diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index bda0c64..75d89ef 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -1,3 +1,4 @@ +--- name: Lint on: [push, pull_request] @@ -10,3 +11,4 @@ jobs: - uses: actions/checkout@v2 - uses: actions/setup-python@v2 - uses: pre-commit/action@v2.0.0 + - uses: ibiqlik/action-yamllint@v3 diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml new file mode 100644 index 0000000..75f9609 --- /dev/null +++ b/.github/workflows/publish.yml @@ -0,0 +1,65 @@ +--- +name: Publish +on: + push: + tags: + - "v*" +env: + ALIAS: aquasecurity + REP: kube-hunter +jobs: + publish: + name: Publish + runs-on: ubuntu-18.04 + steps: + - name: Check Out Repo + uses: actions/checkout@v2 + - name: Set up QEMU + uses: docker/setup-qemu-action@v1 + - name: Set up Docker Buildx + id: buildx + uses: docker/setup-buildx-action@v1 + - name: Cache Docker layers + uses: actions/cache@v2 + with: + path: /tmp/.buildx-cache + key: ${{ runner.os }}-buildxarch-${{ github.sha }} + restore-keys: | + ${{ runner.os }}-buildxarch- + - name: Login to Docker Hub + uses: docker/login-action@v1 + with: + username: ${{ secrets.DOCKERHUB_USER }} + password: ${{ secrets.DOCKERHUB_TOKEN }} + - name: Login to ECR + uses: docker/login-action@v1 + with: + registry: public.ecr.aws + username: ${{ secrets.ECR_ACCESS_KEY_ID }} + password: ${{ secrets.ECR_SECRET_ACCESS_KEY }} + - name: Get version + id: get_version + uses: crazy-max/ghaction-docker-meta@v1 + with: + images: ${{ env.REP }} + tag-semver: | + {{version}} + + - name: Build and push - Docker/ECR + id: docker_build + uses: docker/build-push-action@v2 + with: + context: . + platforms: linux/amd64 + builder: ${{ steps.buildx.outputs.name }} + push: true + tags: | + ${{ secrets.DOCKERHUB_USER }}/${{ env.REP }}:${{ steps.get_version.outputs.version }} + public.ecr.aws/${{ env.ALIAS }}/${{ env.REP }}:${{ steps.get_version.outputs.version }} + ${{ secrets.DOCKERHUB_USER }}/${{ env.REP }}:latest + public.ecr.aws/${{ env.ALIAS }}/${{ env.REP }}:latest + cache-from: type=local,src=/tmp/.buildx-cache/release + cache-to: type=local,mode=max,dest=/tmp/.buildx-cache/release + + - name: Image digest + run: echo ${{ steps.docker_build.outputs.digest }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c05a989..fac4bf7 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,9 +1,10 @@ +--- on: push: # Sequence of patterns matched against refs/tags tags: - - 'v*' # Push events to matching v*, i.e. v1.0, v20.15.10 - + - 'v*' # Push events to matching v*, i.e. v1.0, v20.15.10 + name: Release jobs: @@ -18,17 +19,17 @@ jobs: uses: actions/setup-python@v2 with: python-version: '3.9' - + - name: Install dependencies run: | python -m pip install -U pip python -m pip install -r requirements-dev.txt - + - name: Build project shell: bash run: | make pyinstaller - + - name: Create Release id: create_release uses: actions/create-release@v1 @@ -41,7 +42,7 @@ jobs: prerelease: false - name: Upload Release Asset - id: upload-release-asset + id: upload-release-asset uses: actions/upload-release-asset@v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} @@ -49,4 +50,4 @@ jobs: upload_url: ${{ steps.create_release.outputs.upload_url }} asset_path: ./dist/kube-hunter asset_name: kube-hunter-linux-x86_64-${{ github.ref }} - asset_content_type: application/octet-stream \ No newline at end of file + asset_content_type: application/octet-stream diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 5e7174b..94f8ca8 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -1,3 +1,4 @@ +--- name: Test on: [push, pull_request] diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 40196a7..5d9ac74 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,10 +1,11 @@ +--- repos: -- repo: https://github.com/psf/black - rev: stable - hooks: - - id: black -- repo: https://gitlab.com/pycqa/flake8 - rev: 3.7.9 - hooks: - - id: flake8 - additional_dependencies: [flake8-bugbear] + - repo: https://github.com/psf/black + rev: stable + hooks: + - id: black + - repo: https://gitlab.com/pycqa/flake8 + rev: 3.7.9 + hooks: + - id: flake8 + additional_dependencies: [flake8-bugbear] diff --git a/.yamllint b/.yamllint new file mode 100644 index 0000000..34c9366 --- /dev/null +++ b/.yamllint @@ -0,0 +1,6 @@ +--- +extends: default + +rules: + line-length: disable + truthy: disable diff --git a/README.md b/README.md index 0bfaacf..b5a7a23 100644 --- a/README.md +++ b/README.md @@ -1,12 +1,18 @@ ![kube-hunter](https://github.com/aquasecurity/kube-hunter/blob/main/kube-hunter.png) +[![GitHub Release][release-img]][release] +![Downloads][download] +![Docker Pulls][docker-pull] [![Build Status](https://github.com/aquasecurity/kube-hunter/workflows/Test/badge.svg)](https://github.com/aquasecurity/kube-hunter/actions) [![codecov](https://codecov.io/gh/aquasecurity/kube-hunter/branch/main/graph/badge.svg)](https://codecov.io/gh/aquasecurity/kube-hunter) [![Code style: black](https://img.shields.io/badge/code%20style-black-000000.svg)](https://github.com/psf/black) [![License](https://img.shields.io/github/license/aquasecurity/kube-hunter)](https://github.com/aquasecurity/kube-hunter/blob/main/LICENSE) [![Docker image](https://images.microbadger.com/badges/image/aquasec/kube-hunter.svg)](https://microbadger.com/images/aquasec/kube-hunter "Get your own image badge on microbadger.com") - +[download]: https://img.shields.io/github/downloads/aquasecurity/kube-hunter/total?logo=github +[release-img]: https://img.shields.io/github/release/aquasecurity/kube-hunter.svg?logo=github +[release]: https://github.com/aquasecurity/kube-hunter/releases +[docker-pull]: https://img.shields.io/docker/pulls/aquasec/kube-hunter?logo=docker&label=docker%20pulls%20%2F%20kube-hunter kube-hunter hunts for security weaknesses in Kubernetes clusters. The tool was developed to increase awareness and visibility for security issues in Kubernetes environments. **You should NOT run kube-hunter on a Kubernetes cluster that you don't own!** diff --git a/docs/_config.yml b/docs/_config.yml index eb68192..3f845f5 100644 --- a/docs/_config.yml +++ b/docs/_config.yml @@ -1,3 +1,4 @@ +--- title: kube-hunter description: Kube-hunter hunts for security weaknesses in Kubernetes clusters logo: https://raw.githubusercontent.com/aquasecurity/kube-hunter/main/kube-hunter.png @@ -10,7 +11,7 @@ collections: defaults: - scope: - path: "" # an empty string here means all files in the project + path: "" # an empty string here means all files in the project values: layout: "default" diff --git a/job.yaml b/job.yaml index 8f722df..2d9e50f 100644 --- a/job.yaml +++ b/job.yaml @@ -1,3 +1,4 @@ +--- apiVersion: batch/v1 kind: Job metadata: @@ -6,9 +7,9 @@ spec: template: spec: containers: - - name: kube-hunter - image: aquasec/kube-hunter - command: ["kube-hunter"] - args: ["--pod"] + - name: kube-hunter + image: aquasec/kube-hunter + command: ["kube-hunter"] + args: ["--pod"] restartPolicy: Never backoffLimit: 4