Skip to content
This repository was archived by the owner on Oct 14, 2020. It is now read-only.

Commit 4231095

Browse files
rfelberrfelber
committed
Added a HelmChart value documentation to each readme based on a template feature.
1 parent 88725bb commit 4231095

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

49 files changed

+1571
-103
lines changed

‎hooks/declarative-subsequent-scans/README.md‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ usecase: "Cascading Scans based declarative Rules."
1111

1212
## Deployment
1313

14-
Installing the Cascading Scans hook will add a ReadOnly Hook to your namespace which looks for matching _CascadingRules_ in the namespace and start the according scans.
14+
Installing the Cascading Scans hook will add a ReadOnly Hook to your namespace which looks for matching _CascadingRules_ in the namespace and start the according scans.
1515

1616
```bash
1717
helm upgrade --install dssh ./hooks/declarative-subsequent-scans/
@@ -25,7 +25,7 @@ dssh ReadOnly docker.io/scbexperimental/hook-declarative-subsequent-scans:la
2525
```
2626

2727
## CascadingScan Rules
28-
The CascadingRules are included directly in each helm chart of the individual scanners.
28+
The CascadingRules are included directly in each helm chart of the individual scanners.
2929

3030
```bash
3131
# Check your CascadingRules
@@ -113,4 +113,11 @@ pop3s-tls-scan sslyze non-invasive light
113113
smtps-tls-scan sslyze non-invasive light
114114
ssh-scan ssh-scan non-invasive light
115115
zap-http zap-baseline non-invasive medium
116-
```
116+
```
117+
118+
## Chart Configuration
119+
120+
| Key | Type | Default | Description |
121+
|-----|------|---------|-------------|
122+
| image.repository | string | `"docker.io/scbexperimental/hook-declarative-subsequent-scans"` | Hook image repository |
123+
| image.tag | string | `nil` | |

‎hooks/declarative-subsequent-scans/README.md.gotmpl‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
---
2+
title: "Cascading Scans"
3+
path: "hooks/declarative-subsequent-scans"
4+
category: "hook"
5+
type: "processing"
6+
state: "released"
7+
usecase: "Cascading Scans based declarative Rules."
8+
---
9+
10+
<!-- end -->
11+
12+
## Deployment
13+
14+
Installing the Cascading Scans hook will add a ReadOnly Hook to your namespace which looks for matching _CascadingRules_ in the namespace and start the according scans.
15+
16+
```bash
17+
helm upgrade --install dssh ./hooks/declarative-subsequent-scans/
18+
```
19+
20+
### Verification
21+
```bash
22+
kubectl get ScanCompletionHooks
23+
NAME TYPE IMAGE
24+
dssh ReadOnly docker.io/scbexperimental/hook-declarative-subsequent-scans:latest
25+
```
26+
27+
## CascadingScan Rules
28+
The CascadingRules are included directly in each helm chart of the individual scanners.
29+
30+
```bash
31+
# Check your CascadingRules
32+
kubectl get CascadingRules
33+
NAME STARTS INVASIVENESS INTENSIVENESS
34+
https-tls-scan sslyze non-invasive light
35+
imaps-tls-scan sslyze non-invasive light
36+
nikto-http nikto non-invasive medium
37+
nmap-smb nmap non-invasive light
38+
pop3s-tls-scan sslyze non-invasive light
39+
smtps-tls-scan sslyze non-invasive light
40+
ssh-scan ssh-scan non-invasive light
41+
zap-http zap-baseline non-invasive medium
42+
```
43+
44+
## Starting a cascading Scan
45+
When you start a normal Scan, no CascadingRule will be applied. To use a _CascadingRule_ the scan must be marked to allow cascading rules.
46+
This is implemented using kubernetes label selectors, meaning that scans mark the classes of scans which are allowed to be cascaded by the current one.
47+
48+
### Example
49+
```yaml
50+
cat <<EOF | kubectl apply -f -
51+
apiVersion: "execution.experimental.securecodebox.io/v1"
52+
kind: Scan
53+
metadata:
54+
name: "example.com"
55+
spec:
56+
scanType: nmap
57+
parameters:
58+
- -p22,80,443
59+
- example.com
60+
cascades:
61+
matchLabels:
62+
securecodebox.io/intensive: light
63+
EOF
64+
```
65+
66+
This Scan will use all CascadingRules which are labeled with a "light" intensity.
67+
You can lookup which CascadingRules this selects by running:
68+
69+
```bash
70+
kubectl get CascadingRules -l "securecodebox.io/intensive=light"
71+
NAME STARTS INVASIVENESS INTENSIVENESS
72+
https-tls-scan sslyze non-invasive light
73+
imaps-tls-scan sslyze non-invasive light
74+
nmap-smb nmap non-invasive light
75+
pop3s-tls-scan sslyze non-invasive light
76+
smtps-tls-scan sslyze non-invasive light
77+
ssh-scan ssh-scan non-invasive light
78+
```
79+
80+
The label selectors also allow the more powerful matchExpression selectors:
81+
82+
```yaml
83+
cat <<EOF | kubectl apply -f -
84+
apiVersion: "execution.experimental.securecodebox.io/v1"
85+
kind: Scan
86+
metadata:
87+
name: "example.com"
88+
spec:
89+
scanType: nmap
90+
parameters:
91+
- -p22,80,443
92+
- example.com
93+
cascades:
94+
# Using matchExpression instead of matchLabels
95+
matchExpression:
96+
key: "securecodebox.io/intensive"
97+
operator: In
98+
# This select both light and medium intensity rules
99+
values: [light, medium]
100+
EOF
101+
```
102+
103+
This selection can be replicated in kubectl using:
104+
105+
```bash
106+
kubectl get CascadingRules -l "securecodebox.io/intensive in (light,medium)"
107+
NAME STARTS INVASIVENESS INTENSIVENESS
108+
https-tls-scan sslyze non-invasive light
109+
imaps-tls-scan sslyze non-invasive light
110+
nikto-http nikto non-invasive medium
111+
nmap-smb nmap non-invasive light
112+
pop3s-tls-scan sslyze non-invasive light
113+
smtps-tls-scan sslyze non-invasive light
114+
ssh-scan ssh-scan non-invasive light
115+
zap-http zap-baseline non-invasive medium
116+
```
117+
118+
## Chart Configuration
119+
120+
{{ template "chart.valuesTable" . }}

‎hooks/declarative-subsequent-scans/values.yaml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33
# Declare variables to be passed into your templates.
44

55
image:
6+
# image.repository -- Hook image repository
67
repository: docker.io/scbexperimental/hook-declarative-subsequent-scans
7-
# image.tag - defaults to the charts version
8+
# parserImage.tag -- Parser image tag
9+
# @default -- defaults to the charts version
810
tag: null

‎hooks/generic-webhook/README.md‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,17 @@ usecase: "Publishes Scan Findings as WebHook."
1111

1212
## Deployment
1313

14-
Installing the Generic WebHook hook will add a ReadOnly Hook to your namespace.
14+
Installing the Generic WebHook hook will add a ReadOnly Hook to your namespace.
1515

1616
```bash
1717
helm upgrade --install gwh ./hooks/generic-webhook/ --set webhookUrl="http://example.com/my/webhook/target"
1818
```
19-
> ✍ This documentation is currently work-in-progress.
19+
> ✍ This documentation is currently work-in-progress.
20+
21+
## Chart Configuration
22+
23+
| Key | Type | Default | Description |
24+
|-----|------|---------|-------------|
25+
| image.repository | string | `"docker.io/scbexperimental/generic-webhook"` | Hook image repository |
26+
| image.tag | string | `nil` | |
27+
| webhookUrl | string | `"http://example.com"` | The URL of your WebHook endpoint |

‎hooks/generic-webhook/README.md.gotmpl‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
title: "Generic WebHook"
3+
path: "hooks/generic-webhook"
4+
category: "hook"
5+
type: "integration"
6+
state: "released"
7+
usecase: "Publishes Scan Findings as WebHook."
8+
---
9+
10+
<!-- end -->
11+
12+
## Deployment
13+
14+
Installing the Generic WebHook hook will add a ReadOnly Hook to your namespace.
15+
16+
```bash
17+
helm upgrade --install gwh ./hooks/generic-webhook/ --set webhookUrl="http://example.com/my/webhook/target"
18+
```
19+
> ✍ This documentation is currently work-in-progress.
20+
21+
## Chart Configuration
22+
23+
{{ template "chart.valuesTable" . }}

‎hooks/generic-webhook/values.yaml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,12 @@
22
# This is a YAML-formatted file.
33
# Declare variables to be passed into your templates.
44

5+
# webhookUrl -- The URL of your WebHook endpoint
56
webhookUrl: "http://example.com"
67

78
image:
9+
# image.repository -- Hook image repository
810
repository: docker.io/scbexperimental/generic-webhook
9-
# image.tag - defaults to the charts version
11+
# parserImage.tag -- Parser image tag
12+
# @default -- defaults to the charts version
1013
tag: null

‎hooks/imperative-subsequent-scans/README.md‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,4 +7,24 @@ state: "roadmap"
77
usecase: "Cascading Scans based imperative Rules."
88
---
99

10-
> 🔧 The implementation is currently work-in-progress and still undergoing major changes. It'll be released here once it has stabilized.
10+
## Deployment
11+
12+
Installing the imperative-subsequent-scans hook will add a ReadOnly Hook to your namespace.
13+
14+
```bash
15+
helm upgrade --install issh ./hooks/imperative-subsequent-scans/
16+
```
17+
> ✍ This documentation is currently work-in-progress.
18+
19+
## Chart Configuration
20+
21+
| Key | Type | Default | Description |
22+
|-----|------|---------|-------------|
23+
| cascade.amassNmap | bool | `false` | True if you want to cascade nmap scans for each subdomain found by amass, otherwise false. |
24+
| cascade.nmapNikto | bool | `false` | True if you want to cascade Nikto scans for each HTTP Port found by nmap, otherwise false. |
25+
| cascade.nmapSmb | bool | `false` | True if you want to cascade nmap SMB scans for each SMB Port found by nmap, otherwise false. |
26+
| cascade.nmapSsh | bool | `false` | True if you want to cascade SSH scans for each SSH Port found by nmap, otherwise false. |
27+
| cascade.nmapSsl | bool | `false` | True if you want to cascade SSL scans for each HTTP Port found by nmap, otherwise false. |
28+
| cascade.nmapZapBaseline | bool | `false` | True if you want to cascade ZAP scans for each HTTP Port found by nmap, otherwise false. |
29+
| image.repository | string | `"docker.io/scbexperimental/hook-imperative-subsequent-scans"` | Hook image repository |
30+
| image.tag | string | `nil` | |

‎hooks/imperative-subsequent-scans/README.md.gotmpl‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
title: "Imperative Scans"
3+
path: "hooks/imperative-subsequent-scans"
4+
category: "hook"
5+
type: "integration"
6+
state: "roadmap"
7+
usecase: "Cascading Scans based imperative Rules."
8+
---
9+
10+
## Deployment
11+
12+
Installing the imperative-subsequent-scans hook will add a ReadOnly Hook to your namespace.
13+
14+
```bash
15+
helm upgrade --install issh ./hooks/imperative-subsequent-scans/
16+
```
17+
> ✍ This documentation is currently work-in-progress.
18+
19+
## Chart Configuration
20+
21+
{{ template "chart.valuesTable" . }}

‎hooks/imperative-subsequent-scans/values.yaml‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3,20 +3,22 @@
33
# Declare variables to be passed into your templates.
44

55
cascade:
6-
# Cascade nmap scans for each subdomain found by amass
7-
amassNmap: true
8-
# Cascade nmap SMB scans for each SMB Port found by nmap
6+
# cascade.amassNmap -- True if you want to cascade nmap scans for each subdomain found by amass, otherwise false.
7+
amassNmap: false
8+
# cascade.nmapSmb -- True if you want to cascade nmap SMB scans for each SMB Port found by nmap, otherwise false.
99
nmapSmb: false
10-
# Cascade SSH scans for each SSH Port found by nmap
11-
nmapSsh: true
12-
# Cascade SSL scans for each HTTP Port found by nmap
13-
nmapSsl: true
14-
# Cascade Nikto scans for each HTTP Port found by nmap
10+
# cascade.nmapSsh -- True if you want to cascade SSH scans for each SSH Port found by nmap, otherwise false.
11+
nmapSsh: false
12+
# cascade.nmapSsl -- True if you want to cascade SSL scans for each HTTP Port found by nmap, otherwise false.
13+
nmapSsl: false
14+
# cascade.nmapNikto -- True if you want to cascade Nikto scans for each HTTP Port found by nmap, otherwise false.
1515
nmapNikto: false
16-
# Cascade ZAP scans for each HTTP Port found by nmap
16+
# cascade.nmapZapBaseline -- True if you want to cascade ZAP scans for each HTTP Port found by nmap, otherwise false.
1717
nmapZapBaseline: false
1818

1919
image:
20+
# image.repository -- Hook image repository
2021
repository: docker.io/scbexperimental/hook-imperative-subsequent-scans
21-
# image.tag - defaults to the charts version
22+
# parserImage.tag -- Parser image tag
23+
# @default -- defaults to the charts version
2224
tag: null

‎hooks/persistence-elastic/README.md‎

Lines changed: 29 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -14,44 +14,39 @@ The ElasticSearch persistenceProvider hook saves all findings and reports into t
1414

1515
## Deployment
1616

17-
Installing the Elasticsearch persistenceProvider hook will add a _ReadOnly Hook_ to your namespace.
17+
Installing the Elasticsearch persistenceProvider hook will add a _ReadOnly Hook_ to your namespace.
1818

1919
```bash
2020
helm upgrade --install elkh ./hooks/persistence-elastic/
2121
```
2222

23-
## Configuration
24-
see values.yaml
25-
26-
```yaml
27-
# Define a specific index prefix
28-
indexPrefix: "scbv2"
29-
30-
# Enable this when you already have an Elastic Stack running to which you want to send your results
31-
externalElasticStack:
32-
enabled: false
33-
elasticsearchAddress: "https://elasticsearch.example.com"
34-
kibanaAddress: "https://kibana.example.com"
35-
36-
# Configure authentication schema and credentials the persistence provider should use to connect to elasticsearch
37-
# user and apikey are mutually exclusive, only set one!
38-
authentication:
39-
# Link a pre-existing generic secret with `username` and `password` key / value pairs
40-
userSecret: null
41-
# Link a pre-existing generic secret with `id` and `key` key / value pairs
42-
apiKeySecret: null
43-
44-
# Configures included Elasticsearch subchart
45-
elasticsearch:
46-
enabled: true
47-
replicas: 1
48-
minimumMasterNodes: 1
49-
# image: docker.elastic.co/elasticsearch/elasticsearch-oss
50-
51-
# Configures included Elasticsearch subchart
52-
kibana:
53-
enabled: true
54-
# image: docker.elastic.co/kibana/kibana-oss
55-
```
23+
## Chart Configuration
24+
25+
| Key | Type | Default | Description |
26+
|-----|------|---------|-------------|
27+
| affinity | object | `{}` | |
28+
| authentication | object | `{"apiKeySecret":null,"userSecret":null}` | Configure authentication schema and credentials the persistence provider should use to connect to elasticsearch user and apikey are mutually exclusive, only set one! |
29+
| authentication.apiKeySecret | string | `nil` | Link a pre-existing generic secret with `id` and `key` key / value pairs |
30+
| authentication.userSecret | string | `nil` | Link a pre-existing generic secret with `username` and `password` key / value pairs |
31+
| elasticsearch | object | `{"enabled":true,"minimumMasterNodes":1,"replicas":1}` | Configures the included elasticsearch subchart (see: https://github.com/elastic/helm-charts/tree/elasticsearch) |
32+
| elasticsearch.enabled | bool | `true` | Enable if you want to deploy an elasticsearch service. |
33+
| elasticsearch.minimumMasterNodes | int | `1` | The value for discovery.zen.minimum_master_nodes. Should be set to (master_eligible_nodes / 2) + 1. Ignored in Elasticsearch versions >= 7 |
34+
| elasticsearch.replicas | int | `1` | Kubernetes replica count for the StatefulSet (i.e. how many pods) |
35+
| externalElasticStack.elasticsearchAddress | string | `"https://elasticsearch.example.com"` | The URL of the elasticsearch service to persists all findings to. |
36+
| externalElasticStack.enabled | bool | `false` | Enable this when you already have an Elastic Stack running to which you want to send your results |
37+
| externalElasticStack.kibanaAddress | string | `"https://kibana.example.com"` | The URL of the kibana service used to visualize all findings. |
38+
| fullnameOverride | string | `""` | |
39+
| image.repository | string | `"docker.io/scbexperimental/persistence-elastic"` | Hook image repository |
40+
| image.tag | string | `nil` | |
41+
| imagePullSecrets | list | `[]` | |
42+
| indexPrefix | string | `"scbv2"` | Define a specific index prefix used for all elasticsearch indices. |
43+
| kibana | object | `{"enabled":true}` | Configures included Elasticsearch subchart |
44+
| kibana.enabled | bool | `true` | Enable if you want to deploy an kibana service (see: https://github.com/elastic/helm-charts/tree/master/kibana) |
45+
| nameOverride | string | `""` | |
46+
| nodeSelector | object | `{}` | |
47+
| podSecurityContext | object | `{}` | |
48+
| resources | object | `{}` | |
49+
| securityContext | object | `{}` | |
50+
| tolerations | list | `[]` | |
5651

5752
[elastic.io]: https://www.elastic.co/products/elasticsearch

0 commit comments

Comments
 (0)