diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 77ed1e26e8..6aa3dd2172 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -120,7 +120,7 @@ jobs: # ---- Build Stage ---- - # ---- Build Stage | Operator & Lurcher ---- + # ---- Build Stage | Operator & Lurker ---- operator: name: "Build | Operator" @@ -130,7 +130,7 @@ jobs: runs-on: ubuntu-latest strategy: matrix: - component: ["operator", "lurcher"] + component: ["operator", "lurker"] steps: - name: Checkout uses: actions/checkout@v2 @@ -625,8 +625,8 @@ jobs: helm -n securecodebox-system install securecodebox-operator ./operator/ --wait \ --set="image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/operator" \ --set="image.tag=sha-$(git rev-parse --short HEAD)" \ - --set="lurcher.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/lurcher" \ - --set="lurcher.image.tag=sha-$(git rev-parse --short HEAD)" \ + --set="lurker.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/lurker" \ + --set="lurker.image.tag=sha-$(git rev-parse --short HEAD)" \ # ---- Operator Health Check ---- diff --git a/docs/resources/scb-architecture.drawio b/docs/resources/scb-architecture.drawio index 9f6f1a6d36..7da3d1532f 100644 --- a/docs/resources/scb-architecture.drawio +++ b/docs/resources/scb-architecture.drawio @@ -70,7 +70,7 @@ - + @@ -268,4 +268,4 @@ - \ No newline at end of file + diff --git a/docs/resources/scb-architecture.svg b/docs/resources/scb-architecture.svg index df4cfc1b42..4d5bf5bf52 100644 --- a/docs/resources/scb-architecture.svg +++ b/docs/resources/scb-architecture.svg @@ -1 +1 @@ -
Kubernetes Job
Kubernetes Job
kubectl apply -f scan.yaml
kubectl apply -f scan.yaml
Kubernetes Job
Kubernetes Job
Scanner Container
Run Scan
Scanner Container...
Lurcher
Extract Results
Lurcher...
Kubernetes Job
Kubernetes Job
CustomRessource
Scan : scanType
CustomRessourceScan : sc...
1
1
Security Scanning
Security Scanning
Result Parsing
Result Parsing
Data Processing Hooks
Data Processing Hooks
Analytics &
Vulnerability Management
Analytics &...
Security Test Definition
Security Test Definition
Parser Container
Parse Results
Parser Container...
secureCodeBox
Operator
secureCodeBoxOperator
3
3
2
2
Kubernetes Job
Kubernetes Job
ReadOnlyHook
Persist Results
ReadOnlyHook...
ReadAndWriteHook
Modify Results
ReadAndWriteHook...
5
5
4
4Viewer does not support full SVG 1.1 \ No newline at end of file +
Kubernetes Job
Kubernetes Job
kubectl apply -f scan.yaml
kubectl apply -f scan.yaml
Kubernetes Job
Kubernetes Job
Scanner Container
Run Scan
Scanner Container...
Lurker
Extract Results
Lurker...
Kubernetes Job
Kubernetes Job
CustomRessource
Scan : scanType
CustomRessourceScan : sc...
1
1
Security Scanning
Security Scanning
Result Parsing
Result Parsing
Data Processing Hooks
Data Processing Hooks
Analytics &
Vulnerability Management
Analytics &...
Security Test Definition
Security Test Definition
Parser Container
Parse Results
Parser Container...
secureCodeBox
Operator
secureCodeBoxOperator
3
3
2
2
Kubernetes Job
Kubernetes Job
ReadOnlyHook
Persist Results
ReadOnlyHook...
ReadAndWriteHook
Modify Results
ReadAndWriteHook...
5
5
4
4Viewer does not support full SVG 1.1 diff --git a/docs/uml/compononents_overview.uxf b/docs/uml/compononents_overview.uxf index 14be20fca3..7f7f0e0748 100644 --- a/docs/uml/compononents_overview.uxf +++ b/docs/uml/compononents_overview.uxf @@ -22,7 +22,7 @@ Operator 60 <<Sidecar>> -Lurcher +Lurker diff --git a/docs/uml/sequence_overview.puml b/docs/uml/sequence_overview.puml index ddefe0c0cc..0f6a59f752 100644 --- a/docs/uml/sequence_overview.puml +++ b/docs/uml/sequence_overview.puml @@ -14,7 +14,7 @@ actor kubectl box "secureCodeBox" participant Operator <> participant Scanner <> - participant Lurcher <> + participant Lurker <> participant Minio <> participant Parser <> collections ReadOnlyHooks <> @@ -30,14 +30,14 @@ kubectl -\ Operator : start scan activate Operator Operator -> Scanner : run job activate Scanner -activate Lurcher +activate Lurker Scanner -> Target : scan -Lurcher -\ Scanner : read data -Lurcher -\ Minio : store raw results +Lurker -\ Scanner : read data +Lurker -\ Minio : store raw results Scanner <-- Target Operator <-- Scanner deactivate Scanner -deactivate Lurcher +deactivate Lurker Operator -> Parser : run job activate Parser diff --git a/lurcher/.dockerignore b/lurker/.dockerignore similarity index 100% rename from lurcher/.dockerignore rename to lurker/.dockerignore diff --git a/lurcher/.gitignore b/lurker/.gitignore similarity index 100% rename from lurcher/.gitignore rename to lurker/.gitignore diff --git a/lurcher/Dockerfile b/lurker/Dockerfile similarity index 89% rename from lurcher/Dockerfile rename to lurker/Dockerfile index d4b8176acd..95a41dd39c 100644 --- a/lurcher/Dockerfile +++ b/lurker/Dockerfile @@ -17,12 +17,12 @@ RUN go mod download COPY main.go main.go # Build -RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GO111MODULE=on go build -a -o lurcher main.go +RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GO111MODULE=on go build -a -o lurker main.go # Use distroless as minimal base image to package the manager binary # Refer to https://github.com/GoogleContainerTools/distroless for more details FROM gcr.io/distroless/static:nonroot WORKDIR / -COPY --from=builder /workspace/lurcher . +COPY --from=builder /workspace/lurker . -ENTRYPOINT ["/lurcher"] +ENTRYPOINT ["/lurker"] diff --git a/lurcher/docs/README.DockerHub-Core.md b/lurker/docs/README.DockerHub-Core.md similarity index 95% rename from lurcher/docs/README.DockerHub-Core.md rename to lurker/docs/README.DockerHub-Core.md index 4ecab2691c..432836840b 100644 --- a/lurcher/docs/README.DockerHub-Core.md +++ b/lurker/docs/README.DockerHub-Core.md @@ -45,10 +45,10 @@ You can find resources to help you get started on our [documentation website](ht - tagged releases, e.g. `2.9.0`, `2.8.0`, `2.7.0` ## How to use this image -This `lurcher` image is intended to work in combination with the OWASP secureCodeBox. For more informations details please take a look at the documentation page: https://docs.securecodebox.io/docs/getting-started/installation. +This `lurker` image is intended to work in combination with the OWASP secureCodeBox. For more informations details please take a look at the documentation page: https://docs.securecodebox.io/docs/getting-started/installation. ```bash -docker pull securecodebox/lurcher +docker pull securecodebox/lurker ``` ## What is secureCodeBox Operator? diff --git a/lurcher/go.mod b/lurker/go.mod similarity index 62% rename from lurcher/go.mod rename to lurker/go.mod index b690df4806..94bfba9acb 100644 --- a/lurcher/go.mod +++ b/lurker/go.mod @@ -2,11 +2,13 @@ // // SPDX-License-Identifier: Apache-2.0 -module github.com/secureCodeBox/secureCodeBox/lurcher +module github.com/secureCodeBox/secureCodeBox/lurker go 1.15 require ( + github.com/pkg/errors v0.9.1 + k8s.io/api v0.0.0-20191114100352-16d7abae0d2a k8s.io/apimachinery v0.0.0-20191028221656-72ed19daf4bb k8s.io/client-go v0.0.0-20191114101535-6c5935290e33 ) diff --git a/lurcher/go.sum b/lurker/go.sum similarity index 97% rename from lurcher/go.sum rename to lurker/go.sum index 79540b9192..70678a9567 100644 --- a/lurcher/go.sum +++ b/lurker/go.sum @@ -29,8 +29,6 @@ github.com/go-openapi/jsonpointer v0.0.0-20160704185906-46af16f9f7b1/go.mod h1:+ github.com/go-openapi/jsonreference v0.0.0-20160704190145-13c6e3589ad9/go.mod h1:W3Z9FmVs9qj+KR4zFKmDPGiLdk1D9Rlm7cyMvf57TTg= github.com/go-openapi/spec v0.0.0-20160808142527-6aced65f8501/go.mod h1:J8+jY1nAiCcj+friV/PDoE1/3eeccG9LYBs0tYvLOWc= github.com/go-openapi/swag v0.0.0-20160704191624-1d0bd113de87/go.mod h1:DXUve3Dpr1UfpPtxFw+EFuQ41HhCWZfha5jSVRG7C7I= -github.com/go-resty/resty/v2 v2.1.0 h1:Z6IefCpUMfnvItVJaJXWv/pMiiD11So35QgwEELsldE= -github.com/go-resty/resty/v2 v2.1.0/go.mod h1:dZGr0i9PLlaaTD4H/hoZIDjQ+r6xq8mgbRzHZf7f2J8= github.com/gogo/protobuf v1.2.2-0.20190723190241-65acae22fc9d h1:3PaI8p3seN09VjbTYC/QWlUZdZ1qS1zGjy7LH2Wt07I= github.com/gogo/protobuf v1.2.2-0.20190723190241-65acae22fc9d/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o= github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q= @@ -66,8 +64,10 @@ github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/u github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU= github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= +github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= +github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/mailru/easyjson v0.0.0-20160728113105-d5b7844b561a/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc= github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= @@ -92,6 +92,7 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk= github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4= +github.com/spf13/pflag v1.0.3 h1:zPAT6CGy6wXeQ7NtTnaTerfKOsV6V6F8agHXFiazDkg= github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/testify v0.0.0-20151208002404-e3a8ff8ce365/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs= @@ -114,8 +115,6 @@ golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73r golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= -golang.org/x/net v0.0.0-20190628185345-da137c7871d7 h1:rTIdg5QFRR7XCaK4LCjBiPbx8j4DQRpdYMnGn/bJUEU= -golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20190812203447-cdfb69ac37fc h1:gkKoSkUmnU6bpS/VhkuO27bzQeSA51uaEfbOW5dNb68= golang.org/x/net v0.0.0-20190812203447-cdfb69ac37fc/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= @@ -150,12 +149,14 @@ golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3 google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE= google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM= google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= +google.golang.org/appengine v1.5.0 h1:KxkO13IPW4Lslp2bz+KHP2E3gtFlrIGNThxkZQ3g+4c= google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc= google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE= google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE= google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY= gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys= gopkg.in/inf.v0 v0.9.0 h1:3zYtXIO92bvsdS3ggAdA8Gb4Azj0YU+TVY1uGYNFA8o= diff --git a/lurcher/go.sum.license b/lurker/go.sum.license similarity index 100% rename from lurcher/go.sum.license rename to lurker/go.sum.license diff --git a/lurcher/main.go b/lurker/main.go similarity index 70% rename from lurcher/main.go rename to lurker/main.go index 31aea5ebce..127a03cd47 100644 --- a/lurcher/main.go +++ b/lurker/main.go @@ -9,6 +9,7 @@ import ( "flag" "fmt" "io/ioutil" + corev1 "k8s.io/api/core/v1" "log" "net/http" "net/http/httputil" @@ -46,7 +47,7 @@ func main() { log.Fatal("Flag 'uploadURL' is no proper URL") } - log.Println("Starting lurcher") + log.Println("Starting lurker") log.Printf("Waiting for main container '%s' to complete", mainContainer) log.Printf("After scan is completed file '%s' will be uploaded to '%s'", filePath, url.Hostname()) @@ -99,7 +100,7 @@ func uploadFile(path, url string) error { log.Println("Failed Request:") log.Println(string(bytes)) - return fmt.Errorf("Lurcher failed to upload scan result file. File upload returned non 2xx status code (%d)", res.StatusCode) + return fmt.Errorf("Lurker failed to upload scan result file. File upload returned non 2xx status code (%d)", res.StatusCode) } func waitForMainContainerToEnd(container, pod, namespace string) { @@ -114,25 +115,30 @@ func waitForMainContainerToEnd(container, pod, namespace string) { log.Printf("Waiting for maincontainer to exit.") - for { - pod, err := clientset.CoreV1().Pods(namespace).Get(pod, metav1.GetOptions{}) - if kerrors.IsNotFound(err) { - log.Printf("Pod %s not found in namespace %s", pod, namespace) - } else if statusError, isStatus := err.(*kerrors.StatusError); isStatus { - log.Printf("Error getting pod %v", statusError.ErrStatus.Message) - } else if err != nil { - panic(err.Error()) - } else { - containerStatuses := pod.Status.ContainerStatuses - - for _, status := range containerStatuses { - if status.Name == container && status.State.Terminated != nil { - log.Printf("Main Container Exited. Lurcher will end as well.") - return - } - } - } - + for keepWaitingForMainContainerToExit(container, pod, namespace, clientset) { time.Sleep(500 * time.Millisecond) } } + +func keepWaitingForMainContainerToExit(container string, podName string, namespace string, clientset *kubernetes.Clientset) bool { + pod, err := clientset.CoreV1().Pods(namespace).Get(podName, metav1.GetOptions{}) + if kerrors.IsNotFound(err) { + log.Printf("Pod %s not found in namespace %s", pod, namespace) + } else if statusError, isStatus := err.(*kerrors.StatusError); isStatus { + log.Printf("Error getting pod %v", statusError.ErrStatus.Message) + } else if err != nil { + panic(err.Error()) + } + + return !mainContainerExited(container, pod.Status.ContainerStatuses) +} + +func mainContainerExited(container string, containerStatuses []corev1.ContainerStatus) bool { + for _, status := range containerStatuses { + if status.Name == container && status.State.Terminated != nil { + log.Printf("Main Container exited. Lurker will end as well.") + return true + } + } + return false +} diff --git a/operator/Chart.yaml b/operator/Chart.yaml index ea54eb740e..c8dddadaf1 100644 --- a/operator/Chart.yaml +++ b/operator/Chart.yaml @@ -42,8 +42,8 @@ annotations: # artifacthub.io/images: | # - name: securecodebox-operator # image: docker.io/securecodebox/operator:v2.7.0-alpha1 - # - name: securecodebox-lurcher - # image: docker.io/securecodebox/lurcher:v2.7.0-alpha1 + # - name: securecodebox-lurker + # image: docker.io/securecodebox/lurker:v2.7.0-alpha1 artifacthub.io/crds: | - kind: Scan version: v1 diff --git a/operator/README.md b/operator/README.md index dd85224c26..105994d75a 100644 --- a/operator/README.md +++ b/operator/README.md @@ -73,15 +73,15 @@ helm install securecodebox-operator secureCodeBox/operator | Key | Type | Default | Description | |-----|------|---------|-------------| -| customCACertificate | object | `{"certificate":"public.crt","existingCertificate":null}` | Setup for Custom CA certificates. These are automatically mounted into every secureCodeBox component (lurcher, parser & hooks). Requires that every namespace has a configmap with the CA certificate(s) | +| customCACertificate | object | `{"certificate":"public.crt","existingCertificate":null}` | Setup for Custom CA certificates. These are automatically mounted into every secureCodeBox component (lurker, parser & hooks). Requires that every namespace has a configmap with the CA certificate(s) | | customCACertificate.certificate | string | `"public.crt"` | key in the configmap holding the certificate(s) | | customCACertificate.existingCertificate | string | `nil` | name of the configMap holding the ca certificate(s), needs to be the same across all namespaces | | image.pullPolicy | string | `"Always"` | Image pull policy | | image.repository | string | `"docker.io/securecodebox/operator"` | The operator image repository | | image.tag | string | defaults to the charts version | Parser image tag | -| lurcher.image.pullPolicy | string | `"Always"` | Image pull policy | -| lurcher.image.repository | string | `"docker.io/securecodebox/lurcher"` | The operator image repository | -| lurcher.image.tag | string | defaults to the charts version | Parser image tag | +| lurker.image.pullPolicy | string | `"Always"` | Image pull policy | +| lurker.image.repository | string | `"docker.io/securecodebox/lurker"` | The operator image repository | +| lurker.image.tag | string | defaults to the charts version | Parser image tag | | minio.defaultBucket.enabled | bool | `true` | | | minio.defaultBucket.name | string | `"securecodebox"` | | | minio.enabled | bool | `true` | Enable this to use minio as storage backend instead of a cloud bucket provider like AWS S3, Google Cloud Storage, DigitalOcean Spaces etc. | diff --git a/operator/controllers/execution/scans/scan_controller.go b/operator/controllers/execution/scans/scan_controller.go index 41d786d78c..9e9e7ed48b 100644 --- a/operator/controllers/execution/scans/scan_controller.go +++ b/operator/controllers/execution/scans/scan_controller.go @@ -50,7 +50,7 @@ const defaultPresignDuration = 12 * time.Hour // +kubebuilder:rbac:groups=execution.securecodebox.io,resources=parsedefinitions,verbs=get;list;watch // +kubebuilder:rbac:groups=execution.securecodebox.io,resources=scancompletionhooks,verbs=get;list;watch // +kubebuilder:rbac:groups=batch,resources=jobs,verbs=get;list;watch;create;update;patch;delete -// Permissions needed to create service accounts for lurcher, parser and scanCompletionHooks +// Permissions needed to create service accounts for lurker, parser and scanCompletionHooks // Pod permission are required to grant these permission to service accounts // +kubebuilder:rbac:groups=core,resources=pods,verbs=get diff --git a/operator/controllers/execution/scans/scan_reconciler.go b/operator/controllers/execution/scans/scan_reconciler.go index 85fa794d7f..c1cfe081c9 100644 --- a/operator/controllers/execution/scans/scan_reconciler.go +++ b/operator/controllers/execution/scans/scan_reconciler.go @@ -73,8 +73,8 @@ func (r *ScanReconciler) startScan(scan *executionv1.Scan) error { } r.ensureServiceAccountExists( scan.Namespace, - "lurcher", - "Lurcher is used to extract results from secureCodeBox Scans. It needs rights to get and watch the status of pods to see when the scans have finished.", + "lurker", + "Lurker is used to extract results from secureCodeBox Scans. It needs rights to get and watch the status of pods to see when the scans have finished.", rules, ) @@ -181,7 +181,7 @@ func (r *ScanReconciler) constructJobForScan(scan *executionv1.Scan, scanType *e job.Spec.Template.Annotations = podAnnotations if job.Spec.Template.Spec.ServiceAccountName == "" { - job.Spec.Template.Spec.ServiceAccountName = "lurcher" + job.Spec.Template.Spec.ServiceAccountName = "lurker" } // merging volume definition from ScanType (if existing) with standard results volume @@ -207,33 +207,33 @@ func (r *ScanReconciler) constructJobForScan(scan *executionv1.Scan, scanType *e }, ) - // Get lurcher image config from env - lurcherImage := os.Getenv("LURCHER_IMAGE") - if lurcherImage == "" { - lurcherImage = "securecodebox/lurcher:latest" + // Get lurker image config from env + lurkerImage := os.Getenv("LURKER_IMAGE") + if lurkerImage == "" { + lurkerImage = "securecodebox/lurker:latest" } - lurcherPullPolicyRaw := os.Getenv("LURCHER_PULL_POLICY") - var lurcherPullPolicy corev1.PullPolicy - switch lurcherPullPolicyRaw { + lurkerPullPolicyRaw := os.Getenv("LURKER_PULL_POLICY") + var lurkerPullPolicy corev1.PullPolicy + switch lurkerPullPolicyRaw { case "Always": - lurcherPullPolicy = corev1.PullAlways + lurkerPullPolicy = corev1.PullAlways case "IfNotPresent": - lurcherPullPolicy = corev1.PullIfNotPresent + lurkerPullPolicy = corev1.PullIfNotPresent case "Never": - lurcherPullPolicy = corev1.PullNever + lurkerPullPolicy = corev1.PullNever case "": - lurcherPullPolicy = corev1.PullAlways + lurkerPullPolicy = corev1.PullAlways default: - return nil, fmt.Errorf("Unknown imagePull Policy for lurcher: %s", lurcherPullPolicyRaw) + return nil, fmt.Errorf("Unknown imagePull Policy for lurker: %s", lurkerPullPolicyRaw) } falsePointer := false truePointer := true - lurcherSidecar := &corev1.Container{ - Name: "lurcher", - Image: lurcherImage, - ImagePullPolicy: lurcherPullPolicy, + lurkerSidecar := &corev1.Container{ + Name: "lurker", + Image: lurkerImage, + ImagePullPolicy: lurkerPullPolicy, Args: []string{ "--container", job.Spec.Template.Spec.Containers[0].Name, @@ -281,7 +281,7 @@ func (r *ScanReconciler) constructJobForScan(scan *executionv1.Scan, scanType *e } customCACertificate, isConfigured := os.LookupEnv("CUSTOM_CA_CERTIFICATE_EXISTING_CERTIFICATE") - r.Log.Info("Configuring customCACerts for lurcher", "customCACertificate", customCACertificate, "isConfigured", isConfigured) + r.Log.Info("Configuring customCACerts for lurker", "customCACertificate", customCACertificate, "isConfigured", isConfigured) if customCACertificate != "" { job.Spec.Template.Spec.Volumes = append(job.Spec.Template.Spec.Volumes, corev1.Volume{ Name: "ca-certificate", @@ -295,7 +295,7 @@ func (r *ScanReconciler) constructJobForScan(scan *executionv1.Scan, scanType *e }) certificateName := os.Getenv("CUSTOM_CA_CERTIFICATE_NAME") - lurcherSidecar.VolumeMounts = append(lurcherSidecar.VolumeMounts, corev1.VolumeMount{ + lurkerSidecar.VolumeMounts = append(lurkerSidecar.VolumeMounts, corev1.VolumeMount{ Name: "ca-certificate", ReadOnly: true, MountPath: "/etc/ssl/certs/" + certificateName, @@ -303,7 +303,7 @@ func (r *ScanReconciler) constructJobForScan(scan *executionv1.Scan, scanType *e }) } - job.Spec.Template.Spec.Containers = append(job.Spec.Template.Spec.Containers, *lurcherSidecar) + job.Spec.Template.Spec.Containers = append(job.Spec.Template.Spec.Containers, *lurkerSidecar) if err := ctrl.SetControllerReference(scan, job, r.Scheme); err != nil { return nil, err diff --git a/operator/docs/README.ArtifactHub.md b/operator/docs/README.ArtifactHub.md index b6fb30e954..d37ff8157f 100644 --- a/operator/docs/README.ArtifactHub.md +++ b/operator/docs/README.ArtifactHub.md @@ -78,15 +78,15 @@ helm install securecodebox-operator secureCodeBox/operator | Key | Type | Default | Description | |-----|------|---------|-------------| -| customCACertificate | object | `{"certificate":"public.crt","existingCertificate":null}` | Setup for Custom CA certificates. These are automatically mounted into every secureCodeBox component (lurcher, parser & hooks). Requires that every namespace has a configmap with the CA certificate(s) | +| customCACertificate | object | `{"certificate":"public.crt","existingCertificate":null}` | Setup for Custom CA certificates. These are automatically mounted into every secureCodeBox component (lurker, parser & hooks). Requires that every namespace has a configmap with the CA certificate(s) | | customCACertificate.certificate | string | `"public.crt"` | key in the configmap holding the certificate(s) | | customCACertificate.existingCertificate | string | `nil` | name of the configMap holding the ca certificate(s), needs to be the same across all namespaces | | image.pullPolicy | string | `"Always"` | Image pull policy | | image.repository | string | `"docker.io/securecodebox/operator"` | The operator image repository | | image.tag | string | defaults to the charts version | Parser image tag | -| lurcher.image.pullPolicy | string | `"Always"` | Image pull policy | -| lurcher.image.repository | string | `"docker.io/securecodebox/lurcher"` | The operator image repository | -| lurcher.image.tag | string | defaults to the charts version | Parser image tag | +| lurker.image.pullPolicy | string | `"Always"` | Image pull policy | +| lurker.image.repository | string | `"docker.io/securecodebox/lurker"` | The operator image repository | +| lurker.image.tag | string | defaults to the charts version | Parser image tag | | minio.defaultBucket.enabled | bool | `true` | | | minio.defaultBucket.name | string | `"securecodebox"` | | | minio.enabled | bool | `true` | Enable this to use minio as storage backend instead of a cloud bucket provider like AWS S3, Google Cloud Storage, DigitalOcean Spaces etc. | diff --git a/operator/templates/manager/manager.yaml b/operator/templates/manager/manager.yaml index 1004e76719..bd438ee24e 100644 --- a/operator/templates/manager/manager.yaml +++ b/operator/templates/manager/manager.yaml @@ -110,10 +110,10 @@ spec: value: {{ .Values.s3.awsStsEndpoint | quote }} {{- end }} {{- end }} - - name: LURCHER_IMAGE - value: "{{ .Values.lurcher.image.repository }}:{{ .Values.lurcher.image.tag | default .Chart.Version }}" - - name: LURCHER_PULL_POLICY - value: {{ .Values.lurcher.image.pullPolicy }} + - name: LURKER_IMAGE + value: "{{ .Values.lurker.image.repository }}:{{ .Values.lurker.image.tag | default .Chart.Version }}" + - name: LURKER_PULL_POLICY + value: {{ .Values.lurker.image.pullPolicy }} {{- if .Values.customCACertificate.existingCertificate }} - name: CUSTOM_CA_CERTIFICATE_EXISTING_CERTIFICATE value: {{ .Values.customCACertificate.existingCertificate | quote }} diff --git a/operator/values.yaml b/operator/values.yaml index 303d3a7cd7..19da5e4954 100644 --- a/operator/values.yaml +++ b/operator/values.yaml @@ -18,7 +18,7 @@ image: # image.pullPolicy -- Image pull policy pullPolicy: Always -# -- Setup for Custom CA certificates. These are automatically mounted into every secureCodeBox component (lurcher, parser & hooks). +# -- Setup for Custom CA certificates. These are automatically mounted into every secureCodeBox component (lurker, parser & hooks). # Requires that every namespace has a configmap with the CA certificate(s) customCACertificate: # -- name of the configMap holding the ca certificate(s), needs to be the same across all namespaces @@ -52,14 +52,14 @@ securityContext: # -- Sets the securityContext on the operators pod level. See: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container podSecurityContext: {} -lurcher: +lurker: image: - # lurcher.image.repository -- The operator image repository - repository: docker.io/securecodebox/lurcher - # lurcher.image.tag -- Parser image tag + # lurker.image.repository -- The operator image repository + repository: docker.io/securecodebox/lurker + # lurker.image.tag -- Parser image tag # @default -- defaults to the charts version tag: null - # lurcher.image.pullPolicy -- Image pull policy + # lurker.image.pullPolicy -- Image pull policy pullPolicy: Always minio: diff --git a/scanners/angularjs-csti-scanner/scanner/wrapper.sh b/scanners/angularjs-csti-scanner/scanner/wrapper.sh index 510726ca0c..43d4b4290f 100644 --- a/scanners/angularjs-csti-scanner/scanner/wrapper.sh +++ b/scanners/angularjs-csti-scanner/scanner/wrapper.sh @@ -11,7 +11,7 @@ if [ -f /acstis/config/acstis-config.py ]; then fi python /acstis/acstis-script.py $@ -# If no finding occured generate a empty file for the lurcher +# If no finding occurred generate a empty file for the lurker if [ ! -f /home/securecodebox/findings.log ]; then touch /home/securecodebox/findings.log fi diff --git a/scanners/kubeaudit/templates/kubeaudit-rbac.yaml b/scanners/kubeaudit/templates/kubeaudit-rbac.yaml index 62104b819c..6437248a0d 100644 --- a/scanners/kubeaudit/templates/kubeaudit-rbac.yaml +++ b/scanners/kubeaudit/templates/kubeaudit-rbac.yaml @@ -12,7 +12,7 @@ metadata: kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: kubeaudit-lurcher + name: kubeaudit-lurker namespace: {{ .Release.Namespace}} subjects: - kind: ServiceAccount @@ -21,7 +21,7 @@ subjects: roleRef: apiGroup: rbac.authorization.k8s.io kind: Role - name: lurcher + name: lurker --- {{- if eq .Values.kubeauditScope "namespace" }} kind: Role diff --git a/scanners/screenshooter/scanner/wrapper.sh b/scanners/screenshooter/scanner/wrapper.sh index aab7f778fd..40d0282862 100644 --- a/scanners/screenshooter/scanner/wrapper.sh +++ b/scanners/screenshooter/scanner/wrapper.sh @@ -3,8 +3,8 @@ # SPDX-License-Identifier: Apache-2.0 # Screnshooter entrypoint script to change the result file linux permission after completion. -# Firefox will set the permission in a way which makes it inaccessible to the lurcher otherwise -# Gets executed two times because it happend to produce better results for long loading sites +# Firefox will set the permission in a way which makes it inaccessible to the lurker otherwise +# Gets executed two times because it happened to produce better results for long loading sites timeout 30 firefox $@ timeout 30 firefox $@ if [ ! -f /home/securecodebox/screenshot.png ]; then