Skip to content
This repository was archived by the owner on Oct 14, 2020. It is now read-only.

Commit e22e85c

Browse files
authored
Merge pull request #28 from Weltraumschaf/24
Improve developer guide
2 parents ac9af9a + dddedbb commit e22e85c

File tree

6 files changed

+126
-38
lines changed

6 files changed

+126
-38
lines changed

.envrc

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# shellcheck shell=sh
2+
# https://direnv.net/man/direnv-stdlib.1.html
3+
PATH_add bin
4+
# shellcheck disable=SC2155
5+
export PROJECT_DIR="$(pwd)"
6+
7+
export S3_BUCKET="scb"
8+
export S3_USE_SSL="false"
9+
export S3_ENDPOINT="127.0.0.1:9000"
10+
# shellcheck disable=2039,1090
11+
source "${PROJECT_DIR}/.s3_credentials"

.gitignore

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,5 @@
33
coverage/
44
.vagrant
55
**.log
6-
**/*.monopic
6+
**/*.monopic
7+
.s3_credentials

README.md

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
<p align="center">
1515
<a href="https://opensource.org/licenses/Apache-2.0"><img alt="Build" src="https://github.com/secureCodeBox/secureCodeBox-v2-alpha/workflows/CI/badge.svg"></a>
1616
<a href="https://codeclimate.com/github/secureCodeBox/secureCodeBox-v2-alpha/test_coverage"><img alt="Test Coverage" src="https://api.codeclimate.com/v1/badges/b6bf3af707671b5e5251/test_coverage" /></a>
17-
<a href="https://snyk.io/test/github/secureCodeBox/secureCodeBox-v2-alpha/"><img alt="Known Vulnerabilities" src="https://snyk.io/test/github/secureCodeBox/secureCodeBox-v2-alpha/badge.svg"></a>
17+
<a href="https://snyk.io/test/github/secureCodeBox/secureCodeBox-v2-alpha/"><img alt="Known Vulnerabilities" src="https://snyk.io/test/github/secureCodeBox/secureCodeBox-v2-alpha/badge.svg"></a>
1818
</p>
1919

2020
**NOTE**: This Repository contains a **work in progress** preview of the planned next major secureCodeBox Release. You can find the current **stable release** here [https://github.com/secureCodeBox/secureCodeBox](https://github.com/secureCodeBox/secureCodeBox). The release of version 2.0 is still at least some month away but you can already get a sneak peak here 😀. The release will contain a major architecture change which will not be backward compatible. More details will follow soon in a series of blog articles.
@@ -73,14 +73,16 @@ There is a german article about [Security DevOps – Angreifern (immer) einen Sc
7373

7474
### Deployment (based on Helm)
7575

76+
There are shorthand scripts to un-/install everything in the `bin` directory.
77+
7678
Deploy the secureCodeBox operator first:
7779

7880
```bash
7981
kubectl create namespace securecodebox-system
80-
helm -n securecodebox-system install securecodebox-operator ./operator/
82+
helm -n securecodebox-system upgrade --install securecodebox-operator ./operator/
8183
```
8284

83-
Optionally deploy SCB scanner Charts for each security scanner you want to use:
85+
Optionally deploy SCB scanner charts for each security scanner you want to use. They should not be installed into the `securecodebox-system` like the operator so that different teams can use different kinds of scanners.
8486

8587
```bash
8688
helm upgrade --install amass ./scanners/amass/

bin/install-all.sh

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
#!/usr/bin/env bash
2+
3+
set -eu
4+
5+
kubectl create namespace securecodebox-system
6+
helm -n securecodebox-system upgrade --install securecodebox-operator ./operator/
7+
8+
helm upgrade --install amass ./scanners/amass/
9+
helm upgrade --install kube-hunter ./scanners/kube-hunter/
10+
helm upgrade --install nikto ./scanners/nikto
11+
helm upgrade --install nmap ./scanners/nmap/
12+
helm upgrade --install ssh-scan ./scanners/ssh_scan/
13+
helm upgrade --install sslyze ./scanners/sslyze/
14+
helm upgrade --install trivy ./scanners/trivy/
15+
helm upgrade --install zap ./scanners/zap/
16+
helm upgrade --install wpscan ./scanners/wpscan/
17+
18+
helm upgrade --install dummy-ssh ./demo-apps/dummy-ssh/
19+
20+
helm upgrade --install aah ./hooks/update-field/
21+
helm upgrade --install gwh ./hooks/generic-webhook/
22+
helm upgrade --install issh ./hooks/imperative-subsequent-scans/
23+
24+
helm upgrade --install elkh ./hooks/persistence-elastic/

bin/uninstall-all.sh

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#!/usr/bin/env bash
2+
3+
set -eu
4+
5+
helm -n securecodebox-system uninstall securecodebox-operator
6+
7+
helm uninstall amass
8+
helm uninstall kube-hunter
9+
helm uninstall nikto
10+
helm uninstall nmap
11+
helm uninstall ssh-scan
12+
helm uninstall sslyze
13+
helm uninstall trivy
14+
helm uninstall zap
15+
helm uninstall wpscan
16+
17+
helm uninstall dummy-ssh
18+
19+
helm uninstall aah
20+
helm uninstall gwh
21+
helm uninstall issh
22+
23+
helm uninstall elkh
24+
25+
kubectl delete namespaces securecodebox-system

docs/developer-guide/README.md

Lines changed: 59 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -4,82 +4,107 @@
44

55
### Prerequisites
66

7-
#### Golang
7+
#### Golang
88

9-
The operator is written in Golang.
10-
To build the operator you will need to install [Go](https://golang.org/).
9+
The operator is written in Golang. To build the operator you will need to install [Go](https://golang.org/).
1110

1211
#### Minikube or Kind
1312

14-
For local development we recommend to use [Minikube](https://kubernetes.io/docs/tasks/tools/install-minikube/) or [kind](https://github.com/kubernetes-sigs/kind). If you are using MacOS or Windows you can also use the kubernetes cluster included within Docker for Mac/Windows.
15-
All of these tools will enable you to run a local kubernetes cluster on your development machine.
13+
For local development we recommend to use [Minikube](https://kubernetes.io/docs/tasks/tools/install-minikube/) or [kind](https://github.com/kubernetes-sigs/kind). If you are using MacOS or Windows you can also use the kubernetes cluster included within Docker for Mac/Windows. All of these tools will enable you to run a local kubernetes cluster on your development machine.
1614

17-
#### Operating your local kubernetes cluster
15+
#### Operating Your Local Kubernetes Cluster
1816

19-
To operate your (local) kubernetes cluster you will need to install [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) and [helm](https://helm.sh/)
17+
To operate your (local) Kubernetes cluster you will need to install [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) and [helm](https://helm.sh/)
18+
19+
#### macOS
20+
21+
For macOs simply use [Homebrew](https://brew.sh/) to install all the tools:
22+
23+
```bash
24+
brew cask install docker
25+
brew install go helm
26+
```
27+
28+
After that start the `Docker.app` and go to it's settings and start Kubernetes.
2029

2130
#### Minio
2231

2332
For your local development you will need a S3 compatible storage.
24-
We would recommend to use [Minio](https://min.io/download#/) inside a podman or docker container.
33+
We would recommend to use [Minio](https://min.io/download#/) inside a Podman or docker container.
34+
35+
##### If You Want to Use Podman
2536

2637
```bash
27-
# if you want to use podman
28-
$ podman run --name minio -p 9000:9000 minio/minio server /data
29-
# if you want to use docker
30-
$ docker run --name minio -p 9000:9000 minio/minio server /data
38+
podman run \
39+
--name minio \
40+
-p 9000:9000 \
41+
minio/minio \
42+
server /data
3143
```
3244

33-
In the Minio management GUI you will need to add a new bucket for the operator.
34-
The default credentials for your minio instance are *minioadmin:minioadmin*.
35-
You might change those.
45+
##### If You Want to Use Docker
46+
47+
```bash
48+
docker container run \
49+
--name minio \
50+
-p 9000:9000 \
51+
-d \
52+
--rm \
53+
minio/minio \
54+
server /data
55+
```
3656

37-
After setting up your bucket you will need to specify some environment variables to enable the operator to use the bucket.
38-
You could add these to your *.bashrc* or *.zshrc* as well.
57+
In the Minio management GUI you will need to add a new bucket for the operator. The default credentials for your minio instance are `minioadmin:minioadmin`. You might change those. Go to the management UI at <http://localhost:9000/> and add a new bucket. After creating your bucket you will need to specify some environment variables to enable the operator to use the bucket. For that export these variables:
3958

4059
```bash
41-
$ export S3_ACCESS_KEY="your-minio-access-key"
42-
$ export S3_SECRET_KEY="your-minio-secret-key"
43-
$ export S3_BUCKET="name-of-your-bucket"
44-
$ export S3_USE_SSL="false" # This ensures that the operator will connect even without HTTPS
45-
$ export S3_ENDPOINT="<your.local.ip1address>:9000/"
60+
export S3_ACCESS_KEY="your-minio-access-key"
61+
export S3_SECRET_KEY="your-minio-secret-key"
62+
export S3_BUCKET="name-of-your-bucket"
63+
export S3_USE_SSL="false" # This ensures that the operator will connect even without HTTPS
64+
export S3_ENDPOINT="127.0.0.1:9000"
4665
```
4766

48-
### Build and run the operator
67+
You can save time by using [direnv](https://direnv.net/) to export these variables in your project. If you use direnv just add a file `.s3_credentials` with your Minio credentials.
68+
69+
### Build and Run the Operator
4970

50-
To build an run the operator you can simply execute *make* in the *operator* directory of this repository.
71+
To build an run the operator you can simply execute `make` in the `operator` directory of this repository:
5172

5273
```bash
53-
$ make
74+
cd operator
75+
make
5476
```
5577

56-
To run the operator locally you can simply execute *make run*
78+
This will produce the operator as `bin/manager`. If you wonder why the operator is named _manager_ (the resulting binary). The reason for that is in Kubernetes a combination of more than one _controller_ is called _controller-manager_ or short _manager_. In contrast _operator_ is created by the community to name a _controller-manager_ which controls _custom resources_ and hence we use _custom resources_. (see <https://book.kubebuilder.io/> for further information)
79+
80+
To run the operator locally you can simply execute `make run` in the `operator` directory of this repository:
5781

58-
*NOTICE:* You will need to uninstall the operator from your local cluster first or it will result in undefined behavior!
82+
*NOTICE:* You will need to uninstall the operator with `helm -n securecodebox-system uninstall securecodebox-operator` from your local cluster, if you've installed it via helm. Unless both operators try to work on the same cluster which may cause unexpected behavior.
5983

6084
```bash
61-
$ make run
85+
cd operator
86+
make run
6287
```
6388

64-
## How to a new security scanner
89+
## How to a New Security Scanner
6590

6691
### ScanType Definition
6792

6893
### Parsing SDK
6994

70-
## How to integrate a new hook
95+
## How to Integrate a New Hook
7196

7297
### HookType Definition
7398

7499
### Hook SDK
75100

76-
# Guidelines
101+
## Guidelines
77102

78-
## Coding Guidelines
103+
### Coding Guidelines
79104

80-
### JSON
105+
#### JSON
81106

82-
We're using snake_case (lower case) for json attributes. If an enum type is used as attribute its converted to lower case. If it's an value it's always used UPPERCASE. This is to hold the attribute api consistent, but make shure Enums are recognized as enums.
107+
We're using snake_case (lower case) for json attributes. If an enum type is used as attribute its converted to lower case. If it's an value it's always used UPPERCASE. This is to hold the attribute api consistent, but make sure Enums are recognized as enums.
83108

84109
```json
85110
{

0 commit comments

Comments
 (0)