secureCodeBox · Weltraumschaf · Sep 29, 2023 · Sep 8, 2023 · Sep 11, 2023 · Sep 11, 2023
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -25,6 +25,7 @@ env:
   KIND_BINARY_VERSION: "v0.20.0"
   KUBECTL_VERSION: "v1.27.4"
   HELM_VERSION: "v3.12.2"
+  HELM_PLUGIN_UNITTEST: "0.3.5"
 
 jobs:
   # ---- NVM Setup ----
@@ -99,6 +100,51 @@ jobs:
 
   # ---- Unit-Test | Java ----
 
+  helm-unit-test:
+    name: "Unit-Test | Helm"
+    runs-on: ubuntu-22.04
+    needs:
+      - k8s-setup
+    steps:
+      - uses: actions/checkout@v3
+      - name: Download Helm
+        uses: actions/download-artifact@v3
+        with:
+          name: helm
+          path: ./helm
+
+      - name: Make binaries globally available
+        run: |
+          chmod +x ./helm/helm && sudo mv ./helm/helm /usr/local/bin/helm
+
+      - name: Verify tools
+        run: |
+          helm version
+
+      - name: Install Helm Unit Test Plugin
+        run: |
+          helm plugin install https://github.com/helm-unittest/helm-unittest.git --version ${{ env.HELM_PLUGIN_UNITTEST }}
+
+      - name: Helm-Chart Unit Tests | Operator
+        working-directory: ./operator
+        run: make helm-unit-tests
+
+      - name: Helm-Chart Unit Tests | AutoDiscovery
+        working-directory: ./auto-discovery/kubernetes
+        run: make helm-unit-tests
+
+      - name: Helm-Chart Unit Tests | Hooks
+        working-directory: ./hooks
+        run: make helm-unit-tests
+
+      - name: Helm-Chart Unit Tests | Scanners
+        working-directory: ./scanners
+        run: make helm-unit-tests
+
+      - name: Helm-Chart Unit Tests | Demo-Targets
+        working-directory: ./demo-targets
+        run: make helm-unit-tests
+
   unit-java:
     name: "Unit-Test | Java"
     runs-on: ubuntu-22.04

diff --git a/auto-discovery/kubernetes/.helmignore b/auto-discovery/kubernetes/.helmignore
@@ -10,4 +10,5 @@ go.sum
 main.go
 Makefile
 PROJECT
-auto-discovery-config.yaml
+auto-discovery-config.yaml
+./tests/
diff --git a/auto-discovery/kubernetes/Makefile b/auto-discovery/kubernetes/Makefile
@@ -79,6 +79,12 @@ test: manifests generate fmt vet envtest ## Run tests.
 ginkgo: manifests generate fmt vet envtest ## Run tests.
 	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) -p path)" ginko test ./... -coverprofile cover.out -v --progress
 
+## Helm unit tests
+.PHONY: helm-unit-tests
+helm-unit-tests:
+	echo "Running helm unit tests for operator"; \
+	helm unittest . \
+
 ##@ Build
 
 .PHONY: build

diff --git a/auto-discovery/kubernetes/tests/__snapshot__/auto-discovery_test.yaml.snap b/auto-discovery/kubernetes/tests/__snapshot__/auto-discovery_test.yaml.snap
@@ -0,0 +1,287 @@
+matches the snapshot:
+  1: |
+    apiVersion: v1
+    data:
+      auto-discovery.yaml: |
+        {
+          "apiVersion": "config.securecodebox.io/v1",
+          "cluster": {
+            "name": "docker-desktop"
+          },
+          "containerAutoDiscovery": {
+            "enabled": false,
+            "passiveReconcileInterval": "1m",
+            "scanConfigs": [
+              {
+                "annotations": {
+                  "defectdojo.securecodebox.io/engagement-name": "{{ .Target.Name }}",
+                  "defectdojo.securecodebox.io/engagement-version": "{{if (index .Target.Labels `app.kubernetes.io/version`) }}{{ index .Target.Labels `app.kubernetes.io/version` }}{{end}}",
+                  "defectdojo.securecodebox.io/product-name": "{{ .Cluster.Name }} | {{ .Namespace.Name }} | {{ .Target.Name }}",
+                  "defectdojo.securecodebox.io/product-tags": "cluster/{{ .Cluster.Name }},namespace/{{ .Namespace.Name }}"
+                },
+                "hookSelector": {},
+                "labels": {},
+                "name": "trivy",
+                "parameters": [
+                  "{{ .ImageID }}"
+                ],
+                "repeatInterval": "168h",
+                "scanType": "trivy-image-autodiscovery",
+                "volumeMounts": [],
+                "volumes": []
+              }
+            ]
+          },
+          "health": {
+            "healthProbeBindAddress": ":8081"
+          },
+          "imagePullSecretConfig": {
+            "mapImagePullSecretsToEnvironmentVariables": true,
+            "passwordEnvironmentVariableName": "TRIVY_PASSWORD",
+            "usernameEnvironmentVariableName": "TRIVY_USERNAME"
+          },
+          "kind": "AutoDiscoveryConfig",
+          "leaderElection": {
+            "leaderElect": true,
+            "resourceName": "0e41a1f4.securecodebox.io"
+          },
+          "metrics": {
+            "bindAddress": "127.0.0.1:8080"
+          },
+          "resourceInclusion": {
+            "mode": "enabled-per-namespace"
+          },
+          "serviceAutoDiscovery": {
+            "enabled": true,
+            "passiveReconcileInterval": "1m",
+            "scanConfigs": [
+              {
+                "annotations": {
+                  "defectdojo.securecodebox.io/engagement-name": "{{ .Target.Name }}",
+                  "defectdojo.securecodebox.io/engagement-version": "{{if (index .Target.Labels `app.kubernetes.io/version`) }}{{ index .Target.Labels `app.kubernetes.io/version` }}{{end}}",
+                  "defectdojo.securecodebox.io/product-name": "{{ .Cluster.Name }} | {{ .Namespace.Name }} | {{ .Target.Name }}",
+                  "defectdojo.securecodebox.io/product-tags": "cluster/{{ .Cluster.Name }},namespace/{{ .Namespace.Name }}"
+                },
+                "hookSelector": {},
+                "labels": {},
+                "name": "zap",
+                "parameters": [
+                  "-t",
+                  "{{ .Host.Type }}://{{ .Service.Name }}.{{ .Service.Namespace }}.svc:{{ .Host.Port }}"
+                ],
+                "repeatInterval": "168h",
+                "scanType": "zap-advanced-scan",
+                "volumeMounts": [],
+                "volumes": []
+              }
+            ]
+          }
+        }
+    kind: ConfigMap
+    metadata:
+      name: auto-discovery
+  2: |
+    apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      labels:
+        control-plane: auto-discovery
+      name: auto-discovery
+    spec:
+      replicas: 1
+      selector:
+        matchLabels:
+          control-plane: auto-discovery
+      template:
+        metadata:
+          labels:
+            control-plane: auto-discovery
+        spec:
+          containers:
+            - args:
+                - --config
+                - /etc/securecodebox/auto-discovery.yaml
+              command:
+                - /manager
+              image: securecodebox/auto-discovery-kubernetes:0.0.0
+              imagePullPolicy: IfNotPresent
+              livenessProbe:
+                httpGet:
+                  path: /healthz
+                  port: 8081
+                initialDelaySeconds: 15
+                periodSeconds: 20
+              name: auto-discovery
+              readinessProbe:
+                httpGet:
+                  path: /readyz
+                  port: 8081
+                initialDelaySeconds: 5
+                periodSeconds: 10
+              resources:
+                limits:
+                  cpu: 100m
+                  memory: 100Mi
+                requests:
+                  cpu: 100m
+                  memory: 20Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop:
+                    - all
+                privileged: false
+                readOnlyRootFilesystem: true
+                runAsNonRoot: true
+              volumeMounts:
+                - mountPath: /etc/securecodebox/auto-discovery.yaml
+                  name: config
+                  readOnly: true
+                  subPath: auto-discovery.yaml
+          imagePullSecrets:
+            - name: foo
+          securityContext:
+            fsGroup: 1234
+          serviceAccountName: auto-discovery
+          terminationGracePeriodSeconds: 10
+          volumes:
+            - configMap:
+                name: auto-discovery
+              name: config
+  3: |
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: Role
+    metadata:
+      name: auto-discovery-leader-election-role
+    rules:
+      - apiGroups:
+          - ""
+        resources:
+          - configmaps
+        verbs:
+          - get
+          - list
+          - watch
+          - create
+          - update
+          - patch
+          - delete
+      - apiGroups:
+          - coordination.k8s.io
+        resources:
+          - leases
+        verbs:
+          - get
+          - list
+          - watch
+          - create
+          - update
+          - patch
+          - delete
+      - apiGroups:
+          - ""
+        resources:
+          - events
+        verbs:
+          - create
+          - patch
+  4: |
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata:
+      name: auto-discovery-leader-election-rolebinding
+    roleRef:
+      apiGroup: rbac.authorization.k8s.io
+      kind: Role
+      name: auto-discovery-leader-election-role
+    subjects:
+      - kind: ServiceAccount
+        name: auto-discovery
+        namespace: NAMESPACE
+  5: |
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: ClusterRole
+    metadata:
+      name: auto-discovery
+    rules:
+      - apiGroups:
+          - ""
+        resources:
+          - namespaces
+        verbs:
+          - get
+          - list
+          - watch
+      - apiGroups:
+          - ""
+        resources:
+          - pods
+        verbs:
+          - get
+          - list
+          - watch
+      - apiGroups:
+          - ""
+        resources:
+          - pods/status
+        verbs:
+          - get
+      - apiGroups:
+          - ""
+        resources:
+          - services
+        verbs:
+          - get
+          - list
+          - watch
+      - apiGroups:
+          - ""
+        resources:
+          - services/status
+        verbs:
+          - get
+      - apiGroups:
+          - execution.securecodebox.io
+        resources:
+          - scantypes
+        verbs:
+          - get
+          - list
+          - watch
+      - apiGroups:
+          - execution.securecodebox.io
+        resources:
+          - scheduledscans
+        verbs:
+          - create
+          - get
+          - list
+          - patch
+          - update
+          - watch
+      - apiGroups:
+          - execution.securecodebox.io/status
+        resources:
+          - scheduledscans
+        verbs:
+          - get
+          - patch
+          - update
+  6: |
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: ClusterRoleBinding
+    metadata:
+      name: auto-discovery
+    roleRef:
+      apiGroup: rbac.authorization.k8s.io
+      kind: ClusterRole
+      name: auto-discovery
+    subjects:
+      - kind: ServiceAccount
+        name: auto-discovery
+        namespace: NAMESPACE
+  7: |
+    apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      name: auto-discovery
diff --git a/auto-discovery/kubernetes/tests/auto-discovery_test.yaml b/auto-discovery/kubernetes/tests/auto-discovery_test.yaml
@@ -0,0 +1,15 @@
+suite: Full Snapshot
+templates:
+  - rbac/*.yaml
+  - manager/*.yaml
+tests:
+  - it: matches the snapshot
+    chart:
+      version: 0.0.0
+      appVersion: 0.0.0      
+    set:
+      imagePullSecrets: [{name: foo}]
+      podSecurityContext: {fsGroup: 1234}
+
+    asserts:
+      - matchSnapshot: {}