Merge branch 'master' into targets

J12934 · J12934 · commit 09f8a2a99b47 · 2020-03-26T17:36:59.000+01:00
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -17,11 +17,10 @@ jobs:
       - name: "Build'n Push Operator"
         uses: docker/build-push-action@v1
         with:
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-          repository: j12934/securecodebox/operator
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+          repository: scbexperimental/operator
           tag_with_ref: true
-          registry: docker.pkg.github.com
           path: ./operator/
   lurcher:
     name: "Lurcher"
@@ -39,11 +38,10 @@ jobs:
       - uses: docker/build-push-action@v1
         name: "Build & Push Lurcher Image"
         with:
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-          repository: j12934/securecodebox/lurcher
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+          repository: scbexperimental/lurcher
           tag_with_ref: true
-          registry: docker.pkg.github.com
           path: ./lurcher/
   integrations:
     name: "Node Unit Tests"
@@ -93,47 +91,42 @@ jobs:
       - uses: docker/build-push-action@v1
         name: "Build & Push Parser SDK"
         with:
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-          repository: j12934/securecodebox/parser-sdk-nodejs
-          registry: docker.pkg.github.com
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+          repository: scbexperimental/parser-sdk-nodejs
           path: ./parser-sdk/nodejs/
           tag_with_ref: true
       # Actual Parsers
       - uses: docker/build-push-action@v1
         name: "Build & Push Amass Parser Image"
         with:
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-          repository: j12934/securecodebox/parser-amass
-          registry: docker.pkg.github.com
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+          repository: scbexperimental/parser-amass
           path: ./integrations/amass/parser/
           tag_with_ref: true
       - uses: docker/build-push-action@v1
         name: "Build & Push Nmap Parser Image"
         with:
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-          repository: j12934/securecodebox/parser-nmap
-          registry: docker.pkg.github.com
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+          repository: scbexperimental/parser-nmap
           path: ./integrations/nmap/parser/
           tag_with_ref: true
       - uses: docker/build-push-action@v1
         name: "Build & Push ssh_scan Parser Image"
         with:
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-          repository: j12934/securecodebox/parser-ssh-scan
-          registry: docker.pkg.github.com
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+          repository: scbexperimental/parser-ssh-scan
           path: ./integrations/ssh_scan/parser/
           tag_with_ref: true
       - uses: docker/build-push-action@v1
         name: "Build & Push OWASP Zap Parser Image"
         with:
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-          repository: j12934/securecodebox/parser-zap
-          registry: docker.pkg.github.com
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+          repository: scbexperimental/parser-zap
           path: ./integrations/zap/parser/
           tag_with_ref: true
   persistenceImages:
@@ -145,22 +138,28 @@ jobs:
       - uses: docker/build-push-action@v1
         name: "Build & Push Persistence SDK"
         with:
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-          repository: j12934/securecodebox/persistence-sdk-nodejs
-          registry: docker.pkg.github.com
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+          repository: scbexperimental/persistence-sdk-nodejs
           path: ./persistence-sdk/nodejs/
           tag_with_ref: true
       # Actual PersistenceProviders
       - uses: docker/build-push-action@v1
         name: "Build & Push Elastic PersistenceProvider Image"
         with:
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-          repository: j12934/securecodebox/persistence-elastic
-          registry: docker.pkg.github.com
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+          repository: scbexperimental/persistence-elastic
           path: ./persistence/persistence-elastic/
           tag_with_ref: true
+      - uses: docker/build-push-action@v1
+        name: "Build & Push Elastic PersistenceProvider Dashboard Importer Image"
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+          repository: scbexperimental/persistence-elastic-dashboard-importer
+          path: ./persistence/persistence-elastic/dashboardImporter/
+          tag_with_ref: true
   scannerImages:
     # Note we only build images for scanner that don't provider official public container images
     name: "Build Scanner Images"
@@ -170,10 +169,9 @@ jobs:
       - uses: docker/build-push-action@v1
         name: "Build & Push Nmap Scanner Image"
         with:
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-          repository: j12934/securecodebox/nmap
-          registry: docker.pkg.github.com
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+          repository: scbexperimental/nmap
           path: ./integrations/nmap/scanner/
           # Note: not prefixed with a "v" as this seems to match nmap versioning standards
           tags: "7.80,7.80-1,latest"
diff --git a/integrations/amass/amass-parsejob-definition.yaml b/integrations/amass/amass-parsejob-definition.yaml
@@ -1,7 +1,7 @@
-apiVersion: "scans.experimental.securecodebox.io/v1"
+apiVersion: 'scans.experimental.securecodebox.io/v1'
 kind: ParseDefinition
 metadata:
-  name: "amass-jsonl"
+  name: 'amass-jsonl'
 spec:
   handlesResultsType: amass-jsonl
-  image: scbexperimental/amass-parser
+  image: scbexperimental/parser-amass
diff --git a/integrations/amass/parser/Dockerfile b/integrations/amass/parser/Dockerfile
@@ -1,3 +1,3 @@
-FROM scbexperimental/parser-sdk:nodejs12
+FROM scbexperimental/parser-sdk-nodejs:latest
 WORKDIR /home/app/parser-wrapper/parser/
 COPY --chown=app:app ./parser.js ./parser.js
diff --git a/integrations/nmap/nmap-parsejob-definition.yaml b/integrations/nmap/nmap-parsejob-definition.yaml
@@ -4,4 +4,4 @@ metadata:
   name: "nmap-xml"
 spec:
   handlesResultsType: nmap-xml
-  image: scbexperimental/nmap-parser
+  image: scbexperimental/parser-nmap
diff --git a/integrations/nmap/nmap-scanjob-definition.yaml b/integrations/nmap/nmap-scanjob-definition.yaml
@@ -14,5 +14,5 @@ spec:
           restartPolicy: OnFailure
           containers:
             - name: nmap
-              image: scbexperimental/nmap:7.80-r2
+              image: scbexperimental/nmap:7.80
               command: ["nmap", "-oX", "/home/securecodebox/nmap-results.xml"]
diff --git a/integrations/nmap/parser/Dockerfile b/integrations/nmap/parser/Dockerfile
@@ -4,7 +4,7 @@ WORKDIR /home/app
 COPY package.json package-lock.json ./
 RUN npm ci --production
 
-FROM scbexperimental/parser-sdk:nodejs12
+FROM scbexperimental/parser-sdk-nodejs:latest
 WORKDIR /home/app/parser-wrapper/parser/
 COPY --from=build --chown=app:app /home/app/node_modules/ ./node_modules/
 COPY --chown=app:app ./parser.js ./parser.js
diff --git a/integrations/ssh_scan/parser/Dockerfile b/integrations/ssh_scan/parser/Dockerfile
@@ -1,3 +1,3 @@
-FROM scbexperimental/parser-sdk:nodejs12
+FROM scbexperimental/parser-sdk-nodejs:latest
 WORKDIR /home/app/parser-wrapper/parser/
 COPY --chown=app:app ./parser.js ./parser.js
diff --git a/integrations/ssh_scan/ssh-scan-parsejob-definition.yaml b/integrations/ssh_scan/ssh-scan-parsejob-definition.yaml
@@ -4,4 +4,4 @@ metadata:
   name: "ssh-scan-json"
 spec:
   handlesResultsType: ssh-scan-json
-  image: scbexperimental/ssh-scan-parser
+  image: scbexperimental/parser-ssh-scan
diff --git a/integrations/ssh_scan/ssh-scan-scanjob-definition.yaml b/integrations/ssh_scan/ssh-scan-scanjob-definition.yaml
@@ -1,12 +1,12 @@
-apiVersion: "scans.experimental.securecodebox.io/v1"
+apiVersion: 'scans.experimental.securecodebox.io/v1'
 kind: ScanTemplate
 metadata:
-  name: "ssh-scan"
+  name: 'ssh-scan'
 spec:
-  name: "ssh-scan"
+  name: 'ssh-scan'
   extractResults:
     type: ssh-scan-json
-    location: "/home/securecodebox/ssh-scan-results.json"
+    location: '/home/securecodebox/ssh-scan-results.json'
   jobTemplate:
     spec:
       ttlSecondsAfterFinished: 10
@@ -17,6 +17,6 @@ spec:
             - name: ssh-scan
               image: mozilla/ssh_scan
               command:
-                - "/app/bin/ssh_scan"
-                - "--output"
-                - "/home/securecodebox/ssh-scan-results.json"
+                - '/app/bin/ssh_scan'
+                - '--output'
+                - '/home/securecodebox/ssh-scan-results.json'
diff --git a/integrations/zap/parser/Dockerfile b/integrations/zap/parser/Dockerfile
@@ -1,3 +1,3 @@
-FROM scbexperimental/parser-sdk:nodejs12
+FROM scbexperimental/parser-sdk-nodejs:latest
 WORKDIR /home/app/parser-wrapper/parser/
 COPY --chown=app:app ./parser.js ./parser.js
diff --git a/integrations/zap/zap-parsejob-definition.yaml b/integrations/zap/zap-parsejob-definition.yaml
@@ -4,4 +4,4 @@ metadata:
   name: "zap-json"
 spec:
   handlesResultsType: zap-json
-  image: scbexperimental/zap-parser
+  image: scbexperimental/parser-zap
diff --git a/integrations/zap/zap-scanjob-definitions.yaml b/integrations/zap/zap-scanjob-definitions.yaml
@@ -1,11 +1,11 @@
-apiVersion: "scans.experimental.securecodebox.io/v1"
+apiVersion: 'scans.experimental.securecodebox.io/v1'
 kind: ScanTemplate
 metadata:
-  name: "zap-baseline"
+  name: 'zap-baseline'
 spec:
   extractResults:
     type: zap-json
-    location: "/home/securecodebox/zap-results.json"
+    location: '/home/securecodebox/zap-results.json'
   jobTemplate:
     spec:
       ttlSecondsAfterFinished: 10
@@ -16,26 +16,26 @@ spec:
             - name: zap-baseline
               image: owasp/zap2docker-bare:2.9.0
               command:
-                - "zap-baseline.py"
-                - "-J"
+                - 'zap-baseline.py'
+                - '-J'
                 # ZAP Baseline Script doesn't allow absolute paths...
                 # Hacky workaround: specify a relative path to the `/zap/wrk` base dir.
-                - "../../home/securecodebox/zap-results.json"
+                - '../../home/securecodebox/zap-results.json'
               volumeMounts:
                 - mountPath: /zap/wrk
                   name: zap-workdir
           volumes:
             - name: zap-workdir
               emptyDir: {}
 ---
-apiVersion: "scans.experimental.securecodebox.io/v1"
+apiVersion: 'scans.experimental.securecodebox.io/v1'
 kind: ScanTemplate
 metadata:
-  name: "zap-api-scan"
+  name: 'zap-api-scan'
 spec:
   extractResults:
     type: zap-json
-    location: "/home/securecodebox/zap-results.json"
+    location: '/home/securecodebox/zap-results.json'
   jobTemplate:
     spec:
       ttlSecondsAfterFinished: 10
@@ -46,26 +46,26 @@ spec:
             - name: zap-api-scan
               image: owasp/zap2docker-bare:2.9.0
               command:
-                - "zap-api-scan.py"
-                - "-J"
+                - 'zap-api-scan.py'
+                - '-J'
                 # ZAP Baseline Script doesn't allow absolute paths...
                 # Hacky workaround: specify a relative path to the `/zap/wrk` base dir.
-                - "../../home/securecodebox/zap-results.json"
+                - '../../home/securecodebox/zap-results.json'
               volumeMounts:
                 - mountPath: /zap/wrk
                   name: zap-workdir
           volumes:
             - name: zap-workdir
               emptyDir: {}
 ---
-apiVersion: "scans.experimental.securecodebox.io/v1"
+apiVersion: 'scans.experimental.securecodebox.io/v1'
 kind: ScanTemplate
 metadata:
-  name: "zap-full-scan"
+  name: 'zap-full-scan'
 spec:
   extractResults:
     type: zap-json
-    location: "/home/securecodebox/zap-results.json"
+    location: '/home/securecodebox/zap-results.json'
   jobTemplate:
     spec:
       ttlSecondsAfterFinished: 10
@@ -76,11 +76,11 @@ spec:
             - name: zap-full-scan
               image: owasp/zap2docker-bare:2.9.0
               command:
-                - "zap-full-scan.py"
-                - "-J"
+                - 'zap-full-scan.py'
+                - '-J'
                 # ZAP Baseline Script doesn't allow absolute paths...
                 # Hacky workaround: specify a relative path to the `/zap/wrk` base dir.
-                - "../../home/securecodebox/zap-results.json"
+                - '../../home/securecodebox/zap-results.json'
               volumeMounts:
                 - mountPath: /zap/wrk
                   name: zap-workdir
diff --git a/lurcher/go.mod b/lurcher/go.mod
@@ -1,4 +1,4 @@
-module github.com/j12934/secureCodeBox/lurcher
+module github.com/secureCodeBox/secureCodeBox-v2-alpha/lurcher
 
 go 1.13
 
diff --git a/lurcher/job.yaml b/lurcher/job.yaml
@@ -12,14 +12,15 @@ spec:
           image: alpine
           command: ["sleep", "5"]
         - name: lurcher
-          image: scbexperimental/lurcher:go-version
+          image: scbexperimental
           imagePullPolicy: IfNotPresent
           args:
             - "--container"
             - "primary"
             - "--file"
             - "/home/securecodebox/result.xml"
             - "--url"
+            # This URL has been expired for quite some time ;) To test this you'll need to generate a new one.
             - "https://fra1.digitaloceanspaces.com/securecodebox/scan/result.xml?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=NWN2DEMTNFQUTQB5SZ6A%2F20200312%2Ffra1%2Fs3%2Faws4_request&X-Amz-Date=20200312T180859Z&X-Amz-Expires=43200&X-Amz-SignedHeaders=host&X-Amz-Signature=852dc4576ff5b6195b9f6a7dd49851cc701a2fb59fb23db6e7c7913f412f0460"
           env:
             - name: NAMESPACE
diff --git a/operator/PROJECT b/operator/PROJECT
@@ -1,5 +1,5 @@
 domain: experimental.securecodebox.io
-repo: github.com/J12934/secureCodeBox/operator/
+repo: github.com/secureCodeBox/secureCodeBox-v2-alpha/operator/
 resources:
 - group: scans
   kind: Scan
diff --git a/operator/config/manager/kustomization.yaml b/operator/config/manager/kustomization.yaml
@@ -1,8 +1,8 @@
 resources:
-- manager.yaml
+  - manager.yaml
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 images:
-- name: controller
-  newName: scbexperimental/operator
-  newTag: latest
+  - name: controller
+    newName: scbexperimental/operator
+    newTag: latest
diff --git a/operator/config/samples/scans_v1_scantemplate.yaml b/operator/config/samples/scans_v1_scantemplate.yaml
@@ -15,4 +15,4 @@ spec:
           containers:
             - name: nmap
               image: scbexperimental/nmap:7.80-r2
-              command: ["nmap", "-oX", "/home/securecodebox/nmap-results.xml"]
+              command: ["nmap", "-oX", "/home/securecodebox/nmap-results.xml"]
diff --git a/operator/controllers/scan_controller.go b/operator/controllers/scan_controller.go
@@ -298,7 +298,8 @@ func (r *ScanReconciler) startParser(scan *scansv1.Scan) error {
 		Spec: batch.JobSpec{
 			Template: corev1.PodTemplateSpec{
 				Spec: corev1.PodSpec{
-					RestartPolicy: corev1.RestartPolicyNever,
+					RestartPolicy:      corev1.RestartPolicyNever,
+					ServiceAccountName: "parser",
 					Containers: []corev1.Container{
 						{
 							Name:  "parser",
@@ -581,7 +582,7 @@ func (r *ScanReconciler) startPersistenceProvider(scan *scansv1.Scan) error {
 						RestartPolicy:      corev1.RestartPolicyNever,
 						Containers: []corev1.Container{
 							{
-								Name:  "parser",
+								Name:  "persistence",
 								Image: persistenceProvider.Spec.Image,
 								Args: []string{
 									rawFileURL,
diff --git a/operator/crds/scans.experimental.securecodebox.io_scans.yaml b/operator/crds/scans.experimental.securecodebox.io_scans.yaml
diff --git a/package.json b/package.json
diff --git a/persistence/persistence-elastic/Dockerfile b/persistence/persistence-elastic/Dockerfile
diff --git a/persistence/persistence-elastic/dashboardImporter/Dockerfile b/persistence/persistence-elastic/dashboardImporter/Dockerfile
diff --git a/persistence/persistence-elastic/dashboardImporter/dashboards/daily-summary.json b/persistence/persistence-elastic/dashboardImporter/dashboards/daily-summary.json
diff --git a/persistence/persistence-elastic/dashboardImporter/export-dashboards.sh b/persistence/persistence-elastic/dashboardImporter/export-dashboards.sh
diff --git a/persistence/persistence-elastic/dashboardImporter/import-dashboards.sh b/persistence/persistence-elastic/dashboardImporter/import-dashboards.sh
diff --git a/persistence/persistence-elastic/dashboardImporter/readme.md b/persistence/persistence-elastic/dashboardImporter/readme.md
diff --git a/persistence/persistence-elastic/templates/import-dashboard.yaml b/persistence/persistence-elastic/templates/import-dashboard.yaml
