Skip to content
This repository was archived by the owner on Oct 14, 2020. It is now read-only.

Commit b9ee818

Browse files
committed
#30 Adapt the quesion 1 paragraph to the styling of the previous one
Signed-off-by: Sven Strittmatter <sven.strittmatter@iteratec.com>
1 parent e2c6a17 commit b9ee818

File tree

1 file changed

+24
-21
lines changed

1 file changed

+24
-21
lines changed

docs/adr/adr_0001.adoc

Lines changed: 24 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -30,43 +30,46 @@ One major challenge implementing the _secureCodeBox_ is to provide a flexible an
3030
└──────────────────┘ └──────────────────┘ └──────────────────┘
3131
....
3232

33-
By now the phase 3 "`persisting`" was implemented by so called _persistenceProviders_ (e.g., the _persistence-elastic_ provider which is responsible for persisting all findings in a given elasticsearch database). The _secureCodeBox_ Operator is aware of this 3 phases and is responsible for the state model and execution of each security scan.
33+
By now the phase 3 "`persisting`" was implemented by so called _PersistenceProviders_ (e.g., the _persistence-elastic_ provider which is responsible for persisting all findings in a given elasticsearch database). The _secureCodeBox_ Operator is aware of this 3 phases and is responsible for the state model and execution of each security scan.
3434

3535
=== Problem and Question
3636

3737
We identified different additional use cases with a more "`data processing oriented`" pattern than the implemented phase 3 "`persisting`" indicates. For example, we implemented a so called _MetaDataProvider_ feature, which is responsible for enhancing each security finding with additional metadata. But the _MetaDataProvider_ must be executed after the phase 2 "`parsing`" and before the phase 3 "`persisting`" because it depends on the parsed finding results (which will be enhanced) and the updated findings should be also persisted.
3838

3939
To find a proper solution, we split the topic into the following two questions:
4040

41-
. Should we unify the concepts MetaDataProvider and PersistenceProvider?
41+
. Should we unify the concepts _MetaDataProvider_ and _PersistenceProvider_?
4242
. How should the execution model look like for each concept?
4343

4444
==== Question 1: Should We Unify the Concepts MetaDataProvider and PersistenceProvider?
4545

4646
===== Solution Approach 1: Unify
4747

48-
Both "modules" are "processing" the security findings, which are generated in the parsing phase.
49-
But there is one larger difference between them:
48+
Both "`modules`" are "`processing`" the security findings, which were generated in the phase 2 "`parsing`",
49+
but there is one major difference between them:
5050

51-
* `PersistenceProvider` is processing the findings with a *ReadOnly* pattern
52-
* `MetaDataProvider` is processing the findings with a *ReadAndWrite* pattern
51+
* a _PersistenceProvider_ is processing the findings *read only*, and
52+
* a _MetaDataProvider_ is processing the findings *read and write*.
5353

54-
There is a similar thing in kubernetes called [AdmissionController](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/), with the exception that the are executed before a resource gets created.
54+
There is a similar concept in Kubernetes called https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/[AdmissionController], but with the exception that the will be executed before a resource is created.
5555

56-
The are two variants:
56+
There are two variants of _AdmissionControllers_:
5757

58-
. `ValidatingWebhookConfiguration` (ReadOnly) *Executed Last*
59-
. `MutatingWebhookConfiguration` (ReadAndWrite) *Executed First*
58+
. _ValidatingWebhookConfiguration_: *read only*, *executed last*; and
59+
. _MutatingWebhookConfiguration_: *read and write*, *executed first*.
6060

61-
We could do a similar thing and introduce CRD which allows to execute "custom code" (generally speaking, depends on the second question) after a scan has completed (meaning both scan and parser phases are done). Some name ideas:
61+
We could do a similar thing and introduce CRD which allows to execute "`custom code`" (depends on the second question) after a scan has completed (meaning both phases "`scan`" and "`parsing`" were done). Some name ideas:
6262

63-
* `ScanHooks`
64-
* `ScanCompletionHooks`
65-
* `FindingProcessors`
63+
* _ScanHooks_
64+
* _ScanCompletionHooks_
65+
* _FindingProcessors_
6666

67-
These could be implemented with a `type` attribute, which declares if they are `ReadOnly` or `ReadAndWrite`.
67+
These could be implemented with a `type` attribute, which declares if they are *read only* or *read and write*.
6868

69-
The operator would process all these resources in the namespace and execute the `ReadAndWrite` ones first (in serial: one at a time to avoid write conflicts) and then the `ReadOnly` ones (in parallel).
69+
The _secureCodeBox operator_ would process all these CRDs in the namespace and execute the *read and write* ones first in serial only one at a time to avoid write conflicts and then the *read only* ones in parallel.
70+
////
71+
#30: What namespace is meant here?
72+
////
7073

7174
[source,yaml]
7275
----
@@ -95,14 +98,14 @@ The Execution Flow would then look something like this:
9598

9699
====== Pros
97100

98-
* Only one Implementation
99-
* Pretty Generic to expand and test out new ideas without having to modify the secureCodeBox Operator
101+
* Only one implementation.
102+
* Pretty generic to expand and test out new ideas without having to modify the _secureCodeBox operator_.
100103

101104
====== Cons
102105

103-
* Possible "over-abstraction"?
104-
* Need to refactor the ElasticSearch PersistenceProvider
105-
* The "General Implementation" will be harder than the individual ones
106+
* Possibly an "`over-abstraction`".
107+
* Need to refactor the _persistence-elastic_ provider.
108+
* The "`general implementation`" will be harder than the individual ones.
106109

107110
===== Solution Approach 1: Keep Split between Persistence Provider and MetaData Provider
108111

0 commit comments

Comments
 (0)