The secureCodeBox AutoDiscovery is running on kubernetes (K8S) and is an optional component of the complete secureCodeBox stack. The Kubernetes AutoDiscovery needs to be deployed along side the secureCodeBox Operator. It monitors security relevant resources inside a K8S environment and automatically create scans to continuously monitor security aspects of the resources.

The AutoDiscovery controller will automatically detect these new resources (services and containers) and start secureCodeBox scans for them:

1. A ZAP Baseline Scan to detect basic web vulnerabilities in the service. (Using ZAP-automation-framework)
2. An image scan scanning for vulnerable libraries in the docker / container image of the deployment. (Using trivy)
3. (WIP) A TLS Scan against the certificate of the ingress for the host. (Using SSLyze)

The AutoDiscovery automatically tracks the lifecycle of the kubernetes resources and will automatically start new scans for new application versions.

This example deploys JuiceShop to a new Kubernetes Namespace. (You can find the kubernetes manifests for the deployment here)

The AutoDiscovery will automatically pick up this new deployment and then starts a ZAP Scan against it. The scan created uses our zap-automation-framework ScanType by default, this can be changed with the config.serviceAutoDiscovery.scanConfig.scanType config on the autoDiscovery helm release.

When the ContainerAutoDiscovery is enabled, the AutoDiscovery can also create a trivy scan for each unique container image (having multiple pods with the same container will only create one scan). The ScanType can be defined with config.containerAutoDiscovery.scanConfig.scanType.

The auto-discovery-kubernetes chart can be deployed via helm:

# Install HelmChart (use -n to configure another namespace)
helm upgrade --install auto-discovery-kubernetes oci://ghcr.io/securecodebox/helm/auto-discovery-kubernetes

Kubernetes: >=v1.11.0-0

The AutoDiscovery allows different modes to determine if a resource is supposed to be scanned. These modes allow you to gradually roll out the AutoDiscovery in a cluster. This allows to roll it out in cluster without a "big bang" where the AutoDiscovery starts a scan for every app in the cluster which would likely exhaust the clusters compute resources.

The three different modes are:

1. enabled-per-namespace (default): See section
2. enabled-per-resource: See section
3. all: See section

Enable this by setting config.resourceInclusion.mode=enable-per-namespace.

This mode will start scans for resources in namespaces with the annotation auto-discovery.securecodebox.io/enabled=true.

# enable AutoDiscovery in namespace "juice-shop"
kubectl annotate namespace juice-shop auto-discovery.securecodebox.io/enabled=true

If you want to exclude a certain resource in a otherwise AutoDiscovery enabled namespace, you can exclude it by annotating it with auto-discovery.securecodebox.io/ignore=true.

# disable AutoDiscovery for service "foobar"
kubectl -n juice-shop annotate service foobar auto-discovery.securecodebox.io/ignore=true

Enable this by setting config.resourceInclusion.mode=enabled-per-resource.

This mode will start scans for every resources with the annotation auto-discovery.securecodebox.io/enabled=true.

# enable AutoDiscovery for service "juice-shop"
kubectl -n juice-shop annotate service juice-shop auto-discovery.securecodebox.io/enabled=true

Enable this by setting config.resourceInclusion.mode=all.

This mode will start scans for every resources in the cluster unless it has the annotation auto-discovery.securecodebox.io/ignore=true.

⚠️ Using this setting in larger cluster will likely start a large number of scans in the cluster. This could block all available compute resource in your cluster and seriously affect your applications availability.

# *disable* AutoDiscovery for service "juice-shop"
kubectl -n juice-shop annotate service juice-shop auto-discovery.securecodebox.io/ignore=true

Code of secureCodeBox is licensed under the Apache License 2.0.

To avoid having to build & deploy the AutoDiscovery every time you make a code change you can run it locally. It automatically connects to your current cluster configured in your kube config.

make run

# execute the tests locally
make test

# view the test coverage
go tool cover -html=cover.out