Skip to content
This repository was archived by the owner on Oct 14, 2020. It is now read-only.

Commit 8210699

Browse files
J12934J12934
committed
Apply code review comments
1 parent 669b011 commit 8210699

File tree

12 files changed

+28
-28
lines changed

12 files changed

+28
-28
lines changed

‎hook-sdk/nodejs/Dockerfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,4 +11,4 @@ COPY --from=build --chown=app:app /home/app/node_modules/ ./node_modules/
1111
COPY --chown=app:app ./hook-wrapper.js ./hook-wrapper.js
1212
USER 1001
1313
ENV NODE_ENV ${NODE_ENV:-production}
14-
ENTRYPOINT ["node", "/home/app/hook-wrapper/hook-wrapper.js"]
14+
ENTRYPOINT ["node", "/home/app/hook-wrapper/hook-wrapper.js"]

‎operator/README.md

+4-4
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ helm install securecodebox-operator secureCodeBox/operator
2121

2222
| Key | Type | Default | Description |
2323
|-----|------|---------|-------------|
24-
| image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
24+
| image.pullPolicy | string | `"Always"` | Image pull policy |
2525
| image.repository | string | `"docker.io/securecodebox/operator"` | The operator image repository |
2626
| image.tag | string | defaults to the charts version | Parser image tag |
2727
| lurcher.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
@@ -38,9 +38,9 @@ helm install securecodebox-operator secureCodeBox/operator
3838
| s3.port | string | `nil` | |
3939
| s3.secretAttributeNames.accesskey | string | `"accesskey"` | |
4040
| s3.secretAttributeNames.secretkey | string | `"secretkey"` | |
41-
| securityContext.allowPrivilegeEscalation | bool | `false` | Ensures that users privilidges canout be escalated |
42-
| securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privilidges from the operator container. They are not required |
43-
| securityContext.privileged | bool | `false` | Ensures that the operator container is not run in privilidged mode |
41+
| securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated |
42+
| securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the operator container. They are not required |
43+
| securityContext.privileged | bool | `false` | Ensures that the operator container is not run in privileged mode |
4444
| securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system |
4545
| securityContext.runAsNonRoot | bool | `true` | Enforces that the Operator image is run as a non root user |
4646
| telemetryEnabled | bool | `true` | The Operator sends anonymous telemetry data, to give the team an overview how much the secureCodeBox is used. Find out more at https://www.securecodebox.io/telemetry |

‎operator/values.yaml

+4-4
Original file line numberDiff line numberDiff line change
@@ -12,20 +12,20 @@ image:
1212
# @default -- defaults to the charts version
1313
tag: null
1414
# image.pullPolicy -- Image pull policy
15-
pullPolicy: IfNotPresent
15+
pullPolicy: Always
1616

1717
securityContext:
1818
# securityContext.runAsNonRoot -- Enforces that the Operator image is run as a non root user
1919
runAsNonRoot: true
2020
# securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system
2121
readOnlyRootFilesystem: true
22-
# securityContext.allowPrivilegeEscalation -- Ensures that users privilidges canout be escalated
22+
# securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated
2323
allowPrivilegeEscalation: false
24-
# securityContext.privileged -- Ensures that the operator container is not run in privilidged mode
24+
# securityContext.privileged -- Ensures that the operator container is not run in privileged mode
2525
privileged: false
2626
capabilities:
2727
drop:
28-
# securityContext.capabilities.drop[0] -- This drops all linux privilidges from the operator container. They are not required
28+
# securityContext.capabilities.drop[0] -- This drops all linux privileges from the operator container. They are not required
2929
- all
3030

3131
lurcher:

‎parser-sdk/nodejs/Dockerfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,4 +11,4 @@ COPY --from=build --chown=app:app /home/app/node_modules/ ./node_modules/
1111
COPY --chown=app:app ./parser-wrapper.js ./parser-wrapper.js
1212
USER 1001
1313
ENV NODE_ENV ${NODE_ENV:-production}
14-
ENTRYPOINT ["node", "/home/app/parser-wrapper/parser-wrapper.js"]
14+
ENTRYPOINT ["node", "/home/app/parser-wrapper/parser-wrapper.js"]

‎scanners/nmap/README.md

+6-6
Original file line numberDiff line numberDiff line change
@@ -50,10 +50,10 @@ Warning! This is currently not tested and might require additional testing to wo
5050

5151
If you want to use Nmap to identify operating systems of hosts you'll need to weaken the securityContext config, as Nmap requires the capability to send raw sockets to identify operating systems. See [Nmap Docs](https://secwiki.org/w/Running_nmap_as_an_unprivileged_user)
5252

53-
You can deployed the ScanType with the config like this:
53+
You can deploy the ScanType with the config like this:
5454

5555
```bash
56-
cat <<EOF | helm install nmap-privilidged ./scanners/nmap --values -
56+
cat <<EOF | helm install nmap-privileged ./scanners/nmap --values -
5757
scannerJob:
5858
env:
5959
- name: "NMAP_PRIVILEGED"
@@ -77,7 +77,7 @@ kind: Scan
7777
metadata:
7878
name: "nmap-os-scan"
7979
spec:
80-
scanType: "nmap-privilidged"
80+
scanType: "nmap-privileged"
8181
parameters:
8282
- --privileged
8383
- "-O"
@@ -98,9 +98,9 @@ spec:
9898
| scannerJob.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
9999
| scannerJob.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) |
100100
| scannerJob.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) |
101-
| scannerJob.securityContext.allowPrivilegeEscalation | bool | `false` | Ensures that users privilidges canout be escalated |
102-
| scannerJob.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privilidges from the container. |
103-
| scannerJob.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privilidged mode |
101+
| scannerJob.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated |
102+
| scannerJob.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. |
103+
| scannerJob.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode |
104104
| scannerJob.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system |
105105
| scannerJob.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user |
106106
| scannerJob.ttlSecondsAfterFinished | string | `nil` | Defines how long the scanner job after finishing will be available (see: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/) |

‎scanners/nmap/README.md.gotmpl

+4-4
Original file line numberDiff line numberDiff line change
@@ -50,10 +50,10 @@ Warning! This is currently not tested and might require additional testing to wo
5050

5151
If you want to use Nmap to identify operating systems of hosts you'll need to weaken the securityContext config, as Nmap requires the capability to send raw sockets to identify operating systems. See [Nmap Docs](https://secwiki.org/w/Running_nmap_as_an_unprivileged_user)
5252

53-
You can deployed the ScanType with the config like this:
53+
You can deploy the ScanType with the config like this:
5454

5555
```bash
56-
cat <<EOF | helm install nmap-privilidged ./scanners/nmap --values -
56+
cat <<EOF | helm install nmap-privileged ./scanners/nmap --values -
5757
scannerJob:
5858
env:
5959
- name: "NMAP_PRIVILEGED"
@@ -77,7 +77,7 @@ kind: Scan
7777
metadata:
7878
name: "nmap-os-scan"
7979
spec:
80-
scanType: "nmap-privilidged"
80+
scanType: "nmap-privileged"
8181
parameters:
8282
- --privileged
8383
- "-O"
@@ -86,4 +86,4 @@ spec:
8686

8787
## Chart Configuration
8888

89-
{{ template "chart.valuesTable" . }}
89+
{{ template "chart.valuesTable" . }}

‎scanners/nmap/scanner/Dockerfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,4 @@ FROM alpine:3.12
22
RUN apk add --no-cache nmap=7.80-r2 nmap-scripts=7.80-r2
33
RUN addgroup --system --gid 1001 nmap && adduser nmap --system --uid 1001 --ingroup nmap
44
USER 1001
5-
CMD [nmap]
5+
CMD [nmap]

‎scanners/nmap/values.yaml

+3-3
Original file line numberDiff line numberDiff line change
@@ -42,11 +42,11 @@ scannerJob:
4242
runAsNonRoot: true
4343
# scannerJob.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system
4444
readOnlyRootFilesystem: true
45-
# scannerJob.securityContext.allowPrivilegeEscalation -- Ensures that users privilidges canout be escalated
45+
# scannerJob.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated
4646
allowPrivilegeEscalation: false
47-
# scannerJob.securityContext.privileged -- Ensures that the scanner container is not run in privilidged mode
47+
# scannerJob.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode
4848
privileged: false
4949
capabilities:
5050
drop:
51-
# scannerJob.securityContext.capabilities.drop[0] -- This drops all linux privilidges from the container.
51+
# scannerJob.securityContext.capabilities.drop[0] -- This drops all linux privileges from the container.
5252
- all

‎scanners/sslyze/templates/sslyze-scan-type.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -33,4 +33,4 @@ spec:
3333
{{- toYaml .Values.scannerJob.extraContainers | nindent 12 }}
3434
{{- end }}
3535
volumes:
36-
{{- toYaml .Values.scannerJob.extraVolumes | nindent 12 }}
36+
{{- toYaml .Values.scannerJob.extraVolumes | nindent 12 }}

‎scanners/test-scan/templates/test-scan-scan-type.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -31,4 +31,4 @@ spec:
3131
{{- toYaml .Values.scannerJob.extraContainers | nindent 12 }}
3232
{{- end }}
3333
volumes:
34-
{{- toYaml .Values.scannerJob.extraVolumes | nindent 12 }}
34+
{{- toYaml .Values.scannerJob.extraVolumes | nindent 12 }}

‎scanners/trivy/templates/trivy-scan-type.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -38,4 +38,4 @@ spec:
3838
{{- toYaml .Values.scannerJob.extraContainers | nindent 12 }}
3939
{{- end }}
4040
volumes:
41-
{{- toYaml .Values.scannerJob.extraVolumes | nindent 12 }}
41+
{{- toYaml .Values.scannerJob.extraVolumes | nindent 12 }}

‎scanners/wpscan/templates/wpscan-scan-type.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -36,4 +36,4 @@ spec:
3636
{{- toYaml .Values.scannerJob.extraContainers | nindent 12 }}
3737
{{- end }}
3838
volumes:
39-
{{- toYaml .Values.scannerJob.extraVolumes | nindent 12 }}
39+
{{- toYaml .Values.scannerJob.extraVolumes | nindent 12 }}

0 commit comments

Comments
 (0)