Merge pull request #93 from secureCodeBox/ensure-helm-charts-use-corresponding-image-versions

Ensure Helm Charts use corresponding Container Image Versions

Author: J12934

.github/workflows/ci.yaml

@@ -366,9 +366,7 @@ jobs:
           # Install Operator using the images of the current commit
           helm -n securecodebox-system install securecodebox-operator ./operator/ --wait \
             --set="image.tag=sha-$(git rev-parse --short HEAD)" \
-            --set="image.digest=null" \
             --set="lurcher.image.tag=sha-$(git rev-parse --short HEAD)" \
-            --set="lurcher.image.digest=null"
       - name: "Inspect Operator"
         run: |
           echo "Deployment in namespace 'securecodebox-system'"

demo-apps/bodgeit/Chart.yaml

@@ -1,19 +1,18 @@
 apiVersion: v2
-version: 0.1.0
+version: latest
 type: application
 appVersion: "v1.4.0"
 name: bodgeit
 description: "The BodgeIt Store is a vulnerable web app which is aimed at people who are new to pen testing"
 home: https://github.com/psiinon/bodgeit
 icon: https://scb-art.j12934.now.sh/bodgeit.png
 keywords:
-- vulnerable
-- webapp
-- demo
+  - vulnerable
+  - webapp
+  - demo
 sources:
-- https://github.com/secureCodeBox/helm
-- https://github.com/psiinon/bodgeit
+  - https://github.com/secureCodeBox/helm
+  - https://github.com/psiinon/bodgeit
 maintainers:
-- name: iteratec GmbH
-  email: security@iteratec.com
-
+  - name: iteratec GmbH
+    email: security@iteratec.com

demo-apps/dummy-ssh/Chart.yaml

@@ -1,17 +1,16 @@
 apiVersion: v2
-version: 0.1.0
+version: latest
 type: application
 appVersion: "v1.0.0"
 name: dummy-ssh
 description: "SSH Server for scan testing."
 home: https://wordpress.org
 icon: https://www.securecodebox.io/integrationIcons/SSH.svg
 keywords:
-- vulnerable
-- ssh
+  - vulnerable
+  - ssh
 sources:
-- https://github.com/secureCodeBox/secureCodeBox/tree/master/demo/dummy-ssh
+  - https://github.com/secureCodeBox/secureCodeBox/tree/master/demo/dummy-ssh
 maintainers:
-- name: iteratec GmbH
-  email: security@iteratec.com
-
+  - name: iteratec GmbH
+    email: security@iteratec.com

demo-apps/http-webhook/Chart.yaml

@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.1.0
+version: latest
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

demo-apps/juice-shop/Chart.yaml

@@ -1,26 +1,26 @@
 apiVersion: v2
-version: 0.1.0
+version: latest
 appVersion: "v12.0.2"
 name: juice-shop
 description: "OWASP Juice Shop: Probably the most modern and sophisticated insecure web application"
 type: application
 home: https://owasp.org/www-project-juice-shop/
 icon: https://raw.githubusercontent.com/bkimminich/juice-shop/bdbcc0ea4484a2dd6b8ca243daa34c882129cdd4/frontend/src/assets/public/images/JuiceShop_Logo_400px.png
 keywords:
-- owasp
-- javascript
-- vulnerable
-- hacking
-- application-security
-- owasp-top-10
-- owasp-top-ten
-- pentesting
-- vulnapp
-- appsec
-- ctf
+  - owasp
+  - javascript
+  - vulnerable
+  - hacking
+  - application-security
+  - owasp-top-10
+  - owasp-top-ten
+  - pentesting
+  - vulnapp
+  - appsec
+  - ctf
 sources:
-- https://github.com/secureCodeBox/helm
-- https://github.com/bkimminich/juice-shop
+  - https://github.com/secureCodeBox/helm
+  - https://github.com/bkimminich/juice-shop
 maintainers:
-- name: iteratec GmbH
-  email: security@iteratec.com
+  - name: iteratec GmbH
+    email: security@iteratec.com

demo-apps/old-wordpress/Chart.yaml

@@ -1,17 +1,17 @@
 apiVersion: v2
-version: 0.1.0
+version: latest
 appVersion: "4.0"
 name: old-wordpress
 description: "Insecure & Outdated Wordpress Instance: Never expose it to the internet!"
 type: application
 home: https://wordpress.org
 icon: https://s.w.org/style/images/about/WordPress-logotype-alternative.png
 keywords:
-- vulnerable
-- wordpress
+  - vulnerable
+  - wordpress
 sources:
-- https://github.com/secureCodeBox/helm
-- https://github.com/secureCodeBox/secureCodeBox/tree/master/demo/old-wordpress
+  - https://github.com/secureCodeBox/helm
+  - https://github.com/secureCodeBox/secureCodeBox/tree/master/demo/old-wordpress
 maintainers:
-- name: iteratec GmbH
-  email: security@iteratec.com
+  - name: iteratec GmbH
+    email: security@iteratec.com

demo-apps/swagger-petstore/Chart.yaml

@@ -1,17 +1,17 @@
 apiVersion: v2
-version: 0.1.0
+version: latest
 appVersion: "1.0.3"
 name: swagger-petstore
 description: "This is the sample petstore application"
 type: application
 home: https://github.com/swagger-api/swagger-petstore
 icon: https://static1.smartbear.co/swagger/media/assets/images/swagger_logo.svg
 keywords:
-- swagger
-- openapi
+  - swagger
+  - openapi
 sources:
-- https://github.com/secureCodeBox/helm
-- https://github.com/swagger-api/swagger-petstore
+  - https://github.com/secureCodeBox/helm
+  - https://github.com/swagger-api/swagger-petstore
 maintainers:
-- name: iteratec GmbH
-  email: security@iteratec.com
+  - name: iteratec GmbH
+    email: security@iteratec.com

hooks/declarative-subsequent-scans/Chart.yaml

@@ -4,8 +4,7 @@ description: Starts possible subsequent security scans based on findings (e.g. o
 
 type: application
 
-version: 0.1.0
-
-appVersion: latest
+# version - gets automatically set to the secureCodeBox release version when the helm charts gets published
+version: latest
 
 dependencies: []

hooks/declarative-subsequent-scans/templates/declerative-subsequent-scans-hook.yaml

@@ -4,17 +4,5 @@ metadata:
   name: {{ include "declarative-subsequent-scans.fullname" . }}
 spec:
   type: ReadOnly
-  {{- if .Values.image.registry }}
-  {{- if .Values.image.digest }}
-  image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}@{{ .Values.image.digest }}"
-  {{- else }}
-  image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag }}"
-  {{- end }}
-  {{- else }}
-  {{- if .Values.image.digest }}
-  image: "{{ .Values.image.repository }}@{{ .Values.image.digest }}"
-  {{- else }}
-  image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
-  {{- end }}
-  {{- end }}
+  image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.Version }}"
   serviceAccountName: declarative-combined-scans

hooks/declarative-subsequent-scans/values.yaml

@@ -3,7 +3,6 @@
 # Declare variables to be passed into your templates.
 
 image:
-  registry: docker.io
-  repository: scbexperimental/hook-declarative-subsequent-scans
-  tag: latest
-  digest: null
+  repository: docker.io/scbexperimental/hook-declarative-subsequent-scans
+  # image.tag - defaults to the charts version
+  tag: null