8000 Merge pull request #714 from secureCodeBox/consistency/value-files · secureCodeBox/secureCodeBox@06f3578 · GitHub
[go: up one dir, main page]
Skip to content

Commit 06f3578

Browse files
J12934J12934
authored
Merge pull request #714 from secureCodeBox/consistency/value-files
🚧 [Consistency] Making all values.yaml files consistent
2 parents 61f3c81 + 403c9d4 commit 06f3578

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

57 files changed

+554
-128
lines changed

‎scanners/amass/README.md‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,7 @@ Kubernetes: `>=v1.11.0-0`
6969

7070
| Key | Type | Default | Description |
7171
|-----|------|---------|-------------|
72+
| cascadingRules.enabled | bool | `false` | Enables or disables the installation of the default cascading rules for this scanner |
7273
| parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) |
7374
| parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images |
7475
| parser.image.repository | string | `"docker.io/securecodebox/parser-amass"` | Parser image repository |
@@ -85,7 +86,12 @@ Kubernetes: `>=v1.11.0-0`
8586
| scanner.image.tag | string | `nil` | defaults to the charts appVersion |
8687
| scanner.nameAppend | string | `nil` | append a string to the default scantype name. |
8788
| scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) |
88-
| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) |
89+
| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":false,"runAsNonRoot":false}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) |
90+
| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated |
91+
| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. |
92+
| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode |
93+
| scanner.securityContext.readOnlyRootFilesystem | bool | `false` | Prevents write access to the containers file system |
94+
| scanner.securityContext.runAsNonRoot | bool | `false` | Enforces that the scanner image is run as a non root user |
8995
| scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
9096

9197
## License

‎scanners/amass/docs/README.ArtifactHub.md‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,7 @@ Kubernetes: `>=v1.11.0-0`
7474

7575
| Key | Type | Default | Description |
7676
|-----|------|---------|-------------|
77+
| cascadingRules.enabled | bool | `false` | Enables or disables the installation of the default cascading rules for this scanner |
7778
| parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) |
7879
| parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images |
7980
| parser.image.repository | string | `"docker.io/securecodebox/parser-amass"` | Parser image repository |
@@ -90,7 +91,12 @@ Kubernetes: `>=v1.11.0-0`
9091
| scanner.image.tag | string | `nil` | defaults to the charts appVersion |
9192
| scanner.nameAppend | string | `nil` | append a string to the default scantype name. |
9293
| scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) |
93-
| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) |
94+
| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) |
95+
| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated |
96+
| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. |
97+
| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode |
98+
| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system |
99+
| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user |
94100
| scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
95101

96102
## Contributing

‎scanners/amass/values.yaml‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,4 +66,20 @@ scanner:
6666
extraContainers: []
6767

6868
# scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
69-
securityContext: {}
69+
securityContext:
70+
# scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user
71+
runAsNonRoot: false
72+
# scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system
73+
readOnlyRootFilesystem: false
74+
# scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated
75+
allowPrivilegeEscalation: false
76+
# scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode
77+
privileged: false
78+
capabilities:
79+
drop:
80+
# scanner.securityContext.capabilities.drop[0] -- This drops all linux privileges from the container.
81+
- all
82+
83+
cascadingRules:
84+
# cascadingRules.enabled -- Enables or disables the installation of the default cascading rules for this scanner
85+
enabled: false

‎scanners/angularjs-csti-scanner/README.md‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -168,6 +168,7 @@ options.scope.request_methods = [
168168
169169
| Key | Type | Default | Description |
170170
|-----|------|---------|-------------|
171+
| cascadingRules.enabled | bool | `false` | Enables or disables the installation of the default cascading rules for this scanner |
171172
| parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) |
172173
| parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images |
173174
| parser.image.repository | string | `"docker.io/securecodebox/parser-angularjs-csti-scanner"` | Parser image repository |
@@ -181,10 +182,15 @@ options.scope.request_methods = [
181182
| scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
182183
| scanner.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images |
183184
| scanner.image.repository | string | `"docker.io/securecodebox/scanner-angularjs-csti-scanner"` | Container Image to run the scan |
184-
| scanner.image.tag | string | `nil` | defaults to the charts version |
185+
| scanner.image.tag | string | `nil` | defaults to the charts appVersion |
185186
| scanner.nameAppend | string | `nil` | append a string to the default scantype name. |
186187
| scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) |
187-
| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) |
188+
| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) |
189+
| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated |
190+
| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. |
191+
| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode |
192+
| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system |
193+
| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user |
188194
| scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
189195
190196
## License

‎scanners/angularjs-csti-scanner/docs/README.ArtifactHub.md‎

Lines changed: 8 additions & 2 deletions
3359
Original file line numberDiff line numberDiff line change
@@ -173,6 +173,7 @@ options.scope.request_methods = [
173173
174174
| Key | Type | Default | Description |
175175
|-----|------|---------|-------------|
176+
| cascadingRules.enabled | bool | `false` | Enables or disables the installation of the default cascading rules for this scanner |
176177
| parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) |
177178
| parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images |
178179
| parser.image.repository | string | `"docker.io/securecodebox/parser-angularjs-csti-scanner"` | Parser image repository |
@@ -186,10 +187,15 @@ options.scope.request_methods = [
186187
| scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
187188
| scanner.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images |
188189
| scanner.image.repository | string | `"docker.io/securecodebox/scanner-angularjs-csti-scanner"` | Container Image to run the scan |
189-
| scanner.image.tag | string | `nil` | defaults to the charts version |
190+
| scanner.image.tag | string | `nil` | defaults to the charts appVersion |
190191
| scanner.nameAppend | string | `nil` | append a string to the default scantype name. |
191192
| scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) |
192-
| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) |
193+
| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) |
194+
| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated |
195+
| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. |
196+
| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode |
197+
| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system |
198+
| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user |
193199
| scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
194200
195201
## Contributing

‎scanners/angularjs-csti-scanner/values.yaml‎

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ parser:
1111
tag: null
1212
# -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
1313
pullPolicy: IfNotPresent
14-
14+
1515
# parser.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/
1616
ttlSecondsAfterFinished: null
1717
# parser.env -- Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/)
@@ -21,7 +21,7 @@ scanner:
2121
image:
2222
# scanner.image.repository -- Container Image to run the scan
2323
repository: docker.io/securecodebox/scanner-angularjs-csti-scanner
24-
# scanner.image.tag -- defaults to the charts version
24+
# scanner.image.tag -- defaults to the charts appVersion
2525
tag: null
2626
# -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
2727
pullPolicy: IfNotPresent
@@ -60,4 +60,20 @@ scanner:
6060
extraContainers: []
6161

6262
# scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
63-
securityContext: {}
63+
securityContext:
64+
# scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user
65+
runAsNonRoot: true
66+
# scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system
67+
readOnlyRootFilesystem: true
68+
# scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated
69+
allowPrivilegeEscalation: false
70+
# scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode
71+
privileged: false
72+
capabilities:
73+
drop:
74+
# scanner.securityContext.capabilities.drop[0] -- This drops all linux privileges from the container.
75+
- all
76+
77+
cascadingRules:
78+
# cascadingRules.enabled -- Enables or disables the installation of the default cascading rules for this scanner
79+
enabled: false

‎scanners/git-repo-scanner/README.md‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,7 @@ Kubernetes: `>=v1.11.0-0`
9797

9898
| Key | Type | Default | Description |
9999
|-----|------|---------|-------------|
100+
| cascadingRules.enabled | bool | `false` | Enables or disables the installation of the default cascading rules for this scanner |
100101
| parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) |
101102
| parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images |
102103
| parser.image.repository | string | `"docker.io/securecodebox/parser-git-repo-scanner"` | Parser image repository |
@@ -113,7 +114,12 @@ Kubernetes: `>=v1.11.0-0`
113114
| scanner.image.tag | string | `nil` | defaults to the charts version |
114115
| scanner.nameAppend | string | `nil` | append a string to the default scantype name. |
115116
| scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) |
116-
| scanner.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) |
117+
| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) |
118+
| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated |
119+
| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. |
120+
| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode |
121+
| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system |
122+
| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user |
117123
| scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
118124

119125
## License

0 commit comments

Comments
 (0)
0