Skip to content
This repository was archived by the owner on Oct 14, 2020. It is now read-only.

Commit a592989

Browse files
J12934J12934
committed
Add empty securityContext to all scanners
These will be extended later to best represent the needs of the individual scanners. Also added `env`, `extraVolumes`, `extraVolumeMounts`, `extraContainers` config values missing in scanner templates.
1 parent 24667a3 commit a592989

33 files changed

+205
-45
lines changed

‎scanners/amass/README.md

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -38,17 +38,17 @@ Special command line options:
3838

3939
## Chart Configuration
4040

41-
| Key | Type | Default | Description |
42-
| ---------------------------------- | ------ | ---------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
43-
| parserImage.repository | string | `"docker.io/securecodebox/parser-amass"` | Parser image repository |
44-
| parserImage.tag | string | defaults to the charts version | Parser image tag |
45-
| scannerJob.env | list | `[]` | Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) |
46-
| scannerJob.extraContainers | list | `[]` | Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) |
47-
| scannerJob.extraVolumeMounts | list | `[]` | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
48-
| scannerJob.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
49-
| scannerJob.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) |
50-
| scannerJob.ttlSecondsAfterFinished | string | `nil` | Defines how long the scanner job after finishing will be available (see: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/) |
41+
| Key | Type | Default | Description |
42+
|-----|------|---------|-------------|
43+
| parserImage.repository | string | `"docker.io/securecodebox/parser-amass"` | Parser image repository |
44+
| parserImage.tag | string | defaults to the charts version | Parser image tag |
45+
| scannerJob.env | list | `[]` | Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) |
46+
| scannerJob.extraContainers | list | `[]` | Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) |
47+
| scannerJob.extraVolumeMounts | list | `[{"mountPath":"/amass/output/config.ini","name":"amass-config","subPath":"config.ini"}]` | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
48+
| scannerJob.extraVolumes | list | `[{"configMap":{"name":"amass-config"},"name":"amass-config"}]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
49+
| scannerJob.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) |
50+
| scannerJob.ttlSecondsAfterFinished | string | `nil` | Defines how long the scanner job after finishing will be available (see: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/) |
5151

5252
[owasp_amass_project]: https://owasp.org/www-project-amass/
5353
[amass github]: https://github.com/OWASP/Amass
54-
[amass user guide]: https://github.com/OWASP/Amass/blob/master/doc/user_guide.md
54+
[amass user guide]: https://github.com/OWASP/Amass/blob/master/doc/user_guide.md

‎scanners/amass/templates/amass-scan-type.yaml

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -24,16 +24,19 @@ spec:
2424
- "enum"
2525
- "-json"
2626
- "/home/securecodebox/amass-results.jsonl"
27-
volumeMounts:
28-
- name: "amass-config"
29-
mountPath: "/amass/output/config.ini"
30-
subPath: "config.ini"
3127
resources:
3228
{{- toYaml .Values.scannerJob.resources | nindent 16 }}
29+
securityContext:
30+
{{- toYaml .Values.scannerJob.securityContext | nindent 16 }}
31+
env:
32+
{{- toYaml .Values.scannerJob.env | nindent 16 }}
33+
volumeMounts:
34+
{{- toYaml .Values.scannerJob.extraVolumeMounts | nindent 16 }}
35+
{{- if .Values.scannerJob.extraContainers }}
36+
{{- toYaml .Values.scannerJob.extraContainers | nindent 12 }}
37+
{{- end }}
3338
volumes:
34-
- name: "amass-config"
35-
configMap:
36-
name: "amass-config"
39+
{{- toYaml .Values.scannerJob.extraVolumeMounts | nindent 12 }}
3740
---
3841
apiVersion: v1
3942
kind: ConfigMap

‎scanners/amass/values.yaml

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,19 @@ scannerJob:
2424
env: []
2525

2626
# scannerJob.extraVolumes -- Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/)
27-
extraVolumes: []
27+
extraVolumes:
28+
- name: "amass-config"
29+
configMap:
30+
name: "amass-config"
2831

2932
# scannerJob.extraVolumeMounts -- Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/)
30-
extraVolumeMounts: []
33+
extraVolumeMounts:
34+
- name: "amass-config"
35+
mountPath: "/amass/output/config.ini"
36+
subPath: "config.ini"
3137

3238
# scannerJob.extraContainers -- Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/)
3339
extraContainers: []
40+
41+
# scannerJob.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
42+
securityContext: {}

‎scanners/kube-hunter/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ The following security scan configuration example are based on the [kube-hunter
4343
| scannerJob.extraVolumeMounts | list | `[]` | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
4444
| scannerJob.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
4545
| scannerJob.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) |
46+
| scannerJob.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) |
4647
| scannerJob.ttlSecondsAfterFinished | string | `nil` | Defines how long the scanner job after finishing will be available (see: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/) |
4748

4849
[kube-hunter Website]: https://kube-hunter.aquasec.com/

‎scanners/kube-hunter/templates/kubehunter-scan-type.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,3 +24,14 @@ spec:
2424
- 'json'
2525
resources:
2626
{{- toYaml .Values.scannerJob.resources | nindent 16 }}
27+
securityContext:
28+
{{- toYaml .Values.scannerJob.securityContext | nindent 16 }}
29+
env:
30+
{{- toYaml .Values.scannerJob.env | nindent 16 }}
31+
volumeMounts:
32+
{{- toYaml .Values.scannerJob.extraVolumeMounts | nindent 16 }}
33+
{{- if .Values.scannerJob.extraContainers }}
34+
{{- toYaml .Values.scannerJob.extraContainers | nindent 12 }}
35+
{{- end }}
36+
volumes:
37+
{{- toYaml .Values.scannerJob.extraVolumes | nindent 12 }}

‎scanners/kube-hunter/values.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,3 +36,6 @@ scannerJob:
3636

3737
# scannerJob.extraContainers -- Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/)
3838
extraContainers: []
39+
40+
# scannerJob.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
41+
securityContext: {}

‎scanners/ncrack/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,7 @@ SEE THE MAN PAGE (http://nmap.org/ncrack/man.html) FOR MORE OPTIONS AND EXAMPLES
151151
| scannerJob.extraVolumeMounts | list | `[]` | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
152152
| scannerJob.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
153153
| scannerJob.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) |
154+
| scannerJob.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) |
154155
| scannerJob.ttlSecondsAfterFinished | string | `nil` | Defines how long the scanner job after finishing will be available (see: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/) |
155156

156157
---

‎scanners/ncrack/templates/ncrack-scan-type.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,15 @@ spec:
2121
command: ["ncrack", "-oX", "/home/securecodebox/ncrack-results.xml"]
2222
resources:
2323
{{- toYaml .Values.scannerJob.resources | nindent 16 }}
24+
securityContext:
25+
{{- toYaml .Values.scannerJob.securityContext | nindent 16 }}
26+
env:
27+
{{- toYaml .Values.scannerJob.env | nindent 16 }}
2428
volumeMounts:
2529
{{- toYaml .Values.scannerJob.extraVolumeMounts | nindent 16 }}
30+
{{- if .Values.scannerJob.extraContainers }}
31+
{{- toYaml .Values.scannerJob.extraContainers | nindent 12 }}
32+
{{- end }}
2633
volumes:
2734
{{- toYaml .Values.scannerJob.extraVolumes | nindent 12 }}
2835

‎scanners/ncrack/values.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,3 +36,6 @@ scannerJob:
3636

3737
# scannerJob.extraContainers -- Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/)
3838
extraContainers: []
39+
40+
# scannerJob.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
41+
securityContext: {}

‎scanners/nikto/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@ Nikto also has a comprehensive list of [command line options documented](https:/
6060
| scannerJob.extraVolumeMounts | list | `[]` | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
6161
| scannerJob.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
6262
| scannerJob.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) |
63+
| scannerJob.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) |
6364
| scannerJob.ttlSecondsAfterFinished | string | `nil` | Defines how long the scanner job after finishing will be available (see: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/) |
6465

6566
[cirt.net]: https://cirt.net/

0 commit comments

Comments
 (0)