Skip to content

Refactor hook HelmCharts to introduce consistency in HelmChart Values #484

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
J12934 merged 11 commits into from
Jun 18, 2021
Merged

Refactor hook HelmCharts to introduce consistency in HelmChart Values #484

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
22b1393
Cascading Scans: refactor values according to new spec
EndPositive Jun 10, 2021
f5ecccf
Post-processing: refactor values according to new spec
EndPositive Jun 10, 2021
861f59b
Generic: refactor values according to new spec
EndPositive Jun 10, 2021
372b5e9
Notification: refactor values according to new spec
EndPositive Jun 10, 2021
d6d4e94
Defectdojo persistence: refactor values according to new spec
EndPositive Jun 10, 2021
8a70280
Elastic persistence: refactor values according to new spec
EndPositive Jun 10, 2021
e59c661
Teams notification: refactor values according to new spec & add chart…
EndPositive Jun 10, 2021
0cc34c0
Update field: refactor values according to new spec
EndPositive Jun 10, 2021
30d2396
CI: refactor hook values according to new spec
EndPositive Jun 10, 2021
ad6aba5
CI: update __testFiles__ hook values according to new spec
EndPositive Jun 10, 2021
ec2756f
Merge branch 'v3' into maintanance/helmchart-values-consistency-hooks
J12934 Jun 18, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 12 additions & 12 deletions .github/workflows/ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -613,13 +613,13 @@ jobs:
- name: "Hooks (ReadAndWrite) Integration Tests"
run: |
helm -n integration-tests install update-category ./hooks/update-field/ \
--set="image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/hook-update-field" \
--set="image.tag=sha-$(git rev-parse --short HEAD)" \
--set="hook.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/hook-update-field" \
--set="hook.image.tag=sha-$(git rev-parse --short HEAD)" \
--set="attribute.name=category" \
--set="attribute.value=fancy-category"
helm -n integration-tests install update-severity ./hooks/update-field/ \
--set="image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/hook-update-field" \
--set="image.tag=sha-$(git rev-parse --short HEAD)" \
--set="hook.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/hook-update-field" \
--set="hook.image.tag=sha-$(git rev-parse --short HEAD)" \
--set="attribute.name=severity" \
--set="attribute.value=high"
helm -n integration-tests install test-scan ./scanners/test-scan/ \
Expand All @@ -642,9 +642,9 @@ jobs:
--set="scanner.image.tag=sha-$(git rev-parse --short HEAD)"
helm -n integration-tests install http-webhook ./demo-apps/http-webhook
helm -n integration-tests install ro-hook ./hooks/generic-webhook/ \
--set="image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/hook-generic-webhook" \
--set="hook.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/hook-generic-webhook" \
--set="webhookUrl=http://http-webhook/hallo-welt" \
--set="image.tag=sha-$(git rev-parse --short HEAD)"
--set="hook.image.tag=sha-$(git rev-parse --short HEAD)"
cd tests/integration/
npx jest --ci --color generic/read-only-hook.test.js
helm -n integration-tests uninstall test-scan http-webhook ro-hook
Expand Down Expand Up @@ -772,8 +772,8 @@ jobs:
helm -n integration-tests install http-webhook ./demo-apps/http-webhook --wait

helm -n integration-tests install notification-hook ./hooks/notification --values tests/integration/hooks/__testFiles__/notification-values.yaml \
--set="image.repository=docker.io/${{env.DOCKER_NAMESPACE }}/hook-notification" \
--set="image.tag=sha-$(git rev-parse --short HEAD)"
--set="hook.image.repository=docker.io/${{env.DOCKER_NAMESPACE }}/hook-notification" \
--set="hook.image.tag=sha-$(git rev-parse --short HEAD)"

cd tests/integration/
npx jest --ci --color ./hooks/notification.test.js
Expand Down Expand Up @@ -848,8 +848,8 @@ jobs:
kubectl create namespace cascading-tests
# Install cascading-scans hook
helm upgrade --install dssh ./hooks/cascading-scans/ -n cascading-tests \
--set="image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/hook-cascading-scans" \
--set="image.tag=sha-$(git rev-parse --short HEAD)"
--set="hook.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/hook-cascading-scans" \
--set="hook.image.tag=sha-$(git rev-parse --short HEAD)"
# Install nmap
helm -n cascading-tests install nmap ./scanners/nmap/ \
--set="scanner.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/scanner-nmap" \
Expand Down Expand Up @@ -891,8 +891,8 @@ jobs:
kubectl create namespace cascading-tests
# Install cascading-scans hook
helm upgrade --install dssh ./hooks/cascading-scans/ -n cascading-tests --wait \
--set="image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/hook-cascading-scans" \
--set="image.tag=sha-$(git rev-parse --short HEAD)"
--set="hook.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/hook-cascading-scans" \
--set="hook.image.tag=sha-$(git rev-parse --short HEAD)"
# Install unsafe-https
helm upgrade --install unsafe-https ./demo-apps/unsafe-https/ -n cascading-tests --wait
# Install nmap
Expand Down
6 changes: 3 additions & 3 deletions hooks/cascading-scans/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,6 +119,6 @@ zap-http zap-baseline-scan non-invasive medium

| Key | Type | Default | Description |
|-----|------|---------|-------------|
| hookJob.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
| image.repository | string | `"docker.io/securecodebox/hook-cascading-scans"` | Hook image repository |
| image.tag | string | defaults to the charts version | The image Tag defaults to the charts version if not defined. |
| hook.image.repository | string | `"docker.io/securecodebox/hook-cascading-scans"` | Hook image repository |
| hook.image.tag | string | defaults to the charts version | The image Tag defaults to the charts version if not defined. |
| hook.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
4 changes: 2 additions & 2 deletions hooks/cascading-scans/templates/cascading-scans-hook.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,8 +10,8 @@ metadata:
{{- include "cascading-scans.labels" . | nindent 4 }}
spec:
type: ReadOnly
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.Version }}"
image: "{{ .Values.hook.image.repository }}:{{ .Values.hook.image.tag | default .Chart.Version }}"
imagePullSecrets:
- name: "securecodebox"
ttlSecondsAfterFinished: {{ .Values.hookJob.ttlSecondsAfterFinished }}
ttlSecondsAfterFinished: {{ .Values.hook.ttlSecondsAfterFinished }}
serviceAccountName: cascading-scans
16 changes: 8 additions & 8 deletions hooks/cascading-scans/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,13 +6,13 @@
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

image:
# image.repository -- Hook image repository
repository: docker.io/securecodebox/hook-cascading-scans
# image.tag -- The image Tag defaults to the charts version if not defined.
# @default -- defaults to the charts version
tag: null
hook:
image:
# hook.image.repository -- Hook image repository
repository: docker.io/securecodebox/hook-cascading-scans
# hook.image.tag -- The image Tag defaults to the charts version if not defined.
# @default -- defaults to the charts version
tag: null

hookJob:
# hookJob.ttlSecondsAfterFinished -- Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/
# hook.ttlSecondsAfterFinished -- Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/
ttlSecondsAfterFinished: null
6 changes: 3 additions & 3 deletions hooks/finding-post-processing/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@ The `override` field specifies the desired fields and values that need to be upd

| Key | Type | Default | Description |
|-----|------|---------|-------------|
| hookJob.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
| image.repository | string | `"docker.io/securecodebox/hook-finding-post-processing"` | Hook image repository |
| image.tag | string | defaults to the charts version | The image Tag defaults to the charts version if not defined. |
| hook.image.repository | string | `"docker.io/securecodebox/hook-finding-post-processing"` | Hook image repository |
| hook.image.tag | string | defaults to the charts version | The image Tag defaults to the charts version if not defined. |
| hook.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
| rules | list | `[]` | |
2 changes: 1 addition & 1 deletion hooks/finding-post-processing/templates/finding-post-processing-hook.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ metadata:
{{- include "finding-post-processing.labels" . | nindent 4 }}
spec:
type: ReadAndWrite
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.Version }}"
image: "{{ .Values.hook.image.repository }}:{{ .Values.hook.image.tag | default .Chart.Version }}"
env:
- name: RULES
value: {{ .Values.rules | toJson | quote }}
21 changes: 11 additions & 10 deletions hooks/finding-post-processing/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,14 +6,8 @@
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

image:
# image.repository -- Hook image repository
repository: docker.io/securecodebox/hook-finding-post-processing
# image.tag -- The image Tag defaults to the charts version if not defined.
# @default -- defaults to the charts version
tag: null

rules: []
rules:
[]
#- matches:
# anyOf:
# - category: "Open Port"
Expand All @@ -28,6 +22,13 @@ rules: []
# severity: "high"
# description: "Telnet is bad"

hookJob:
# hookJob.ttlSecondsAfterFinished -- Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/
hook:
image:
# hook.image.repository -- Hook image repository
repository: docker.io/securecodebox/hook-finding-post-processing
# hook.image.tag -- The image Tag defaults to the charts version if not defined.
# @default -- defaults to the charts version
tag: null

# hook.ttlSecondsAfterFinished -- Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/
ttlSecondsAfterFinished: null
6 changes: 3 additions & 3 deletions hooks/generic-webhook/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ helm upgrade --install gwh secureCodeBox/generic-webhook --set webhookUrl="http:

| Key | Type | Default | Description |
|-----|------|---------|-------------|
| hookJob.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
| image.repository | string | `"docker.io/securecodebox/hook-generic-webhook"` | Hook image repository |
| image.tag | string | defaults to the charts version | The image Tag defaults to the charts version if not defined. |
| hook.image.repository | string | `"docker.io/securecodebox/hook-generic-webhook"` | Hook image repository |
| hook.image.tag | string | defaults to the charts version | The image Tag defaults to the charts version if not defined. |
| hook.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
| webhookUrl | string | `"http://example.com"` | The URL of your WebHook endpoint |
4 changes: 2 additions & 2 deletions hooks/generic-webhook/templates/webhook-hook.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,8 +10,8 @@ metadata:
{{- include "generic-webhook.labels" . | nindent 4 }}
spec:
type: ReadOnly
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.Version }}"
ttlSecondsAfterFinished: {{ .Values.hookJob.ttlSecondsAfterFinished }}
image: "{{ .Values.hook.image.repository }}:{{ .Values.hook.image.tag | default .Chart.Version }}"
ttlSecondsAfterFinished: {{ .Values.hook.ttlSecondsAfterFinished }}
env:
- name: WEBHOOK_URL
value: {{ .Values.webhookUrl | quote }}
16 changes: 8 additions & 8 deletions hooks/generic-webhook/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,13 +9,13 @@
# webhookUrl -- The URL of your WebHook endpoint
webhookUrl: "http://example.com"

image:
# image.repository -- Hook image repository
repository: docker.io/securecodebox/hook-generic-webhook
# image.tag -- The image Tag defaults to the charts version if not defined.
# @default -- defaults to the charts version
tag: null
hook:
image:
# hook.image.repository -- Hook image repository
repository: docker.io/securecodebox/hook-generic-webhook
# hook.image.tag -- The image Tag defaults to the charts version if not defined.
# @default -- defaults to the charts version
tag: null

hookJob:
# hookJob.ttlSecondsAfterFinished -- Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/
# hook.ttlSecondsAfterFinished -- Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/
ttlSecondsAfterFinished: null
8 changes: 4 additions & 4 deletions hooks/notification/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -221,10 +221,10 @@ To fill your template with data we provide the following objects.
| env[1].name | string | `"SMTP_CONFIG"` | |
| env[1].valueFrom.secretKeyRef.key | string | `"smtp-config-key"` | |
| env[1].valueFrom.secretKeyRef.name | string | `"some-secret"` | |
| hookJob.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
| image.pullPolicy | string | `"Always"` | |
| image.repository | string | `"docker.io/securecodebox/hook-notification"` | Hook image repository |
| image.tag | string | defaults to the charts version | Image tag |
| hook.image.pullPolicy | string | `"Always"` | |
| hook.image.repository | string | `"docker.io/securecodebox/hook-notification"` | Hook image repository |
| hook.image.tag | string | defaults to the charts version | Image tag |
| hook.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
| notificationChannels[0].endPoint | string | `"SOME_ENV_KEY"` | |
| notificationChannels[0].name | string | `"slack"` | |
| notificationChannels[0].rules[0].matches.anyOf[0].category | string | `"Open Port"` | |
Expand Down
6 changes: 3 additions & 3 deletions hooks/notification/templates/notification-hook.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,9 @@ metadata:
name: {{ include "notification-hook.fullname" . }}
spec:
type: ReadOnly
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.Version }}"
ttlSecondsAfterFinished: {{ .Values.hookJob.ttlSecondsAfterFinished }}
imagePullPolicy: "{{ .Values.hook.image.pullPolicy }}"
image: "{{ .Values.hook.image.repository }}:{{ .Values.hook.image.tag | default .Chart.Version }}"
ttlSecondsAfterFinished: {{ .Values.hook.ttlSecondsAfterFinished }}
volumes:
- name: {{ .Release.Name }}-config
configMap:
Expand Down
18 changes: 9 additions & 9 deletions hooks/notification/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,16 +6,16 @@
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

image:
# image.repository -- Hook image repository
repository: docker.io/securecodebox/hook-notification
# image.tag -- Image tag
# @default -- defaults to the charts version
tag: null
pullPolicy: Always
hook:
image:
# hook.image.repository -- Hook image repository
repository: docker.io/securecodebox/hook-notification
# hook.image.tag -- Image tag
# @default -- defaults to the charts version
tag: null
pullPolicy: Always

hookJob:
# hookJob.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/
# hook.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/
ttlSecondsAfterFinished: null

notificationChannels:
Expand Down
6 changes: 3 additions & 3 deletions hooks/persistence-defectdojo/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,6 +133,6 @@ helm upgrade --install dd secureCodeBox/persistence-defectdojo \
| defectdojo.authentication.usernameKey | string | `"username"` | Name of the username key in the `userSecret` secret. Use this if you already have a secret with different key / value pairs |
| defectdojo.syncFindingsBack | bool | `true` | Syncs back (two way sync) all imported findings from DefectDojo to SCB Findings Store, set to false to only import the findings to DefectDojo (one way sync). |
| defectdojo.url | string | `"http://defectdojo-django.default.svc"` | Url to the DefectDojo Instance |
| image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images |
| image.repository | string | `"docker.io/securecodebox/hook-persistence-defectdojo"` | Hook image repository |
| image.tag | string | `nil` | Container image tag |
| hook.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images |
| hook.image.repository | string | `"docker.io/securecodebox/hook-persistence-defectdojo"` | Hook image repository |
| hook.image.tag | string | `nil` | Container image tag |
4 changes: 2 additions & 2 deletions hooks/persistence-defectdojo/templates/persistence-provider.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,8 @@ spec:
{{- else }}
type: ReadOnly
{{- end }}
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.Version }}"
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
image: "{{ .Values.hook.image.repository }}:{{ .Values.hook.image.tag | default .Chart.Version }}"
imagePullPolicy: "{{ .Values.hook.image.pullPolicy }}"
env:
- name: DEFECTDOJO_URL
value: {{ .Values.defectdojo.url | quote }}
Expand Down
17 changes: 9 additions & 8 deletions hooks/persistence-defectdojo/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,14 +6,15 @@
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

image:
# image.repository -- Hook image repository
repository: docker.io/securecodebox/hook-persistence-defectdojo
# -- Container image tag
# @default -- defaults to the charts version
tag: null
# -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
pullPolicy: IfNotPresent
hook:
image:
# hook.image.repository -- Hook image repository
repository: docker.io/securecodebox/hook-persistence-defectdojo
# -- Container image tag
# @default -- defaults to the charts version
tag: null
# -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
pullPolicy: IfNotPresent

defectdojo:
# -- Syncs back (two way sync) all imported findings from DefectDojo to SCB Findings Store, set to false to only import the findings to DefectDojo (one way sync).
Expand Down
Loading