Skip to content

Minimal implementation #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Feb 27, 2023
Merged

Minimal implementation #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
7352b75
chore: miscellaneous repo updates
Feb 22, 2023
8f7e1cd
feat: initial implementation of the controller
Feb 22, 2023
b21d661
ci: move module download to separate step
Feb 23, 2023
5b683ef
ci: install controller tools
Feb 23, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions .circleci/config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,6 @@ commands:
- go-build-cache-{{ .Branch }}-{{ .Revision }}
- go-build-cache-{{ .Branch }}-
- go-build-cache-

jobs:
scan:
resource_class: small
Expand All @@ -52,16 +51,21 @@ jobs:
# saving & restoring the module cache takes almost 6x longer than simply fetching the modules...
#- go/mod-download-cached
- restore-build-cache
- go/mod-download
- run:
command: |
golangci-lint run ./...
golangci-lint run -v --timeout=2m ./...
environment:
# we re-use the Go build cache as our lint-cache too.
GOLANGCI_LINT_CACHE: /home/circleci/.cache/go-build
# we're not using the go/test command from the Go orb because that uses `-count=1` as an argument.
# That means all tests are run every time, instead of honoring the cache.
- run:
command: go test -race ./...
command: |
# install required tools for kubebuilder tests.
go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest
source <(setup-envtest use -p env)
go test -race ./...
- save-build-cache

release:
Expand Down
9 changes: 9 additions & 0 deletions .dockerignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
.bin/
.circleci/
.github/
test/results/
.git*
*.js
*.md
*.yaml
config.secret.json
64 changes: 64 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,64 @@
### Git ###
# Created by git for backups. To disable backups in Git:
# $ git config --global mergetool.keepBackup false
*.orig

# Created by git when using merge tools for conflicts
*.BACKUP.*
*.BASE.*
*.LOCAL.*
*.REMOTE.*
*_BACKUP_*.txt
*_BASE_*.txt
*_LOCAL_*.txt
*_REMOTE_*.txt

### Go ###
# Binaries for programs and plugins
*.exe
*.exe~
*.dll
*.so
*.dylib

# Test binary, built with `go test -c`
*.test

# Output of the go coverage tool, specifically when used with LiteIDE
*.out

# Dependency directories (remove the comment below to include it)
# /vendor/

# Go workspace file
go.work

### Go Patch ###
/vendor/
/Godeps/

### Helm ###
# Chart dependencies
/helm/**/charts/*.tgz

/helm/config.secret.json

### Test results ###
/test/results

### IDEs ###
.idea
.vscode
.dccache

### Tooling ###
/.bin/

### Local development ###
# Local config file
/config.local.json
# Local build system configuration
/local.mk

### Node.js ###
/node_modules
4 changes: 2 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ ARG COMMIT_SHA
ARG GIT_TAG

RUN go mod download
RUN CGO_ENABLED=0 go build \
RUN CGO_ENABLED=0 GOEXPERIMENT=boringcrypto go build \
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice find! I wish this question https://stackoverflow.com/questions/71215891/does-google-go-dev-boringcrypto-branch-contains-fips-certified-boringcrypto-libr had an answer... 😄

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This does though:

Is the plan to inherit the existing CMVP validation of BoringCrpto until 7/12/2025 or submit for a new FIPS validation?

@pfox1969 The BoringCrypto module being used did not change as part of this work.

And because the BoringCrypto module is FIPS-certified, I'd say yes it is FIPS-certified as well?

Also, this seems to be an interesting discussion, which links to this

// Package fipsonly restricts all TLS configuration to FIPS-approved settings.
//
// The effect is triggered by importing the package anywhere in a program, as in:
//
//	import _ "crypto/tls/fipsonly"
//
// This package only exists when using Go compiled with GOEXPERIMENT=boringcrypto.

Looks pretty good to me then? 😄 (we do not have imported this package currently though)

-ldflags="-s -w \
-X github.com/snyk/kubernetes-scanner/build.commitSHA=$COMMIT_SHA \
-X github.com/snyk/kubernetes-scanner/build.tag=$GIT_TAG\
Expand All @@ -18,4 +18,4 @@ RUN CGO_ENABLED=0 go build \
FROM gcr.io/distroless/static

COPY --from=build /go/bin/kubernetes-scanner /
CMD ["/kubernetes-scanner"]
ENTRYPOINT ["/kubernetes-scanner"]
13 changes: 13 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
# Kubernetes-Scanner

## Running tests

- Install Kubebuilder from your package manager of choice
- Install setup-envtest with Go: `go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest`
- Install the required tools: `setup-envtest use`
- Setup the environment: `setup-envtest use -p env | source`

(yes this is not optimal)

See [this](https://pkg.go.dev/sigs.k8s.io/controller-runtime/tools/setup-envtest#section-readme)
for more info.
67 changes: 67 additions & 0 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,70 @@
module github.com/snyk/kubernetes-scanner

go 1.19

require (
golang.org/x/exp v0.0.0-20230213192124-5e25df0256eb
k8s.io/api v0.26.1
k8s.io/apimachinery v0.26.1
k8s.io/client-go v0.26.1
sigs.k8s.io/controller-runtime v0.14.4
)

require (
github.com/beorn7/perks v1.0.1 // indirect
github.com/cespare/xxhash/v2 v2.1.2 // indirect
github.com/davecgh/go-spew v1.1.1 // indirect
github.com/emicklei/go-restful/v3 v3.9.0 // indirect
github.com/evanphx/json-patch v4.12.0+incompatible // indirect
github.com/evanphx/json-patch/v5 v5.6.0 // indirect
github.com/fsnotify/fsnotify v1.6.0 // indirect
github.com/go-logr/logr v1.2.3 // indirect
github.com/go-logr/zapr v1.2.3 // indirect
github.com/go-openapi/jsonpointer v0.19.5 // indirect
github.com/go-openapi/jsonreference v0.20.0 // indirect
github.com/go-openapi/swag v0.19.14 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
github.com/golang/protobuf v1.5.2 // indirect
github.com/google/gnostic v0.5.7-v3refs // indirect
github.com/google/go-cmp v0.5.9 // indirect
github.com/google/gofuzz v1.1.0 // indirect
github.com/google/uuid v1.1.2 // indirect
github.com/imdario/mergo v0.3.6 // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/mailru/easyjson v0.7.6 // indirect
github.com/matttproud/golang_protobuf_extensions v1.0.2 // indirect
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
github.com/modern-go/reflect2 v1.0.2 // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/pkg/errors v0.9.1 // indirect
github.com/prometheus/client_golang v1.14.0 // indirect
github.com/prometheus/client_model v0.3.0 // indirect
github.com/prometheus/common v0.37.0 // indirect
github.com/prometheus/procfs v0.8.0 // indirect
github.com/spf13/pflag v1.0.5 // indirect
go.uber.org/atomic v1.7.0 // indirect
go.uber.org/multierr v1.6.0 // indirect
go.uber.org/zap v1.24.0 // indirect
golang.org/x/net v0.3.1-0.20221206200815-1e63c2f08a10 // indirect
golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b // indirect
golang.org/x/sys v0.3.0 // indirect
golang.org/x/term v0.3.0 // indirect
golang.org/x/text v0.5.0 // indirect
golang.org/x/time v0.3.0 // indirect
gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect
google.golang.org/appengine v1.6.7 // indirect
google.golang.org/protobuf v1.28.1 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/apiextensions-apiserver v0.26.1 // indirect
k8s.io/component-base v0.26.1 // indirect
k8s.io/klog/v2 v2.80.1 // indirect
k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 // indirect
k8s.io/utils v0.0.0-20221128185143-99ec85e7a448 // indirect
sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 // indirect
sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
sigs.k8s.io/yaml v1.3.0 // indirect
)
Loading