Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Insecure connection handling #38

Merged
merged 17 commits into from
Nov 11, 2024
Merged

Insecure connection handling #38

Show file tree
Hide file tree
Changes from 16 commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
231869d
handling insecure connections
surya9839 Sep 4, 2024
2bf42db
handling insecure connections
surya9839 Sep 4, 2024
36caeb6
handling insecure connections
surya9839 Sep 4, 2024
960501f
handling insecure connections
surya9839 Sep 4, 2024
86c4ba6
removed hardcorded data_type for curl command
surya9839 Sep 26, 2024
f860e05
modifing docker file
surya9839 Oct 1, 2024
624d711
modifing docker file
surya9839 Oct 1, 2024
88a5071
modifing K8s-risk-management
surya9839 Oct 1, 2024
e0a0a45
modifing K8s-risk-management
surya9839 Oct 1, 2024
125ea6a
values update
surya9839 Oct 1, 2024
2b19016
values update
surya9839 Oct 1, 2024
8f787f9
new_requirement of allowing local cert
surya9839 Oct 23, 2024
e64086e
Update curl_command.sh
surya9839 Oct 25, 2024
bdea86e
logic for cert from local
surya9839 Oct 25, 2024
56517ae
changes for local cert
surya9839 Oct 28, 2024
8931a58
changes for local cert
surya9839 Oct 29, 2024
102e238
Merge branch 'main' into insecure-connection-handling
SujithKasireddy Nov 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file added .DS_Store
View file
Open in desktop
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove binary file

Binary file not shown.
4 changes: 4 additions & 0 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,5 +2,9 @@ FROM alpine:latest

RUN apk --update add jq curl
COPY entrypoint.sh .
COPY curl_command.sh .

# Grant execute permissions to the scripts
RUN chmod +x entrypoint.sh curl_command.sh
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove this RUN step.
On your local system run:

chmod +x entrypoint.sh curl_command.sh
git add entrypoint.sh curl_command.sh


ENTRYPOINT ["/bin/sh", "entrypoint.sh"]
Binary file added cis-k8s-job/.DS_Store
View file
Open in desktop
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove binary file

Binary file not shown.
16 changes: 12 additions & 4 deletions cis-k8s-job/templates/cis-corn-job.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ spec:
containers:
- image: accuknox/accuknox-job:latest
command: ["/bin/sh", "-c"]
args: ['/bin/sh entrypoint.sh && curl --location --request POST "https://${URL}/api/v1/artifact/?tenant_id=${TENANT_ID}&data_type=KB&label_id=${LABEL_NAME}&save_to_s3=true" --header "Tenant-Id: ${TENANT_ID}" --header "Authorization: Bearer ${AUTH_TOKEN}" --form "file=@\"./data/report.json\"" && cat /data/report.json']
args: ['/bin/sh entrypoint.sh && ./curl_command.sh']
name: cis-k8s-cronjob
resources: {}
env:
Expand All @@ -24,11 +24,19 @@ spec:
- name: LABEL_NAME
value: {{ .Values.accuknox.label }}
- name: CLUSTER_ID
value: {{ .Values.accuknox.clusterId }}
value: {{ .Values.accuknox.clusterID }}
- name: TENANT_ID
value: {{ .Values.accuknox.tenantId | quote}}
value: {{ .Values.accuknox.tenantID | quote}}
- name: URL
value: {{ .Values.accuknox.url }}
value: {{ .Values.accuknox.URL }}
- name: CERT_BUNDLE_PATH
value: {{ .Values.accuknox.certBundlePath | quote }}
- name: CERT_BUNDLE_URL
value: {{ .Values.accuknox.certBundleURL }}
- name: USE_INSECURE_CONNECTION
value: {{ .Values.accuknox.useInsecureConnection | quote }}
- name: DATA_TYPE
value: "KB"
volumeMounts:
- mountPath: /data
name: datapath
Expand Down
16 changes: 12 additions & 4 deletions cis-k8s-job/templates/cis-job.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ spec:
containers:
- image: accuknox/accuknox-job:latest
command: ["/bin/sh", "-c"]
args: ['/bin/sh entrypoint.sh && curl --location --request POST "https://${URL}/api/v1/artifact/?tenant_id=${TENANT_ID}&data_type=KB&label_id=${LABEL_NAME}&save_to_s3=true" --header "Tenant-Id: ${TENANT_ID}" --header "Authorization: Bearer ${AUTH_TOKEN}" --form "file=@\"./data/report.json\"" && cat /data/report.json']
args: ['/bin/sh entrypoint.sh && ./curl_command.sh']
name: cis-k8s-cronjob
resources: {}
env:
Expand All @@ -24,11 +24,19 @@ spec:
- name: LABEL_NAME
value: {{ .Values.accuknox.label }}
- name: CLUSTER_ID
value: {{ .Values.accuknox.clusterId }}
value: {{ .Values.accuknox.clusterID }}
- name: TENANT_ID
value: {{ .Values.accuknox.tenantId | quote}}
value: {{ .Values.accuknox.tenantID | quote}}
- name: URL
value: {{ .Values.accuknox.url }}
value: {{ .Values.accuknox.URL }}
Comment on lines -44 to +48
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fix values.

- name: CERT_BUNDLE_PATH
value: {{ .Values.accuknox.certBundlePath | quote }}
- name: CERT_BUNDLE_URL
value: {{ .Values.accuknox.certBundleURL }}
- name: USE_INSECURE_CONNECTION
value: {{ .Values.accuknox.useInsecureConnection | quote }}
- name: DATA_TYPE
value: "KB"
volumeMounts:
- mountPath: /data
name: datapath
Expand Down
10 changes: 7 additions & 3 deletions cis-k8s-job/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,10 @@ accuknox:
cronTab: "30 9 * * *"
clusterName: ""
label: ""
clusterId: ""
tenantId: ""
url: "cspm.demo.accuknox.com"
clusterID: ""
tenantID: ""
URL: "cspm.demo.accuknox.com"
certBundlePath: "" # Set this for cert local path if needed .
certBundleURL: "" # Set this for cert URL if needed (if certBundlePath is set as well certBundlePath will take precedent)
useInsecureConnection: false # Set to true if insecure connection is needed

34 changes: 34 additions & 0 deletions curl_command.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
#!/bin/sh

# Initialize CURL_FLAGS to handle both insecure and certificate usage
CURL_FLAGS=""

# Always add --insecure if USE_INSECURE_CONNECTION is true
if [ "$USE_INSECURE_CONNECTION" = "true" ]; then
CURL_FLAGS="$CURL_FLAGS --insecure"
fi

# Add certificate flags if CERT_BUNDLE_PATH is provided
if [ -n "$CERT_BUNDLE_PATH" ]; then
echo "Using in-line certificate content from CERT_BUNDLE_PATH..."
printf "%b" "$CERT_BUNDLE_PATH" > /tmp/cert.pem
CURL_FLAGS="$CURL_FLAGS --cacert /tmp/cert.pem"
elif [ -n "$CERT_BUNDLE_URL" ]; then
echo "Attempting to download certificate from $CERT_BUNDLE_URL..."
if curl -o /tmp/cert.pem "$CERT_BUNDLE_URL"; then
CURL_FLAGS="$CURL_FLAGS --cacert /tmp/cert.pem"
else
echo "Certificate not available or failed to download."
fi
fi

# main curl command
curl --location --request POST "https://${URL}/api/v1/artifact/?tenant_id=${TENANT_ID}&data_type=${DATA_TYPE}&label_id=${LABEL_NAME}&save_to_s3=true" \
--header "Tenant-Id: ${TENANT_ID}" \
--header "Authorization: Bearer ${AUTH_TOKEN}" \
$CURL_FLAGS \
--form "file=@/data/report.json"

SujithKasireddy marked this conversation as resolved.
Show resolved Hide resolved
# Print the report
cat /data/report.json

7 changes: 2 additions & 5 deletions k8s-risk-assessment-job/templates/configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,8 +33,5 @@ data:
cat /data/report.json

# push
curl --location --request POST \
--header "Authorization: Bearer ${AUTH_TOKEN}" \
--header "Tenant-Id: ${TENANT_ID}" \
--form "file=@\"/data/report.json\"" \
"https://${URL}/api/v1/artifact/?tenant_id=${TENANT_ID}&data_type=KS&save_to_s3=false&label_id=${LABEL_NAME}"

/curl_command.sh
8 changes: 8 additions & 0 deletions k8s-risk-assessment-job/templates/cronjob.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,14 @@ spec:
value: {{ .Values.accuknox.clusterID | quote }}
- name: LABEL_NAME
value: {{ .Values.accuknox.label }}
- name: CERT_BUNDLE_PATH
value: {{ .Values.accuknox.certBundlePath | quote }}
- name: CERT_BUNDLE_URL
value: {{ .Values.accuknox.certBundleURL }}
- name: USE_INSECURE_CONNECTION
value: {{ .Values.accuknox.useInsecureConnection | quote }}
- name: DATA_TYPE
value: "KS"
volumeMounts:
- mountPath: /data
name: datapath
Expand Down
8 changes: 8 additions & 0 deletions k8s-risk-assessment-job/templates/job.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,14 @@ spec:
value: {{ .Values.accuknox.clusterID | quote }}
- name: LABEL_NAME
value: {{ .Values.accuknox.label }}
- name: CERT_BUNDLE_PATH
value: {{ .Values.accuknox.certBundlePath | quote }}
- name: CERT_BUNDLE_URL
value: {{ .Values.accuknox.certBundleURL }}
- name: USE_INSECURE_CONNECTION
value: {{ .Values.accuknox.useInsecureConnection | quote }}
- name: DATA_TYPE
value: "KS"
volumeMounts:
- mountPath: /data
name: datapath
Expand Down
4 changes: 4 additions & 0 deletions k8s-risk-assessment-job/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,3 +18,7 @@ accuknox:
clusterID: 0
label: ""
secretName: ""
certBundlePath: "" # Set this for cert local path if needed .
certBundleURL: "" # Set this for cert URL if needed (if certBundlePath is set as well certBundlePath will take precedent)
useInsecureConnection: false # Set to true if insecure connection is needed

10 changes: 9 additions & 1 deletion k8tls-job/templates/k8tls-cronjob.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ spec:
containers:
- image: accuknox/accuknox-job:latest
command: ["/bin/sh", "-c"]
args: ['curl --location --request POST "https://${URL}/api/v1/artifact/?tenant_id=${TENANT_ID}&data_type=K8TLS&save_to_s3=false" --header "Tenant-Id: ${TENANT_ID}" --header "Authorization: Bearer ${AUTH_TOKEN}" --form "file=@\"/data/report.json\"" && cat /data/report.json']
args: ['./curl_command.sh']
name: k8tls-job
resources: {}
env:
Expand All @@ -56,6 +56,14 @@ spec:
value: {{ if ne .Values.accuknox.clusterName "" }}{{ .Values.accuknox.clusterName }}{{ else }}{{ "default" }}{{ end }}
- name: LABEL_NAME
value: {{ if ne .Values.accuknox.label "" }}{{ .Values.accuknox.label }}{{ else }}{{ "default" }}{{ end }}
- name: CERT_BUNDLE_PATH
value: {{ .Values.accuknox.certBundlePath | quote }}
- name: CERT_BUNDLE_URL
value: {{ .Values.accuknox.certBundleURL }}
- name: USE_INSECURE_CONNECTION
value: {{ .Values.accuknox.useInsecureConnection | quote }}
- name: DATA_TYPE
value: "K8TLS"
volumeMounts:
- mountPath: /data
name: datapath
Expand Down
10 changes: 9 additions & 1 deletion k8tls-job/templates/k8tls-job.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ spec:
containers:
- image: accuknox/accuknox-job:latest
command: ["/bin/sh", "-c"]
args: ['curl --location --request POST "https://${URL}/api/v1/artifact/?tenant_id=${TENANT_ID}&data_type=K8TLS&save_to_s3=false" --header "Tenant-Id: ${TENANT_ID}" --header "Authorization: Bearer ${AUTH_TOKEN}" --form "file=@\"/data/report.json\"" && cat /data/report.json']
args: ['./curl_command.sh']
SujithKasireddy marked this conversation as resolved.
Show resolved Hide resolved
name: k8tls-job
resources: {}
env:
Expand All @@ -26,6 +26,14 @@ spec:
value: {{ if ne .Values.accuknox.clusterName "" }}{{ .Values.accuknox.clusterName }}{{ else }}{{ "default" }}{{ end }}
- name: LABEL_NAME
value: {{ if ne .Values.accuknox.label "" }}{{ .Values.accuknox.label }}{{ else }}{{ "default" }}{{ end }}
- name: CERT_BUNDLE_PATH
value: {{ .Values.accuknox.certBundlePath | quote }}
- name: CERT_BUNDLE_URL
value: {{ .Values.accuknox.certBundleURL }}
- name: USE_INSECURE_CONNECTION
value: {{ .Values.accuknox.useInsecureConnection | quote }}
- name: DATA_TYPE
value: "K8TLS"
volumeMounts:
- mountPath: /data
name: datapath
Expand Down
3 changes: 3 additions & 0 deletions k8tls-job/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,3 +9,6 @@ accuknox:
clusterName: ""
label: ""
URL: "cspm.demo.accuknox.com"
certBundlePath: "" # Set this for cert local path if needed .
certBundleURL: "" # Set this for cert URL if needed (if certBundlePath is set as well certBundlePath will take precedent)
useInsecureConnection: false # Set to true if insecure connection is needed
11 changes: 10 additions & 1 deletion kiem-job/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,8 @@ spec:
mountPath: /data
containers:
- image: accuknox/accuknox-job:latest
command: ['sh', '-c', 'curl --location --request POST "https://${URL}/api/v1/artifact/?tenant_id=${TENANT_ID}&data_type=KIEM&save_to_s3=false&label_id=${LABEL_NAME}" --header "Tenant-Id: ${TENANT_ID}" --header "Authorization: Bearer ${AUTH_TOKEN}" --form "file=@\"/data/report.json\""']
command: ["/bin/sh", "-c"]
args: ['./curl_command.sh']
name: accuknox-kiem-cronjob
resources: {}
env:
Expand All @@ -40,6 +41,14 @@ spec:
value: {{ .Values.accuknox.clusterName }}
- name: LABEL_NAME
value: {{ .Values.accuknox.label | quote}}
- name: CERT_BUNDLE_PATH
value: {{ .Values.accuknox.certBundlePath | quote }}
- name: CERT_BUNDLE_URL
value: {{ .Values.accuknox.certBundleURL }}
- name: USE_INSECURE_CONNECTION
value: {{ .Values.accuknox.useInsecureConnection | quote }}
- name: DATA_TYPE
value: "KIEM"
volumeMounts:
- mountPath: /data
name: datapath
Expand Down
11 changes: 10 additions & 1 deletion kiem-job/templates/job.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,8 @@ spec:
mountPath: /data
containers:
- image: accuknox/accuknox-job:latest
command: ['sh', '-c', 'curl --location --request POST "https://${URL}/api/v1/artifact/?tenant_id=${TENANT_ID}&data_type=KIEM&save_to_s3=false&label_id=${LABEL_NAME}" --header "Tenant-Id: ${TENANT_ID}" --header "Authorization: Bearer ${AUTH_TOKEN}" --form "file=@\"/data/report.json\""']
command: ["/bin/sh", "-c"]
args: ['./curl_command.sh']
name: accuknox-kiem-job
resources: {}
env:
Expand All @@ -35,6 +36,14 @@ spec:
value: {{ .Values.accuknox.clusterName }}
- name: LABEL_NAME
value: {{ .Values.accuknox.label | quote}}
- name: CERT_BUNDLE_PATH
value: {{ .Values.accuknox.certBundlePath | quote }}
- name: CERT_BUNDLE_URL
value: {{ .Values.accuknox.certBundleURL }}
- name: USE_INSECURE_CONNECTION
value: {{ .Values.accuknox.useInsecureConnection | quote }}
- name: DATA_TYPE
value: "KIEM"
volumeMounts:
- mountPath: /data
name: datapath
Expand Down
3 changes: 3 additions & 0 deletions kiem-job/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,6 @@ accuknox:
cronTab: "30 9 * * *"
clusterName: ""
label: ""
certBundlePath: "" # Set this for cert local path if needed .
certBundleURL: "" # Set this for cert URL if needed (if certBundlePath is set as well certBundlePath will take precedent)
useInsecureConnection: false # Set to true if insecure connection is needed
Loading