diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 50d9ecca4c..1d20fa7318 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -613,13 +613,13 @@ jobs: - name: "Hooks (ReadAndWrite) Integration Tests" run: | helm -n integration-tests install update-category ./hooks/update-field/ \ - --set="image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/hook-update-field" \ - --set="image.tag=sha-$(git rev-parse --short HEAD)" \ + --set="hook.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/hook-update-field" \ + --set="hook.image.tag=sha-$(git rev-parse --short HEAD)" \ --set="attribute.name=category" \ --set="attribute.value=fancy-category" helm -n integration-tests install update-severity ./hooks/update-field/ \ - --set="image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/hook-update-field" \ - --set="image.tag=sha-$(git rev-parse --short HEAD)" \ + --set="hook.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/hook-update-field" \ + --set="hook.image.tag=sha-$(git rev-parse --short HEAD)" \ --set="attribute.name=severity" \ --set="attribute.value=high" helm -n integration-tests install test-scan ./scanners/test-scan/ \ @@ -642,9 +642,9 @@ jobs: --set="scanner.image.tag=sha-$(git rev-parse --short HEAD)" helm -n integration-tests install http-webhook ./demo-apps/http-webhook helm -n integration-tests install ro-hook ./hooks/generic-webhook/ \ - --set="image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/hook-generic-webhook" \ + --set="hook.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/hook-generic-webhook" \ --set="webhookUrl=http://http-webhook/hallo-welt" \ - --set="image.tag=sha-$(git rev-parse --short HEAD)" + --set="hook.image.tag=sha-$(git rev-parse --short HEAD)" cd tests/integration/ npx jest --ci --color generic/read-only-hook.test.js helm -n integration-tests uninstall test-scan http-webhook ro-hook @@ -772,8 +772,8 @@ jobs: helm -n integration-tests install http-webhook ./demo-apps/http-webhook --wait helm -n integration-tests install notification-hook ./hooks/notification --values tests/integration/hooks/__testFiles__/notification-values.yaml \ - --set="image.repository=docker.io/${{env.DOCKER_NAMESPACE }}/hook-notification" \ - --set="image.tag=sha-$(git rev-parse --short HEAD)" + --set="hook.image.repository=docker.io/${{env.DOCKER_NAMESPACE }}/hook-notification" \ + --set="hook.image.tag=sha-$(git rev-parse --short HEAD)" cd tests/integration/ npx jest --ci --color ./hooks/notification.test.js @@ -848,8 +848,8 @@ jobs: kubectl create namespace cascading-tests # Install cascading-scans hook helm upgrade --install dssh ./hooks/cascading-scans/ -n cascading-tests \ - --set="image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/hook-cascading-scans" \ - --set="image.tag=sha-$(git rev-parse --short HEAD)" + --set="hook.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/hook-cascading-scans" \ + --set="hook.image.tag=sha-$(git rev-parse --short HEAD)" # Install nmap helm -n cascading-tests install nmap ./scanners/nmap/ \ --set="scanner.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/scanner-nmap" \ @@ -891,8 +891,8 @@ jobs: kubectl create namespace cascading-tests # Install cascading-scans hook helm upgrade --install dssh ./hooks/cascading-scans/ -n cascading-tests --wait \ - --set="image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/hook-cascading-scans" \ - --set="image.tag=sha-$(git rev-parse --short HEAD)" + --set="hook.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/hook-cascading-scans" \ + --set="hook.image.tag=sha-$(git rev-parse --short HEAD)" # Install unsafe-https helm upgrade --install unsafe-https ./demo-apps/unsafe-https/ -n cascading-tests --wait # Install nmap diff --git a/hooks/cascading-scans/README.md b/hooks/cascading-scans/README.md index 9d23e94007..acd7c0f673 100644 --- a/hooks/cascading-scans/README.md +++ b/hooks/cascading-scans/README.md @@ -119,6 +119,6 @@ zap-http zap-baseline-scan non-invasive medium | Key | Type | Default | Description | |-----|------|---------|-------------| -| hookJob.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | -| image.repository | string | `"docker.io/securecodebox/hook-cascading-scans"` | Hook image repository | -| image.tag | string | defaults to the charts version | The image Tag defaults to the charts version if not defined. | +| hook.image.repository | string | `"docker.io/securecodebox/hook-cascading-scans"` | Hook image repository | +| hook.image.tag | string | defaults to the charts version | The image Tag defaults to the charts version if not defined. | +| hook.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | diff --git a/hooks/cascading-scans/templates/cascading-scans-hook.yaml b/hooks/cascading-scans/templates/cascading-scans-hook.yaml index c57fb938a4..ac0c8328bf 100644 --- a/hooks/cascading-scans/templates/cascading-scans-hook.yaml +++ b/hooks/cascading-scans/templates/cascading-scans-hook.yaml @@ -10,8 +10,8 @@ metadata: {{- include "cascading-scans.labels" . | nindent 4 }} spec: type: ReadOnly - image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.Version }}" + image: "{{ .Values.hook.image.repository }}:{{ .Values.hook.image.tag | default .Chart.Version }}" imagePullSecrets: - name: "securecodebox" - ttlSecondsAfterFinished: {{ .Values.hookJob.ttlSecondsAfterFinished }} + ttlSecondsAfterFinished: {{ .Values.hook.ttlSecondsAfterFinished }} serviceAccountName: cascading-scans diff --git a/hooks/cascading-scans/values.yaml b/hooks/cascading-scans/values.yaml index ffb6123a6a..99e7551d2c 100644 --- a/hooks/cascading-scans/values.yaml +++ b/hooks/cascading-scans/values.yaml @@ -6,13 +6,13 @@ # This is a YAML-formatted file. # Declare variables to be passed into your templates. -image: - # image.repository -- Hook image repository - repository: docker.io/securecodebox/hook-cascading-scans - # image.tag -- The image Tag defaults to the charts version if not defined. - # @default -- defaults to the charts version - tag: null +hook: + image: + # hook.image.repository -- Hook image repository + repository: docker.io/securecodebox/hook-cascading-scans + # hook.image.tag -- The image Tag defaults to the charts version if not defined. + # @default -- defaults to the charts version + tag: null -hookJob: - # hookJob.ttlSecondsAfterFinished -- Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ + # hook.ttlSecondsAfterFinished -- Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null diff --git a/hooks/finding-post-processing/README.md b/hooks/finding-post-processing/README.md index 2150727664..6f53e21f25 100644 --- a/hooks/finding-post-processing/README.md +++ b/hooks/finding-post-processing/README.md @@ -54,7 +54,7 @@ The `override` field specifies the desired fields and values that need to be upd | Key | Type | Default | Description | |-----|------|---------|-------------| -| hookJob.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | -| image.repository | string | `"docker.io/securecodebox/hook-finding-post-processing"` | Hook image repository | -| image.tag | string | defaults to the charts version | The image Tag defaults to the charts version if not defined. | +| hook.image.repository | string | `"docker.io/securecodebox/hook-finding-post-processing"` | Hook image repository | +| hook.image.tag | string | defaults to the charts version | The image Tag defaults to the charts version if not defined. | +| hook.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | | rules | list | `[]` | | diff --git a/hooks/finding-post-processing/templates/finding-post-processing-hook.yaml b/hooks/finding-post-processing/templates/finding-post-processing-hook.yaml index c5051d7778..345c658e6a 100644 --- a/hooks/finding-post-processing/templates/finding-post-processing-hook.yaml +++ b/hooks/finding-post-processing/templates/finding-post-processing-hook.yaml @@ -10,7 +10,7 @@ metadata: {{- include "finding-post-processing.labels" . | nindent 4 }} spec: type: ReadAndWrite - image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.Version }}" + image: "{{ .Values.hook.image.repository }}:{{ .Values.hook.image.tag | default .Chart.Version }}" env: - name: RULES value: {{ .Values.rules | toJson | quote }} diff --git a/hooks/finding-post-processing/values.yaml b/hooks/finding-post-processing/values.yaml index 91b977e1cd..de15067128 100644 --- a/hooks/finding-post-processing/values.yaml +++ b/hooks/finding-post-processing/values.yaml @@ -6,14 +6,8 @@ # This is a YAML-formatted file. # Declare variables to be passed into your templates. -image: - # image.repository -- Hook image repository - repository: docker.io/securecodebox/hook-finding-post-processing - # image.tag -- The image Tag defaults to the charts version if not defined. - # @default -- defaults to the charts version - tag: null - -rules: [] +rules: + [] #- matches: # anyOf: # - category: "Open Port" @@ -28,6 +22,13 @@ rules: [] # severity: "high" # description: "Telnet is bad" -hookJob: - # hookJob.ttlSecondsAfterFinished -- Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ +hook: + image: + # hook.image.repository -- Hook image repository + repository: docker.io/securecodebox/hook-finding-post-processing + # hook.image.tag -- The image Tag defaults to the charts version if not defined. + # @default -- defaults to the charts version + tag: null + + # hook.ttlSecondsAfterFinished -- Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null diff --git a/hooks/generic-webhook/README.md b/hooks/generic-webhook/README.md index 11c8374a40..31bde16360 100644 --- a/hooks/generic-webhook/README.md +++ b/hooks/generic-webhook/README.md @@ -21,7 +21,7 @@ helm upgrade --install gwh secureCodeBox/generic-webhook --set webhookUrl="http: | Key | Type | Default | Description | |-----|------|---------|-------------| -| hookJob.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | -| image.repository | string | `"docker.io/securecodebox/hook-generic-webhook"` | Hook image repository | -| image.tag | string | defaults to the charts version | The image Tag defaults to the charts version if not defined. | +| hook.image.repository | string | `"docker.io/securecodebox/hook-generic-webhook"` | Hook image repository | +| hook.image.tag | string | defaults to the charts version | The image Tag defaults to the charts version if not defined. | +| hook.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | | webhookUrl | string | `"http://example.com"` | The URL of your WebHook endpoint | diff --git a/hooks/generic-webhook/templates/webhook-hook.yaml b/hooks/generic-webhook/templates/webhook-hook.yaml index b65db67863..4e7cd95454 100644 --- a/hooks/generic-webhook/templates/webhook-hook.yaml +++ b/hooks/generic-webhook/templates/webhook-hook.yaml @@ -10,8 +10,8 @@ metadata: {{- include "generic-webhook.labels" . | nindent 4 }} spec: type: ReadOnly - image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.Version }}" - ttlSecondsAfterFinished: {{ .Values.hookJob.ttlSecondsAfterFinished }} + image: "{{ .Values.hook.image.repository }}:{{ .Values.hook.image.tag | default .Chart.Version }}" + ttlSecondsAfterFinished: {{ .Values.hook.ttlSecondsAfterFinished }} env: - name: WEBHOOK_URL value: {{ .Values.webhookUrl | quote }} diff --git a/hooks/generic-webhook/values.yaml b/hooks/generic-webhook/values.yaml index 7cc2fd73c4..1f9f278664 100644 --- a/hooks/generic-webhook/values.yaml +++ b/hooks/generic-webhook/values.yaml @@ -9,13 +9,13 @@ # webhookUrl -- The URL of your WebHook endpoint webhookUrl: "http://example.com" -image: - # image.repository -- Hook image repository - repository: docker.io/securecodebox/hook-generic-webhook - # image.tag -- The image Tag defaults to the charts version if not defined. - # @default -- defaults to the charts version - tag: null +hook: + image: + # hook.image.repository -- Hook image repository + repository: docker.io/securecodebox/hook-generic-webhook + # hook.image.tag -- The image Tag defaults to the charts version if not defined. + # @default -- defaults to the charts version + tag: null -hookJob: - # hookJob.ttlSecondsAfterFinished -- Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ + # hook.ttlSecondsAfterFinished -- Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null diff --git a/hooks/notification/README.md b/hooks/notification/README.md index 01895301f2..a5b7f51a05 100644 --- a/hooks/notification/README.md +++ b/hooks/notification/README.md @@ -221,10 +221,10 @@ To fill your template with data we provide the following objects. | env[1].name | string | `"SMTP_CONFIG"` | | | env[1].valueFrom.secretKeyRef.key | string | `"smtp-config-key"` | | | env[1].valueFrom.secretKeyRef.name | string | `"some-secret"` | | -| hookJob.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | -| image.pullPolicy | string | `"Always"` | | -| image.repository | string | `"docker.io/securecodebox/hook-notification"` | Hook image repository | -| image.tag | string | defaults to the charts version | Image tag | +| hook.image.pullPolicy | string | `"Always"` | | +| hook.image.repository | string | `"docker.io/securecodebox/hook-notification"` | Hook image repository | +| hook.image.tag | string | defaults to the charts version | Image tag | +| hook.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | | notificationChannels[0].endPoint | string | `"SOME_ENV_KEY"` | | | notificationChannels[0].name | string | `"slack"` | | | notificationChannels[0].rules[0].matches.anyOf[0].category | string | `"Open Port"` | | diff --git a/hooks/notification/templates/notification-hook.yaml b/hooks/notification/templates/notification-hook.yaml index fab4396346..c7d306d90a 100644 --- a/hooks/notification/templates/notification-hook.yaml +++ b/hooks/notification/templates/notification-hook.yaml @@ -8,9 +8,9 @@ metadata: name: {{ include "notification-hook.fullname" . }} spec: type: ReadOnly - imagePullPolicy: "{{ .Values.image.pullPolicy }}" - image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.Version }}" - ttlSecondsAfterFinished: {{ .Values.hookJob.ttlSecondsAfterFinished }} + imagePullPolicy: "{{ .Values.hook.image.pullPolicy }}" + image: "{{ .Values.hook.image.repository }}:{{ .Values.hook.image.tag | default .Chart.Version }}" + ttlSecondsAfterFinished: {{ .Values.hook.ttlSecondsAfterFinished }} volumes: - name: {{ .Release.Name }}-config configMap: diff --git a/hooks/notification/values.yaml b/hooks/notification/values.yaml index ecbcdf0aba..0ec081e81d 100644 --- a/hooks/notification/values.yaml +++ b/hooks/notification/values.yaml @@ -6,16 +6,16 @@ # This is a YAML-formatted file. # Declare variables to be passed into your templates. -image: - # image.repository -- Hook image repository - repository: docker.io/securecodebox/hook-notification - # image.tag -- Image tag - # @default -- defaults to the charts version - tag: null - pullPolicy: Always +hook: + image: + # hook.image.repository -- Hook image repository + repository: docker.io/securecodebox/hook-notification + # hook.image.tag -- Image tag + # @default -- defaults to the charts version + tag: null + pullPolicy: Always -hookJob: - # hookJob.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ + # hook.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null notificationChannels: diff --git a/hooks/persistence-defectdojo/README.md b/hooks/persistence-defectdojo/README.md index 80612a8721..14f71bd946 100644 --- a/hooks/persistence-defectdojo/README.md +++ b/hooks/persistence-defectdojo/README.md @@ -133,6 +133,6 @@ helm upgrade --install dd secureCodeBox/persistence-defectdojo \ | defectdojo.authentication.usernameKey | string | `"username"` | Name of the username key in the `userSecret` secret. Use this if you already have a secret with different key / value pairs | | defectdojo.syncFindingsBack | bool | `true` | Syncs back (two way sync) all imported findings from DefectDojo to SCB Findings Store, set to false to only import the findings to DefectDojo (one way sync). | | defectdojo.url | string | `"http://defectdojo-django.default.svc"` | Url to the DefectDojo Instance | -| image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | -| image.repository | string | `"docker.io/securecodebox/hook-persistence-defectdojo"` | Hook image repository | -| image.tag | string | `nil` | Container image tag | +| hook.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | +| hook.image.repository | string | `"docker.io/securecodebox/hook-persistence-defectdojo"` | Hook image repository | +| hook.image.tag | string | `nil` | Container image tag | diff --git a/hooks/persistence-defectdojo/templates/persistence-provider.yaml b/hooks/persistence-defectdojo/templates/persistence-provider.yaml index 756f54dff4..252260fdef 100644 --- a/hooks/persistence-defectdojo/templates/persistence-provider.yaml +++ b/hooks/persistence-defectdojo/templates/persistence-provider.yaml @@ -15,8 +15,8 @@ spec: {{- else }} type: ReadOnly {{- end }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.Version }}" - imagePullPolicy: "{{ .Values.image.pullPolicy }}" + image: "{{ .Values.hook.image.repository }}:{{ .Values.hook.image.tag | default .Chart.Version }}" + imagePullPolicy: "{{ .Values.hook.image.pullPolicy }}" env: - name: DEFECTDOJO_URL value: {{ .Values.defectdojo.url | quote }} diff --git a/hooks/persistence-defectdojo/values.yaml b/hooks/persistence-defectdojo/values.yaml index 5bcf8f7930..dfccc1daf8 100644 --- a/hooks/persistence-defectdojo/values.yaml +++ b/hooks/persistence-defectdojo/values.yaml @@ -6,14 +6,15 @@ # This is a YAML-formatted file. # Declare variables to be passed into your templates. -image: - # image.repository -- Hook image repository - repository: docker.io/securecodebox/hook-persistence-defectdojo - # -- Container image tag - # @default -- defaults to the charts version - tag: null - # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images - pullPolicy: IfNotPresent +hook: + image: + # hook.image.repository -- Hook image repository + repository: docker.io/securecodebox/hook-persistence-defectdojo + # -- Container image tag + # @default -- defaults to the charts version + tag: null + # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + pullPolicy: IfNotPresent defectdojo: # -- Syncs back (two way sync) all imported findings from DefectDojo to SCB Findings Store, set to false to only import the findings to DefectDojo (one way sync). diff --git a/hooks/persistence-elastic/README.md b/hooks/persistence-elastic/README.md index 067f93bfb7..0d23c70700 100644 --- a/hooks/persistence-elastic/README.md +++ b/hooks/persistence-elastic/README.md @@ -43,9 +43,9 @@ the [Luxon documentation](https://moment.github.io/luxon/docs/manual/formatting. | externalElasticStack.enabled | bool | `false` | Enable this when you already have an Elastic Stack running to which you want to send your results | | externalElasticStack.kibanaAddress | string | `"https://kibana.example.com"` | The URL of the kibana service used to visualize all findings. | | fullnameOverride | string | `""` | | -| hookJob.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | -| image.repository | string | `"docker.io/securecodebox/hook-persistence-elastic"` | Image repository for the dashboard importer job | -| image.tag | string | defaults to the charts version | Image tag for the dashboard importer job | +| hook.image.repository | string | `"docker.io/securecodebox/hook-persistence-elastic"` | Hook image repository | +| hook.image.tag | string | defaults to the charts version | The image Tag defaults to the charts version if not defined. | +| hook.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | | imagePullSecrets | list | `[]` | | | indexAppendNamespace | bool | `true` | Define if the name of the namespace where this hook is deployed to must be added to the index name. The namespace can be used to separate index by tenants (namespaces). | | indexPrefix | string | `"scbv2"` | Define a specific index prefix used for all elasticsearch indices. | diff --git a/hooks/persistence-elastic/templates/persistence-provider.yaml b/hooks/persistence-elastic/templates/persistence-provider.yaml index 81db45fff4..cb6741c28f 100644 --- a/hooks/persistence-elastic/templates/persistence-provider.yaml +++ b/hooks/persistence-elastic/templates/persistence-provider.yaml @@ -11,8 +11,8 @@ metadata: type: Structured spec: type: ReadOnly - image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.Version }}" - ttlSecondsAfterFinished: {{ .Values.hookJob.ttlSecondsAfterFinished }} + image: "{{ .Values.hook.image.repository }}:{{ .Values.hook.image.tag | default .Chart.Version }}" + ttlSecondsAfterFinished: {{ .Values.hook.ttlSecondsAfterFinished }} env: - name: ELASTICSEARCH_INDEX_PREFIX value: {{ .Values.indexPrefix | quote }} diff --git a/hooks/persistence-elastic/values.yaml b/hooks/persistence-elastic/values.yaml index 89f2f309f0..8668e6fc12 100644 --- a/hooks/persistence-elastic/values.yaml +++ b/hooks/persistence-elastic/values.yaml @@ -6,13 +6,6 @@ # This is a YAML-formatted file. # Declare variables to be passed into your templates. -image: - # image.repository -- Hook image repository - repository: docker.io/securecodebox/hook-persistence-elastic - # image.tag -- The image Tag defaults to the charts version if not defined. - # @default -- defaults to the charts version - tag: null - # indexPrefix -- Define a specific index prefix used for all elasticsearch indices. indexPrefix: "scbv2" # indexSuffix -- Define a specific index suffix based on date pattern (YEAR (yyyy), MONTH (yyyy-MM), WEEK (yyyy-'W'W), DATE (yyyy-MM-dd)). We use Luxon for date formatting (https://moment.github.io/luxon/docs/manual/formatting.html#table-of-tokens) @@ -85,6 +78,13 @@ tolerations: [] affinity: {} -hookJob: - # hookJob.ttlSecondsAfterFinished -- Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ +hook: + image: + # hook.image.repository -- Hook image repository + repository: docker.io/securecodebox/hook-persistence-elastic + # hook.image.tag -- The image Tag defaults to the charts version if not defined. + # @default -- defaults to the charts version + tag: null + + # hook.ttlSecondsAfterFinished -- Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null diff --git a/hooks/teams-webhook/README.md b/hooks/teams-webhook/README.md index 763f6dc250..5dd6722970 100644 --- a/hooks/teams-webhook/README.md +++ b/hooks/teams-webhook/README.md @@ -18,3 +18,18 @@ Installing the Teams WebHook hook will add a ReadOnly Hook to your namespace. helm upgrade --install twh ./hooks/teams-webhook/ --set notification.url="http://example.com/my/webhook/target" ``` > ✍ This documentation is currently work-in-progress. + +## Chart Configuration + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| hook.image.repository | string | `"docker.io/securecodebox/hook-teams-webhook"` | Hook image repository | +| hook.image.tag | string | defaults to the charts version | Image tag | +| hook.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | +| notification.rules | list | `[]` | A optional rule definition that can be used to describe in wich case a notification must be fired. If not defined / empty each scan result will be notified. | +| notification.template | string | `"messageCard"` | The MS Teams message template that should be used [messageCard | adaptiveCard]. | +| notification.url | string | `"http://example.com"` | The URL of your WebHook endpoint | +| vulnerabilityManagement.enabled | bool | `false` | | +| vulnerabilityManagement.findingsUrl | string | `"https://your-kibana-service.url/your-dashboard-path/filter:{{uid}}"` | | +| vulnerabilityManagement.name | string | `"Kibana Dashboard"` | | +| vulnerabilityManagement.url | string | `"https://your-kibana-service.url/your-dashboard-path"` | | diff --git a/hooks/teams-webhook/README.md.gotmpl b/hooks/teams-webhook/README.md.gotmpl index dda68dcd47..2a33183f5d 100644 --- a/hooks/teams-webhook/README.md.gotmpl +++ b/hooks/teams-webhook/README.md.gotmpl @@ -24,3 +24,7 @@ Installing the Teams WebHook hook will add a ReadOnly Hook to your namespace. helm upgrade --install twh ./hooks/teams-webhook/ --set notification.url="http://example.com/my/webhook/target" ``` > ✍ This documentation is currently work-in-progress. + +## Chart Configuration + +{{ template "chart.valuesTable" . }} diff --git a/hooks/teams-webhook/templates/teams-hook.yaml b/hooks/teams-webhook/templates/teams-hook.yaml index 2bdf028246..77985c43c4 100644 --- a/hooks/teams-webhook/templates/teams-hook.yaml +++ b/hooks/teams-webhook/templates/teams-hook.yaml @@ -10,8 +10,8 @@ metadata: {{- include "teams-webhook.labels" . | nindent 4 }} spec: type: ReadOnly - image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.Version }}" - ttlSecondsAfterFinished: {{ .Values.hookJob.ttlSecondsAfterFinished }} + image: "{{ .Values.hook.image.repository }}:{{ .Values.hook.image.tag | default .Chart.Version }}" + ttlSecondsAfterFinished: {{ .Values.hook.ttlSecondsAfterFinished }} env: - name: WEBHOOK_URL value: {{ .Values.notification.url | quote }} diff --git a/hooks/teams-webhook/values.yaml b/hooks/teams-webhook/values.yaml index 533ddcf759..a77cdf3381 100644 --- a/hooks/teams-webhook/values.yaml +++ b/hooks/teams-webhook/values.yaml @@ -18,13 +18,6 @@ notification: # - severity: "high" # - severity: "medium" -image: - # image.repository -- Hook image repository - repository: docker.io/securecodebox/hook-teams-webhook - # image.tag -- Image tag - # @default -- defaults to the charts version - tag: null - vulnerabilityManagement: # vulnerabilityManagement.enabled If enabled a direct link to your vulnerability management system will be added at the bottom of each message. enabled: false @@ -35,6 +28,13 @@ vulnerabilityManagement: # vulnerabilityManagement.url A special URL used to deep link into your vulnerability management system. The placeholder {{uid}} will be replaced with the current scanId (uid). findingsUrl: "https://your-kibana-service.url/your-dashboard-path/filter:{{uid}}" -hookJob: - # hookJob.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ +hook: + image: + # hook.image.repository -- Hook image repository + repository: docker.io/securecodebox/hook-teams-webhook + # hook.image.tag -- Image tag + # @default -- defaults to the charts version + tag: null + + # hook.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null diff --git a/hooks/update-field/README.md b/hooks/update-field/README.md index 150430eda8..ab506f922f 100644 --- a/hooks/update-field/README.md +++ b/hooks/update-field/README.md @@ -24,6 +24,6 @@ helm upgrade --install ufh secureCodeBox/update-field --set attribute.name="cate |-----|------|---------|-------------| | attribute.name | string | `"category"` | The name of the attribute you want to add to each finding result | | attribute.value | string | `"my-own-category"` | The value of the attribute you want to add to each finding result | -| hookJob.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | -| image.repository | string | `"docker.io/securecodebox/hook-update-field"` | Hook image repository | -| image.tag | string | defaults to the charts version | The image Tag defaults to the charts version if not defined. | +| hook.image.repository | string | `"docker.io/securecodebox/hook-update-field"` | Hook image repository | +| hook.image.tag | string | defaults to the charts version | The image Tag defaults to the charts version if not defined. | +| hook.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | diff --git a/hooks/update-field/templates/update-field-hook.yaml b/hooks/update-field/templates/update-field-hook.yaml index 52abd5c874..d5206898cd 100644 --- a/hooks/update-field/templates/update-field-hook.yaml +++ b/hooks/update-field/templates/update-field-hook.yaml @@ -10,8 +10,8 @@ metadata: {{- include "update-field.labels" . | nindent 4 }} spec: type: ReadAndWrite - image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.Version }}" - ttlSecondsAfterFinished: {{ .Values.hookJob.ttlSecondsAfterFinished }} + image: "{{ .Values.hook.image.repository }}:{{ .Values.hook.image.tag | default .Chart.Version }}" + ttlSecondsAfterFinished: {{ .Values.hook.ttlSecondsAfterFinished }} env: - name: ATTRIBUTE_NAME value: {{ .Values.attribute.name | quote }} diff --git a/hooks/update-field/values.yaml b/hooks/update-field/values.yaml index 3d1bf73215..d627b673ff 100644 --- a/hooks/update-field/values.yaml +++ b/hooks/update-field/values.yaml @@ -12,13 +12,13 @@ attribute: # attribute.value -- The value of the attribute you want to add to each finding result value: my-own-category -image: - # image.repository -- Hook image repository - repository: docker.io/securecodebox/hook-update-field - # image.tag -- The image Tag defaults to the charts version if not defined. - # @default -- defaults to the charts version - tag: null +hook: + image: + # hook.image.repository -- Hook image repository + repository: docker.io/securecodebox/hook-update-field + # hook.image.tag -- The image Tag defaults to the charts version if not defined. + # @default -- defaults to the charts version + tag: null -hookJob: - # hookJob.ttlSecondsAfterFinished -- Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ + # hook.ttlSecondsAfterFinished -- Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null diff --git a/tests/integration/hooks/__testFiles__/finding-post-processing-values.yaml b/tests/integration/hooks/__testFiles__/finding-post-processing-values.yaml index a5554c847e..058acc4c53 100644 --- a/tests/integration/hooks/__testFiles__/finding-post-processing-values.yaml +++ b/tests/integration/hooks/__testFiles__/finding-post-processing-values.yaml @@ -6,13 +6,13 @@ # This is a YAML-formatted file. # Declare variables to be passed into your templates. -image: - # image.tag - defaults to the charts version - # image.repository -- Hook image repository - repository: docker.io/securecodebox/finding-post-processing - # parserImage.tag -- Parser image tag - # @default -- defaults to the charts version - tag: null +hook: + image: + # hook.image.repository -- Hook image repository + repository: docker.io/securecodebox/finding-post-processing + # hook.image.tag -- Parser image tag + # @default -- defaults to the charts version + tag: null rules: - matches: diff --git a/tests/integration/hooks/__testFiles__/notification-values.yaml b/tests/integration/hooks/__testFiles__/notification-values.yaml index 6df1accc9c..efea62be42 100644 --- a/tests/integration/hooks/__testFiles__/notification-values.yaml +++ b/tests/integration/hooks/__testFiles__/notification-values.yaml @@ -2,16 +2,16 @@ # # SPDX-License-Identifier: Apache-2.0 -image: - # image.repository -- Hook image repository - repository: null - # image.tag -- Image tag - # @default -- defaults to the charts version - tag: null - pullPolicy: Always +hook: + image: + # hook.image.repository -- Hook image repository + repository: null + # hook.image.tag -- Image tag + # @default -- defaults to the charts version + tag: null + pullPolicy: Always -hookJob: - # hookJob.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ + # hook.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null notificationChannels: