secureCodeBox · J12934 · May 31, 2022 · May 30, 2022 · May 30, 2022 · May 30, 2022
diff --git a/hooks/notification/templates/configmap.yaml b/hooks/notification/templates/configmap.yaml
@@ -2,9 +2,13 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
+---
 apiVersion: v1
 kind: ConfigMap
 metadata:
   name: "{{ .Release.Name }}-config"
+  labels:
+    {{- include "notification-hook.labels" . | nindent 4 }}
 data:
-  notification-channel.yaml: {{ .Values.notificationChannels | toYaml | quote }}
+  notification-channel.yaml: |
+    {{ .Values.notificationChannels | toYaml | nindent 4 }}
diff --git a/scanners/zap-advanced/README.md b/scanners/zap-advanced/README.md
@@ -509,11 +509,7 @@ zapConfiguration:
 | scanner.securityContext.runAsNonRoot | bool | `false` | Enforces that the scanner image is run as a non root user |
 | scanner.tolerations | list | `[]` | Optional tolerations settings that control how the scanner job is scheduled (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) |
 | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
-| zapConfiguration | object | `{"global":{"addonInstall":["pscanrulesBeta","ascanrulesBeta","pscanrulesAlpha","ascanrulesAlpha"],"addonUpdate":true,"sessionName":"secureCodeBox"}}` | All `scanType` specific configuration options. Feel free to add more configuration options. All configuration options can be overriden by scan specific configurations if defined. Please have a look into the README.md to find more configuration options. |
-| zapConfiguration.global | object | `{"addonInstall":["pscanrulesBeta","ascanrulesBeta","pscanrulesAlpha","ascanrulesAlpha"],"addonUpdate":true,"sessionName":"secureCodeBox"}` | Optional general ZAP Configurations settings. |
-| zapConfiguration.global.addonInstall | list | `["pscanrulesBeta","ascanrulesBeta","pscanrulesAlpha","ascanrulesAlpha"]` | Installs additional ZAP AddOns on startup, listed by their name: |
-| zapConfiguration.global.addonUpdate | bool | `true` | Updates all installed ZAP AddOns on startup if true, otherwise false. |
-| zapConfiguration.global.sessionName | string | `"secureCodeBox"` | The ZAP internal Session name. Default: secureCodeBox |
+| zapConfiguration | object | `{}` | All `scanType` specific configuration options. Feel free to add more configuration options. All configuration options can be overriden by scan specific configurations if defined. Please have a look into the README.md to find more configuration options. |
 | zapContainer.env | list | `[]` | Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) |
 | zapContainer.envFrom | list | `[]` | Optional mount environment variables from configMaps or secrets (see: https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#configure-all-key-value-pairs-in-a-secret-as-container-environment-variables) |
 | zapContainer.extraVolumeMounts | list | `[{"mountPath":"/home/zap/.ZAP_D/scripts/scripts/authentication/","name":"zap-scripts-authentication","readOnly":true},{"mountPath":"/home/zap/.ZAP_D/scripts/scripts/session/","name":"zap-scripts-session","readOnly":true}]` | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |

diff --git a/scanners/zap-advanced/docs/README.ArtifactHub.md b/scanners/zap-advanced/docs/README.ArtifactHub.md
@@ -514,11 +514,7 @@ zapConfiguration:
 | scanner.securityContext.runAsNonRoot | bool | `false` | Enforces that the scanner image is run as a non root user |
 | scanner.tolerations | list | `[]` | Optional tolerations settings that control how the scanner job is scheduled (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) |
 | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
-| zapConfiguration | object | `{"global":{"addonInstall":["pscanrulesBeta","ascanrulesBeta","pscanrulesAlpha","ascanrulesAlpha"],"addonUpdate":true,"sessionName":"secureCodeBox"}}` | All `scanType` specific configuration options. Feel free to add more configuration options. All configuration options can be overriden by scan specific configurations if defined. Please have a look into the README.md to find more configuration options. |
-| zapConfiguration.global | object | `{"addonInstall":["pscanrulesBeta","ascanrulesBeta","pscanrulesAlpha","ascanrulesAlpha"],"addonUpdate":true,"sessionName":"secureCodeBox"}` | Optional general ZAP Configurations settings. |
-| zapConfiguration.global.addonInstall | list | `["pscanrulesBeta","ascanrulesBeta","pscanrulesAlpha","ascanrulesAlpha"]` | Installs additional ZAP AddOns on startup, listed by their name: |
-| zapConfiguration.global.addonUpdate | bool | `true` | Updates all installed ZAP AddOns on startup if true, otherwise false. |
-| zapConfiguration.global.sessionName | string | `"secureCodeBox"` | The ZAP internal Session name. Default: secureCodeBox |
+| zapConfiguration | object | `{}` | All `scanType` specific configuration options. Feel free to add more configuration options. All configuration options can be overriden by scan specific configurations if defined. Please have a look into the README.md to find more configuration options. |
 | zapContainer.env | list | `[]` | Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) |
 | zapContainer.envFrom | list | `[]` | Optional mount environment variables from configMaps or secrets (see: https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#configure-all-key-value-pairs-in-a-secret-as-container-environment-variables) |
 | zapContainer.extraVolumeMounts | list | `[{"mountPath":"/home/zap/.ZAP_D/scripts/scripts/authentication/","name":"zap-scripts-authentication","readOnly":true},{"mountPath":"/home/zap/.ZAP_D/scripts/scripts/session/","name":"zap-scripts-session","readOnly":true}]` | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |

diff --git a/scanners/zap-advanced/templates/zap-advanced-scan-type.yaml b/scanners/zap-advanced/templates/zap-advanced-scan-type.yaml
@@ -60,8 +60,6 @@ spec:
                 - "XML"
                 - "--zap-url"
                 - "localhost:8080"
-                # - "--api-key"
-                # - "ertzukndtzuikbvcfjkmnbvcfghjklmnbvc"
                 - "--config-folder"
                 - "/home/securecodebox/configs/"
                 - "--output-folder"
@@ -101,7 +99,7 @@ spec:
                 - {{ . | quote }}
                 {{- end }}
                 - "-config"
-                - "api.disablekey=true" # Disble API Key. TODO: change with helm random value? -config api.key=change-me-9203935709
+                - "api.disablekey=true" # Disble API Key because not required. Only pod local access allowed (localhost binding).
               resources:
                 {{- toYaml .Values.zapContainer.resources | nindent 16 }}
               securityContext:

diff --git a/scanners/zap-advanced/values.yaml b/scanners/zap-advanced/values.yaml
@@ -155,19 +155,19 @@ zapContainer:
         - all
 
 # -- All `scanType` specific configuration options. Feel free to add more configuration options. All configuration options can be overriden by scan specific configurations if defined. Please have a look into the README.md to find more configuration options.
-zapConfiguration:
-  # -- Optional general ZAP Configurations settings.
-  global:
-    # -- The ZAP internal Session name. Default: secureCodeBox
-    sessionName: secureCodeBox
-    # -- Updates all installed ZAP AddOns on startup if true, otherwise false.
-    addonUpdate: true
-    # -- Installs additional ZAP AddOns on startup, listed by their name:
-    addonInstall:
-      - pscanrulesBeta
-      - ascanrulesBeta
-      - pscanrulesAlpha
-      - ascanrulesAlpha
+zapConfiguration: {}
+  # # -- Optional general ZAP Configurations settings.
+  # global:
+  #   # -- The ZAP internal Session name. Default: secureCodeBox
+  #   sessionName: secureCodeBox
+  #   # -- Updates all installed ZAP AddOns on startup if true, otherwise false.
+  #   addonUpdate: true
+  #   # -- Installs additional ZAP AddOns on startup, listed by their name:
+  #   addonInstall:
+  #     - pscanrulesBeta
+  #     - ascanrulesBeta
+  #     - pscanrulesAlpha
+  #     - ascanrulesAlpha
 
 cascadingRules:
   # cascadingRules.enabled -- Enables or disables the installation of the default cascading rules for this scanner