secureCodeBox · Weltraumschaf · Mar 17, 2023 · Jan 20, 2023 · Jan 20, 2023 · Jan 21, 2023
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -19,7 +19,7 @@ env:
   # ---- Language Versions ----
 
   GO_VERSION: "1.19"
-  PYTHON_VERSION: "3.8.10"
+  PYTHON_VERSION: "3.9.16"
   NODE_VERSION: "16"
   NPM_VERSION: "8.19.2"
 
@@ -123,6 +123,52 @@ jobs:
           name: auto-discovery-image
           path: ./auto-discovery/kubernetes/auto-discovery-kubernetes.tar
           retention-days: 1
+
+  # ---- Build Stage | AutoDiscovery | PullSecretExtractor ----
+  auto-discovery-kubernetes-secret-extraction-container:
+    name: "Autodiscovery | Kubernetes | SecretExtractionInitContainer"
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Setup Python Version
+        uses: actions/setup-python@v4
+        with:
+          python-version: '${{ env.PYTHON_VERSION }}'
+      - name: Unit Tests
+        working-directory: ./auto-discovery/kubernetes/pull-secret-extractor
+        run: make unit-test
+
+      - name: Build Container Image
+        working-directory: ./auto-discovery/kubernetes/pull-secret-extractor
+        run: make docker-build
+
+      - name: Export Container Image
+        working-directory: ./auto-discovery/kubernetes/pull-secret-extractor
+        run: make docker-export
+
+      - name: Upload Image A
527E
s Artifact
+        uses: actions/upload-artifact@v2
+        with:
+          name: auto-discovery-pull-secret-extractor
+          path: ./auto-discovery/kubernetes/pull-secret-extractor/auto-discovery-secret-extractor.tar
+          retention-days: 1
+
+      - name: "Start kind cluster"
+        run: |
+          kind version
+          kind create cluster --wait 3m --image kindest/node:v1.24.0@sha256:0866296e693efe1fed79d5e6c7af8df71fc73ae45e3679af05342239cdc5bc8e
+
+      - name: "Inspect kind cluster"
+        run: |
+          kubectl config current-context
+          kubectl get node
+
+      - name: "Run integration tests"
+        working-directory: ./auto-discovery/kubernetes/pull-secret-extractor
+        run: |
+          make integration-test
 
   # ---- Build Stage | SDK Matrix ----
 

diff --git a/.github/workflows/release-build.yaml b/.github/workflows/release-build.yaml
@@ -5,7 +5,7 @@
 name: "Release Build"
 on:
   release:
-    types: [released]
+    types: [released, prereleased]
 
 env:
   # ---- Language Versions ----
@@ -118,6 +118,53 @@ jobs:
           repository: ${{ env.DOCKER_NAMESPACE }}/auto-discovery-kubernetes
           readme-filepath: ./auto-discovery/kubernetes/docs/README.DockerHub-Core.md
 
+  # ---- AutoDiscovery | PullSecretExtractor ----
+
+  auto-discovery-kubernetes-pull-secret-extractor:
+    name: "AutoDiscovery | Kubernetes | Pull Secret Extractor"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Docker Meta
+        id: docker_meta
+        uses: docker/metadata-action@v3
+        with:
+          images: ${{ env.DOCKER_NAMESPACE }}/auto-discovery-pull-secret-extractor
+          tags: |
+            type=sha
+            type=semver,pattern={{version}}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+
+      - name: Login to DockerHub
+        uses: docker/login-action@v1
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+
+      - name: Build and Push
+        uses: docker/build-push-action@v2
+        with:
+          context: ./auto-discovery/kubernetes/pull-secret-extractor
+          file: ./auto-discovery/kubernetes/pull-secret-extractor/Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.docker_meta.outputs.tags }}
+          labels: ${{ steps.docker_meta.outputs.labels }}
+
+      - name: Update Docker Hub Description
+        uses: peter-evans/dockerhub-description@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+          repository: ${{ env.DOCKER_NAMESPACE }}/auto-discovery-pull-secret-extractor
+          readme-filepath: ./auto-discovery/kubernetes/pull-secret-extractor/readme.md
+
   # ---- SDK Matrix ----
 
   sdk:

diff --git a/auto-discovery/kubernetes/api/v1/autodiscoveryconfig_types.go b/auto-discovery/kubernetes/api/v1/autodiscoveryconfig_types.go
@@ -30,9 +30,16 @@ type ServiceAutoDiscoveryConfig struct {
 }
 
 type ContainerAutoDiscoveryConfig struct {
-	Enabled                  bool            `json:"enabled"`
-	PassiveReconcileInterval metav1.Duration `json:"passiveReconcileInterval"`
-	ScanConfig               ScanConfig      `json:"scanConfig"`
+	Enabled                  bool                  `json:"enabled"`
+	ImagePullSecretConfig    ImagePullSecretConfig `json:"imagePullSecretConfig"`
+	PassiveReconcileInterval metav1.Duration       `json:"passiveReconcileInterval"`
+	ScanConfig               ScanConfig            `json:"scanConfig"`
+}
+
+type ImagePullSecretConfig struct {
+	MapImagePullSecretsToEnvironmentVariables bool   `json:"mapImagePullSecretsToEnvironmentVariables"`
+	UsernameEnvironmentVariableName           string `json:"usernameEnvironmentVariableName"`
+	PasswordNameEnvironmentVariableName       string `json:"passwordEnvironmentVariableName"`
 }
 
 type ClusterConfig struct {

diff --git a/auto-discovery/kubernetes/api/v1/zz_generated.deepcopy.go b/auto-discovery/kubernetes/api/v1/zz_generated.deepcopy.go
diff --git a/auto-discovery/kubernetes/auto-discovery-config.yaml b/auto-discovery/kubernetes/auto-discovery-config.yaml
@@ -50,7 +50,7 @@ containerAutoDiscovery:
   enabled: true
   passiveReconcileInterval: 10s
   scanConfig:
-    scanType: trivy-image
+    scanType: trivy-image-autodiscovery
     # -- parameters used for the scans created by the containerAutoDiscovery
     parameters:
       - "{{ .ImageID }}"
@@ -66,3 +66,7 @@ containerAutoDiscovery:
       defectdojo.securecodebox.io/engagement-version: "{{if (index .Target.Labels `app.kubernetes.io/version`) }}{{ index .Target.Labels `app.kubernetes.io/version` }}{{end}}"
     # -- hookSelector allows to specify a LabelSelector with which the hooks are selected
     hookSelector: {}
+  imagePullSecretConfig:
+    mapImagePullSecretsToEnvironmentVariables: true
+    usernameEnvironmentVariableName: "TRIVY_USERNAME"
+    passwordEnvironmentVariableName: "TRIVY_PASSWORD"
diff --git a/auto-discovery/kubernetes/controllers/container_scan_controller.go b/auto-discovery/kubernetes/controllers/container_scan_controller.go
@@ -177,11 +177,26 @@ func getScanName(imageID string) string {
 }
 
 func (r *ContainerScanReconciler) createScheduledScans(ctx context.Context, pod corev1.Pod, imageIDs []string) {
+	secretsDefined, secrets := checkForImagePullSecrets(pod)
+	mapSecretsToEnv := r.Config.ContainerAutoDiscoveryConfig.ImagePullSecretConfig.MapImagePullSecretsToEnvironmentVariables
+
 	for _, imageID := range imageIDs {
-		r.createScheduledScan(ctx, pod, imageID)
+		if secretsDefined {
+			if mapSecretsToEnv {
+				r.createScheduledScanWithImagePullSecrets(ctx, pod, imageID, secrets)
+			}
+		} else {
+			r.createScheduledScan(ctx, pod, imageID)
+		}
 	}
 }
 
+func checkForImagePullSecrets(pod corev1.Pod) (bool, []corev1.LocalObjectReference) {
+	imagePullSecrets := pod.Spec.ImagePullSecrets
+	secretsDefined := len(imagePullSecrets) > 0
+	return secretsDefined, imagePullSecrets
+}
+
 func (r *ContainerScanReconciler) createScheduledScan(ctx context.Context, pod corev1.Pod, imageID string) {
 	namespace := r.getNamespace(ctx, pod)
 
@@ -194,6 +209,20 @@ func (r *ContainerScanReconciler) createScheduledScan(ctx context.Context, pod c
 		r.Log.V(6).Info("Created scheduled scan", "pod", pod.Name, "namespace", pod.Namespace)
 	}
 }
+
+func (r *ContainerScanReconciler) createScheduledScanWithImagePullSecrets(ctx context.Context, pod corev1.Pod, imageID string, secrets []corev1.LocalObjectReference) {
+	namespace := r.getNamespace(ctx, pod)
+
+	newScheduledScan := r.generateScanWithVolumeMounts(pod, imageID, namespace, secrets)
+	err := r.Client.Create(ctx, &newScheduledScan)
+
+	if err != nil {
+		r.Log.Error(err, "Failed to create scheduled scan", "scan", newScheduledScan, "namespace", namespace)
+	} else {
+		r.Log.V(6).Info("Created scheduled scan", "pod", pod.Name, "namespace", pod.Namespace)
+	}
+}
+
 func (r *ContainerScanReconciler) getNamespace(ctx context.Context, pod corev1.Pod) corev1.Namespace {
 	var result corev1.Namespace
 	err := r.Client.Get(ctx, types.NamespacedName{Name: pod.Namespace, Namespace: ""}, &result)
@@ -228,6 +257,129 @@ func (r *ContainerScanReconciler) generateScan(pod corev1.Pod, imageID string, n
 	return newScheduledScan
 }
 
+func (r *ContainerScanReconciler) generateScanWithVolumeMounts(pod corev1.Pod, imageID string, namespace corev1.Namespace, secrets []corev1.LocalObjectReference) executionv1.ScheduledScan {
+	scanConfig := r.Config.ContainerAutoDiscoveryConfig.ScanConfig
+	templateArgs := ContainerAutoDiscoveryTemplateArgs{
+		Config:     r.Config,
+		ScanConfig: scanConfig,
+		Cluster:    r.Config.Cluster,
+		Target:     pod.ObjectMeta,
+		Namespace:  namespace,
+		ImageID:    imageID,
+	}
+
+	extraVolumes, extraMounts := getVolumesForSecrets(secrets, imageID)
+	scanConfig.Volumes = append(scanConfig.Volumes, extraVolumes...)
+
+	scanSpec := util.GenerateScanSpec(scanConfig, templateArgs)
+	scanSpec.ScanSpec.InitContainers = append(scanSpec.ScanSpec.InitContainers, getSecretExtractionInitContainer(imageID, extraMounts))
+
+	pullSecretConfig := r.Config.ContainerAutoDiscoveryConfig.ImagePullSecretConfig
+	usernameEnvVarName := pullSecretConfig.UsernameEnvironmentVariableName
+	passwordEnvVarName := pullSecretConfig.PasswordNameEnvironmentVariableName
+	scanSpec.ScanSpec.Env = append(scanSpec.ScanSpec.Env, getTemporarySecretEnvironmentVariableMount(imageID, usernameEnvVarName, passwordEnvVarName)...)
+
+	newScheduledScan := executionv1.ScheduledScan{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:        getScanName(imageID),
+			Namespace:   pod.Namespace,
+			Annotations: getScanAnnotations(scanConfig, templateArgs),
+			Labels:      getScanLabels(scanConfig, templateArgs),
+		},
+		Spec: scanSpec,
+	}
+	return newScheduledScan
+}
+
+func getVolumesForSecrets(secrets []corev1.LocalObjectReference, imageID string) ([]corev1.Volume, []corev1.VolumeMount) {
+	var volumes []corev1.Volume
+	var mounts []corev1.VolumeMount
+	for _, secret := range secrets {
+		volume := corev1.Volume{
+			Name: secret.Name + "-volume",
+			VolumeSource: corev1.VolumeSource{
+				Secret: &corev1.SecretVolumeSource{
+					SecretName: secret.Name,
+				},
+			},
+		}
+
+		mount := corev1.VolumeMount{
+			Name:      secret.Name + "-volume",
+			MountPath: "/secrets/" + secret.Name,
+		}
+
+		volumes = append(volumes, volume)
+		mounts = append(mounts, mount)
+	}
+	return volumes, mounts
+}
+
+func getSecretExtractionInitContainer(imageID string, volumeMounts []corev1.VolumeMount) corev1.Container {
+	temporarySecretName := getTemporarySecretName(imageID)
+
+	return corev1.Container{
+		Name:         "secret-extraction-to-env",
+		Image:        "docker.io/securecodebox/auto-discovery-pull-secret-extractor",
+		Command:      []string{"python"},
+		Args:         []string{"secret_extraction.py", imageID, temporarySecretName},
+		VolumeMounts: volumeMounts,
+		Env: []corev1.EnvVar{
+			{
+				Name: "POD_NAME",
+				ValueFrom: &corev1.EnvVarSource{
+					FieldRef: &corev1.ObjectFieldSelector{
+						FieldPath: "metadata.name",
+					},
+				},
+			},
+			{
+				Name: "NAMESPACE",
+				ValueFrom: &corev1.EnvVarSource{
+					FieldRef: &corev1.ObjectFieldSelector{
+						FieldPath: "metadata.namespace",
+					},
+				},
+			},
+		},
+	}
+}
+
+func getTemporarySecretName(imageID string) string {
+	//limit name to kubernetes max length
+	return ("temporary-secret-" + getScanName(imageID))[:62]
+}
+
+func getTemporarySecretEnvironmentVariableMount(imageID string, usernameEnvVarName string, passwordEnvVarName string) []corev1.EnvVar {
+	trueBool := true
+	return []corev1.EnvVar{
+		{
+			Name: usernameEnvVarName,
+			ValueFrom: &corev1.EnvVarSource{
+				SecretKeyRef: &corev1.SecretKeySelector{
+					Optional: &trueBool,
+					LocalObjectReference: corev1.LocalObjectReference{
+						Name: getTemporarySecretName(imageID),
+					},
+					Key: "username",
+				},
+			},
+		},
+		{
+			Name: passwordEnvVarName,
+			ValueFrom: &corev1.EnvVarSource{
+				SecretKeyRef: &corev1.SecretKeySelector{
+					Optional: &trueBool,
+					LocalObjectReference: corev1.LocalObjectReference{
+						Name: getTemporarySecretName(imageID),
+					},
+					Key: "password",
+				},
+			},
+		},
+	}
+}
+
 func (r *ContainerScanReconciler) checkForScanType(ctx context.Context, pod corev1.Pod) bool {
 	namespace := r.getNamespace(ctx, pod)