feat: add demo

components/producers/cloudpi/README.md

@@ -0,0 +1,4 @@
+# What's not automated
+
+- image build
+- task creation

components/producers/cloudpi/neo4j-client/main.py

@@ -1,6 +1,5 @@
 from reachability import assessor
 from trivy import run
-import os
 
 
 def main():

components/producers/cloudpi/neo4j-client/reachability/assessor.py

@@ -1,8 +1,9 @@
 from neo4j import GraphDatabase
-
-uri = "bolt://localhost:7687"
+import os
 
 # Create a Neo4j driver instance
+uri = os.getenv("DATABASE_URI")
+print(f"querying endpoint {uri}")
 driver = GraphDatabase.driver(uri)
 
 def get_snapshosts_exposed():

components/producers/cloudpi/neo4j-client/trivy/run.py

@@ -1,12 +1,13 @@
 import json
 import subprocess
+import os
 
 def scan_ebs(snap_name):
     try:
         # Run Trivy scan command for the specified ebs
         # trivy vm --scanners vuln ebs:snap-02f3d4e008898f8d0 --aws-region eu-west-1
         result = subprocess.run(
-            ['trivy', 'vm', '--scanners', 'vuln', '--format', 'json', f"ebs:{snap_name}"],
+            ['trivy', 'vm', '--scanners', 'vuln', '--format', 'json', '--severity', os.GetEnv("SEVERITY"), f"ebs:{snap_name}"],
             capture_output=True,
             text=True,
             check=True

components/producers/cloudpi/task-demo.yaml

@@ -0,0 +1,69 @@
+apiVersion: tekton.dev/v1
+kind: Task
+metadata:
+  annotations:
+  labels:
+    v1.dracon.ocurity.com/component: producer
+    v1.dracon.ocurity.com/test-type: sca
+  name: producer-cloudpi
+  namespace: dracon
+spec:
+  params:
+  - description: aws access key id
+    name: AWS_ACCESS_KEY_ID
+    type: string
+  - description: aws secret access key
+    name: AWS_SECRET_ACCESS_KEY
+    type: string
+  - description: aws region
+    name: AWS_DEFAULT_REGION
+    type: string
+  - description: database uri
+    name: DATABASE_URI
+    default: "bolt://dracon.dracon.svc:7687"
+  - description: severity flag to identify vulnerabilities
+    name: SEVERITY
+    default: HIGH
+  steps:
+  - name: run-cartography
+    image: 'kind-registry:5000/components/producers/cloudpi:v0.13.0'
+    env:
+      - name: AWS_ACCESS_KEY_ID
+        value: $(params.AWS_ACCESS_KEY_ID)
+      - name: AWS_SECRET_ACCESS_KEY
+        value: $(params.AWS_SECRET_ACCESS_KEY)
+      - name: AWS_DEFAULT_REGION
+        value: $(params.AWS_DEFAULT_REGION)
+      - name: READ_PATH
+        value: $(workspaces.output.path)/.dracon/producers
+      - name: WRITE_PATH
+        value: "$(workspaces.output.path)/.dracon/producers"
+    command: 
+      - cartography
+    args:
+      - --neo4j-uri
+      - bolt://dracon.dracon.svc:7687
+  - args:
+    - main.py
+    command:
+    - python
+    computeResources: {}
+    env:
+    - name: AWS_ACCESS_KEY_ID
+      value: $(params.AWS_ACCESS_KEY_ID)
+    - name: AWS_SECRET_ACCESS_KEY
+      value: $(params.AWS_SECRET_ACCESS_KEY)
+    - name: AWS_DEFAULT_REGION
+      value: $(params.AWS_DEFAULT_REGION)
+    - name: DATABASE_URI
+      value: $(params.DATABASE_URI)
+    - name: SEVERITY
+      value: $(params.SEVERITY)
+    image: kind-registry:5000/components/producers/neo4jclient:v0.13.8
+    name: run-trivy
+    volumeMounts:
+    - mountPath: /scratch
+      name: scratch
+  volumes:
+  - emptyDir: {}
+    name: scratch