Update loadtest ALB TLS policies and fix Trivy PR scanning (#46194)
This commit is contained in:
Luke Heath
@@ -118,36 +118,21 @@ jobs:
|
||||
env:
|
||||
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db
|
||||
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db
|
||||
TRIVY_SECRET_CONFIG: "./security/code/trivy-secret.yaml"
|
||||
with:
|
||||
scan-type: "fs"
|
||||
ignore-unfixed: false
|
||||
# PR/push: print findings to the run log and fail the check so
|
||||
# engineers see issues before merging. Schedule/manual matrix runs:
|
||||
# emit SARIF for upload to the Security tab.
|
||||
# PR/push: only scan for secrets (block leaked credentials before merge).
|
||||
# Schedule/manual: full scan (vuln + secret + misconfig) with SARIF upload
|
||||
# to the Security tab for triage. CVEs are tracked nightly, not per-PR.
|
||||
scanners: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && 'vuln,secret,misconfig' || 'secret' }}
|
||||
format: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && 'sarif' || 'table' }}
|
||||
output: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && 'trivy-results.sarif' || '' }}
|
||||
exit-code: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && '0' || '1' }}
|
||||
severity: "CRITICAL,HIGH,MEDIUM,LOW"
|
||||
trivyignores: "./security/code/.trivyignore"
|
||||
# Skip private keys used only for local testing, not production:
|
||||
# - tools/osquery/in-a-box/osquery/fleet.key: TLS key for the "Fleet in a box" demo
|
||||
# - tools/osquery/fleet.key: TLS key for the standalone osquery dev sandbox
|
||||
# - orbit/pkg/insecure/proxy.go: TLS key used when running orbit with `--insecure` mode for development/testing.
|
||||
# - ee/orbit/pkg/httpsigproxy/httpsigproxy.go: TLS key only used for osquery to orbit _local_ communication
|
||||
# (for injection of HTTP signatures for the TPM-backed feature in Linux).
|
||||
# - website/config/custom.js: commented-out Stripe test-mode placeholders shown as example config.
|
||||
# - ee/fleet-agent-downloader/config/custom.js: same Sails template, commented-out Stripe test placeholders.
|
||||
# - tools/test-orbit-mtls/client.key: client private key used only by local/test mTLS tooling.
|
||||
# - tools/smtp4dev/fleet.key: TLS key for the local smtp4dev development mail server.
|
||||
skip-files: |
|
||||
tools/osquery/in-a-box/osquery/fleet.key
|
||||
tools/osquery/fleet.key
|
||||
tools/smtp4dev/fleet.key
|
||||
orbit/pkg/insecure/proxy.go
|
||||
ee/orbit/pkg/httpsigproxy/httpsigproxy.go
|
||||
website/config/custom.js
|
||||
ee/fleet-agent-downloader/config/custom.js
|
||||
tools/test-orbit-mtls/client.key
|
||||
# Test/dev keys and Sails placeholders are handled by trivy-secret.yaml.
|
||||
# Production files use targeted path+regex allow-rules in trivy-secret.yaml.
|
||||
|
||||
- name: Upload Trivy scan results to GitHub Security tab
|
||||
# Only upload on schedule/manual runs. PR/push uploads register
|
||||
|
||||
@@ -217,7 +217,7 @@ resource "aws_alb_listener" "elasticsearch" {
|
||||
load_balancer_arn = aws_alb.main.arn
|
||||
port = 9200
|
||||
protocol = "HTTPS"
|
||||
ssl_policy = "ELBSecurityPolicy-FS-1-2-Res-2019-08"
|
||||
ssl_policy = "ELBSecurityPolicy-TLS13-1-2-2021-06"
|
||||
certificate_arn = aws_acm_certificate_validation.fleetdm_com.certificate_arn
|
||||
|
||||
default_action {
|
||||
@@ -240,7 +240,7 @@ resource "aws_alb_listener" "elasticapm" {
|
||||
load_balancer_arn = aws_alb.main.arn
|
||||
port = 8200
|
||||
protocol = "HTTPS"
|
||||
ssl_policy = "ELBSecurityPolicy-FS-1-2-Res-2019-08"
|
||||
ssl_policy = "ELBSecurityPolicy-TLS13-1-2-2021-06"
|
||||
certificate_arn = aws_acm_certificate_validation.fleetdm_com.certificate_arn
|
||||
|
||||
default_action {
|
||||
@@ -260,7 +260,7 @@ resource "aws_alb_listener" "kibana" {
|
||||
load_balancer_arn = aws_alb.main.arn
|
||||
port = 5601
|
||||
protocol = "HTTPS"
|
||||
ssl_policy = "ELBSecurityPolicy-FS-1-2-Res-2019-08"
|
||||
ssl_policy = "ELBSecurityPolicy-TLS13-1-2-2021-06"
|
||||
certificate_arn = aws_acm_certificate_validation.fleetdm_com.certificate_arn
|
||||
|
||||
default_action {
|
||||
|
||||
@@ -0,0 +1,96 @@
|
||||
# Trivy secret scanning configuration.
|
||||
# Docs: https://trivy.dev/docs/latest/scanner/secret/
|
||||
#
|
||||
# Every suppressed file is listed explicitly. Production files also require
|
||||
# a content-specific regex so new real secrets in the same file still trigger.
|
||||
|
||||
allow-rules:
|
||||
|
||||
# ---- Test/dev private keys and TLS certs (not production) ----
|
||||
|
||||
- id: test-key-osquery-iab
|
||||
path: ^tools/osquery/in-a-box/osquery/fleet.key$
|
||||
|
||||
- id: test-key-osquery
|
||||
path: ^tools/osquery/fleet.key$
|
||||
|
||||
- id: test-key-smtp4dev
|
||||
path: ^tools/smtp4dev/fleet.key$
|
||||
|
||||
- id: test-key-orbit-mtls
|
||||
path: ^tools/test-orbit-mtls/client.key$
|
||||
|
||||
- id: test-key-intermediate-ca
|
||||
path: ^tools/test-certs/intermediate-ca/intermediate.key.pem$
|
||||
|
||||
- id: test-key-root-ca
|
||||
path: ^tools/test-certs/root-ca/root-ca.key.pem$
|
||||
|
||||
- id: test-key-server-cert
|
||||
path: ^tools/test-certs/server/server.key.pem$
|
||||
|
||||
- id: test-key-upgrade
|
||||
path: ^test/upgrade/fleet.key$
|
||||
|
||||
- id: test-key-service-testdata
|
||||
path: ^server/service/testdata/client.key$
|
||||
|
||||
- id: test-key-cryptoutil-rsa
|
||||
path: ^server/mdm/cryptoutil/testdata/pkcs8-rsa.key$
|
||||
|
||||
- id: test-key-cryptoutil-x25519
|
||||
path: ^server/mdm/cryptoutil/testdata/pkcs8-x25519.key$
|
||||
|
||||
- id: test-key-certificate
|
||||
path: ^pkg/certificate/testdata/test.key$
|
||||
|
||||
- id: test-key-client-testdata
|
||||
path: ^client/testdata/client.key$
|
||||
|
||||
- id: test-key-insecure-proxy
|
||||
path: ^orbit/pkg/insecure/proxy.go$
|
||||
|
||||
- id: test-key-httpsigproxy
|
||||
path: ^ee/orbit/pkg/httpsigproxy/httpsigproxy.go$
|
||||
|
||||
# ---- Production files (path + content-specific regex) ----
|
||||
|
||||
- id: serve-dev-license-jwts
|
||||
description: "Hardcoded dev/expired license JWTs for --dev_license flag"
|
||||
path: "^cmd/fleet/serve\\.go$"
|
||||
regex: "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9\\."
|
||||
|
||||
- id: calendars-gcp-placeholder
|
||||
description: "GCP service account JSON placeholder shown in the UI"
|
||||
path: "^frontend/pages/admin/IntegrationsPage/cards/Calendars/Calendars\\.tsx$"
|
||||
regex: "fleet-in-your-calendar"
|
||||
|
||||
- id: sails-fake-stripe-website
|
||||
description: "Placeholder Stripe keys in website Sails config"
|
||||
path: "^(website/config/custom\\.js|website/config/env/production\\.js|website/config/env/staging\\.js|website/views/pages/faq\\.ejs)$"
|
||||
regex: "(sk_test_Zzd814|pk_test_Zzd814|sk_prod__fake_Nfgh|sk_sandbox__fake_Nfgh|pk_sandbox__fake_fKd3)"
|
||||
|
||||
- id: sails-fake-stripe-agent-downloader
|
||||
description: "Placeholder Stripe keys in fleet-agent-downloader Sails config"
|
||||
path: "^(ee/fleet-agent-downloader/config/custom\\.js|ee/fleet-agent-downloader/config/env/production\\.js|ee/fleet-agent-downloader/config/env/staging\\.js)$"
|
||||
regex: "(sk_test_Zzd814|pk_test_Zzd814|sk_prod__fake_Nfgh|sk_sandbox__fake_Nfgh|pk_sandbox__fake_fKd3)"
|
||||
|
||||
- id: sails-fake-stripe-vuln-dashboard
|
||||
description: "Placeholder Stripe keys in vulnerability-dashboard Sails config"
|
||||
path: "^(ee/vulnerability-dashboard/config/custom\\.js|ee/vulnerability-dashboard/config/env/production\\.js|ee/vulnerability-dashboard/config/env/staging\\.js|ee/vulnerability-dashboard/views/pages/homepage\\.ejs|ee/vulnerability-dashboard/views/pages/faq\\.ejs|ee/vulnerability-dashboard/assets/js/utilities/open-stripe-checkout\\.js)$"
|
||||
regex: "(sk_test_Zzd814|pk_test_Zzd814|pk_test_Qz5RfD|sk_prod__fake_Nfgh|sk_sandbox__fake_Nfgh|pk_sandbox__fake_fKd3)"
|
||||
|
||||
- id: sails-fake-sendgrid-website
|
||||
description: "Placeholder SendGrid key in website Sails config"
|
||||
path: "^(website/config/custom\\.js|website/config/env/production\\.js|website/config/env/staging\\.js|website/views/pages/faq\\.ejs)$"
|
||||
regex: "SG\\.fake\\.3e0Bn0qSQVnwb1E4qNPz9JZP5vLZYqjh7sn8S93oSHU"
|
||||
|
||||
- id: sails-fake-sendgrid-agent-downloader
|
||||
description: "Placeholder SendGrid key in fleet-agent-downloader Sails config"
|
||||
path: "^(ee/fleet-agent-downloader/config/custom\\.js|ee/fleet-agent-downloader/config/env/production\\.js|ee/fleet-agent-downloader/config/env/staging\\.js)$"
|
||||
regex: "SG\\.fake\\.3e0Bn0qSQVnwb1E4qNPz9JZP5vLZYqjh7sn8S93oSHU"
|
||||
|
||||
- id: sails-fake-sendgrid-vuln-dashboard
|
||||
description: "Placeholder SendGrid key in vulnerability-dashboard Sails config"
|
||||
path: "^(ee/vulnerability-dashboard/config/custom\\.js|ee/vulnerability-dashboard/config/env/production\\.js|ee/vulnerability-dashboard/config/env/staging\\.js|ee/vulnerability-dashboard/views/pages/homepage\\.ejs|ee/vulnerability-dashboard/views/pages/faq\\.ejs)$"
|
||||
regex: "SG\\.fake\\.3e0Bn0qSQVnwb1E4qNPz9JZP5vLZYqjh7sn8S93oSHU"
|
||||
Reference in New Issue
Block a user