Merge pull request #51 from DelusionalOptimist/fix-prod

.github/workflows/push-image.yaml

@@ -0,0 +1,46 @@
+name: build accuknox-job image workflow
+
+on:
+  push:
+    tags:
+    - '*'
+    branches:
+    - "main"
+
+jobs:
+  push_to_registry:
+    name: Push Docker image to Docker Hub
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_HUB_USER }}
+          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+
+      - name: Determine version
+        id: vars
+        run: |
+          if [ ${{ github.ref }} == "refs/heads/main" ]; then
+            echo "tag=latest" >> $GITHUB_OUTPUT
+          else
+            echo "tag=${GITHUB_REF#refs/*/}" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Set git ssh private key
+        run: echo "${{ secrets.GIT_KEY }}" > GIT-KEY
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v6
+        with:
+          # equivalent of make docker-build
+          context: .
+          file: Dockerfile
+          push: true
+          tags: accuknox/accuknox-job:${{ steps.vars.outputs.tag }}

Dockerfile

@@ -2,9 +2,5 @@ FROM alpine:latest
 
 RUN apk --update add jq curl
 COPY entrypoint.sh .
-COPY curl_command.sh .
-
-# Grant execute permissions to the scripts
-RUN chmod +x entrypoint.sh curl_command.sh
 
 ENTRYPOINT ["/bin/sh", "entrypoint.sh"]

cis-k8s-job/templates/cis-cron-job.yaml

@@ -10,115 +10,53 @@ spec:
     spec:
       template:
         spec:
+        {{- if or (or (contains "master" .Values.toolConfig.nodeType) (contains "controlplane" .Values.toolConfig.nodeType)) (or (contains "master" .Values.toolConfig.targets) (contains "controlplane" .Values.toolConfig.targets)) }}
+          {{- include "masterConfig" .Values.toolConfig | trim | nindent 10 }}
+        {{- end }}
+        {{- if .Values.imagePullSecrets.name }}
+          imagePullSecrets:
+          - name: {{ .Values.imagePullSecrets.name }}
+        {{- end }}
           containers:
-          - image: accuknox/accuknox-job:latest
+          - image: "{{ .Values.accuknoxJob.image.repository }}:{{ .Values.accuknoxJob.image.tag }}" 
             command: ["/bin/sh", "-c"]
-            args: ['/bin/sh entrypoint.sh && ./curl_command.sh']
+            args: ['/bin/sh entrypoint.sh && curl --location --request POST "https://${URL}/api/v1/artifact/?tenant_id=${TENANT_ID}&data_type=KB&label_id=${LABEL_NAME}&save_to_s3=true" --header "Tenant-Id: ${TENANT_ID}" --header "Authorization: Bearer ${AUTH_TOKEN}" --form "file=@\"./data/report.json\"" && cat /data/report.json']
             name: cis-k8s-cronjob
             resources: {}
             env:
               - name: AUTH_TOKEN
-                value: {{ .Values.accuknox.authToken }}
+                valueFrom:
+                  secretKeyRef:
+                    key: AUTH_TOKEN
+                    {{- if (.Values.accuknox.secretName | empty) }}
+                    name: cis-k8s-job-auth-token
+                    {{- else }}
+                    name: {{ .Values.accuknox.secretName }}
+                    {{- end }}
               - name: CLUSTER_NAME
                 value: {{ .Values.accuknox.clusterName }}
               - name: LABEL_NAME
                 value: {{ .Values.accuknox.label }}
               - name: CLUSTER_ID
-                value: {{ .Values.accuknox.clusterID }}
+                value: {{ .Values.accuknox.clusterId }}
               - name: TENANT_ID
-                value: {{ .Values.accuknox.tenantID | quote}}
+                value: {{ .Values.accuknox.tenantId | quote}}
               - name: URL
-                value: {{ .Values.accuknox.URL }}
-              - name: CERT_BUNDLE_PATH
-                value: {{ .Values.accuknox.certBundlePath | quote }}
-              - name: CERT_BUNDLE_URL
-                value: {{ .Values.accuknox.certBundleURL }}
-              - name: USE_INSECURE_CONNECTION
-                value: {{ .Values.accuknox.useInsecureConnection | quote }}
-              - name: DATA_TYPE
-                value: "KB"
+                value: {{ .Values.accuknox.url }}
             volumeMounts:
             - mountPath: /data
               name: datapath
           initContainers:
-          - image: docker.io/aquasec/kube-bench:v0.6.19
-            command: ["/bin/sh", "-c"]
-            args: ["kube-bench run --json > /data/report.json"]
+          - image: "{{ .Values.kubeBench.image.repository }}:{{ .Values.kubeBench.image.tag }}" 
+            command:
+            {{- include "cmd" .Values.toolConfig | trim | nindent 13 }}
             name: kube-bench
             volumeMounts:
-            - mountPath: /data
-              name: datapath
-            - mountPath: /var/lib/etcd
-              name: var-lib-etcd
-              readOnly: true
-            - mountPath: /var/lib/kubelet
-              name: var-lib-kubelet
-              readOnly: true
-            - mountPath: /var/lib/kube-scheduler
-              name: var-lib-kube-scheduler
-              readOnly: true
-            - mountPath: /var/lib/kube-controller-manager
-              name: var-lib-kube-controller-manager
-              readOnly: true
-            - mountPath: /etc/systemd
-              name: etc-systemd
-              readOnly: true
-            - mountPath: /lib/systemd/
-              name: lib-systemd
-              readOnly: true
-            - mountPath: /srv/kubernetes/
-              name: srv-kubernetes
-              readOnly: true
-            - mountPath: /etc/kubernetes
-              name: etc-kubernetes
-              readOnly: true
-            - mountPath: /usr/local/mount-from-host/bin
-              name: usr-bin
-              readOnly: true
-            - mountPath: /etc/cni/net.d/
-              name: etc-cni-netd
-              readOnly: true
-            - mountPath: /opt/cni/bin/
-              name: opt-cni-bin
-              readOnly: true
+            {{- include "volumeMounts" .Values.toolConfig | trim | nindent 13 }}
           hostPID: true
           restartPolicy: Never
           volumes:
-            - name: datapath
-              emptyDir: {}
-            - hostPath:
-                path: /var/lib/etcd
-              name: var-lib-etcd
-            - hostPath:
-                path: /var/lib/kubelet
-              name: var-lib-kubelet
-            - hostPath:
-                path: /var/lib/kube-scheduler
-              name: var-lib-kube-scheduler
-            - hostPath:
-                path: /var/lib/kube-controller-manager
-              name: var-lib-kube-controller-manager
-            - hostPath:
-                path: /etc/systemd
-              name: etc-systemd
-            - hostPath:
-                path: /lib/systemd
-              name: lib-systemd
-            - hostPath:
-                path: /srv/kubernetes
-              name: srv-kubernetes
-            - hostPath:
-                path: /etc/kubernetes
-              name: etc-kubernetes
-            - hostPath:
-                path: /usr/bin
-              name: usr-bin
-            - hostPath:
-                path: /etc/cni/net.d/
-              name: etc-cni-netd
-            - hostPath:
-                path: /opt/cni/bin/
-              name: opt-cni-bin
+          {{- include "volumes" .Values.toolConfig | trim | nindent 11 }}
 
   schedule: "{{ .Values.accuknox.cronTab }}"
   successfulJobsHistoryLimit: 1

cis-k8s-job/templates/cis-job.yaml

@@ -23,7 +23,7 @@ spec:
       containers:
       - image: "{{ .Values.accuknoxJob.image.repository }}:{{ .Values.accuknoxJob.image.tag }}"
         command: ["/bin/sh", "-c"]
-        args: ['/bin/sh entrypoint.sh && ./curl_command.sh']
+        args: ['/bin/sh entrypoint.sh && curl --location --request POST "https://${URL}/api/v1/artifact/?tenant_id=${TENANT_ID}&data_type=KB&label_id=${LABEL_NAME}&save_to_s3=true" --header "Tenant-Id: ${TENANT_ID}" --header "Authorization: Bearer ${AUTH_TOKEN}" --form "file=@\"./data/report.json\"" && cat /data/report.json']
         name: cis-k8s-cronjob
         resources: {}
         env:
@@ -41,19 +41,11 @@ spec:
           - name: LABEL_NAME
             value: {{ .Values.accuknox.label }}
           - name: CLUSTER_ID
-            value: {{ .Values.accuknox.clusterID }}
+            value: {{ .Values.accuknox.clusterId }}
           - name: TENANT_ID
-            value: {{ .Values.accuknox.tenantID | quote}}
+            value: {{ .Values.accuknox.tenantId | quote}}
           - name: URL
-            value: {{ .Values.accuknox.URL }}
-          - name: CERT_BUNDLE_PATH
-            value: {{ .Values.accuknox.certBundlePath | quote }}
-          - name: CERT_BUNDLE_URL
-            value: {{ .Values.accuknox.certBundleURL }}
-          - name: USE_INSECURE_CONNECTION
-            value: {{ .Values.accuknox.useInsecureConnection | quote }}
-          - name: DATA_TYPE
-            value: "KB"
+            value: {{ .Values.accuknox.url }}
         volumeMounts:
         - mountPath: /data
           name: datapath

k8s-risk-assessment-job/templates/configmap.yaml

@@ -33,6 +33,8 @@ data:
     cat /data/report.json
 
     # push
-    
-    /curl_command.sh
-
+    curl --location --request POST \
+    --header "Authorization: Bearer ${AUTH_TOKEN}" \
+    --header "Tenant-Id: ${TENANT_ID}" \
+    --form "file=@\"/data/report.json\"" \
+    "https://${URL}/api/v1/artifact/?tenant_id=${TENANT_ID}&data_type=KS&save_to_s3=true&label_id=${LABEL_NAME}"

k8s-risk-assessment-job/templates/cronjob.yaml

@@ -55,14 +55,6 @@ spec:
                   value: {{ .Values.accuknox.clusterID | quote }}
                 - name: LABEL_NAME
                   value: {{ .Values.accuknox.label }}
-                - name: CERT_BUNDLE_PATH
-                  value: {{ .Values.accuknox.certBundlePath | quote }}
-                - name: CERT_BUNDLE_URL
-                  value: {{ .Values.accuknox.certBundleURL }}
-                - name: USE_INSECURE_CONNECTION
-                  value: {{ .Values.accuknox.useInsecureConnection | quote }}
-                - name: DATA_TYPE
-                  value: "KS"
               volumeMounts:
                 - mountPath: /data
                   name: datapath

k8s-risk-assessment-job/templates/job.yaml

@@ -51,14 +51,6 @@ spec:
               value: {{ .Values.accuknox.clusterID | quote }}
             - name: LABEL_NAME
               value: {{ .Values.accuknox.label }}
-            - name: CERT_BUNDLE_PATH
-              value: {{ .Values.accuknox.certBundlePath | quote }}
-            - name: CERT_BUNDLE_URL
-              value: {{ .Values.accuknox.certBundleURL }}
-            - name: USE_INSECURE_CONNECTION
-              value: {{ .Values.accuknox.useInsecureConnection | quote }}
-            - name: DATA_TYPE
-              value: "KS"
           volumeMounts:
             - mountPath: /data
               name: datapath

k8s-risk-assessment-job/values.yaml

@@ -31,7 +31,3 @@ accuknox:
   clusterID: 0
   label: ""
   secretName: ""
-  certBundlePath: ""  # Set this for cert local path if needed .
-  certBundleURL: ""  # Set this for cert URL if needed (if certBundlePath is set as well certBundlePath will take precedent)
-  useInsecureConnection: false  # Set to true if insecure connection is needed
-

k8tls-job/templates/k8tls-cronjob.yaml

@@ -46,8 +46,7 @@ spec:
           containers:
           - image:  "{{ .Values.accuknoxJob.image.repository }}:{{ .Values.accuknoxJob.image.tag }}"
             command: ["/bin/sh", "-c"]
-            args: ['./curl_command.sh']
-
+            args: ['curl --location --request POST "https://${URL}/api/v1/artifact/?tenant_id=${TENANT_ID}&data_type=K8TLS&save_to_s3=true" --header "Tenant-Id: ${TENANT_ID}" --header "Authorization: Bearer ${AUTH_TOKEN}" --form "file=@\"/data/report.json\"" && cat /data/report.json']
             name: k8tls-job
             resources: {}
             env:
@@ -68,14 +67,6 @@ spec:
                 value: {{ if ne .Values.accuknox.clusterName "" }}{{ .Values.accuknox.clusterName }}{{ else }}{{ "default" }}{{ end }}
               - name: LABEL_NAME
                 value: {{ if ne .Values.accuknox.label "" }}{{ .Values.accuknox.label }}{{ else }}{{ "default" }}{{ end }}
-              - name: CERT_BUNDLE_PATH
-                value: {{ .Values.accuknox.certBundlePath | quote }}    
-              - name: CERT_BUNDLE_URL
-                value: {{ .Values.accuknox.certBundleURL }}
-              - name: USE_INSECURE_CONNECTION
-                value: {{ .Values.accuknox.useInsecureConnection | quote }}
-              - name: DATA_TYPE
-                value: "K8TLS"
             volumeMounts:
               - mountPath: /data
                 name: datapath

k8tls-job/templates/k8tls-job.yaml

@@ -18,7 +18,7 @@ spec:
       containers:
       - image: "{{ .Values.accuknoxJob.image.repository }}:{{ .Values.accuknoxJob.image.tag }}"
         command: ["/bin/sh", "-c"]
-        args: ['./curl_command.sh']
+        args: ['curl --location --request POST "https://${URL}/api/v1/artifact/?tenant_id=${TENANT_ID}&data_type=K8TLS&save_to_s3=true" --header "Tenant-Id: ${TENANT_ID}" --header "Authorization: Bearer ${AUTH_TOKEN}" --form "file=@\"/data/report.json\"" && cat /data/report.json']
         name: k8tls-job
         resources: {}
         env:
@@ -39,14 +39,6 @@ spec:
             value: {{ if ne .Values.accuknox.clusterName "" }}{{ .Values.accuknox.clusterName }}{{ else }}{{ "default" }}{{ end }}
           - name: LABEL_NAME
             value: {{ if ne .Values.accuknox.label "" }}{{ .Values.accuknox.label }}{{ else }}{{ "default" }}{{ end }}
-          - name: CERT_BUNDLE_PATH
-            value: {{ .Values.accuknox.certBundlePath | quote }}   
-          - name: CERT_BUNDLE_URL
-            value: {{ .Values.accuknox.certBundleURL }}
-          - name: USE_INSECURE_CONNECTION
-            value: {{ .Values.accuknox.useInsecureConnection | quote }}
-          - name: DATA_TYPE
-            value: "K8TLS"
         volumeMounts:
           - mountPath: /data
             name: datapath

k8tls-job/values.yaml

@@ -26,6 +26,4 @@ accuknox:
   clusterName: ""
   label: ""
   URL: "cspm.demo.accuknox.com"
-  certBundlePath: ""  # Set this for cert local path if needed .
-  certBundleURL: ""  # Set this for cert URL if needed (if certBundlePath is set as well certBundlePath will take precedent)
-  useInsecureConnection: false  # Set to true if insecure connection is needed
+  secretName: ""