diff --git a/charts/zora/Chart.yaml b/charts/zora/Chart.yaml index bea193f..b3d8b7e 100644 --- a/charts/zora/Chart.yaml +++ b/charts/zora/Chart.yaml @@ -17,7 +17,7 @@ name: zora description: A multi-plugin solution that reports misconfigurations and vulnerabilities by scanning your cluster at scheduled times. icon: https://zora-docs.undistro.io/v0.7/assets/logo.svg type: application -version: 0.8.3 -appVersion: "v0.8.3" +version: 0.8.4-rc1 +appVersion: "v0.8.4-rc1" sources: - https://github.com/undistro/zora diff --git a/charts/zora/README.md b/charts/zora/README.md index 4a8d43b..623d252 100644 --- a/charts/zora/README.md +++ b/charts/zora/README.md @@ -1,6 +1,6 @@ # Zora Helm Chart -![Version: 0.8.3](https://img.shields.io/badge/Version-0.8.3-informational?style=flat-square&color=3CA9DD) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square&color=3CA9DD) ![AppVersion: v0.8.3](https://img.shields.io/badge/AppVersion-v0.8.3-informational?style=flat-square&color=3CA9DD) +![Version: 0.8.4-rc1](https://img.shields.io/badge/Version-0.8.4--rc1-informational?style=flat-square&color=3CA9DD) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square&color=3CA9DD) ![AppVersion: v0.8.4-rc1](https://img.shields.io/badge/AppVersion-v0.8.4--rc1-informational?style=flat-square&color=3CA9DD) A multi-plugin solution that reports misconfigurations and vulnerabilities by scanning your cluster at scheduled times. @@ -13,7 +13,7 @@ helm repo add undistro https://charts.undistro.io --force-update helm repo update undistro helm upgrade --install zora undistro/zora \ -n zora-system \ - --version 0.8.3 \ + --version 0.8.4-rc1 \ --create-namespace \ --wait \ --set clusterName="$(kubectl config current-context)" @@ -75,7 +75,7 @@ The following table lists the configurable parameters of the Zora chart and thei | operator.rbac.serviceAccount.annotations | object | `{}` | Annotations to be added to service account | | operator.rbac.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | | operator.podAnnotations | object | `{"kubectl.kubernetes.io/default-container":"manager"}` | Annotations to be added to pods | -| operator.podSecurityContext | object | `{"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532}` | [Security Context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context) to add to the pod | +| operator.podSecurityContext | object | `{"runAsNonRoot":true}` | [Security Context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context) to add to the pod | | operator.securityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true}` | [Security Context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context) to add to `manager` container | | operator.metricsService.type | string | `"ClusterIP"` | Type of metrics service | | operator.metricsService.port | int | `8443` | Port of metrics service | @@ -115,10 +115,11 @@ The following table lists the configurable parameters of the Zora chart and thei | scan.plugins.trivy.resources | object | `{}` | [Resources](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers) to add to `trivy` container | | scan.plugins.trivy.podAnnotations | object | `{}` | Annotations added to the trivy pods | | scan.plugins.trivy.image.repository | string | `"ghcr.io/aquasecurity/trivy"` | trivy plugin image repository | -| scan.plugins.trivy.image.tag | string | `"0.48.2"` | trivy plugin image tag | +| scan.plugins.trivy.image.tag | string | `"0.49.1"` | trivy plugin image tag | | scan.plugins.trivy.env | list | `[]` | List of environment variables to set in trivy container. | | scan.plugins.trivy.envFrom | list | `[]` | List of sources to populate environment variables in trivy container. | | scan.plugins.trivy.timeout | string | `"10m"` | Trivy timeout | +| scan.plugins.trivy.insecure | bool | `false` | Allow insecure server connections for Trivy | | scan.plugins.popeye.skipInternalResources | bool | `false` | Specifies whether the following resources should be skipped by `popeye` scans. 1. resources from `kube-system`, `kube-public` and `kube-node-lease` namespaces; 2. kubernetes system reserved RBAC (prefixed with `system:`); 3. `kube-root-ca.crt` configmaps; 4. `default` namespace; 5. `default` serviceaccounts; 6. Helm secrets (prefixed with `sh.helm.release`); 7. Zora components. See `popeye` configuration file that is used for this case: https://github.com/undistro/zora/blob/main/charts/zora/templates/plugins/popeye-config.yaml | | scan.plugins.popeye.resources | object | `{"limits":{"cpu":"500m","memory":"500Mi"},"requests":{"cpu":"250m","memory":"256Mi"}}` | [Resources](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers) to add to `popeye` container | | scan.plugins.popeye.podAnnotations | object | `{}` | Annotations added to the popeye pods | diff --git a/charts/zora/templates/plugins/trivy.yaml b/charts/zora/templates/plugins/trivy.yaml index 22dd580..c308235 100644 --- a/charts/zora/templates/plugins/trivy.yaml +++ b/charts/zora/templates/plugins/trivy.yaml @@ -35,6 +35,8 @@ spec: env: - name: TRIVY_IGNORE_VULN_DESCRIPTIONS value: {{ .Values.scan.plugins.trivy.ignoreDescriptions | quote }} + - name: SSL_CERT_DIR + value: "/etc/ssl/:/run/secrets/kubernetes.io/serviceaccount/" {{- with .Values.scan.plugins.trivy.env }} {{- toYaml . | nindent 4 }} {{- end }} @@ -58,6 +60,10 @@ spec: --all-namespaces \ --scanners=vuln \ -f=json \ + --cache-dir=/tmp/trivy-cache \ + {{- if .Values.scan.plugins.trivy.insecure }} + --insecure \ + {{- end }} {{- if .Values.scan.plugins.trivy.ignoreUnfixed }} --ignore-unfixed \ {{- end }} diff --git a/charts/zora/values.yaml b/charts/zora/values.yaml index 338d044..479ec92 100644 --- a/charts/zora/values.yaml +++ b/charts/zora/values.yaml @@ -82,8 +82,6 @@ operator: # -- [Security Context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context) to add to the pod podSecurityContext: runAsNonRoot: true - runAsUser: 65532 - runAsGroup: 65532 # -- [Security Context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context) to add to `manager` container securityContext: allowPrivilegeEscalation: false @@ -211,7 +209,7 @@ scan: # -- trivy plugin image repository repository: ghcr.io/aquasecurity/trivy # -- trivy plugin image tag - tag: 0.48.2 + tag: 0.49.1 # -- List of environment variables to set in trivy container. env: [] # - name: AWS_REGION @@ -228,6 +226,9 @@ scan: # name: trivy-credentials # -- Trivy timeout timeout: 10m + # -- Allow insecure server connections for Trivy + insecure: false + popeye: # -- Specifies whether the following resources should be skipped by `popeye` scans. # 1. resources from `kube-system`, `kube-public` and `kube-node-lease` namespaces;