Validate with ai

[santoshkal]

This PR Implements remediations to failed results while validating resources with different techs available with Genval like, Rego, CEL, and Regex.
Genval can now accept parameters from YAML file by passing --config flag.

[dryrunsecurity]

DryRun Security Summary

The pull request enhances the genval application's security and functionality by introducing AI-powered remediation, secure policy management, improved configuration handling, robust error logging, and input validation for infrastructure files like Dockerfiles, Terraform configurations, and Kubernetes manifests.

Expand for full summary

Summary:

The code changes in this pull request focus on enhancing the security and functionality of the genval application, which is used for validating and remediating various types of infrastructure files, including Dockerfiles, Terraform configurations, and Kubernetes manifests.

The key security-related changes include:

1. Automated Remediation: The introduction of an AI-powered remediation functionality that can automatically address security issues identified during the validation process. This feature aims to simplify the process of fixing security-related problems in infrastructure files.

2. Secure Policy Management: The ability to use Rego policies stored in OCI-compliant registries for validation, which allows for centralized and potentially more secure policy management.

3. Improved Configuration Management: The addition of YAML-based configuration support, which enables users to centralize and manage the application's settings, including security-related parameters.

4. Robust Error Handling and Logging: Enhancements to the error handling and logging mechanisms, which can aid in debugging and troubleshooting potential security issues.

5. Secure Input Validation: Efforts to ensure that user-provided input, such as Dockerfiles, Terraform configurations, and Kubernetes manifests, are properly validated and sanitized to prevent potential security vulnerabilities.

Overall, these changes demonstrate a strong focus on improving the security and usability of the genval application, which can be beneficial for organizations looking to maintain secure infrastructure as code practices.

Files Changed:

• cmd/container.go: Introduces a takeAction flag and updates the validation functions to support OCI-based policy validation.
• cmd/celval_terraform.go: Adds remediation functionality, configuration file support, and parsing/evaluation improvements.
• cmd/celval_dockerfileval.go: Introduces new flags, remediation loop, and output handling.
• cmd/celval_infrafile.go: Updates the validation and remediation process for Kubernetes manifests.
• cmd/opts.go: Adds utility functions and YAML configuration loading.
• cmd/genai.go: Refactors the configuration loading process.
• cmd/regex.go: Removes the requirement for the reqinput flag in the regex command.
• cmd/cue.go: Enhances the cue command with new flags and improved validation/generation functionality.
• go.mod and go.sum: Update dependencies, including the cuelang.org/go package.
• cmd/regoval_dockerfileval.go: Adds remediation capabilities and configuration file support.
• cmd/regoval_infrafile.go: Introduces remediation functionality and OCI registry support.
• cmd/regoval_terraform.go: Adds remediation capabilities and configuration file support.
• llm/assistant.go: Improves the system prompt loading functionality.
• llm/README.md: Updates the configuration file for the language model used in the application.
• llm/takeaction.go: Implements the RemediateResource() function for LLM-based remediation.
• llm/types.go: Adds new fields to the CommonSpec struct, including OCICredentials and Takeaction.
• pkg/cuecore/printresults.go: Introduces functions to print errors and validation success in a tabular format.
• pkg/cuecore/cuecore.go: Refactors the existing code, with minor changes in the import statements.
• pkg/parser/dockerfile_parser.go: Adds a new Location field to the DockerfileInstruction struct.
• pkg/validate/regoval.go: Improves the error handling and logging, and adds support for tracing the Rego policy evaluation process.
• pkg/validate/printresults.go: Enhances the PrintResults function to improve error handling and extract failed policies.
• pkg/validate/celval.go: Updates the EvaluateCELPolicies function to return more information about the evaluation process.
• templates/defaultpolicies/rego/dockerfile_policies/check_cmd/check_cmd.json: Introduces a new policy to ensure that there is only one CMD instruction in a Dockerfile.
• templates/defaultpolicies/rego/dockerfile_policies/check_cmd/check_cmd.rego: Defines the Rego policy to enforce the single

Code Analysis

We ran 9 analyzers against 30 files and 2 analyzers had findings. 7 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	2 findings
Authn/Authz Analyzer	3 findings

View PR in the DryRun Dashboard.

[dryrunsecurity]

DryRun Security Summary

The pull request enhances the Genval application's security and usability by introducing automated remediation, centralized configuration management, improved error handling, support for OCI registry-based policies, and robust input validation for infrastructure-as-code file validation.

Expand for full summary

Summary:

The code changes in this pull request focus on enhancing the security and usability of the Genval application, which is a tool used for validating and remediating infrastructure-as-code (IaC) files, such as Dockerfiles and Kubernetes manifests, using various policy frameworks (e.g., Rego, CEL).

The key security-related improvements include:

1. Automated Remediation: The addition of the --takeaction and --model flags, which enable the application to automatically remediate failed validation results using an AI/LLM-based approach. This feature can help users quickly address security issues in their IaC files.

2. Centralized Configuration Management: The introduction of YAML-based configuration files, which allow users to centralize and manage various settings, including input files, policies, and credentials, improving the overall security and maintainability of the application.

3. Improved Error Handling and Logging: The code changes include enhancements to error handling and logging, providing more detailed information to users and security teams, which can aid in troubleshooting and incident response.

4. Support for OCI Registry-based Policies: The ability to fetch security policies from OCI-compliant registries, such as GitHub Container Registry, enables a more centralized and secure policy management approach.

5. Validation of User Input: The code includes various input validation checks to ensure that user-provided data, such as file paths and URLs, are properly sanitized and validated, reducing the risk of injection vulnerabilities.

Overall, the changes in this pull request demonstrate a strong focus on improving the security and usability of the Genval application, which is a crucial tool for securing infrastructure-as-code in modern software development and deployment practices.

Files Changed:

1. cmd/celval_terraform.go: Adds new flags and functionality to the "celval terraform" command, including automated remediation using an AI model and support for configuration files.
2. cmd/celval_dockerfileval.go: Introduces similar remediation and configuration management capabilities for the "celval dockerfileval" command.
3. cmd/container.go: Enhances the "dockerfile" command with input validation and policy-based validation features.
4. cmd/celval_infrafile.go: Adds a new "infrafile" command to validate Kubernetes and related manifests using CEL policies and AI-powered remediation.
5. cmd/genai.go: Improves the handling of system prompts and user prompts for the "genai" command.
6. cmd/opts.go: Introduces helper functions for parsing and validating configuration options.
7. cmd/regex.go: Removes the requirement for the --reqinput flag, which could potentially introduce security risks.
8. cmd/cue.go: Enhances the "cue" command with verbose logging, output directory control, and improved error handling.
9. cmd/regoval_dockerfileval.go: Adds remediation capabilities and configuration management to the "dockerfileval" command.
10. cmd/regoval_infrafile.go: Introduces similar remediation and configuration features for the "infrafile" command.
11. go.mod and go.sum: Updates various dependencies, including Cue, AWS SDK, and Charmbracelet libraries.
12. llm/assistant.go: Improves the handling of system prompt files and their organization.
13. llm/README.md: Updates the configuration file for the Dockerfile validation process, including changes to the AI model and remediation settings.
14. llm/takeaction.go: Implements the remediation functionality using an LLM-based approach.
15. llm/types.go: Adds new fields to the configuration structure, including OCI credentials and the Takeaction flag.
16. pkg/cuecore/printresults.go: Enhances the presentation of validation results.
17. pkg/cuecore/cuecore.go: Reorganizes the import statements.
18. pkg/parser/dockerfile_parser.go: Adds line number information to the parsed Dockerfile instructions.
19. pkg/validate/celval.go: Improves the handling of failed CEL policy evaluations.
20. pkg/validate/printresults.go: Enhances the output formatting and reporting of policy evaluation results.
21. pkg/validate/regoval.go: Refactors the Rego policy validation

Code Analysis

We ran 9 analyzers against 30 files and 2 analyzers had findings. 7 analyzers had no findings.

Analyzer	Findings
Authn/Authz Analyzer	3 findings
Sensitive Files Analyzer	2 findings

View PR in the DryRun Dashboard.