Skip to content

Commit 330764e

Browse files
amrityamroutamrityamrout
authored
Merge pull request #157 from abnamro/2472323-fix-datree-findings
2472323 fix datree findings
2 parents e7eb9a0 + f0863ef commit 330764e

File tree

19 files changed

+73
-47
lines changed

19 files changed

+73
-47
lines changed

‎deployment/kubernetes/README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -222,7 +222,7 @@ helm lint . --set-file global.secretScanRulePackConfig=./RESC-RULE.toml
222222

223223
Render chart templates locally and display the output.
224224
```bash
225-
helm template resc . -f ../resc-helm-wizard/custom-values.yaml --set-file global.secretScanRulePackConfig=./RESC-RULE.toml
225+
helm template resc . -f ./example-values.yaml --set-file global.secretScanRulePackConfig=./RESC-RULE.toml
226226
```
227227

228228
## Deploying charts manually
@@ -242,7 +242,7 @@ Make sure you have completed the [pre-requisite](#prerequisites) steps.
242242

243243
* Deploy the helm charts.
244244
```bash
245-
helm install --namespace resc resc . -f ../resc-helm-wizard/custom-values.yaml --set-file global.secretScanRulePackConfig=./RESC-RULE.toml
245+
helm install --namespace resc resc . -f ./example-values.yaml --set-file global.secretScanRulePackConfig=./RESC-RULE.toml
246246
```
247247

248248
* Optionally, set the default namespace for all kubectl commands. Now you no longer need to specify the -n resc option for all the kubectl commands.

‎deployment/kubernetes/charts/resc-database/templates/database_service.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ metadata:
77
labels:
88
app: {{ .Values.global.appName }}
99
tier: ms-database
10+
annotations:
11+
datree.skip/SERVICE_INCORRECT_TYPE_VALUE_NODEPORT: irrelevant as its only exposed for local environment and can be enabled/disabled from env specific values.yaml
1012
spec:
1113
{{ if .Values.database.exposeToHostPort }}
1214
type: NodePort

‎deployment/kubernetes/charts/resc-frontend/templates/frontend_deployment.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ kind: Deployment
33
metadata:
44
name: {{ .Values.global.appName }}-frontend
55
namespace: {{ .Values.global.namespace }}
6+
annotations:
7+
datree.skip/CONTAINERS_INCORRECT_RUNASUSER_VALUE_LOWUID: irrelevant for nginx docker image, skipping.
68
spec:
79
replicas: {{ .Values.replicas}}
810
selector:

‎deployment/kubernetes/charts/resc-frontend/templates/frontend_service.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ metadata:
66
labels:
77
app: {{ .Values.global.appName }}
88
tier: frontend
9+
annotations:
10+
datree.skip/SERVICE_INCORRECT_TYPE_VALUE_NODEPORT: irrelevant as frontend needs to be exposed outside of the cluster
911
spec:
1012
{{ if .Values.exposeToHostPort }}
1113
type: NodePort

‎deployment/kubernetes/charts/resc-rabbitmq/templates/rabbitmq_job.yaml

+10-4
Original file line numberDiff line numberDiff line change
@@ -46,12 +46,15 @@ spec:
4646
- secretRef:
4747
name: {{ .Values.global.appName }}-rabbitmq-admin-secret
4848
{{ end }}
49+
50+
{{- $additionalVolumeMounts := include "resc.mqInitAdditionalVolumeMounts" . }}
51+
{{- if $additionalVolumeMounts }}
4952
volumeMounts:
50-
{{ if eq .Values.useKubernetesSecret "false"}}
5153
{{- with include "resc.mqInitAdditionalVolumeMounts" .}}
5254
{{- nindent 12 .}}
5355
{{- end }}
54-
{{ end }}
56+
{{- end }}
57+
5558
securityContext:
5659
allowPrivilegeEscalation: false
5760
readOnlyRootFilesystem: false
@@ -63,12 +66,15 @@ spec:
6366
type: RuntimeDefault
6467
runAsNonRoot: true
6568
runAsUser: 10001
69+
70+
{{- $additionalVolumes := include "resc.mqInitAdditionalVolumes" . }}
71+
{{- if $additionalVolumes }}
6672
volumes:
67-
{{ if eq .Values.useKubernetesSecret "false"}}
6873
{{- with include "resc.mqInitAdditionalVolumes" .}}
6974
{{- nindent 8 .}}
7075
{{- end }}
71-
{{ end }}
76+
{{- end }}
77+
7278
restartPolicy: {{ .Values.mqInit.restartPolicy }}
7379
{{ if .Values.global.imagePullSecret }}
7480
imagePullSecrets:

‎deployment/kubernetes/charts/resc-rabbitmq/templates/rabbitmq_service.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ metadata:
66
labels:
77
app: {{ .Values.global.appName }}
88
tier: rabbitmq
9+
annotations:
10+
datree.skip/SERVICE_INCORRECT_TYPE_VALUE_NODEPORT: irrelevant as its only exposed for local environment and can be enabled/disabled from env specific values.yaml
911
spec:
1012
{{ if and (eq .Values.global.enableInClusterRabbitMqMgmt "true") (.Values.rabbitMQ.exposeAmqpToHostPort) (.Values.rabbitMQ.exposeToHostPort)}}
1113
type: NodePort

‎deployment/kubernetes/charts/resc-rabbitmq/templates/rabbitmq_statefulset.yaml

+3-2
Original file line numberDiff line numberDiff line change
@@ -78,11 +78,12 @@ spec:
7878
- mountPath: "/var/lib/rabbitmq/mnesia"
7979
subPath: "var/lib/rabbitmq/mnesia"
8080
name: {{ .Values.global.appName }}-mq-pv-storage
81-
{{ if eq .Values.useKubernetesSecret "false"}}
81+
{{- $additionalVolumeMounts := include "resc.mqAdditionalVolumeMounts" . }}
82+
{{- if $additionalVolumeMounts }}
8283
{{- with include "resc.mqAdditionalVolumeMounts" .}}
8384
{{- nindent 12 .}}
8485
{{- end }}
85-
{{ end }}
86+
{{- end }}
8687
securityContext:
8788
allowPrivilegeEscalation: false
8889
readOnlyRootFilesystem: false

‎deployment/kubernetes/charts/resc-redis/templates/redis_deployement.yaml

+9-4
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,9 @@ spec:
4545
ports:
4646
- containerPort: {{ .Values.redis.config.port}}
4747
resources:
48+
requests:
49+
cpu: {{ .Values.redis.resources.requests.cpu }}
50+
memory: {{ .Values.redis.resources.requests.memory }}
4851
limits:
4952
cpu: {{ .Values.redis.resources.limits.cpu }}
5053
memory: {{ .Values.redis.resources.limits.memory }}
@@ -53,11 +56,12 @@ spec:
5356
name: data
5457
- mountPath: /redis-master
5558
name: config
56-
{{ if eq .Values.useKubernetesSecret "false"}}
59+
{{- $additionalVolumeMounts := include "resc.redisAdditionalVolumeMounts" . }}
60+
{{- if $additionalVolumeMounts }}
5761
{{- with include "resc.redisAdditionalVolumeMounts" .}}
5862
{{- nindent 8 .}}
5963
{{- end }}
60-
{{ end }}
64+
{{- end }}
6165
volumes:
6266
- name: data
6367
emptyDir: {}
@@ -67,10 +71,11 @@ spec:
6771
items:
6872
- key: redis-config
6973
path: redis.conf
70-
{{ if eq .Values.useKubernetesSecret "false"}}
74+
{{- $additionalVolumes := include "resc.redisAdditionalVolumes" . }}
75+
{{- if $additionalVolumes }}
7176
{{- with include "resc.redisAdditionalVolumes" .}}
7277
{{- nindent 8 .}}
7378
{{- end }}
74-
{{ end }}
79+
{{- end }}
7580

7681

‎deployment/kubernetes/charts/resc-redis/templates/redis_service.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ metadata:
66
labels:
77
app: {{ .Values.global.appName }}
88
tier: redis
9+
annotations:
10+
datree.skip/SERVICE_INCORRECT_TYPE_VALUE_NODEPORT: irrelevant as its only exposed for local environment and can be enabled/disabled from env specific values.yaml
911
spec:
1012
{{ if and (eq .Values.global.enableInClusterRedis "true") (.Values.redis.exposeToHostPort)}}
1113
type: NodePort

‎deployment/kubernetes/charts/resc-redis/values.yaml

+5-5
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
11
redis:
2+
image:
3+
repository:
4+
name: redis
5+
tag: 7.0.11-alpine
6+
pullPolicy: IfNotPresent
27
resources:
38
requests:
49
cpu: 250m
510
memory: 256Mi
611
limits:
712
cpu: 250m
813
memory: 256Mi
9-
image:
10-
repository:
11-
name: redis
12-
tag: 7.0.11-alpine
13-
pullPolicy: IfNotPresent
1414
config:
1515
port: 6379
1616
password:

‎deployment/kubernetes/charts/resc-vcs-scanner-secrets/templates/vcs_scanner_secrets_deployment.yaml

+6-4
Original file line numberDiff line numberDiff line change
@@ -57,11 +57,12 @@ spec:
5757
- name: config-volume
5858
mountPath: {{ .Values.config.vcs_instance_file_path }}
5959
subPath: vcs_instances_config.json
60-
{{ if eq .Values.useKubernetesSecret "false"}}
60+
{{- $additionalVolumeMounts := include "resc.vcsScannerSecretsAdditionalVolumeMounts" . }}
61+
{{- if $additionalVolumeMounts }}
6162
{{- with include "resc.vcsScannerSecretsAdditionalVolumeMounts" .}}
6263
{{- nindent 12 .}}
6364
{{- end }}
64-
{{ end }}
65+
{{- end }}
6566
env:
6667
- name: GET_HOSTS_FROM
6768
value: dns
@@ -80,11 +81,12 @@ spec:
8081
- name: config-volume
8182
configMap:
8283
name: {{ .Values.global.appName }}-vcs-instances-config
83-
{{ if eq .Values.useKubernetesSecret "false"}}
84+
{{- $additionalVolumes := include "resc.vcsScannerSecretsAdditionalVolumes" . }}
85+
{{- if $additionalVolumes }}
8486
{{- with include "resc.vcsScannerSecretsAdditionalVolumes" .}}
8587
{{- nindent 8 .}}
8688
{{- end }}
87-
{{ end }}
89+
{{- end }}
8890
restartPolicy: {{ .Values.restartPolicy }}
8991
{{ if .Values.global.imagePullSecret }}
9092
imagePullSecrets:

‎deployment/kubernetes/charts/resc-vcs-scraper-projects/templates/vcs_scraper_projects_cron_job.yaml

+7-4
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ spec:
77
suspend: {{ .Values.suspend }}
88
schedule: "{{ .Values.config.schedule }}"
99
concurrencyPolicy: Forbid
10+
startingDeadlineSeconds: {{ .Values.config.startingDeadlineSeconds }}
1011
successfulJobsHistoryLimit: {{ .Values.config.successfulJobsHistoryLimit }}
1112
failedJobsHistoryLimit: {{ .Values.config.failedJobsHistoryLimit }}
1213
jobTemplate:
@@ -57,11 +58,12 @@ spec:
5758
- name: config-volume
5859
mountPath: {{ .Values.config.vcs_instance_file_path }}
5960
subPath: vcs_instances_config.json
60-
{{ if eq .Values.useKubernetesSecret "false"}}
61+
{{- $additionalVolumeMounts := include "resc.vcsScraperProjectsAdditionalVolumeMounts" . }}
62+
{{- if $additionalVolumeMounts }}
6163
{{- with include "resc.vcsScraperProjectsAdditionalVolumeMounts" .}}
6264
{{- nindent 14 .}}
6365
{{- end }}
64-
{{ end }}
66+
{{- end }}
6567
env:
6668
- name: GET_HOSTS_FROM
6769
value: dns
@@ -80,11 +82,12 @@ spec:
8082
- name: config-volume
8183
configMap:
8284
name: {{ .Values.global.appName }}-vcs-instances-config
83-
{{ if eq .Values.useKubernetesSecret "false"}}
85+
{{- $additionalVolumes := include "resc.vcsScraperProjectsAdditionalVolumes" . }}
86+
{{- if $additionalVolumes }}
8487
{{- with include "resc.vcsScraperProjectsAdditionalVolumes" .}}
8588
{{- nindent 12 .}}
8689
{{- end }}
87-
{{ end }}
90+
{{- end }}
8891
restartPolicy: {{ .Values.restartPolicy }}
8992
{{ if .Values.global.imagePullSecret }}
9093
imagePullSecrets:

‎deployment/kubernetes/charts/resc-vcs-scraper-projects/values.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ config:
1212
schedule:
1313
successfulJobsHistoryLimit: 0
1414
failedJobsHistoryLimit: 0
15+
startingDeadlineSeconds: 100
1516
resources:
1617
requests:
1718
cpu: 300m

‎deployment/kubernetes/charts/resc-vcs-scraper-repositories/templates/vcs_scraper_repositories_deployment.yaml

+6-4
Original file line numberDiff line numberDiff line change
@@ -59,11 +59,12 @@ spec:
5959
- name: config-volume
6060
mountPath: {{ .Values.config.vcs_instance_file_path }}
6161
subPath: vcs_instances_config.json
62-
{{ if eq .Values.useKubernetesSecret "false"}}
62+
{{- $additionalVolumeMounts := include "resc.vcsScraperRepositoriesAdditionalVolumeMounts" . }}
63+
{{- if $additionalVolumeMounts }}
6364
{{- with include "resc.vcsScraperRepositoriesAdditionalVolumeMounts" .}}
6465
{{- nindent 10 .}}
6566
{{- end }}
66-
{{ end }}
67+
{{- end }}
6768
env:
6869
- name: GET_HOSTS_FROM
6970
value: dns
@@ -86,11 +87,12 @@ spec:
8687
- name: config-volume
8788
configMap:
8889
name: {{ .Values.global.appName }}-vcs-instances-config
89-
{{ if eq .Values.useKubernetesSecret "false"}}
90+
{{- $additionalVolumes := include "resc.vcsScraperRepositoriesAdditionalVolumes" . }}
91+
{{- if $additionalVolumes }}
9092
{{- with include "resc.vcsScraperRepositoriesAdditionalVolumes" .}}
9193
{{- nindent 8 .}}
9294
{{- end }}
93-
{{ end }}
95+
{{- end }}
9496
restartPolicy: {{ .Values.restartPolicy }}
9597
{{ if .Values.global.imagePullSecret }}
9698
imagePullSecrets:

‎deployment/kubernetes/datree-policies.yaml

+6-6
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,9 @@ policies:
66
- identifier: INGRESS_INCORRECT_HOST_VALUE_PERMISSIVE
77
messageOnFailure: Incorrect value for key `host` - specify host instead of using a wildcard character ("*")
88
#- identifier: CONTAINERS_MISSING_IMAGE_VALUE_VERSION # Not applicable to RESC
9-
# messageOnFailure: Incorrect value for key `image` - specify an image version to avoid unpleasant "version surprises" in the future
10-
- identifier: DEPLOYMENT_MISSING_LABEL_ENV_VALUE
11-
messageOnFailure: 'Missing label object `env` - add a proper environment description (e.g. "prod", "testing", etc.) to the Deployment config'
9+
# messageOnFailure: Incorrect value for key `image` - specify an image version to avoid unpleasant "version surprises" in the future
10+
# - identifier: DEPLOYMENT_MISSING_LABEL_ENV_VALUE # Not applicable to RESC
11+
# messageOnFailure: 'Missing label object `env` - add a proper environment description (e.g. "prod", "testing", etc.) to the Deployment config'
1212
- identifier: CONTAINERS_MISSING_CPU_REQUEST_KEY
1313
messageOnFailure: Missing property object `requests.cpu` - value should be within the accepted boundaries recommended by the organization
1414
- identifier: CRONJOB_INVALID_SCHEDULE_VALUE
@@ -25,12 +25,12 @@ policies:
2525
messageOnFailure: Incorrect value for key `hostPID` - running on the host’s PID namespace enables access to sensitive information from processes running outside the container
2626
- identifier: K8S_DEPRECATED_APIVERSION_1.16
2727
messageOnFailure: Incorrect value for key `apiVersion` - the version you are trying to use is not supported by the Kubernetes cluster version (>=1.16)
28-
- identifier: CONTAINERS_MISSING_IMAGE_VALUE_DIGEST
29-
messageOnFailure: 'Incorrect value for key `image` - add a digest tag (starts with `@sha256:`) to represent an immutable version of the image'
28+
# - identifier: CONTAINERS_MISSING_IMAGE_VALUE_DIGEST # Not applicable to RESC, version tag is better and we don't want to update our Kubernetes manifests with image digest tag on everytime we public a image
29+
# messageOnFailure: 'Incorrect value for key `image` - add a digest tag (starts with `@sha256:`) to represent an immutable version of the image'
3030
- identifier: CONTAINERS_INCORRECT_HOSTIPC_VALUE_TRUE
3131
messageOnFailure: Incorrect value for key `hostIPC` - running on the host’s IPC namespace can be (maliciously) used to interact with other processes running outside the container
3232
# - identifier: DEPLOYMENT_INCORRECT_REPLICAS_VALUE # Not applicable to RESC
33-
# messageOnFailure: Incorrect value for key `replicas` - don't relay on a single pod to do all of the work. Running 2 or more replicas will increase the availability of the service
33+
# messageOnFailure: Incorrect value for key `replicas` - don't relay on a single pod to do all of the work. Running 2 or more replicas will increase the availability of the service
3434
- identifier: HPA_MISSING_MAXREPLICAS_KEY
3535
messageOnFailure: Missing property object `maxReplicas` - the value should be within the accepted boundaries recommended by the organization
3636
- identifier: CONTAINERS_MISSING_READINESSPROBE_KEY

‎deployment/kubernetes/example-values.yaml

-4
Original file line numberDiff line numberDiff line change
@@ -122,10 +122,6 @@ resc-redis:
122122
config:
123123
port: 6379
124124
password: "Y0urStr0ngPassword" # <enter Redis password here for caching, default to Y0urStr0ngPassword>
125-
resources:
126-
limits:
127-
cpu: 250m
128-
memory: 256Mi
129125

130126
resc-vcs-instances:
131127
vcsInstances:

‎deployment/kubernetes/templates/web_service_deployment.tpl

+6-4
Original file line numberDiff line numberDiff line change
@@ -59,11 +59,12 @@ spec:
5959
- name: config-volume
6060
mountPath: /tmp/odbc.ini
6161
subPath: odbc.ini
62-
{{ if eq .Values.useKubernetesSecret "false"}}
62+
{{- $additionalVolumeMounts := include "resc.rescWebserviceAdditionalVolumeMounts" . }}
63+
{{- if $additionalVolumeMounts }}
6364
{{- with include "resc.rescWebserviceAdditionalVolumeMounts" .}}
6465
{{- nindent 12 .}}
6566
{{- end }}
66-
{{ end }}
67+
{{- end }}
6768
securityContext:
6869
allowPrivilegeEscalation: false
6970
readOnlyRootFilesystem: false
@@ -87,11 +88,12 @@ spec:
8788
- name: config-volume
8889
configMap:
8990
name: {{ .Values.global.appName }}-web-service-config{{ .Values.nameSuffix }}
90-
{{ if eq .Values.useKubernetesSecret "false"}}
91+
{{- $additionalVolumes := include "resc.rescWebserviceAdditionalVolumes" . }}
92+
{{- if $additionalVolumes }}
9193
{{- with include "resc.rescWebserviceAdditionalVolumes" .}}
9294
{{- nindent 8 .}}
9395
{{- end }}
94-
{{ end }}
96+
{{- end }}
9597
{{ if .Values.global.imagePullSecret }}
9698
imagePullSecrets:
9799
- name: {{ .Values.global.imagePullSecret }}

‎deployment/kubernetes/templates/web_service_service.tpl

+2
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ metadata:
77
labels:
88
app: {{ .Values.global.appName }}
99
tier: api{{ .Values.nameSuffix }}
10+
annotations:
11+
datree.skip/SERVICE_INCORRECT_TYPE_VALUE_NODEPORT: irrelevant as its only exposed for local environment and can be enabled/disabled from env specific values.yaml
1012
spec:
1113
{{ if .Values.exposeToHostPort }}
1214
type: NodePort

‎deployment/resc-helm-wizard/src/resc_helm_wizard/config/example-values.yaml

-4
Original file line numberDiff line numberDiff line change
@@ -122,10 +122,6 @@ resc-redis:
122122
config:
123123
port: 6379
124124
password: "Y0urStr0ngPassword" # <enter Redis password here for caching, default to Y0urStr0ngPassword>
125-
resources:
126-
limits:
127-
cpu: 250m
128-
memory: 256Mi
129125

130126
resc-vcs-instances:
131127
vcsInstances:

0 commit comments

Comments
 (0)