secureCodeBox · J12934 · Oct 19, 2020 · Oct 9, 2020 · Oct 9, 2020 · Oct 9, 2020
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -131,6 +131,16 @@ jobs:
           tag_with_ref: true
           tag_with_sha: true
           build_args: baseImageTag=ci-local
+      - uses: docker/build-push-action@v1
+        name: "Build & Push kubeaudit Parser Image"
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+          repository: securecodebox/parser-kubeaudit
+          path: ./scanners/kubeaudit/parser/
+          tag_with_ref: true
+          tag_with_sha: true
+          build_args: baseImageTag=ci-local
       - uses: docker/build-push-action@v1
         name: "Build & Push kube-hunter Parser Image"
         with:
@@ -336,6 +346,14 @@ jobs:
           path: ./scanners/kube-hunter/scanner/
           # Note: not prefixed with a "v" as this matches the aquasec/kube-hunter tags
           tags: "0.3.0,latest"
+      - uses: docker/build-push-action@v1
+        name: "Build & Push kubeaudit Scanner Image"
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+          repository: securecodebox/scanner-kubeaudit
+          path: ./scanners/kubeaudit/scanner/
+          tags: "v0.11.5,latest"
       - uses: docker/build-push-action@v1
         name: "Build & Push test-scan Scanner Image"
         with:
@@ -453,6 +471,17 @@ jobs:
             --set="image.tag=0.3.0"
           cd tests/integration/
           npx jest --ci --color kube-hunter
+      - name: "kubeaudit Integration Tests"
+        run: |
+          kubectl create namespace kubeaudit-tests
+          helm -n kubeaudit-tests install juice-shop ./demo-apps/juice-shop/ --wait
+          helm -n integration-tests install kubeaudit ./scanners/kubeaudit/ \
+            --set="parserImage.tag=sha-$(git rev-parse --short HEAD)" \
+            --set="image.tag=0.11.5" \
+            --set="kubeauditScope=cluster"
+          cd tests/integration/
+          npx jest --ci --color kubeaudit
+          kubectl delete namespace kubeaudit-tests
       - name: "ssh-scan Integration Tests"
         run: |
           helm -n integration-tests install ssh-scan ./scanners/ssh_scan/ --set="parserImage.tag=sha-$(git rev-parse --short HEAD)"

diff --git a/operator/controllers/execution/scans/scan_reconciler.go b/operator/controllers/execution/scans/scan_reconciler.go
@@ -176,7 +176,9 @@ func (r *ScanReconciler) constructJobForScan(scan *executionv1.Scan, scanType *e
 	podAnnotations["sidecar.istio.io/inject"] = "false"
 	job.Spec.Template.Annotations = podAnnotations
 
-	job.Spec.Template.Spec.ServiceAccountName = "lurcher"
+	if job.Spec.Template.Spec.ServiceAccountName == "" {
+		job.Spec.Template.Spec.ServiceAccountName = "lurcher"
+	}
 
 	// merging volume definition from ScanType (if existing) with standard results volume
 	if job.Spec.Template.Spec.Containers[0].VolumeMounts == nil || len(job.Spec.Template.Spec.Containers[0].VolumeMounts) == 0 {

diff --git a/scanners/gitleaks/README.md b/scanners/gitleaks/README.md
@@ -17,12 +17,15 @@ with all commits up to the initial one.
 To learn more about gitleaks visit <https://github.com/zricethezav/gitleaks>
 
 ## Deployment
+
 The gitleaks scanner can be deployed with helm:
+
 ```bash
 helm upgrade --install gitleaks secureCodeBox/gitleaks
 ```
 
 ## Scanner configuration
+
 For a complete overview of the configuration options checkout the
 [Gitleaks documentation](https://github.com/zricethezav/gitleaks/wiki/Options).
 
@@ -35,6 +38,7 @@ The only mandatory parameters are:
 **Do not** override the option `--report-format` or `--report`. It is already configured for automatic findings parsing.
 
 #### Ruleset
+
 At this point we provide three rulesets which you can pass to the `--config` oprtion:
 
 - `/home/config_all.toml`: Includes every rule.
@@ -43,11 +47,13 @@ At this point we provide three rulesets which you can pass to the `--config` opr
 find something like **password = Ej2ifDk2jfeo2** but it will reduce resulting false positives.
 
 #### Other useful options are:
+
 - `--commit-since`: Scan commits more recent than a specific date. Ex: '2006-01-02' or '2006-01-02T15:04:05-0700' format.
 - `--commit-until`: Scan commits older than a specific date. Ex: '2006-01-02' or '2006-01-02T15:04:05-0700' format.
 - `--repo-config`: Load config from target repo. Config file must be ".gitleaks.toml" or "gitleaks.toml".
 
 #### Finding format
+
 It is not an easy task to classify the severity of the scans because we can't tell for sure if the finding is e.g. a real
 or a testing password. Another issue is that the rate of false positives for generic rules can be very high. Therefore,
 we tried to classify the severity of the finding by looking at the accuracy of the rule which detected it. Rules for AWS

diff --git a/scanners/gitleaks/README.md.gotmpl b/scanners/gitleaks/README.md.gotmpl
@@ -17,12 +17,15 @@ with all commits up to the initial one.
 To learn more about gitleaks visit <https://github.com/zricethezav/gitleaks>
 
 ## Deployment
+
 The gitleaks scanner can be deployed with helm:
+
 ```bash
 helm upgrade --install gitleaks secureCodeBox/gitleaks
 ```
 
 ## Scanner configuration
+
 For a complete overview of the configuration options checkout the 
 [Gitleaks documentation](https://github.com/zricethezav/gitleaks/wiki/Options).
 
@@ -35,6 +38,7 @@ The only mandatory parameters are:
 **Do not** override the option `--report-format` or `--report`. It is already configured for automatic findings parsing.
 
 #### Ruleset
+
 At this point we provide three rulesets which you can pass to the `--config` oprtion:
 
 - `/home/config_all.toml`: Includes every rule.
@@ -43,11 +47,13 @@ At this point we provide three rulesets which you can pass to the `--config` opr
 find something like **password = Ej2ifDk2jfeo2** but it will reduce resulting false positives.
 
 #### Other useful options are:
+
 - `--commit-since`: Scan commits more recent than a specific date. Ex: '2006-01-02' or '2006-01-02T15:04:05-0700' format.
 - `--commit-until`: Scan commits older than a specific date. Ex: '2006-01-02' or '2006-01-02T15:04:05-0700' format.
 - `--repo-config`: Load config from target repo. Config file must be ".gitleaks.toml" or "gitleaks.toml".
 
 #### Finding format
+
 It is not an easy task to classify the severity of the scans because we can't tell for sure if the finding is e.g. a real
 or a testing password. Another issue is that the rate of false positives for generic rules can be very high. Therefore, 
 we tried to classify the severity of the finding by looking at the accuracy of the rule which detected it. Rules for AWS 

diff --git a/scanners/kubeaudit/.helmignore b/scanners/kubeaudit/.helmignore
@@ -0,0 +1,5 @@
+.DS_Store
+
+parser/
+scanner/
+examples/
diff --git a/scanners/kubeaudit/Chart.yaml b/scanners/kubeaudit/Chart.yaml
@@ -0,0 +1,20 @@
+apiVersion: v2
+name: kubeaudit
+description: A Helm chart for the kubeaudit security scanner that integrates with the secureCodeBox.
+
+type: application
+version: latest
+appVersion: "v0.11.5"
+
+keywords:
+  - security
+  - kubeaudit
+  - scanner
+  - secureCodeBox
+home: https://www.securecodebox.io/scanners/kubeaudit
+icon: https://www.securecodebox.io/scannerIcons/kubeaudit.svg
+sources:
+  - https://github.com/secureCodeBox/secureCodeBox
+maintainers:
+  - name: iteratec GmbH
+    email: secureCodeBox@iteratec.com
diff --git a/scanners/kubeaudit/README.md b/scanners/kubeaudit/README.md
@@ -2,18 +2,46 @@
 title: "kubeaudit"
 category: "scanner"
 type: "Kubernetes"
-state: "roadmap"
-appVersion: "0.9.0"
-usecase: "Audit your Kubernetes clusters"
+state: "released"
+appVersion: "0.15.1"
+usecase: "Kubernetes Configuration Scanner"
 ---
 
-kubeaudit helps you audit your Kubernetes clusters against common security controls.
+Kubeaudit finds security misconfigurations in you Kubernetes Resources and gives tips on how to resolve these.
 
-To learn more about the kubeaudit scanner itself visit [kubeaudit GitHub].
+Kubeaudit comes with a large lists of "auditors" which test various aspects, like the SecurityContext of pods.
+You can find the complete list of [auditors here](https://github.com/Shopify/kubeaudit/tree/master/docs/auditors).
+
+To learn more about the kubeaudit itself visit [kubeaudit GitHub].
 
 <!-- end -->
 
-> 🔧 The secureCodeBox core team is working on an integration of kubeaudit. We will keep you informed.
+## Deployment
+
+The kube-hunter ScanType can be deployed via helm:
+
+```bash
 helm upgrade --install kubeaudit secureCodeBox/kubeaudit
+```
+
+## Chart Configuration
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| kubeauditScope | string | `"namespace"` | Automatically sets up rbac roles for kubeaudit to access the ressources it scans. Can be either "cluster" (ClusterRole) or "namespace" (Role)         |
+| parserImage.repository | string | `"docker.io/securecodebox/parser-kubeaudit"` | Parser image repository |
+| parserImage.tag | string | defaults to the charts version | Parser image tag |
+| scannerJob.env | list | `[]` | Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) |
+| scannerJob.extraContainers | list | `[]` | Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) |
+| scannerJob.extraVolumeMounts | list | `[]` | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
+| scannerJob.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
+| scannerJob.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) |
+| scannerJob.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) |
+| scannerJob.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated |
+| scannerJob.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. |
+| scannerJob.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode |
+| scannerJob.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system |
+| scannerJob.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user |
+| scannerJob.ttlSecondsAfterFinished | string | `nil` | Defines how long the scanner job after finishing will be available (see: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/) |
 
-[kubeaudit GitHub]: https://github.com/Shopify/kubeaudit
-[kubeaudit Documentation]: https://github.com/Shopify/kubeaudit#quick-start
+[kubeaudit GitHub]: https://github.com/Shopify/kubeaudit/
diff --git a/scanners/kubeaudit/README.md.gotmpl b/scanners/kubeaudit/README.md.gotmpl
@@ -0,0 +1,31 @@
+---
+title: "kubeaudit"
+category: "scanner"
+type: "Kubernetes"
+state: "released"
+appVersion: "0.15.1"
+usecase: "Kubernetes Configuration Scanner"
+---
+
+Kubeaudit finds security misconfigurations in you Kubernetes Resources and gives tips on how to resolve these.
+
+Kubeaudit comes with a large lists of "auditors" which test various aspects, like the SecurityContext of pods.
+You can find the complete list of [auditors here](https://github.com/Shopify/kubeaudit/tree/master/docs/auditors).
+
+To learn more about the kubeaudit itself visit [kubeaudit GitHub].
+
+<!-- end -->
+
+## Deployment
+
+The kube-hunter ScanType can be deployed via helm:
+
+```bash
+helm upgrade --install kubeaudit secureCodeBox/kubeaudit
+```
+
+## Chart Configuration
+
+{{ template "chart.valuesTable" . }}
+
+[kubeaudit GitHub]: https://github.com/Shopify/kubeaudit/
diff --git a/scanners/kubeaudit/examples 52F4 /juice-shop/scan.yaml b/scanners/kubeaudit/examples 52F4 /juice-shop/scan.yaml
@@ -0,0 +1,9 @@
+apiVersion: "execution.securecodebox.io/v1"
+kind: Scan
+metadata:
+  name: "kubeaudit-juiceshop"
+spec:
+  scanType: "kubeaudit"
+  parameters:
+    - "-n"
+    - "juice-shop"
diff --git a/scanners/kubeaudit/parser/Dockerfile b/scanners/kubeaudit/parser/Dockerfile
@@ -0,0 +1,4 @@
+ARG baseImageTag
+FROM securecodebox/parser-sdk-nodejs:${baseImageTag:-latest}
+WORKDIR /home/app/parser-wrapper/parser/
+COPY --chown=app:app ./parser.js ./parser.js