From 074e1bd0443c0daa7774d3ad62e4cef7b50722d0 Mon Sep 17 00:00:00 2001 From: Steve G <9045562+eurogig@users.noreply.github.com> Date: Tue, 8 Feb 2022 11:59:52 +0000 Subject: [PATCH 01/12] Preflight security check prod --- .github/workflows/prod-preflight.yml | 34 ++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 .github/workflows/prod-preflight.yml diff --git a/.github/workflows/prod-preflight.yml b/.github/workflows/prod-preflight.yml new file mode 100644 index 0000000..7c69f7b --- /dev/null +++ b/.github/workflows/prod-preflight.yml @@ -0,0 +1,34 @@ +# This is a basic workflow to help you get started with Actions + +name: CD + +# Controls when the workflow will run +on: + # Triggers the workflow on push or pull request events but only for the main branch + push: + branches: [ main ] + pull_request: + branches: [ main ] + + # Allows you to run this workflow manually from the Actions tab + workflow_dispatch: + +# A workflow run is made up of one or more jobs that can run sequentially or in parallel +jobs: + # This workflow contains a single job called "build" + build: + # The type of runner that the job will run on + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v2 + - name: Set up Python 3.8 + uses: actions/setup-python@v1 + with: + python-version: 3.8 + - name: Test with Checkov + id: checkov + uses: bridgecrewio/checkov-action@master + with: + directory: overlays/prod + framework: kustomize From d2c96e43c1b5ca4b650e3eb0f7464f68cf45dd92 Mon Sep 17 00:00:00 2001 From: Steve G <9045562+eurogig@users.noreply.github.com> Date: Tue, 8 Feb 2022 12:03:58 +0000 Subject: [PATCH 02/12] Dev Preflight Security --- .github/workflows/dev-preflight.yml | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 .github/workflows/dev-preflight.yml diff --git a/.github/workflows/dev-preflight.yml b/.github/workflows/dev-preflight.yml new file mode 100644 index 0000000..26585d4 --- /dev/null +++ b/.github/workflows/dev-preflight.yml @@ -0,0 +1,27 @@ +# This is a basic workflow to help you get started with Actions + +name: DEVCD-Checkov + +# Controls when the workflow will run +on: + # Triggers the workflow on push or pull request events but only for the main branch + push: + branches: [ main ] + pull_request: + branches: [ main ] + + # Allows you to run this workflow manually from the Actions tab + workflow_dispatch: + + steps: + - uses: actions/checkout@v2 + - name: Set up Python 3.8 + uses: actions/setup-python@v1 + with: + python-version: 3.8 + - name: Test with Checkov + id: checkov + uses: bridgecrewio/checkov-action@master + with: + directory: kustomize/overlays/dev + framework: kustomize From 825daeb151dc09ac0193a3c0ac2b78d7534139af Mon Sep 17 00:00:00 2001 From: Steve G <9045562+eurogig@users.noreply.github.com> Date: Tue, 8 Feb 2022 12:06:32 +0000 Subject: [PATCH 03/12] Fixed path --- .github/workflows/prod-preflight.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/prod-preflight.yml b/.github/workflows/prod-preflight.yml index 7c69f7b..2ca0d46 100644 --- a/.github/workflows/prod-preflight.yml +++ b/.github/workflows/prod-preflight.yml @@ -30,5 +30,5 @@ jobs: id: checkov uses: bridgecrewio/checkov-action@master with: - directory: overlays/prod + directory: kustomize/overlays/prod framework: kustomize From d6e6447261e47a12418e5ddf8cc78814a3e19510 Mon Sep 17 00:00:00 2001 From: Steve G <9045562+eurogig@users.noreply.github.com> Date: Tue, 8 Feb 2022 12:06:42 +0000 Subject: [PATCH 04/12] Big Typo Fix --- .github/workflows/dev-preflight.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/dev-preflight.yml b/.github/workflows/dev-preflight.yml index 26585d4..035b82f 100644 --- a/.github/workflows/dev-preflight.yml +++ b/.github/workflows/dev-preflight.yml @@ -12,7 +12,13 @@ on: # Allows you to run this workflow manually from the Actions tab workflow_dispatch: - + +# A workflow run is made up of one or more jobs that can run sequentially or in parallel +jobs: + # This workflow contains a single job called "build" + build: + # The type of runner that the job will run on + runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 - name: Set up Python 3.8 From f70e9186728b7ff706d5ac6f66ddc4415dd4ef95 Mon Sep 17 00:00:00 2001 From: Steve G <9045562+eurogig@users.noreply.github.com> Date: Tue, 8 Feb 2022 12:29:34 +0000 Subject: [PATCH 05/12] Added kubectl --- .github/workflows/dev-preflight.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/dev-preflight.yml b/.github/workflows/dev-preflight.yml index 035b82f..1f49182 100644 --- a/.github/workflows/dev-preflight.yml +++ b/.github/workflows/dev-preflight.yml @@ -20,6 +20,11 @@ jobs: # The type of runner that the job will run on runs-on: ubuntu-latest steps: + - name: Kubectl tool installer + uses: Azure/setup-kubectl@v2.0 + with: + # Version of kubectl + version: v1.22.4 - uses: actions/checkout@v2 - name: Set up Python 3.8 uses: actions/setup-python@v1 From df1c7284ad3dafcb8b9442cad60ccf1e23843430 Mon Sep 17 00:00:00 2001 From: Steve G <9045562+eurogig@users.noreply.github.com> Date: Tue, 8 Feb 2022 12:52:27 +0000 Subject: [PATCH 06/12] Just the base yaml --- .github/workflows/dev-preflight.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dev-preflight.yml b/.github/workflows/dev-preflight.yml index 1f49182..f53cee6 100644 --- a/.github/workflows/dev-preflight.yml +++ b/.github/workflows/dev-preflight.yml @@ -34,5 +34,5 @@ jobs: id: checkov uses: bridgecrewio/checkov-action@master with: - directory: kustomize/overlays/dev - framework: kustomize + directory: kustomize/base + framework: kubernetes From 6e8b33c25430d350d428d5f93be140ad41116ea3 Mon Sep 17 00:00:00 2001 From: Steve G <9045562+eurogig@users.noreply.github.com> Date: Tue, 8 Feb 2022 14:44:08 +0000 Subject: [PATCH 07/12] Set back to dev --- .github/workflows/dev-preflight.yml | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/.github/workflows/dev-preflight.yml b/.github/workflows/dev-preflight.yml index f53cee6..53d7885 100644 --- a/.github/workflows/dev-preflight.yml +++ b/.github/workflows/dev-preflight.yml @@ -6,7 +6,8 @@ name: DEVCD-Checkov on: # Triggers the workflow on push or pull request events but only for the main branch push: - branches: [ main ] + paths: + - 'kustomize/overlays/dev/**' pull_request: branches: [ main ] @@ -19,12 +20,7 @@ jobs: build: # The type of runner that the job will run on runs-on: ubuntu-latest - steps: - - name: Kubectl tool installer - uses: Azure/setup-kubectl@v2.0 - with: - # Version of kubectl - version: v1.22.4 + steps: - uses: actions/checkout@v2 - name: Set up Python 3.8 uses: actions/setup-python@v1 @@ -34,5 +30,5 @@ jobs: id: checkov uses: bridgecrewio/checkov-action@master with: - directory: kustomize/base - framework: kubernetes + directory: kustomize/overlays/dev + framework: kustomize From 88c8a0365d0d2b479f87060afd3fc1f46619f2a5 Mon Sep 17 00:00:00 2001 From: Steve G <9045562+eurogig@users.noreply.github.com> Date: Tue, 8 Feb 2022 14:46:04 +0000 Subject: [PATCH 08/12] checking all pushes --- .github/workflows/dev-preflight.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/dev-preflight.yml b/.github/workflows/dev-preflight.yml index 53d7885..69bd049 100644 --- a/.github/workflows/dev-preflight.yml +++ b/.github/workflows/dev-preflight.yml @@ -6,8 +6,7 @@ name: DEVCD-Checkov on: # Triggers the workflow on push or pull request events but only for the main branch push: - paths: - - 'kustomize/overlays/dev/**' + branches: [ main ] pull_request: branches: [ main ] From d37458bc6ce6a5073c4184796b8b60a01a75b89f Mon Sep 17 00:00:00 2001 From: Steve G <9045562+eurogig@users.noreply.github.com> Date: Tue, 8 Feb 2022 16:23:03 +0000 Subject: [PATCH 09/12] Excess to requirements for demo --- .github/workflows/prod-preflight.yml | 34 ---------------------------- 1 file changed, 34 deletions(-) delete mode 100644 .github/workflows/prod-preflight.yml diff --git a/.github/workflows/prod-preflight.yml b/.github/workflows/prod-preflight.yml deleted file mode 100644 index 2ca0d46..0000000 --- a/.github/workflows/prod-preflight.yml +++ /dev/null @@ -1,34 +0,0 @@ -# This is a basic workflow to help you get started with Actions - -name: CD - -# Controls when the workflow will run -on: - # Triggers the workflow on push or pull request events but only for the main branch - push: - branches: [ main ] - pull_request: - branches: [ main ] - - # Allows you to run this workflow manually from the Actions tab - workflow_dispatch: - -# A workflow run is made up of one or more jobs that can run sequentially or in parallel -jobs: - # This workflow contains a single job called "build" - build: - # The type of runner that the job will run on - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@v2 - - name: Set up Python 3.8 - uses: actions/setup-python@v1 - with: - python-version: 3.8 - - name: Test with Checkov - id: checkov - uses: bridgecrewio/checkov-action@master - with: - directory: kustomize/overlays/prod - framework: kustomize From 3a335b677d99c654d457d6f40ab7f1182c3d9df0 Mon Sep 17 00:00:00 2001 From: Steve G <9045562+eurogig@users.noreply.github.com> Date: Wed, 9 Feb 2022 11:15:45 +0000 Subject: [PATCH 10/12] prod action --- .github/workflows/prof-preflight.yml | 35 ++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 .github/workflows/prof-preflight.yml diff --git a/.github/workflows/prof-preflight.yml b/.github/workflows/prof-preflight.yml new file mode 100644 index 0000000..9bcdb2f --- /dev/null +++ b/.github/workflows/prof-preflight.yml @@ -0,0 +1,35 @@ +# This is a basic workflow to help you get started with Actions + +name: PRODCD-Checkov + +# Controls when the workflow will run +on: + # Triggers the workflow on push or pull request events but only for the main branch + push: + branches: [ main ] + paths: 'kustomize/overlays/prod/**' + pull_request: + branches: [ main ] + paths: 'kustomize/overlays/prod/**' + + # Allows you to run this workflow manually from the Actions tab + workflow_dispatch: + +# A workflow run is made up of one or more jobs that can run sequentially or in parallel +jobs: + # This workflow contains a single job called "build" + build: + # The type of runner that the job will run on + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v2 + - name: Set up Python 3.8 + uses: actions/setup-python@v1 + with: + python-version: 3.8 + - name: Test with Checkov + id: checkov + uses: bridgecrewio/checkov-action@master + with: + directory: kustomize/overlays/prod + framework: kustomize From efac3b4adf7647d2d38966839e5b53a99813cd59 Mon Sep 17 00:00:00 2001 From: Steve G <9045562+eurogig@users.noreply.github.com> Date: Tue, 15 Feb 2022 11:42:07 +0000 Subject: [PATCH 11/12] Rename prof-preflight.yml to prod-preflight.yml --- .github/workflows/{prof-preflight.yml => prod-preflight.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename .github/workflows/{prof-preflight.yml => prod-preflight.yml} (100%) diff --git a/.github/workflows/prof-preflight.yml b/.github/workflows/prod-preflight.yml similarity index 100% rename from .github/workflows/prof-preflight.yml rename to .github/workflows/prod-preflight.yml From 8bab8bab435cf3e166777cbc497132f8ada345bf Mon Sep 17 00:00:00 2001 From: eurogig Date: Wed, 16 Feb 2022 11:24:43 +0000 Subject: [PATCH 12/12] Updated seccomp to k8s 1.19 --- .pre-commit-config.yaml | 8 ++++++++ kustomize/overlays/prod/deployment.yaml | 5 ++--- 2 files changed, 10 insertions(+), 3 deletions(-) create mode 100644 .pre-commit-config.yaml diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 0000000..4f04cec --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,8 @@ +- repo: https://github.com/bridgecrewio/checkov.git + rev: '2.0.809' # change to tag or sha + hooks: + - id: checkov + entry: checkov -d kustomize/overlays/prod + verbose: true + files: \.yaml$ + args: ["--framework","kustomize"] diff --git a/kustomize/overlays/prod/deployment.yaml b/kustomize/overlays/prod/deployment.yaml index efacc0e..7105979 100644 --- a/kustomize/overlays/prod/deployment.yaml +++ b/kustomize/overlays/prod/deployment.yaml @@ -5,9 +5,6 @@ metadata: namespace: kustomizegoat spec: template: - metadata: - annotations: - seccomp.security.alpha.kubernetes.io/pod: "docker/default" spec: affinity: podAntiAffinity: @@ -59,6 +56,8 @@ spec: name: pid-volume automountServiceAccountToken: false securityContext: + seccompProfile: + type: RuntimeDefault runAsNonRoot: true runAsUser: 10014 runAsGroup: 10014