WIP

Co-authored-by: Jorge Estigarribia <jorgestiga@hotmail.com>
Co-authored-by: Yannik Fuhrmeister <12710254+fuhrmeistery@users.noreply.github.com>

Author: 3 people

operator/apis/execution/v1/scan_types.go

@@ -45,6 +45,26 @@ type ScanStatus struct {
 	RawResultFile string `json:"rawResultFile,omitempty"`
 
 	Findings FindingStats `json:"findings,omitempty"`
+
+	ReadAndWriteHookStatus []HookStatus `json:"readAndWriteHookStatus,omitempty"`
+}
+
+// HookState Describes the State of a Hook on a Scan
+type HookState string
+
+const (
+	Pending    HookState = "Pending"
+	InProgress HookState = "InProgress"
+	Completed  HookState = "Completed"
+
+	// Cancelled  HookState = "Cancelled"
+	// Failed  HookState = "Failed"
+)
+
+type HookStatus struct {
+	HookName string    `json:"hookName"`
+	State    HookState `json:"state"`
+	JobName  string    `json:"jobName"`
 }
 
 // FindingStats contains the general stats about the results of the scan

operator/config/crd/bases/execution.experimental.securecodebox.io_scans.yaml

@@ -113,6 +113,21 @@ spec:
               description: RawResultType determines which kind of ParseDefinition
                 will be used to turn the raw results of the scanner into findings
               type: string
+            readAndWriteHookStatus:
+              items:
+                properties:
+                  hookName:
+                    type: string
+                  jobName:
+                    type: string
+                  state:
+                    type: string
+                required:
+                - hookName
+                - jobName
+                - state
+                type: object
+              type: array
             state:
               type: string
           type: object

operator/config/samples/Dockerfile

@@ -1,2 +1,2 @@
 FROM alpine
-CMD [sleep, 5s]
+ENTRYPOINT [sleep, 5s]

…es/execution_v1_persistenceprovider.yaml …g/samples/execution_v1_readonlyhook.yamloperator/config/samples/execution_v1_persistenceprovider.yaml renamed to operator/config/samples/execution_v1_readonlyhook.yaml operator/config/samples/execution_v1_persistenceprovider.yaml renamed to operator/config/samples/execution_v1_readonlyhook.yaml

@@ -1,9 +1,33 @@
-apiVersion: "execution.experimental.securecodebox.io/v1"
+apiVersion: execution.experimental.securecodebox.io/v1
 kind: Scan
 metadata:
-  name: "nmap-localhost"
+  finalizers:
+    - s3.storage.experimental.securecodebox.io
+  name: nmap-localhost
+  namespace: default
 spec:
-  scanType: "nmap"
   parameters:
-    - "-Pn"
+    - -Pn
     - localhost
+  scanType: nmap
+status:
+  state: Errored
+  errorDescription: At least one ReadOnlyHook failed, check the hooks kubernetes jobs related to the scan for more details.
+  findings:
+    categories:
+      Host: 1
+    count: 1
+    severities:
+      informational: 1
+  rawResultFile: nmap-results.xml
+  rawResultType: nmap-xml
+  readAndWriteHookStatus:
+    - hookName: luy-metadata
+      state: Completed
+      jobName: luy-metadata-123123
+    - hookName: finding-priority
+      state: Error
+      jobName: finding-priority-123123
+      error: "Job failed"
+    - hookName: hook-3
+      state: Pending

operator/config/samples/execution_v1_scan/nmap_localhost.yaml

@@ -113,6 +113,23 @@ func (r *ScanReconciler) Reconcile(req ctrl.Request) (ctrl.Result, error) {
 	case "Parsing":
 		err = r.checkIfParsingIsCompleted(&scan)
 	case "ParseCompleted":
+		// Hook status erstellen
+		// List all ReadAndWrite Hook -> Hook Status an Scan hängen
+		// Scan State auf ReadAndWriteHookProcessing setzen
+	case "ReadAndWriteHookProcessing":
+		// Hook Status Array durchgegen
+
+		// hook := First Array entry which is not Completed.
+
+		// if hook == "Pending" => create Job
+		// if hook == "InProgress" =>
+		//	 if job == "Completed" => hook = "Completed"
+		//	 (if job == "Failed" => hook = "Failed" => scan = "Failed")
+
+		// hook = nil => scan = "ReadAndWriteHookCompleted"
+
+		// Scan Status auf ReadAndWriteHookCompleted setzen
+	case "ReadAndWriteHookCompleted":
 		err = r.startReadOnlyHooks(&scan)
 	case "ReadOnlyHookProcessing":
 		err = r.checkIfReadOnlyHookIsCompleted(&scan)

operator/controllers/execution/scan_controller.go

@@ -1,10 +1,11 @@
 apiVersion: "execution.experimental.securecodebox.io/v1"
-kind: PersistenceProvider
+kind: ScanCompletionHook
 metadata:
   name: {{ include "persistence-elastic.fullname" . }}
   labels:
     type: Structured
 spec:
+  type: ReadOnly
   image: "scbexperimental/persistence-elastic:latest"
   {{- if .Values.image.digest }}
   image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}@{{ .Values.image.digest }}"