Merge pull request #4 from tks98/trivy-sidecar

Refactoring, Documentation, Demo

Dockerfile

@@ -10,9 +10,7 @@ RUN apt-get update -y && \
     curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
 
 # build Go binary
-# remove debugging information and compress binary
-RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o kube-sentry main.go
-#RUN upx --brute kube-sentry
+RUN CGO_ENABLED=0 go build -o kube-sentry main.go
 
 # copy binary into smaller image
 FROM alpine:latest

README.md

@@ -1,4 +1,9 @@
-# kube-sentry
+<img src="docs/diagrams/logo/kube-sentry-logo-banner.png" alt="kube-sentry"/>
+
+>Defend against high-risk workloads and gain visibility into vulnerable containers running on Kubernetes
+
+
+# Introduction
 
 kube-sentry is a validating admission webhook for Kubernetes that scans incoming container images for vulnerabilities, exports scan results to prometheus, and can prevent pods from being created based on user specified rules.
 
@@ -8,13 +13,15 @@ kube-sentry is a validating admission webhook for Kubernetes that scans incoming
 
 kube-sentry can be installed with the included helm chart
 
+![kube-sentry-demo](docs/demo/demo.gif)
+
 ```bash
-helm install kube-sentry -n kube-sentry --create-namespace .
+helm install kube-sentry -n kube-sentry . --wait 
 ```
 
 ## Dependencies
 
-kube-sentry requires a remote trivy server for scanning container images. This can be installed using the trivy helm chart https://github.com/aquasecurity/trivy/tree/main/helm/trivy.
+kube-sentry requires a remote trivy server for scanning container images. By default, it is installed as a chart dependency. 
 
 ## Configuration
 

deploy/kube-sentry/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: trivy
+  repository: https://aquasecurity.github.io/helm-charts/
+  version: 0.4.17
+digest: sha256:c4d6c7d1dd063f88c1726e417d3cf005af1d3a95c3d45b0b4036e7d1cce90cab
+generated: "2022-10-29T22:58:19.421851-05:00"

deploy/kube-sentry/Chart.yaml

@@ -1,6 +1,20 @@
 apiVersion: v2
 name: kube-sentry
-description: A Helm chart for Kubernetes
+description: Defend against high-risk workloads and gain visibility into vulnerable containers running on Kubernetes
 type: application
-version: 0.1.0
-appVersion: "1.16.0"
+version: 1.0.0
+appVersion: "1.0.0"
+sources:
+  - https://github.com/tks98/kube-sentry
+maintainers:
+  - name: Travis Smith
+    email: [email protected]
+    url: https://github.com/tks98
+
+dependencies:
+  - name: trivy
+    version: "0.4.17"
+    repository: https://aquasecurity.github.io/helm-charts/
+    condition: trivy.enabled
+    tags:
+      - trivy

deploy/kube-sentry/templates/cert.yaml

@@ -1,24 +1,30 @@
+{{- if .Values.webhook.caBundle.certmanager.enabled }}
 apiVersion: cert-manager.io/v1
 kind: Issuer
 metadata:
-  name: self-signer
+  name: {{ include "kube-sentry.fullname" . }}
   namespace: {{.Release.Namespace}}
   annotations:
     "helm.sh/hook": pre-install
     "helm.sh/hook-weight": "-3"
+  labels:
+    {{- include "kube-sentry.labels" . | nindent 4 }}
 spec:
   selfSigned: {}
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
-  name: kube-sentry-cert
+  name: {{ include "kube-sentry.fullname" . }}-cert
   namespace: {{ .Release.Namespace }}
   annotations:
     "helm.sh/hook": pre-install
+  labels:
+    {{- include "kube-sentry.labels" . | nindent 4 }}
 spec:
-  secretName: {{.Values.webhook.caBundle.certmanager.secretName}}
+  secretName: {{ include "kube-sentry.fullname" . }}-cert
   dnsNames:
-{{- toYaml .Values.webhook.caBundle.certmanager.dnsNames | nindent 4 }}
+    - {{ include "kube-sentry.fullname" . }}.{{.Release.Namespace}}.svc
   issuerRef:
-    name: self-signer
+    name: {{ include "kube-sentry.fullname" . }}
+{{- end }}

deploy/kube-sentry/templates/deployment.yaml

@@ -57,7 +57,7 @@ spec:
       volumes:
         - name: webhook-certs
           secret:
-            secretName: kube-sentry-cert
+            secretName: {{ include "kube-sentry.fullname" . }}-cert
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

deploy/kube-sentry/templates/webhook.yaml → deploy/kube-sentry/templates/validatingwebhookconfiguration.yaml

@@ -2,11 +2,15 @@ kind: ValidatingWebhookConfiguration
 apiVersion: admissionregistration.k8s.io/v1
 metadata:
   name: {{ include "kube-sentry.fullname" . }}
+  labels:
+    {{- include "kube-sentry.labels" . | nindent 4 }}
   annotations:
-    helm.sh/hook: post-install
-{{- toYaml .Values.webhook.caBundle.certmanager.annotations | nindent 4 }}
+    {{- if .Values.webhook.caBundle.certmanager.enabled }}
+    cert-manager.io/inject-ca-from: {{.Release.Namespace}}/{{ include "kube-sentry.fullname" . }}-cert # namespace/secretName
+    {{- end }}
 webhooks:
-  - name: kube-sentry.kube-sentry.svc
+  - name: {{ include "kube-sentry.fullname" . }}.{{.Release.Namespace}}.svc
+    failurePolicy: Ignore # still forward api requests when unexpected errors are returned (expected failures still block pod creation)
     clientConfig:
       {{- if not .Values.webhook.caBundle.certmanager.enabled }}
       caBundle: {{ .Values.webhook.caBundle.value }}
@@ -20,6 +24,6 @@ webhooks:
         apiVersions: ["v1"]
         resources: ["pods"]
         operations: ["CREATE"]
-        scope: Namespaced
+        scope: "*"
     sideEffects: None
     admissionReviewVersions: ["v1"]

deploy/kube-sentry/values.yaml

@@ -1,31 +1,30 @@
 replicaCount: 1
 
+imagePullSecrets: []
+nameOverride: ""
+fullnameOverride: ""
+
 # The admission webhook needs to communicate with the k8s api server over https
 # A caBundle needs to be created and specified ValidatingWebhookConfiguration
 # These certs also need to be mounted into kube-sentry so that we can utilize them
 webhook:
+  name: kube-sentry.test.svc
   caBundle:
     certmanager: # certmanager's ca-injector can be used to inject the caBundle into the ValidationWebhookConfiguration https://cert-manager.io/docs/concepts/ca-injector/
       enabled: true
-      secretName: kube-sentry-cert
-      annotations:
-        cert-manager.io/inject-ca-from: kube-sentry/kube-sentry-cert # namespace/secretName
-      dnsNames:
-        - kube-sentry.kube-sentry.svc
     value: "" # if you are not using certmanager, put the caBundle value here
 
 image:
   repository:  docker.io/tks98/kube-sentry
   pullPolicy: Always
-  # Overrides the image tag whose default is the chart appVersion.
   tag: "latest"
   args:
     tlsCertFile: "/etc/webhook/certs/tls.crt"
     tlsKeyFile: "/etc/webhook/certs/tls.key"
     insecure: "false"
     listenAddr: ":8080"
     metricsAddr: ":8081"
-    trivyAddr: "trivy.default:4954"
+    trivyAddr: "trivy.kube-sentry:4954"
     trivyScheme: "http"
     metricsLabels: "report_name, image_namespace, image_registry, image_repository, image_tag,image_digest, severity, vulnerability_id, vulnerable_resource_name, installed_resource_version, fixed_resource_version, vulnerability_title, vulnerability_link"
     sentryMode: "true"
@@ -40,27 +39,14 @@ image:
       containerPort: 8081
       protocol: TCP
 
-imagePullSecrets: []
-nameOverride: ""
-fullnameOverride: ""
-
 serviceAccount:
-  # Specifies whether a service account should be created
   create: true
-  # Annotations to add to the service account
-  annotations: {}
-  # The name of the service account to use.
-  # If not set and create is true, a name is generated using the fullname template
-  name: ""
 
 podAnnotations:
   prometheus.io/path: /
   prometheus.io/port: '8081'
   prometheus.io/scrape: 'true'
 
-podSecurityContext: {}
-  # fsGroup: 2000
-
 securityContext:
   capabilities:
      drop:
@@ -73,18 +59,11 @@ service:
   type: ClusterIP
   port: 443
 
-
-resources: {}
-  # We usually recommend not to specify default resources and to leave this as a conscious
-  # choice for the user. This also increases chances charts run on environments with little
-  # resources, such as Minikube. If you do want to specify resources, uncomment the following
-  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-  # limits:
-  #   cpu: 100m
-  #   memory: 128Mi
-  # requests:
-  #   cpu: 100m
-  #   memory: 128Mi
-
 autoscaling:
-  enabled: false
+  enabled: false
+
+# enable and configure trivy server instance to be deployed with kube-sentry
+# https://github.com/aquasecurity/trivy/blob/main/helm/trivy/values.yaml
+trivy:
+  enabled: true
+  fullnameOverride: "trivy"

docs/configuration/certificates.md

@@ -25,8 +25,6 @@ webhook:
       annotations:
         cert-manager.io/inject-ca-from: kube-sentry/kube-sentry-cert # namespace/secretName
       dnsNames:
-        - kube-sentry
-        - kube-sentry.kube-sentry
         - kube-sentry.kube-sentry.svc
     value: "" # if you are not using certmanager, put the PEM encoded caBundle here and set enabled to false
 ```

docs/demo/demo.tape

@@ -0,0 +1,33 @@
+Output demo.mp4
+Output demo.gif
+
+Set FontSize 20
+Set Width 1200
+Set Height 600
+
+Type "cd /Users/tks/Projects/kube-sentry/deploy/kube-sentry"
+Enter
+
+Sleep 1s
+Type "ls"
+Enter
+Sleep 1s
+
+Space
+Type "helm install kube-sentry -n kube-sentry . --wait"
+Enter
+Sleep 20s
+
+Space
+Type "clear"
+Enter
+Sleep 1s
+
+Type "kubectl get pods -n kube-sentry"
+Enter
+Sleep 5s
+
+Space
+Type "kubectl apply -f https://k8s.io/examples/pods/simple-pod.yaml -n kube-sentry"
+Enter
+Sleep 10s

go.mod

@@ -14,15 +14,19 @@ require (
 )
 
 require (
+	bitbucket.org/creachadair/shell v0.0.7 // indirect
 	github.com/aquasecurity/trivy-db v0.0.0-20220904090734-9dd4c7776a52 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/bitfield/script v0.20.2 // indirect
 	github.com/caarlos0/env/v6 v6.10.0 // indirect
 	github.com/cespare/xxhash/v2 v2.1.2 // indirect
 	github.com/go-logr/logr v1.2.3 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/google/go-containerregistry v0.11.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/itchyny/gojq v0.12.7 // indirect
+	github.com/itchyny/timefmt-go v0.1.3 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kr/pretty v0.2.1 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect

go.sum

@@ -1,3 +1,5 @@
+bitbucket.org/creachadair/shell v0.0.7 h1:Z96pB6DkSb7F3Y3BBnJeOZH2gazyMTWlvecSD4vDqfk=
+bitbucket.org/creachadair/shell v0.0.7/go.mod h1:oqtXSSvSYr4624lnnabXHaBsYW6RD80caLi2b3hJk0U=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
@@ -46,6 +48,8 @@ github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/bitfield/script v0.20.2 h1:4DexsRtBILVMEn3EZwHbtJdDqdk43sXI8gM3F04JXgs=
+github.com/bitfield/script v0.20.2/go.mod h1:l3AZPVAtKQrL03bwh7nlNTUtgrgSWurpJSbtqspYrOA=
 github.com/caarlos0/env/v6 v6.10.0 h1:lA7sxiGArZ2KkiqpOQNf8ERBRWI+v8MWIH+eGjSN22I=
 github.com/caarlos0/env/v6 v6.10.0/go.mod h1:hvp/ryKXKipEkcuYjs9mI4bBCg+UI0Yhgm5Zu0ddvwc=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
@@ -122,6 +126,8 @@ github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
 github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
 github.com/google/go-containerregistry v0.11.0 h1:Xt8x1adcREjFcmDoDK8OdOsjxu90PHkGuwNP8GiHMLM=
 github.com/google/go-containerregistry v0.11.0/go.mod h1:BBaYtsHPHA42uEgAvd/NejvAfPSlz281sJWqupjSxfk=
@@ -143,6 +149,10 @@ github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5m
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
+github.com/itchyny/gojq v0.12.7 h1:hYPTpeWfrJ1OT+2j6cvBScbhl0TkdwGM4bc66onUSOQ=
+github.com/itchyny/gojq v0.12.7/go.mod h1:ZdvNHVlzPgUf8pgjnuDTmGfHA/21KoutQUJ3An/xNuw=
+github.com/itchyny/timefmt-go v0.1.3 h1:7M3LGVDsqcd0VZH2U+x393obrzZisp7C0uEe921iRkU=
+github.com/itchyny/timefmt-go v0.1.3/go.mod h1:0osSSCQSASBJMsIZnhAaF1C2fCBTJZXrnj37mG8/c+A=
 github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
 github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
@@ -164,6 +174,8 @@ github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfn
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
+github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 h1:I0XW9+e1XWDxdcEniV4rQAIOPUGDq67JSCiRCgGCZLI=
 github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
@@ -368,8 +380,10 @@ golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220227234510-4e6760a101f9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10 h1:WIoqL4EROvwiPdUtaip4VcDdpZ4kha7wBWZrbVKCIZg=
 golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -536,6 +550,7 @@ gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=