Skip to content

Commit b54d42b

Browse files
Merge pull request #11 from HighwayofLife/update-tools
Update all tools and prep 2.7 release
2 parents 9112cb2 + 0c27563 commit b54d42b

File tree

4 files changed

+106
-66
lines changed

4 files changed

+106
-66
lines changed
Lines changed: 66 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,7 @@
1-
name: Docker
1+
name: Publish Container Image
22

33
on:
44
push:
5-
# Publish `master` as Docker `latest` image.
6-
branches:
7-
- master
8-
95
# Publish `v1.2.3` tags as releases.
106
tags:
117
- v*
@@ -14,19 +10,24 @@ on:
1410
pull_request:
1511

1612
env:
17-
# TODO: Change variable to your image's name.
18-
IMAGE_NAME: image
13+
HUB_NAMESPACE: deck15
14+
REGISTRY: ghcr.io
15+
IMAGE_NAME: kubeval-tools
1916

2017
jobs:
21-
# Run tests.
18+
# Run build test.
2219
# See also https://docs.docker.com/docker-hub/builds/automated-testing/
2320
test:
2421
runs-on: ubuntu-latest
22+
permissions:
23+
contents: read
24+
packages: write
2525

2626
steps:
27-
- uses: actions/checkout@v2
27+
- name: Checkout Repository
28+
uses: actions/checkout@v2
2829

29-
- name: Run tests
30+
- name: Run Build
3031
run: |
3132
if [ -f docker-compose.test.yml ]; then
3233
docker-compose --file docker-compose.test.yml build
@@ -38,7 +39,7 @@ jobs:
3839
# Push image to GitHub Packages.
3940
# See also https://docs.docker.com/docker-hub/builds/
4041
push:
41-
# Ensure test job passes before pushing image.
42+
# Ensure build-image job passes before pushing image.
4243
needs: test
4344

4445
runs-on: ubuntu-latest
@@ -49,32 +50,61 @@ jobs:
4950
packages: write
5051

5152
steps:
52-
- uses: actions/checkout@v2
53+
- name: Checkout the repo
54+
uses: actions/checkout@v2
5355

5456
- name: Build image
5557
run: docker build . --file Dockerfile --tag $IMAGE_NAME
5658

57-
- name: Log into registry
58-
run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login docker.pkg.github.com -u ${{ github.actor }} --password-stdin
59-
60-
- name: Push image
61-
run: |
62-
IMAGE_ID=docker.pkg.github.com/${{ github.repository }}/$IMAGE_NAME
63-
64-
# Change all uppercase to lowercase
65-
IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
66-
67-
# Strip git ref prefix from version
68-
VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
69-
70-
# Strip "v" prefix from tag name
71-
[[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
72-
73-
# Use Docker `latest` tag convention
74-
[ "$VERSION" == "master" ] && VERSION=latest
75-
76-
echo IMAGE_ID=$IMAGE_ID
77-
echo VERSION=$VERSION
78-
79-
docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
80-
docker push $IMAGE_ID:$VERSION
59+
- name: Log in to the Container Registry
60+
uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
61+
with:
62+
registry: ${{ env.REGISTRY }}
63+
username: ${{ github.actor }}
64+
password: ${{ secrets.GITHUB_TOKEN }}
65+
66+
- name: Log in to Docker Hub
67+
uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
68+
with:
69+
username: ${{ secrets.DOCKER_USERNAME }}
70+
password: ${{ secrets.DOCKER_PASSWORD }}
71+
72+
- name: Extract metadata for Github Registry
73+
id: meta
74+
uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
75+
with:
76+
images: |
77+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
78+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
79+
${{ env.HUB_NAMESPACE }}/${{ env.IMAGE_NAME }}
80+
${{ env.HUB_NAMESPACE }}/${{ env.IMAGE_NAME }}:latest
81+
82+
- name: Build and push Docker images
83+
uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc
84+
with:
85+
context: .
86+
push: true
87+
tags: ${{ steps.meta.outputs.tags }}
88+
labels: ${{ steps.meta.outputs.labels }}
89+
90+
# - name: Push image
91+
# run: |
92+
# IMAGE_ID=docker.pkg.github.com/${{ github.repository }}/$IMAGE_NAME
93+
94+
# # Change all uppercase to lowercase
95+
# IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
96+
97+
# # Strip git ref prefix from version
98+
# VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
99+
100+
# # Strip "v" prefix from tag name
101+
# [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
102+
103+
# # Use Docker `latest` tag convention
104+
# [ "$VERSION" == "master" ] && VERSION=latest
105+
106+
# echo IMAGE_ID=$IMAGE_ID
107+
# echo VERSION=$VERSION
108+
109+
# docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
110+
# docker push $IMAGE_ID:$VERSION

CHANGELOG.md

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,21 @@
1-
v2.7 (Unreleased)
2-
-----------------
1+
v2.7
2+
----
33
### Features 🚀
4-
* 🚀 **[NEW]** Added **[KubeScan](https://github.com/controlplaneio/kubesec)**, a security scanning tool for Kubernetes pods, deployments, daemonsets and statefulsets.
4+
* 🚀 **[NEW]** Added **[KubeSec](https://github.com/controlplaneio/kubesec)**, a Security risk analysis for Kubernetes Resources
55

66
### Additions
7-
* Install Kubescan [v2.11.2](https://github.com/controlplaneio/kubesec/releases/tag/v2.11.2)
7+
* Install Kubesec [v2.11.4](https://github.com/controlplaneio/kubesec/releases/tag/v2.11.4)
88

9+
### Updates 📝
10+
* Upgrade Python from 3.9 to 3.10
11+
* Upgrade Kustomize from 4.1.3 to 4.5.3
12+
* Upgrade Conftest from 0.25 to 0.30
13+
* Upgrade Kube Score from 1.11 to 1.14
14+
* Upgrade Polaris 4.0.2 to 5.1.0
15+
* Upgrade Kube Linter 0.2.2 to 0.2.6
16+
* Upgrade Kube Conform from 0.4.7 to 0.4.13
17+
* Upgrade Kube Audit from 0.14.1 to 0.16.0
18+
* Upgrade Datree from 0.1.431 to 1.0.15
919

1020
v2.6
1121
----

Dockerfile

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,40 @@
1-
FROM python:3.9.5-alpine3.13
1+
FROM python:3.10.4-alpine3.15
22
# https://hub.docker.com/_/python
33

4-
ARG APP_VERSION=2.6
4+
ARG APP_VERSION=2.7
55

66
# https://github.com/instrumenta/kubeval/releases
77
ARG KUBEVAL_VERSION=0.16.1
88

99
# https://github.com/kubernetes-sigs/kustomize/releases
10-
ARG KUSTOMIZE_VERSION=4.1.3
10+
ARG KUSTOMIZE_VERSION=4.5.3
1111

1212
# https://github.com/open-policy-agent/conftest/releases
13-
ARG CONFTEST_VERSION=0.25.0
13+
ARG CONFTEST_VERSION=0.30.0
1414

1515
# https://github.com/stelligent/config-lint/releases
1616
ARG CONFIG_LINT_VERSION=1.6.0
1717

1818
# https://github.com/zegl/kube-score/releases
19-
ARG KUBE_SCORE_VERSION=1.11.0
19+
ARG KUBE_SCORE_VERSION=1.14.0
2020

2121
# https://github.com/FairwindsOps/polaris/releases
22-
ARG POLARIS_VERSION=4.0.2
22+
ARG POLARIS_VERSION=5.1.0
2323

2424
# https://github.com/stackrox/kube-linter/releases
25-
ARG KUBE_LINTER_VERSION=0.2.2
25+
ARG KUBE_LINTER_VERSION=0.2.6
2626

2727
# https://github.com/yannh/kubeconform/releases
28-
ARG KUBECONFORM_VERSION=0.4.7
28+
ARG KUBECONFORM_VERSION=0.4.13
2929

3030
# https://github.com/Shopify/kubeaudit/releases
31-
ARG KUBEAUDIT_VERSION=0.14.1
31+
ARG KUBEAUDIT_VERSION=0.16.0
3232

3333
# https://github.com/datreeio/datree/releases
34-
ARG DATREE_VERSION=0.1.431
34+
ARG DATREE_VERSION=1.0.15
3535

3636
# https://github.com/controlplaneio/kubesec/releases
37-
ARG KUBESEC_VERSION=2.11.2
37+
ARG KUBESEC_VERSION=2.11.4
3838

3939
# split layers into distinct components
4040
# Install yamllint and kubectl via the alpine packages repositories
@@ -71,7 +71,7 @@ RUN mkdir /tmp/kubeconform \
7171
# Install Kubeaudit
7272
RUN mkdir /tmp/kubeaudit \
7373
&& curl -L -o /tmp/kubeaudit/kubeaudit.tar.gz \
74-
https://github.com/Shopify/kubeaudit/releases/download/v${KUBEAUDIT_VERSION}/kubeaudit_${KUBEAUDIT_VERSION}_linux_amd64.tar.gz \
74+
https://github.com/Shopify/kubeaudit/releases/download/${KUBEAUDIT_VERSION}/kubeaudit_${KUBEAUDIT_VERSION}_linux_amd64.tar.gz \
7575
&& tar -xzf /tmp/kubeaudit/kubeaudit.tar.gz -C /tmp/kubeaudit \
7676
&& mv /tmp/kubeaudit/kubeaudit /usr/local/bin \
7777
&& chmod +x /usr/local/bin/kubeaudit \
@@ -107,7 +107,7 @@ RUN mkdir /tmp/kube-score \
107107
# Install Polaris (https://github.com/FairwindsOps/polaris)
108108
RUN mkdir /tmp/polaris \
109109
&& curl -L -o /tmp/polaris/polaris.tar.gz \
110-
https://github.com/FairwindsOps/polaris/releases/download/${POLARIS_VERSION}/polaris_${POLARIS_VERSION}_linux_amd64.tar.gz \
110+
https://github.com/FairwindsOps/polaris/releases/download/${POLARIS_VERSION}/polaris_linux_amd64.tar.gz \
111111
&& tar -xzf /tmp/polaris/polaris.tar.gz -C /tmp/polaris \
112112
&& mv /tmp/polaris/polaris /usr/local/bin \
113113
&& chmod +x /usr/local/bin/polaris \

README.md

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -29,20 +29,20 @@ Tools List
2929
----------
3030
| Tool | Version | Purpose | Description |
3131
|-------------|----------|------------|-----------------------------------------------------------------------------------|
32-
| Kubectl | 1.21.1 | CLI | Kubernetes CLI. Can be used with `--dry-run=client` to validate manifests |
33-
| Helm | 3.6.0 | CLI | Helm helps you manage Kubernetes applications — define, install, and upgrade Kubernetes applications as helm charts. Run as a validation tool, can be run as `helm lint`, or `helm template`. |
34-
| Yamllint | 1.26.0 | Linter | Basic linter for YAML files |
32+
| Kubectl | 1.23.5 | CLI | Kubernetes CLI. Can be used with `--dry-run=client` to validate manifests |
33+
| Helm | 3.8.1 | CLI | Helm helps you manage Kubernetes applications — define, install, and upgrade Kubernetes applications as helm charts. Run as a validation tool, can be run as `helm lint`, or `helm template`. |
34+
| Yamllint | 1.26.3 | Linter | Basic linter for YAML files |
3535
| Kubeval | 0.16.1 | Validation | Tool for validating a Kubernetes YAML manifests. Doesn't work with CRDs. |
36-
| Kustomize | 4.1.3 | Compile | Template-free way to customize app configs. Useful to validate kustomize configs. |
36+
| Kustomize | 4.5.3 | Compile | Template-free way to customize app configs. Useful to validate kustomize configs. |
3737
| Config Lint | 1.6.0 | Validation | Validate config files using custom rules specified in YAML. |
38-
| Conftest | 0.25.0 | Tests | Utility to help you write tests against structured configuration data. |
39-
| Kube Score | 1.11.0 | Security | Tool that performs **static code analysis** of Kubernetes object definitions. |
40-
| Polaris | 4.0.2 | Validation | Identifies Kubernetes deployment configuration errors |
41-
| Kube Linter | 0.2.2 | Security | Linter and Static analysis tool that checks Kubernetes manifests |
42-
| Kubeconform | 0.4.7 | Validation | Kubernetes manifests validation tool like Kubeval with CRD support |
43-
| Kubeaudit | 0.14.1 | Security | Audit clusters or manifest files for security concerns |
44-
| Datree | 0.1.431 | Policy | Ensure Kubernetes manifests and Helm charts are valid and follow your policies. |
45-
| Kubesec | 2.11.2 | Security | Security risk analysis for Kubernetes resources |
38+
| Conftest | 0.30.0 | Tests | Utility to help you write tests against structured configuration data. |
39+
| Kube Score | 1.14.0 | Security | Tool that performs **static code analysis** of Kubernetes object definitions. |
40+
| Polaris | 5.1.0 | Validation | Identifies Kubernetes deployment configuration errors |
41+
| Kube Linter | 0.2.6 | Security | Linter and Static analysis tool that checks Kubernetes manifests |
42+
| Kubeconform | 0.4.13 | Validation | Kubernetes manifests validation tool like Kubeval with CRD support |
43+
| Kubeaudit | 0.16.0 | Security | Audit clusters or manifest files for security concerns |
44+
| Datree | 1.0.15 | Policy | Ensure Kubernetes manifests and Helm charts are valid and follow your policies. |
45+
| Kubesec | 2.11.4 | Security | Security risk analysis for Kubernetes resources |
4646

4747
CI Examples
4848
-----------
@@ -378,7 +378,7 @@ helm datree test <CHART_DIRECTORY>
378378
KubeSec
379379
-------
380380

381-
[KubeScan](https://github.com/controlplaneio/kubesec) is a security scanning tool for Kubernetes pods, deployments, daemonsets and statefulsets.
381+
[KubeSec](https://github.com/controlplaneio/kubesec) is a security scanning tool for Kubernetes pods, deployments, daemonsets and statefulsets.
382382

383383
#### Example usage
384384

0 commit comments

Comments
 (0)