← 输入框|github.com|刷新
Skip to content

Implement init container support (ADR-0009) - #724

Merged
malexmave merged 2 commits into
mainfrom
feature/init-containers
Oct 14, 2021
Merged

malexmave merged 2 commits into
mainfrom
feature/init-containers

Conversation

@malexmave

@malexmave malexmave commented Oct 13, 2021 •

Copy link
Copy Markdown
Member

This PR implements ADR-0009 by exposing the initContainers API in the scantypes. It thus closes #707.

Description

ScanTypes now expose another configuration option, initContainers, which allows you to specify a container (or set of containers) that should run before the scan container. Use this to download files onto the scanner or perform other actions in preparation for the scan. It uses the built-in functionality of Kubernetes and does not require any SCB-specific knowledge.

For testing, here's an example application of an nmap scan that scans a set of websites that is downloaded from the web using an initContainer.

apiVersion: "execution.securecodebox.io/v1"
kind: Scan
metadata:
  name: "test-init-containers"
spec:
  volumes:
    - name: test-dir
      emptyDir: {}
  volumeMounts:
    - mountPath: "/test/"
      name: test-dir
  scanType: "nmap"
  parameters:
    - "-iL"
    - "/test/targets.txt"
  initContainers:
    - name: "download-targets"
      image: busybox
      command: 
        - wget
        - "https://gist.githubusercontent.com/malexmave/23246404607929739792f7c5f9750d83/raw/0fac194deeecc5553f96d5ad095a4f8a899dc50f/gistfile1.txt"
        - "-O"
        - /test/targets.txt
      volumeMounts:
        - mountPath: "/test/"
          name: test-dir

I will update the documentation to provide example use cases and create a PR on the relevant repo next.

Checklist

  • Test your changes as thoroughly as possible before you commit them. Preferably, automate your test by unit/integration tests.
  • Make sure npm test runs for the whole project.
  • Make codeclimate checks happy

Signed-off-by: Max Maass <max.maass@iteratec.com>
Signed-off-by: Max Maass <max.maass@iteratec.com>
@malexmave

Copy link
Copy Markdown
Member Author

I just updated the CRDs in the right place for Helm as well. The way I understand it, the files in operator/crds should be identical to those in operator/config/crd/bases. However, it seems like they weren't identical before I regenerated the CRDs after including the new initContainer element in them (the diffs in both locations are different, while the new version of both files are identical, so the versions before the change weren't identical). Since they are identical now, I hope that this is fine, but in case people want to check what changed compared to the previous "production" versions, see f0973e8.

@malexmave
malexmave merged commit 0e94265 into main Oct 14, 2021
@malexmave
malexmave deleted the feature/init-containers branch October 14, 2021 07:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

architecture Architecture changes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Feature: Pre-populate the file system of containers to support SAST scanners

2 participants