From 22b13933fba2175cd38e2475424ed39548802a00 Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Thu, 10 Jun 2021 11:13:08 +0200 Subject: [PATCH 01/10] Cascading Scans: refactor values according to new spec Signed-off-by: Jop Zitman --- hooks/cascading-scans/README.md | 6 +++--- .../templates/cascading-scans-hook.yaml | 4 ++-- hooks/cascading-scans/values.yaml | 16 ++++++++-------- 3 files changed, 13 insertions(+), 13 deletions(-) diff --git a/hooks/cascading-scans/README.md b/hooks/cascading-scans/README.md index 18dec4c820..f2645e1061 100644 --- a/hooks/cascading-scans/README.md +++ b/hooks/cascading-scans/README.md @@ -119,6 +119,6 @@ zap-http zap-baseline-scan non-invasive medium | Key | Type | Default | Description | |-----|------|---------|-------------| -| hookJob.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | -| image.repository | string | `"docker.io/securecodebox/cascading-scans"` | Hook image repository | -| image.tag | string | defaults to the charts version | The image Tag defaults to the charts version if not defined. | +| hook.image.repository | string | `"docker.io/securecodebox/cascading-scans"` | Hook image repository | +| hook.image.tag | string | defaults to the charts version | The image Tag defaults to the charts version if not defined. | +| hook.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | diff --git a/hooks/cascading-scans/templates/cascading-scans-hook.yaml b/hooks/cascading-scans/templates/cascading-scans-hook.yaml index c57fb938a4..ac0c8328bf 100644 --- a/hooks/cascading-scans/templates/cascading-scans-hook.yaml +++ b/hooks/cascading-scans/templates/cascading-scans-hook.yaml @@ -10,8 +10,8 @@ metadata: {{- include "cascading-scans.labels" . | nindent 4 }} spec: type: ReadOnly - image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.Version }}" + image: "{{ .Values.hook.image.repository }}:{{ .Values.hook.image.tag | default .Chart.Version }}" imagePullSecrets: - name: "securecodebox" - ttlSecondsAfterFinished: {{ .Values.hookJob.ttlSecondsAfterFinished }} + ttlSecondsAfterFinished: {{ .Values.hook.ttlSecondsAfterFinished }} serviceAccountName: cascading-scans diff --git a/hooks/cascading-scans/values.yaml b/hooks/cascading-scans/values.yaml index f4ede20e64..4daba32019 100644 --- a/hooks/cascading-scans/values.yaml +++ b/hooks/cascading-scans/values.yaml @@ -6,13 +6,13 @@ # This is a YAML-formatted file. # Declare variables to be passed into your templates. -image: - # image.repository -- Hook image repository - repository: docker.io/securecodebox/cascading-scans - # image.tag -- The image Tag defaults to the charts version if not defined. - # @default -- defaults to the charts version - tag: null +hook: + image: + # hook.image.repository -- Hook image repository + repository: docker.io/securecodebox/cascading-scans + # hook.image.tag -- The image Tag defaults to the charts version if not defined. + # @default -- defaults to the charts version + tag: null -hookJob: - # hookJob.ttlSecondsAfterFinished -- Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ + # hook.ttlSecondsAfterFinished -- Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null From f5ecccfc2be07b3aff5d87a41785e64ac3864f8f Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Thu, 10 Jun 2021 11:14:31 +0200 Subject: [PATCH 02/10] Post-processing: refactor values according to new spec Signed-off-by: Jop Zitman --- hooks/finding-post-processing/README.md | 6 +++--- .../finding-post-processing-hook.yaml | 2 +- hooks/finding-post-processing/values.yaml | 18 +++++++++--------- 3 files changed, 13 insertions(+), 13 deletions(-) diff --git a/hooks/finding-post-processing/README.md b/hooks/finding-post-processing/README.md index d79991e768..a654e3dfd2 100644 --- a/hooks/finding-post-processing/README.md +++ b/hooks/finding-post-processing/README.md @@ -54,7 +54,7 @@ The `override` field specifies the desired fields and values that need to be upd | Key | Type | Default | Description | |-----|------|---------|-------------| -| hookJob.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | -| image.repository | string | `"docker.io/securecodebox/finding-post-processing"` | Hook image repository | -| image.tag | string | defaults to the charts version | The image Tag defaults to the charts version if not defined. | +| hook.image.repository | string | `"docker.io/securecodebox/finding-post-processing"` | Hook image repository | +| hook.image.tag | string | defaults to the charts version | The image Tag defaults to the charts version if not defined. | +| hook.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | | rules | list | `[]` | | diff --git a/hooks/finding-post-processing/templates/finding-post-processing-hook.yaml b/hooks/finding-post-processing/templates/finding-post-processing-hook.yaml index c5051d7778..345c658e6a 100644 --- a/hooks/finding-post-processing/templates/finding-post-processing-hook.yaml +++ b/hooks/finding-post-processing/templates/finding-post-processing-hook.yaml @@ -10,7 +10,7 @@ metadata: {{- include "finding-post-processing.labels" . | nindent 4 }} spec: type: ReadAndWrite - image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.Version }}" + image: "{{ .Values.hook.image.repository }}:{{ .Values.hook.image.tag | default .Chart.Version }}" env: - name: RULES value: {{ .Values.rules | toJson | quote }} diff --git a/hooks/finding-post-processing/values.yaml b/hooks/finding-post-processing/values.yaml index c437faadc7..148fd1edce 100644 --- a/hooks/finding-post-processing/values.yaml +++ b/hooks/finding-post-processing/values.yaml @@ -6,13 +6,6 @@ # This is a YAML-formatted file. # Declare variables to be passed into your templates. -image: - # image.repository -- Hook image repository - repository: docker.io/securecodebox/finding-post-processing - # image.tag -- The image Tag defaults to the charts version if not defined. - # @default -- defaults to the charts version - tag: null - rules: [] #- matches: # anyOf: @@ -28,6 +21,13 @@ rules: [] # severity: "high" # description: "Telnet is bad" -hookJob: - # hookJob.ttlSecondsAfterFinished -- Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ +hook: + image: + # hook.image.repository -- Hook image repository + repository: docker.io/securecodebox/finding-post-processing + # hook.image.tag -- The image Tag defaults to the charts version if not defined. + # @default -- defaults to the charts version + tag: null + + # hook.ttlSecondsAfterFinished -- Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null From 861f59b6114188e7ef00055176e2748ab9e2db7f Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Thu, 10 Jun 2021 11:15:50 +0200 Subject: [PATCH 03/10] Generic: refactor values according to new spec Signed-off-by: Jop Zitman --- hooks/generic-webhook/README.md | 6 +++--- .../generic-webhook/templates/webhook-hook.yaml | 4 ++-- hooks/generic-webhook/values.yaml | 16 ++++++++-------- 3 files changed, 13 insertions(+), 13 deletions(-) diff --git a/hooks/generic-webhook/README.md b/hooks/generic-webhook/README.md index 70c291b2b3..170cc696d2 100644 --- a/hooks/generic-webhook/README.md +++ b/hooks/generic-webhook/README.md @@ -21,7 +21,7 @@ helm upgrade --install gwh secureCodeBox/generic-webhook --set webhookUrl="http: | Key | Type | Default | Description | |-----|------|---------|-------------| -| hookJob.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | -| image.repository | string | `"docker.io/securecodebox/generic-webhook"` | Hook image repository | -| image.tag | string | defaults to the charts version | The image Tag defaults to the charts version if not defined. | +| hook.image.repository | string | `"docker.io/securecodebox/generic-webhook"` | Hook image repository | +| hook.image.tag | string | defaults to the charts version | The image Tag defaults to the charts version if not defined. | +| hook.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | | webhookUrl | string | `"http://example.com"` | The URL of your WebHook endpoint | diff --git a/hooks/generic-webhook/templates/webhook-hook.yaml b/hooks/generic-webhook/templates/webhook-hook.yaml index b65db67863..4e7cd95454 100644 --- a/hooks/generic-webhook/templates/webhook-hook.yaml +++ b/hooks/generic-webhook/templates/webhook-hook.yaml @@ -10,8 +10,8 @@ metadata: {{- include "generic-webhook.labels" . | nindent 4 }} spec: type: ReadOnly - image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.Version }}" - ttlSecondsAfterFinished: {{ .Values.hookJob.ttlSecondsAfterFinished }} + image: "{{ .Values.hook.image.repository }}:{{ .Values.hook.image.tag | default .Chart.Version }}" + ttlSecondsAfterFinished: {{ .Values.hook.ttlSecondsAfterFinished }} env: - name: WEBHOOK_URL value: {{ .Values.webhookUrl | quote }} diff --git a/hooks/generic-webhook/values.yaml b/hooks/generic-webhook/values.yaml index 7a51b46836..c9d9c9ba1b 100644 --- a/hooks/generic-webhook/values.yaml +++ b/hooks/generic-webhook/values.yaml @@ -9,13 +9,13 @@ # webhookUrl -- The URL of your WebHook endpoint webhookUrl: "http://example.com" -image: - # image.repository -- Hook image repository - repository: docker.io/securecodebox/generic-webhook - # image.tag -- The image Tag defaults to the charts version if not defined. - # @default -- defaults to the charts version - tag: null +hook: + image: + # hook.image.repository -- Hook image repository + repository: docker.io/securecodebox/generic-webhook + # hook.image.tag -- The image Tag defaults to the charts version if not defined. + # @default -- defaults to the charts version + tag: null -hookJob: - # hookJob.ttlSecondsAfterFinished -- Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ + # hook.ttlSecondsAfterFinished -- Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null From 372b5e9a1a48c982a679fbcb9bedffccc8fd2e09 Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Thu, 10 Jun 2021 11:17:00 +0200 Subject: [PATCH 04/10] Notification: refactor values according to new spec Signed-off-by: Jop Zitman --- hooks/notification-hook/README.md | 8 ++++---- .../templates/notification-hook.yaml | 6 +++--- hooks/notification-hook/values.yaml | 18 +++++++++--------- 3 files changed, 16 insertions(+), 16 deletions(-) diff --git a/hooks/notification-hook/README.md b/hooks/notification-hook/README.md index b684b0ab04..74b9df5d3b 100644 --- a/hooks/notification-hook/README.md +++ b/hooks/notification-hook/README.md @@ -221,10 +221,10 @@ To fill your template with data we provide the following objects. | env[1].name | string | `"SMTP_CONFIG"` | | | env[1].valueFrom.secretKeyRef.key | string | `"smtp-config-key"` | | | env[1].valueFrom.secretKeyRef.name | string | `"some-secret"` | | -| hookJob.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | -| image.pullPolicy | string | `"Always"` | | -| image.repository | string | `"docker.io/securecodebox/notification-hook"` | Hook image repository | -| image.tag | string | defaults to the charts version | Image tag | +| hook.image.pullPolicy | string | `"Always"` | | +| hook.image.repository | string | `"docker.io/securecodebox/notification-hook"` | Hook image repository | +| hook.image.tag | string | defaults to the charts version | Image tag | +| hook.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | | notificationChannels[0].endPoint | string | `"SOME_ENV_KEY"` | | | notificationChannels[0].name | string | `"slack"` | | | notificationChannels[0].rules[0].matches.anyOf[0].category | string | `"Open Port"` | | diff --git a/hooks/notification-hook/templates/notification-hook.yaml b/hooks/notification-hook/templates/notification-hook.yaml index fab4396346..c7d306d90a 100644 --- a/hooks/notification-hook/templates/notification-hook.yaml +++ b/hooks/notification-hook/templates/notification-hook.yaml @@ -8,9 +8,9 @@ metadata: name: {{ include "notification-hook.fullname" . }} spec: type: ReadOnly - imagePullPolicy: "{{ .Values.image.pullPolicy }}" - image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.Version }}" - ttlSecondsAfterFinished: {{ .Values.hookJob.ttlSecondsAfterFinished }} + imagePullPolicy: "{{ .Values.hook.image.pullPolicy }}" + image: "{{ .Values.hook.image.repository }}:{{ .Values.hook.image.tag | default .Chart.Version }}" + ttlSecondsAfterFinished: {{ .Values.hook.ttlSecondsAfterFinished }} volumes: - name: {{ .Release.Name }}-config configMap: diff --git a/hooks/notification-hook/values.yaml b/hooks/notification-hook/values.yaml index 6c696f039a..bbc409339c 100644 --- a/hooks/notification-hook/values.yaml +++ b/hooks/notification-hook/values.yaml @@ -6,16 +6,16 @@ # This is a YAML-formatted file. # Declare variables to be passed into your templates. -image: - # image.repository -- Hook image repository - repository: docker.io/securecodebox/notification-hook - # image.tag -- Image tag - # @default -- defaults to the charts version - tag: null - pullPolicy: Always +hook: + image: + # hook.image.repository -- Hook image repository + repository: docker.io/securecodebox/notification-hook + # hook.image.tag -- Image tag + # @default -- defaults to the charts version + tag: null + pullPolicy: Always -hookJob: - # hookJob.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ + # hook.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null notificationChannels: From d6d4e94dbc53f63dbaf79f51d90d33c72ce4ba96 Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Thu, 10 Jun 2021 11:18:52 +0200 Subject: [PATCH 05/10] Defectdojo persistence: refactor values according to new spec Signed-off-by: Jop Zitman --- hooks/persistence-defectdojo/README.md | 6 +++--- .../templates/persistence-provider.yaml | 4 ++-- hooks/persistence-defectdojo/values.yaml | 17 +++++++++-------- 3 files changed, 14 insertions(+), 13 deletions(-) diff --git a/hooks/persistence-defectdojo/README.md b/hooks/persistence-defectdojo/README.md index 12e39ebe3b..ac2d02c362 100644 --- a/hooks/persistence-defectdojo/README.md +++ b/hooks/persistence-defectdojo/README.md @@ -133,6 +133,6 @@ helm upgrade --install dd secureCodeBox/persistence-defectdojo \ | defectdojo.authentication.usernameKey | string | `"username"` | Name of the username key in the `userSecret` secret. Use this if you already have a secret with different key / value pairs | | defectdojo.syncFindingsBack | bool | `true` | Syncs back (two way sync) all imported findings from DefectDojo to SCB Findings Store, set to false to only import the findings to DefectDojo (one way sync). | | defectdojo.url | string | `"http://defectdojo-django.default.svc"` | Url to the DefectDojo Instance | -| image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | -| image.repository | string | `"docker.io/securecodebox/persistence-defectdojo"` | Hook image repository | -| image.tag | string | `nil` | Container image tag | +| hook.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | +| hook.image.repository | string | `"docker.io/securecodebox/persistence-defectdojo"` | Hook image repository | +| hook.image.tag | string | `nil` | Container image tag | diff --git a/hooks/persistence-defectdojo/templates/persistence-provider.yaml b/hooks/persistence-defectdojo/templates/persistence-provider.yaml index 756f54dff4..252260fdef 100644 --- a/hooks/persistence-defectdojo/templates/persistence-provider.yaml +++ b/hooks/persistence-defectdojo/templates/persistence-provider.yaml @@ -15,8 +15,8 @@ spec: {{- else }} type: ReadOnly {{- end }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.Version }}" - imagePullPolicy: "{{ .Values.image.pullPolicy }}" + image: "{{ .Values.hook.image.repository }}:{{ .Values.hook.image.tag | default .Chart.Version }}" + imagePullPolicy: "{{ .Values.hook.image.pullPolicy }}" env: - name: DEFECTDOJO_URL value: {{ .Values.defectdojo.url | quote }} diff --git a/hooks/persistence-defectdojo/values.yaml b/hooks/persistence-defectdojo/values.yaml index b100b9cd7c..8248b675b8 100644 --- a/hooks/persistence-defectdojo/values.yaml +++ b/hooks/persistence-defectdojo/values.yaml @@ -6,14 +6,15 @@ # This is a YAML-formatted file. # Declare variables to be passed into your templates. -image: - # image.repository -- Hook image repository - repository: docker.io/securecodebox/persistence-defectdojo - # -- Container image tag - # @default -- defaults to the charts version - tag: null - # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images - pullPolicy: IfNotPresent +hook: + image: + # hook.image.repository -- Hook image repository + repository: docker.io/securecodebox/persistence-defectdojo + # -- Container image tag + # @default -- defaults to the charts version + tag: null + # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + pullPolicy: IfNotPresent defectdojo: # -- Syncs back (two way sync) all imported findings from DefectDojo to SCB Findings Store, set to false to only import the findings to DefectDojo (one way sync). From 8a7028051c0a61d0ae57219e8ab1aba550af038e Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Thu, 10 Jun 2021 11:20:27 +0200 Subject: [PATCH 06/10] Elastic persistence: refactor values according to new spec Signed-off-by: Jop Zitman --- hooks/persistence-elastic/README.md | 6 +++--- .../templates/persistence-provider.yaml | 4 ++-- hooks/persistence-elastic/values.yaml | 18 +++++++++--------- 3 files changed, 14 insertions(+), 14 deletions(-) diff --git a/hooks/persistence-elastic/README.md b/hooks/persistence-elastic/README.md index e3df2d59c4..277a922275 100644 --- a/hooks/persistence-elastic/README.md +++ b/hooks/persistence-elastic/README.md @@ -43,9 +43,9 @@ the [Luxon documentation](https://moment.github.io/luxon/docs/manual/formatting. | externalElasticStack.enabled | bool | `false` | Enable this when you already have an Elastic Stack running to which you want to send your results | | externalElasticStack.kibanaAddress | string | `"https://kibana.example.com"` | The URL of the kibana service used to visualize all findings. | | fullnameOverride | string | `""` | | -| hookJob.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | -| image.repository | string | `"docker.io/securecodebox/persistence-elastic"` | Image repository for the dashboard importer job | -| image.tag | string | defaults to the charts version | Image tag for the dashboard importer job | +| hook.image.repository | string | `"docker.io/securecodebox/persistence-elastic"` | Hook image repository | +| hook.image.tag | string | defaults to the charts version | The image Tag defaults to the charts version if not defined. | +| hook.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | | imagePullSecrets | list | `[]` | | | indexAppendNamespace | bool | `true` | Define if the name of the namespace where this hook is deployed to must be added to the index name. The namespace can be used to separate index by tenants (namespaces). | | indexPrefix | string | `"scbv2"` | Define a specific index prefix used for all elasticsearch indices. | diff --git a/hooks/persistence-elastic/templates/persistence-provider.yaml b/hooks/persistence-elastic/templates/persistence-provider.yaml index 81db45fff4..cb6741c28f 100644 --- a/hooks/persistence-elastic/templates/persistence-provider.yaml +++ b/hooks/persistence-elastic/templates/persistence-provider.yaml @@ -11,8 +11,8 @@ metadata: type: Structured spec: type: ReadOnly - image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.Version }}" - ttlSecondsAfterFinished: {{ .Values.hookJob.ttlSecondsAfterFinished }} + image: "{{ .Values.hook.image.repository }}:{{ .Values.hook.image.tag | default .Chart.Version }}" + ttlSecondsAfterFinished: {{ .Values.hook.ttlSecondsAfterFinished }} env: - name: ELASTICSEARCH_INDEX_PREFIX value: {{ .Values.indexPrefix | quote }} diff --git a/hooks/persistence-elastic/values.yaml b/hooks/persistence-elastic/values.yaml index 789976248d..de06626c5d 100644 --- a/hooks/persistence-elastic/values.yaml +++ b/hooks/persistence-elastic/values.yaml @@ -6,13 +6,6 @@ # This is a YAML-formatted file. # Declare variables to be passed into your templates. -image: - # image.repository -- Hook image repository - repository: docker.io/securecodebox/persistence-elastic - # image.tag -- The image Tag defaults to the charts version if not defined. - # @default -- defaults to the charts version - tag: null - # indexPrefix -- Define a specific index prefix used for all elasticsearch indices. indexPrefix: "scbv2" # indexSuffix -- Define a specific index suffix based on date pattern (YEAR (yyyy), MONTH (yyyy-MM), WEEK (yyyy-'W'W), DATE (yyyy-MM-dd)). We use Luxon for date formatting (https://moment.github.io/luxon/docs/manual/formatting.html#table-of-tokens) @@ -85,6 +78,13 @@ tolerations: [] affinity: {} -hookJob: - # hookJob.ttlSecondsAfterFinished -- Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ +hook: + image: + # hook.image.repository -- Hook image repository + repository: docker.io/securecodebox/persistence-elastic + # hook.image.tag -- The image Tag defaults to the charts version if not defined. + # @default -- defaults to the charts version + tag: null + + # hook.ttlSecondsAfterFinished -- Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null From e59c6619ca79348a294fb13faa09d3b323947422 Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Thu, 10 Jun 2021 11:22:32 +0200 Subject: [PATCH 07/10] Teams notification: refactor values according to new spec & add chartValues table to readme Signed-off-by: Jop Zitman --- hooks/teams-webhook/README.md | 15 +++++++++++++++ hooks/teams-webhook/README.md.gotmpl | 4 ++++ hooks/teams-webhook/templates/teams-hook.yaml | 4 ++-- hooks/teams-webhook/values.yaml | 18 +++++++++--------- 4 files changed, 30 insertions(+), 11 deletions(-) diff --git a/hooks/teams-webhook/README.md b/hooks/teams-webhook/README.md index 763f6dc250..0be25d97a0 100644 --- a/hooks/teams-webhook/README.md +++ b/hooks/teams-webhook/README.md @@ -18,3 +18,18 @@ Installing the Teams WebHook hook will add a ReadOnly Hook to your namespace. helm upgrade --install twh ./hooks/teams-webhook/ --set notification.url="http://example.com/my/webhook/target" ``` > ✍ This documentation is currently work-in-progress. + +## Chart Configuration + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| hook.image.repository | string | `"docker.io/securecodebox/teams-webhook"` | Hook image repository | +| hook.image.tag | string | defaults to the charts version | Image tag | +| hook.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | +| notification.rules | list | `[]` | A optional rule definition that can be used to describe in wich case a notification must be fired. If not defined / empty each scan result will be notified. | +| notification.template | string | `"messageCard"` | The MS Teams message template that should be used [messageCard | adaptiveCard]. | +| notification.url | string | `"http://example.com"` | The URL of your WebHook endpoint | +| vulnerabilityManagement.enabled | bool | `false` | | +| vulnerabilityManagement.findingsUrl | string | `"https://your-kibana-service.url/your-dashboard-path/filter:{{uid}}"` | | +| vulnerabilityManagement.name | string | `"Kibana Dashboard"` | | +| vulnerabilityManagement.url | string | `"https://your-kibana-service.url/your-dashboard-path"` | | diff --git a/hooks/teams-webhook/README.md.gotmpl b/hooks/teams-webhook/README.md.gotmpl index dda68dcd47..2a33183f5d 100644 --- a/hooks/teams-webhook/README.md.gotmpl +++ b/hooks/teams-webhook/README.md.gotmpl @@ -24,3 +24,7 @@ Installing the Teams WebHook hook will add a ReadOnly Hook to your namespace. helm upgrade --install twh ./hooks/teams-webhook/ --set notification.url="http://example.com/my/webhook/target" ``` > ✍ This documentation is currently work-in-progress. + +## Chart Configuration + +{{ template "chart.valuesTable" . }} diff --git a/hooks/teams-webhook/templates/teams-hook.yaml b/hooks/teams-webhook/templates/teams-hook.yaml index 2bdf028246..77985c43c4 100644 --- a/hooks/teams-webhook/templates/teams-hook.yaml +++ b/hooks/teams-webhook/templates/teams-hook.yaml @@ -10,8 +10,8 @@ metadata: {{- include "teams-webhook.labels" . | nindent 4 }} spec: type: ReadOnly - image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.Version }}" - ttlSecondsAfterFinished: {{ .Values.hookJob.ttlSecondsAfterFinished }} + image: "{{ .Values.hook.image.repository }}:{{ .Values.hook.image.tag | default .Chart.Version }}" + ttlSecondsAfterFinished: {{ .Values.hook.ttlSecondsAfterFinished }} env: - name: WEBHOOK_URL value: {{ .Values.notification.url | quote }} diff --git a/hooks/teams-webhook/values.yaml b/hooks/teams-webhook/values.yaml index 6ef2bfa16a..b0e09bd538 100644 --- a/hooks/teams-webhook/values.yaml +++ b/hooks/teams-webhook/values.yaml @@ -18,13 +18,6 @@ notification: # - severity: "high" # - severity: "medium" -image: - # image.repository -- Hook image repository - repository: docker.io/securecodebox/teams-webhook - # image.tag -- Image tag - # @default -- defaults to the charts version - tag: null - vulnerabilityManagement: # vulnerabilityManagement.enabled If enabled a direct link to your vulnerability management system will be added at the bottom of each message. enabled: false @@ -35,6 +28,13 @@ vulnerabilityManagement: # vulnerabilityManagement.url A special URL used to deep link into your vulnerability management system. The placeholder {{uid}} will be replaced with the current scanId (uid). findingsUrl: "https://your-kibana-service.url/your-dashboard-path/filter:{{uid}}" -hookJob: - # hookJob.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ +hook: + image: + # hook.image.repository -- Hook image repository + repository: docker.io/securecodebox/teams-webhook + # hook.image.tag -- Image tag + # @default -- defaults to the charts version + tag: null + + # hook.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null From 0cc34c0513d0d771a8900eff9238735e65db4919 Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Thu, 10 Jun 2021 11:23:50 +0200 Subject: [PATCH 08/10] Update field: refactor values according to new spec Signed-off-by: Jop Zitman --- hooks/update-field/README.md | 6 +++--- .../templates/update-field-hook.yaml | 4 ++-- hooks/update-field/values.yaml | 16 ++++++++-------- 3 files changed, 13 insertions(+), 13 deletions(-) diff --git a/hooks/update-field/README.md b/hooks/update-field/README.md index 93e529d2e9..7d9d316b9b 100644 --- a/hooks/update-field/README.md +++ b/hooks/update-field/README.md @@ -24,6 +24,6 @@ helm upgrade --install ufh secureCodeBox/update-field --set attribute.name="cate |-----|------|---------|-------------| | attribute.name | string | `"category"` | The name of the attribute you want to add to each finding result | | attribute.value | string | `"my-own-category"` | The value of the attribute you want to add to each finding result | -| hookJob.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | -| image.repository | string | `"docker.io/securecodebox/update-field"` | Hook image repository | -| image.tag | string | defaults to the charts version | The image Tag defaults to the charts version if not defined. | +| hook.image.repository | string | `"docker.io/securecodebox/update-field"` | Hook image repository | +| hook.image.tag | string | defaults to the charts version | The image Tag defaults to the charts version if not defined. | +| hook.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | diff --git a/hooks/update-field/templates/update-field-hook.yaml b/hooks/update-field/templates/update-field-hook.yaml index 52abd5c874..d5206898cd 100644 --- a/hooks/update-field/templates/update-field-hook.yaml +++ b/hooks/update-field/templates/update-field-hook.yaml @@ -10,8 +10,8 @@ metadata: {{- include "update-field.labels" . | nindent 4 }} spec: type: ReadAndWrite - image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.Version }}" - ttlSecondsAfterFinished: {{ .Values.hookJob.ttlSecondsAfterFinished }} + image: "{{ .Values.hook.image.repository }}:{{ .Values.hook.image.tag | default .Chart.Version }}" + ttlSecondsAfterFinished: {{ .Values.hook.ttlSecondsAfterFinished }} env: - name: ATTRIBUTE_NAME value: {{ .Values.attribute.name | quote }} diff --git a/hooks/update-field/values.yaml b/hooks/update-field/values.yaml index cf5b0a7b37..827e3dae30 100644 --- a/hooks/update-field/values.yaml +++ b/hooks/update-field/values.yaml @@ -12,13 +12,13 @@ attribute: # attribute.value -- The value of the attribute you want to add to each finding result value: my-own-category -image: - # image.repository -- Hook image repository - repository: docker.io/securecodebox/update-field - # image.tag -- The image Tag defaults to the charts version if not defined. - # @default -- defaults to the charts version - tag: null +hook: + image: + # hook.image.repository -- Hook image repository + repository: docker.io/securecodebox/update-field + # hook.image.tag -- The image Tag defaults to the charts version if not defined. + # @default -- defaults to the charts version + tag: null -hookJob: - # hookJob.ttlSecondsAfterFinished -- Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ + # hook.ttlSecondsAfterFinished -- Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null From 30d239687164e7514428b04dd61fc422c9189249 Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Thu, 10 Jun 2021 11:33:47 +0200 Subject: [PATCH 09/10] CI: refactor hook values according to new spec Signed-off-by: Jop Zitman --- .github/workflows/ci.yaml | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index c01d081b7e..7a4a2cf0e7 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -613,13 +613,13 @@ jobs: - name: "Hooks (ReadAndWrite) Integration Tests" run: | helm -n integration-tests install update-category ./hooks/update-field/ \ - --set="image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/update-field" \ - --set="image.tag=sha-$(git rev-parse --short HEAD)" \ + --set="hook.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/update-field" \ + --set="hook.image.tag=sha-$(git rev-parse --short HEAD)" \ --set="attribute.name=category" \ --set="attribute.value=fancy-category" helm -n integration-tests install update-severity ./hooks/update-field/ \ - --set="image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/update-field" \ - --set="image.tag=sha-$(git rev-parse --short HEAD)" \ + --set="hook.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/update-field" \ + --set="hook.image.tag=sha-$(git rev-parse --short HEAD)" \ --set="attribute.name=severity" \ --set="attribute.value=high" helm -n integration-tests install test-scan ./scanners/test-scan/ \ @@ -642,9 +642,9 @@ jobs: --set="scanner.image.tag=sha-$(git rev-parse --short HEAD)" helm -n integration-tests install http-webhook ./demo-apps/http-webhook helm -n integration-tests install ro-hook ./hooks/generic-webhook/ \ - --set="image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/generic-webhook" \ + --set="hook.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/generic-webhook" \ --set="webhookUrl=http://http-webhook/hallo-welt" \ - --set="image.tag=sha-$(git rev-parse --short HEAD)" + --set="hook.image.tag=sha-$(git rev-parse --short HEAD)" cd tests/integration/ npx jest --ci --color generic/read-only-hook.test.js helm -n integration-tests uninstall test-scan http-webhook ro-hook @@ -772,8 +772,8 @@ jobs: helm -n integration-tests install http-webhook ./demo-apps/http-webhook --wait helm -n integration-tests install notification-hook ./hooks/notification-hook --values tests/integration/hooks/__testFiles__/notification-hook-values.yaml \ - --set="image.repository=docker.io/${{env.DOCKER_NAMESPACE }}/notification-hook" \ - --set="image.tag=sha-$(git rev-parse --short HEAD)" + --set="hook.image.repository=docker.io/${{env.DOCKER_NAMESPACE }}/notification-hook" \ + --set="hook.image.tag=sha-$(git rev-parse --short HEAD)" cd tests/integration/ npx jest --ci --color ./hooks/notification-hook.test.js @@ -848,8 +848,8 @@ jobs: kubectl create namespace cascading-tests # Install cascading-scans hook helm upgrade --install dssh ./hooks/cascading-scans/ -n cascading-tests \ - --set="image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/cascading-scans" \ - --set="image.tag=sha-$(git rev-parse --short HEAD)" + --set="hook.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/cascading-scans" \ + --set="hook.image.tag=sha-$(git rev-parse --short HEAD)" # Install nmap helm -n cascading-tests install nmap ./scanners/nmap/ \ --set="scanner.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/scanner-nmap" \ @@ -891,8 +891,8 @@ jobs: kubectl create namespace cascading-tests # Install cascading-scans hook helm upgrade --install dssh ./hooks/cascading-scans/ -n cascading-tests --wait \ - --set="image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/cascading-scans" \ - --set="image.tag=sha-$(git rev-parse --short HEAD)" + --set="hook.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/cascading-scans" \ + --set="hook.image.tag=sha-$(git rev-parse --short HEAD)" # Install unsafe-https helm upgrade --install unsafe-https ./demo-apps/unsafe-https/ -n cascading-tests --wait # Install nmap From ad6aba579e97d5ea7a7d306f4868fb79e463bb9e Mon Sep 17 00:00:00 2001 From: Jop Zitman Date: Thu, 10 Jun 2021 11:41:29 +0200 Subject: [PATCH 10/10] CI: update __testFiles__ hook values according to new spec Signed-off-by: Jop Zitman --- .../finding-post-processing-values.yaml | 14 +++++++------- .../notification-hook-values.yaml | 18 +++++++++--------- 2 files changed, 16 insertions(+), 16 deletions(-) diff --git a/tests/integration/hooks/__testFiles__/finding-post-processing-values.yaml b/tests/integration/hooks/__testFiles__/finding-post-processing-values.yaml index a5554c847e..058acc4c53 100644 --- a/tests/integration/hooks/__testFiles__/finding-post-processing-values.yaml +++ b/tests/integration/hooks/__testFiles__/finding-post-processing-values.yaml @@ -6,13 +6,13 @@ # This is a YAML-formatted file. # Declare variables to be passed into your templates. -image: - # image.tag - defaults to the charts version - # image.repository -- Hook image repository - repository: docker.io/securecodebox/finding-post-processing - # parserImage.tag -- Parser image tag - # @default -- defaults to the charts version - tag: null +hook: + image: + # hook.image.repository -- Hook image repository + repository: docker.io/securecodebox/finding-post-processing + # hook.image.tag -- Parser image tag + # @default -- defaults to the charts version + tag: null rules: - matches: diff --git a/tests/integration/hooks/__testFiles__/notification-hook-values.yaml b/tests/integration/hooks/__testFiles__/notification-hook-values.yaml index 6df1accc9c..efea62be42 100644 --- a/tests/integration/hooks/__testFiles__/notification-hook-values.yaml +++ b/tests/integration/hooks/__testFiles__/notification-hook-values.yaml @@ -2,16 +2,16 @@ # # SPDX-License-Identifier: Apache-2.0 -image: - # image.repository -- Hook image repository - repository: null - # image.tag -- Image tag - # @default -- defaults to the charts version - tag: null - pullPolicy: Always +hook: + image: + # hook.image.repository -- Hook image repository + repository: null + # hook.image.tag -- Image tag + # @default -- defaults to the charts version + tag: null + pullPolicy: Always -hookJob: - # hookJob.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ + # hook.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null notificationChannels: