From e88bdd55c9ee636cfef294349875e0d51ce26a6c Mon Sep 17 00:00:00 2001 From: Robert Seedorff Date: Sat, 9 Jul 2022 14:31:20 +0200 Subject: [PATCH 1/4] Improved nuclei cache feature to be configured for different cluster setups (single or multinode). Since not all clusters have pvc with ReadWriteMany available --- scanners/nuclei/templates/nuclei-shared-volumeclaim.yaml | 3 +-- scanners/nuclei/values.yaml | 5 ++++- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/scanners/nuclei/templates/nuclei-shared-volumeclaim.yaml b/scanners/nuclei/templates/nuclei-shared-volumeclaim.yaml index ae0bc4bb8c..654a185d74 100644 --- a/scanners/nuclei/templates/nuclei-shared-volumeclaim.yaml +++ b/scanners/nuclei/templates/nuclei-shared-volumeclaim.yaml @@ -11,8 +11,7 @@ metadata: name: nuclei-content-claim spec: accessModes: - - ReadWriteOnce - - ReadOnlyMany + {{- toYaml .Values.nucleiTemplateCache.accessMode | nindent 4 }} resources: requests: storage: 1Gi diff --git a/scanners/nuclei/values.yaml b/scanners/nuclei/values.yaml index 295049910e..4edddc22aa 100644 --- a/scanners/nuclei/values.yaml +++ b/scanners/nuclei/values.yaml @@ -93,7 +93,10 @@ scanner: nucleiTemplateCache: # -- Enables or disables the use of an persistent volume to cache the always downloaded nuclei-templates for all scans. - enabled: true + enabled: false + # -- Depending on your setup you can define the pvc access mode for one `ReadWriteOnce` or multiple node clusters `ReadWriteMany` + accessMode: + - ReadWriteMany # every day at 08:00: "0 8 * * *" # every full hour: "0 */1 * * *"" # -- The schedule indicates when and how often the nuclei template cache should be updated From 1e9ac7a5f55f9f2e265226b7eb57ab345371ffb7 Mon Sep 17 00:00:00 2001 From: rseedorff Date: Sat, 9 Jul 2022 12:31:53 +0000 Subject: [PATCH 2/4] Updating Helm Docs Signed-off-by: GitHub Actions --- scanners/nuclei/README.md | 3 ++- scanners/nuclei/docs/README.ArtifactHub.md | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/scanners/nuclei/README.md b/scanners/nuclei/README.md index 1ce1f2cb99..8e43f85b12 100644 --- a/scanners/nuclei/README.md +++ b/scanners/nuclei/README.md @@ -176,8 +176,9 @@ helm install nuclei secureCodeBox/nuclei --set="nucleiTemplateCache.enabled=fals |-----|------|---------|-------------| | cascadingRules.enabled | bool | `true` | Enables or disables the installation of the default cascading rules for this scanner | | imagePullSecrets | list | `[]` | Define imagePullSecrets when a private registry is used (see: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/) | +| nucleiTemplateCache.accessMode | list | `["ReadWriteMany"]` | Depending on your setup you can define the pvc access mode for one `ReadWriteOnce` or multiple node clusters `ReadWriteMany` | | nucleiTemplateCache.concurrencyPolicy | string | `"Replace"` | Determines how kubernetes handles cases where multiple instances of the cronjob would work if they are running at the same time. See: https://kubernetes.io/docs/tasks/job/automated-tasks-with-cron-jobs/#concurrency-policy | -| nucleiTemplateCache.enabled | bool | `true` | Enables or disables the use of an persistent volume to cache the always downloaded nuclei-templates for all scans. | +| nucleiTemplateCache.enabled | bool | `false` | Enables or disables the use of an persistent volume to cache the always downloaded nuclei-templates for all scans. | | nucleiTemplateCache.failedJobsHistoryLimit | int | `10` | Determines how many failed jobs are kept until kubernetes cleans them up. See: https://kubernetes.io/docs/tasks/job/automated-tasks-with-cron-jobs/#jobs-history-limits | | nucleiTemplateCache.schedule | string | `"0 */1 * * *"` | The schedule indicates when and how often the nuclei template cache should be updated | | nucleiTemplateCache.successfulJobsHistoryLimit | int | `3` | Determines how many successful jobs are kept until kubernetes cleans them up. See: https://kubernetes.io/docs/tasks/job/automated-tasks-with-cron-jobs/#jobs-history-limits | diff --git a/scanners/nuclei/docs/README.ArtifactHub.md b/scanners/nuclei/docs/README.ArtifactHub.md index 3507ab8783..0531ecb8cf 100644 --- a/scanners/nuclei/docs/README.ArtifactHub.md +++ b/scanners/nuclei/docs/README.ArtifactHub.md @@ -183,8 +183,9 @@ helm install nuclei secureCodeBox/nuclei --set="nucleiTemplateCache.enabled=fals |-----|------|---------|-------------| | cascadingRules.enabled | bool | `true` | Enables or disables the installation of the default cascading rules for this scanner | | imagePullSecrets | list | `[]` | Define imagePullSecrets when a private registry is used (see: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/) | +| nucleiTemplateCache.accessMode | list | `["ReadWriteMany"]` | Depending on your setup you can define the pvc access mode for one `ReadWriteOnce` or multiple node clusters `ReadWriteMany` | | nucleiTemplateCache.concurrencyPolicy | string | `"Replace"` | Determines how kubernetes handles cases where multiple instances of the cronjob would work if they are running at the same time. See: https://kubernetes.io/docs/tasks/job/automated-tasks-with-cron-jobs/#concurrency-policy | -| nucleiTemplateCache.enabled | bool | `true` | Enables or disables the use of an persistent volume to cache the always downloaded nuclei-templates for all scans. | +| nucleiTemplateCache.enabled | bool | `false` | Enables or disables the use of an persistent volume to cache the always downloaded nuclei-templates for all scans. | | nucleiTemplateCache.failedJobsHistoryLimit | int | `10` | Determines how many failed jobs are kept until kubernetes cleans them up. See: https://kubernetes.io/docs/tasks/job/automated-tasks-with-cron-jobs/#jobs-history-limits | | nucleiTemplateCache.schedule | string | `"0 */1 * * *"` | The schedule indicates when and how often the nuclei template cache should be updated | | nucleiTemplateCache.successfulJobsHistoryLimit | int | `3` | Determines how many successful jobs are kept until kubernetes cleans them up. See: https://kubernetes.io/docs/tasks/job/automated-tasks-with-cron-jobs/#jobs-history-limits | From 5651b1fce29a82c9fd7605bd5efbe5d5d98dc2da Mon Sep 17 00:00:00 2001 From: Robert Seedorff Date: Tue, 12 Jul 2022 14:23:22 +0200 Subject: [PATCH 3/4] Resetting default configuration to existing values to prevent a breaking change here. Signed-off-by: Robert Seedorff --- scanners/nuclei/values.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/scanners/nuclei/values.yaml b/scanners/nuclei/values.yaml index 4edddc22aa..121cb7bb55 100644 --- a/scanners/nuclei/values.yaml +++ b/scanners/nuclei/values.yaml @@ -93,10 +93,11 @@ scanner: nucleiTemplateCache: # -- Enables or disables the use of an persistent volume to cache the always downloaded nuclei-templates for all scans. - enabled: false + enabled: true # -- Depending on your setup you can define the pvc access mode for one `ReadWriteOnce` or multiple node clusters `ReadWriteMany` accessMode: - - ReadWriteMany + - ReadWriteOnce + - ReadOnlyMany # every day at 08:00: "0 8 * * *" # every full hour: "0 */1 * * *"" # -- The schedule indicates when and how often the nuclei template cache should be updated From 1954e919511c48a0590a811281398e588eafb53b Mon Sep 17 00:00:00 2001 From: rseedorff Date: Tue, 12 Jul 2022 12:24:04 +0000 Subject: [PATCH 4/4] Updating Helm Docs Signed-off-by: GitHub Actions --- scanners/nuclei/README.md | 4 ++-- scanners/nuclei/docs/README.ArtifactHub.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/scanners/nuclei/README.md b/scanners/nuclei/README.md index 8e43f85b12..6158e85d00 100644 --- a/scanners/nuclei/README.md +++ b/scanners/nuclei/README.md @@ -176,9 +176,9 @@ helm install nuclei secureCodeBox/nuclei --set="nucleiTemplateCache.enabled=fals |-----|------|---------|-------------| | cascadingRules.enabled | bool | `true` | Enables or disables the installation of the default cascading rules for this scanner | | imagePullSecrets | list | `[]` | Define imagePullSecrets when a private registry is used (see: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/) | -| nucleiTemplateCache.accessMode | list | `["ReadWriteMany"]` | Depending on your setup you can define the pvc access mode for one `ReadWriteOnce` or multiple node clusters `ReadWriteMany` | +| nucleiTemplateCache.accessMode | list | `["ReadWriteOnce","ReadOnlyMany"]` | Depending on your setup you can define the pvc access mode for one `ReadWriteOnce` or multiple node clusters `ReadWriteMany` | | nucleiTemplateCache.concurrencyPolicy | string | `"Replace"` | Determines how kubernetes handles cases where multiple instances of the cronjob would work if they are running at the same time. See: https://kubernetes.io/docs/tasks/job/automated-tasks-with-cron-jobs/#concurrency-policy | -| nucleiTemplateCache.enabled | bool | `false` | Enables or disables the use of an persistent volume to cache the always downloaded nuclei-templates for all scans. | +| nucleiTemplateCache.enabled | bool | `true` | Enables or disables the use of an persistent volume to cache the always downloaded nuclei-templates for all scans. | | nucleiTemplateCache.failedJobsHistoryLimit | int | `10` | Determines how many failed jobs are kept until kubernetes cleans them up. See: https://kubernetes.io/docs/tasks/job/automated-tasks-with-cron-jobs/#jobs-history-limits | | nucleiTemplateCache.schedule | string | `"0 */1 * * *"` | The schedule indicates when and how often the nuclei template cache should be updated | | nucleiTemplateCache.successfulJobsHistoryLimit | int | `3` | Determines how many successful jobs are kept until kubernetes cleans them up. See: https://kubernetes.io/docs/tasks/job/automated-tasks-with-cron-jobs/#jobs-history-limits | diff --git a/scanners/nuclei/docs/README.ArtifactHub.md b/scanners/nuclei/docs/README.ArtifactHub.md index 0531ecb8cf..316ffe252b 100644 --- a/scanners/nuclei/docs/README.ArtifactHub.md +++ b/scanners/nuclei/docs/README.ArtifactHub.md @@ -183,9 +183,9 @@ helm install nuclei secureCodeBox/nuclei --set="nucleiTemplateCache.enabled=fals |-----|------|---------|-------------| | cascadingRules.enabled | bool | `true` | Enables or disables the installation of the default cascading rules for this scanner | | imagePullSecrets | list | `[]` | Define imagePullSecrets when a private registry is used (see: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/) | -| nucleiTemplateCache.accessMode | list | `["ReadWriteMany"]` | Depending on your setup you can define the pvc access mode for one `ReadWriteOnce` or multiple node clusters `ReadWriteMany` | +| nucleiTemplateCache.accessMode | list | `["ReadWriteOnce","ReadOnlyMany"]` | Depending on your setup you can define the pvc access mode for one `ReadWriteOnce` or multiple node clusters `ReadWriteMany` | | nucleiTemplateCache.concurrencyPolicy | string | `"Replace"` | Determines how kubernetes handles cases where multiple instances of the cronjob would work if they are running at the same time. See: https://kubernetes.io/docs/tasks/job/automated-tasks-with-cron-jobs/#concurrency-policy | -| nucleiTemplateCache.enabled | bool | `false` | Enables or disables the use of an persistent volume to cache the always downloaded nuclei-templates for all scans. | +| nucleiTemplateCache.enabled | bool | `true` | Enables or disables the use of an persistent volume to cache the always downloaded nuclei-templates for all scans. | | nucleiTemplateCache.failedJobsHistoryLimit | int | `10` | Determines how many failed jobs are kept until kubernetes cleans them up. See: https://kubernetes.io/docs/tasks/job/automated-tasks-with-cron-jobs/#jobs-history-limits | | nucleiTemplateCache.schedule | string | `"0 */1 * * *"` | The schedule indicates when and how often the nuclei template cache should be updated | | nucleiTemplateCache.successfulJobsHistoryLimit | int | `3` | Determines how many successful jobs are kept until kubernetes cleans them up. See: https://kubernetes.io/docs/tasks/job/automated-tasks-with-cron-jobs/#jobs-history-limits |