From 67ae740300f840c7d3a1d8a304fb9417302203dc Mon Sep 17 00:00:00 2001 From: Sebastian Date: Wed, 29 Sep 2021 11:35:34 +0200 Subject: [PATCH 01/15] Make all values.yaml files follow the same template structure 1. Replaced some unnecessary comments 2. Added xy.xyz.zxy descriptions to all values 3. Added security context to all scanners 4. Added cascading rules to all scanners (when no cascading rules exist, they are set to false) 5. Changed nuclei image tag from "latest" to "null" 6. Set RunAsNonRoot for whatweb from "false" to "true" 7. ncrack, zap/zap-advanced have some special settings that have not been touched Signed-off-by: Sebastian --- scanners/amass/values.yaml | 18 ++++++- scanners/angularjs-csti-scanner/values.yaml | 22 ++++++-- scanners/git-repo-scanner/values.yaml | 21 ++++++-- scanners/gitleaks/values.yaml | 17 ++++-- scanners/kube-hunter/values.yaml | 17 ++++-- scanners/kubeaudit/values.yaml | 9 +++- scanners/ncrack/values.yaml | 14 ++++- scanners/nikto/values.yaml | 17 ++++-- scanners/nmap/values.yaml | 6 +-- scanners/nuclei/values.yaml | 46 +++++++++++------ scanners/screenshooter/values.yaml | 18 +++++-- scanners/ssh-scan/values.yaml | 14 ++++- scanners/sslyze/values.yaml | 14 ++++- scanners/test-scan/values.yaml | 20 +++++++- scanners/trivy/values.yaml | 18 ++++++- scanners/typo3scan/values.yaml | 14 ++++- scanners/whatweb/values.yaml | 6 +-- scanners/wpscan/values.yaml | 18 ++++++- scanners/zap-advanced/values.yaml | 57 +++++++++++++++------ scanners/zap/values.yaml | 14 ++++- 20 files changed, 311 insertions(+), 69 deletions(-) diff --git a/scanners/amass/values.yaml b/scanners/amass/values.yaml index 9e9c69becd..91813bfa6f 100644 --- a/scanners/amass/values.yaml +++ b/scanners/amass/values.yaml @@ -66,4 +66,20 @@ scanner: extraContainers: [] # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) - securityContext: {} + securityContext: + # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user + runAsNonRoot: true + # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system + readOnlyRootFilesystem: true + # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated + allowPrivilegeEscalation: false + # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode + privileged: false + capabilities: + drop: + # scanner.securityContext.capabilities.drop[0] -- This drops all linux privileges from the container. + - all + +cascadingRules: + # cascadingRules.enabled -- Enables or disables the installation of the default cascading rules for this scanner + enabled: false diff --git a/scanners/angularjs-csti-scanner/values.yaml b/scanners/angularjs-csti-scanner/values.yaml index c6f15649db..cfac783b10 100644 --- a/scanners/angularjs-csti-scanner/values.yaml +++ b/scanners/angularjs-csti-scanner/values.yaml @@ -11,7 +11,7 @@ parser: tag: null # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images pullPolicy: IfNotPresent - + # parser.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null # parser.env -- Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) @@ -21,7 +21,7 @@ scanner: image: # scanner.image.repository -- Container Image to run the scan repository: docker.io/securecodebox/scanner-angularjs-csti-scanner - # scanner.image.tag -- defaults to the charts version + # scanner.image.tag -- defaults to the charts appVersion tag: null # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images pullPolicy: IfNotPresent @@ -60,4 +60,20 @@ scanner: extraContainers: [] # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) - securityContext: {} + securityContext: + # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user + runAsNonRoot: true + # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system + readOnlyRootFilesystem: true + # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated + allowPrivilegeEscalation: false + # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode + privileged: false + capabilities: + drop: + # scanner.securityContext.capabilities.drop[0] -- This drops all linux privileges from the container. + - all + +cascadingRules: + # cascadingRules.enabled -- Enables or disables the installation of the default cascading rules for this scanner + enabled: false diff --git a/scanners/git-repo-scanner/values.yaml b/scanners/git-repo-scanner/values.yaml index 5bed40abb0..f27724e96d 100644 --- a/scanners/git-repo-scanner/values.yaml +++ b/scanners/git-repo-scanner/values.yaml @@ -4,7 +4,6 @@ parser: image: - # parser.image.tag - defaults to the charts version # parser.image.repository -- Parser image repository repository: docker.io/securecodebox/parser-git-repo-scanner # parser.image.tag -- Parser image tag @@ -22,7 +21,7 @@ scanner: image: # scanner.image.repository -- Container Image to run the scan repository: docker.io/securecodebox/scanner-git-repo-scanner - # scanner.image.tag -- defaults to the charts version + # scanner.image.tag -- defaults to the charts appVersion tag: null # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images pullPolicy: IfNotPresent @@ -61,4 +60,20 @@ scanner: extraContainers: [] # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) - securityContext: {} + securityContext: + # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user + runAsNonRoot: true + # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system + readOnlyRootFilesystem: true + # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated + allowPrivilegeEscalation: false + # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode + privileged: false + capabilities: + drop: + # scanner.securityContext.capabilities.drop[0] -- This drops all linux privileges from the container. + - all + +cascadingRules: + # cascadingRules.enabled -- Enables or disables the installation of the default cascading rules for this scanner + enabled: false diff --git a/scanners/gitleaks/values.yaml b/scanners/gitleaks/values.yaml index 3c98056aa8..0ca94e0d9e 100644 --- a/scanners/gitleaks/values.yaml +++ b/scanners/gitleaks/values.yaml @@ -4,7 +4,6 @@ parser: image: - # parser.image.tag - defaults to the charts version # parser.image.repository -- Parser image repository repository: docker.io/securecodebox/parser-gitleaks # parser.image.tag -- Parser image tag @@ -22,7 +21,7 @@ scanner: image: # scanner.image.repository -- Container Image to run the scan repository: docker.io/securecodebox/scanner-gitleaks - # scanner.image.tag -- defaults to the app version + # scanner.image.tag -- defaults to the charts appVersion tag: null # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images pullPolicy: IfNotPresent @@ -66,7 +65,19 @@ scanner: extraContainers: [] # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) - securityContext: {} + securityContext: + # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user + runAsNonRoot: true + # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system + readOnlyRootFilesystem: true + # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated + allowPrivilegeEscalation: false + # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode + privileged: false + capabilities: + drop: + # scanner.securityContext.capabilities.drop[0] -- This drops all linux privileges from the container. + - all cascadingRules: # cascadingRules.enabled -- Enables or disables the installation of the default cascading rules for this scanner diff --git a/scanners/kube-hunter/values.yaml b/scanners/kube-hunter/values.yaml index b12f71ad89..e26cb52087 100644 --- a/scanners/kube-hunter/values.yaml +++ b/scanners/kube-hunter/values.yaml @@ -21,7 +21,7 @@ scanner: image: # scanner.image.repository -- Container Image to run the scan repository: docker.io/securecodebox/scanner-kube-hunter - # scanner.image.tag -- defaults to the charts version + # scanner.image.tag -- defaults to the charts appVersion tag: null # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images pullPolicy: IfNotPresent @@ -60,9 +60,20 @@ scanner: extraContainers: [] # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) - securityContext: {} + securityContext: + # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user + runAsNonRoot: true + # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system + readOnlyRootFilesystem: true + # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated + allowPrivilegeEscalation: false + # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode + privileged: false + capabilities: + drop: + # scanner.securityContext.capabilities.drop[0] -- This drops all linux privileges from the container. + - all cascadingRules: # cascadingRules.enabled -- Enables or disables the installation of the default cascading rules for this scanner enabled: true - diff --git a/scanners/kubeaudit/values.yaml b/scanners/kubeaudit/values.yaml index 1f1c854b55..20f671715c 100644 --- a/scanners/kubeaudit/values.yaml +++ b/scanners/kubeaudit/values.yaml @@ -4,7 +4,6 @@ parser: image: - # parser.image.tag - defaults to the charts version # parser.image.repository -- Parser image repository repository: docker.io/securecodebox/parser-kubeaudit # parser.image.tag -- Parser image tag @@ -20,6 +19,10 @@ parser: scanner: image: + # scanner.image.repository -- Container Image to run the scan + repository: docker.io/securecodebox/scanner-kubeaudit + # scanner.image.tag -- defaults to the charts appVersion + tag: null # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images pullPolicy: IfNotPresent @@ -73,3 +76,7 @@ scanner: # kubeauditScope -- Automatically sets up rbac roles for kubeaudit to access the resources it scans. Can be either "cluster" (ClusterRole) or "namespace" (Role) kubeauditScope: "namespace" + +cascadingRules: + # cascadingRules.enabled -- Enables or disables the installation of the default cascading rules for this scanner + enabled: false diff --git a/scanners/ncrack/values.yaml b/scanners/ncrack/values.yaml index 9d0393b8a4..678a730352 100644 --- a/scanners/ncrack/values.yaml +++ b/scanners/ncrack/values.yaml @@ -66,7 +66,19 @@ scanner: extraContainers: [] # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) - securityContext: {} + securityContext: + # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user + runAsNonRoot: true + # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system + readOnlyRootFilesystem: true + # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated + allowPrivilegeEscalation: false + # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode + privileged: false + capabilities: + drop: + # scanner.securityContext.capabilities.drop[0] -- This drops all linux privileges from the container. + - all cascadingRules: # cascadingRules.enabled -- Enables or disables the installation of the default cascading rules for this scanner diff --git a/scanners/nikto/values.yaml b/scanners/nikto/values.yaml index 98baec028e..3d044a9d70 100644 --- a/scanners/nikto/values.yaml +++ b/scanners/nikto/values.yaml @@ -11,7 +11,7 @@ parser: tag: null # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images pullPolicy: IfNotPresent - + # parser.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null # parser.env -- Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) @@ -60,9 +60,20 @@ scanner: extraContainers: [] # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) - securityContext: {} + securityContext: + # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user + runAsNonRoot: true + # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system + readOnlyRootFilesystem: true + # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated + allowPrivilegeEscalation: false + # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode + privileged: false + capabilities: + drop: + # scanner.securityContext.capabilities.drop[0] -- This drops all linux privileges from the container. + - all cascadingRules: # cascadingRules.enabled -- Enables or disables the installation of the default cascading rules for this scanner enabled: true - diff --git a/scanners/nmap/values.yaml b/scanners/nmap/values.yaml index 5d177fee4a..802aff0163 100644 --- a/scanners/nmap/values.yaml +++ b/scanners/nmap/values.yaml @@ -7,11 +7,11 @@ parser: # parser.image.repository -- Parser image repository repository: docker.io/securecodebox/parser-nmap # parser.image.tag -- Parser image tag - # @default -- defaults to the charts appVersion + # @default -- defaults to the charts version tag: null # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images pullPolicy: IfNotPresent - + # parser.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null # parser.env -- Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) @@ -21,7 +21,7 @@ scanner: image: # scanner.image.repository -- Container Image to run the scan repository: docker.io/securecodebox/scanner-nmap - # scanner.image.tag -- defaults to the charts version + # scanner.image.tag -- defaults to the charts appVersion tag: null # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images pullPolicy: IfNotPresent diff --git a/scanners/nuclei/values.yaml b/scanners/nuclei/values.yaml index a82e01400c..4087c3d9e4 100644 --- a/scanners/nuclei/values.yaml +++ b/scanners/nuclei/values.yaml @@ -4,29 +4,29 @@ parser: image: - # -- Parser image repository + # parser.image.repository -- Parser image repository repository: docker.io/securecodebox/parser-nuclei - # -- Parser image tag + # parser.image.tag -- Parser image tag # @default -- defaults to the charts version tag: null # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images pullPolicy: IfNotPresent - # -- seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ + # parser.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null - # -- Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) + # parser.env -- Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) env: [] scanner: image: - # -- Container Image to run the scan + # scanner.image.repository -- Container Image to run the scan repository: docker.io/projectdiscovery/nuclei - # -- defaults to the charts version - tag: latest + # scanner.image.tag -- defaults to the charts appVersion + tag: null # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images pullPolicy: IfNotPresent - # -- append a string to the default scantype name. + # scanner.nameAppend -- append a string to the default scantype name. nameAppend: null # -- seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ @@ -37,7 +37,7 @@ scanner: # @default -- 3 backoffLimit: 3 - # -- CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) + # scanner.resources -- CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) resources: {} # resources: # requests: @@ -47,20 +47,32 @@ scanner: # memory: "512Mi" # cpu: "500m" - # -- Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) + # scanner.env -- Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) env: [] - # -- Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) + # scanner.extraVolumes -- Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) extraVolumes: [] - # -- Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) + # scanner.extraVolumeMounts -- Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) extraVolumeMounts: [] - # -- Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) + # scanner.extraContainers -- Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) extraContainers: [] - # -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) - securityContext: {} + # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) + securityContext: + # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user + runAsNonRoot: true + # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system + readOnlyRootFilesystem: true + # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated + allowPrivilegeEscalation: false + # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode + privileged: false + capabilities: + drop: + # scanner.securityContext.capabilities.drop[0] -- This drops all linux privileges from the container. + - all nucleiTemplateCache: # -- Enables or disables the use of an persistent volume to cache the always downloaded nuclei-templates for all scans. @@ -71,5 +83,5 @@ nucleiTemplateCache: schedule: "0 */1 * * *" cascadingRules: - # -- Enables or disables the installation of the default cascading rules for this scanner - enabled: true \ No newline at end of file + # cascadingRules.enabled -- Enables or disables the installation of the default cascading rules for this scanner + enabled: true diff --git a/scanners/screenshooter/values.yaml b/scanners/screenshooter/values.yaml index 095586a306..3e7f52cc81 100644 --- a/scanners/screenshooter/values.yaml +++ b/scanners/screenshooter/values.yaml @@ -7,7 +7,7 @@ parser: # parser.image.repository -- Parser image repository repository: docker.io/securecodebox/parser-screenshooter # parser.image.tag -- Parser image tag - # @default -- defaults to the charts appVersion + # @default -- defaults to the charts version tag: null # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images pullPolicy: IfNotPresent @@ -21,7 +21,7 @@ scanner: image: # scanner.image.repository -- Container Image to run the scan repository: docker.io/securecodebox/scanner-screenshooter - # scanner.image.tag -- defaults to the charts version + # scanner.image.tag -- defaults to the charts appVersion tag: null # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images pullPolicy: IfNotPresent @@ -60,7 +60,19 @@ scanner: extraContainers: [] # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) - securityContext: {} + securityContext: + # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user + runAsNonRoot: true + # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system + readOnlyRootFilesystem: true + # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated + allowPrivilegeEscalation: false + # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode + privileged: false + capabilities: + drop: + # scanner.securityContext.capabilities.drop[0] -- This drops all linux privileges from the container. + - all cascadingRules: # cascadingRules.enabled -- Enables or disables the installation of the default cascading rules for this scanner diff --git a/scanners/ssh-scan/values.yaml b/scanners/ssh-scan/values.yaml index de1c637c1e..6b0da72a9f 100644 --- a/scanners/ssh-scan/values.yaml +++ b/scanners/ssh-scan/values.yaml @@ -60,7 +60,19 @@ scanner: extraContainers: [] # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) - securityContext: {} + securityContext: + # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user + runAsNonRoot: true + # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system + readOnlyRootFilesystem: true + # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated + allowPrivilegeEscalation: false + # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode + privileged: false + capabilities: + drop: + # scanner.securityContext.capabilities.drop[0] -- This drops all linux privileges from the container. + - all cascadingRules: # cascadingRules.enabled -- Enables or disables the installation of the default cascading rules for this scanner diff --git a/scanners/sslyze/values.yaml b/scanners/sslyze/values.yaml index fd1c19ba5d..e698f87df2 100644 --- a/scanners/sslyze/values.yaml +++ b/scanners/sslyze/values.yaml @@ -60,7 +60,19 @@ scanner: extraContainers: [] # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) - securityContext: {} + securityContext: + # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user + runAsNonRoot: true + # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system + readOnlyRootFilesystem: true + # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated + allowPrivilegeEscalation: false + # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode + privileged: false + capabilities: + drop: + # scanner.securityContext.capabilities.drop[0] -- This drops all linux privileges from the container. + - all cascadingRules: # cascadingRules.enabled -- Enables or disables the installation of the default cascading rules for this scanner diff --git a/scanners/test-scan/values.yaml b/scanners/test-scan/values.yaml index ebb68c1198..8633bd5fcd 100644 --- a/scanners/test-scan/values.yaml +++ b/scanners/test-scan/values.yaml @@ -21,7 +21,7 @@ scanner: image: # scanner.image.repository -- Container Image to run the scan repository: docker.io/securecodebox/scanner-test-scan - # scanner.image.tag - defaults to the charts version + # scanner.image.tag -- defaults to the charts appVersion tag: null # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images pullPolicy: IfNotPresent @@ -60,4 +60,20 @@ scanner: extraContainers: [] # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) - securityContext: {} + securityContext: + # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user + runAsNonRoot: true + # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system + readOnlyRootFilesystem: true + # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated + allowPrivilegeEscalation: false + # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode + privileged: false + capabilities: + drop: + # scanner.securityContext.capabilities.drop[0] -- This drops all linux privileges from the container. + - all + +cascadingRules: + # cascadingRules.enabled -- Enables or disables the installation of the default cascading rules for this scanner + enabled: false diff --git a/scanners/trivy/values.yaml b/scanners/trivy/values.yaml index 5d40abd349..b3c9ef627f 100644 --- a/scanners/trivy/values.yaml +++ b/scanners/trivy/values.yaml @@ -60,4 +60,20 @@ scanner: extraContainers: [] # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) - securityContext: {} + securityContext: + # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user + runAsNonRoot: true + # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system + readOnlyRootFilesystem: true + # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated + allowPrivilegeEscalation: false + # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode + privileged: false + capabilities: + drop: + # scanner.securityContext.capabilities.drop[0] -- This drops all linux privileges from the container. + - all + +cascadingRules: + # cascadingRules.enabled -- Enables or disables the installation of the default cascading rules for this scanner + enabled: false diff --git a/scanners/typo3scan/values.yaml b/scanners/typo3scan/values.yaml index 8c79a2fee0..6a84c7f733 100644 --- a/scanners/typo3scan/values.yaml +++ b/scanners/typo3scan/values.yaml @@ -60,7 +60,19 @@ scanner: extraContainers: [] # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) - securityContext: {} + securityContext: + # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user + runAsNonRoot: true + # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system + readOnlyRootFilesystem: true + # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated + allowPrivilegeEscalation: false + # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode + privileged: false + capabilities: + drop: + # scanner.securityContext.capabilities.drop[0] -- This drops all linux privileges from the container. + - all cascadingRules: # cascadingRules.enabled -- Enables or disables the installation of the default cascading rules for this scanner diff --git a/scanners/whatweb/values.yaml b/scanners/whatweb/values.yaml index 698796e113..ea22d7b275 100644 --- a/scanners/whatweb/values.yaml +++ b/scanners/whatweb/values.yaml @@ -7,7 +7,7 @@ parser: # parser.image.repository -- Parser image repository repository: docker.io/securecodebox/parser-whatweb # parser.image.tag -- Parser image tag - # @default -- defaults to the charts appVersion + # @default -- defaults to the charts version tag: null # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images pullPolicy: IfNotPresent @@ -21,7 +21,7 @@ scanner: image: # scanner.image.repository -- Container Image to run the scan repository: docker.io/securecodebox/scanner-whatweb - # scanner.image.tag -- defaults to the charts version + # scanner.image.tag -- defaults to the charts appVersion tag: null # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images pullPolicy: IfNotPresent @@ -62,7 +62,7 @@ scanner: # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) securityContext: # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user - runAsNonRoot: false + runAsNonRoot: true # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system readOnlyRootFilesystem: true # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated diff --git a/scanners/wpscan/values.yaml b/scanners/wpscan/values.yaml index aa2e515128..89394432ec 100644 --- a/scanners/wpscan/values.yaml +++ b/scanners/wpscan/values.yaml @@ -60,4 +60,20 @@ scanner: extraContainers: [] # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) - securityContext: {} + securityContext: + # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user + runAsNonRoot: true + # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system + readOnlyRootFilesystem: true + # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated + allowPrivilegeEscalation: false + # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode + privileged: false + capabilities: + drop: + # scanner.securityContext.capabilities.drop[0] -- This drops all linux privileges from the container. + - all + +cascadingRules: + # cascadingRules.enabled -- Enables or disables the installation of the default cascading rules for this scanner + enabled: false diff --git a/scanners/zap-advanced/values.yaml b/scanners/zap-advanced/values.yaml index f53b67962f..4c1039ecc8 100644 --- a/scanners/zap-advanced/values.yaml +++ b/scanners/zap-advanced/values.yaml @@ -4,24 +4,24 @@ parser: image: - # -- Parser image repository + # parser.image.repository -- Parser image repository repository: docker.io/securecodebox/parser-zap - # -- Parser image tag + # parser.image.tag -- Parser image tag # @default -- defaults to the charts version tag: null # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images pullPolicy: IfNotPresent - # -- seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ + # parser.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null # parser.env -- Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) env: [] scanner: image: - # -- Container Image to run the scan + # scanner.image.repository -- Container Image to run the scan repository: docker.io/securecodebox/scanner-zap-advanced - # -- defaults to the charts appVersion + # scanner.image.tag -- defaults to the charts appVersion tag: null # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images pullPolicy: IfNotPresent @@ -37,7 +37,7 @@ scanner: # @default -- 3 backoffLimit: 3 - # -- CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) + # scanner.resources -- CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) resources: {} # resources: # requests: @@ -47,13 +47,13 @@ scanner: # memory: "512Mi" # cpu: "500m" - # -- Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) + # scanner.env -- Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) env: [] - # -- Optional mount environment variables from configMaps or secrets (see: https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#configure-all-key-value-pairs-in-a-secret-as-container-environment-variables) + # scanner.envFrom -- Optional mount environment variables from configMaps or secrets (see: https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#configure-all-key-value-pairs-in-a-secret-as-container-environment-variables) envFrom: [] - # -- Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) + # scanner.extraVolumes -- Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) extraVolumes: - name: zap-advanced-scantype-config configMap: @@ -65,18 +65,30 @@ scanner: configMap: name: zap-scripts-session - # -- Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) + # scanner.extraVolumeMounts -- Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) extraVolumeMounts: - name: zap-advanced-scantype-config mountPath: /home/securecodebox/configs/1-zap-advanced-scantype.yaml subPath: 1-zap-advanced-scantype.yaml readOnly: true - # -- Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) + # scanner.extraContainers -- Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) extraContainers: [] - # -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) - securityContext: {} + # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) + securityContext: + # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user + runAsNonRoot: true + # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system + readOnlyRootFilesystem: true + # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated + allowPrivilegeEscalation: false + # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode + privileged: false + capabilities: + drop: + # scanner.securityContext.capabilities.drop[0] -- This drops all linux privileges from the container. + - all zapContainer: image: @@ -112,8 +124,20 @@ zapContainer: mountPath: /home/zap/.ZAP_D/scripts/scripts/session/ readOnly: true - # -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) - securityContext: {} + # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) + securityContext: + # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user + runAsNonRoot: true + # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system + readOnlyRootFilesystem: true + # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated + allowPrivilegeEscalation: false + # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode + privileged: false + capabilities: + drop: + # scanner.securityContext.capabilities.drop[0] -- This drops all linux privileges from the container. + - all # -- All `scanType` specific configuration options. Feel free to add more configuration options. All configuration options can be overriden by scan specific configurations if defined. Please have a look into the README.md to find more configuration options. zapConfiguration: @@ -130,7 +154,6 @@ zapConfiguration: - pscanrulesAlpha - ascanrulesAlpha -# -- Configurations regarding the cascading scan cascadingRules: - # -- Enables or disables the installation of the default cascading rules for this scanner + # cascadingRules.enabled -- Enables or disables the installation of the default cascading rules for this scanner enabled: true diff --git a/scanners/zap/values.yaml b/scanners/zap/values.yaml index 72da02560a..a318a9594c 100644 --- a/scanners/zap/values.yaml +++ b/scanners/zap/values.yaml @@ -67,7 +67,19 @@ scanner: extraContainers: [] # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) - securityContext: {} + securityContext: + # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user + runAsNonRoot: true + # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system + readOnlyRootFilesystem: true + # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated + allowPrivilegeEscalation: false + # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode + privileged: false + capabilities: + drop: + # scanner.securityContext.capabilities.drop[0] -- This drops all linux privileges from the container. + - all cascadingRules: # cascadingRules.enabled -- Enables or disables the installation of the default cascading rules for this scanner From 1d7f71f4b58126c1a65df0037412f76d9f31e3dc Mon Sep 17 00:00:00 2001 From: SebieF Date: Wed, 29 Sep 2021 09:36:03 +0000 Subject: [PATCH 02/15] Updating Helm Docs Signed-off-by: GitHub Actions --- scanners/amass/README.md | 8 +++++++- scanners/amass/docs/README.ArtifactHub.md | 8 +++++++- scanners/angularjs-csti-scanner/README.md | 10 ++++++++-- .../docs/README.ArtifactHub.md | 10 ++++++++-- scanners/git-repo-scanner/README.md | 10 ++++++++-- .../git-repo-scanner/docs/README.ArtifactHub.md | 10 ++++++++-- scanners/gitleaks/README.md | 9 +++++++-- scanners/gitleaks/docs/README.ArtifactHub.md | 9 +++++++-- scanners/kube-hunter/README.md | 9 +++++++-- scanners/kube-hunter/docs/README.ArtifactHub.md | 9 +++++++-- scanners/kubeaudit/README.md | 3 +++ scanners/kubeaudit/docs/README.ArtifactHub.md | 3 +++ scanners/ncrack/README.md | 7 ++++++- scanners/ncrack/docs/README.ArtifactHub.md | 7 ++++++- scanners/nikto/README.md | 7 ++++++- scanners/nikto/docs/README.ArtifactHub.md | 7 ++++++- scanners/nmap/README.md | 4 ++-- scanners/nmap/docs/README.ArtifactHub.md | 4 ++-- scanners/nuclei/README.md | 11 ++++++++--- scanners/nuclei/docs/README.ArtifactHub.md | 11 ++++++++--- scanners/screenshooter/README.md | 11 ++++++++--- .../screenshooter/docs/README.ArtifactHub.md | 11 ++++++++--- scanners/ssh-scan/README.md | 7 ++++++- scanners/ssh-scan/docs/README.ArtifactHub.md | 7 ++++++- scanners/sslyze/README.md | 7 ++++++- scanners/sslyze/docs/README.ArtifactHub.md | 7 ++++++- scanners/test-scan/README.md | 10 ++++++++-- scanners/test-scan/docs/README.ArtifactHub.md | 10 ++++++++-- scanners/trivy/README.md | 8 +++++++- scanners/trivy/docs/README.ArtifactHub.md | 8 +++++++- scanners/wpscan/README.md | 8 +++++++- scanners/wpscan/docs/README.ArtifactHub.md | 8 +++++++- scanners/zap-advanced/README.md | 16 ++++++++++++---- scanners/zap-advanced/docs/README.ArtifactHub.md | 16 ++++++++++++---- scanners/zap/README.md | 7 ++++++- scanners/zap/docs/README.ArtifactHub.md | 7 ++++++- 36 files changed, 244 insertions(+), 60 deletions(-) diff --git a/scanners/amass/README.md b/scanners/amass/README.md index e31a8387c6..c1a0091aa6 100644 --- a/scanners/amass/README.md +++ b/scanners/amass/README.md @@ -69,6 +69,7 @@ Kubernetes: `>=v1.11.0-0` | Key | Type | Default | Description | |-----|------|---------|-------------| +| cascadingRules.enabled | bool | `false` | Enables or disables the installation of the default cascading rules for this scanner | | parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | | parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | parser.image.repository | string | `"docker.io/securecodebox/parser-amass"` | Parser image repository | @@ -85,7 +86,12 @@ Kubernetes: `>=v1.11.0-0` | scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## License diff --git a/scanners/amass/docs/README.ArtifactHub.md b/scanners/amass/docs/README.ArtifactHub.md index d0895839de..f67dda46c6 100644 --- a/scanners/amass/docs/README.ArtifactHub.md +++ b/scanners/amass/docs/README.ArtifactHub.md @@ -74,6 +74,7 @@ Kubernetes: `>=v1.11.0-0` | Key | Type | Default | Description | |-----|------|---------|-------------| +| cascadingRules.enabled | bool | `false` | Enables or disables the installation of the default cascading rules for this scanner | | parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | | parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | parser.image.repository | string | `"docker.io/securecodebox/parser-amass"` | Parser image repository | @@ -90,7 +91,12 @@ Kubernetes: `>=v1.11.0-0` | scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## Contributing diff --git a/scanners/angularjs-csti-scanner/README.md b/scanners/angularjs-csti-scanner/README.md index a8117bfdbf..d0bab273c2 100644 --- a/scanners/angularjs-csti-scanner/README.md +++ b/scanners/angularjs-csti-scanner/README.md @@ -168,6 +168,7 @@ options.scope.request_methods = [ | Key | Type | Default | Description | |-----|------|---------|-------------| +| cascadingRules.enabled | bool | `false` | Enables or disables the installation of the default cascading rules for this scanner | | parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | | parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | parser.image.repository | string | `"docker.io/securecodebox/parser-angularjs-csti-scanner"` | Parser image repository | @@ -181,10 +182,15 @@ options.scope.request_methods = [ | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | scanner.image.repository | string | `"docker.io/securecodebox/scanner-angularjs-csti-scanner"` | Container Image to run the scan | -| scanner.image.tag | string | `nil` | defaults to the charts version | +| scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## License diff --git a/scanners/angularjs-csti-scanner/docs/README.ArtifactHub.md b/scanners/angularjs-csti-scanner/docs/README.ArtifactHub.md index 4fbf808ab8..99d3dede0a 100644 --- a/scanners/angularjs-csti-scanner/docs/README.ArtifactHub.md +++ b/scanners/angularjs-csti-scanner/docs/README.ArtifactHub.md @@ -173,6 +173,7 @@ options.scope.request_methods = [ | Key | Type | Default | Description | |-----|------|---------|-------------| +| cascadingRules.enabled | bool | `false` | Enables or disables the installation of the default cascading rules for this scanner | | parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | | parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | parser.image.repository | string | `"docker.io/securecodebox/parser-angularjs-csti-scanner"` | Parser image repository | @@ -186,10 +187,15 @@ options.scope.request_methods = [ | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | scanner.image.repository | string | `"docker.io/securecodebox/scanner-angularjs-csti-scanner"` | Container Image to run the scan | -| scanner.image.tag | string | `nil` | defaults to the charts version | +| scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## Contributing diff --git a/scanners/git-repo-scanner/README.md b/scanners/git-repo-scanner/README.md index 3275094a88..98019dbd71 100644 --- a/scanners/git-repo-scanner/README.md +++ b/scanners/git-repo-scanner/README.md @@ -97,6 +97,7 @@ Kubernetes: `>=v1.11.0-0` | Key | Type | Default | Description | |-----|------|---------|-------------| +| cascadingRules.enabled | bool | `false` | Enables or disables the installation of the default cascading rules for this scanner | | parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | | parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | parser.image.repository | string | `"docker.io/securecodebox/parser-git-repo-scanner"` | Parser image repository | @@ -110,10 +111,15 @@ Kubernetes: `>=v1.11.0-0` | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | scanner.image.repository | string | `"docker.io/securecodebox/scanner-git-repo-scanner"` | Container Image to run the scan | -| scanner.image.tag | string | `nil` | defaults to the charts version | +| scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## License diff --git a/scanners/git-repo-scanner/docs/README.ArtifactHub.md b/scanners/git-repo-scanner/docs/README.ArtifactHub.md index 7f4ed59d8f..576c6290c0 100644 --- a/scanners/git-repo-scanner/docs/README.ArtifactHub.md +++ b/scanners/git-repo-scanner/docs/README.ArtifactHub.md @@ -104,6 +104,7 @@ Kubernetes: `>=v1.11.0-0` | Key | Type | Default | Description | |-----|------|---------|-------------| +| cascadingRules.enabled | bool | `false` | Enables or disables the installation of the default cascading rules for this scanner | | parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | | parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | parser.image.repository | string | `"docker.io/securecodebox/parser-git-repo-scanner"` | Parser image repository | @@ -117,10 +118,15 @@ Kubernetes: `>=v1.11.0-0` | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | scanner.image.repository | string | `"docker.io/securecodebox/scanner-git-repo-scanner"` | Container Image to run the scan | -| scanner.image.tag | string | `nil` | defaults to the charts version | +| scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## Contributing diff --git a/scanners/gitleaks/README.md b/scanners/gitleaks/README.md index ce2b80ba63..08276c3cd9 100644 --- a/scanners/gitleaks/README.md +++ b/scanners/gitleaks/README.md @@ -175,10 +175,15 @@ For more information on how to use cascades take a look at | scanner.extraVolumes | list | `[{"configMap":{"name":"gitleaks-config"},"name":"gitleaks-config"}]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | scanner.image.repository | string | `"docker.io/securecodebox/scanner-gitleaks"` | Container Image to run the scan | -| scanner.image.tag | string | `nil` | defaults to the app version | +| scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## License diff --git a/scanners/gitleaks/docs/README.ArtifactHub.md b/scanners/gitleaks/docs/README.ArtifactHub.md index 22d61dae94..0285c4f92f 100644 --- a/scanners/gitleaks/docs/README.ArtifactHub.md +++ b/scanners/gitleaks/docs/README.ArtifactHub.md @@ -180,10 +180,15 @@ For more information on how to use cascades take a look at | scanner.extraVolumes | list | `[{"configMap":{"name":"gitleaks-config"},"name":"gitleaks-config"}]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | scanner.image.repository | string | `"docker.io/securecodebox/scanner-gitleaks"` | Container Image to run the scan | -| scanner.image.tag | string | `nil` | defaults to the app version | +| scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## Contributing diff --git a/scanners/kube-hunter/README.md b/scanners/kube-hunter/README.md index ea246b864d..e9d35e8ae2 100644 --- a/scanners/kube-hunter/README.md +++ b/scanners/kube-hunter/README.md @@ -76,10 +76,15 @@ Kubernetes: `>=v1.11.0-0` | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | scanner.image.repository | string | `"docker.io/securecodebox/scanner-kube-hunter"` | Container Image to run the scan | -| scanner.image.tag | string | `nil` | defaults to the charts version | +| scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## License diff --git a/scanners/kube-hunter/docs/README.ArtifactHub.md b/scanners/kube-hunter/docs/README.ArtifactHub.md index 0ca1f8063c..7696e1cec1 100644 --- a/scanners/kube-hunter/docs/README.ArtifactHub.md +++ b/scanners/kube-hunter/docs/README.ArtifactHub.md @@ -83,10 +83,15 @@ Kubernetes: `>=v1.11.0-0` | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | scanner.image.repository | string | `"docker.io/securecodebox/scanner-kube-hunter"` | Container Image to run the scan | -| scanner.image.tag | string | `nil` | defaults to the charts version | +| scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## Contributing diff --git a/scanners/kubeaudit/README.md b/scanners/kubeaudit/README.md index 94d17c132c..8f2da2bdc6 100644 --- a/scanners/kubeaudit/README.md +++ b/scanners/kubeaudit/README.md @@ -65,6 +65,7 @@ Kubernetes: `>=v1.11.0-0` | Key | Type | Default | Description | |-----|------|---------|-------------| +| cascadingRules.enabled | bool | `false` | Enables or disables the installation of the default cascading rules for this scanner | | kubeauditScope | string | `"namespace"` | Automatically sets up rbac roles for kubeaudit to access the resources it scans. Can be either "cluster" (ClusterRole) or "namespace" (Role) | | parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | | parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | @@ -78,6 +79,8 @@ Kubernetes: `>=v1.11.0-0` | scanner.extraVolumeMounts | list | `[]` | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | +| scanner.image.repository | string | `"docker.io/securecodebox/scanner-kubeaudit"` | Container Image to run the scan | +| scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | | scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | diff --git a/scanners/kubeaudit/docs/README.ArtifactHub.md b/scanners/kubeaudit/docs/README.ArtifactHub.md index 2592705393..82d66dc485 100644 --- a/scanners/kubeaudit/docs/README.ArtifactHub.md +++ b/scanners/kubeaudit/docs/README.ArtifactHub.md @@ -72,6 +72,7 @@ Kubernetes: `>=v1.11.0-0` | Key | Type | Default | Description | |-----|------|---------|-------------| +| cascadingRules.enabled | bool | `false` | Enables or disables the installation of the default cascading rules for this scanner | | kubeauditScope | string | `"namespace"` | Automatically sets up rbac roles for kubeaudit to access the resources it scans. Can be either "cluster" (ClusterRole) or "namespace" (Role) | | parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | | parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | @@ -85,6 +86,8 @@ Kubernetes: `>=v1.11.0-0` | scanner.extraVolumeMounts | list | `[]` | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | +| scanner.image.repository | string | `"docker.io/securecodebox/scanner-kubeaudit"` | Container Image to run the scan | +| scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | | scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | diff --git a/scanners/ncrack/README.md b/scanners/ncrack/README.md index 72c5ed47f7..b7b2ea0b0a 100644 --- a/scanners/ncrack/README.md +++ b/scanners/ncrack/README.md @@ -227,7 +227,12 @@ helm delete ncrack | scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## License diff --git a/scanners/ncrack/docs/README.ArtifactHub.md b/scanners/ncrack/docs/README.ArtifactHub.md index 425f37c461..aa536ec853 100644 --- a/scanners/ncrack/docs/README.ArtifactHub.md +++ b/scanners/ncrack/docs/README.ArtifactHub.md @@ -234,7 +234,12 @@ helm delete ncrack | scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## Contributing diff --git a/scanners/nikto/README.md b/scanners/nikto/README.md index 295bcd107d..5cb3551118 100644 --- a/scanners/nikto/README.md +++ b/scanners/nikto/README.md @@ -98,7 +98,12 @@ Kubernetes: `>=v1.11.0-0` | scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## License diff --git a/scanners/nikto/docs/README.ArtifactHub.md b/scanners/nikto/docs/README.ArtifactHub.md index f16d557238..434b505e89 100644 --- a/scanners/nikto/docs/README.ArtifactHub.md +++ b/scanners/nikto/docs/README.ArtifactHub.md @@ -103,7 +103,12 @@ Kubernetes: `>=v1.11.0-0` | scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## Contributing diff --git a/scanners/nmap/README.md b/scanners/nmap/README.md index 9eed01babf..f7dce643bd 100644 --- a/scanners/nmap/README.md +++ b/scanners/nmap/README.md @@ -121,7 +121,7 @@ spec: | parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | | parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | parser.image.repository | string | `"docker.io/securecodebox/parser-nmap"` | Parser image repository | -| parser.image.tag | string | defaults to the charts appVersion | Parser image tag | +| parser.image.tag | string | defaults to the charts version | Parser image tag | | parser.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | | scanner.activeDeadlineSeconds | string | `nil` | There are situations where you want to fail a scan Job after some amount of time. To do so, set activeDeadlineSeconds to define an active deadline (in seconds) when considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#job-termination-and-cleanup) | | scanner.backoffLimit | int | 3 | There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) | @@ -131,7 +131,7 @@ spec: | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | scanner.image.repository | string | `"docker.io/securecodebox/scanner-nmap"` | Container Image to run the scan | -| scanner.image.tag | string | `nil` | defaults to the charts version | +| scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | | scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | diff --git a/scanners/nmap/docs/README.ArtifactHub.md b/scanners/nmap/docs/README.ArtifactHub.md index 587ef3d8d3..a08d740468 100644 --- a/scanners/nmap/docs/README.ArtifactHub.md +++ b/scanners/nmap/docs/README.ArtifactHub.md @@ -126,7 +126,7 @@ spec: | parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | | parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | parser.image.repository | string | `"docker.io/securecodebox/parser-nmap"` | Parser image repository | -| parser.image.tag | string | defaults to the charts appVersion | Parser image tag | +| parser.image.tag | string | defaults to the charts version | Parser image tag | | parser.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | | scanner.activeDeadlineSeconds | string | `nil` | There are situations where you want to fail a scan Job after some amount of time. To do so, set activeDeadlineSeconds to define an active deadline (in seconds) when considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#job-termination-and-cleanup) | | scanner.backoffLimit | int | 3 | There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) | @@ -136,7 +136,7 @@ spec: | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | scanner.image.repository | string | `"docker.io/securecodebox/scanner-nmap"` | Container Image to run the scan | -| scanner.image.tag | string | `nil` | defaults to the charts version | +| scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | | scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | diff --git a/scanners/nuclei/README.md b/scanners/nuclei/README.md index 6bf2090449..9986f57b81 100644 --- a/scanners/nuclei/README.md +++ b/scanners/nuclei/README.md @@ -166,7 +166,7 @@ Kubernetes: `>=v1.11.0-0` | parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | | parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | parser.image.repository | string | `"docker.io/securecodebox/parser-nuclei"` | Parser image repository | -| parser.image.tag | string | `nil` | Parser image tag | +| parser.image.tag | string | defaults to the charts version | Parser image tag | | parser.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | | scanner.activeDeadlineSeconds | string | `nil` | There are situations where you want to fail a scan Job after some amount of time. To do so, set activeDeadlineSeconds to define an active deadline (in seconds) when considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#job-termination-and-cleanup) | | scanner.backoffLimit | int | 3 | There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) | @@ -176,10 +176,15 @@ Kubernetes: `>=v1.11.0-0` | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | scanner.image.repository | string | `"docker.io/projectdiscovery/nuclei"` | Container Image to run the scan | -| scanner.image.tag | string | `"latest"` | defaults to the charts version | +| scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## License diff --git a/scanners/nuclei/docs/README.ArtifactHub.md b/scanners/nuclei/docs/README.ArtifactHub.md index 5b5821c280..efba10fe39 100644 --- a/scanners/nuclei/docs/README.ArtifactHub.md +++ b/scanners/nuclei/docs/README.ArtifactHub.md @@ -173,7 +173,7 @@ Kubernetes: `>=v1.11.0-0` | parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | | parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | parser.image.repository | string | `"docker.io/securecodebox/parser-nuclei"` | Parser image repository | -| parser.image.tag | string | `nil` | Parser image tag | +| parser.image.tag | string | defaults to the charts version | Parser image tag | | parser.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | | scanner.activeDeadlineSeconds | string | `nil` | There are situations where you want to fail a scan Job after some amount of time. To do so, set activeDeadlineSeconds to define an active deadline (in seconds) when considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#job-termination-and-cleanup) | | scanner.backoffLimit | int | 3 | There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) | @@ -183,10 +183,15 @@ Kubernetes: `>=v1.11.0-0` | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | scanner.image.repository | string | `"docker.io/projectdiscovery/nuclei"` | Container Image to run the scan | -| scanner.image.tag | string | `"latest"` | defaults to the charts version | +| scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## Contributing diff --git a/scanners/screenshooter/README.md b/scanners/screenshooter/README.md index d721f3c53f..d4a013cb49 100644 --- a/scanners/screenshooter/README.md +++ b/scanners/screenshooter/README.md @@ -65,7 +65,7 @@ Kubernetes: `>=v1.11.0-0` | parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | | parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | parser.image.repository | string | `"docker.io/securecodebox/parser-screenshooter"` | Parser image repository | -| parser.image.tag | string | defaults to the charts appVersion | Parser image tag | +| parser.image.tag | string | defaults to the charts version | Parser image tag | | parser.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | | scanner.activeDeadlineSeconds | string | `nil` | There are situations where you want to fail a scan Job after some amount of time. To do so, set activeDeadlineSeconds to define an active deadline (in seconds) when considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#job-termination-and-cleanup) | | scanner.backoffLimit | int | 3 | There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) | @@ -75,10 +75,15 @@ Kubernetes: `>=v1.11.0-0` | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | scanner.image.repository | string | `"docker.io/securecodebox/scanner-screenshooter"` | Container Image to run the scan | -| scanner.image.tag | string | `nil` | defaults to the charts version | +| scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## License diff --git a/scanners/screenshooter/docs/README.ArtifactHub.md b/scanners/screenshooter/docs/README.ArtifactHub.md index fcf6bbf610..65b3c6301e 100644 --- a/scanners/screenshooter/docs/README.ArtifactHub.md +++ b/scanners/screenshooter/docs/README.ArtifactHub.md @@ -70,7 +70,7 @@ Kubernetes: `>=v1.11.0-0` | parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | | parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | parser.image.repository | string | `"docker.io/securecodebox/parser-screenshooter"` | Parser image repository | -| parser.image.tag | string | defaults to the charts appVersion | Parser image tag | +| parser.image.tag | string | defaults to the charts version | Parser image tag | | parser.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | | scanner.activeDeadlineSeconds | string | `nil` | There are situations where you want to fail a scan Job after some amount of time. To do so, set activeDeadlineSeconds to define an active deadline (in seconds) when considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#job-termination-and-cleanup) | | scanner.backoffLimit | int | 3 | There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) | @@ -80,10 +80,15 @@ Kubernetes: `>=v1.11.0-0` | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | scanner.image.repository | string | `"docker.io/securecodebox/scanner-screenshooter"` | Container Image to run the scan | -| scanner.image.tag | string | `nil` | defaults to the charts version | +| scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## Contributing diff --git a/scanners/ssh-scan/README.md b/scanners/ssh-scan/README.md index 73c4a5e647..85fbf8c575 100644 --- a/scanners/ssh-scan/README.md +++ b/scanners/ssh-scan/README.md @@ -112,7 +112,12 @@ Kubernetes: `>=v1.11.0-0` | scanner.image.tag | string | `"latest@sha256:d6f41c2c328223931b97a4ae5d35d3bb91b5c8d91871ced3d2e0cde06b1edf1f"` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## License diff --git a/scanners/ssh-scan/docs/README.ArtifactHub.md b/scanners/ssh-scan/docs/README.ArtifactHub.md index e76ba07f70..ec2b6bac33 100644 --- a/scanners/ssh-scan/docs/README.ArtifactHub.md +++ b/scanners/ssh-scan/docs/README.ArtifactHub.md @@ -119,7 +119,12 @@ Kubernetes: `>=v1.11.0-0` | scanner.image.tag | string | `"latest@sha256:d6f41c2c328223931b97a4ae5d35d3bb91b5c8d91871ced3d2e0cde06b1edf1f"` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## Contributing diff --git a/scanners/sslyze/README.md b/scanners/sslyze/README.md index 6e90fbd24c..07f1a1e096 100644 --- a/scanners/sslyze/README.md +++ b/scanners/sslyze/README.md @@ -179,7 +179,12 @@ Kubernetes: `>=v1.11.0-0` | scanner.image.tag | string | `"latest@sha256:ff2c5c626401b1961736a5b2ae6e35a41d213e8b2712102100abf5ee46dcca71"` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## License diff --git a/scanners/sslyze/docs/README.ArtifactHub.md b/scanners/sslyze/docs/README.ArtifactHub.md index 32ab3800c1..a638b24b75 100644 --- a/scanners/sslyze/docs/README.ArtifactHub.md +++ b/scanners/sslyze/docs/README.ArtifactHub.md @@ -186,7 +186,12 @@ Kubernetes: `>=v1.11.0-0` | scanner.image.tag | string | `"latest@sha256:ff2c5c626401b1961736a5b2ae6e35a41d213e8b2712102100abf5ee46dcca71"` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## Contributing diff --git a/scanners/test-scan/README.md b/scanners/test-scan/README.md index 40102a54f6..a185fea102 100644 --- a/scanners/test-scan/README.md +++ b/scanners/test-scan/README.md @@ -55,6 +55,7 @@ Kubernetes: `>=v1.11.0-0` | Key | Type | Default | Description | |-----|------|---------|-------------| +| cascadingRules.enabled | bool | `false` | Enables or disables the installation of the default cascading rules for this scanner | | parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | | parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | parser.image.repository | string | `"docker.io/securecodebox/parser-test-scan"` | Parser image repository | @@ -68,10 +69,15 @@ Kubernetes: `>=v1.11.0-0` | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | scanner.image.repository | string | `"docker.io/securecodebox/scanner-test-scan"` | Container Image to run the scan | -| scanner.image.tag | string | `nil` | | +| scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## License diff --git a/scanners/test-scan/docs/README.ArtifactHub.md b/scanners/test-scan/docs/README.ArtifactHub.md index 1c82741474..adc6e21a1b 100644 --- a/scanners/test-scan/docs/README.ArtifactHub.md +++ b/scanners/test-scan/docs/README.ArtifactHub.md @@ -61,6 +61,7 @@ Kubernetes: `>=v1.11.0-0` | Key | Type | Default | Description | |-----|------|---------|-------------| +| cascadingRules.enabled | bool | `false` | Enables or disables the installation of the default cascading rules for this scanner | | parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | | parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | parser.image.repository | string | `"docker.io/securecodebox/parser-test-scan"` | Parser image repository | @@ -74,10 +75,15 @@ Kubernetes: `>=v1.11.0-0` | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | scanner.image.repository | string | `"docker.io/securecodebox/scanner-test-scan"` | Container Image to run the scan | -| scanner.image.tag | string | `nil` | | +| scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## Contributing diff --git a/scanners/trivy/README.md b/scanners/trivy/README.md index ef130a2f94..70ea08e9c1 100644 --- a/scanners/trivy/README.md +++ b/scanners/trivy/README.md @@ -67,6 +67,7 @@ Kubernetes: `>=v1.11.0-0` | Key | Type | Default | Description | |-----|------|---------|-------------| +| cascadingRules.enabled | bool | `false` | Enables or disables the installation of the default cascading rules for this scanner | | parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | | parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | parser.image.repository | string | `"docker.io/securecodebox/parser-trivy"` | Parser image repository | @@ -83,7 +84,12 @@ Kubernetes: `>=v1.11.0-0` | scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## License diff --git a/scanners/trivy/docs/README.ArtifactHub.md b/scanners/trivy/docs/README.ArtifactHub.md index 455f82a3ed..afd4bc8f0b 100644 --- a/scanners/trivy/docs/README.ArtifactHub.md +++ b/scanners/trivy/docs/README.ArtifactHub.md @@ -74,6 +74,7 @@ Kubernetes: `>=v1.11.0-0` | Key | Type | Default | Description | |-----|------|---------|-------------| +| cascadingRules.enabled | bool | `false` | Enables or disables the installation of the default cascading rules for this scanner | | parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | | parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | parser.image.repository | string | `"docker.io/securecodebox/parser-trivy"` | Parser image repository | @@ -90,7 +91,12 @@ Kubernetes: `>=v1.11.0-0` | scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## Contributing diff --git a/scanners/wpscan/README.md b/scanners/wpscan/README.md index 7ae5765c80..2a142e9e93 100644 --- a/scanners/wpscan/README.md +++ b/scanners/wpscan/README.md @@ -101,6 +101,7 @@ Kubernetes: `>=v1.11.0-0` | Key | Type | Default | Description | |-----|------|---------|-------------| +| cascadingRules.enabled | bool | `false` | Enables or disables the installation of the default cascading rules for this scanner | | parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | | parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | parser.image.repository | string | `"docker.io/securecodebox/parser-wpscan"` | Parser image repository | @@ -117,7 +118,12 @@ Kubernetes: `>=v1.11.0-0` | scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## License diff --git a/scanners/wpscan/docs/README.ArtifactHub.md b/scanners/wpscan/docs/README.ArtifactHub.md index 235ea2962d..c0b8e1ca0e 100644 --- a/scanners/wpscan/docs/README.ArtifactHub.md +++ b/scanners/wpscan/docs/README.ArtifactHub.md @@ -106,6 +106,7 @@ Kubernetes: `>=v1.11.0-0` | Key | Type | Default | Description | |-----|------|---------|-------------| +| cascadingRules.enabled | bool | `false` | Enables or disables the installation of the default cascading rules for this scanner | | parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | | parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | parser.image.repository | string | `"docker.io/securecodebox/parser-wpscan"` | Parser image repository | @@ -122,7 +123,12 @@ Kubernetes: `>=v1.11.0-0` | scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## Contributing diff --git a/scanners/zap-advanced/README.md b/scanners/zap-advanced/README.md index 0d2ada7abc..fa43cf434f 100644 --- a/scanners/zap-advanced/README.md +++ b/scanners/zap-advanced/README.md @@ -479,12 +479,11 @@ zapConfiguration: | Key | Type | Default | Description | |-----|------|---------|-------------| -| cascadingRules | object | `{"enabled":true}` | Configurations regarding the cascading scan | | cascadingRules.enabled | bool | `true` | Enables or disables the installation of the default cascading rules for this scanner | | parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | | parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | parser.image.repository | string | `"docker.io/securecodebox/parser-zap"` | Parser image repository | -| parser.image.tag | string | `nil` | Parser image tag | +| parser.image.tag | string | defaults to the charts version | Parser image tag | | parser.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | | scanner.activeDeadlineSeconds | string | `nil` | There are situations where you want to fail a scan Job after some amount of time. To do so, set activeDeadlineSeconds to define an active deadline (in seconds) when considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#job-termination-and-cleanup) | | scanner.backoffLimit | int | 3 | There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) | @@ -498,7 +497,12 @@ zapConfiguration: | scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | | zapConfiguration | object | `{"global":{"addonInstall":["pscanrulesBeta","ascanrulesBeta","pscanrulesAlpha","ascanrulesAlpha"],"addonUpdate":true,"sessionName":"secureCodeBox"}}` | All `scanType` specific configuration options. Feel free to add more configuration options. All configuration options can be overriden by scan specific configurations if defined. Please have a look into the README.md to find more configuration options. | | zapConfiguration.global | object | `{"addonInstall":["pscanrulesBeta","ascanrulesBeta","pscanrulesAlpha","ascanrulesAlpha"],"addonUpdate":true,"sessionName":"secureCodeBox"}` | Optional general ZAP Configurations settings. | @@ -512,7 +516,11 @@ zapConfiguration: | zapContainer.image.repository | string | `"owasp/zap2docker-stable"` | Container Image to run the scan | | zapContainer.image.tag | string | `nil` | defaults to the charts appVersion | | zapContainer.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| zapContainer.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| zapContainer.securityContext.allowPrivilegeEscalation | bool | `false` | | +| zapContainer.securityContext.capabilities.drop[0] | string | `"all"` | | +| zapContainer.securityContext.privileged | bool | `false` | | +| zapContainer.securityContext.readOnlyRootFilesystem | bool | `true` | | +| zapContainer.securityContext.runAsNonRoot | bool | `true` | | ## License [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0) diff --git a/scanners/zap-advanced/docs/README.ArtifactHub.md b/scanners/zap-advanced/docs/README.ArtifactHub.md index dacf024cbe..78abe67795 100644 --- a/scanners/zap-advanced/docs/README.ArtifactHub.md +++ b/scanners/zap-advanced/docs/README.ArtifactHub.md @@ -484,12 +484,11 @@ zapConfiguration: | Key | Type | Default | Description | |-----|------|---------|-------------| -| cascadingRules | object | `{"enabled":true}` | Configurations regarding the cascading scan | | cascadingRules.enabled | bool | `true` | Enables or disables the installation of the default cascading rules for this scanner | | parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | | parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | parser.image.repository | string | `"docker.io/securecodebox/parser-zap"` | Parser image repository | -| parser.image.tag | string | `nil` | Parser image tag | +| parser.image.tag | string | defaults to the charts version | Parser image tag | | parser.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | | scanner.activeDeadlineSeconds | string | `nil` | There are situations where you want to fail a scan Job after some amount of time. To do so, set activeDeadlineSeconds to define an active deadline (in seconds) when considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#job-termination-and-cleanup) | | scanner.backoffLimit | int | 3 | There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) | @@ -503,7 +502,12 @@ zapConfiguration: | scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | | zapConfiguration | object | `{"global":{"addonInstall":["pscanrulesBeta","ascanrulesBeta","pscanrulesAlpha","ascanrulesAlpha"],"addonUpdate":true,"sessionName":"secureCodeBox"}}` | All `scanType` specific configuration options. Feel free to add more configuration options. All configuration options can be overriden by scan specific configurations if defined. Please have a look into the README.md to find more configuration options. | | zapConfiguration.global | object | `{"addonInstall":["pscanrulesBeta","ascanrulesBeta","pscanrulesAlpha","ascanrulesAlpha"],"addonUpdate":true,"sessionName":"secureCodeBox"}` | Optional general ZAP Configurations settings. | @@ -517,7 +521,11 @@ zapConfiguration: | zapContainer.image.repository | string | `"owasp/zap2docker-stable"` | Container Image to run the scan | | zapContainer.image.tag | string | `nil` | defaults to the charts appVersion | | zapContainer.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| zapContainer.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| zapContainer.securityContext.allowPrivilegeEscalation | bool | `false` | | +| zapContainer.securityContext.capabilities.drop[0] | string | `"all"` | | +| zapContainer.securityContext.privileged | bool | `false` | | +| zapContainer.securityContext.readOnlyRootFilesystem | bool | `true` | | +| zapContainer.securityContext.runAsNonRoot | bool | `true` | | ## Contributing diff --git a/scanners/zap/README.md b/scanners/zap/README.md index ba9e38324b..6c525a4e3a 100644 --- a/scanners/zap/README.md +++ b/scanners/zap/README.md @@ -119,7 +119,12 @@ That's why we introduced this `zap-advanced` scanner chart, which introduces ext | scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## License diff --git a/scanners/zap/docs/README.ArtifactHub.md b/scanners/zap/docs/README.ArtifactHub.md index e1ce88215b..c246757651 100644 --- a/scanners/zap/docs/README.ArtifactHub.md +++ b/scanners/zap/docs/README.ArtifactHub.md @@ -124,7 +124,12 @@ That's why we introduced this `zap-advanced` scanner chart, which introduces ext | scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | +| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | +| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | +| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## Contributing From 25ca91c2fbb7a3763147543a25684199ccb38ddb Mon Sep 17 00:00:00 2001 From: Sebastian Date: Tue, 5 Oct 2021 15:00:20 +0200 Subject: [PATCH 03/15] Switching security context privileges to root privileges This is necessary because the provided amass container has a non-numeric user that cannot be verified to be root or not: Error: container has runAsNonRoot and image has non-numeric user (user), cannot verify user is non-root (pod: "scan-amass-scanner-dummy-scan, container: amass) Signed-off-by: Sebastian --- scanners/amass/values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scanners/amass/values.yaml b/scanners/amass/values.yaml index 91813bfa6f..b84f89ce77 100644 --- a/scanners/amass/values.yaml +++ b/scanners/amass/values.yaml @@ -68,9 +68,9 @@ scanner: # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) securityContext: # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user - runAsNonRoot: true + runAsNonRoot: false # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system - readOnlyRootFilesystem: true + readOnlyRootFilesystem: false # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated allowPrivilegeEscalation: false # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode From 20bddce65bd114d462587639645e47af9d6f7d64 Mon Sep 17 00:00:00 2001 From: SebieF Date: Tue, 5 Oct 2021 13:00:48 +0000 Subject: [PATCH 04/15] Updating Helm Docs Signed-off-by: GitHub Actions --- scanners/amass/README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/scanners/amass/README.md b/scanners/amass/README.md index b925f7e13c..a1bc567895 100644 --- a/scanners/amass/README.md +++ b/scanners/amass/README.md @@ -86,12 +86,12 @@ Kubernetes: `>=v1.11.0-0` | scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":false,"runAsNonRoot":false}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | | scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | | scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | -| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | -| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | +| scanner.securityContext.readOnlyRootFilesystem | bool | `false` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `false` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## License From 098e568e939cbf00dd1397464f243fedbc639bd6 Mon Sep 17 00:00:00 2001 From: Sebastian Date: Mon, 11 Oct 2021 14:44:03 +0200 Subject: [PATCH 05/15] Changing test-scan to use non-numeric user A non-numeric user cannot be checked to be non-root by Kubernetes and causes an error if runAsNonRoot is (justifiably) activated. Signed-off-by: Sebastian --- scanners/test-scan/scanner/Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scanners/test-scan/scanner/Dockerfile b/scanners/test-scan/scanner/Dockerfile index 8da89374be..db339fbffc 100644 --- a/scanners/test-scan/scanner/Dockerfile +++ b/scanners/test-scan/scanner/Dockerfile @@ -3,6 +3,6 @@ # SPDX-License-Identifier: Apache-2.0 FROM alpine:3.11 -RUN addgroup -S test && adduser -S -g test test -USER test +RUN addgroup --system --gid 1001 test && adduser test --system --uid 1001 --ingroup test +USER 1001 CMD [cat] From fda7c6d93fc370e97caf0d2d0423865b201e9a08 Mon Sep 17 00:00:00 2001 From: Sebastian Date: Mon, 11 Oct 2021 15:16:54 +0200 Subject: [PATCH 06/15] Gitleaks needs root rights in its scanner Dockerfile Signed-off-by: Sebastian --- scanners/gitleaks/values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scanners/gitleaks/values.yaml b/scanners/gitleaks/values.yaml index 0ca94e0d9e..d71b70e5a9 100644 --- a/scanners/gitleaks/values.yaml +++ b/scanners/gitleaks/values.yaml @@ -67,9 +67,9 @@ scanner: # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) securityContext: # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user - runAsNonRoot: true + runAsNonRoot: false # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system - readOnlyRootFilesystem: true + readOnlyRootFilesystem: false # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated allowPrivilegeEscalation: false # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode From 9249657f0e31286149a7803fc41f940c372325a5 Mon Sep 17 00:00:00 2001 From: Sebastian Date: Mon, 11 Oct 2021 15:19:51 +0200 Subject: [PATCH 07/15] Changing Dockerfile to not require users Like Kubehunter Dockerfile, non-root user is not needed Signed-off-by: Sebastian --- scanners/gitleaks/scanner/Dockerfile | 5 +---- scanners/gitleaks/values.yaml | 4 ++-- 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/scanners/gitleaks/scanner/Dockerfile b/scanners/gitleaks/scanner/Dockerfile index 733670ca14..4807d35dd2 100644 --- a/scanners/gitleaks/scanner/Dockerfile +++ b/scanners/gitleaks/scanner/Dockerfile @@ -4,8 +4,5 @@ ARG scannerVersion=latest FROM zricethezav/gitleaks:${scannerVersion} -USER root COPY wrapper.sh /wrapper.sh -RUN chmod o+x ./wrapper.sh -USER gitleaks -ENTRYPOINT ["./wrapper.sh" ] +ENTRYPOINT [ "sh", "./wrapper.sh" ] diff --git a/scanners/gitleaks/values.yaml b/scanners/gitleaks/values.yaml index d71b70e5a9..0ca94e0d9e 100644 --- a/scanners/gitleaks/values.yaml +++ b/scanners/gitleaks/values.yaml @@ -67,9 +67,9 @@ scanner: # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) securityContext: # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user - runAsNonRoot: false + runAsNonRoot: true # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system - readOnlyRootFilesystem: false + readOnlyRootFilesystem: true # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated allowPrivilegeEscalation: false # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode From 0d81d5a670be4e1a064d71210267ac10b6337c38 Mon Sep 17 00:00:00 2001 From: Sebastian Date: Wed, 13 Oct 2021 10:48:24 +0200 Subject: [PATCH 08/15] Resetting gitleaks Dockerfile to main branch Changes to USER did not yield the desired effect Signed-off-by: Sebastian --- scanners/gitleaks/scanner/Dockerfile | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/scanners/gitleaks/scanner/Dockerfile b/scanners/gitleaks/scanner/Dockerfile index 4807d35dd2..733670ca14 100644 --- a/scanners/gitleaks/scanner/Dockerfile +++ b/scanners/gitleaks/scanner/Dockerfile @@ -4,5 +4,8 @@ ARG scannerVersion=latest FROM zricethezav/gitleaks:${scannerVersion} +USER root COPY wrapper.sh /wrapper.sh -ENTRYPOINT [ "sh", "./wrapper.sh" ] +RUN chmod o+x ./wrapper.sh +USER gitleaks +ENTRYPOINT ["./wrapper.sh" ] From 5ea532e297df94f7834b6c35052fb16ceaa6d7bd Mon Sep 17 00:00:00 2001 From: Sebastian Date: Wed, 13 Oct 2021 10:49:21 +0200 Subject: [PATCH 09/15] Setting runAsNonRoot (and readOnlyRootFilesystem if necessary) to true For scanners: gitleaks, kube-hunter, ssh-scan, sslyze, trivy, wpscan, zap, zap-advanced Signed-off-by: Sebastian --- scanners/gitleaks/values.yaml | 2 +- scanners/kube-hunter/values.yaml | 2 +- scanners/ssh-scan/values.yaml | 4 ++-- scanners/sslyze/values.yaml | 2 +- scanners/trivy/values.yaml | 4 ++-- scanners/wpscan/values.yaml | 4 ++-- scanners/zap-advanced/values.yaml | 8 ++++---- scanners/zap/values.yaml | 4 ++-- 8 files changed, 15 insertions(+), 15 deletions(-) diff --git a/scanners/gitleaks/values.yaml b/scanners/gitleaks/values.yaml index 0ca94e0d9e..058a6c9764 100644 --- a/scanners/gitleaks/values.yaml +++ b/scanners/gitleaks/values.yaml @@ -67,7 +67,7 @@ scanner: # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) securityContext: # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user - runAsNonRoot: true + runAsNonRoot: false # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system readOnlyRootFilesystem: true # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated diff --git a/scanners/kube-hunter/values.yaml b/scanners/kube-hunter/values.yaml index e26cb52087..262b311ee9 100644 --- a/scanners/kube-hunter/values.yaml +++ b/scanners/kube-hunter/values.yaml @@ -62,7 +62,7 @@ scanner: # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) securityContext: # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user - runAsNonRoot: true + runAsNonRoot: false # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system readOnlyRootFilesystem: true # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated diff --git a/scanners/ssh-scan/values.yaml b/scanners/ssh-scan/values.yaml index 6b0da72a9f..960d988e85 100644 --- a/scanners/ssh-scan/values.yaml +++ b/scanners/ssh-scan/values.yaml @@ -62,9 +62,9 @@ scanner: # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) securityContext: # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user - runAsNonRoot: true + runAsNonRoot: false # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system - readOnlyRootFilesystem: true + readOnlyRootFilesystem: false # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated allowPrivilegeEscalation: false # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode diff --git a/scanners/sslyze/values.yaml b/scanners/sslyze/values.yaml index e698f87df2..62f6c1dedf 100644 --- a/scanners/sslyze/values.yaml +++ b/scanners/sslyze/values.yaml @@ -62,7 +62,7 @@ scanner: # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) securityContext: # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user - runAsNonRoot: true + runAsNonRoot: false # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system readOnlyRootFilesystem: true # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated diff --git a/scanners/trivy/values.yaml b/scanners/trivy/values.yaml index b3c9ef627f..378d8871d3 100644 --- a/scanners/trivy/values.yaml +++ b/scanners/trivy/values.yaml @@ -62,9 +62,9 @@ scanner: # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) securityContext: # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user - runAsNonRoot: true + runAsNonRoot: false # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system - readOnlyRootFilesystem: true + readOnlyRootFilesystem: false # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated allowPrivilegeEscalation: false # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode diff --git a/scanners/wpscan/values.yaml b/scanners/wpscan/values.yaml index 89394432ec..2296184f69 100644 --- a/scanners/wpscan/values.yaml +++ b/scanners/wpscan/values.yaml @@ -62,9 +62,9 @@ scanner: # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) securityContext: # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user - runAsNonRoot: true + runAsNonRoot: false # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system - readOnlyRootFilesystem: true + readOnlyRootFilesystem: false # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated allowPrivilegeEscalation: false # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode diff --git a/scanners/zap-advanced/values.yaml b/scanners/zap-advanced/values.yaml index 4c1039ecc8..0b5d6c0469 100644 --- a/scanners/zap-advanced/values.yaml +++ b/scanners/zap-advanced/values.yaml @@ -78,9 +78,9 @@ scanner: # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) securityContext: # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user - runAsNonRoot: true + runAsNonRoot: false # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system - readOnlyRootFilesystem: true + readOnlyRootFilesystem: false # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated allowPrivilegeEscalation: false # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode @@ -127,9 +127,9 @@ zapContainer: # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) securityContext: # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user - runAsNonRoot: true + runAsNonRoot: false # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system - readOnlyRootFilesystem: true + readOnlyRootFilesystem: false # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated allowPrivilegeEscalation: false # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode diff --git a/scanners/zap/values.yaml b/scanners/zap/values.yaml index a318a9594c..cb9b2887b0 100644 --- a/scanners/zap/values.yaml +++ b/scanners/zap/values.yaml @@ -69,9 +69,9 @@ scanner: # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) securityContext: # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user - runAsNonRoot: true + runAsNonRoot: false # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system - readOnlyRootFilesystem: true + readOnlyRootFilesystem: false # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated allowPrivilegeEscalation: false # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode From 5f95e1b33cbcbbcf0a16946209d325a3c284a8ec Mon Sep 17 00:00:00 2001 From: SebieF Date: Wed, 13 Oct 2021 08:49:48 +0000 Subject: [PATCH 10/15] Updating Helm Docs Signed-off-by: GitHub Actions --- scanners/gitleaks/README.md | 4 ++-- scanners/kube-hunter/README.md | 4 ++-- scanners/ssh-scan/README.md | 6 +++--- scanners/sslyze/README.md | 4 ++-- scanners/trivy/README.md | 6 +++--- scanners/wpscan/README.md | 6 +++--- scanners/zap-advanced/README.md | 10 +++++----- scanners/zap/README.md | 6 +++--- 8 files changed, 23 insertions(+), 23 deletions(-) diff --git a/scanners/gitleaks/README.md b/scanners/gitleaks/README.md index 08276c3cd9..1402a62882 100644 --- a/scanners/gitleaks/README.md +++ b/scanners/gitleaks/README.md @@ -178,12 +178,12 @@ For more information on how to use cascades take a look at | scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":false}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | | scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | | scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | | scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | -| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | +| scanner.securityContext.runAsNonRoot | bool | `false` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## License diff --git a/scanners/kube-hunter/README.md b/scanners/kube-hunter/README.md index e9d35e8ae2..1c42bf91c3 100644 --- a/scanners/kube-hunter/README.md +++ b/scanners/kube-hunter/README.md @@ -79,12 +79,12 @@ Kubernetes: `>=v1.11.0-0` | scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":false}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | | scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | | scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | | scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | -| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | +| scanner.securityContext.runAsNonRoot | bool | `false` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## License diff --git a/scanners/ssh-scan/README.md b/scanners/ssh-scan/README.md index 85fbf8c575..b12dd7af41 100644 --- a/scanners/ssh-scan/README.md +++ b/scanners/ssh-scan/README.md @@ -112,12 +112,12 @@ Kubernetes: `>=v1.11.0-0` | scanner.image.tag | string | `"latest@sha256:d6f41c2c328223931b97a4ae5d35d3bb91b5c8d91871ced3d2e0cde06b1edf1f"` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":false,"runAsNonRoot":false}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | | scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | | scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | -| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | -| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | +| scanner.securityContext.readOnlyRootFilesystem | bool | `false` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `false` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## License diff --git a/scanners/sslyze/README.md b/scanners/sslyze/README.md index 07f1a1e096..8bc5dc00e5 100644 --- a/scanners/sslyze/README.md +++ b/scanners/sslyze/README.md @@ -179,12 +179,12 @@ Kubernetes: `>=v1.11.0-0` | scanner.image.tag | string | `"latest@sha256:ff2c5c626401b1961736a5b2ae6e35a41d213e8b2712102100abf5ee46dcca71"` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":false}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | | scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | | scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | | scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | -| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | +| scanner.securityContext.runAsNonRoot | bool | `false` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## License diff --git a/scanners/trivy/README.md b/scanners/trivy/README.md index 70ea08e9c1..3ffde9c7aa 100644 --- a/scanners/trivy/README.md +++ b/scanners/trivy/README.md @@ -84,12 +84,12 @@ Kubernetes: `>=v1.11.0-0` | scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":false,"runAsNonRoot":false}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | | scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | | scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | -| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | -| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | +| scanner.securityContext.readOnlyRootFilesystem | bool | `false` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `false` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## License diff --git a/scanners/wpscan/README.md b/scanners/wpscan/README.md index 2a142e9e93..bc33752e77 100644 --- a/scanners/wpscan/README.md +++ b/scanners/wpscan/README.md @@ -118,12 +118,12 @@ Kubernetes: `>=v1.11.0-0` | scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":false,"runAsNonRoot":false}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | | scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | | scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | -| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | -| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | +| scanner.securityContext.readOnlyRootFilesystem | bool | `false` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `false` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## License diff --git a/scanners/zap-advanced/README.md b/scanners/zap-advanced/README.md index fa43cf434f..fb9682410a 100644 --- a/scanners/zap-advanced/README.md +++ b/scanners/zap-advanced/README.md @@ -497,12 +497,12 @@ zapConfiguration: | scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":false,"runAsNonRoot":false}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | | scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | | scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | -| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | -| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | +| scanner.securityContext.readOnlyRootFilesystem | bool | `false` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `false` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | | zapConfiguration | object | `{"global":{"addonInstall":["pscanrulesBeta","ascanrulesBeta","pscanrulesAlpha","ascanrulesAlpha"],"addonUpdate":true,"sessionName":"secureCodeBox"}}` | All `scanType` specific configuration options. Feel free to add more configuration options. All configuration options can be overriden by scan specific configurations if defined. Please have a look into the README.md to find more configuration options. | | zapConfiguration.global | object | `{"addonInstall":["pscanrulesBeta","ascanrulesBeta","pscanrulesAlpha","ascanrulesAlpha"],"addonUpdate":true,"sessionName":"secureCodeBox"}` | Optional general ZAP Configurations settings. | @@ -519,8 +519,8 @@ zapConfiguration: | zapContainer.securityContext.allowPrivilegeEscalation | bool | `false` | | | zapContainer.securityContext.capabilities.drop[0] | string | `"all"` | | | zapContainer.securityContext.privileged | bool | `false` | | -| zapContainer.securityContext.readOnlyRootFilesystem | bool | `true` | | -| zapContainer.securityContext.runAsNonRoot | bool | `true` | | +| zapContainer.securityContext.readOnlyRootFilesystem | bool | `false` | | +| zapContainer.securityContext.runAsNonRoot | bool | `false` | | ## License [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0) diff --git a/scanners/zap/README.md b/scanners/zap/README.md index 6c525a4e3a..7590c62158 100644 --- a/scanners/zap/README.md +++ b/scanners/zap/README.md @@ -119,12 +119,12 @@ That's why we introduced this `zap-advanced` scanner chart, which introduces ext | scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":false,"runAsNonRoot":false}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | | scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | | scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | -| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | -| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | +| scanner.securityContext.readOnlyRootFilesystem | bool | `false` | Prevents write access to the containers file system | +| scanner.securityContext.runAsNonRoot | bool | `false` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | ## License From 5428a14782b94434c93f4057a197016c07ff746a Mon Sep 17 00:00:00 2001 From: Sebastian Date: Wed, 13 Oct 2021 11:23:11 +0200 Subject: [PATCH 11/15] Typo3Scan needs readOnlyRootFileSystem as false Signed-off-by: Sebastian --- scanners/typo3scan/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scanners/typo3scan/values.yaml b/scanners/typo3scan/values.yaml index 6a84c7f733..a97ceef2fb 100644 --- a/scanners/typo3scan/values.yaml +++ b/scanners/typo3scan/values.yaml @@ -64,7 +64,7 @@ scanner: # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user runAsNonRoot: true # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system - readOnlyRootFilesystem: true + readOnlyRootFilesystem: false # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated allowPrivilegeEscalation: false # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode From a519bd0098a29e30a66799edf209670427804a8b Mon Sep 17 00:00:00 2001 From: Sebastian Franz Date: Fri, 15 Oct 2021 13:08:15 +0200 Subject: [PATCH 12/15] Adding empty file parser test Signed-off-by: Sebastian --- .../parser/__testFiles__/test-empty-report.json | 1 + .../__testFiles__/test-empty-report.json.license | 3 +++ scanners/cmseek/parser/parser.test.js | 14 +++++++++++++- 3 files changed, 17 insertions(+), 1 deletion(-) create mode 100644 scanners/cmseek/parser/__testFiles__/test-empty-report.json create mode 100644 scanners/cmseek/parser/__testFiles__/test-empty-report.json.license diff --git a/scanners/cmseek/parser/__testFiles__/test-empty-report.json b/scanners/cmseek/parser/__testFiles__/test-empty-report.json new file mode 100644 index 0000000000..fe51488c70 --- /dev/null +++ b/scanners/cmseek/parser/__testFiles__/test-empty-report.json @@ -0,0 +1 @@ +[] diff --git a/scanners/cmseek/parser/__testFiles__/test-empty-report.json.license b/scanners/cmseek/parser/__testFiles__/test-empty-report.json.license new file mode 100644 index 0000000000..c59b85a5b5 --- /dev/null +++ b/scanners/cmseek/parser/__testFiles__/test-empty-report.json.license @@ -0,0 +1,3 @@ +SPDX-FileCopyrightText: 2021 iteratec GmbH + +SPDX-License-Identifier: Apache-2.0 diff --git a/scanners/cmseek/parser/parser.test.js b/scanners/cmseek/parser/parser.test.js index 0821bba4f9..587c9e6923 100644 --- a/scanners/cmseek/parser/parser.test.js +++ b/scanners/cmseek/parser/parser.test.js @@ -50,4 +50,16 @@ test("parser parses result of non-Joomla scan successfully", async () => { const findings = await parse(JSON.parse(fileContent)); await expect(validateParser(findings)).resolves.toBeUndefined(); expect(findings).toMatchSnapshot(); -}); \ No newline at end of file +}); + +test("should properly parse empty cmseek json file", async () => { + const jsonContent = await readFile( + __dirname + "/__testFiles__/test-empty-report.json", + { + encoding: "utf8", + } + ); + const findings = await parse(jsonContent); + await expect(validateParser(findings)).resolves.toBeUndefined(); + expect(findings).toMatchInlineSnapshot(`Array []`); +}); From d859e7ffc1aaa3cc97a69ae5188654ba1311af0b Mon Sep 17 00:00:00 2001 From: Sebastian Date: Fri, 15 Oct 2021 13:13:07 +0200 Subject: [PATCH 13/15] Making all yaml files consistent with template Signed-off-by: Sebastian Franz --- scanners/cmseek/Chart.yaml | 21 ++++--------------- .../cmseek/templates/cascading-rules.yaml | 5 ++++- .../templates/cmseek-parse-definition.yaml | 1 - .../cmseek/templates/cmseek-scan-type.yaml | 3 ++- scanners/cmseek/values.yaml | 20 ++++++++++++++---- 5 files changed, 26 insertions(+), 24 deletions(-) diff --git a/scanners/cmseek/Chart.yaml b/scanners/cmseek/Chart.yaml index 02afe32b60..5def923caa 100644 --- a/scanners/cmseek/Chart.yaml +++ b/scanners/cmseek/Chart.yaml @@ -1,40 +1,27 @@ # SPDX-FileCopyrightText: 2021 iteratec GmbH # # SPDX-License-Identifier: Apache-2.0 + apiVersion: v2 name: cmseek description: A Helm chart for the Joomla security scanner that integrates with the secureCodeBox -# A chart can be either an 'application' or a 'library' chart. -# -# Application charts are a collection of templates that can be packaged into versioned archives -# to be deployed. -# -# Library charts provide useful utilities or functions for the chart developer. They're included as -# a dependency of application charts to inject those utilities and functions into the rendering -# pipeline. Library charts do not define any templates and therefore cannot be deployed. type: application # version - gets automatically set to the secureCodeBox release version when the helm charts gets published version: v3.1.0-alpha1 -# This is the version number of the application being deployed. This version number should be -# incremented each time you make changes to the application. Versions are not expected to -# follow Semantic Versioning. They should reflect the version the application is using. -# It is recommended to use it with quotes. appVersion: "1.1.3" kubeVersion: ">=v1.11.0-0" -keywords: + +keywords: - security - cmseek - Joomla - scanner - secureCodeBox - home: https://docs.securecodebox.io/docs/scanners/cmseek icon: https://docs.securecodebox.io/img/integrationIcons/Default.svg - sources: - https://github.com/secureCodeBox/secureCodeBox - maintainers: - name: iteratec GmbH - - email: secureCodeBox@iteratec.com + email: secureCodeBox@iteratec.com diff --git a/scanners/cmseek/templates/cascading-rules.yaml b/scanners/cmseek/templates/cascading-rules.yaml index 2c32ae28d4..97dd683b66 100644 --- a/scanners/cmseek/templates/cascading-rules.yaml +++ b/scanners/cmseek/templates/cascading-rules.yaml @@ -1,12 +1,15 @@ # SPDX-FileCopyrightText: 2021 iteratec GmbH # # SPDX-License-Identifier: Apache-2.0 + # We only want to import the default cascading rules if they are enabled {{ if .Values.cascadingRules.enabled }} +# The CascadingRules are not directly in the /templates directory as their curly bracket syntax clashes with helms templates ... :( +# We import them as raw files to avoid these clashes as escaping them is even more messy {{ range $path, $_ := .Files.Glob "cascading-rules/*" }} # Include File {{ $.Files.Get $path }} # Separate multiple files --- {{ end }} -{{ end }} \ No newline at end of file +{{ end }} diff --git a/scanners/cmseek/templates/cmseek-parse-definition.yaml b/scanners/cmseek/templates/cmseek-parse-definition.yaml index 08f9b9c6fe..183b26cd4d 100644 --- a/scanners/cmseek/templates/cmseek-parse-definition.yaml +++ b/scanners/cmseek/templates/cmseek-parse-definition.yaml @@ -9,7 +9,6 @@ metadata: spec: image: "{{ .Values.parser.image.repository }}:{{ .Values.parser.image.tag | default .Chart.Version }}" imagePullPolicy: {{ .Values.parser.image.pullPolicy }} - ttlSecondsAfterFinished: {{ .Values.parser.ttlSecondsAfterFinished }} env: {{- toYaml .Values.parser.env | nindent 4 }} diff --git a/scanners/cmseek/templates/cmseek-scan-type.yaml b/scanners/cmseek/templates/cmseek-scan-type.yaml index f47014dc1b..3ff244a42f 100644 --- a/scanners/cmseek/templates/cmseek-scan-type.yaml +++ b/scanners/cmseek/templates/cmseek-scan-type.yaml @@ -1,10 +1,11 @@ # SPDX-FileCopyrightText: 2021 iteratec GmbH # # SPDX-License-Identifier: Apache-2.0 + apiVersion: "execution.securecodebox.io/v1" kind: ScanType metadata: - name: "cmseek" + name: "cmseek{{ .Values.scanner.nameAppend | default ""}}" spec: extractResults: type: cmseek-json diff --git a/scanners/cmseek/values.yaml b/scanners/cmseek/values.yaml index 13a7b04f85..aa7bfc0cb9 100644 --- a/scanners/cmseek/values.yaml +++ b/scanners/cmseek/values.yaml @@ -11,6 +11,7 @@ parser: tag: null # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images pullPolicy: IfNotPresent + # parser.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null # parser.env -- Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) @@ -28,12 +29,11 @@ scanner: # scanner.nameAppend -- append a string to the default scantype name. nameAppend: null - # scanner.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ + # -- seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null # -- There are situations where you want to fail a scan Job after some amount of time. To do so, set activeDeadlineSeconds to define an active deadline (in seconds) when considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#job-termination-and-cleanup) activeDeadlineSeconds: null - - # scanner.backoffLimit -- There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) + # -- There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) # @default -- 3 backoffLimit: 3 @@ -60,7 +60,19 @@ scanner: extraContainers: [] # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) - securityContext: {} + securityContext: + # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user + runAsNonRoot: true + # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system + readOnlyRootFilesystem: false + # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated + allowPrivilegeEscalation: false + # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode + privileged: false + capabilities: + drop: + # scanner.securityContext.capabilities.drop[0] -- This drops all linux privileges from the container. + - all cascadingRules: # cascadingRules.enabled -- Enables or disables the installation of the default cascading rules for this scanner From b3364ea336755edbe92f4b1bc16cb32a036e5dc7 Mon Sep 17 00:00:00 2001 From: Sebastian Franz Date: Fri, 15 Oct 2021 13:19:29 +0200 Subject: [PATCH 14/15] Adding empty json file test Signed-off-by: Sebastian Franz --- .../parser/__testFiles__/test-empty-report.json | 1 + .../__testFiles__/test-empty-report.json.license | 3 +++ scanners/cmseek/parser/parser.test.js | 14 +++++++++++++- 3 files changed, 17 insertions(+), 1 deletion(-) create mode 100644 scanners/cmseek/parser/__testFiles__/test-empty-report.json create mode 100644 scanners/cmseek/parser/__testFiles__/test-empty-report.json.license diff --git a/scanners/cmseek/parser/__testFiles__/test-empty-report.json b/scanners/cmseek/parser/__testFiles__/test-empty-report.json new file mode 100644 index 0000000000..fe51488c70 --- /dev/null +++ b/scanners/cmseek/parser/__testFiles__/test-empty-report.json @@ -0,0 +1 @@ +[] diff --git a/scanners/cmseek/parser/__testFiles__/test-empty-report.json.license b/scanners/cmseek/parser/__testFiles__/test-empty-report.json.license new file mode 100644 index 0000000000..c59b85a5b5 --- /dev/null +++ b/scanners/cmseek/parser/__testFiles__/test-empty-report.json.license @@ -0,0 +1,3 @@ +SPDX-FileCopyrightText: 2021 iteratec GmbH + +SPDX-License-Identifier: Apache-2.0 diff --git a/scanners/cmseek/parser/parser.test.js b/scanners/cmseek/parser/parser.test.js index 0821bba4f9..587c9e6923 100644 --- a/scanners/cmseek/parser/parser.test.js +++ b/scanners/cmseek/parser/parser.test.js @@ -50,4 +50,16 @@ test("parser parses result of non-Joomla scan successfully", async () => { const findings = await parse(JSON.parse(fileContent)); await expect(validateParser(findings)).resolves.toBeUndefined(); expect(findings).toMatchSnapshot(); -}); \ No newline at end of file +}); + +test("should properly parse empty cmseek json file", async () => { + const jsonContent = await readFile( + __dirname + "/__testFiles__/test-empty-report.json", + { + encoding: "utf8", + } + ); + const findings = await parse(jsonContent); + await expect(validateParser(findings)).resolves.toBeUndefined(); + expect(findings).toMatchInlineSnapshot(`Array []`); +}); From 2c1b8c986747a5aa90de38e221b1fdc1da3c17be Mon Sep 17 00:00:00 2001 From: Sebastian Franz Date: Fri, 15 Oct 2021 13:19:46 +0200 Subject: [PATCH 15/15] Making all yaml files follow the template Signed-off-by: Sebastian Franz --- scanners/cmseek/Chart.yaml | 21 ++++--------------- .../cmseek/templates/cascading-rules.yaml | 5 ++++- .../templates/cmseek-parse-definition.yaml | 1 - .../cmseek/templates/cmseek-scan-type.yaml | 3 ++- scanners/cmseek/values.yaml | 20 ++++++++++++++---- 5 files changed, 26 insertions(+), 24 deletions(-) diff --git a/scanners/cmseek/Chart.yaml b/scanners/cmseek/Chart.yaml index 02afe32b60..5def923caa 100644 --- a/scanners/cmseek/Chart.yaml +++ b/scanners/cmseek/Chart.yaml @@ -1,40 +1,27 @@ # SPDX-FileCopyrightText: 2021 iteratec GmbH # # SPDX-License-Identifier: Apache-2.0 + apiVersion: v2 name: cmseek description: A Helm chart for the Joomla security scanner that integrates with the secureCodeBox -# A chart can be either an 'application' or a 'library' chart. -# -# Application charts are a collection of templates that can be packaged into versioned archives -# to be deployed. -# -# Library charts provide useful utilities or functions for the chart developer. They're included as -# a dependency of application charts to inject those utilities and functions into the rendering -# pipeline. Library charts do not define any templates and therefore cannot be deployed. type: application # version - gets automatically set to the secureCodeBox release version when the helm charts gets published version: v3.1.0-alpha1 -# This is the version number of the application being deployed. This version number should be -# incremented each time you make changes to the application. Versions are not expected to -# follow Semantic Versioning. They should reflect the version the application is using. -# It is recommended to use it with quotes. appVersion: "1.1.3" kubeVersion: ">=v1.11.0-0" -keywords: + +keywords: - security - cmseek - Joomla - scanner - secureCodeBox - home: https://docs.securecodebox.io/docs/scanners/cmseek icon: https://docs.securecodebox.io/img/integrationIcons/Default.svg - sources: - https://github.com/secureCodeBox/secureCodeBox - maintainers: - name: iteratec GmbH - - email: secureCodeBox@iteratec.com + email: secureCodeBox@iteratec.com diff --git a/scanners/cmseek/templates/cascading-rules.yaml b/scanners/cmseek/templates/cascading-rules.yaml index 2c32ae28d4..97dd683b66 100644 --- a/scanners/cmseek/templates/cascading-rules.yaml +++ b/scanners/cmseek/templates/cascading-rules.yaml @@ -1,12 +1,15 @@ # SPDX-FileCopyrightText: 2021 iteratec GmbH # # SPDX-License-Identifier: Apache-2.0 + # We only want to import the default cascading rules if they are enabled {{ if .Values.cascadingRules.enabled }} +# The CascadingRules are not directly in the /templates directory as their curly bracket syntax clashes with helms templates ... :( +# We import them as raw files to avoid these clashes as escaping them is even more messy {{ range $path, $_ := .Files.Glob "cascading-rules/*" }} # Include File {{ $.Files.Get $path }} # Separate multiple files --- {{ end }} -{{ end }} \ No newline at end of file +{{ end }} diff --git a/scanners/cmseek/templates/cmseek-parse-definition.yaml b/scanners/cmseek/templates/cmseek-parse-definition.yaml index 08f9b9c6fe..183b26cd4d 100644 --- a/scanners/cmseek/templates/cmseek-parse-definition.yaml +++ b/scanners/cmseek/templates/cmseek-parse-definition.yaml @@ -9,7 +9,6 @@ metadata: spec: image: "{{ .Values.parser.image.repository }}:{{ .Values.parser.image.tag | default .Chart.Version }}" imagePullPolicy: {{ .Values.parser.image.pullPolicy }} - ttlSecondsAfterFinished: {{ .Values.parser.ttlSecondsAfterFinished }} env: {{- toYaml .Values.parser.env | nindent 4 }} diff --git a/scanners/cmseek/templates/cmseek-scan-type.yaml b/scanners/cmseek/templates/cmseek-scan-type.yaml index f47014dc1b..3ff244a42f 100644 --- a/scanners/cmseek/templates/cmseek-scan-type.yaml +++ b/scanners/cmseek/templates/cmseek-scan-type.yaml @@ -1,10 +1,11 @@ # SPDX-FileCopyrightText: 2021 iteratec GmbH # # SPDX-License-Identifier: Apache-2.0 + apiVersion: "execution.securecodebox.io/v1" kind: ScanType metadata: - name: "cmseek" + name: "cmseek{{ .Values.scanner.nameAppend | default ""}}" spec: extractResults: type: cmseek-json diff --git a/scanners/cmseek/values.yaml b/scanners/cmseek/values.yaml index 13a7b04f85..aa7bfc0cb9 100644 --- a/scanners/cmseek/values.yaml +++ b/scanners/cmseek/values.yaml @@ -11,6 +11,7 @@ parser: tag: null # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images pullPolicy: IfNotPresent + # parser.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null # parser.env -- Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) @@ -28,12 +29,11 @@ scanner: # scanner.nameAppend -- append a string to the default scantype name. nameAppend: null - # scanner.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ + # -- seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ ttlSecondsAfterFinished: null # -- There are situations where you want to fail a scan Job after some amount of time. To do so, set activeDeadlineSeconds to define an active deadline (in seconds) when considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#job-termination-and-cleanup) activeDeadlineSeconds: null - - # scanner.backoffLimit -- There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) + # -- There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) # @default -- 3 backoffLimit: 3 @@ -60,7 +60,19 @@ scanner: extraContainers: [] # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) - securityContext: {} + securityContext: + # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user + runAsNonRoot: true + # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system + readOnlyRootFilesystem: false + # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated + allowPrivilegeEscalation: false + # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode + privileged: false + capabilities: + drop: + # scanner.securityContext.capabilities.drop[0] -- This drops all linux privileges from the container. + - all cascadingRules: # cascadingRules.enabled -- Enables or disables the installation of the default cascading rules for this scanner