secureCodeBox · J12934 · Jul 12, 2021 · May 31, 2021 · May 31, 2021 · May 31, 2021
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -182,6 +182,58 @@ jobs:
           repository: ${{ env.DOCKER_NAMESPACE }}/${{ matrix.component }}
           readme-filepath: ./${{ matrix.component }}/docs/README.DockerHub-Core.md
 
+  # ---- Build Stage | AutoDiscovery ----
+
+  auto-discovery-kubernetes:
+    name: "AutoDiscovery | Kubernetes"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Go Setup
+        uses: actions/setup-go@v2
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - name: Lint Go Code
+        working-directory: ./auto-discovery/kubernetes
+        run: |
+          go fmt ./...
+          go vet ./...
+
+      - name: Test
+        working-directory: ./auto-discovery/kubernetes/
+        run: make test
+
+      - name: Docker Meta
+        id: docker_meta
+        uses: crazy-max/ghaction-docker-meta@v1
+        with:
+          images: ${{ env.DOCKER_NAMESPACE }}/auto-discovery-kubernetes
+          tag-sha: true
+          tag-semver: |
+            {{ version }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+
+      - name: Login to DockerHub
+        uses: docker/login-action@v1
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+
+      - name: Build and Push
+        uses: docker/build-push-action@v2
+        with:
+          context: ./auto-discovery/kubernetes/
+          file: ./auto-discovery/kubernetes/Dockerfile
+          platforms: linux/amd64
+          push: true
+          tags: ${{ steps.docker_meta.outputs.tags }}
+          labels: ${{ steps.docker_meta.outputs.labels }}
+
   # ---- Build Stage | SDK Matrix ----
 
   sdk:

diff --git a/.github/workflows/helm-docs.yaml b/.github/workflows/helm-docs.yaml
@@ -30,14 +30,19 @@ jobs:
           cd helm-docs
 
           curl --output helm-docs.tar.gz --location https://github.com/norwoodj/helm-docs/releases/download/v1.5.0/helm-docs_1.5.0_Linux_x86_64.tar.gz
+          # Checksum must be extracted from the checksum file every time helm-docs gets updated.
+          echo "a352e13a8438045b8ed138b821cb757c177acd999c1af77345152d7a64b0ddb7  helm-docs.tar.gz" | shasum --check
+
           tar -xvf helm-docs.tar.gz
           # Verify installation
           ./helm-docs --version
 
+          sudo mv helm-docs /usr/local/bin/helm-docs
+
       - name: Generate Helm Docs
         run: |
           # Generate README.md based on Chart.yaml and template
-          ./helm-docs/helm-docs --template-files=./.helm-docs/templates.gotmpl --template-files=.helm-docs.gotmpl --template-files=./.helm-docs/README.md.gotmpl
+          helm-docs --template-files=./.helm-docs/templates.gotmpl --template-files=.helm-docs.gotmpl --template-files=./.helm-docs/README.md.gotmpl
 
       - name: Generate Demo-Apps Docs
         run: |
@@ -51,8 +56,8 @@ jobs:
             cd "${dir}" || exit
             if [ -d "docs" ]; then
               echo "Docs Folder found at: ${dir}/docs"
-              ./../../helm-docs/helm-docs --template-files=./../../.helm-docs/templates.gotmpl --template-files=.helm-docs.gotmpl --template-files=./../../.helm-docs/README.DockerHub-Target.md.gotmpl --output-file=docs/README.DockerHub-Target.md
-              ./../../helm-docs/helm-docs --template-files=./../../.helm-docs/templates.gotmpl --template-files=.helm-docs.gotmpl --template-files=./../../.helm-docs/README.ArtifactHub.md.gotmpl --output-file=docs/README.ArtifactHub.md
+              helm-docs --template-files=./../../.helm-docs/templates.gotmpl --template-files=.helm-docs.gotmpl --template-files=./../../.helm-docs/README.DockerHub-Target.md.gotmpl --output-file=docs/README.DockerHub-Target.md
+              helm-docs --template-files=./../../.helm-docs/templates.gotmpl --template-files=.helm-docs.gotmpl --template-files=./../../.helm-docs/README.ArtifactHub.md.gotmpl --output-file=docs/README.ArtifactHub.md
             else
               echo "Ignoring Docs creation process for Chart $dir, because no `docs` folder found at: ${dir}/docs"
             fi
@@ -71,8 +76,8 @@ jobs:
             cd "${dir}" || exit
             if [ -d "docs" ]; then
               echo "Docs Folder found at: ${dir}/docs"
-              ./../../helm-docs/helm-docs --template-files=./../../.helm-docs/templates.gotmpl --template-files=.helm-docs.gotmpl --template-files=./../../.helm-docs/README.DockerHub-Hook.md.gotmpl --output-file=docs/README.DockerHub-Hook.md
-              ./../../helm-docs/helm-docs --template-files=./../../.helm-docs/templates.gotmpl --template-files=.helm-docs.gotmpl --template-files=./../../.helm-docs/README.ArtifactHub.md.gotmpl --output-file=docs/README.ArtifactHub.md
+              helm-docs --template-files=./../../.helm-docs/templates.gotmpl --template-files=.helm-docs.gotmpl --template-files=./../../.helm-docs/README.DockerHub-Hook.md.gotmpl --output-file=docs/README.DockerHub-Hook.md
+              helm-docs --template-files=./../../.helm-docs/templates.gotmpl --template-files=.helm-docs.gotmpl --template-files=./../../.helm-docs/README.ArtifactHub.md.gotmpl --output-file=docs/README.ArtifactHub.md
             else
               echo "Ignoring Docs creation process for Chart $dir, because no `docs` folder found at: ${dir}/docs"
             fi
@@ -93,35 +98,46 @@ jobs:
               echo "Docs Folder found at: ${dir}/docs"
               if [ -d "parser" ]; then
                 echo "Parser found at: ${dir}/parser"
-                ./../../helm-docs/helm-docs --template-files=./../../.helm-docs/templates.gotmpl --template-files=.helm-docs.gotmpl --template-files=./../../.helm-docs/README.DockerHub-Parser.md.gotmpl --output-file=docs/README.DockerHub-Parser.md
+                helm-docs --template-files=./../../.helm-docs/templates.gotmpl --template-files=.helm-docs.gotmpl --template-files=./../../.helm-docs/README.DockerHub-Parser.md.gotmpl --output-file=docs/README.DockerHub-Parser.md
               fi
               if [ -d "scanner" ]; then
                 echo "Scanner found at: ${dir}/parser"
-                ./../../helm-docs/helm-docs --template-files=./../../.helm-docs/templates.gotmpl --template-files=.helm-docs.gotmpl --template-files=./../../.helm-docs/README.DockerHub-Scanner.md.gotmpl --output-file=docs/README.DockerHub-Scanner.md
+                helm-docs --template-files=./../../.helm-docs/templates.gotmpl --template-files=.helm-docs.gotmpl --template-files=./../../.helm-docs/README.DockerHub-Scanner.md.gotmpl --output-file=docs/README.DockerHub-Scanner.md
               fi
-              ./../../helm-docs/helm-docs --template-files=./../../.helm-docs/templates.gotmpl --template-files=.helm-docs.gotmpl --template-files=./../../.helm-docs/README.ArtifactHub.md.gotmpl --output-file=docs/README.ArtifactHub.md
+              helm-docs --template-files=./../../.helm-docs/templates.gotmpl --template-files=.helm-docs.gotmpl --template-files=./../../.helm-docs/README.ArtifactHub.md.gotmpl --output-file=docs/README.ArtifactHub.md
             else
               echo "Ignoring Docs creation process for Chart $dir, because no `docs` folder found at: ${dir}/docs"
             fi
           )
           done
 
-      - name: Generate Core Docs
+      - name: Generate Core (Operator) Docs
         run: |
           # Start in the operator folder
           cd operator
           if [ -d "docs" ]; then
             echo "Docs Folder found at: operator/docs"
-            ./../helm-docs/helm-docs --template-files=./../.helm-docs/templates.gotmpl --template-files=.helm-docs.gotmpl --template-files=./../.helm-docs/README.DockerHub-Core.md.gotmpl --output-file=docs/README.DockerHub-Core.md
-            ./../helm-docs/helm-docs --template-files=./../.helm-docs/templates.gotmpl --template-files=.helm-docs.gotmpl --template-files=./../.helm-docs/README.ArtifactHub.md.gotmpl --output-file=docs/README.ArtifactHub.md
+            helm-docs --template-files=./../.helm-docs/templates.gotmpl --template-files=.helm-docs.gotmpl --template-files=./../.helm-docs/README.DockerHub-Core.md.gotmpl --output-file=docs/README.DockerHub-Core.md
+            helm-docs --template-files=./../.helm-docs/templates.gotmpl --template-files=.helm-docs.gotmpl --template-files=./../.helm-docs/README.ArtifactHub.md.gotmpl --output-file=docs/README.ArtifactHub.md
           else
             echo "Ignoring Docs creation process for Chart $dir, because no `docs` folder found at: operator/docs"
           fi
+      - name: Generate Core (AutoDiscovery Kubernetes) Docs
+        run: |
+          cd auto-discovery/kubernetes
+          if [ -d "docs" ]; then
+            echo "Docs Folder found at: auto-discovery/kubernetes/docs"
+            helm-docs --template-files=./../../.helm-docs/templates.gotmpl --template-files=.helm-docs.gotmpl --template-files=./../../.helm-docs/README.DockerHub-Core.md.gotmpl --output-file=docs/README.DockerHub-Core.md
+            helm-docs --template-files=./../../.helm-docs/templates.gotmpl --template-files=.helm-docs.gotmpl --template-files=./../../.helm-docs/README.ArtifactHub.md.gotmpl --output-file=docs/README.ArtifactHub.md
+          else
+            echo "Ignoring Docs creation process for Chart $dir, because no `docs` folder found at: auto-discovery/kubernetes/docs"
+          fi
 
       - name: Remove Helm Docs Files
         run: |
-          # Remove helm-docs download to ensure they don't get commited back
+          # Remove helm-docs download to ensure they don't get committed back
           rm -rf helm-docs
+
       - uses: stefanzweifel/git-auto-commit-action@v4.11.0
         with:
           commit_message: Updating Helm Docs

diff --git a/.helm-docs/README.DockerHub-Core.md.gotmpl b/.helm-docs/README.DockerHub-Core.md.gotmpl
@@ -12,7 +12,7 @@ SPDX-License-Identifier: Apache-2.0
 {{ template "extra.dockerDeploymentSection" . }}
 
 ## How to use this image
-This `core` image is intended to work in combination with the OWASP secureCodeBox. For more informations details please take a look at the documentation page: {{ template "chart.homepage" . }}.
+This `core` image is intended to work in combination with the OWASP secureCodeBox. For more information details please take a look at the documentation page: {{ template "chart.homepage" . }}.
 
 ```bash
 docker pull securecodebox/{{ template "chart.name" . }}

diff --git a/.helm-docs/README.DockerHub-Hook.md.gotmpl b/.helm-docs/README.DockerHub-Hook.md.gotmpl
@@ -12,7 +12,7 @@ SPDX-License-Identifier: Apache-2.0
 {{ template "extra.dockerDeploymentSection" . }}
 
 ## How to use this image
-This `hook` image is intended to work in combination with other `parser` images to read or manipulate `findings` results. For more informations details please take a look at the [project page][scb-docs] or [documentation page][{{ template "chart.homepage" . }}].
+This `hook` image is intended to work in combination with other `parser` images to read or manipulate `findings` results. For more information details please take a look at the [project page][scb-docs] or [documentation page][{{ template "chart.homepage" . }}].
 
 ```bash
 docker pull securecodebox/hook-{{ template "chart.name" . }}

diff --git a/.helm-docs/README.DockerHub-Parser.md.gotmpl b/.helm-docs/README.DockerHub-Parser.md.gotmpl
@@ -12,7 +12,7 @@ SPDX-License-Identifier: Apache-2.0
 {{ template "extra.dockerDeploymentSection" . }}
 
 ## How to use this image
-This `parser` image is intended to work in combination with the corresponding security scanner docker image to parse the `findings` results. For more informations details please take a look at the documentation page: {{ template "chart.homepage" . }}.
+This `parser` image is intended to work in combination with the corresponding security scanner docker image to parse the `findings` results. For more information details please take a look at the documentation page: {{ template "chart.homepage" . }}.
 
 ```bash
 docker pull securecodebox/parser-{{ template "chart.name" . }}

diff --git a/.helm-docs/README.DockerHub-Scanner.md.gotmpl b/.helm-docs/README.DockerHub-Scanner.md.gotmpl
@@ -12,7 +12,7 @@ SPDX-License-Identifier: Apache-2.0
 {{ template "extra.dockerDeploymentSection" . }}
 
 ## How to use this image
-This `scanner` image is intended to work in combination with the corresponding `parser` image to parse the scanner `findings` to generic secureCodeBox results. For more informations details please take a look at the [project page][scb-docs] or [documentation page][{{ template "chart.homepage" . }}].
+This `scanner` image is intended to work in combination with the corresponding `parser` image to parse the scanner `findings` to generic secureCodeBox results. For more information details please take a look at the [project page][scb-docs] or [documentation page][{{ template "chart.homepage" . }}].
 
 ```bash
 docker pull securecodebox/scanner-{{ template "chart.name" . }}

diff --git a/.helm-docs/README.DockerHub-Target.md.gotmpl b/.helm-docs/README.DockerHub-Target.md.gotmpl
@@ -12,7 +12,7 @@ SPDX-License-Identifier: Apache-2.0
 {{ template "extra.dockerDeploymentSection" . }}
 
 ## How to use this image
-This image is an potentialy vulnerable service or application which is used for demo purposes, automated tests and trainings.
+This image is a potentially vulnerable service or application which is used for demo purposes, automated tests and trainings.
 
 ```bash
 docker pull securecodebox/{{ template "chart.name" . }}

diff --git a/.helm-docs/templates.gotmpl b/.helm-docs/templates.gotmpl
@@ -18,12 +18,12 @@ SPDX-License-Identifier: Apache-2.0
 <!-- 
 .: IMPORTANT! :.
 --------------------------
-This file is generated automaticaly with `helm-docs` based on the following template files:
+This file is generated automatically with `helm-docs` based on the following template files:
 - ./.helm-docs/templates.gotmpl (general template data for all charts)
 - ./chart-folder/.helm-docs.gotmpl (chart specific template data)
 
 Please be aware of that and apply your changes only within those template files instead of this file. 
-Otherwise your changes will be reverted/overriden automaticaly due to the build process `./.github/workflows/helm-docs.yaml`
+Otherwise your changes will be reverted/overwritten automatically due to the build process `./.github/workflows/helm-docs.yaml`
 --------------------------
 -->
 {{- end }}
@@ -49,7 +49,7 @@ You can find resources to help you get started on our [documentation website](ht
 
 {{- define "extra.chartDeploymentSection" -}}
 ## Deployment
-The {{ template "chart.name" . }} `scanType` can be deployed via helm:
+The {{ template "chart.name" . }} chart can be deployed via helm:
 
 ```bash
 # Install HelmChart (use -n to configure another namespace)

diff --git a/auto-discovery/kubernetes/.dockerignore b/auto-discovery/kubernetes/.dockerignore
@@ -0,0 +1,10 @@
+# SPDX-FileCopyrightText: 2021 iteratec GmbH
+#
+# SPDX-License-Identifier: Apache-2.0
+
+# More info: https://docs.docker.com/engine/reference/builder/#dockerignore-file
+# Ignore all files which are not go type
+!**/*.go
+!**/*.mod
+!**/*.sum
+auto-discovery-config.yaml
diff --git a/auto-discovery/kubernetes/.gitignore b/auto-discovery/kubernetes/.gitignore
@@ -0,0 +1,28 @@
+# SPDX-FileCopyrightText: 2021 iteratec GmbH
+#
+# SPDX-License-Identifier: Apache-2.0
+
+# Binaries for programs and plugins
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+bin
+testbin/*
+
+# Test binary, build with `go test -c`
+*.test
+
+# Output of the go coverage tool, specifically when used with LiteIDE
+*.out
+
+# Kubernetes Generated files - skip generated files, except for vendored files
+
+!vendor/**/zz_generated.*
+
+# editor and IDE paraphernalia
+.idea
+*.swp
+*.swo
+*~
diff --git a/auto-discovery/kubernetes/.helm-docs.gotmpl b/auto-discovery/kubernetes/.helm-docs.gotmpl
@@ -0,0 +1,131 @@
+{{- /*
+SPDX-FileCopyrightText: 2020 iteratec GmbH
+
+SPDX-License-Identifier: Apache-2.0
+*/ -}}
+
+{{- define "extra.docsSection" -}}
+---
+title: "secreCodeBox AutoDiscovery for Kubernetes"
+category: "core"
+type: "AutoDiscovery"
+state: "released"
+appVersion: "{{ template "chart.appVersion" . }}"
+usecase: "secureCodeBox AutoDiscovery for Kubernetes discovers and starts scans for apps running in the cluster."
+---
+
+![auto-discovery logo](https://docs.securecodebox.io/img/Logo_Color.svg)
+
+The secureCodeBox _AutoDiscovery_ is running on kubernetes (K8S) and is an optional component of the complete secureCodeBox stack.
+The Kubernetes AutoDiscovery needs to be deployed along side the secureCodeBox Operator. It monitors security relevant resources inside a K8S environment and automatically create scans to continuously monitor security aspects of the resources.
+
+<!-- end -->
+
+The AutoDiscovery controller will automatically detect these new resources (services) and start secureCodeBox _scans_ for them:
+
+1. A ZAP Baseline Scan to detect basic web vulnerabilities in the service. (Using OWASP ZAP)
+2. (WIP) A image scan scanning for vulnerable libraries in the docker / container image of the deployment. (Using trivy)
+3. (WIP) A TLS Scan against the certificate of the ingress for the host. (Using SSLyze)
+
+The AutoDiscovery automatically tracks the lifecycle of the kubernetes resources and will automatically start new scans for new application versions.
+{{- end }}
+
+{{- define "extra.dockerDeploymentSection" -}}
+{{- end }}
+
+{{- define "extra.chartAboutSection" -}}
+## Example
+
+<p align="center">
+  <img width="950" src="./auto-discovery-demo.svg" alt="AutoDiscovery CLI Example">
+</p>
+
+This example deploys [JuiceShop](https://owasp.org/www-project-juice-shop/) to a new Kubernetes Namespace.
+(You can find the kubernetes manifests for the deployment [here](./demo/juice-shop.yaml))
+
+The AutoDiscovery will automatically pick up this new deployment and then starts a OWASP ZAP Scan against it.
+The scan created uses our `zap-advanced` ScanType by default, this can be changed with the `config.serviceAutoDiscovery.scanConfig.scanType` config on the autoDiscovery helm release.
+{{- end }}
+
+{{- define "extra.scannerConfigurationSection" -}}
+{{- end }}
+
+{{- define "extra.chartConfigurationSection" -}}
+### In / Excluding Resources from the AutoDiscovery
+
+The AutoDiscovery allows different modes to determine if a resource is supposed to be scanned.
+These modes allow you to gradually roll out the AutoDiscovery in a cluster.
+This allows to roll it out in cluster without a "big bang" where the AutoDiscovery starts a scan for every app in the cluster which would likely exhaust the clusters compute resources.
+
+The three different modes are:
+
+1. `enabled-per-namespace` (default): [See section](#enabled-per-namespace-mode-default)
+2. `enabled-per-resource`: [See section](#enabled-per-resource-mode)
+3. `scan-all`: [See section](#scan-all-mode)
+
+#### Enabled per Namespace Mode (default)
+
+Enable this by setting `config.resourceInclusion.mode=enable-per-namespace`.
+
+This mode will start scans for resources in namespaces with the annotation `auto-discovery.securecodebox.io/enabled=true`.
+
+```bash
+# enable AutoDiscovery in namespace "juice-shop"
+kubectl annotate namespace juice-shop auto-discovery.securecodebox.io/enabled=true
+```
+
+If you want to exclude a certain resource in a otherwise AutoDiscovery enabled namespace, you can exclude it by annotating it with `auto-discovery.securecodebox.io/ignore=true`.
+
+```bash
+# disable AutoDiscovery for service "foobar"
+kubectl -n juice-shop annotate service foobar auto-discovery.securecodebox.io/ignore=true
+```
+
+#### Enabled per Resource Mode
+
+Enable this by setting `config.resourceInclusion.mode=enabled-per-resource`.
+
+This mode will start scans for every resources with the annotation `auto-discovery.securecodebox.io/enabled=true`.
+
+```bash
+# enable AutoDiscovery for service "juice-shop"
+kubectl -n juice-shop annotate service juice-shop auto-discovery.securecodebox.io/enabled=true
+```
+
+#### Scan All Mode
+
+Enable this by setting `config.resourceInclusion.mode=scan-all`.
+
+This mode will start scans for **every** resources in the cluster **unless** it has the annotation `auto-discovery.securecodebox.io/ignore=true`.
+
+> ⚠️ Using this setting in larger cluster will likely start a large number of scans in the cluster. This could block all available compute resource in your cluster and seriously affect your applications availability.
+
+```bash
+# *disable* AutoDiscovery for service "juice-shop"
+kubectl -n juice-shop annotate service juice-shop auto-discovery.securecodebox.io/ignore=true
+```
+
+{{- end }}
+
+{{- define "extra.scannerLinksSection" -}}
+## Development
+
+### Run the AutoDiscovery locally
+
+To avoid having to build & deploy the AutoDiscovery every time you make a code change you can run it locally.
+It automatically connects to your current cluster configured in your kube config.
+
+```bash
+make run
+```
+
+### Running the tests
+
+```bash
+# execute the tests locally
+make test
+
+# view the test coverage
+go tool cover -html=cover.out
+```
+{{- end }}