Semgr8s v0.1.8 release

.github/workflows/.reusable-compliance.yml

@@ -33,7 +33,7 @@ jobs:
           repo_token: ${{ secrets.SCORECARD_TOKEN }}
           publish_results: false  #TODO: reactivate when working again
       - name: Upload
-        uses: github/codeql-action/upload-sarif@05963f47d870e2cb19a537396c1f668a348c7d8f # v3.24.8
+        uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9
         with:
           sarif_file: results.sarif
 
@@ -51,7 +51,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
       - name: Review
-        uses: actions/dependency-review-action@0fa40c3c10055986a88de3baa0d6ec17c5a894b3 # v4.2.3
+        uses: actions/dependency-review-action@5bbc3ba658137598168acb2ab73b21c432dd411b # v4.2.5
         with:
           comment-summary-in-pr: always
 

.github/workflows/.reusable-docs.yml

@@ -30,7 +30,7 @@ jobs:
           git config user.name "versioning_user"
           git config user.email "[email protected]"
       - name: Install python
-        uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
+        uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
         with:
           python-version-file: '.python-version'
       - name: Install poetry

.github/workflows/.reusable-integration-test.yml

@@ -144,10 +144,10 @@ jobs:
       fail-fast: false
       matrix:
         k8s-version: [
-            "v1.25",
             "v1.26",
             "v1.27",
             "v1.28",
+            "v1.29",
           ]
     steps:
       - name: Checkout code
@@ -201,6 +201,7 @@ jobs:
             "v1.22",
             "v1.23",
             "v1.24",
+            "v1.25",
           ]
     steps:
       - name: Checkout code

.github/workflows/.reusable-sast.yml

@@ -27,7 +27,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
       - name: Install python
-        uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
+        uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
         with:
           python-version-file: '.python-version'
       - name: Install poetry
@@ -48,7 +48,7 @@ jobs:
         run: bandit -r -f sarif -o bandit-results.sarif semgr8s/ --exit-zero
       - name: Upload
         if: inputs.output == 'sarif'
-        uses: github/codeql-action/upload-sarif@05963f47d870e2cb19a537396c1f668a348c7d8f # v3.24.8
+        uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9
         with:
           sarif_file: 'bandit-results.sarif'
 
@@ -62,7 +62,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
       - name: Install python
-        uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
+        uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
         with:
           python-version-file: '.python-version'
       - name: Install poetry
@@ -99,22 +99,22 @@ jobs:
         shell: bash
       - name: Scan
         if: inputs.output == 'table'
-        uses: bridgecrewio/checkov-action@06112e15bd63a2efc6b1655c67372c1737658fe7 # v12.2695.0
+        uses: bridgecrewio/checkov-action@068bd0c37d4fc3fb29500a1c039da808ec60e560 # v12.2705.0
         with:
           skip_check: CKV_DOCKER_2
           output_format: cli
           soft_fail: false
       - name: Scan
         if: inputs.output == 'sarif'
-        uses: bridgecrewio/checkov-action@06112e15bd63a2efc6b1655c67372c1737658fe7 # v12.2695.0
+        uses: bridgecrewio/checkov-action@068bd0c37d4fc3fb29500a1c039da808ec60e560 # v12.2705.0
         with:
           skip_check: CKV_DOCKER_2
           output_file_path: console,checkov-results.sarif
           output_format: cli,sarif
           soft_fail: true
       - name: Upload
         if: inputs.output == 'sarif'
-        uses: github/codeql-action/upload-sarif@05963f47d870e2cb19a537396c1f668a348c7d8f # v3.24.8
+        uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9
         with:
           sarif_file: checkov-results.sarif
 
@@ -131,11 +131,11 @@ jobs:
     - name: Checkout repository
       uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@05963f47d870e2cb19a537396c1f668a348c7d8f # v3.24.8
+      uses: github/codeql-action/init@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9
       with:
         languages: 'python'
     - name: Analyze
-      uses: github/codeql-action/analyze@05963f47d870e2cb19a537396c1f668a348c7d8f # v3.24.8
+      uses: github/codeql-action/analyze@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9
 
   hadolint:
     runs-on: ubuntu-latest
@@ -164,7 +164,7 @@ jobs:
           no-fail: true
           output-file: hadolint-results.sarif
       - name: Upload
-        uses: github/codeql-action/upload-sarif@05963f47d870e2cb19a537396c1f668a348c7d8f # v3.24.8
+        uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9
         if: inputs.output == 'sarif'
         with:
           sarif_file: 'hadolint-results.sarif'
@@ -197,7 +197,7 @@ jobs:
           format: sarif
           output-file: kubelinter-results.sarif
       - name: Upload
-        uses: github/codeql-action/upload-sarif@05963f47d870e2cb19a537396c1f668a348c7d8f # v3.24.8
+        uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9
         if: inputs.output == 'sarif'
         with:
           sarif_file: 'kubelinter-results.sarif'
@@ -211,7 +211,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
       - name: Install python
-        uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
+        uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
         with:
           python-version-file: '.python-version'
       - name: Install poetry
@@ -247,7 +247,7 @@ jobs:
         if: inputs.output == 'sarif'
         run: semgrep ci --config=auto --suppress-errors --sarif --output=semgrep-results.sarif || exit 0
       - name: Upload
-        uses: github/codeql-action/upload-sarif@05963f47d870e2cb19a537396c1f668a348c7d8f # v3.24.8
+        uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9
         if: inputs.output == 'sarif'
         with:
           sarif_file: semgrep-results.sarif

.github/workflows/.reusable-sca.yml

@@ -93,7 +93,7 @@ jobs:
           username: ${{ inputs.repo_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Run
-        uses: anchore/sbom-action@9fece9e20048ca9590af301449208b2b8861333b # v0.15.9
+        uses: anchore/sbom-action@ab5d7b5f48981941c4c5d6bf33aeb98fe3bae38c # v0.15.10
         with:
           image: ${{ inputs.image }}
           format: cyclonedx-json

.github/workflows/nightly.yaml

@@ -32,7 +32,7 @@ jobs:
       issues: read
       packages: read
       pages: read
-      pull-requests: read
+      pull-requests: write
       repository-projects: read
       security-events: write
       statuses: read

README.md

@@ -100,35 +100,48 @@ Once all resources are in `READY` state, you have successfully installed semgr8s
 ### Testing
 
 Several test resources are provided under `tests/demo/`.
-For namespaces with label `semgr8s/validation=enabled`, Semgr8s denies creating pods with insecure configuration according to the rules in `charts/semgr8s/rules`:
+Semgr8s only validates resources in namespaces with label `semgr8s/validation=enabled`:
 
 ```bash
-kubectl create -f tests/demo/failing_deployment.yaml
+kubectl apply -f tests/demo/00_test-namespace.yaml
 ```
 <details>
   <summary>output</summary>
 
   ```bash
-  namespace/test-semgr8s-failing created
-  Error from server: error when creating "tests/demo/failing_deployment.yaml": admission webhook "semgr8s-svc.semgr8ns.svc" denied the request: Found 1 violation(s) of the following policies: 
-  * rules.allow-privilege-escalation-no-securitycontext
-  Error from server: error when creating "tests/demo/failing_deployment.yaml": admission webhook "semgr8s-svc.semgr8ns.svc" denied the request: Found 1 violation(s) of the following policies: 
-  * rules.privileged-container
-  Error from server: error when creating "tests/demo/failing_deployment.yaml": admission webhook "semgr8s-svc.semgr8ns.svc" denied the request: Found 1 violation(s) of the following policies: 
-  * rules.hostnetwork-pod
+  namespace/test-semgr8s created
   ```
 </details>
 
-Securely configured resources on the other hand are permitted to the cluster:
+It denies creating pods with non-compliant configuration according to the local rules in `charts/semgr8s/rules` and `.application.remoteRules`  `charts/semgr8s/values.yaml`:
 
 ```bash
-kubectl create -f tests/demo/passing_deployment.yaml
+kubectl apply -f tests/demo/40_failing-deployment.yaml
+```
+<details>
+  <summary>output</summary>
+
+  ```bash
+  Error from server: error when creating "tests/demo/40_failing-deployment.yaml": admission webhook "semgr8s-svc.semgr8ns.svc" denied the request: Found 1 violation(s) of the following policies: 
+  * rules.test-semgr8s-forbidden-label
+  Error from server: error when creating "tests/demo/40_failing-deployment.yaml": admission webhook "semgr8s-svc.semgr8ns.svc" denied the request: Found 1 violation(s) of the following policies: 
+  * yaml.kubernetes.security.writable-filesystem-container.writable-filesystem-container
+  Error from server: error when creating "tests/demo/40_failing-deployment.yaml": admission webhook "semgr8s-svc.semgr8ns.svc" denied the request: Found 1 violation(s) of the following policies: 
+  * yaml.kubernetes.security.privileged-container.privileged-container
+  Error from server: error when creating "tests/demo/40_failing-deployment.yaml": admission webhook "semgr8s-svc.semgr8ns.svc" denied the request: Found 1 violation(s) of the following policies: 
+  * yaml.kubernetes.security.hostnetwork-pod.hostnetwork-pod
+  ```
+</details>
+
+Compliantly configured resources on the other hand are permitted to the cluster:
+
+```bash
+kubectl apply -f tests/demo/20_passing-deployment.yaml
 ```
 <details>
   <summary>output</summary>
 
   ```bash
-  namespace/test-semgr8s-passing created
   pod/passing-testpod-1 created
   ```
 </details>
@@ -159,12 +172,12 @@ kubectl delete -f tests/demo/
   <summary>output</summary>
 
   ```bash
-  namespace "test-semgr8s-failing" deleted
-  namespace "test-semgr8s-passing" deleted
+  namespace "test-semgr8s" deleted
   pod "passing-testpod-1" deleted
-  Error from server (NotFound): error when deleting "tests/demo/failing_deployment.yaml": pods "failing-testpod-1" not found
-  Error from server (NotFound): error when deleting "tests/demo/failing_deployment.yaml": pods "failing-testpod-2" not found
-  Error from server (NotFound): error when deleting "tests/demo/failing_deployment.yaml": pods "failing-testpod-3" not found
+  Error from server (NotFound): error when deleting "tests/demo/40_failing-deployment.yaml": pods "forbiddenlabel-pod" not found
+  Error from server (NotFound): error when deleting "tests/demo/40_failing-deployment.yaml": pods "failing-testpod-1" not found
+  Error from server (NotFound): error when deleting "tests/demo/40_failing-deployment.yaml": pods "failing-testpod-2" not found
+  Error from server (NotFound): error when deleting "tests/demo/40_failing-deployment.yaml": pods "failing-testpod-3" not found
 
   ```
 </details>

charts/semgr8s/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: semgr8s
 description: Semgrep-based Policy Controller for Kubernetes
 type: application
-version: "0.1.6"
-appVersion: "0.1.6"
+version: "0.1.8"
+appVersion: "0.1.8"
 keywords:
   - kubernetes
   - admission controller

charts/semgr8s/templates/deployment.yaml

@@ -5,7 +5,7 @@ metadata:
   labels:
     {{- include "semgr8s.labels" . | nindent 4 }}
 spec:
-  replicas: {{ .Values.deployment.replicaCount }}
+  replicas: {{ .Values.deployment.replicas }}
   selector:
     matchLabels:
       {{- include "semgr8s.selectorLabels" . | nindent 6 }}

charts/semgr8s/templates/webhook.yaml

@@ -14,8 +14,8 @@ metadata:
     {{- include "semgr8s.labels" . | nindent 4 }}
 type: Opaque
 data:
-  ca.crt: {{ $certificate.Cert | b64enc }}
-  ca.key: {{ $certificate.Key | b64enc }}
+  tls.crt: {{ $certificate.Cert | b64enc }}
+  tls.key: {{ $certificate.Key | b64enc }}
 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration

charts/semgr8s/values.yaml

@@ -4,7 +4,7 @@ deployment:
     pullPolicy: IfNotPresent
     tag: ""
   imagePullSecrets: []
-  replicaCount: 1
+  replicas: 2
   containerPort: 5000
   podAnnotations: {}
   podSecurityContext: {}