by: Jop Zitman --- scanners/nmap/README.md | 1 + scanners/nmap/README.md.gotmpl | 1 + 2 files changed, 2 insertions(+) diff --git a/scanners/nmap/README.md b/scanners/nmap/README.md index e786f20969..58cfc23139 100644 --- a/scanners/nmap/README.md +++ b/scanners/nmap/README.md @@ -53,6 +53,7 @@ You can deploy the ScanType with the config like this: ```bash cat <