You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Oct 14, 2020. It is now read-only.
By now the phase 3 "`persisting`" was implemented by so called _persistenceProviders_ (e.g., the _persistence-elastic_ provider which is responsible for persisting all findings in a given elasticsearch database). The _secureCodeBox_ Operator is aware of this 3 phases and is responsible for the state model and execution of each security scan.
33
+
By now the phase 3 "`persisting`" was implemented by so called _PersistenceProviders_ (e.g., the _persistence-elastic_ provider which is responsible for persisting all findings in a given elasticsearch database). The _secureCodeBox_ Operator is aware of this 3 phases and is responsible for the state model and execution of each security scan.
34
34
35
35
=== Problem and Question
36
36
37
37
We identified different additional use cases with a more "`data processing oriented`" pattern than the implemented phase 3 "`persisting`" indicates. For example, we implemented a so called _MetaDataProvider_ feature, which is responsible for enhancing each security finding with additional metadata. But the _MetaDataProvider_ must be executed after the phase 2 "`parsing`" and before the phase 3 "`persisting`" because it depends on the parsed finding results (which will be enhanced) and the updated findings should be also persisted.
38
38
39
39
To find a proper solution, we split the topic into the following two questions:
40
40
41
-
. Should we unify the concepts MetaDataProvider and PersistenceProvider?
41
+
. Should we unify the concepts _MetaDataProvider_ and _PersistenceProvider_?
42
42
. How should the execution model look like for each concept?
43
43
44
44
==== Question 1: Should We Unify the Concepts MetaDataProvider and PersistenceProvider?
45
45
46
46
===== Solution Approach 1: Unify
47
47
48
-
Both "modules" are "processing" the security findings, which are generated in the parsing phase.
49
-
But there is one larger difference between them:
48
+
Both "`modules`" are "`processing`" the security findings, which were generated in the phase 2 "`parsing`",
49
+
but there is one major difference between them:
50
50
51
-
* `PersistenceProvider` is processing the findings with a *ReadOnly* pattern
52
-
* `MetaDataProvider` is processing the findings with a *ReadAndWrite* pattern
51
+
* a _PersistenceProvider_ is processing the findings *read only*, and
52
+
* a _MetaDataProvider_ is processing the findings *read and write*.
53
53
54
-
There is a similar thing in kubernetes called [AdmissionController](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/), with the exception that the are executed before a resource gets created.
54
+
There is a similar concept in Kubernetes called https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/[AdmissionController], but with the exception that the will be executed before a resource is created.
. _ValidatingWebhookConfiguration_: *read only*, *executed last*; and
59
+
. _MutatingWebhookConfiguration_: *read and write*, *executed first*.
60
60
61
-
We could do a similar thing and introduce CRD which allows to execute "custom code" (generally speaking, depends on the second question) after a scan has completed (meaning both scan and parser phases are done). Some name ideas:
61
+
We could do a similar thing and introduce CRD which allows to execute "`custom code`" (depends on the second question) after a scan has completed (meaning both phases "`scan`" and "`parsing`" were done). Some name ideas:
62
62
63
-
* `ScanHooks`
64
-
* `ScanCompletionHooks`
65
-
* `FindingProcessors`
63
+
* _ScanHooks_
64
+
* _ScanCompletionHooks_
65
+
* _FindingProcessors_
66
66
67
-
These could be implemented with a `type` attribute, which declares if they are `ReadOnly` or `ReadAndWrite`.
67
+
These could be implemented with a `type` attribute, which declares if they are *read only* or *read and write*.
68
68
69
-
The operator would process all these resources in the namespace and execute the `ReadAndWrite` ones first (in serial: one at a time to avoid write conflicts) and then the `ReadOnly` ones (in parallel).
69
+
The _secureCodeBox operator_ would process all these CRDs in the namespace and execute the *read and write* ones first in serial only one at a time to avoid write conflicts and then the *read only* ones in parallel.
70
+
////
71
+
#30: What namespace is meant here?
72
+
////
70
73
71
74
[source,yaml]
72
75
----
@@ -95,14 +98,14 @@ The Execution Flow would then look something like this:
95
98
96
99
====== Pros
97
100
98
-
* Only one Implementation
99
-
* Pretty Generic to expand and test out new ideas without having to modify the secureCodeBox Operator
101
+
* Only one implementation.
102
+
* Pretty generic to expand and test out new ideas without having to modify the _secureCodeBox operator_.
100
103
101
104
====== Cons
102
105
103
-
* Possible "over-abstraction"?
104
-
* Need to refactor the ElasticSearch PersistenceProvider
105
-
* The "General Implementation" will be harder than the individual ones
106
+
* Possibly an "`over-abstraction`".
107
+
* Need to refactor the _persistence-elastic_ provider.
108
+
* The "`general implementation`" will be harder than the individual ones.
106
109
107
110
===== Solution Approach 1: Keep Split between Persistence Provider and MetaData Provider
0 commit comments