From 4a2cbbae7ce866b4d7d089a37459034d66387fcd Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Fri, 18 Aug 2023 14:40:36 +0200 Subject: [PATCH 01/33] #1833 Reimplemented amass parser to use the sqlite database instead of the JSON output This is done since the JSON output is no longer supported Signed-off-by: Ilyes Ben Dlala --- scanners/amass/parser/parser.js | 154 ++++++++++++++++++++++++-------- 1 file changed, 119 insertions(+), 35 deletions(-) diff --git a/scanners/amass/parser/parser.js b/scanners/amass/parser/parser.js index 70ab03b813..f6b1fa8e89 100644 --- a/scanners/amass/parser/parser.js +++ b/scanners/amass/parser/parser.js @@ -2,42 +2,126 @@ // // SPDX-License-Identifier: Apache-2.0 -async function parse(fileContent) { - let identifiedDomains = []; - - if (typeof fileContent === "string") { - identifiedDomains = fileContent - .split("\n") - .filter(Boolean) - .map((domainJson) => JSON.parse(domainJson)); - } else if (typeof fileContent === "object") { - // If amass identifies a single result it will be automatically parsed as a json object by the sdk & underlying http lib (axios) - identifiedDomains = [fileContent]; - } - - return identifiedDomains.map((domain) => { - let timestamp; - if (domain.Timestamp) { - timestamp = new Date(domain.Timestamp).toISOString(); - } - return { - name: domain.name, - identified_at: timestamp, - description: `Found subdomain ${domain.name}`, - category: "Subdomain", - location: domain.name, - osi_layer: "NETWORK", - severity: "INFORMATIONAL", - attributes: { - tag: domain.tag, - hostname: domain.name, - source: domain.source, - domain: domain.domain, - addresses: domain.addresses, - ip_addresses: domain.addresses?.map((address) => address.ip) ?? [], - }, - }; +const sqlite3 = require('sqlite3').verbose(); + + +async function checkifTableExists(db){ + const query = `select count(*) from sqlite_master m where m.name="assets" OR m.name="relations"` + + return new Promise((resolve, reject) => { + db.get(query, [], (err, row) => { + if (err) { + reject(err); + return; + } + resolve(row["count(*)"] === 2); + }); + }); + +} + +async function openDatabase(databasePath) { + + return new Promise((resolve, reject) => { + const db = new sqlite3.Database(databasePath, sqlite3.OPEN_READONLY, (err) => { + if (err) { + reject(err.message); + return; + } + }); + resolve(db); }); } +async function parse(databasePath) { + const db = await openDatabase(databasePath); + const tableExists = await checkifTableExists(db); + if(!tableExists) return []; + + return new Promise((resolve, reject) => { + + const query = ` + WITH relation_chain AS ( + SELECT + fqdn.content AS subdomain, + ips.content AS ip, + cidr.content AS cidr, + asn.id AS asn_id, + asn.content AS asn + FROM assets fqdn + + JOIN relations r1 ON fqdn.id = r1.from_asset_id AND (r1.type = 'a_record' OR r1.type = 'aaaa_record') + JOIN assets ips ON r1.to_asset_id = ips.id + + JOIN relations r2 ON ips.id = r2.to_asset_id AND r2.type = 'contains' + JOIN assets cidr ON r2.from_asset_id = cidr.id + + JOIN relations r3 ON cidr.id = r3.to_asset_id AND r3.type = 'announces' + JOIN assets asn ON r3.from_asset_id = asn.id + + WHERE fqdn.type = 'FQDN' + ) + + SELECT + rc.subdomain, + rc.ip, + rc.cidr, + rc.asn, + a.content AS managed_by, + (SELECT content FROM assets WHERE id = 1) AS domain + + FROM relation_chain rc + JOIN relations r ON rc.asn_id = r.from_asset_id AND r.type = 'managed_by' + JOIN assets a ON r.to_asset_id = a.id;`; + + db.all(query, [], (err, rows) => { + if (err) { + reject(err); + return; + } + + const results = rows.map((row) => { + // Parse the stringified JSON values + const domainObj = JSON.parse(row.domain); + const subdomainObj = JSON.parse(row.subdomain); + const ipObj = JSON.parse(row.ip); + const cidrObj = JSON.parse(row.cidr); + const asnObj = JSON.parse(row.asn); + const managedByObj = JSON.parse(row.managed_by); + + return { + name: subdomainObj.name, + identified_at: null, + description: `Found subdomain ${subdomainObj.name}`, + category: "Subdomain", + location: subdomainObj.name, + osi_layer: "NETWORK", + severity: "INFORMATIONAL", + attributes: { + addresses: { + ip: ipObj.address, + cidr: cidrObj.cidr, + asn: asnObj.number, + desc: managedByObj.name + }, + domain: domainObj.name, + hostname: subdomainObj.name, + ip_addresses: ipObj.address, + }, + }; + }); + + resolve(results); + + db.close((closeErr) => { + if (closeErr) { + reject(closeErr.message); + } + }); + }); + }); +} + + + module.exports.parse = parse; From 62426ae9d8fd1214b74dad3bda6e2f5449ab1c5c Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Fri, 18 Aug 2023 14:43:57 +0200 Subject: [PATCH 02/33] #1833 Updated amass parser tests and snapshot It now uses sqlite databases as test-files Signed-off-by: Ilyes Ben Dlala --- .../parser/__snapshots__/parser.test.js.snap | 1225 ++--------------- .../amass/parser/__testFiles__/empty.jsonl | 0 .../parser/__testFiles__/emptyTables.sqlite | Bin 0 -> 20480 bytes ...onl.license => emptyTables.sqlite.license} | 0 .../parser/__testFiles__/example.com.jsonl | 1 - .../parser/__testFiles__/example.com.sqlite | Bin 0 -> 20480 bytes ...onl.license => example.com.sqlite.license} | 0 .../parser/__testFiles__/noTables.sqlite | Bin 0 -> 20480 bytes .../__testFiles__/noTables.sqlite.license | 3 + .../__testFiles__/securecodebox.io.jsonl | 44 - scanners/amass/parser/parser.test.js | 106 +- 11 files changed, 123 insertions(+), 1256 deletions(-) delete mode 100644 scanners/amass/parser/__testFiles__/empty.jsonl create mode 100644 scanners/amass/parser/__testFiles__/emptyTables.sqlite rename scanners/amass/parser/__testFiles__/{example.com.jsonl.license => emptyTables.sqlite.license} (100%) delete mode 100644 scanners/amass/parser/__testFiles__/example.com.jsonl create mode 100644 scanners/amass/parser/__testFiles__/example.com.sqlite rename scanners/amass/parser/__testFiles__/{securecodebox.io.jsonl.license => example.com.sqlite.license} (100%) create mode 100644 scanners/amass/parser/__testFiles__/noTables.sqlite create mode 100644 scanners/amass/parser/__testFiles__/noTables.sqlite.license delete mode 100644 scanners/amass/parser/__testFiles__/securecodebox.io.jsonl diff --git a/scanners/amass/parser/__snapshots__/parser.test.js.snap b/scanners/amass/parser/__snapshots__/parser.test.js.snap index 2b4a0afb46..8aa0b7654a 100644 --- a/scanners/amass/parser/__snapshots__/parser.test.js.snap +++ b/scanners/amass/parser/__snapshots__/parser.test.js.snap @@ -1,1179 +1,164 @@ // Jest Snapshot v1, https://goo.gl/fbAQLP -exports[`example parser parses large json result successfully 1`] = ` +exports[`parser parses example.com sqlite results database successfully 1`] = ` [ { "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "grafana.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", + "addresses": { + "asn": 15133, + "cidr": "93.184.216.0/24", + "desc": "EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business", + "ip": "93.184.216.34", + }, + "domain": "example.com", + "hostname": "example.com", + "ip_addresses": "93.184.216.34", }, "category": "Subdomain", - "description": "Found subdomain grafana.securecodebox.io", - "identified_at": "2019-10-04T21:35:19.000Z", - "location": "grafana.securecodebox.io", - "name": "grafana.securecodebox.io", + "description": "Found subdomain example.com", + "identified_at": "2023-08-18T12:23:59.131Z", + "location": "example.com", + "name": "example.com", "osi_layer": "NETWORK", "severity": "INFORMATIONAL", }, { "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "kibana.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", + "addresses": { + "asn": 15133, + "cidr": "93.184.216.0/24", + "desc": "EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business", + "ip": "93.184.216.34", + }, + "domain": "example.com", + "hostname": "www.example.com", + "ip_addresses": "93.184.216.34", }, "category": "Subdomain", - "description": "Found subdomain kibana.securecodebox.io", - "identified_at": "2019-10-04T21:35:21.000Z", - "location": "kibana.securecodebox.io", - "name": "kibana.securecodebox.io", + "description": "Found subdomain www.example.com", + "identified_at": "2023-08-18T12:23:59.131Z", + "location": "www.example.com", + "name": "www.example.com", "osi_layer": "NETWORK", "severity": "INFORMATIONAL", }, { "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "build.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", + "addresses": { + "asn": 15133, + "cidr": "2606:2800:220::/48", + "desc": "EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business", + "ip": "2606:2800:220:1:248:1893:25c8:1946", + }, + "domain": "example.com", + "hostname": "example.com", + "ip_addresses": "2606:2800:220:1:248:1893:25c8:1946", }, "category": "Subdomain", - "description": "Found subdomain build.securecodebox.io", - "identified_at": "2019-10-04T21:35:21.000Z", - "location": "build.securecodebox.io", - "name": "build.securecodebox.io", + "description": "Found subdomain example.com", + "identified_at": "2023-08-18T12:23:59.131Z", + "location": "example.com", + "name": "example.com", "osi_layer": "NETWORK", "severity": "INFORMATIONAL", }, { "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "monitoring.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", + "addresses": { + "asn": 15133, + "cidr": "2606:2800:220::/48", + "desc": "EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business", + "ip": "2606:2800:220:1:248:1893:25c8:1946", + }, + "domain": "example.com", + "hostname": "www.example.com", + "ip_addresses": "2606:2800:220:1:248:1893:25c8:1946", }, "category": "Subdomain", - "description": "Found subdomain monitoring.securecodebox.io", - "identified_at": "2019-10-04T21:35:21.000Z", - "location": "monitoring.securecodebox.io", - "name": "monitoring.securecodebox.io", + "description": "Found subdomain www.example.com", + "identified_at": "2023-08-18T12:23:59.131Z", + "location": "www.example.com", + "name": "www.example.com", "osi_layer": "NETWORK", "severity": "INFORMATIONAL", }, { "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "ui.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", + "addresses": { + "asn": 26710, + "cidr": "199.43.135.0/24", + "desc": "ICANN-ANYCASTED-SERVICES - ICANN", + "ip": "199.43.135.53", + }, + "domain": "example.com", + "hostname": "a.iana-servers.net", + "ip_addresses": "199.43.135.53", }, "category": "Subdomain", - "description": "Found subdomain ui.securecodebox.io", - "identified_at": "2019-10-04T21:35:21.000Z", - "location": "ui.securecodebox.io", - "name": "ui.securecodebox.io", + "description": "Found subdomain a.iana-servers.net", + "identified_at": "2023-08-18T12:23:59.131Z", + "location": "a.iana-servers.net", + "name": "a.iana-servers.net", "osi_layer": "NETWORK", "severity": "INFORMATIONAL", }, { "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "juiceshop.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", + "addresses": { + "asn": 26710, + "cidr": "2001:500:8f::/48", + "desc": "ICANN-ANYCASTED-SERVICES - ICANN", + "ip": "2001:500:8f::53", + }, + "domain": "example.com", + "hostname": "a.iana-servers.net", + "ip_addresses": "2001:500:8f::53", }, "category": "Subdomain", - "description": "Found subdomain juiceshop.securecodebox.io", - "identified_at": "2019-10-04T21:35:21.000Z", - "location": "juiceshop.securecodebox.io", - "name": "juiceshop.securecodebox.io", + "description": "Found subdomain a.iana-servers.net", + "identified_at": "2023-08-18T12:23:59.131Z", + "location": "a.iana-servers.net", + "name": "a.iana-servers.net", "osi_layer": "NETWORK", "severity": "INFORMATIONAL", }, { "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "wpscan.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", + "addresses": { + "asn": 26710, + "cidr": "2001:500:8d::/48", + "desc": "ICANN-ANYCASTED-SERVICES - ICANN", + "ip": "2001:500:8d::53", + }, + "domain": "example.com", + "hostname": "b.iana-servers.net", + "ip_addresses": "2001:500:8d::53", }, "category": "Subdomain", - "description": "Found subdomain wpscan.securecodebox.io", - "identified_at": "2019-10-04T21:35:21.000Z", - "location": "wpscan.securecodebox.io", - "name": "wpscan.securecodebox.io", + "description": "Found subdomain b.iana-servers.net", + "identified_at": "2023-08-18T12:23:59.131Z", + "location": "b.iana-servers.net", + "name": "b.iana-servers.net", "osi_layer": "NETWORK", "severity": "INFORMATIONAL", }, { "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "hack.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", + "addresses": { + "asn": 26710, + "cidr": "199.43.133.0/24", + "desc": "ICANN-ANYCASTED-SERVICES - ICANN", + "ip": "199.43.133.53", + }, + "domain": "example.com", + "hostname": "b.iana-servers.net", + "ip_addresses": "199.43.133.53", }, "category": "Subdomain", - "description": "Found subdomain hack.securecodebox.io", - "identified_at": "2019-10-04T21:35:21.000Z", - "location": "hack.securecodebox.io", - "name": "hack.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "spider.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain spider.securecodebox.io", - "identified_at": "2019-10-04T21:35:22.000Z", - "location": "spider.securecodebox.io", - "name": "spider.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "www.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain www.securecodebox.io", - "identified_at": "2019-10-04T21:35:22.000Z", - "location": "www.securecodebox.io", - "name": "www.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "rancher.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain rancher.securecodebox.io", - "identified_at": "2019-10-04T21:35:22.000Z", - "location": "rancher.securecodebox.io", - "name": "rancher.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "backend.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain backend.securecodebox.io", - "identified_at": "2019-10-04T21:35:22.000Z", - "location": "backend.securecodebox.io", - "name": "backend.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "zap.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain zap.securecodebox.io", - "identified_at": "2019-10-04T21:35:22.000Z", - "location": "zap.securecodebox.io", - "name": "zap.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "bodgeit.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain bodgeit.securecodebox.io", - "identified_at": "2019-10-04T21:35:22.000Z", - "location": "bodgeit.securecodebox.io", - "name": "bodgeit.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "api-management.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain api-management.securecodebox.io", - "identified_at": "2019-10-04T21:35:22.000Z", - "location": "api-management.securecodebox.io", - "name": "api-management.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "dvwa.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain dvwa.securecodebox.io", - "identified_at": "2019-10-04T21:35:23.000Z", - "location": "dvwa.securecodebox.io", - "name": "dvwa.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "prometheus.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain prometheus.securecodebox.io", - "identified_at": "2019-10-04T21:35:23.000Z", - "location": "prometheus.securecodebox.io", - "name": "prometheus.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "engine.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain engine.securecodebox.io", - "identified_at": "2019-10-04T21:35:23.000Z", - "location": "engine.securecodebox.io", - "name": "engine.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "logging.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain logging.securecodebox.io", - "identified_at": "2019-10-04T21:35:23.000Z", - "location": "logging.securecodebox.io", - "name": "logging.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "petstoreapi.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain petstoreapi.securecodebox.io", - "identified_at": "2019-10-04T21:35:24.000Z", - "location": "petstoreapi.securecodebox.io", - "name": "petstoreapi.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "jenkins.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain jenkins.securecodebox.io", - "identified_at": "2019-10-04T21:35:24.000Z", - "location": "jenkins.securecodebox.io", - "name": "jenkins.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "bridge.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain bridge.securecodebox.io", - "identified_at": "2019-10-04T21:35:24.000Z", - "location": "bridge.securecodebox.io", - "name": "bridge.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "petstore.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain petstore.securecodebox.io", - "identified_at": "2019-10-04T21:35:24.000Z", - "location": "petstore.securecodebox.io", - "name": "petstore.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "sslyze.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain sslyze.securecodebox.io", - "identified_at": "2019-10-04T21:35:24.000Z", - "location": "sslyze.securecodebox.io", - "name": "sslyze.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "scanner.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain scanner.securecodebox.io", - "identified_at": "2019-10-04T21:35:25.000Z", - "location": "scanner.securecodebox.io", - "name": "scanner.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "sieve.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain sieve.securecodebox.io", - "identified_at": "2019-10-04T21:35:25.000Z", - "location": "sieve.securecodebox.io", - "name": "sieve.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Forward DNS", - "tag": "dns", - }, - "category": "Subdomain", - "description": "Found subdomain securecodebox.io", - "identified_at": "2019-10-04T21:35:19.000Z", - "location": "securecodebox.io", - "name": "securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "gateway.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain gateway.securecodebox.io", - "identified_at": "2019-10-04T21:35:25.000Z", - "location": "gateway.securecodebox.io", - "name": "gateway.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "sso.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain sso.securecodebox.io", - "identified_at": "2019-10-04T21:35:26.000Z", - "location": "sso.securecodebox.io", - "name": "sso.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "test.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain test.securecodebox.io", - "identified_at": "2019-10-04T21:35:26.000Z", - "location": "test.securecodebox.io", - "name": "test.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "elasticsearch.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain elasticsearch.securecodebox.io", - "identified_at": "2019-10-04T21:35:27.000Z", - "location": "elasticsearch.securecodebox.io", - "name": "elasticsearch.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "arachni.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain arachni.securecodebox.io", - "identified_at": "2019-10-04T21:35:28.000Z", - "location": "arachni.securecodebox.io", - "name": "arachni.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "ctf.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain ctf.securecodebox.io", - "identified_at": "2019-10-04T21:35:28.000Z", - "location": "ctf.securecodebox.io", - "name": "ctf.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "nmap.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain nmap.securecodebox.io", - "identified_at": "2019-10-04T21:35:28.000Z", - "location": "nmap.securecodebox.io", - "name": "nmap.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "discovery.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain discovery.securecodebox.io", - "identified_at": "2019-10-04T21:36:47.000Z", - "location": "discovery.securecodebox.io", - "name": "discovery.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "demo.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain demo.securecodebox.io", - "identified_at": "2019-10-04T21:36:48.000Z", - "location": "demo.securecodebox.io", - "name": "demo.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "dashboard.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain dashboard.securecodebox.io", - "identified_at": "2019-10-04T21:36:48.000Z", - "location": "dashboard.securecodebox.io", - "name": "dashboard.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "consul.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain consul.securecodebox.io", - "identified_at": "2019-10-04T21:36:48.000Z", - "location": "consul.securecodebox.io", - "name": "consul.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "target.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain target.securecodebox.io", - "identified_at": "2019-10-04T21:36:48.000Z", - "location": "target.securecodebox.io", - "name": "target.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "vault.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain vault.securecodebox.io", - "identified_at": "2019-10-04T21:36:48.000Z", - "location": "vault.securecodebox.io", - "name": "vault.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "docs.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain docs.securecodebox.io", - "identified_at": "2019-10-04T21:36:49.000Z", - "location": "docs.securecodebox.io", - "name": "docs.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "nikto.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain nikto.securecodebox.io", - "identified_at": "2019-10-04T21:36:50.000Z", - "location": "nikto.securecodebox.io", - "name": "nikto.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "api-backend.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain api-backend.securecodebox.io", - "identified_at": "2019-10-04T21:36:51.000Z", - "location": "api-backend.securecodebox.io", - "name": "api-backend.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - { - "attributes": { - "addresses": [ - { - "asn": 24940, - "cidr": "138.201.0.0/16", - "desc": "HETZNER-AS ", - "ip": "138.201.126.99", - }, - ], - "domain": "securecodebox.io", - "hostname": "api.securecodebox.io", - "ip_addresses": [ - "138.201.126.99", - ], - "source": "Entrust", - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain api.securecodebox.io", - "identified_at": "2019-10-04T21:36:51.000Z", - "location": "api.securecodebox.io", - "name": "api.securecodebox.io", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, -] -`; - -exports[`handles jsonl files with a single row correctly 1`] = ` -[ - { - "attributes": { - "addresses": [ - { - "asn": 54113, - "cidr": "185.199.108.0/22", - "desc": "FASTLY - Fastly", - "ip": "185.199.109.153", - }, - ], - "domain": "securecodebox.io", - "hostname": "www.securecodebox.io", - "ip_addresses": [ - "185.199.109.153", - ], - "source": undefined, - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain www.securecodebox.io", - "identified_at": "2012-04-23T18:25:43.511Z", - "location": "www.securecodebox.io", - "name": "www.securecodebox.io", + "description": "Found subdomain b.iana-servers.net", + "identified_at": "2023-08-18T12:23:59.131Z", + "location": "b.iana-servers.net", + "name": "b.iana-servers.net", "osi_layer": "NETWORK", "severity": "INFORMATIONAL", }, diff --git a/scanners/amass/parser/__testFiles__/empty.jsonl b/scanners/amass/parser/__testFiles__/empty.jsonl deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/scanners/amass/parser/__testFiles__/emptyTables.sqlite b/scanners/amass/parser/__testFiles__/emptyTables.sqlite new file mode 100644 index 0000000000000000000000000000000000000000..702de013aaf9c1493e5fc8f73e774d76fbd8ca4d GIT binary patch literal 20480 zcmeI3&u`mg7{{F^ZJKUfx*w$~sN^NPv}%*u?`tQH5fWMImS}C-CD~w_z;Y9}vz9oW z?QSa-hXRwha031T4jj0E#EJX3!jXSq9JnA39N@;|q)D6j&1yJI484h(I)3~7`aEB| zd0#t~8|$WPpq-Z8)LlflDJ~S^-b9GwxI6GO3P0V4w;k!ef#0E1+ru{RaB1!3$w`rm zoZsQ%srdKjcP76Y_Qz~LBftnS0*nA7zz8q`i~u9R2>c%i99<7bXJ%(ZAKrKM?S`Q{ zj^R3;*GQqP=Bp~I=C7@*sIzZ=0>Q(qqhhJ5uBm0TRW5Gi%eT>W_4ZPGtY#a!Yt%KE zv#fx1wYZ_86?HX#bG?cRH_K(URMotlm1=%tt7GCG>=~%4zEeH+(6U^^ayxraLw8)w zF$^n!yM_3loIR6Bgg!oOS7RFu-8Ea5)7u#BtEsp9-W-V$&9YitD|y|Y?~As8%Ic~L%`T{wu5`@$0@^Hr7}ix#RUuy~ zh?UAqy=QPTx9Jx8fecpo4S2~?imM5D5>x5HO#iylc)}|cg?1;@W#m4%#FnmXIgdR zk#oNRvv^J4cU$fE+CVf-7}ybpv&y)4W|{O}rZ_JCL;RDt>b+qPMt~7u1Q-EEfDvE> z7y(9r5nu!u0Y-okpc2T3!-WdZ6Ro$@qxBY)(l9s2JSHh#PVqS;WE4SCFi!K?3@_lE zBrWn-;rZ7`!dY;EHN9RBV4TU2tR&~;j&Uv&CSWXRPVKJI)HTyG-Jx-%j3i`ud>nVe zE6AJw{~G@({tdM{wv!QH1Q-EEfDvE>7y(9r5nu!u0Y-okU<95ofke0vdd5OScs87c zamp&f$V*`oqbw10um6v~7xejj3ue(60Y-okU<4QeM&QLG5dD(Oy-QAC01*|q2Eu1b zhP&Np)$Sc8Yi8X}DoG)iON%5e5R&GXv6x&+dUx!?KymAVnEZg^g5#nqB%uv@mlRPh zZsqHB+i;x2BwSGOHu@t-B#{5Hr(}-iU-V^<;j@(@@w_6}6=hkJ``l-I=|hep$BjKE zi5ew+k(z#Ah=BsA5oCyPm0kdTMgcnk3&8O8&?jW}Xp&NaP%f4??cKwqr8nC>EaXe2 zRK9c@Zpf{wE2)ZFzE$+@+D)ONHw3tB(}o*}p-r7_Z-d_S(M@tWMT?oQlpx@KbK3wt z;Y?QGhd8)E(Ij+4@ImQmQVOC;&jox%_FH;Wg)^E8*n>0`s7Fe4)zc%Ks$syt|ETIz z5dMwKQDjLZA0M3IGYXbL_89ZQWJ4s53xCRiZYusB5HL4i)1G8p0OQ>ko(x|??y{w~KhHbvzve31C$F#fyKajK}#Y=4D52~~X?vs`v z!AWXRTE`B)qe_eTkGCA0>SQsEg-kGM5or9#O){OQP~%r`ta#Gz9BU6BK1>^r^yXf} zNY`3T-%$jaf=owZBykk;JHuJJPWw77C|HygLCz5cOEuWaiJ3Fccpl);XH@A933`eV zIqM$+R0V`WgiNndio$(_^t7p4dddO$7`BtP43`4QJC?bpLELQzatCK)?h7(qI5WE- zxp~gsBGb7uojqF!BHx|=Py7ha&x1c-yiX!5V@7}xU<4QeMt~7u1Q>z;DuHuRP9cd< zXz;_Ww``SG~|g8V&i^GoEsn36@pK?5}WXwcIN+7$&;Rj#z*~zSQ&$uRLK+m zR9B*uN};2nSBD_tyIqM=f_l^cU&z&%?=%Fr?`Ka1^~c0nF#Vd$4KY1Fo%lnx?QD{u W+F{E%HjMZHi97_%ooN`R82%07)QrCX literal 0 HcmV?d00001 diff --git a/scanners/amass/parser/__testFiles__/example.com.jsonl.license b/scanners/amass/parser/__testFiles__/emptyTables.sqlite.license similarity index 100% rename from scanners/amass/parser/__testFiles__/example.com.jsonl.license rename to scanners/amass/parser/__testFiles__/emptyTables.sqlite.license diff --git a/scanners/amass/parser/__testFiles__/example.com.jsonl b/scanners/amass/parser/__testFiles__/example.com.jsonl deleted file mode 100644 index 058d848e16..0000000000 --- a/scanners/amass/parser/__testFiles__/example.com.jsonl +++ /dev/null @@ -1 +0,0 @@ -{"name":"www.example.de","domain":"example.de","addresses":[{"ip":"10.110.225.135","cidr":"10.110.224.0/21","asn":34011,"desc":"GD-EMEA-DC-CGN1"}],"tag":"cert","sources":["CertSpotter"]} \ No newline at end of file diff --git a/scanners/amass/parser/__testFiles__/example.com.sqlite b/scanners/amass/parser/__testFiles__/example.com.sqlite new file mode 100644 index 0000000000000000000000000000000000000000..879dc86942706d6a3b13b79a6ddb1be684ebc88b GIT binary patch literal 20480 zcmeI3Pi)&%9LJp|U7A0Rw{=}N!Bi72tF~tLvmHAIG_usK!rH7$!eG<3%uU?QTHdXy4hXn_gv1GP0*;)xaDxjH7dY~JNs~75%Nh^@2|Y_`Ui|X?{rUWU zcHP{2vJHTntBNPo50Dea|=7o0jQ$ zmhW}{MhaykUp4q@{=$mEclVu+^RU?szF4Xn%SM@BD;HPu<*WQf?cD(*zav-Pv?!TYbJCR5fdwlZ7zvXd!kQ;8h zRqNEPwpX!THu+80Zkg^Q{;u`tET1+vH=A~++0%Rj+TOQY*8D3Ihh{II z2{E?QupWB%ns60gGq?P9=XGt!TTL9=5r(tM6h5=C@Cb7T!+p)Y2TydP1SkPYfD)ht zC;>`<5}*Vq0ZM=ppadv^Q3UegaG@dyQmwz#Q|m7%W#HNz2}oKHv;`r@i&(-lB#Gqtt-xj!V-wZnpeMLwal9B*#1brN>&lG z0^0Q(hn&LP#|-x~_dPt(jS`>)C;>`<5}*Vq0ZM=ppaduZN`Mle1pa#hbKyeh84C^J zlVKI+39ASb$HP*Lutb2r|DTz<$#9=@ce&?N-=PJcGdXnL~_p>V~xc3lLd{??8lX$@15m?fTvA zblq;aX+16Gav535h?0~M&LKH{HjVGtg^A+YeL4LW!NkpDV12GOY+cc1t+ z;9@8Nq6h89kx>btXC$yOW&+4N9A%`FJ1ijsv0N-)a&K>^9kbP`VIf~CE#ymA;fCC* zvA9q%%2$f`uH6N`h^GLTYrAj*F_fu0#sgB(&vTH|^a9CezET2*Tdj2q`Uz!KQ6L$( zp2AQ9JqZ;N15o-ssf^Q;*u*V%R8hqPiVE1rDJr^|#2!dpN%pWWhavmHqY7tGOJF{P zwv?0rACwicI?|x+5fa908%fzY9`E!`C0IiV4fTz&xNP8-fj(I+6!}8C)!K6GdiREF zzGAue?YiZi<%>=|!#B>YpELO@mTNz5JN$($&vx*EKUQlgx}=yog)Bd#pWp@E~J7G+UcZ zD^qW`0!I-yB`` zkCAlHKLp4Mtwu1RWkOPDfRLH7O~+jDpnWXY%Q%)#fFz5n;qlC^k7Z7~IDyR-4vcP` z*tDe(HkLck*s~i!7V!1|iTDQ$_YLkcx)kHM@9SG<~2~Yx*03|>PPy&U1j z&Bx6UR)o}9P@W+pkb({{X>V@t+(Aqcvy%hwHb1(FemTDIz8kP z&#K2px|DmdP9G%*^=S~k7)-L`(lqT+yA8jIUVp?L9+KiVQBxzM6?@U9l0!lqkIn@#%BqEZOKB8D65U!-CcqxU@@OU+%muKP-L8!$>y4-7o*i=x7 za#NrrRz*U4Rf)xeQbmo9jJDrHQ^5s7{}!}Z%#>_zJyL-f*1FaOcF=hwQN~j>N-mB&^W2>7CIf!D7KnvYRjpl zv<(>!W$3^GPQVx7&;u8k;lv%TaO4Y=0~dw^hjQatza_R-iOQif%&a|*6m6cj-}9H^ zmDiQ)*DTLOcUn%<@DLGZgh)iVf{-8xx8XGguhH&nvb%*%`w{8woUpwur1aOO=^xAp zLj1@0kJC@5pPumde25d^1ULasfD_;ZH~~(86W|2?_XOh4BUdiX%|$-G?-@G{({NqW zb2~pr3uP@|)lfBm^_qq{#}=j#Jghn@ma5u@Rz}<9;%2^l3%#S=T5gZk9Mka3x(;)e zHL$K0H#M}Tt>Qn)IxiqjsN`8(o*DcvE7E1UPJk2O1ULasfD_;ZH~~(8 z6W|1x1oF{np(2Vz@89at`!|$QFgM2{CM%+{BIb~kQ6*W$I3;E?qJ(p@yd+{(6yF+& zX2Av4je0$VaVA5uvXWCe#<@t8fU%^zwYz51&@J2Y0^`aVS;~mG8+VEpL_eGVBmQgr zJ7#tKASb{HZ~~kFC%_4C0-OLRzzJ{yoB$`l3A|haiD)5m!i|RLTr>;gjJpUUuSQ9X zaf_gvK3xw$*ZR}#$m9nnJ-Zfs!wGN#oB$`l32*|OKmdV>Z^-=n6ji0Js;g;bz4MYC@XH}NM$}((Y#Rd78j+?Sgj{%9E%fhoT?sh`CgR8OdHJL4(nq8RO zsI#}pZ0=NNCkr7h_SXMT{Q}Rg!aoE4-Sfko04Kl+Z~~kFC%_4C0-V4L6F4&=s3Z}I z48OUhw~Y+jZtdGJ=ZnuW?+A@yGS9ZG!56*_%XVikG7U%nVHv`NSTSH(Z>{Cjqr--D zP??<&Sh>Pj`Y6{6Lm}yC_99p^a;0OvTrZqw7{U#JO>)^^WILo`^wVY7D$4o5bn#KT z=loG&ZWaA4AYI%`_uMqYP?-q~DIJA8>$jA0aj<-oS*X;63EVDxCwk`~J~L!WWdhkQ z24pMsvOW9CkRbr16XU-E;7Y)@2X~ZFsT6-*$OQ%M8?u5bpm?^3h}=gMJL5~Yeaj-x z4oT!*ooB`whDt0jw}5za{elrrpblKV;j^Aql1( Vw%xAbs1HzDgn+qI4WkUhe*rimjMo4F literal 0 HcmV?d00001 diff --git a/scanners/amass/parser/__testFiles__/noTables.sqlite.license b/scanners/amass/parser/__testFiles__/noTables.sqlite.license new file mode 100644 index 0000000000..c95bc37185 --- /dev/null +++ b/scanners/amass/parser/__testFiles__/noTables.sqlite.license @@ -0,0 +1,3 @@ +SPDX-FileCopyrightText: the secureCodeBox authors + +SPDX-License-Identifier: Apache-2.0 diff --git a/scanners/amass/parser/__testFiles__/securecodebox.io.jsonl b/scanners/amass/parser/__testFiles__/securecodebox.io.jsonl deleted file mode 100644 index bda992dc21..0000000000 --- a/scanners/amass/parser/__testFiles__/securecodebox.io.jsonl +++ /dev/null @@ -1,44 +0,0 @@ -{"Timestamp":"2019-10-04T23:35:19+02:00","name":"grafana.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:21+02:00","name":"kibana.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:21+02:00","name":"build.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:21+02:00","name":"monitoring.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:21+02:00","name":"ui.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:21+02:00","name":"juiceshop.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:21+02:00","name":"wpscan.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:21+02:00","name":"hack.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:22+02:00","name":"spider.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:22+02:00","name":"www.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:22+02:00","name":"rancher.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:22+02:00","name":"backend.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:22+02:00","name":"zap.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:22+02:00","name":"bodgeit.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:22+02:00","name":"api-management.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:23+02:00","name":"dvwa.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:23+02:00","name":"prometheus.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:23+02:00","name":"engine.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:23+02:00","name":"logging.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:24+02:00","name":"petstoreapi.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:24+02:00","name":"jenkins.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:24+02:00","name":"bridge.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:24+02:00","name":"petstore.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:24+02:00","name":"sslyze.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:25+02:00","name":"scanner.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:25+02:00","name":"sieve.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:19+02:00","name":"securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"dns","source":"Forward DNS"} -{"Timestamp":"2019-10-04T23:35:25+02:00","name":"gateway.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:26+02:00","name":"sso.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:26+02:00","name":"test.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:27+02:00","name":"elasticsearch.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:28+02:00","name":"arachni.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:28+02:00","name":"ctf.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:35:28+02:00","name":"nmap.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:36:47+02:00","name":"discovery.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:36:48+02:00","name":"demo.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:36:48+02:00","name":"dashboard.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:36:48+02:00","name":"consul.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:36:48+02:00","name":"target.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:36:48+02:00","name":"vault.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:36:49+02:00","name":"docs.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:36:50+02:00","name":"nikto.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:36:51+02:00","name":"api-backend.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} -{"Timestamp":"2019-10-04T23:36:51+02:00","name":"api.securecodebox.io","domain":"securecodebox.io","addresses":[{"ip":"138.201.126.99","cidr":"138.201.0.0/16","asn":24940,"desc":"HETZNER-AS "}],"tag":"cert","source":"Entrust"} diff --git a/scanners/amass/parser/parser.test.js b/scanners/amass/parser/parser.test.js index 42eba2cf79..f1b8289209 100644 --- a/scanners/amass/parser/parser.test.js +++ b/scanners/amass/parser/parser.test.js @@ -2,111 +2,35 @@ // // SPDX-License-Identifier: Apache-2.0 -const fs = require("fs"); -const util = require("util"); const { validateParser, } = require("@securecodebox/parser-sdk-nodejs/parser-utils"); // eslint-disable-next-line security/detect-non-literal-fs-filename -const readFile = util.promisify(fs.readFile); -const {parse} = require("./parser"); - -test("example parser parses empty json files to zero findings", async () => { - const fileContent = await readFile(__dirname + "/__testFiles__/empty.jsonl", { - encoding: "utf8", - }); - - const findings = await parse(fileContent); - await expect(validateParser(findings)).resolves.toBeUndefined(); - expect(findings).toEqual([]); -}); - -// test("example parser parses missing json files to zero findings", async () => { -// expect(await parse(null)).toEqual([]); -// }); +const { + parse +} = require("./parser"); -// test("example parser parses missing json files to zero findings", async () => { -// expect(await parse(0)).toEqual([]); -// }); +test("parser parses example.com sqlite results database successfully", async () => { + const databasePath = __dirname + "/__testFiles__/example.com.sqlite"; -test("example parser parses single line json successfully", async () => { - const fileContent = await readFile( - __dirname + "/__testFiles__/example.com.jsonl", - { - encoding: "utf8", - } - ); - const findings = await parse(fileContent); + const findings = await parse(databasePath); await expect(validateParser(findings)).resolves.toBeUndefined(); - - expect(findings).toMatchInlineSnapshot(` - [ - { - "attributes": { - "addresses": [ - { - "asn": 34011, - "cidr": "10.110.224.0/21", - "desc": "GD-EMEA-DC-CGN1", - "ip": "10.110.225.135", - }, - ], - "domain": "example.de", - "hostname": "www.example.de", - "ip_addresses": [ - "10.110.225.135", - ], - "source": undefined, - "tag": "cert", - }, - "category": "Subdomain", - "description": "Found subdomain www.example.de", - "identified_at": undefined, - "location": "www.example.de", - "name": "www.example.de", - "osi_layer": "NETWORK", - "severity": "INFORMATIONAL", - }, - ] - `); + expect(findings).toMatchSnapshot(); }); -test("example parser parses large json result successfully", async () => { - const fileContent = await readFile( - __dirname + "/__testFiles__/securecodebox.io.jsonl", - { - encoding: "utf8", - } - ); - - const findings = await parse(fileContent); +test("parser parses sqlite results database with empty tables successfully", async () => { + const databasePath = __dirname + "/__testFiles__/emptyTables.sqlite"; + const findings = await parse(databasePath); await expect(validateParser(findings)).resolves.toBeUndefined(); - expect(findings).toMatchSnapshot(); + expect(findings).toEqual([]); }); -// axios parses jsonl with a single line / entry as a json object as they are coincidentally also valid json objects. -// This means that the parser needs to also handle objects passed into into it, not just strings -test("handles jsonl files with a single row correctly", async () => { - const fileContent = { - name: "www.securecodebox.io", - domain: "securecodebox.io", - Timestamp: "2012-04-23T18:25:43.511Z", - addresses: [ - { - ip: "185.199.109.153", - cidr: "185.199.108.0/22", - asn: 54113, - desc: "FASTLY - Fastly", - }, - // ... - ], - tag: "cert", - sources: ["Crtsh"], - }; +test("parser parses sqlite results database with no tables successfully", async () => { + const databasePath = __dirname + "/__testFiles__/noTables.sqlite"; - const findings = await parse(fileContent); + const findings = await parse(databasePath); await expect(validateParser(findings)).resolves.toBeUndefined(); - expect(findings).toMatchSnapshot(); + expect(findings).toEqual([]); }); From b067cfad7f584106a3d7df7af2ea6265c8da7c6b Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Fri, 18 Aug 2023 14:45:15 +0200 Subject: [PATCH 03/33] #1833 Added sqlite3 dependency in new package.json for amass parser Signed-off-by: Ilyes Ben Dlala --- scanners/amass/parser/package-lock.json | 1109 +++++++++++++++++++++++ scanners/amass/parser/package.json | 16 + 2 files changed, 1125 insertions(+) create mode 100644 scanners/amass/parser/package-lock.json create mode 100644 scanners/amass/parser/package.json diff --git a/scanners/amass/parser/package-lock.json b/scanners/amass/parser/package-lock.json new file mode 100644 index 0000000000..87384844d2 --- /dev/null +++ b/scanners/amass/parser/package-lock.json @@ -0,0 +1,1109 @@ +{ + "name": "@securecodebox/parser-amass", + "version": "1.0.0", + "lockfileVersion": 3, + "requires": true, + "packages": { + "": { + "name": "@securecodebox/parser-amass", + "version": "1.0.0", + "license": "Apache-2.0", + "dependencies": { + "sqlite3": "^5.1.6" + }, + "devDependencies": {} + }, + "node_modules/@gar/promisify": { + "version": "1.1.3", + "resolved": "https://registry.npmjs.org/@gar/promisify/-/promisify-1.1.3.tgz", + "integrity": "sha512-k2Ty1JcVojjJFwrg/ThKi2ujJ7XNLYaFGNB/bWT9wGR+oSMJHMa5w+CUq6p/pVrKeNNgA7pCqEcjSnHVoqJQFw==", + "optional": true + }, + "node_modules/@mapbox/node-pre-gyp": { + "version": "1.0.11", + "resolved": "https://registry.npmjs.org/@mapbox/node-pre-gyp/-/node-pre-gyp-1.0.11.tgz", + "integrity": "sha512-Yhlar6v9WQgUp/He7BdgzOz8lqMQ8sU+jkCq7Wx8Myc5YFJLbEe7lgui/V7G1qB1DJykHSGwreceSaD60Y0PUQ==", + "dependencies": { + "detect-libc": "^2.0.0", + "https-proxy-agent": "^5.0.0", + "make-dir": "^3.1.0", + "node-fetch": "^2.6.7", + "nopt": "^5.0.0", + "npmlog": "^5.0.1", + "rimraf": "^3.0.2", + "semver": "^7.3.5", + "tar": "^6.1.11" + }, + "bin": { + "node-pre-gyp": "bin/node-pre-gyp" + } + }, + "node_modules/@npmcli/fs": { + "version": "1.1.1", + "resolved": "https://registry.npmjs.org/@npmcli/fs/-/fs-1.1.1.tgz", + "integrity": "sha512-8KG5RD0GVP4ydEzRn/I4BNDuxDtqVbOdm8675T49OIG/NGhaK0pjPX7ZcDlvKYbA+ulvVK3ztfcF4uBdOxuJbQ==", + "optional": true, + "dependencies": { + "@gar/promisify": "^1.0.1", + "semver": "^7.3.5" + } + }, + "node_modules/@npmcli/move-file": { + "version": "1.1.2", + "resolved": "https://registry.npmjs.org/@npmcli/move-file/-/move-file-1.1.2.tgz", + "integrity": "sha512-1SUf/Cg2GzGDyaf15aR9St9TWlb+XvbZXWpDx8YKs7MLzMH/BCeopv+y9vzrzgkfykCGuWOlSu3mZhj2+FQcrg==", + "deprecated": "This functionality has been moved to @npmcli/fs", + "optional": true, + "dependencies": { + "mkdirp": "^1.0.4", + "rimraf": "^3.0.2" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/@tootallnate/once": { + "version": "1.1.2", + "resolved": "https://registry.npmjs.org/@tootallnate/once/-/once-1.1.2.tgz", + "integrity": "sha512-RbzJvlNzmRq5c3O09UipeuXno4tA1FE6ikOjxZK0tuxVv3412l64l5t1W5pj4+rJq9vpkm/kwiR07aZXnsKPxw==", + "optional": true, + "engines": { + "node": ">= 6" + } + }, + "node_modules/abbrev": { + "version": "1.1.1", + "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-1.1.1.tgz", + "integrity": "sha512-nne9/IiQ/hzIhY6pdDnbBtz7DjPTKrY00P/zvPSm5pOFkl6xuGrGnXn/VtTNNfNtAfZ9/1RtehkszU9qcTii0Q==" + }, + "node_modules/agent-base": { + "version": "6.0.2", + "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz", + "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==", + "dependencies": { + "debug": "4" + }, + "engines": { + "node": ">= 6.0.0" + } + }, + "node_modules/agentkeepalive": { + "version": "4.5.0", + "resolved": "https://registry.npmjs.org/agentkeepalive/-/agentkeepalive-4.5.0.tgz", + "integrity": "sha512-5GG/5IbQQpC9FpkRGsSvZI5QYeSCzlJHdpBQntCsuTOxhKD8lqKhrleg2Yi7yvMIf82Ycmmqln9U8V9qwEiJew==", + "optional": true, + "dependencies": { + "humanize-ms": "^1.2.1" + }, + "engines": { + "node": ">= 8.0.0" + } + }, + "node_modules/aggregate-error": { + "version": "3.1.0", + "resolved": "https://registry.npmjs.org/aggregate-error/-/aggregate-error-3.1.0.tgz", + "integrity": "sha512-4I7Td01quW/RpocfNayFdFVk1qSuoh0E7JrbRJ16nH01HhKFQ88INq9Sd+nd72zqRySlr9BmDA8xlEJ6vJMrYA==", + "optional": true, + "dependencies": { + "clean-stack": "^2.0.0", + "indent-string": "^4.0.0" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/ansi-regex": { + "version": "5.0.1", + "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz", + "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==", + "engines": { + "node": ">=8" + } + }, + "node_modules/aproba": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/aproba/-/aproba-2.0.0.tgz", + "integrity": "sha512-lYe4Gx7QT+MKGbDsA+Z+he/Wtef0BiwDOlK/XkBrdfsh9J/jPPXbX0tE9x9cl27Tmu5gg3QUbUrQYa/y+KOHPQ==" + }, + "node_modules/are-we-there-yet": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/are-we-there-yet/-/are-we-there-yet-2.0.0.tgz", + "integrity": "sha512-Ci/qENmwHnsYo9xKIcUJN5LeDKdJ6R1Z1j9V/J5wyq8nh/mYPEpIKJbBZXtZjG04HiK7zV/p6Vs9952MrMeUIw==", + "dependencies": { + "delegates": "^1.0.0", + "readable-stream": "^3.6.0" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/balanced-match": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz", + "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==" + }, + "node_modules/brace-expansion": { + "version": "1.1.11", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz", + "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==", + "dependencies": { + "balanced-match": "^1.0.0", + "concat-map": "0.0.1" + } + }, + "node_modules/cacache": { + "version": "15.3.0", + "resolved": "https://registry.npmjs.org/cacache/-/cacache-15.3.0.tgz", + "integrity": "sha512-VVdYzXEn+cnbXpFgWs5hTT7OScegHVmLhJIR8Ufqk3iFD6A6j5iSX1KuBTfNEv4tdJWE2PzA6IVFtcLC7fN9wQ==", + "optional": true, + "dependencies": { + "@npmcli/fs": "^1.0.0", + "@npmcli/move-file": "^1.0.1", + "chownr": "^2.0.0", + "fs-minipass": "^2.0.0", + "glob": "^7.1.4", + "infer-owner": "^1.0.4", + "lru-cache": "^6.0.0", + "minipass": "^3.1.1", + "minipass-collect": "^1.0.2", + "minipass-flush": "^1.0.5", + "minipass-pipeline": "^1.2.2", + "mkdirp": "^1.0.3", + "p-map": "^4.0.0", + "promise-inflight": "^1.0.1", + "rimraf": "^3.0.2", + "ssri": "^8.0.1", + "tar": "^6.0.2", + "unique-filename": "^1.1.1" + }, + "engines": { + "node": ">= 10" + } + }, + "node_modules/chownr": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/chownr/-/chownr-2.0.0.tgz", + "integrity": "sha512-bIomtDF5KGpdogkLd9VspvFzk9KfpyyGlS8YFVZl7TGPBHL5snIOnxeshwVgPteQ9b4Eydl+pVbIyE1DcvCWgQ==", + "engines": { + "node": ">=10" + } + }, + "node_modules/clean-stack": { + "version": "2.2.0", + "resolved": "https://registry.npmjs.org/clean-stack/-/clean-stack-2.2.0.tgz", + "integrity": "sha512-4diC9HaTE+KRAMWhDhrGOECgWZxoevMc5TlkObMqNSsVU62PYzXZ/SMTjzyGAFF1YusgxGcSWTEXBhp0CPwQ1A==", + "optional": true, + "engines": { + "node": ">=6" + } + }, + "node_modules/color-support": { + "version": "1.1.3", + "resolved": "https://registry.npmjs.org/color-support/-/color-support-1.1.3.tgz", + "integrity": "sha512-qiBjkpbMLO/HL68y+lh4q0/O1MZFj2RX6X/KmMa3+gJD3z+WwI1ZzDHysvqHGS3mP6mznPckpXmw1nI9cJjyRg==", + "bin": { + "color-support": "bin.js" + } + }, + "node_modules/concat-map": { + "version": "0.0.1", + "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz", + "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==" + }, + "node_modules/console-control-strings": { + "version": "1.1.0", + "resolved": "https://registry.npmjs.org/console-control-strings/-/console-control-strings-1.1.0.tgz", + "integrity": "sha512-ty/fTekppD2fIwRvnZAVdeOiGd1c7YXEixbgJTNzqcxJWKQnjJ/V1bNEEE6hygpM3WjwHFUVK6HTjWSzV4a8sQ==" + }, + "node_modules/debug": { + "version": "4.3.4", + "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz", + "integrity": "sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==", + "dependencies": { + "ms": "2.1.2" + }, + "engines": { + "node": ">=6.0" + }, + "peerDependenciesMeta": { + "supports-color": { + "optional": true + } + } + }, + "node_modules/delegates": { + "version": "1.0.0", + "resolved": "https://registry.npmjs.org/delegates/-/delegates-1.0.0.tgz", + "integrity": "sha512-bd2L678uiWATM6m5Z1VzNCErI3jiGzt6HGY8OVICs40JQq/HALfbyNJmp0UDakEY4pMMaN0Ly5om/B1VI/+xfQ==" + }, + "node_modules/detect-libc": { + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.0.2.tgz", + "integrity": "sha512-UX6sGumvvqSaXgdKGUsgZWqcUyIXZ/vZTrlRT/iobiKhGL0zL4d3osHj3uqllWJK+i+sixDS/3COVEOFbupFyw==", + "engines": { + "node": ">=8" + } + }, + "node_modules/emoji-regex": { + "version": "8.0.0", + "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz", + "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==" + }, + "node_modules/encoding": { + "version": "0.1.13", + "resolved": "https://registry.npmjs.org/encoding/-/encoding-0.1.13.tgz", + "integrity": "sha512-ETBauow1T35Y/WZMkio9jiM0Z5xjHHmJ4XmjZOq1l/dXz3lr2sRn87nJy20RupqSh1F2m3HHPSp8ShIPQJrJ3A==", + "optional": true, + "dependencies": { + "iconv-lite": "^0.6.2" + } + }, + "node_modules/env-paths": { + "version": "2.2.1", + "resolved": "https://registry.npmjs.org/env-paths/-/env-paths-2.2.1.tgz", + "integrity": "sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A==", + "optional": true, + "engines": { + "node": ">=6" + } + }, + "node_modules/err-code": { + "version": "2.0.3", + "resolved": "https://registry.npmjs.org/err-code/-/err-code-2.0.3.tgz", + "integrity": "sha512-2bmlRpNKBxT/CRmPOlyISQpNj+qSeYvcym/uT0Jx2bMOlKLtSy1ZmLuVxSEKKyor/N5yhvp/ZiG1oE3DEYMSFA==", + "optional": true + }, + "node_modules/fs-minipass": { + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/fs-minipass/-/fs-minipass-2.1.0.tgz", + "integrity": "sha512-V/JgOLFCS+R6Vcq0slCuaeWEdNC3ouDlJMNIsacH2VtALiu9mV4LPrHc5cDl8k5aw6J8jwgWWpiTo5RYhmIzvg==", + "dependencies": { + "minipass": "^3.0.0" + }, + "engines": { + "node": ">= 8" + } + }, + "node_modules/fs.realpath": { + "version": "1.0.0", + "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz", + "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==" + }, + "node_modules/gauge": { + "version": "3.0.2", + "resolved": "https://registry.npmjs.org/gauge/-/gauge-3.0.2.tgz", + "integrity": "sha512-+5J6MS/5XksCuXq++uFRsnUd7Ovu1XenbeuIuNRJxYWjgQbPuFhT14lAvsWfqfAmnwluf1OwMjz39HjfLPci0Q==", + "dependencies": { + "aproba": "^1.0.3 || ^2.0.0", + "color-support": "^1.1.2", + "console-control-strings": "^1.0.0", + "has-unicode": "^2.0.1", + "object-assign": "^4.1.1", + "signal-exit": "^3.0.0", + "string-width": "^4.2.3", + "strip-ansi": "^6.0.1", + "wide-align": "^1.1.2" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/glob": { + "version": "7.2.3", + "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz", + "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==", + "dependencies": { + "fs.realpath": "^1.0.0", + "inflight": "^1.0.4", + "inherits": "2", + "minimatch": "^3.1.1", + "once": "^1.3.0", + "path-is-absolute": "^1.0.0" + }, + "engines": { + "node": "*" + }, + "funding": { + "url": "https://github.com/sponsors/isaacs" + } + }, + "node_modules/graceful-fs": { + "version": "4.2.11", + "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz", + "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==", + "optional": true + }, + "node_modules/has-unicode": { + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/has-unicode/-/has-unicode-2.0.1.tgz", + "integrity": "sha512-8Rf9Y83NBReMnx0gFzA8JImQACstCYWUplepDa9xprwwtmgEZUF0h/i5xSA625zB/I37EtrswSST6OXxwaaIJQ==" + }, + "node_modules/http-cache-semantics": { + "version": "4.1.1", + "resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.1.1.tgz", + "integrity": "sha512-er295DKPVsV82j5kw1Gjt+ADA/XYHsajl82cGNQG2eyoPkvgUhX+nDIyelzhIWbbsXP39EHcI6l5tYs2FYqYXQ==", + "optional": true + }, + "node_modules/http-proxy-agent": { + "version": "4.0.1", + "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-4.0.1.tgz", + "integrity": "sha512-k0zdNgqWTGA6aeIRVpvfVob4fL52dTfaehylg0Y4UvSySvOq/Y+BOyPrgpUrA7HylqvU8vIZGsRuXmspskV0Tg==", + "optional": true, + "dependencies": { + "@tootallnate/once": "1", + "agent-base": "6", + "debug": "4" + }, + "engines": { + "node": ">= 6" + } + }, + "node_modules/https-proxy-agent": { + "version": "5.0.1", + "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz", + "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==", + "dependencies": { + "agent-base": "6", + "debug": "4" + }, + "engines": { + "node": ">= 6" + } + }, + "node_modules/humanize-ms": { + "version": "1.2.1", + "resolved": "https://registry.npmjs.org/humanize-ms/-/humanize-ms-1.2.1.tgz", + "integrity": "sha512-Fl70vYtsAFb/C06PTS9dZBo7ihau+Tu/DNCk/OyHhea07S+aeMWpFFkUaXRa8fI+ScZbEI8dfSxwY7gxZ9SAVQ==", + "optional": true, + "dependencies": { + "ms": "^2.0.0" + } + }, + "node_modules/iconv-lite": { + "version": "0.6.3", + "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz", + "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==", + "optional": true, + "dependencies": { + "safer-buffer": ">= 2.1.2 < 3.0.0" + }, + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/imurmurhash": { + "version": "0.1.4", + "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz", + "integrity": "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==", + "optional": true, + "engines": { + "node": ">=0.8.19" + } + }, + "node_modules/indent-string": { + "version": "4.0.0", + "resolved": "https://registry.npmjs.org/indent-string/-/indent-string-4.0.0.tgz", + "integrity": "sha512-EdDDZu4A2OyIK7Lr/2zG+w5jmbuk1DVBnEwREQvBzspBJkCEbRa8GxU1lghYcaGJCnRWibjDXlq779X1/y5xwg==", + "optional": true, + "engines": { + "node": ">=8" + } + }, + "node_modules/infer-owner": { + "version": "1.0.4", + "resolved": "https://registry.npmjs.org/infer-owner/-/infer-owner-1.0.4.tgz", + "integrity": "sha512-IClj+Xz94+d7irH5qRyfJonOdfTzuDaifE6ZPWfx0N0+/ATZCbuTPq2prFl526urkQd90WyUKIh1DfBQ2hMz9A==", + "optional": true + }, + "node_modules/inflight": { + "version": "1.0.6", + "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz", + "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==", + "dependencies": { + "once": "^1.3.0", + "wrappy": "1" + } + }, + "node_modules/inherits": { + "version": "2.0.4", + "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz", + "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==" + }, + "node_modules/ip": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/ip/-/ip-2.0.0.tgz", + "integrity": "sha512-WKa+XuLG1A1R0UWhl2+1XQSi+fZWMsYKffMZTTYsiZaUD8k2yDAj5atimTUD2TZkyCkNEeYE5NhFZmupOGtjYQ==", + "optional": true + }, + "node_modules/is-fullwidth-code-point": { + "version": "3.0.0", + "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz", + "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==", + "engines": { + "node": ">=8" + } + }, + "node_modules/is-lambda": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/is-lambda/-/is-lambda-1.0.1.tgz", + "integrity": "sha512-z7CMFGNrENq5iFB9Bqo64Xk6Y9sg+epq1myIcdHaGnbMTYOxvzsEtdYqQUylB7LxfkvgrrjP32T6Ywciio9UIQ==", + "optional": true + }, + "node_modules/isexe": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz", + "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==", + "optional": true + }, + "node_modules/lru-cache": { + "version": "6.0.0", + "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz", + "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==", + "dependencies": { + "yallist": "^4.0.0" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/make-dir": { + "version": "3.1.0", + "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-3.1.0.tgz", + "integrity": "sha512-g3FeP20LNwhALb/6Cz6Dd4F2ngze0jz7tbzrD2wAV+o9FeNHe4rL+yK2md0J/fiSf1sa1ADhXqi5+oVwOM/eGw==", + "dependencies": { + "semver": "^6.0.0" + }, + "engines": { + "node": ">=8" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/make-dir/node_modules/semver": { + "version": "6.3.1", + "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz", + "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==", + "bin": { + "semver": "bin/semver.js" + } + }, + "node_modules/make-fetch-happen": { + "version": "9.1.0", + "resolved": "https://registry.npmjs.org/make-fetch-happen/-/make-fetch-happen-9.1.0.tgz", + "integrity": "sha512-+zopwDy7DNknmwPQplem5lAZX/eCOzSvSNNcSKm5eVwTkOBzoktEfXsa9L23J/GIRhxRsaxzkPEhrJEpE2F4Gg==", + "optional": true, + "dependencies": { + "agentkeepalive": "^4.1.3", + "cacache": "^15.2.0", + "http-cache-semantics": "^4.1.0", + "http-proxy-agent": "^4.0.1", + "https-proxy-agent": "^5.0.0", + "is-lambda": "^1.0.1", + "lru-cache": "^6.0.0", + "minipass": "^3.1.3", + "minipass-collect": "^1.0.2", + "minipass-fetch": "^1.3.2", + "minipass-flush": "^1.0.5", + "minipass-pipeline": "^1.2.4", + "negotiator": "^0.6.2", + "promise-retry": "^2.0.1", + "socks-proxy-agent": "^6.0.0", + "ssri": "^8.0.0" + }, + "engines": { + "node": ">= 10" + } + }, + "node_modules/minimatch": { + "version": "3.1.2", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz", + "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==", + "dependencies": { + "brace-expansion": "^1.1.7" + }, + "engines": { + "node": "*" + } + }, + "node_modules/minipass": { + "version": "3.3.6", + "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz", + "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==", + "dependencies": { + "yallist": "^4.0.0" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/minipass-collect": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/minipass-collect/-/minipass-collect-1.0.2.tgz", + "integrity": "sha512-6T6lH0H8OG9kITm/Jm6tdooIbogG9e0tLgpY6mphXSm/A9u8Nq1ryBG+Qspiub9LjWlBPsPS3tWQ/Botq4FdxA==", + "optional": true, + "dependencies": { + "minipass": "^3.0.0" + }, + "engines": { + "node": ">= 8" + } + }, + "node_modules/minipass-fetch": { + "version": "1.4.1", + "resolved": "https://registry.npmjs.org/minipass-fetch/-/minipass-fetch-1.4.1.tgz", + "integrity": "sha512-CGH1eblLq26Y15+Azk7ey4xh0J/XfJfrCox5LDJiKqI2Q2iwOLOKrlmIaODiSQS8d18jalF6y2K2ePUm0CmShw==", + "optional": true, + "dependencies": { + "minipass": "^3.1.0", + "minipass-sized": "^1.0.3", + "minizlib": "^2.0.0" + }, + "engines": { + "node": ">=8" + }, + "optionalDependencies": { + "encoding": "^0.1.12" + } + }, + "node_modules/minipass-flush": { + "version": "1.0.5", + "resolved": "https://registry.npmjs.org/minipass-flush/-/minipass-flush-1.0.5.tgz", + "integrity": "sha512-JmQSYYpPUqX5Jyn1mXaRwOda1uQ8HP5KAT/oDSLCzt1BYRhQU0/hDtsB1ufZfEEzMZ9aAVmsBw8+FWsIXlClWw==", + "optional": true, + "dependencies": { + "minipass": "^3.0.0" + }, + "engines": { + "node": ">= 8" + } + }, + "node_modules/minipass-pipeline": { + "version": "1.2.4", + "resolved": "https://registry.npmjs.org/minipass-pipeline/-/minipass-pipeline-1.2.4.tgz", + "integrity": "sha512-xuIq7cIOt09RPRJ19gdi4b+RiNvDFYe5JH+ggNvBqGqpQXcru3PcRmOZuHBKWK1Txf9+cQ+HMVN4d6z46LZP7A==", + "optional": true, + "dependencies": { + "minipass": "^3.0.0" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/minipass-sized": { + "version": "1.0.3", + "resolved": "https://registry.npmjs.org/minipass-sized/-/minipass-sized-1.0.3.tgz", + "integrity": "sha512-MbkQQ2CTiBMlA2Dm/5cY+9SWFEN8pzzOXi6rlM5Xxq0Yqbda5ZQy9sU75a673FE9ZK0Zsbr6Y5iP6u9nktfg2g==", + "optional": true, + "dependencies": { + "minipass": "^3.0.0" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/minizlib": { + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-2.1.2.tgz", + "integrity": "sha512-bAxsR8BVfj60DWXHE3u30oHzfl4G7khkSuPW+qvpd7jFRHm7dLxOjUk1EHACJ/hxLY8phGJ0YhYHZo7jil7Qdg==", + "dependencies": { + "minipass": "^3.0.0", + "yallist": "^4.0.0" + }, + "engines": { + "node": ">= 8" + } + }, + "node_modules/mkdirp": { + "version": "1.0.4", + "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-1.0.4.tgz", + "integrity": "sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==", + "bin": { + "mkdirp": "bin/cmd.js" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/ms": { + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz", + "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==" + }, + "node_modules/negotiator": { + "version": "0.6.3", + "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.3.tgz", + "integrity": "sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==", + "optional": true, + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/node-addon-api": { + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-4.3.0.tgz", + "integrity": "sha512-73sE9+3UaLYYFmDsFZnqCInzPyh3MqIwZO9cw58yIqAZhONrrabrYyYe3TuIqtIiOuTXVhsGau8hcrhhwSsDIQ==" + }, + "node_modules/node-fetch": { + "version": "2.6.12", + "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.12.tgz", + "integrity": "sha512-C/fGU2E8ToujUivIO0H+tpQ6HWo4eEmchoPIoXtxCrVghxdKq+QOHqEZW7tuP3KlV3bC8FRMO5nMCC7Zm1VP6g==", + "dependencies": { + "whatwg-url": "^5.0.0" + }, + "engines": { + "node": "4.x || >=6.0.0" + }, + "peerDependencies": { + "encoding": "^0.1.0" + }, + "peerDependenciesMeta": { + "encoding": { + "optional": true + } + } + }, + "node_modules/node-gyp": { + "version": "8.4.1", + "resolved": "https://registry.npmjs.org/node-gyp/-/node-gyp-8.4.1.tgz", + "integrity": "sha512-olTJRgUtAb/hOXG0E93wZDs5YiJlgbXxTwQAFHyNlRsXQnYzUaF2aGgujZbw+hR8aF4ZG/rST57bWMWD16jr9w==", + "optional": true, + "dependencies": { + "env-paths": "^2.2.0", + "glob": "^7.1.4", + "graceful-fs": "^4.2.6", + "make-fetch-happen": "^9.1.0", + "nopt": "^5.0.0", + "npmlog": "^6.0.0", + "rimraf": "^3.0.2", + "semver": "^7.3.5", + "tar": "^6.1.2", + "which": "^2.0.2" + }, + "bin": { + "node-gyp": "bin/node-gyp.js" + }, + "engines": { + "node": ">= 10.12.0" + } + }, + "node_modules/node-gyp/node_modules/are-we-there-yet": { + "version": "3.0.1", + "resolved": "https://registry.npmjs.org/are-we-there-yet/-/are-we-there-yet-3.0.1.tgz", + "integrity": "sha512-QZW4EDmGwlYur0Yyf/b2uGucHQMa8aFUP7eu9ddR73vvhFyt4V0Vl3QHPcTNJ8l6qYOBdxgXdnBXQrHilfRQBg==", + "optional": true, + "dependencies": { + "delegates": "^1.0.0", + "readable-stream": "^3.6.0" + }, + "engines": { + "node": "^12.13.0 || ^14.15.0 || >=16.0.0" + } + }, + "node_modules/node-gyp/node_modules/gauge": { + "version": "4.0.4", + "resolved": "https://registry.npmjs.org/gauge/-/gauge-4.0.4.tgz", + "integrity": "sha512-f9m+BEN5jkg6a0fZjleidjN51VE1X+mPFQ2DJ0uv1V39oCLCbsGe6yjbBnp7eK7z/+GAon99a3nHuqbuuthyPg==", + "optional": true, + "dependencies": { + "aproba": "^1.0.3 || ^2.0.0", + "color-support": "^1.1.3", + "console-control-strings": "^1.1.0", + "has-unicode": "^2.0.1", + "signal-exit": "^3.0.7", + "string-width": "^4.2.3", + "strip-ansi": "^6.0.1", + "wide-align": "^1.1.5" + }, + "engines": { + "node": "^12.13.0 || ^14.15.0 || >=16.0.0" + } + }, + "node_modules/node-gyp/node_modules/npmlog": { + "version": "6.0.2", + "resolved": "https://registry.npmjs.org/npmlog/-/npmlog-6.0.2.tgz", + "integrity": "sha512-/vBvz5Jfr9dT/aFWd0FIRf+T/Q2WBsLENygUaFUqstqsycmZAP/t5BvFJTK0viFmSUxiUKTUplWy5vt+rvKIxg==", + "optional": true, + "dependencies": { + "are-we-there-yet": "^3.0.0", + "console-control-strings": "^1.1.0", + "gauge": "^4.0.3", + "set-blocking": "^2.0.0" + }, + "engines": { + "node": "^12.13.0 || ^14.15.0 || >=16.0.0" + } + }, + "node_modules/nopt": { + "version": "5.0.0", + "resolved": "https://registry.npmjs.org/nopt/-/nopt-5.0.0.tgz", + "integrity": "sha512-Tbj67rffqceeLpcRXrT7vKAN8CwfPeIBgM7E6iBkmKLV7bEMwpGgYLGv0jACUsECaa/vuxP0IjEont6umdMgtQ==", + "dependencies": { + "abbrev": "1" + }, + "bin": { + "nopt": "bin/nopt.js" + }, + "engines": { + "node": ">=6" + } + }, + "node_modules/npmlog": { + "version": "5.0.1", + "resolved": "https://registry.npmjs.org/npmlog/-/npmlog-5.0.1.tgz", + "integrity": "sha512-AqZtDUWOMKs1G/8lwylVjrdYgqA4d9nu8hc+0gzRxlDb1I10+FHBGMXs6aiQHFdCUUlqH99MUMuLfzWDNDtfxw==", + "dependencies": { + "are-we-there-yet": "^2.0.0", + "console-control-strings": "^1.1.0", + "gauge": "^3.0.0", + "set-blocking": "^2.0.0" + } + }, + "node_modules/object-assign": { + "version": "4.1.1", + "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz", + "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/once": { + "version": "1.4.0", + "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz", + "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==", + "dependencies": { + "wrappy": "1" + } + }, + "node_modules/p-map": { + "version": "4.0.0", + "resolved": "https://registry.npmjs.org/p-map/-/p-map-4.0.0.tgz", + "integrity": "sha512-/bjOqmgETBYB5BoEeGVea8dmvHb2m9GLy1E9W43yeyfP6QQCZGFNa+XRceJEuDB6zqr+gKpIAmlLebMpykw/MQ==", + "optional": true, + "dependencies": { + "aggregate-error": "^3.0.0" + }, + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/path-is-absolute": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz", + "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/promise-inflight": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/promise-inflight/-/promise-inflight-1.0.1.tgz", + "integrity": "sha512-6zWPyEOFaQBJYcGMHBKTKJ3u6TBsnMFOIZSa6ce1e/ZrrsOlnHRHbabMjLiBYKp+n44X9eUI6VUPaukCXHuG4g==", + "optional": true + }, + "node_modules/promise-retry": { + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/promise-retry/-/promise-retry-2.0.1.tgz", + "integrity": "sha512-y+WKFlBR8BGXnsNlIHFGPZmyDf3DFMoLhaflAnyZgV6rG6xu+JwesTo2Q9R6XwYmtmwAFCkAk3e35jEdoeh/3g==", + "optional": true, + "dependencies": { + "err-code": "^2.0.2", + "retry": "^0.12.0" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/readable-stream": { + "version": "3.6.2", + "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz", + "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==", + "dependencies": { + "inherits": "^2.0.3", + "string_decoder": "^1.1.1", + "util-deprecate": "^1.0.1" + }, + "engines": { + "node": ">= 6" + } + }, + "node_modules/retry": { + "version": "0.12.0", + "resolved": "https://registry.npmjs.org/retry/-/retry-0.12.0.tgz", + "integrity": "sha512-9LkiTwjUh6rT555DtE9rTX+BKByPfrMzEAtnlEtdEwr3Nkffwiihqe2bWADg+OQRjt9gl6ICdmB/ZFDCGAtSow==", + "optional": true, + "engines": { + "node": ">= 4" + } + }, + "node_modules/rimraf": { + "version": "3.0.2", + "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-3.0.2.tgz", + "integrity": "sha512-JZkJMZkAGFFPP2YqXZXPbMlMBgsxzE8ILs4lMIX/2o0L9UBw9O/Y3o6wFw/i9YLapcUJWwqbi3kdxIPdC62TIA==", + "dependencies": { + "glob": "^7.1.3" + }, + "bin": { + "rimraf": "bin.js" + }, + "funding": { + "url": "https://github.com/sponsors/isaacs" + } + }, + "node_modules/safe-buffer": { + "version": "5.2.1", + "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz", + "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/feross" + }, + { + "type": "patreon", + "url": "https://www.patreon.com/feross" + }, + { + "type": "consulting", + "url": "https://feross.org/support" + } + ] + }, + "node_modules/safer-buffer": { + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz", + "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==", + "optional": true + }, + "node_modules/semver": { + "version": "7.5.4", + "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz", + "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==", + "dependencies": { + "lru-cache": "^6.0.0" + }, + "bin": { + "semver": "bin/semver.js" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/set-blocking": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/set-blocking/-/set-blocking-2.0.0.tgz", + "integrity": "sha512-KiKBS8AnWGEyLzofFfmvKwpdPzqiy16LvQfK3yv/fVH7Bj13/wl3JSR1J+rfgRE9q7xUJK4qvgS8raSOeLUehw==" + }, + "node_modules/signal-exit": { + "version": "3.0.7", + "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz", + "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==" + }, + "node_modules/smart-buffer": { + "version": "4.2.0", + "resolved": "https://registry.npmjs.org/smart-buffer/-/smart-buffer-4.2.0.tgz", + "integrity": "sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg==", + "optional": true, + "engines": { + "node": ">= 6.0.0", + "npm": ">= 3.0.0" + } + }, + "node_modules/socks": { + "version": "2.7.1", + "resolved": "https://registry.npmjs.org/socks/-/socks-2.7.1.tgz", + "integrity": "sha512-7maUZy1N7uo6+WVEX6psASxtNlKaNVMlGQKkG/63nEDdLOWNbiUMoLK7X4uYoLhQstau72mLgfEWcXcwsaHbYQ==", + "optional": true, + "dependencies": { + "ip": "^2.0.0", + "smart-buffer": "^4.2.0" + }, + "engines": { + "node": ">= 10.13.0", + "npm": ">= 3.0.0" + } + }, + "node_modules/socks-proxy-agent": { + "version": "6.2.1", + "resolved": "https://registry.npmjs.org/socks-proxy-agent/-/socks-proxy-agent-6.2.1.tgz", + "integrity": "sha512-a6KW9G+6B3nWZ1yB8G7pJwL3ggLy1uTzKAgCb7ttblwqdz9fMGJUuTy3uFzEP48FAs9FLILlmzDlE2JJhVQaXQ==", + "optional": true, + "dependencies": { + "agent-base": "^6.0.2", + "debug": "^4.3.3", + "socks": "^2.6.2" + }, + "engines": { + "node": ">= 10" + } + }, + "node_modules/sqlite3": { + "version": "5.1.6", + "resolved": "https://registry.npmjs.org/sqlite3/-/sqlite3-5.1.6.tgz", + "integrity": "sha512-olYkWoKFVNSSSQNvxVUfjiVbz3YtBwTJj+mfV5zpHmqW3sELx2Cf4QCdirMelhM5Zh+KDVaKgQHqCxrqiWHybw==", + "hasInstallScript": true, + "dependencies": { + "@mapbox/node-pre-gyp": "^1.0.0", + "node-addon-api": "^4.2.0", + "tar": "^6.1.11" + }, + "optionalDependencies": { + "node-gyp": "8.x" + }, + "peerDependencies": { + "node-gyp": "8.x" + }, + "peerDependenciesMeta": { + "node-gyp": { + "optional": true + } + } + }, + "node_modules/ssri": { + "version": "8.0.1", + "resolved": "https://registry.npmjs.org/ssri/-/ssri-8.0.1.tgz", + "integrity": "sha512-97qShzy1AiyxvPNIkLWoGua7xoQzzPjQ0HAH4B0rWKo7SZ6USuPcrUiAFrws0UH8RrbWmgq3LMTObhPIHbbBeQ==", + "optional": true, + "dependencies": { + "minipass": "^3.1.1" + }, + "engines": { + "node": ">= 8" + } + }, + "node_modules/string_decoder": { + "version": "1.3.0", + "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz", + "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==", + "dependencies": { + "safe-buffer": "~5.2.0" + } + }, + "node_modules/string-width": { + "version": "4.2.3", + "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz", + "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==", + "dependencies": { + "emoji-regex": "^8.0.0", + "is-fullwidth-code-point": "^3.0.0", + "strip-ansi": "^6.0.1" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/strip-ansi": { + "version": "6.0.1", + "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz", + "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==", + "dependencies": { + "ansi-regex": "^5.0.1" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/tar": { + "version": "6.1.15", + "resolved": "https://registry.npmjs.org/tar/-/tar-6.1.15.tgz", + "integrity": "sha512-/zKt9UyngnxIT/EAGYuxaMYgOIJiP81ab9ZfkILq4oNLPFX50qyYmu7jRj9qeXoxmJHjGlbH0+cm2uy1WCs10A==", + "dependencies": { + "chownr": "^2.0.0", + "fs-minipass": "^2.0.0", + "minipass": "^5.0.0", + "minizlib": "^2.1.1", + "mkdirp": "^1.0.3", + "yallist": "^4.0.0" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/tar/node_modules/minipass": { + "version": "5.0.0", + "resolved": "https://registry.npmjs.org/minipass/-/minipass-5.0.0.tgz", + "integrity": "sha512-3FnjYuehv9k6ovOEbyOswadCDPX1piCfhV8ncmYtHOjuPwylVWsghTLo7rabjC3Rx5xD4HDx8Wm1xnMF7S5qFQ==", + "engines": { + "node": ">=8" + } + }, + "node_modules/tr46": { + "version": "0.0.3", + "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz", + "integrity": "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==" + }, + "node_modules/unique-filename": { + "version": "1.1.1", + "resolved": "https://registry.npmjs.org/unique-filename/-/unique-filename-1.1.1.tgz", + "integrity": "sha512-Vmp0jIp2ln35UTXuryvjzkjGdRyf9b2lTXuSYUiPmzRcl3FDtYqAwOnTJkAngD9SWhnoJzDbTKwaOrZ+STtxNQ==", + "optional": true, + "dependencies": { + "unique-slug": "^2.0.0" + } + }, + "node_modules/unique-slug": { + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/unique-slug/-/unique-slug-2.0.2.tgz", + "integrity": "sha512-zoWr9ObaxALD3DOPfjPSqxt4fnZiWblxHIgeWqW8x7UqDzEtHEQLzji2cuJYQFCU6KmoJikOYAZlrTHHebjx2w==", + "optional": true, + "dependencies": { + "imurmurhash": "^0.1.4" + } + }, + "node_modules/util-deprecate": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz", + "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==" + }, + "node_modules/webidl-conversions": { + "version": "3.0.1", + "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz", + "integrity": "sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==" + }, + "node_modules/whatwg-url": { + "version": "5.0.0", + "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz", + "integrity": "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==", + "dependencies": { + "tr46": "~0.0.3", + "webidl-conversions": "^3.0.0" + } + }, + "node_modules/which": { + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz", + "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==", + "optional": true, + "dependencies": { + "isexe": "^2.0.0" + }, + "bin": { + "node-which": "bin/node-which" + }, + "engines": { + "node": ">= 8" + } + }, + "node_modules/wide-align": { + "version": "1.1.5", + "resolved": "https://registry.npmjs.org/wide-align/-/wide-align-1.1.5.tgz", + "integrity": "sha512-eDMORYaPNZ4sQIuuYPDHdQvf4gyCF9rEEV/yPxGfwPkRodwEgiMUUXTx/dex+Me0wxx53S+NgUHaP7y3MGlDmg==", + "dependencies": { + "string-width": "^1.0.2 || 2 || 3 || 4" + } + }, + "node_modules/wrappy": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz", + "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==" + }, + "node_modules/yallist": { + "version": "4.0.0", + "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz", + "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==" + } + } +} diff --git a/scanners/amass/parser/package.json b/scanners/amass/parser/package.json new file mode 100644 index 0000000000..9c48601b9f --- /dev/null +++ b/scanners/amass/parser/package.json @@ -0,0 +1,16 @@ +{ + "name": "@securecodebox/parser-amass", + "version": "1.0.0", + "description": "Parses result files for the type: 'amass-sqlite'", + "main": "", + "scripts": {}, + "keywords": [], + "author": "iteratec GmbH", + "license": "Apache-2.0", + "dependencies": { + "sqlite3": "^5.1.6" + }, + "devDependencies": {} + } + + From e37e3d9b33486f143ca8d3e5916b9473afdbf7b5 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Fri, 18 Aug 2023 14:46:05 +0200 Subject: [PATCH 04/33] #1833 Modified Amass Parser Dockerfile to include copying installed dependencies This is done because sqlite3 package is now required Signed-off-by: Ilyes Ben Dlala --- scanners/amass/parser/Dockerfile | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/scanners/amass/parser/Dockerfile b/scanners/amass/parser/Dockerfile index 86543ec4f1..270c577afa 100644 --- a/scanners/amass/parser/Dockerfile +++ b/scanners/amass/parser/Dockerfile @@ -4,6 +4,13 @@ ARG namespace ARG baseImageTag +FROM node:18-alpine as build +RUN mkdir -p /home/app +WORKDIR /home/app +COPY package.json package-lock.json ./ +RUN npm ci --production + FROM ${namespace:-securecodebox}/parser-sdk-nodejs:${baseImageTag:-latest} WORKDIR /home/app/parser-wrapper/parser/ +COPY --from=build --chown=app:app /home/app/node_modules/ ./node_modules/ COPY --chown=app:app ./parser.js ./parser.js From 9718172e223c8ada8f2609c68b1828a05b1bb5bb Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Fri, 18 Aug 2023 14:48:50 +0200 Subject: [PATCH 05/33] #1833 Added Dockerfile to build custom amass scanner image Signed-off-by: Ilyes Ben Dlala --- scanners/amass/scanner/Dockerfile | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 scanners/amass/scanner/Dockerfile diff --git a/scanners/amass/scanner/Dockerfile b/scanners/amass/scanner/Dockerfile new file mode 100644 index 0000000000..166e755812 --- /dev/null +++ b/scanners/amass/scanner/Dockerfile @@ -0,0 +1,29 @@ +# SPDX-FileCopyrightText: the secureCodeBox authors +# +# SPDX-License-Identifier: Apache-2.0 + +# Base Image +FROM alpine:3.18 as base +ARG scannerVersion + +RUN apk add --no-cache wget unzip \ + && wget https://github.com/owasp-amass/amass/releases/download/${scannerVersion}/amass_Linux_i386.zip \ + && unzip amass_Linux_i386.zip && rm amass_Linux_i386.zip + +# Runtime Image +FROM alpine:latest as runtime +RUN apk --no-cache add ca-certificates pax-utils +COPY --from=base amass_Linux_i386/amass /bin/amass +ENV HOME / +RUN addgroup amass \ + && adduser amass -D -G amass \ + && mkdir /.config \ + && mkdir /.config/amass \ + && chown -R amass:amass /.config + +RUN mkdir /home/securecodebox/ && chown -R amass:amass /home/securecodebox/ + +USER amass +ENTRYPOINT ["/bin/amass"] + + From e903511401144957b555e753a26a48048a62ed07 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Fri, 18 Aug 2023 14:49:03 +0200 Subject: [PATCH 06/33] #1833 Added custom_scanner flag to amass makefile This triggers building custom scanner image in ./scanner/Dockerfile Signed-off-by: Ilyes Ben Dlala --- scanners/amass/Makefile | 1 + 1 file changed, 1 insertion(+) diff --git a/scanners/amass/Makefile b/scanners/amass/Makefile index 28323bca14..c9cc98bb7f 100644 --- a/scanners/amass/Makefile +++ b/scanners/amass/Makefile @@ -7,5 +7,6 @@ include_guard = set scanner = amass +custom_scanner = set include ../../scanners.mk From f8803d3e91944346ac44e4d1b0285ceb13481697 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Fri, 18 Aug 2023 14:51:43 +0200 Subject: [PATCH 07/33] #1833 Updated amass version to v4.1.0 Signed-off-by: Ilyes Ben Dlala --- scanners/amass/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scanners/amass/Chart.yaml b/scanners/amass/Chart.yaml index 14e4a6f8ad..a50cf6beb1 100644 --- a/scanners/amass/Chart.yaml +++ b/scanners/amass/Chart.yaml @@ -8,7 +8,7 @@ description: A Helm chart for the Amass security scanner that integrates with th type: application # version - gets automatically set to the secureCodeBox release version when the helm charts gets published version: v3.1.0-alpha1 -appVersion: "v3.23.3" +appVersion: "v4.1.0" kubeVersion: ">=v1.11.0-0" annotations: versionApi: https://api.github.com/repos/OWASP/Amass/releases/latest From 56fc3fa93a78c72b28913ad85aa00e3666de07f3 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Fri, 18 Aug 2023 14:51:52 +0200 Subject: [PATCH 08/33] #1833 changed amass scanner docker image to use our own custom image Signed-off-by: Ilyes Ben Dlala --- scanners/amass/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scanners/amass/values.yaml b/scanners/amass/values.yaml index 164f6322be..a6e7e7d594 100644 --- a/scanners/amass/values.yaml +++ b/scanners/amass/values.yaml @@ -36,7 +36,7 @@ parser: scanner: image: # scanner.image.repository -- Container Image to run the scan - repository: caffix/amass + repository: docker.io/securecodebox/scanner-amass # scanner.image.tag -- defaults to the charts appVersion tag: null # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images From 94409412f77d76f3e062007919349abf4240dd6c Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Fri, 18 Aug 2023 14:52:36 +0200 Subject: [PATCH 09/33] #1833 Upgraded amass scantype template to use amass.sqlite results file Signed-off-by: Ilyes Ben Dlala --- scanners/amass/templates/amass-scan-type.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/scanners/amass/templates/amass-scan-type.yaml b/scanners/amass/templates/amass-scan-type.yaml index 13300b78af..2176453589 100644 --- a/scanners/amass/templates/amass-scan-type.yaml +++ b/scanners/amass/templates/amass-scan-type.yaml @@ -9,7 +9,7 @@ metadata: spec: extractResults: type: amass-jsonl - location: "/home/securecodebox/amass-results.jsonl" + location: "/home/securecodebox/amass.sqlite" jobTemplate: spec: suspend: {{ .Values.scanner.suspend | default false }} @@ -40,8 +40,8 @@ spec: command: - "amass" - "enum" - - "-json" - - "/home/securecodebox/amass-results.jsonl" + - "-dir" + - "/home/securecodebox/" resources: {{- toYaml .Values.scanner.resources | nindent 16 }} securityContext: From 580d732645dc26a927f871f5694df5ee409b0a5e Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Fri, 18 Aug 2023 14:54:41 +0200 Subject: [PATCH 10/33] #1833 Added amass to custom scanner release build matrix Signed-off-by: Ilyes Ben Dlala --- .github/workflows/release-build.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/release-build.yaml b/.github/workflows/release-build.yaml index 984cde01e5..3786e556e5 100644 --- a/.github/workflows/release-build.yaml +++ b/.github/workflows/release-build.yaml @@ -491,6 +491,7 @@ jobs: strategy: matrix: scanner: + - amass - git-repo-scanner - screenshooter - test-scan From 20baa8b83c1d02a788231aa314b2a022d67a1a4e Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Fri, 18 Aug 2023 14:55:32 +0200 Subject: [PATCH 11/33] #1833 Updated amass integration test to no longer use `-noalts` It is replaced with -alts to enable (instead of disabling) generation of altered names. ref: https://github.com/owasp-amass/amass/blob/master/doc/user_guide.md#the-enum-subcommand Signed-off-by: Ilyes Ben Dlala --- scanners/amass/integration-tests/amass.test.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scanners/amass/integration-tests/amass.test.js b/scanners/amass/integration-tests/amass.test.js index 0e769ca0af..6ad4d2c15f 100644 --- a/scanners/amass/integration-tests/amass.test.js +++ b/scanners/amass/integration-tests/amass.test.js @@ -11,7 +11,7 @@ test( const { count } = await scan( "amass-scanner-dummy-scan", "amass", - ["-passive", "-noalts", "-norecursive", "-d", "owasp.org"], + ["-passive", "-norecursive", "-d", "owasp.org"], 180 ); expect(count).toBeGreaterThanOrEqual(20); From ae5319ba721e31a831d861fc2de7cc06882b1328 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Fri, 25 Aug 2023 09:36:05 +0200 Subject: [PATCH 12/33] #1833 Allow `identified_at` attribute to be null It is not always available and is not required Signed-off-by: Ilyes Ben Dlala --- parser-sdk/nodejs/findings-schema.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/parser-sdk/nodejs/findings-schema.json b/parser-sdk/nodejs/findings-schema.json index 6b98e15c91..27860b6237 100644 --- a/parser-sdk/nodejs/findings-schema.json +++ b/parser-sdk/nodejs/findings-schema.json @@ -18,7 +18,8 @@ "identified_at": { "description": "Date-Time when the Finding was exactly identified according to ISO8601. This information will often not be present.", "type": "string", - "format": "date-time" + "format": "date-time", + "nullable": true }, "parsed_at": { "description": "Date-Time when the Finding was parsed according to ISO8601. This information will always be present.", From e21d01678d4a7c5f1d9370333c1c6a5b55a8cb09 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Fri, 25 Aug 2023 09:38:38 +0200 Subject: [PATCH 13/33] #1833 Optimized Amass Scanner Dockerfile Less Run commands and no usage of `latest` Signed-off-by: Ilyes Ben Dlala --- scanners/amass/scanner/Dockerfile | 24 +++++++++++------------- 1 file changed, 11 insertions(+), 13 deletions(-) diff --git a/scanners/amass/scanner/Dockerfile b/scanners/amass/scanner/Dockerfile index 166e755812..e3095f2f21 100644 --- a/scanners/amass/scanner/Dockerfile +++ b/scanners/amass/scanner/Dockerfile @@ -8,22 +8,20 @@ ARG scannerVersion RUN apk add --no-cache wget unzip \ && wget https://github.com/owasp-amass/amass/releases/download/${scannerVersion}/amass_Linux_i386.zip \ - && unzip amass_Linux_i386.zip && rm amass_Linux_i386.zip + && unzip amass_Linux_i386.zip \ + && rm amass_Linux_i386.zip # Runtime Image -FROM alpine:latest as runtime -RUN apk --no-cache add ca-certificates pax-utils -COPY --from=base amass_Linux_i386/amass /bin/amass -ENV HOME / -RUN addgroup amass \ +FROM alpine:3.18 as runtime + +RUN apk --no-cache add ca-certificates pax-utils \ + && addgroup amass \ && adduser amass -D -G amass \ - && mkdir /.config \ - && mkdir /.config/amass \ - && chown -R amass:amass /.config - -RUN mkdir /home/securecodebox/ && chown -R amass:amass /home/securecodebox/ + && mkdir -p /.config/amass /home/securecodebox/ \ + && chown -R amass:amass /.config /home/securecodebox/ + +COPY --from=base amass_Linux_i386/amass /bin/amass +ENV HOME=/ USER amass ENTRYPOINT ["/bin/amass"] - - From def10dcb90d23c21dbf0a650d38b59131dbe87c1 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Fri, 25 Aug 2023 11:18:35 +0200 Subject: [PATCH 14/33] #1833 Renamed and added volume mount to amass parse definition This is done since the parser requires creating a temp file and reading from it. But the parser environemnt is ready only by default Signed-off-by: Ilyes Ben Dlala --- scanners/amass/templates/amass-parse-definition.yaml | 8 +++++++- scanners/amass/templates/amass-scan-type.yaml | 2 +- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/scanners/amass/templates/amass-parse-definition.yaml b/scanners/amass/templates/amass-parse-definition.yaml index c9315f0a0c..d877984933 100644 --- a/scanners/amass/templates/amass-parse-definition.yaml +++ b/scanners/amass/templates/amass-parse-definition.yaml @@ -5,7 +5,7 @@ apiVersion: "execution.securecodebox.io/v1" kind: ParseDefinition metadata: - name: "amass-jsonl" + name: "amass-sqlite" spec: image: "{{ .Values.parser.image.repository }}:{{ .Values.parser.image.tag | default .Chart.Version }}" imagePullPolicy: {{ .Values.parser.image.pullPolicy }} @@ -26,3 +26,9 @@ spec: resources: {{- toYaml . | nindent 4 }} {{- end }} + volumes: + - name: temp-storage + emptyDir: {} # This will create an empty directory as volume. + volumeMounts: + - name: temp-storage + mountPath: /tmp/ # Mounting to /tmp in the container. Overrides the read-only /tmp diff --git a/scanners/amass/templates/amass-scan-type.yaml b/scanners/amass/templates/amass-scan-type.yaml index 2176453589..e4d0fe46cf 100644 --- a/scanners/amass/templates/amass-scan-type.yaml +++ b/scanners/amass/templates/amass-scan-type.yaml @@ -8,7 +8,7 @@ metadata: name: "amass{{ .Values.scanner.nameAppend | default ""}}" spec: extractResults: - type: amass-jsonl + type: amass-sqlite location: "/home/securecodebox/amass.sqlite" jobTemplate: spec: From 49cadd62f65cafc932e6fb469fde4f4a97f11421 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Fri, 25 Aug 2023 11:20:07 +0200 Subject: [PATCH 15/33] #1833 Changed the openDatabase() function to expect the content of a database instead of the path This is what the lurker expects. A temp file is created to the reading of the database easier Signed-off-by: Ilyes Ben Dlala --- scanners/amass/parser/parser.js | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/scanners/amass/parser/parser.js b/scanners/amass/parser/parser.js index f6b1fa8e89..3ac28e496c 100644 --- a/scanners/amass/parser/parser.js +++ b/scanners/amass/parser/parser.js @@ -3,7 +3,9 @@ // SPDX-License-Identifier: Apache-2.0 const sqlite3 = require('sqlite3').verbose(); - +const fs = require('fs'); +const path = require('path'); +const os = require('os'); async function checkifTableExists(db){ const query = `select count(*) from sqlite_master m where m.name="assets" OR m.name="relations"` @@ -20,10 +22,13 @@ async function checkifTableExists(db){ } -async function openDatabase(databasePath) { - +async function openDatabase(fileContent) { + const tempFilePath = path.join(os.tmpdir(), 'temp-sqlite' + '.sqlite'); + // Write the content to a temporary file + await fs.promises.writeFile(tempFilePath, fileContent); + return new Promise((resolve, reject) => { - const db = new sqlite3.Database(databasePath, sqlite3.OPEN_READONLY, (err) => { + const db = new sqlite3.Database(tempFilePath, sqlite3.OPEN_READONLY, (err) => { if (err) { reject(err.message); return; @@ -33,8 +38,8 @@ async function openDatabase(databasePath) { }); } -async function parse(databasePath) { - const db = await openDatabase(databasePath); +async function parse(fileContent) { + const db = await openDatabase(fileContent); const tableExists = await checkifTableExists(db); if(!tableExists) return []; From d887b76cff7c5cf575e27dea70108272b562029c Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Fri, 25 Aug 2023 11:22:20 +0200 Subject: [PATCH 16/33] #1833 Updated amass parser test and snapshot to fit the change to expect filecontent instead of path of database Signed-off-by: Ilyes Ben Dlala --- .../parser/__snapshots__/parser.test.js.snap | 16 ++++----- .../parser/__testFiles__/emptyTables.sqlite | Bin 20480 -> 20480 bytes scanners/amass/parser/parser.test.js | 31 +++++++++++------- 3 files changed, 27 insertions(+), 20 deletions(-) diff --git a/scanners/amass/parser/__snapshots__/parser.test.js.snap b/scanners/amass/parser/__snapshots__/parser.test.js.snap index 8aa0b7654a..bb0cc2dc51 100644 --- a/scanners/amass/parser/__snapshots__/parser.test.js.snap +++ b/scanners/amass/parser/__snapshots__/parser.test.js.snap @@ -16,7 +16,7 @@ exports[`parser parses example.com sqlite results database successfully 1`] = ` }, "category": "Subdomain", "description": "Found subdomain example.com", - "identified_at": "2023-08-18T12:23:59.131Z", + "identified_at": null, "location": "example.com", "name": "example.com", "osi_layer": "NETWORK", @@ -36,7 +36,7 @@ exports[`parser parses example.com sqlite results database successfully 1`] = ` }, "category": "Subdomain", "description": "Found subdomain www.example.com", - "identified_at": "2023-08-18T12:23:59.131Z", + "identified_at": null, "location": "www.example.com", "name": "www.example.com", "osi_layer": "NETWORK", @@ -56,7 +56,7 @@ exports[`parser parses example.com sqlite results database successfully 1`] = ` }, "category": "Subdomain", "description": "Found subdomain example.com", - "identified_at": "2023-08-18T12:23:59.131Z", + "identified_at": null, "location": "example.com", "name": "example.com", "osi_layer": "NETWORK", @@ -76,7 +76,7 @@ exports[`parser parses example.com sqlite results database successfully 1`] = ` }, "category": "Subdomain", "description": "Found subdomain www.example.com", - "identified_at": "2023-08-18T12:23:59.131Z", + "identified_at": null, "location": "www.example.com", "name": "www.example.com", "osi_layer": "NETWORK", @@ -96,7 +96,7 @@ exports[`parser parses example.com sqlite results database successfully 1`] = ` }, "category": "Subdomain", "description": "Found subdomain a.iana-servers.net", - "identified_at": "2023-08-18T12:23:59.131Z", + "identified_at": null, "location": "a.iana-servers.net", "name": "a.iana-servers.net", "osi_layer": "NETWORK", @@ -116,7 +116,7 @@ exports[`parser parses example.com sqlite results database successfully 1`] = ` }, "category": "Subdomain", "description": "Found subdomain a.iana-servers.net", - "identified_at": "2023-08-18T12:23:59.131Z", + "identified_at": null, "location": "a.iana-servers.net", "name": "a.iana-servers.net", "osi_layer": "NETWORK", @@ -136,7 +136,7 @@ exports[`parser parses example.com sqlite results database successfully 1`] = ` }, "category": "Subdomain", "description": "Found subdomain b.iana-servers.net", - "identified_at": "2023-08-18T12:23:59.131Z", + "identified_at": null, "location": "b.iana-servers.net", "name": "b.iana-servers.net", "osi_layer": "NETWORK", @@ -156,7 +156,7 @@ exports[`parser parses example.com sqlite results database successfully 1`] = ` }, "category": "Subdomain", "description": "Found subdomain b.iana-servers.net", - "identified_at": "2023-08-18T12:23:59.131Z", + "identified_at": null, "location": "b.iana-servers.net", "name": "b.iana-servers.net", "osi_layer": "NETWORK", diff --git a/scanners/amass/parser/__testFiles__/emptyTables.sqlite b/scanners/amass/parser/__testFiles__/emptyTables.sqlite index 702de013aaf9c1493e5fc8f73e774d76fbd8ca4d..60f5523246b2a74c9401c47204ac8219f746104b 100644 GIT binary patch delta 122 zcmZozz}T>Wae}lUBLf2iD-go~^F$qEQAP&6WJX^89}Fx!HyHSJ`FHZg^W4}hD3HRl oc^Pj9n8QDDLJS)hNVmXdL4|o>E-yYV06-BOKL7v# literal 20480 zcmeI3&u`mg7{{F^ZJKUfx*w$~sN^NPv}%*u?`tQH5fWMImS}C-CD~w_z;Y9}vz9oW z?QSa-hXRwha031T4jj0E#EJX3!jXSq9JnA39N@;|q)D6j&1yJI484h(I)3~7`aEB| zd0#t~8|$WPpq-Z8)LlflDJ~S^-b9GwxI6GO3P0V4w;k!ef#0E1+ru{RaB1!3$w`rm zoZsQ%srdKjcP76Y_Qz~LBftnS0*nA7zz8q`i~u9R2>c%i99<7bXJ%(ZAKrKM?S`Q{ zj^R3;*GQqP=Bp~I=C7@*sIzZ=0>Q(qqhhJ5uBm0TRW5Gi%eT>W_4ZPGtY#a!Yt%KE zv#fx1wYZ_86?HX#bG?cRH_K(URMotlm1=%tt7GCG>=~%4zEeH+(6U^^ayxraLw8)w zF$^n!yM_3loIR6Bgg!oOS7RFu-8Ea5)7u#BtEsp9-W-V$&9YitD|y|Y?~As8%Ic~L%`T{wu5`@$0@^Hr7}ix#RUuy~ zh?UAqy=QPTx9Jx8fecpo4S2~?imM5D5>x5HO#iylc)}|cg?1;@W#m4%#FnmXIgdR zk#oNRvv^J4cU$fE+CVf-7}ybpv&y)4W|{O}rZ_JCL;RDt>b+qPMt~7u1Q-EEfDvE> z7y(9r5nu!u0Y-okpc2T3!-WdZ6Ro$@qxBY)(l9s2JSHh#PVqS;WE4SCFi!K?3@_lE zBrWn-;rZ7`!dY;EHN9RBV4TU2tR&~;j&Uv&CSWXRPVKJI)HTyG-Jx-%j3i`ud>nVe zE6AJw{~G@({tdM{wv!QH1Q-EEfDvE>7y(9r5nu!u0Y-okU<95ofke0vdd5OScs87c zamp&f$V*`oqbw10um6v~7xejj3ue(60Y-okU<4QeM&QLG5dD(Oy-QAC01*|q2Eu1b zhP&Np)$Sc8Yi8X}DoG)iON%5e5R&GXv6x&+dUx!?KymAVnEZg^g5#nqB%uv@mlRPh zZsqHB+i;x2BwSGOHu@t-B#{5Hr(}-iU-V^<;j@(@@w_6}6=hkJ``l-I=|hep$BjKE zi5ew+k(z#Ah=BsA5oCyPm0kdTMgcnk3&8O8&?jW}Xp&NaP%f4??cKwqr8nC>EaXe2 zRK9c@Zpf{wE2)ZFzE$+@+D)ONHw3tB(}o*}p-r7_Z-d_S(M@tWMT?oQlpx@KbK3wt z;Y?QGhd8)E(Ij+4@ImQmQVOC;&jox%_FH;Wg)^E8*n>0`s7Fe4)zc%Ks$syt|ETIz z5dMwKQDjLZA0M3IGYXbL_89ZQWJ4s53xCRiZYusB5HL4i)1G8p0OQ>ko(x|??y{w~KhHbvzve31C$F#fyKajK}#Y=4D52~~X?vs`v z!AWXRTE`B)qe_eTkGCA0>SQsEg-kGM5or9#O){OQP~%r`ta#Gz9BU6BK1>^r^yXf} zNY`3T-%$jaf=owZBykk;JHuJJPWw77C|HygLCz5cOEuWaiJ3Fccpl);XH@A933`eV zIqM$+R0V`WgiNndio$(_^t7p4dddO$7`BtP43`4QJC?bpLELQzatCK)?h7(qI5WE- zxp~gsBGb7uojqF!BHx|=Py7ha&x1c-yiX!5V@7}xU<4QeMt~7u1Q>z;DuHuRP9cd< zXz;_Ww``SG~|g8V&i^GoEsn36@pK?5}WXwcIN+7$&;Rj#z*~zSQ&$uRLK+m zR9B*uN};2nSBD_tyIqM=f_l^cU&z&%?=%Fr?`Ka1^~c0nF#Vd$4KY1Fo%lnx?QD{u W+F{E%HjMZHi97_%ooN`R82%07)QrCX diff --git a/scanners/amass/parser/parser.test.js b/scanners/amass/parser/parser.test.js index f1b8289209..e134a0d20a 100644 --- a/scanners/amass/parser/parser.test.js +++ b/scanners/amass/parser/parser.test.js @@ -2,35 +2,42 @@ // // SPDX-License-Identifier: Apache-2.0 -const { - validateParser, -} = require("@securecodebox/parser-sdk-nodejs/parser-utils"); +const fs = require("fs"); +const util = require("util"); +const readFile = util.promisify(fs.readFile); -// eslint-disable-next-line security/detect-non-literal-fs-filename +const { parse } = require("./parser"); const { - parse -} = require("./parser"); + validateParser, +} = require("@securecodebox/parser-sdk-nodejs/parser-utils"); test("parser parses example.com sqlite results database successfully", async () => { - const databasePath = __dirname + "/__testFiles__/example.com.sqlite"; + const fileContent = await readFile( + __dirname + "/__testFiles__/example.com.sqlite" + ); - const findings = await parse(databasePath); + const findings = await parse(fileContent); await expect(validateParser(findings)).resolves.toBeUndefined(); expect(findings).toMatchSnapshot(); }); test("parser parses sqlite results database with empty tables successfully", async () => { - const databasePath = __dirname + "/__testFiles__/emptyTables.sqlite"; - const findings = await parse(databasePath); + const fileContent = await readFile( + __dirname + "/__testFiles__/emptyTables.sqlite" + ); + + const findings = await parse(fileContent); await expect(validateParser(findings)).resolves.toBeUndefined(); expect(findings).toEqual([]); }); test("parser parses sqlite results database with no tables successfully", async () => { - const databasePath = __dirname + "/__testFiles__/noTables.sqlite"; + const fileContent = await readFile( + __dirname + "/__testFiles__/noTables.sqlite", + ); - const findings = await parse(databasePath); + const findings = await parse(fileContent); await expect(validateParser(findings)).resolves.toBeUndefined(); expect(findings).toEqual([]); }); From 8e60035388c4ac2457d83731075ca0de5ef1f56e Mon Sep 17 00:00:00 2001 From: Heiko Kiesel Date: Fri, 25 Aug 2023 15:24:00 +0200 Subject: [PATCH 17/33] Adjust db query to output subdomains even if no relations exist Signed-off-by: Heiko Kiesel --- scanners/amass/parser/parser.js | 48 ++++++++++++++++----------------- 1 file changed, 23 insertions(+), 25 deletions(-) diff --git a/scanners/amass/parser/parser.js b/scanners/amass/parser/parser.js index 3ac28e496c..c8c2be23d1 100644 --- a/scanners/amass/parser/parser.js +++ b/scanners/amass/parser/parser.js @@ -7,7 +7,7 @@ const fs = require('fs'); const path = require('path'); const os = require('os'); -async function checkifTableExists(db){ +async function checkifTableExists(db) { const query = `select count(*) from sqlite_master m where m.name="assets" OR m.name="relations"` return new Promise((resolve, reject) => { @@ -41,43 +41,41 @@ async function openDatabase(fileContent) { async function parse(fileContent) { const db = await openDatabase(fileContent); const tableExists = await checkifTableExists(db); - if(!tableExists) return []; + if (!tableExists) return []; return new Promise((resolve, reject) => { const query = ` WITH relation_chain AS ( - SELECT - fqdn.content AS subdomain, - ips.content AS ip, - cidr.content AS cidr, - asn.id AS asn_id, - asn.content AS asn + SELECT + fqdn.content AS subdomain, + ips.content AS ip, + cidr.content AS cidr, + asn.id AS asn_id, + asn.content AS asn FROM assets fqdn - - JOIN relations r1 ON fqdn.id = r1.from_asset_id AND (r1.type = 'a_record' OR r1.type = 'aaaa_record') - JOIN assets ips ON r1.to_asset_id = ips.id - - JOIN relations r2 ON ips.id = r2.to_asset_id AND r2.type = 'contains' - JOIN assets cidr ON r2.from_asset_id = cidr.id - - JOIN relations r3 ON cidr.id = r3.to_asset_id AND r3.type = 'announces' - JOIN assets asn ON r3.from_asset_id = asn.id - - WHERE fqdn.type = 'FQDN' - ) - SELECT + LEFT JOIN relations r1 ON fqdn.id = r1.from_asset_id AND (r1.type = 'a_record' OR r1.type = 'aaaa_record') + LEFT JOIN assets ips ON r1.to_asset_id = ips.id + + LEFT JOIN relations r2 ON ips.id = r2.to_asset_id AND r2.type = 'contains' + LEFT JOIN assets cidr ON r2.from_asset_id = cidr.id + + LEFT JOIN relations r3 ON cidr.id = r3.to_asset_id AND r3.type = 'announces' + LEFT JOIN assets asn ON r3.from_asset_id = asn.id + + WHERE fqdn.type = 'FQDN' + ) + SELECT rc.subdomain, rc.ip, rc.cidr, rc.asn, a.content AS managed_by, (SELECT content FROM assets WHERE id = 1) AS domain - - FROM relation_chain rc - JOIN relations r ON rc.asn_id = r.from_asset_id AND r.type = 'managed_by' - JOIN assets a ON r.to_asset_id = a.id;`; + FROM relation_chain rc + LEFT JOIN relations r ON rc.asn_id = r.from_asset_id AND r.type = 'managed_by' + LEFT JOIN assets a ON r.to_asset_id = a.id;`; db.all(query, [], (err, rows) => { if (err) { From 3f867bc1a87e303e3182565329991031aa1462b7 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Fri, 25 Aug 2023 16:48:51 +0200 Subject: [PATCH 18/33] #1833 Added check for empty collumn in the sql query for amass parser Signed-off-by: Ilyes Ben Dlala --- scanners/amass/parser/parser.js | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/scanners/amass/parser/parser.js b/scanners/amass/parser/parser.js index c8c2be23d1..81838c3d1b 100644 --- a/scanners/amass/parser/parser.js +++ b/scanners/amass/parser/parser.js @@ -102,14 +102,14 @@ async function parse(fileContent) { severity: "INFORMATIONAL", attributes: { addresses: { - ip: ipObj.address, - cidr: cidrObj.cidr, - asn: asnObj.number, - desc: managedByObj.name + ip: ipObj?.address || null, + cidr: cidrObj?.cidr || null, + asn: asnObj?.number || null, + desc: managedByObj?.name || null }, - domain: domainObj.name, - hostname: subdomainObj.name, - ip_addresses: ipObj.address, + domain: domainObj?.name || null, + hostname: subdomainObj?.name || null, + ip_addresses: ipObj?.address || null, }, }; }); From 70e70ea7d43543263bbe0fb54bdadd3850918768 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Fri, 25 Aug 2023 16:53:07 +0200 Subject: [PATCH 19/33] #1833 Updated amass parser tests and included a new test new test, tests for when -passive arg is used Signed-off-by: Ilyes Ben Dlala --- .../parser/__snapshots__/parser.test.js.snap | 1471 ++++++++++++++++- .../amass/parser/__testFiles__/passive.sqlite | Bin 0 -> 28672 bytes .../__testFiles__/passive.sqlite.license | 3 + scanners/amass/parser/parser.test.js | 10 + 4 files changed, 1441 insertions(+), 43 deletions(-) create mode 100644 scanners/amass/parser/__testFiles__/passive.sqlite create mode 100644 scanners/amass/parser/__testFiles__/passive.sqlite.license diff --git a/scanners/amass/parser/__snapshots__/parser.test.js.snap b/scanners/amass/parser/__snapshots__/parser.test.js.snap index bb0cc2dc51..9b0df8f15f 100644 --- a/scanners/amass/parser/__snapshots__/parser.test.js.snap +++ b/scanners/amass/parser/__snapshots__/parser.test.js.snap @@ -26,59 +26,79 @@ exports[`parser parses example.com sqlite results database successfully 1`] = ` "attributes": { "addresses": { "asn": 15133, - "cidr": "93.184.216.0/24", + "cidr": "2606:2800:220::/48", "desc": "EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business", - "ip": "93.184.216.34", + "ip": "2606:2800:220:1:248:1893:25c8:1946", }, "domain": "example.com", - "hostname": "www.example.com", - "ip_addresses": "93.184.216.34", + "hostname": "example.com", + "ip_addresses": "2606:2800:220:1:248:1893:25c8:1946", }, "category": "Subdomain", - "description": "Found subdomain www.example.com", + "description": "Found subdomain example.com", "identified_at": null, - "location": "www.example.com", - "name": "www.example.com", + "location": "example.com", + "name": "example.com", "osi_layer": "NETWORK", "severity": "INFORMATIONAL", }, { "attributes": { "addresses": { - "asn": 15133, - "cidr": "2606:2800:220::/48", - "desc": "EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business", - "ip": "2606:2800:220:1:248:1893:25c8:1946", + "asn": null, + "cidr": null, + "desc": null, + "ip": null, }, "domain": "example.com", - "hostname": "example.com", - "ip_addresses": "2606:2800:220:1:248:1893:25c8:1946", + "hostname": "iana-servers.net", + "ip_addresses": null, }, "category": "Subdomain", - "description": "Found subdomain example.com", + "description": "Found subdomain iana-servers.net", "identified_at": null, - "location": "example.com", - "name": "example.com", + "location": "iana-servers.net", + "name": "iana-servers.net", "osi_layer": "NETWORK", "severity": "INFORMATIONAL", }, { "attributes": { "addresses": { - "asn": 15133, - "cidr": "2606:2800:220::/48", - "desc": "EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business", - "ip": "2606:2800:220:1:248:1893:25c8:1946", + "asn": 26710, + "cidr": "199.43.133.0/24", + "desc": "ICANN-ANYCASTED-SERVICES - ICANN", + "ip": "199.43.133.53", }, "domain": "example.com", - "hostname": "www.example.com", - "ip_addresses": "2606:2800:220:1:248:1893:25c8:1946", + "hostname": "b.iana-servers.net", + "ip_addresses": "199.43.133.53", }, "category": "Subdomain", - "description": "Found subdomain www.example.com", + "description": "Found subdomain b.iana-servers.net", "identified_at": null, - "location": "www.example.com", - "name": "www.example.com", + "location": "b.iana-servers.net", + "name": "b.iana-servers.net", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": 26710, + "cidr": "2001:500:8d::/48", + "desc": "ICANN-ANYCASTED-SERVICES - ICANN", + "ip": "2001:500:8d::53", + }, + "domain": "example.com", + "hostname": "b.iana-servers.net", + "ip_addresses": "2001:500:8d::53", + }, + "category": "Subdomain", + "description": "Found subdomain b.iana-servers.net", + "identified_at": null, + "location": "b.iana-servers.net", + "name": "b.iana-servers.net", "osi_layer": "NETWORK", "severity": "INFORMATIONAL", }, @@ -125,40 +145,1405 @@ exports[`parser parses example.com sqlite results database successfully 1`] = ` { "attributes": { "addresses": { - "asn": 26710, - "cidr": "2001:500:8d::/48", - "desc": "ICANN-ANYCASTED-SERVICES - ICANN", - "ip": "2001:500:8d::53", + "asn": 15133, + "cidr": "93.184.216.0/24", + "desc": "EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business", + "ip": "93.184.216.34", }, "domain": "example.com", - "hostname": "b.iana-servers.net", - "ip_addresses": "2001:500:8d::53", + "hostname": "www.example.com", + "ip_addresses": "93.184.216.34", }, "category": "Subdomain", - "description": "Found subdomain b.iana-servers.net", + "description": "Found subdomain www.example.com", "identified_at": null, - "location": "b.iana-servers.net", - "name": "b.iana-servers.net", + "location": "www.example.com", + "name": "www.example.com", "osi_layer": "NETWORK", "severity": "INFORMATIONAL", }, { "attributes": { "addresses": { - "asn": 26710, - "cidr": "199.43.133.0/24", - "desc": "ICANN-ANYCASTED-SERVICES - ICANN", - "ip": "199.43.133.53", + "asn": 15133, + "cidr": "2606:2800:220::/48", + "desc": "EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business", + "ip": "2606:2800:220:1:248:1893:25c8:1946", }, "domain": "example.com", - "hostname": "b.iana-servers.net", - "ip_addresses": "199.43.133.53", + "hostname": "www.example.com", + "ip_addresses": "2606:2800:220:1:248:1893:25c8:1946", }, "category": "Subdomain", - "description": "Found subdomain b.iana-servers.net", + "description": "Found subdomain www.example.com", "identified_at": null, - "location": "b.iana-servers.net", - "name": "b.iana-servers.net", + "location": "www.example.com", + "name": "www.example.com", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, +] +`; + +exports[`parser parses sqlite results database with empty relations (i.e with -passive arg) successfully 1`] = ` +[ + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain owasp.org", + "identified_at": null, + "location": "owasp.org", + "name": "owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "wiki.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain wiki.owasp.org", + "identified_at": null, + "location": "wiki.owasp.org", + "name": "wiki.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "calltobattle.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain calltobattle.owasp.org", + "identified_at": null, + "location": "calltobattle.owasp.org", + "name": "calltobattle.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "sl.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain sl.owasp.org", + "identified_at": null, + "location": "sl.owasp.org", + "name": "sl.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "kerala.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain kerala.owasp.org", + "identified_at": null, + "location": "kerala.owasp.org", + "name": "kerala.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "www.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain www.owasp.org", + "identified_at": null, + "location": "www.owasp.org", + "name": "www.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "calendar.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain calendar.owasp.org", + "identified_at": null, + "location": "calendar.owasp.org", + "name": "calendar.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "members.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain members.owasp.org", + "identified_at": null, + "location": "members.owasp.org", + "name": "members.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "lightning.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain lightning.owasp.org", + "identified_at": null, + "location": "lightning.owasp.org", + "name": "lightning.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "mail.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain mail.owasp.org", + "identified_at": null, + "location": "mail.owasp.org", + "name": "mail.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "thanniversary.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain thanniversary.owasp.org", + "identified_at": null, + "location": "thanniversary.owasp.org", + "name": "thanniversary.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "cheatsheetseries.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain cheatsheetseries.owasp.org", + "identified_at": null, + "location": "cheatsheetseries.owasp.org", + "name": "cheatsheetseries.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "secureflag.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain secureflag.owasp.org", + "identified_at": null, + "location": "secureflag.owasp.org", + "name": "secureflag.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "videos.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain videos.owasp.org", + "identified_at": null, + "location": "videos.owasp.org", + "name": "videos.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "www2.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain www2.owasp.org", + "identified_at": null, + "location": "www2.owasp.org", + "name": "www2.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "dev.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain dev.owasp.org", + "identified_at": null, + "location": "dev.owasp.org", + "name": "dev.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "contact.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain contact.owasp.org", + "identified_at": null, + "location": "contact.owasp.org", + "name": "contact.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "brainbreak.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain brainbreak.owasp.org", + "identified_at": null, + "location": "brainbreak.owasp.org", + "name": "brainbreak.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "gapps.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain gapps.owasp.org", + "identified_at": null, + "location": "gapps.owasp.org", + "name": "gapps.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "ocms.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain ocms.owasp.org", + "identified_at": null, + "location": "ocms.owasp.org", + "name": "ocms.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "training.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain training.owasp.org", + "identified_at": null, + "location": "training.owasp.org", + "name": "training.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "austin.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain austin.owasp.org", + "identified_at": null, + "location": "austin.owasp.org", + "name": "austin.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "name-virt-host.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain name-virt-host.owasp.org", + "identified_at": null, + "location": "name-virt-host.owasp.org", + "name": "name-virt-host.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "lists.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain lists.owasp.org", + "identified_at": null, + "location": "lists.owasp.org", + "name": "lists.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "devsecops.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain devsecops.owasp.org", + "identified_at": null, + "location": "devsecops.owasp.org", + "name": "devsecops.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "giving.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain giving.owasp.org", + "identified_at": null, + "location": "giving.owasp.org", + "name": "giving.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "dsomm.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain dsomm.owasp.org", + "identified_at": null, + "location": "dsomm.owasp.org", + "name": "dsomm.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "mas.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain mas.owasp.org", + "identified_at": null, + "location": "mas.owasp.org", + "name": "mas.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "securecodingdojo.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain securecodingdojo.owasp.org", + "identified_at": null, + "location": "securecodingdojo.owasp.org", + "name": "securecodingdojo.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "scvs.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain scvs.owasp.org", + "identified_at": null, + "location": "scvs.owasp.org", + "name": "scvs.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "docs.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain docs.owasp.org", + "identified_at": null, + "location": "docs.owasp.org", + "name": "docs.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "groups.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain groups.owasp.org", + "identified_at": null, + "location": "groups.owasp.org", + "name": "groups.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "new-wiki.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain new-wiki.owasp.org", + "identified_at": null, + "location": "new-wiki.owasp.org", + "name": "new-wiki.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "mu.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain mu.owasp.org", + "identified_at": null, + "location": "mu.owasp.org", + "name": "mu.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "www.lists.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain www.lists.owasp.org", + "identified_at": null, + "location": "www.lists.owasp.org", + "name": "www.lists.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "tsd.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain tsd.owasp.org", + "identified_at": null, + "location": "tsd.owasp.org", + "name": "tsd.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "www.ocms.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain www.ocms.owasp.org", + "identified_at": null, + "location": "www.ocms.owasp.org", + "name": "www.ocms.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "cheesemonkey.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain cheesemonkey.owasp.org", + "identified_at": null, + "location": "cheesemonkey.owasp.org", + "name": "cheesemonkey.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "tempcali.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain tempcali.owasp.org", + "identified_at": null, + "location": "tempcali.owasp.org", + "name": "tempcali.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "talk.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain talk.owasp.org", + "identified_at": null, + "location": "talk.owasp.org", + "name": "talk.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "haroldtest.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain haroldtest.owasp.org", + "identified_at": null, + "location": "haroldtest.owasp.org", + "name": "haroldtest.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "update-wiki.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain update-wiki.owasp.org", + "identified_at": null, + "location": "update-wiki.owasp.org", + "name": "update-wiki.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "dsandbox.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain dsandbox.owasp.org", + "identified_at": null, + "location": "dsandbox.owasp.org", + "name": "dsandbox.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "discourse.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain discourse.owasp.org", + "identified_at": null, + "location": "discourse.owasp.org", + "name": "discourse.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "ads.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain ads.owasp.org", + "identified_at": null, + "location": "ads.owasp.org", + "name": "ads.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "5c4171004230818351034.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain 5c4171004230818351034.owasp.org", + "identified_at": null, + "location": "5c4171004230818351034.owasp.org", + "name": "5c4171004230818351034.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "admin.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain admin.owasp.org", + "identified_at": null, + "location": "admin.owasp.org", + "name": "admin.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "ftp.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain ftp.owasp.org", + "identified_at": null, + "location": "ftp.owasp.org", + "name": "ftp.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "forum.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain forum.owasp.org", + "identified_at": null, + "location": "forum.owasp.org", + "name": "forum.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "esvnjfkee.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain esvnjfkee.owasp.org", + "identified_at": null, + "location": "esvnjfkee.owasp.org", + "name": "esvnjfkee.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "wwww.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain wwww.owasp.org", + "identified_at": null, + "location": "wwww.owasp.org", + "name": "wwww.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "www.my.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain www.my.owasp.org", + "identified_at": null, + "location": "www.my.owasp.org", + "name": "www.my.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "ww.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain ww.owasp.org", + "identified_at": null, + "location": "ww.owasp.org", + "name": "ww.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "webmail.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain webmail.owasp.org", + "identified_at": null, + "location": "webmail.owasp.org", + "name": "webmail.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "webgoat.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain webgoat.owasp.org", + "identified_at": null, + "location": "webgoat.owasp.org", + "name": "webgoat.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "stin.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain stin.owasp.org", + "identified_at": null, + "location": "stin.owasp.org", + "name": "stin.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "registration.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain registration.owasp.org", + "identified_at": null, + "location": "registration.owasp.org", + "name": "registration.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "phpsec.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain phpsec.owasp.org", + "identified_at": null, + "location": "phpsec.owasp.org", + "name": "phpsec.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "owasp4.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain owasp4.owasp.org", + "identified_at": null, + "location": "owasp4.owasp.org", + "name": "owasp4.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "old.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain old.owasp.org", + "identified_at": null, + "location": "old.owasp.org", + "name": "old.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "my.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain my.owasp.org", + "identified_at": null, + "location": "my.owasp.org", + "name": "my.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "ml1.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain ml1.owasp.org", + "identified_at": null, + "location": "ml1.owasp.org", + "name": "ml1.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "ml1lists.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain ml1lists.owasp.org", + "identified_at": null, + "location": "ml1lists.owasp.org", + "name": "ml1lists.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "lessons.webgoat.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain lessons.webgoat.owasp.org", + "identified_at": null, + "location": "lessons.webgoat.owasp.org", + "name": "lessons.webgoat.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "jobs.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain jobs.owasp.org", + "identified_at": null, + "location": "jobs.owasp.org", + "name": "jobs.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "es.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain es.owasp.org", + "identified_at": null, + "location": "es.owasp.org", + "name": "es.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "blogs.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain blogs.owasp.org", + "identified_at": null, + "location": "blogs.owasp.org", + "name": "blogs.owasp.org", + "osi_layer": "NETWORK", + "severity": "INFORMATIONAL", + }, + { + "attributes": { + "addresses": { + "asn": null, + "cidr": null, + "desc": null, + "ip": null, + }, + "domain": "owasp.org", + "hostname": "beta.owasp.org", + "ip_addresses": null, + }, + "category": "Subdomain", + "description": "Found subdomain beta.owasp.org", + "identified_at": null, + "location": "beta.owasp.org", + "name": "beta.owasp.org", "osi_layer": "NETWORK", "severity": "INFORMATIONAL", }, diff --git a/scanners/amass/parser/__testFiles__/passive.sqlite b/scanners/amass/parser/__testFiles__/passive.sqlite new file mode 100644 index 0000000000000000000000000000000000000000..7c1ea6187e26e2c4b9606f6cdf5b4167ac58b8a7 GIT binary patch literal 28672 zcmeI4O>E=V5yvG&TzQ1p;$Z~dx7I(u~?k`r0CE61D+@EKcSEC zoOQ%wtF6Z~87Y=bAIGvQ*$>mlnP0O`!uL@DQ~(t~1yBK002M$5Pytln>#V@NN+Pvz z?OOcDuX$?QAgb#U&mI1oEH#v3Q{kG$7pn?4d~I=-qld0><$6=uQ5xLsM!8mO+~F$9 zog0JqIu21iqP6InWs9EOEY}onOW7_SRhwMtsL@dB%@(|P*eup=4^Q##_6XNhUT%It zuq}^R-tZO9P+hO(5@L;kTgv_`<}6&l9{%`0hQak5-Bg{s+!?uhgUhMCo}mwtJ;!M@ z?LFNjOSdMb77mu+Wj?UB$Q5zGn}fw*sHm$_HLZ(Ai`fW|R#5No18+_M_}O z^Z^f402M$5Pyti`6+i`00aO4LKm||%Q~(tir9d%}C>`>=*m`iQr}f~5(kfk>3%nq% z@Ea?F%;lv`VSQ8BSe1EE=GWFFahVr3dH&`^Vx1y{ma1v&lcmCjOrg9mJh>20i1g%q z%k7*HQ*G&%?v46fsUWTu1W}NNr_NHJ6501+*-x^6rVn_a0;m8gfC``jr~oQ}3ZMe0 z04jhApaQ7C|6hUYiBde`MnmFSVx7Jpau;FZYC@a|xkWHZeTrv41J6>~&*uL!|Fik$ zGXKc@BD0@Krr%HBNl(xHZmu`?)a=KzZ_nPG`E=%&GtKFLPk%7onZBC(W9rS+($rt4 zem=E5`OnGUOujmKCHYa(Nj{nQIPrEup7{I3yA##;r}1CKUy0AhejjrO0+z+8nE2T9 z;#cpA2yjTl#M)g-yi+yy;W?F-fIt=djE_oI;CuM2=GGf~7nw@#1G2x0K{ z^1v%Hd33u(-(;|Md0^dQvpniwq?dcoj%SssnYzVby|M}{^|DpsnooSWBjwlgJTD0% zzmeY%Xo~&OwgYb!^QeFfQ1bLKTIR% zE)|ZIAN=08MmQ=Ie34)eD4}q;0Ib8yQ4O%*E6K{a?szLFHe>D;3YDuP)C)k>zUwhA z*g~Q97{Ed+TqsI=_E3Wiv|0=SUD6~Ni7X;LWcJqoChgbSd$w0|`^d41a+O?_opS4#nnJ(tjLam3P8hk@Ij0vvl(u-0*O#+(EaJC)CfqZ%s1teqslLcSyg zV&JlZd5{25$T!shh{|Pnc3bs4BYGi1hyMg1*{Q}{G6;pOIH2T^k+9*r431n|(#80c z2>t(b(?1@l04jhApaQ4>Du4>00;m8gfC``jr~oSP4ORfw{~|5SXMdZuvrl0CAMUAy z+|mxTCSd*layJIn|JOGI1!AoKU+UQrC9MC`R;NIsVErGq#toXlM6CZ0b?_I*vHpKQ zKd}Bk94LVz6xRQT`)db-2kZY|>7&K^Kcirb_5Z+Jg7tscqhI)j*Z-m8UWWDm!?T~n zvL9qm>H7aq^KZ@bnZIS;%~Ugq^oQxw^p&|k%)L1$(O6+i`00aO4LKm||%Q~(wD z`Y2G|8qs+x`8OxFi5J~qEXjMNQB|S<%CNi9E!mR1^CGZ9nw0})F&g6~xm+C2zf-%- zvZ?t3ppGtg76)uHi0jfnd%t=?+Fe_X-a{eDwda8v(tIAEnns?zb4QYQe+amc=JU(A z$mKr`!7U)MLtsYlBcLWdH=ap!2Pea%%1t1J^uq_78}xQZZ_AbB%I0{m-bs({?qFDU zPykp+Pkg{Khji(F#^GPaXCTWPfDGx04DKv9XAv!4TcuHhX3 literal 0 HcmV?d00001 diff --git a/scanners/amass/parser/__testFiles__/passive.sqlite.license b/scanners/amass/parser/__testFiles__/passive.sqlite.license new file mode 100644 index 0000000000..c95bc37185 --- /dev/null +++ b/scanners/amass/parser/__testFiles__/passive.sqlite.license @@ -0,0 +1,3 @@ +SPDX-FileCopyrightText: the secureCodeBox authors + +SPDX-License-Identifier: Apache-2.0 diff --git a/scanners/amass/parser/parser.test.js b/scanners/amass/parser/parser.test.js index e134a0d20a..f6997b7946 100644 --- a/scanners/amass/parser/parser.test.js +++ b/scanners/amass/parser/parser.test.js @@ -41,3 +41,13 @@ test("parser parses sqlite results database with no tables successfully", async await expect(validateParser(findings)).resolves.toBeUndefined(); expect(findings).toEqual([]); }); + +test("parser parses sqlite results database with empty relations (i.e with -passive arg) successfully", async () => { + const fileContent = await readFile( + __dirname + "/__testFiles__/passive.sqlite", + ); + + const findings = await parse(fileContent); + await expect(validateParser(findings)).resolves.toBeUndefined(); + expect(findings).toMatchSnapshot(); +}); From 419d8c19d3183d7dbf2436d975ddbc37c9605c8c Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Fri, 25 Aug 2023 16:54:15 +0200 Subject: [PATCH 20/33] #1833 Added a check in parser-wrapper.js to parse according to the scanType Amass parser requires that the database remains in binary format Signed-off-by: Ilyes Ben Dlala --- parser-sdk/nodejs/parser-wrapper.js | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/parser-sdk/nodejs/parser-wrapper.js b/parser-sdk/nodejs/parser-wrapper.js index d868059d0c..04c951558c 100644 --- a/parser-sdk/nodejs/parser-wrapper.js +++ b/parser-sdk/nodejs/parser-wrapper.js @@ -119,12 +119,18 @@ async function main() { const resultUploadUrl = process.argv[3]; console.log("Fetching result file"); - const { data } = await axios.get(resultFileUrl); + let response; + if(scan.spec.scanType === "amass"){ + response = await axios.get(resultFileUrl, {responseType: 'arraybuffer'}); + } else { + response = await axios.get(resultFileUrl); + } + console.log("Fetched result file"); let findings = []; try { - findings = await parse(data, scan); + findings = await parse(response.data, scan); } catch (error) { console.error("Parser failed with error:"); console.error(error); From 2d196993a579f9dbe157be79bee350784387c19e Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Fri, 1 Sep 2023 09:57:32 +0200 Subject: [PATCH 21/33] #1833 DRAFT Added EncodingType Attribute to ParseDefinition CRD Signed-off-by: Ilyes Ben Dlala --- .../execution/v1/parsedefinition_types.go | 18 + ...urecodebox.io_clusterparsedefinitions.yaml | 9 + ...ion.securecodebox.io_parsedefinitions.yaml | 9 + .../execution/scans/parse_reconciler.go | 5 + ...urecodebox.io_clusterparsedefinitions.yaml | 5470 ++++++++--------- ...ion.securecodebox.io_parsedefinitions.yaml | 5467 ++++++++-------- parser-sdk/nodejs/parser-wrapper.js | 25 +- .../templates/amass-parse-definition.yaml | 2 + 8 files changed, 5170 insertions(+), 5835 deletions(-) diff --git a/operator/apis/execution/v1/parsedefinition_types.go b/operator/apis/execution/v1/parsedefinition_types.go index 8f1fee64dd..1c7a54dd11 100644 --- a/operator/apis/execution/v1/parsedefinition_types.go +++ b/operator/apis/execution/v1/parsedefinition_types.go @@ -30,6 +30,13 @@ type ParseDefinitionSpec struct { // +nullable TTLSecondsAfterFinished *int32 `json:"ttlSecondsAfterFinished,omitempty"` + // EncodingType specifies the encoding type of the scan result + // Valid values are: + // - "Text" (default): the scan result is a text file + // - "Binary": the scan result is a binary file + //+kubebuilder:default=Text + EncodingType EncodingType `json:"encodingType,omitempty"` + // Env allows to specify environment vars for the parser container. Env []corev1.EnvVar `json:"env,omitempty"` // Volumes allows to specify volumes for the parser container. @@ -53,6 +60,17 @@ type ParseDefinitionStatus struct { // Important: Run "make" to regenerate code after modifying this file } +// EncodingType specifies the encoding type of the scan result +// +kubebuilder:validation:Enum=Text;Binary +type EncodingType string + +const ( + // Text is the default encoding type and will be used if no encoding type is specified + Text EncodingType = "Text" + // Binary is used for binary scan results + Binary EncodingType = "Binary" +) + // +kubebuilder:object:root=true // +kubebuilder:printcolumn:name="Image",type=string,JSONPath=`.spec.image`,description="Scanner Container Image" diff --git a/operator/config/crd/bases/execution.securecodebox.io_clusterparsedefinitions.yaml b/operator/config/crd/bases/execution.securecodebox.io_clusterparsedefinitions.yaml index e32948234a..0643e00dac 100644 --- a/operator/config/crd/bases/execution.securecodebox.io_clusterparsedefinitions.yaml +++ b/operator/config/crd/bases/execution.securecodebox.io_clusterparsedefinitions.yaml @@ -870,6 +870,15 @@ spec: type: array type: object type: object + encodingType: + default: Text + description: 'EncodingType specifies the encoding type of the scan + result Valid values are: - "Text" (default): the scan result is + a text file - "Binary": the scan result is a binary file' + enum: + - Text + - Binary + type: string env: description: Env allows to specify environment vars for the parser container. diff --git a/operator/config/crd/bases/execution.securecodebox.io_parsedefinitions.yaml b/operator/config/crd/bases/execution.securecodebox.io_parsedefinitions.yaml index f327eb64fb..c250c3674a 100644 --- a/operator/config/crd/bases/execution.securecodebox.io_parsedefinitions.yaml +++ b/operator/config/crd/bases/execution.securecodebox.io_parsedefinitions.yaml @@ -869,6 +869,15 @@ spec: type: array type: object type: object + encodingType: + default: Text + description: 'EncodingType specifies the encoding type of the scan + result Valid values are: - "Text" (default): the scan result is + a text file - "Binary": the scan result is a binary file' + enum: + - Text + - Binary + type: string env: description: Env allows to specify environment vars for the parser container. diff --git a/operator/controllers/execution/scans/parse_reconciler.go b/operator/controllers/execution/scans/parse_reconciler.go index 8b7c4ff242..08d05ce650 100644 --- a/operator/controllers/execution/scans/parse_reconciler.go +++ b/operator/controllers/execution/scans/parse_reconciler.go @@ -100,6 +100,11 @@ func (r *ScanReconciler) startParser(scan *executionv1.Scan) error { Resources: []string{"scans/status"}, Verbs: []string{"get", "patch"}, }, + { + APIGroups: []string{"execution.securecodebox.io"}, + Resources: []string{"parsedefinitions"}, + Verbs: []string{"get"}, + }, } r.ensureServiceAccountExists( scan.Namespace, diff --git a/operator/crds/execution.securecodebox.io_clusterparsedefinitions.yaml b/operator/crds/execution.securecodebox.io_clusterparsedefinitions.yaml index 7795004509..ed933fc50b 100644 --- a/operator/crds/execution.securecodebox.io_clusterparsedefinitions.yaml +++ b/operator/crds/execution.securecodebox.io_clusterparsedefinitions.yaml @@ -1,7 +1,3 @@ -# SPDX-FileCopyrightText: the secureCodeBox authors -# -# SPDX-License-Identifier: Apache-2.0 - --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -19,3003 +15,2641 @@ spec: singular: clusterparsedefinition scope: Cluster versions: - - additionalPrinterColumns: - - description: Scanner Container Image - jsonPath: .spec.image - name: Image - type: string - name: v1 - schema: - openAPIV3Schema: - description: - ClusterParseDefinition is the Schema for the clusterparsedefinitions - API - properties: - apiVersion: - description: - "APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources" - type: string - kind: - description: - "Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" - type: string - metadata: - type: object - spec: - description: ParseDefinitionSpec defines the desired state of ParseDefinition - properties: - affinity: - description: - "Affinity allows to specify a node affinity, to control - on which nodes you want a parser to run. See: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/" - properties: - nodeAffinity: - description: - Describes node affinity scheduling rules for the - pod. - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: - The scheduler will prefer to schedule pods to - nodes that satisfy the affinity expressions specified by - this field, but it may choose a node that violates one or - more of the expressions. The node that is most preferred - is the one with the greatest sum of weights, i.e. for each - node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, - etc.), compute a sum by iterating through the elements of - this field and adding "weight" to the sum if the node matches - the corresponding matchExpressions; the node(s) with the - highest sum are the most preferred. - items: - description: - An empty preferred scheduling term matches - all objects with implicit weight 0 (i.e. it's a no-op). - A null preferred scheduling term matches no objects (i.e. - is also a no-op). - properties: - preference: - description: - A node selector term, associated with the - corresponding weight. - properties: - matchExpressions: - description: - A list of node selector requirements - by node's labels. - items: - description: - A node selector requirement is a - selector that contains values, a key, and an - operator that relates the key and values. - properties: - key: - description: - The label key that the selector - applies to. + - additionalPrinterColumns: + - description: Scanner Container Image + jsonPath: .spec.image + name: Image + type: string + name: v1 + schema: + openAPIV3Schema: + description: ClusterParseDefinition is the Schema for the clusterparsedefinitions + API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ParseDefinitionSpec defines the desired state of ParseDefinition + properties: + affinity: + description: 'Affinity allows to specify a node affinity, to control + on which nodes you want a parser to run. See: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/' + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the + pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to + nodes that satisfy the affinity expressions specified by + this field, but it may choose a node that violates one or + more of the expressions. The node that is most preferred + is the one with the greatest sum of weights, i.e. for each + node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, + etc.), compute a sum by iterating through the elements of + this field and adding "weight" to the sum if the node matches + the corresponding matchExpressions; the node(s) with the + highest sum are the most preferred. + items: + description: An empty preferred scheduling term matches + all objects with implicit weight 0 (i.e. it's a no-op). + A null preferred scheduling term matches no objects (i.e. + is also a no-op). + properties: + preference: + description: A node selector term, associated with the + corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: A node selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. + type: string + values: + description: An array of string values. If + the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values array + must be empty. If the operator is Gt or + Lt, the values array must have a single + element, which will be interpreted as an + integer. This array is replaced during a + strategic merge patch. + items: type: string - operator: - description: - Represents a key's relationship - to a set of values. Valid operators are - In, NotIn, Exists, DoesNotExist. Gt, and - Lt. + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: A node selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. + type: string + values: + description: An array of string values. If + the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values array + must be empty. If the operator is Gt or + Lt, the values array must have a single + element, which will be interpreted as an + integer. This array is replaced during a + strategic merge patch. + items: type: string - values: - description: - An array of string values. If - the operator is In or NotIn, the values - array must be non-empty. If the operator - is Exists or DoesNotExist, the values array - must be empty. If the operator is Gt or - Lt, the values array must have a single - element, which will be interpreted as an - integer. This array is replaced during a - strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchFields: - description: - A list of node selector requirements - by node's fields. - items: - description: - A node selector requirement is a - selector that contains values, a key, and an - operator that relates the key and values. - properties: - key: - description: - The label key that the selector - applies to. + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the corresponding + nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this + field are not met at scheduling time, the pod will not be + scheduled onto the node. If the affinity requirements specified + by this field cease to be met at some point during pod execution + (e.g. due to an update), the system may or may not try to + eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. + items: + description: A null or empty node selector term matches + no objects. The requirements of them are ANDed. The + TopologySelectorTerm type implements a subset of the + NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: A node selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. + type: string + values: + description: An array of string values. If + the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values array + must be empty. If the operator is Gt or + Lt, the values array must have a single + element, which will be interpreted as an + integer. This array is replaced during a + strategic merge patch. + items: type: string - operator: - description: - Represents a key's relationship - to a set of values. Valid operators are - In, NotIn, Exists, DoesNotExist. Gt, and - Lt. + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: A node selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. + type: string + values: + description: An array of string values. If + the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values array + must be empty. If the operator is Gt or + Lt, the values array must have a single + element, which will be interpreted as an + integer. This array is replaced during a + strategic merge patch. + items: type: string - values: - description: - An array of string values. If - the operator is In or NotIn, the values - array must be non-empty. If the operator - is Exists or DoesNotExist, the values array - must be empty. If the operator is Gt or - Lt, the values array must have a single - element, which will be interpreted as an - integer. This array is replaced during a - strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - type: object - x-kubernetes-map-type: atomic - weight: - description: - Weight associated with matching the corresponding - nodeSelectorTerm, in the range 1-100. - format: int32 - type: integer - required: - - preference - - weight - type: object - type: array - requiredDuringSchedulingIgnoredDuringExecution: - description: - If the affinity requirements specified by this - field are not met at scheduling time, the pod will not be - scheduled onto the node. If the affinity requirements specified - by this field cease to be met at some point during pod execution - (e.g. due to an update), the system may or may not try to - eventually evict the pod from its node. + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate + this pod in the same node, zone, etc. as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to + nodes that satisfy the affinity expressions specified by + this field, but it may choose a node that violates one or + more of the expressions. The node that is most preferred + is the one with the greatest sum of weights, i.e. for each + node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, + etc.), compute a sum by iterating through the elements of + this field and adding "weight" to the sum if the node has + pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred node(s) properties: - nodeSelectorTerms: - description: - Required. A list of node selector terms. - The terms are ORed. - items: - description: - A null or empty node selector term matches - no objects. The requirements of them are ANDed. The - TopologySelectorTerm type implements a subset of the - NodeSelectorTerm. - properties: - matchExpressions: - description: - A list of node selector requirements - by node's labels. - items: - description: - A node selector requirement is a - selector that contains values, a key, and an - operator that relates the key and values. - properties: - key: - description: - The label key that the selector - applies to. - type: string - operator: - description: - Represents a key's relationship - to a set of values. Valid operators are - In, NotIn, Exists, DoesNotExist. Gt, and - Lt. - type: string - values: - description: - An array of string values. If - the operator is In or NotIn, the values - array must be non-empty. If the operator - is Exists or DoesNotExist, the values array - must be empty. If the operator is Gt or - Lt, the values array must have a single - element, which will be interpreted as an - integer. This array is replaced during a - strategic merge patch. - items: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: A label query over a set of resources, + in this case pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: A label selector requirement + is a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: key is the label key that + the selector applies to. type: string - type: array - required: + operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: - key - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only "value". + The requirements are ANDed. type: object - type: array - matchFields: - description: - A list of node selector requirements - by node's fields. - items: - description: - A node selector requirement is a - selector that contains values, a key, and an - operator that relates the key and values. - properties: - key: - description: - The label key that the selector - applies to. - type: string - operator: - description: - Represents a key's relationship - to a set of values. Valid operators are - In, NotIn, Exists, DoesNotExist. Gt, and - Lt. - type: string - values: - description: - An array of string values. If - the operator is In or NotIn, the values - array must be non-empty. If the operator - is Exists or DoesNotExist, the values array - must be empty. If the operator is Gt or - Lt, the values array must have a single - element, which will be interpreted as an - integer. This array is replaced during a - strategic merge patch. - items: + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + description: A label query over the set of namespaces + that the term applies to. The term is applied + to the union of the namespaces selected by this + field and the ones listed in the namespaces field. + null selector and null or empty namespaces list + means "this pod's namespace". An empty selector + ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: A label selector requirement + is a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: key is the label key that + the selector applies to. type: string - type: array - required: + operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: - key - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only "value". + The requirements are ANDed. type: object - type: array - type: object - x-kubernetes-map-type: atomic - type: array + type: object + x-kubernetes-map-type: atomic + namespaces: + description: namespaces specifies a static list + of namespace names that the term applies to. The + term is applied to the union of the namespaces + listed in this field and the ones selected by + namespaceSelector. null or empty namespaces list + and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods + matching the labelSelector in the specified namespaces, + where co-located is defined as running on a node + whose value of the label with key topologyKey + matches that of any node on which any of the selected + pods is running. Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: weight associated with matching the corresponding + podAffinityTerm, in the range 1-100. + format: int32 + type: integer required: - - nodeSelectorTerms + - podAffinityTerm + - weight type: object - x-kubernetes-map-type: atomic - type: object - podAffinity: - description: - Describes pod affinity scheduling rules (e.g. co-locate - this pod in the same node, zone, etc. as some other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: - The scheduler will prefer to schedule pods to - nodes that satisfy the affinity expressions specified by - this field, but it may choose a node that violates one or - more of the expressions. The node that is most preferred - is the one with the greatest sum of weights, i.e. for each - node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, - etc.), compute a sum by iterating through the elements of - this field and adding "weight" to the sum if the node has - pods which matches the corresponding podAffinityTerm; the - node(s) with the highest sum are the most preferred. - items: - description: - The weights of all of the matched WeightedPodAffinityTerm - fields are added per-node to find the most preferred node(s) - properties: - podAffinityTerm: - description: - Required. A pod affinity term, associated - with the corresponding weight. - properties: - labelSelector: - description: - A label query over a set of resources, - in this case pods. + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this + field are not met at scheduling time, the pod will not be + scheduled onto the node. If the affinity requirements specified + by this field cease to be met at some point during pod execution + (e.g. due to a pod label update), the system may or may + not try to eventually evict the pod from its node. When + there are multiple elements, the lists of nodes corresponding + to each podAffinityTerm are intersected, i.e. all terms + must be satisfied. + items: + description: Defines a set of pods (namely those matching + the labelSelector relative to the given namespace(s)) + that this pod should be co-located (affinity) or not co-located + (anti-affinity) with, where co-located is defined as running + on a node whose value of the label with key + matches that of any node on which a pod of the set of + pods is running + properties: + labelSelector: + description: A label query over a set of resources, + in this case pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are ANDed. + items: + description: A label selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. properties: - matchExpressions: - description: - matchExpressions is a list of label - selector requirements. The requirements are - ANDed. + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: operator represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. If the + operator is Exists or DoesNotExist, the + values array must be empty. This array is + replaced during a strategic merge patch. items: - description: - A label selector requirement - is a selector that contains values, a key, - and an operator that relates the key and - values. - properties: - key: - description: - key is the label key that - the selector applies to. - type: string - operator: - description: - operator represents a key's - relationship to a set of values. Valid - operators are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: - values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. - If the operator is Exists or DoesNotExist, - the values array must be empty. This - array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: type: string - description: - matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is - "In", and the values array contains only "value". - The requirements are ANDed. - type: object + type: array + required: + - key + - operator type: object - x-kubernetes-map-type: atomic - namespaceSelector: - description: - A label query over the set of namespaces - that the term applies to. The term is applied - to the union of the namespaces selected by this - field and the ones listed in the namespaces field. - null selector and null or empty namespaces list - means "this pod's namespace". An empty selector - ({}) matches all namespaces. + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is "In", + and the values array contains only "value". The + requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + description: A label query over the set of namespaces + that the term applies to. The term is applied to the + union of the namespaces selected by this field and + the ones listed in the namespaces field. null selector + and null or empty namespaces list means "this pod's + namespace". An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are ANDed. + items: + description: A label selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. properties: - matchExpressions: - description: - matchExpressions is a list of label - selector requirements. The requirements are - ANDed. + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: operator represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. If the + operator is Exists or DoesNotExist, the + values array must be empty. This array is + replaced during a strategic merge patch. items: - description: - A label selector requirement - is a selector that contains values, a key, - and an operator that relates the key and - values. - properties: - key: - description: - key is the label key that - the selector applies to. - type: string - operator: - description: - operator represents a key's - relationship to a set of values. Valid - operators are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: - values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. - If the operator is Exists or DoesNotExist, - the values array must be empty. This - array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: type: string - description: - matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is - "In", and the values array contains only "value". - The requirements are ANDed. - type: object + type: array + required: + - key + - operator type: object - x-kubernetes-map-type: atomic - namespaces: - description: - namespaces specifies a static list - of namespace names that the term applies to. The - term is applied to the union of the namespaces - listed in this field and the ones selected by - namespaceSelector. null or empty namespaces list - and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - topologyKey: - description: - This pod should be co-located (affinity) - or not co-located (anti-affinity) with the pods - matching the labelSelector in the specified namespaces, - where co-located is defined as running on a node - whose value of the label with key topologyKey - matches that of any node on which any of the selected - pods is running. Empty topologyKey is not allowed. + type: array + matchLabels: + additionalProperties: type: string - required: - - topologyKey - type: object - weight: - description: - weight associated with matching the corresponding - podAffinityTerm, in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - requiredDuringSchedulingIgnoredDuringExecution: - description: - If the affinity requirements specified by this - field are not met at scheduling time, the pod will not be - scheduled onto the node. If the affinity requirements specified - by this field cease to be met at some point during pod execution - (e.g. due to a pod label update), the system may or may - not try to eventually evict the pod from its node. When - there are multiple elements, the lists of nodes corresponding - to each podAffinityTerm are intersected, i.e. all terms - must be satisfied. - items: - description: - Defines a set of pods (namely those matching - the labelSelector relative to the given namespace(s)) - that this pod should be co-located (affinity) or not co-located - (anti-affinity) with, where co-located is defined as running - on a node whose value of the label with key - matches that of any node on which a pod of the set of - pods is running - properties: - labelSelector: - description: - A label query over a set of resources, - in this case pods. - properties: - matchExpressions: - description: - matchExpressions is a list of label - selector requirements. The requirements are ANDed. - items: - description: - A label selector requirement is a - selector that contains values, a key, and an - operator that relates the key and values. - properties: - key: - description: - key is the label key that the - selector applies to. - type: string - operator: - description: - operator represents a key's relationship - to a set of values. Valid operators are - In, NotIn, Exists and DoesNotExist. - type: string - values: - description: - values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. If the - operator is Exists or DoesNotExist, the - values array must be empty. This array is - replaced during a strategic merge patch. - items: + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is "In", + and the values array contains only "value". The + requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: namespaces specifies a static list of namespace + names that the term applies to. The term is applied + to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. null or + empty namespaces list and null namespaceSelector means + "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where + co-located is defined as running on a node whose value + of the label with key topologyKey matches that of + any node on which any of the selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. + avoid putting this pod in the same node, zone, etc. as some + other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to + nodes that satisfy the anti-affinity expressions specified + by this field, but it may choose a node that violates one + or more of the expressions. The node that is most preferred + is the one with the greatest sum of weights, i.e. for each + node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, + etc.), compute a sum by iterating through the elements of + this field and adding "weight" to the sum if the node has + pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: A label query over a set of resources, + in this case pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: A label selector requirement + is a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: key is the label key that + the selector applies to. type: string - type: array - required: + operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: - key - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only "value". + The requirements are ANDed. type: object - type: array - matchLabels: - additionalProperties: - type: string - description: - matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is "In", - and the values array contains only "value". The - requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaceSelector: - description: - A label query over the set of namespaces - that the term applies to. The term is applied to the - union of the namespaces selected by this field and - the ones listed in the namespaces field. null selector - and null or empty namespaces list means "this pod's - namespace". An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: - matchExpressions is a list of label - selector requirements. The requirements are ANDed. - items: - description: - A label selector requirement is a - selector that contains values, a key, and an - operator that relates the key and values. - properties: - key: - description: - key is the label key that the - selector applies to. - type: string - operator: - description: - operator represents a key's relationship - to a set of values. Valid operators are - In, NotIn, Exists and DoesNotExist. - type: string - values: - description: - values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. If the - operator is Exists or DoesNotExist, the - values array must be empty. This array is - replaced during a strategic merge patch. - items: + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + description: A label query over the set of namespaces + that the term applies to. The term is applied + to the union of the namespaces selected by this + field and the ones listed in the namespaces field. + null selector and null or empty namespaces list + means "this pod's namespace". An empty selector + ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: A label selector requirement + is a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: key is the label key that + the selector applies to. type: string - type: array - required: + operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: - key - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only "value". + The requirements are ANDed. type: object - type: array - matchLabels: - additionalProperties: - type: string - description: - matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is "In", - and the values array contains only "value". The - requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: - namespaces specifies a static list of namespace - names that the term applies to. The term is applied - to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. null or - empty namespaces list and null namespaceSelector means - "this pod's namespace". - items: + type: object + x-kubernetes-map-type: atomic + namespaces: + description: namespaces specifies a static list + of namespace names that the term applies to. The + term is applied to the union of the namespaces + listed in this field and the ones selected by + namespaceSelector. null or empty namespaces list + and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods + matching the labelSelector in the specified namespaces, + where co-located is defined as running on a node + whose value of the label with key topologyKey + matches that of any node on which any of the selected + pods is running. Empty topologyKey is not allowed. type: string - type: array - topologyKey: - description: - This pod should be co-located (affinity) - or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where - co-located is defined as running on a node whose value - of the label with key topologyKey matches that of - any node on which any of the selected pods is running. - Empty topologyKey is not allowed. - type: string - required: + required: - topologyKey - type: object - type: array - type: object - podAntiAffinity: - description: - Describes pod anti-affinity scheduling rules (e.g. - avoid putting this pod in the same node, zone, etc. as some - other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: - The scheduler will prefer to schedule pods to - nodes that satisfy the anti-affinity expressions specified - by this field, but it may choose a node that violates one - or more of the expressions. The node that is most preferred - is the one with the greatest sum of weights, i.e. for each - node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling anti-affinity expressions, - etc.), compute a sum by iterating through the elements of - this field and adding "weight" to the sum if the node has - pods which matches the corresponding podAffinityTerm; the - node(s) with the highest sum are the most preferred. - items: - description: - The weights of all of the matched WeightedPodAffinityTerm - fields are added per-node to find the most preferred node(s) - properties: - podAffinityTerm: - description: - Required. A pod affinity term, associated - with the corresponding weight. - properties: - labelSelector: - description: - A label query over a set of resources, - in this case pods. + type: object + weight: + description: weight associated with matching the corresponding + podAffinityTerm, in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: If the anti-affinity requirements specified by + this field are not met at scheduling time, the pod will + not be scheduled onto the node. If the anti-affinity requirements + specified by this field cease to be met at some point during + pod execution (e.g. due to a pod label update), the system + may or may not try to eventually evict the pod from its + node. When there are multiple elements, the lists of nodes + corresponding to each podAffinityTerm are intersected, i.e. + all terms must be satisfied. + items: + description: Defines a set of pods (namely those matching + the labelSelector relative to the given namespace(s)) + that this pod should be co-located (affinity) or not co-located + (anti-affinity) with, where co-located is defined as running + on a node whose value of the label with key + matches that of any node on which a pod of the set of + pods is running + properties: + labelSelector: + description: A label query over a set of resources, + in this case pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are ANDed. + items: + description: A label selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. properties: - matchExpressions: - description: - matchExpressions is a list of label - selector requirements. The requirements are - ANDed. + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: operator represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. If the + operator is Exists or DoesNotExist, the + values array must be empty. This array is + replaced during a strategic merge patch. items: - description: - A label selector requirement - is a selector that contains values, a key, - and an operator that relates the key and - values. - properties: - key: - description: - key is the label key that - the selector applies to. - type: string - operator: - description: - operator represents a key's - relationship to a set of values. Valid - operators are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: - values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. - If the operator is Exists or DoesNotExist, - the values array must be empty. This - array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: type: string - description: - matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is - "In", and the values array contains only "value". - The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaceSelector: - description: - A label query over the set of namespaces - that the term applies to. The term is applied - to the union of the namespaces selected by this - field and the ones listed in the namespaces field. - null selector and null or empty namespaces list - means "this pod's namespace". An empty selector - ({}) matches all namespaces. + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is "In", + and the values array contains only "value". The + requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + description: A label query over the set of namespaces + that the term applies to. The term is applied to the + union of the namespaces selected by this field and + the ones listed in the namespaces field. null selector + and null or empty namespaces list means "this pod's + namespace". An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are ANDed. + items: + description: A label selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. properties: - matchExpressions: - description: - matchExpressions is a list of label - selector requirements. The requirements are - ANDed. + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: operator represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. If the + operator is Exists or DoesNotExist, the + values array must be empty. This array is + replaced during a strategic merge patch. items: - description: - A label selector requirement - is a selector that contains values, a key, - and an operator that relates the key and - values. - properties: - key: - description: - key is the label key that - the selector applies to. - type: string - operator: - description: - operator represents a key's - relationship to a set of values. Valid - operators are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: - values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. - If the operator is Exists or DoesNotExist, - the values array must be empty. This - array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: type: string - description: - matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is - "In", and the values array contains only "value". - The requirements are ANDed. - type: object + type: array + required: + - key + - operator type: object - x-kubernetes-map-type: atomic - namespaces: - description: - namespaces specifies a static list - of namespace names that the term applies to. The - term is applied to the union of the namespaces - listed in this field and the ones selected by - namespaceSelector. null or empty namespaces list - and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - topologyKey: - description: - This pod should be co-located (affinity) - or not co-located (anti-affinity) with the pods - matching the labelSelector in the specified namespaces, - where co-located is defined as running on a node - whose value of the label with key topologyKey - matches that of any node on which any of the selected - pods is running. Empty topologyKey is not allowed. + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is "In", + and the values array contains only "value". The + requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: namespaces specifies a static list of namespace + names that the term applies to. The term is applied + to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. null or + empty namespaces list and null namespaceSelector means + "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where + co-located is defined as running on a node whose value + of the label with key topologyKey matches that of + any node on which any of the selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + encodingType: + description: 'EncodingType specifies the encoding type of the scan + result Valid values are: - "Text" (default): the scan result is + a text file - "Binary": the scan result is a binary file' + type: string + env: + description: Env allows to specify environment vars for the parser + container. + items: + description: EnvVar represents an environment variable present in + a Container. + properties: + name: + description: Name of the environment variable. Must be a C_IDENTIFIER. + type: string + value: + description: 'Variable references $(VAR_NAME) are expanded using + the previously defined environment variables in the container + and any service environment variables. If a variable cannot + be resolved, the reference in the input string will be unchanged. + Double $$ are reduced to a single $, which allows for escaping + the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the + string literal "$(VAR_NAME)". Escaped references will never + be expanded, regardless of whether the variable exists or + not. Defaults to "".' + type: string + valueFrom: + description: Source for the environment variable's value. Cannot + be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: 'Selects a field of the pod: supports metadata.name, + metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, + status.podIP, status.podIPs.' + properties: + apiVersion: + description: Version of the schema the FieldPath is + written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the specified + API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: 'Selects a resource of the container: only + resources limits and requests (limits.cpu, limits.memory, + limits.ephemeral-storage, requests.cpu, requests.memory + and requests.ephemeral-storage) are currently supported.' + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of the exposed + resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's namespace + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + image: + description: Image is the reference to the parser container image + which ca transform the raw scan report into findings + type: string + imagePullPolicy: + description: 'Image pull policy. One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent + otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images' + type: string + imagePullSecrets: + description: ImagePullSecrets used to access private parser images + items: + description: LocalObjectReference contains enough information to + let you locate the referenced object inside the same namespace. + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + type: array + resources: + default: + limits: + cpu: 400m + memory: 200Mi + requests: + cpu: 200m + memory: 100Mi + description: Resources lets you control resource limits and requests + for the parser container. See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount of compute resources + allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount of compute + resources required. If Requests is omitted for a container, + it defaults to Limits if that is explicitly specified, otherwise + to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + type: object + type: object + scopeLimiterAliases: + additionalProperties: + type: string + type: object + tolerations: + description: Tolerations are a different way to control on which nodes + your parser is executed. See https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ + items: + description: The pod this Toleration is attached to tolerates any + taint that matches the triple using the matching + operator . + properties: + effect: + description: Effect indicates the taint effect to match. Empty + means match all taint effects. When specified, allowed values + are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: Key is the taint key that the toleration applies + to. Empty means match all taint keys. If the key is empty, + operator must be Exists; this combination means to match all + values and all keys. + type: string + operator: + description: Operator represents a key's relationship to the + value. Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod + can tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: TolerationSeconds represents the period of time + the toleration (which must be of effect NoExecute, otherwise + this field is ignored) tolerates the taint. By default, it + is not set, which means tolerate the taint forever (do not + evict). Zero and negative values will be treated as 0 (evict + immediately) by the system. + format: int64 + type: integer + value: + description: Value is the taint value the toleration matches + to. If the operator is Exists, the value should be empty, + otherwise just a regular string. + type: string + type: object + type: array + ttlSecondsAfterFinished: + description: TTLSecondsAfterFinished configures the ttlSecondsAfterFinished + field for the created parse job + format: int32 + nullable: true + type: integer + volumeMounts: + description: VolumeMounts allows to specify volume mounts for the + parser container. + items: + description: VolumeMount describes a mounting of a Volume within + a container. + properties: + mountPath: + description: Path within the container at which the volume should + be mounted. Must not contain ':'. + type: string + mountPropagation: + description: mountPropagation determines how mounts are propagated + from the host to container and the other way around. When + not set, MountPropagationNone is used. This field is beta + in 1.10. + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: Mounted read-only if true, read-write otherwise + (false or unspecified). Defaults to false. + type: boolean + subPath: + description: Path within the volume from which the container's + volume should be mounted. Defaults to "" (volume's root). + type: string + subPathExpr: + description: Expanded path within the volume from which the + container's volume should be mounted. Behaves similarly to + SubPath but environment variable references $(VAR_NAME) are + expanded using the container's environment. Defaults to "" + (volume's root). SubPathExpr and SubPath are mutually exclusive. + type: string + required: + - mountPath + - name + type: object + type: array + volumes: + description: Volumes allows to specify volumes for the parser container. + items: + description: Volume represents a named volume in a pod that may + be accessed by any container in the pod. + properties: + awsElasticBlockStore: + description: 'awsElasticBlockStore represents an AWS Disk resource + that is attached to a kubelet''s host machine and then exposed + to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' + properties: + fsType: + description: 'fsType is the filesystem type of the volume + that you want to mount. Tip: Ensure that the filesystem + type is supported by the host operating system. Examples: + "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + TODO: how do we prevent errors in the filesystem from + compromising the machine' + type: string + partition: + description: 'partition is the partition in the volume that + you want to mount. If omitted, the default is to mount + by volume name. Examples: For volume /dev/sda1, you specify + the partition as "1". Similarly, the volume partition + for /dev/sda is "0" (or you can leave the property empty).' + format: int32 + type: integer + readOnly: + description: 'readOnly value true will force the readOnly + setting in VolumeMounts. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' + type: boolean + volumeID: + description: 'volumeID is unique ID of the persistent disk + resource in AWS (Amazon EBS volume). More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' + type: string + required: + - volumeID + type: object + azureDisk: + description: azureDisk represents an Azure Data Disk mount on + the host and bind mount to the pod. + properties: + cachingMode: + description: 'cachingMode is the Host Caching mode: None, + Read Only, Read Write.' + type: string + diskName: + description: diskName is the Name of the data disk in the + blob storage + type: string + diskURI: + description: diskURI is the URI of data disk in the blob + storage + type: string + fsType: + description: fsType is Filesystem type to mount. Must be + a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. + type: string + kind: + description: 'kind expected values are Shared: multiple + blob disks per storage account Dedicated: single blob + disk per storage account Managed: azure managed data + disk (only in managed availability set). defaults to shared' + type: string + readOnly: + description: readOnly Defaults to false (read/write). ReadOnly + here will force the ReadOnly setting in VolumeMounts. + type: boolean + required: + - diskName + - diskURI + type: object + azureFile: + description: azureFile represents an Azure File Service mount + on the host and bind mount to the pod. + properties: + readOnly: + description: readOnly defaults to false (read/write). ReadOnly + here will force the ReadOnly setting in VolumeMounts. + type: boolean + secretName: + description: secretName is the name of secret that contains + Azure Storage Account Name and Key + type: string + shareName: + description: shareName is the azure share Name + type: string + required: + - secretName + - shareName + type: object + cephfs: + description: cephFS represents a Ceph FS mount on the host that + shares a pod's lifetime + properties: + monitors: + description: 'monitors is Required: Monitors is a collection + of Ceph monitors More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' + items: + type: string + type: array + path: + description: 'path is Optional: Used as the mounted root, + rather than the full Ceph tree, default is /' + type: string + readOnly: + description: 'readOnly is Optional: Defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in VolumeMounts. + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' + type: boolean + secretFile: + description: 'secretFile is Optional: SecretFile is the + path to key ring for User, default is /etc/ceph/user.secret + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' + type: string + secretRef: + description: 'secretRef is Optional: SecretRef is reference + to the authentication secret for User, default is empty. + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + user: + description: 'user is optional: User is the rados user name, + default is admin More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' + type: string + required: + - monitors + type: object + cinder: + description: 'cinder represents a cinder volume attached and + mounted on kubelets host machine. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' + properties: + fsType: + description: 'fsType is the filesystem type to mount. Must + be a filesystem type supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to + be "ext4" if unspecified. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' + type: string + readOnly: + description: 'readOnly defaults to false (read/write). ReadOnly + here will force the ReadOnly setting in VolumeMounts. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md' + type: boolean + secretRef: + description: 'secretRef is optional: points to a secret + object containing parameters used to connect to OpenStack.' + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + volumeID: + description: 'volumeID used to identify the volume in cinder. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md' + type: string + required: + - volumeID + type: object + configMap: + description: configMap represents a configMap that should populate + this volume + properties: + defaultMode: + description: 'defaultMode is optional: mode bits used to + set permissions on created files by default. Must be an + octal value between 0000 and 0777 or a decimal value between + 0 and 511. YAML accepts both octal and decimal values, + JSON requires decimal values for mode bits. Defaults to + 0644. Directories within the path are not affected by + this setting. This might be in conflict with other options + that affect the file mode, like fsGroup, and the result + can be other mode bits set.' + format: int32 + type: integer + items: + description: items if unspecified, each key-value pair in + the Data field of the referenced ConfigMap will be projected + into the volume as a file whose name is the key and content + is the value. If specified, the listed keys will be projected + into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in + the ConfigMap, the volume setup will error unless it is + marked optional. Paths must be relative and may not contain + the '..' path or start with '..'. + items: + description: Maps a string key to a path within a volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: 'mode is Optional: mode bits used to + set permissions on this file. Must be an octal value + between 0000 and 0777 or a decimal value between + 0 and 511. YAML accepts both octal and decimal values, + JSON requires decimal values for mode bits. If not + specified, the volume defaultMode will be used. + This might be in conflict with other options that + affect the file mode, like fsGroup, and the result + can be other mode bits set.' + format: int32 + type: integer + path: + description: path is the relative path of the file + to map the key to. May not be an absolute path. + May not contain the path element '..'. May not start + with the string '..'. + type: string + required: + - key + - path + type: object + type: array + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: optional specify whether the ConfigMap or its + keys must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + csi: + description: csi (Container Storage Interface) represents ephemeral + storage that is handled by certain external CSI drivers (Beta + feature). + properties: + driver: + description: driver is the name of the CSI driver that handles + this volume. Consult with your admin for the correct name + as registered in the cluster. + type: string + fsType: + description: fsType to mount. Ex. "ext4", "xfs", "ntfs". + If not provided, the empty value is passed to the associated + CSI driver which will determine the default filesystem + to apply. + type: string + nodePublishSecretRef: + description: nodePublishSecretRef is a reference to the + secret object containing sensitive information to pass + to the CSI driver to complete the CSI NodePublishVolume + and NodeUnpublishVolume calls. This field is optional, + and may be empty if no secret is required. If the secret + object contains more than one secret, all secret references + are passed. + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + readOnly: + description: readOnly specifies a read-only configuration + for the volume. Defaults to false (read/write). + type: boolean + volumeAttributes: + additionalProperties: + type: string + description: volumeAttributes stores driver-specific properties + that are passed to the CSI driver. Consult your driver's + documentation for supported values. + type: object + required: + - driver + type: object + downwardAPI: + description: downwardAPI represents downward API about the pod + that should populate this volume + properties: + defaultMode: + description: 'Optional: mode bits to use on created files + by default. Must be a Optional: mode bits used to set + permissions on created files by default. Must be an octal + value between 0000 and 0777 or a decimal value between + 0 and 511. YAML accepts both octal and decimal values, + JSON requires decimal values for mode bits. Defaults to + 0644. Directories within the path are not affected by + this setting. This might be in conflict with other options + that affect the file mode, like fsGroup, and the result + can be other mode bits set.' + format: int32 + type: integer + items: + description: Items is a list of downward API volume file + items: + description: DownwardAPIVolumeFile represents information + to create the file containing the pod field + properties: + fieldRef: + description: 'Required: Selects a field of the pod: + only annotations, labels, name and namespace are + supported.' + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. type: string required: - - topologyKey + - fieldPath type: object - weight: - description: - weight associated with matching the corresponding - podAffinityTerm, in the range 1-100. + x-kubernetes-map-type: atomic + mode: + description: 'Optional: mode bits used to set permissions + on this file, must be an octal value between 0000 + and 0777 or a decimal value between 0 and 511. YAML + accepts both octal and decimal values, JSON requires + decimal values for mode bits. If not specified, + the volume defaultMode will be used. This might + be in conflict with other options that affect the + file mode, like fsGroup, and the result can be other + mode bits set.' format: int32 type: integer + path: + description: 'Required: Path is the relative path + name of the file to be created. Must not be absolute + or contain the ''..'' path. Must be utf-8 encoded. + The first item of the relative path must not start + with ''..''' + type: string + resourceFieldRef: + description: 'Selects a resource of the container: + only resources limits and requests (limits.cpu, + limits.memory, requests.cpu and requests.memory) + are currently supported.' + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic required: - - podAffinityTerm - - weight + - path type: object type: array - requiredDuringSchedulingIgnoredDuringExecution: - description: - If the anti-affinity requirements specified by - this field are not met at scheduling time, the pod will - not be scheduled onto the node. If the anti-affinity requirements - specified by this field cease to be met at some point during - pod execution (e.g. due to a pod label update), the system - may or may not try to eventually evict the pod from its - node. When there are multiple elements, the lists of nodes - corresponding to each podAffinityTerm are intersected, i.e. - all terms must be satisfied. + type: object + emptyDir: + description: 'emptyDir represents a temporary directory that + shares a pod''s lifetime. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' + properties: + medium: + description: 'medium represents what type of storage medium + should back this directory. The default is "" which means + to use the node''s default medium. Must be an empty string + (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + description: 'sizeLimit is the total amount of local storage + required for this EmptyDir volume. The size limit is also + applicable for memory medium. The maximum usage on memory + medium EmptyDir would be the minimum value between the + SizeLimit specified here and the sum of memory limits + of all containers in a pod. The default is nil which means + that the limit is undefined. More info: http://kubernetes.io/docs/user-guide/volumes#emptydir' + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + ephemeral: + description: "ephemeral represents a volume that is handled + by a cluster storage driver. The volume's lifecycle is tied + to the pod that defines it - it will be created before the + pod starts, and deleted when the pod is removed. \n Use this + if: a) the volume is only needed while the pod runs, b) features + of normal volumes like restoring from snapshot or capacity + tracking are needed, c) the storage driver is specified through + a storage class, and d) the storage driver supports dynamic + volume provisioning through a PersistentVolumeClaim (see EphemeralVolumeSource + for more information on the connection between this volume + type and PersistentVolumeClaim). \n Use PersistentVolumeClaim + or one of the vendor-specific APIs for volumes that persist + for longer than the lifecycle of an individual pod. \n Use + CSI for light-weight local ephemeral volumes if the CSI driver + is meant to be used that way - see the documentation of the + driver for more information. \n A pod can use both types of + ephemeral volumes and persistent volumes at the same time." + properties: + volumeClaimTemplate: + description: "Will be used to create a stand-alone PVC to + provision the volume. The pod in which this EphemeralVolumeSource + is embedded will be the owner of the PVC, i.e. the PVC + will be deleted together with the pod. The name of the + PVC will be `-` where `` is the name from the `PodSpec.Volumes` array entry. + Pod validation will reject the pod if the concatenated + name is not valid for a PVC (for example, too long). \n + An existing PVC with that name that is not owned by the + pod will *not* be used for the pod to avoid using an unrelated + volume by mistake. Starting the pod is then blocked until + the unrelated PVC is removed. If such a pre-created PVC + is meant to be used by the pod, the PVC has to updated + with an owner reference to the pod once the pod exists. + Normally this should not be necessary, but it may be useful + when manually reconstructing a broken cluster. \n This + field is read-only and no changes will be made by Kubernetes + to the PVC after it has been created. \n Required, must + not be nil." + properties: + metadata: + description: May contain labels and annotations that + will be copied into the PVC when creating it. No other + fields are allowed and will be rejected during validation. + type: object + spec: + description: The specification for the PersistentVolumeClaim. + The entire content is copied unchanged into the PVC + that gets created from this template. The same fields + as in a PersistentVolumeClaim are also valid here. + properties: + accessModes: + description: 'accessModes contains the desired access + modes the volume should have. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1' + items: + type: string + type: array + dataSource: + description: 'dataSource field can be used to specify + either: * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) If the + provisioner or an external controller can support + the specified data source, it will create a new + volume based on the contents of the specified + data source. If the AnyVolumeDataSource feature + gate is enabled, this field will always have the + same contents as the DataSourceRef field.' + properties: + apiGroup: + description: APIGroup is the group for the resource + being referenced. If APIGroup is not specified, + the specified Kind must be in the core API + group. For any other third-party types, APIGroup + is required. + type: string + kind: + description: Kind is the type of resource being + referenced + type: string + name: + description: Name is the name of resource being + referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: 'dataSourceRef specifies the object + from which to populate the volume with data, if + a non-empty volume is desired. This may be any + local object from a non-empty API group (non core + object) or a PersistentVolumeClaim object. When + this field is specified, volume binding will only + succeed if the type of the specified object matches + some installed volume populator or dynamic provisioner. + This field will replace the functionality of the + DataSource field and as such if both fields are + non-empty, they must have the same value. For + backwards compatibility, both fields (DataSource + and DataSourceRef) will be set to the same value + automatically if one of them is empty and the + other is non-empty. There are two important differences + between DataSource and DataSourceRef: * While + DataSource only allows two specific types of objects, + DataSourceRef allows any non-core object, as well + as PersistentVolumeClaim objects. * While DataSource + ignores disallowed values (dropping them), DataSourceRef + preserves all values, and generates an error if + a disallowed value is specified. (Beta) Using + this field requires the AnyVolumeDataSource feature + gate to be enabled.' + properties: + apiGroup: + description: APIGroup is the group for the resource + being referenced. If APIGroup is not specified, + the specified Kind must be in the core API + group. For any other third-party types, APIGroup + is required. + type: string + kind: + description: Kind is the type of resource being + referenced + type: string + name: + description: Name is the name of resource being + referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + resources: + description: 'resources represents the minimum resources + the volume should have. If RecoverVolumeExpansionFailure + feature is enabled users are allowed to specify + resource requirements that are lower than previous + value but must still be higher than capacity recorded + in the status field of the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources' + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount + of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Requests describes the minimum + amount of compute resources required. If Requests + is omitted for a container, it defaults to + Limits if that is explicitly specified, otherwise + to an implementation-defined value. More info: + https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + type: object + type: object + selector: + description: selector is a label query over volumes + to consider for binding. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: A label selector requirement + is a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only "value". + The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: 'storageClassName is the name of the + StorageClass required by the claim. More info: + https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1' + type: string + volumeMode: + description: volumeMode defines what type of volume + is required by the claim. Value of Filesystem + is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference + to the PersistentVolume backing this claim. + type: string + type: object + required: + - spec + type: object + type: object + fc: + description: fc represents a Fibre Channel resource that is + attached to a kubelet's host machine and then exposed to the + pod. + properties: + fsType: + description: 'fsType is the filesystem type to mount. Must + be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. TODO: how do we prevent errors in the + filesystem from compromising the machine' + type: string + lun: + description: 'lun is Optional: FC target lun number' + format: int32 + type: integer + readOnly: + description: 'readOnly is Optional: Defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in VolumeMounts.' + type: boolean + targetWWNs: + description: 'targetWWNs is Optional: FC target worldwide + names (WWNs)' + items: + type: string + type: array + wwids: + description: 'wwids Optional: FC volume world wide identifiers + (wwids) Either wwids or combination of targetWWNs and + lun must be set, but not both simultaneously.' + items: + type: string + type: array + type: object + flexVolume: + description: flexVolume represents a generic volume resource + that is provisioned/attached using an exec based plugin. + properties: + driver: + description: driver is the name of the driver to use for + this volume. + type: string + fsType: + description: fsType is the filesystem type to mount. Must + be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". The default filesystem depends + on FlexVolume script. + type: string + options: + additionalProperties: + type: string + description: 'options is Optional: this field holds extra + command options if any.' + type: object + readOnly: + description: 'readOnly is Optional: defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in VolumeMounts.' + type: boolean + secretRef: + description: 'secretRef is Optional: secretRef is reference + to the secret object containing sensitive information + to pass to the plugin scripts. This may be empty if no + secret object is specified. If the secret object contains + more than one secret, all secrets are passed to the plugin + scripts.' + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + required: + - driver + type: object + flocker: + description: flocker represents a Flocker volume attached to + a kubelet's host machine. This depends on the Flocker control + service being running + properties: + datasetName: + description: datasetName is Name of the dataset stored as + metadata -> name on the dataset for Flocker should be + considered as deprecated + type: string + datasetUUID: + description: datasetUUID is the UUID of the dataset. This + is unique identifier of a Flocker dataset + type: string + type: object + gcePersistentDisk: + description: 'gcePersistentDisk represents a GCE Disk resource + that is attached to a kubelet''s host machine and then exposed + to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' + properties: + fsType: + description: 'fsType is filesystem type of the volume that + you want to mount. Tip: Ensure that the filesystem type + is supported by the host operating system. Examples: "ext4", + "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + TODO: how do we prevent errors in the filesystem from + compromising the machine' + type: string + partition: + description: 'partition is the partition in the volume that + you want to mount. If omitted, the default is to mount + by volume name. Examples: For volume /dev/sda1, you specify + the partition as "1". Similarly, the volume partition + for /dev/sda is "0" (or you can leave the property empty). + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' + format: int32 + type: integer + pdName: + description: 'pdName is unique name of the PD resource in + GCE. Used to identify the disk in GCE. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' + type: string + readOnly: + description: 'readOnly here will force the ReadOnly setting + in VolumeMounts. Defaults to false. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' + type: boolean + required: + - pdName + type: object + gitRepo: + description: 'gitRepo represents a git repository at a particular + revision. DEPRECATED: GitRepo is deprecated. To provision + a container with a git repo, mount an EmptyDir into an InitContainer + that clones the repo using git, then mount the EmptyDir into + the Pod''s container.' + properties: + directory: + description: directory is the target directory name. Must + not contain or start with '..'. If '.' is supplied, the + volume directory will be the git repository. Otherwise, + if specified, the volume will contain the git repository + in the subdirectory with the given name. + type: string + repository: + description: repository is the URL + type: string + revision: + description: revision is the commit hash for the specified + revision. + type: string + required: + - repository + type: object + glusterfs: + description: 'glusterfs represents a Glusterfs mount on the + host that shares a pod''s lifetime. More info: https://examples.k8s.io/volumes/glusterfs/README.md' + properties: + endpoints: + description: 'endpoints is the endpoint name that details + Glusterfs topology. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' + type: string + path: + description: 'path is the Glusterfs volume path. More info: + https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' + type: string + readOnly: + description: 'readOnly here will force the Glusterfs volume + to be mounted with read-only permissions. Defaults to + false. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' + type: boolean + required: + - endpoints + - path + type: object + hostPath: + description: 'hostPath represents a pre-existing file or directory + on the host machine that is directly exposed to the container. + This is generally used for system agents or other privileged + things that are allowed to see the host machine. Most containers + will NOT need this. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + --- TODO(jonesdl) We need to restrict who can use host directory + mounts and who can/can not mount host directories as read/write.' + properties: + path: + description: 'path of the directory on the host. If the + path is a symlink, it will follow the link to the real + path. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' + type: string + type: + description: 'type for HostPath Volume Defaults to "" More + info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' + type: string + required: + - path + type: object + iscsi: + description: 'iscsi represents an ISCSI Disk resource that is + attached to a kubelet''s host machine and then exposed to + the pod. More info: https://examples.k8s.io/volumes/iscsi/README.md' + properties: + chapAuthDiscovery: + description: chapAuthDiscovery defines whether support iSCSI + Discovery CHAP authentication + type: boolean + chapAuthSession: + description: chapAuthSession defines whether support iSCSI + Session CHAP authentication + type: boolean + fsType: + description: 'fsType is the filesystem type of the volume + that you want to mount. Tip: Ensure that the filesystem + type is supported by the host operating system. Examples: + "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi + TODO: how do we prevent errors in the filesystem from + compromising the machine' + type: string + initiatorName: + description: initiatorName is the custom iSCSI Initiator + Name. If initiatorName is specified with iscsiInterface + simultaneously, new iSCSI interface : will be created for the connection. + type: string + iqn: + description: iqn is the target iSCSI Qualified Name. + type: string + iscsiInterface: + description: iscsiInterface is the interface Name that uses + an iSCSI transport. Defaults to 'default' (tcp). + type: string + lun: + description: lun represents iSCSI Target Lun number. + format: int32 + type: integer + portals: + description: portals is the iSCSI Target Portal List. The + portal is either an IP or ip_addr:port if the port is + other than default (typically TCP ports 860 and 3260). + items: + type: string + type: array + readOnly: + description: readOnly here will force the ReadOnly setting + in VolumeMounts. Defaults to false. + type: boolean + secretRef: + description: secretRef is the CHAP Secret for iSCSI target + and initiator authentication + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + targetPortal: + description: targetPortal is iSCSI Target Portal. The Portal + is either an IP or ip_addr:port if the port is other than + default (typically TCP ports 860 and 3260). + type: string + required: + - iqn + - lun + - targetPortal + type: object + name: + description: 'name of the volume. Must be a DNS_LABEL and unique + within the pod. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + nfs: + description: 'nfs represents an NFS mount on the host that shares + a pod''s lifetime More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' + properties: + path: + description: 'path that is exported by the NFS server. More + info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' + type: string + readOnly: + description: 'readOnly here will force the NFS export to + be mounted with read-only permissions. Defaults to false. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' + type: boolean + server: + description: 'server is the hostname or IP address of the + NFS server. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' + type: string + required: + - path + - server + type: object + persistentVolumeClaim: + description: 'persistentVolumeClaimVolumeSource represents a + reference to a PersistentVolumeClaim in the same namespace. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' + properties: + claimName: + description: 'claimName is the name of a PersistentVolumeClaim + in the same namespace as the pod using this volume. More + info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' + type: string + readOnly: + description: readOnly Will force the ReadOnly setting in + VolumeMounts. Default false. + type: boolean + required: + - claimName + type: object + photonPersistentDisk: + description: photonPersistentDisk represents a PhotonController + persistent disk attached and mounted on kubelets host machine + properties: + fsType: + description: fsType is the filesystem type to mount. Must + be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. + type: string + pdID: + description: pdID is the ID that identifies Photon Controller + persistent disk + type: string + required: + - pdID + type: object + portworxVolume: + description: portworxVolume represents a portworx volume attached + and mounted on kubelets host machine + properties: + fsType: + description: fSType represents the filesystem type to mount + Must be a filesystem type supported by the host operating + system. Ex. "ext4", "xfs". Implicitly inferred to be "ext4" + if unspecified. + type: string + readOnly: + description: readOnly defaults to false (read/write). ReadOnly + here will force the ReadOnly setting in VolumeMounts. + type: boolean + volumeID: + description: volumeID uniquely identifies a Portworx volume + type: string + required: + - volumeID + type: object + projected: + description: projected items for all in one resources secrets, + configmaps, and downward API + properties: + defaultMode: + description: defaultMode are the mode bits used to set permissions + on created files by default. Must be an octal value between + 0000 and 0777 or a decimal value between 0 and 511. YAML + accepts both octal and decimal values, JSON requires decimal + values for mode bits. Directories within the path are + not affected by this setting. This might be in conflict + with other options that affect the file mode, like fsGroup, + and the result can be other mode bits set. + format: int32 + type: integer + sources: + description: sources is the list of volume projections items: - description: - Defines a set of pods (namely those matching - the labelSelector relative to the given namespace(s)) - that this pod should be co-located (affinity) or not co-located - (anti-affinity) with, where co-located is defined as running - on a node whose value of the label with key - matches that of any node on which a pod of the set of - pods is running + description: Projection that may be projected along with + other supported volume types properties: - labelSelector: - description: - A label query over a set of resources, - in this case pods. + configMap: + description: configMap information about the configMap + data to project properties: - matchExpressions: - description: - matchExpressions is a list of label - selector requirements. The requirements are ANDed. + items: + description: items if unspecified, each key-value + pair in the Data field of the referenced ConfigMap + will be projected into the volume as a file + whose name is the key and content is the value. + If specified, the listed keys will be projected + into the specified paths, and unlisted keys + will not be present. If a key is specified which + is not present in the ConfigMap, the volume + setup will error unless it is marked optional. + Paths must be relative and may not contain the + '..' path or start with '..'. items: - description: - A label selector requirement is a - selector that contains values, a key, and an - operator that relates the key and values. + description: Maps a string key to a path within + a volume. properties: key: - description: - key is the label key that the - selector applies to. + description: key is the key to project. type: string - operator: - description: - operator represents a key's relationship - to a set of values. Valid operators are - In, NotIn, Exists and DoesNotExist. + mode: + description: 'mode is Optional: mode bits + used to set permissions on this file. + Must be an octal value between 0000 and + 0777 or a decimal value between 0 and + 511. YAML accepts both octal and decimal + values, JSON requires decimal values for + mode bits. If not specified, the volume + defaultMode will be used. This might be + in conflict with other options that affect + the file mode, like fsGroup, and the result + can be other mode bits set.' + format: int32 + type: integer + path: + description: path is the relative path of + the file to map the key to. May not be + an absolute path. May not contain the + path element '..'. May not start with + the string '..'. type: string - values: - description: - values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. If the - operator is Exists or DoesNotExist, the - values array must be empty. This array is - replaced during a strategic merge patch. - items: - type: string - type: array required: - - key - - operator + - key + - path type: object type: array - matchLabels: - additionalProperties: - type: string - description: - matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is "In", - and the values array contains only "value". The - requirements are ANDed. - type: object + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: optional specify whether the ConfigMap + or its keys must be defined + type: boolean type: object x-kubernetes-map-type: atomic - namespaceSelector: - description: - A label query over the set of namespaces - that the term applies to. The term is applied to the - union of the namespaces selected by this field and - the ones listed in the namespaces field. null selector - and null or empty namespaces list means "this pod's - namespace". An empty selector ({}) matches all namespaces. + downwardAPI: + description: downwardAPI information about the downwardAPI + data to project + properties: + items: + description: Items is a list of DownwardAPIVolume + file + items: + description: DownwardAPIVolumeFile represents + information to create the file containing + the pod field + properties: + fieldRef: + description: 'Required: Selects a field + of the pod: only annotations, labels, + name and namespace are supported.' + properties: + apiVersion: + description: Version of the schema the + FieldPath is written in terms of, + defaults to "v1". + type: string + fieldPath: + description: Path of the field to select + in the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + description: 'Optional: mode bits used to + set permissions on this file, must be + an octal value between 0000 and 0777 or + a decimal value between 0 and 511. YAML + accepts both octal and decimal values, + JSON requires decimal values for mode + bits. If not specified, the volume defaultMode + will be used. This might be in conflict + with other options that affect the file + mode, like fsGroup, and the result can + be other mode bits set.' + format: int32 + type: integer + path: + description: 'Required: Path is the relative + path name of the file to be created. Must + not be absolute or contain the ''..'' + path. Must be utf-8 encoded. The first + item of the relative path must not start + with ''..''' + type: string + resourceFieldRef: + description: 'Selects a resource of the + container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu + and requests.memory) are currently supported.' + properties: + containerName: + description: 'Container name: required + for volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format + of the exposed resources, defaults + to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to + select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + secret: + description: secret information about the secret data + to project properties: - matchExpressions: - description: - matchExpressions is a list of label - selector requirements. The requirements are ANDed. + items: + description: items if unspecified, each key-value + pair in the Data field of the referenced Secret + will be projected into the volume as a file + whose name is the key and content is the value. + If specified, the listed keys will be projected + into the specified paths, and unlisted keys + will not be present. If a key is specified which + is not present in the Secret, the volume setup + will error unless it is marked optional. Paths + must be relative and may not contain the '..' + path or start with '..'. items: - description: - A label selector requirement is a - selector that contains values, a key, and an - operator that relates the key and values. + description: Maps a string key to a path within + a volume. properties: key: - description: - key is the label key that the - selector applies to. + description: key is the key to project. type: string - operator: - description: - operator represents a key's relationship - to a set of values. Valid operators are - In, NotIn, Exists and DoesNotExist. + mode: + description: 'mode is Optional: mode bits + used to set permissions on this file. + Must be an octal value between 0000 and + 0777 or a decimal value between 0 and + 511. YAML accepts both octal and decimal + values, JSON requires decimal values for + mode bits. If not specified, the volume + defaultMode will be used. This might be + in conflict with other options that affect + the file mode, like fsGroup, and the result + can be other mode bits set.' + format: int32 + type: integer + path: + description: path is the relative path of + the file to map the key to. May not be + an absolute path. May not contain the + path element '..'. May not start with + the string '..'. type: string - values: - description: - values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. If the - operator is Exists or DoesNotExist, the - values array must be empty. This array is - replaced during a strategic merge patch. - items: - type: string - type: array required: - - key - - operator + - key + - path type: object type: array - matchLabels: - additionalProperties: - type: string - description: - matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is "In", - and the values array contains only "value". The - requirements are ANDed. - type: object + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: optional field specify whether the + Secret or its key must be defined + type: boolean type: object x-kubernetes-map-type: atomic - namespaces: - description: - namespaces specifies a static list of namespace - names that the term applies to. The term is applied - to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. null or - empty namespaces list and null namespaceSelector means - "this pod's namespace". - items: - type: string - type: array - topologyKey: - description: - This pod should be co-located (affinity) - or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where - co-located is defined as running on a node whose value - of the label with key topologyKey matches that of - any node on which any of the selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - type: object - type: object - env: - description: - Env allows to specify environment vars for the parser - container. - items: - description: - EnvVar represents an environment variable present in - a Container. - properties: - name: - description: Name of the environment variable. Must be a C_IDENTIFIER. - type: string - value: - description: - 'Variable references $(VAR_NAME) are expanded using - the previously defined environment variables in the container - and any service environment variables. If a variable cannot - be resolved, the reference in the input string will be unchanged. - Double $$ are reduced to a single $, which allows for escaping - the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the - string literal "$(VAR_NAME)". Escaped references will never - be expanded, regardless of whether the variable exists or - not. Defaults to "".' - type: string - valueFrom: - description: - Source for the environment variable's value. Cannot - be used if value is not empty. - properties: - configMapKeyRef: - description: Selects a key of a ConfigMap. - properties: - key: - description: The key to select. - type: string - name: - description: - "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?" - type: string - optional: - description: - Specify whether the ConfigMap or its key - must be defined - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - fieldRef: - description: - "Selects a field of the pod: supports metadata.name, - metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, - spec.nodeName, spec.serviceAccountName, status.hostIP, - status.podIP, status.podIPs." - properties: - apiVersion: - description: - Version of the schema the FieldPath is - written in terms of, defaults to "v1". - type: string - fieldPath: - description: - Path of the field to select in the specified - API version. - type: string - required: - - fieldPath - type: object - x-kubernetes-map-type: atomic - resourceFieldRef: - description: - "Selects a resource of the container: only - resources limits and requests (limits.cpu, limits.memory, - limits.ephemeral-storage, requests.cpu, requests.memory - and requests.ephemeral-storage) are currently supported." - properties: - containerName: - description: - "Container name: required for volumes, - optional for env vars" - type: string - divisor: - anyOf: - - type: integer - - type: string - description: - Specifies the output format of the exposed - resources, defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: "Required: resource to select" - type: string - required: - - resource - type: object - x-kubernetes-map-type: atomic - secretKeyRef: - description: Selects a key of a secret in the pod's namespace - properties: - key: - description: - The key of the secret to select from. Must - be a valid secret key. - type: string - name: - description: - "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?" - type: string - optional: - description: - Specify whether the Secret or its key must - be defined - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - required: - - name - type: object - type: array - image: - description: - Image is the reference to the parser container image - which ca transform the raw scan report into findings - type: string - imagePullPolicy: - description: - "Image pull policy. One of Always, Never, IfNotPresent. - Defaults to Always if :latest tag is specified, or IfNotPresent - otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images" - type: string - imagePullSecrets: - description: ImagePullSecrets used to access private parser images - items: - description: - LocalObjectReference contains enough information to - let you locate the referenced object inside the same namespace. - properties: - name: - description: - "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?" - type: string - type: object - x-kubernetes-map-type: atomic - type: array - resources: - default: - limits: - cpu: 400m - memory: 200Mi - requests: - cpu: 200m - memory: 100Mi - description: - Resources lets you control resource limits and requests - for the parser container. See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: - "Limits describes the maximum amount of compute resources - allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/" - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: - "Requests describes the minimum amount of compute - resources required. If Requests is omitted for a container, - it defaults to Limits if that is explicitly specified, otherwise - to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/" - type: object - type: object - scopeLimiterAliases: - additionalProperties: - type: string - type: object - tolerations: - description: - Tolerations are a different way to control on which nodes - your parser is executed. See https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ - items: - description: - The pod this Toleration is attached to tolerates any - taint that matches the triple using the matching - operator . - properties: - effect: - description: - Effect indicates the taint effect to match. Empty - means match all taint effects. When specified, allowed values - are NoSchedule, PreferNoSchedule and NoExecute. - type: string - key: - description: - Key is the taint key that the toleration applies - to. Empty means match all taint keys. If the key is empty, - operator must be Exists; this combination means to match all - values and all keys. - type: string - operator: - description: - Operator represents a key's relationship to the - value. Valid operators are Exists and Equal. Defaults to Equal. - Exists is equivalent to wildcard for value, so that a pod - can tolerate all taints of a particular category. - type: string - tolerationSeconds: - description: - TolerationSeconds represents the period of time - the toleration (which must be of effect NoExecute, otherwise - this field is ignored) tolerates the taint. By default, it - is not set, which means tolerate the taint forever (do not - evict). Zero and negative values will be treated as 0 (evict - immediately) by the system. - format: int64 - type: integer - value: - description: - Value is the taint value the toleration matches - to. If the operator is Exists, the value should be empty, - otherwise just a regular string. - type: string - type: object - type: array - ttlSecondsAfterFinished: - description: - TTLSecondsAfterFinished configures the ttlSecondsAfterFinished - field for the created parse job - format: int32 - nullable: true - type: integer - volumeMounts: - description: - VolumeMounts allows to specify volume mounts for the - parser container. - items: - description: - VolumeMount describes a mounting of a Volume within - a container. - properties: - mountPath: - description: - Path within the container at which the volume should - be mounted. Must not contain ':'. - type: string - mountPropagation: - description: - mountPropagation determines how mounts are propagated - from the host to container and the other way around. When - not set, MountPropagationNone is used. This field is beta - in 1.10. - type: string - name: - description: This must match the Name of a Volume. - type: string - readOnly: - description: - Mounted read-only if true, read-write otherwise - (false or unspecified). Defaults to false. - type: boolean - subPath: - description: - Path within the volume from which the container's - volume should be mounted. Defaults to "" (volume's root). - type: string - subPathExpr: - description: - Expanded path within the volume from which the - container's volume should be mounted. Behaves similarly to - SubPath but environment variable references $(VAR_NAME) are - expanded using the container's environment. Defaults to "" - (volume's root). SubPathExpr and SubPath are mutually exclusive. - type: string - required: - - mountPath - - name - type: object - type: array - volumes: - description: Volumes allows to specify volumes for the parser container. - items: - description: - Volume represents a named volume in a pod that may - be accessed by any container in the pod. - properties: - awsElasticBlockStore: - description: - "awsElasticBlockStore represents an AWS Disk resource - that is attached to a kubelet's host machine and then exposed - to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore" - properties: - fsType: - description: - 'fsType is the filesystem type of the volume - that you want to mount. Tip: Ensure that the filesystem - type is supported by the host operating system. Examples: - "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore - TODO: how do we prevent errors in the filesystem from - compromising the machine' - type: string - partition: - description: - 'partition is the partition in the volume that - you want to mount. If omitted, the default is to mount - by volume name. Examples: For volume /dev/sda1, you specify - the partition as "1". Similarly, the volume partition - for /dev/sda is "0" (or you can leave the property empty).' - format: int32 - type: integer - readOnly: - description: - "readOnly value true will force the readOnly - setting in VolumeMounts. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore" - type: boolean - volumeID: - description: - "volumeID is unique ID of the persistent disk - resource in AWS (Amazon EBS volume). More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore" - type: string - required: - - volumeID - type: object - azureDisk: - description: - azureDisk represents an Azure Data Disk mount on - the host and bind mount to the pod. - properties: - cachingMode: - description: - "cachingMode is the Host Caching mode: None, - Read Only, Read Write." - type: string - diskName: - description: - diskName is the Name of the data disk in the - blob storage - type: string - diskURI: - description: - diskURI is the URI of data disk in the blob - storage - type: string - fsType: - description: - fsType is Filesystem type to mount. Must be - a filesystem type supported by the host operating system. - Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. - type: string - kind: - description: - "kind expected values are Shared: multiple - blob disks per storage account Dedicated: single blob - disk per storage account Managed: azure managed data - disk (only in managed availability set). defaults to shared" - type: string - readOnly: - description: - readOnly Defaults to false (read/write). ReadOnly - here will force the ReadOnly setting in VolumeMounts. - type: boolean - required: - - diskName - - diskURI - type: object - azureFile: - description: - azureFile represents an Azure File Service mount - on the host and bind mount to the pod. - properties: - readOnly: - description: - readOnly defaults to false (read/write). ReadOnly - here will force the ReadOnly setting in VolumeMounts. - type: boolean - secretName: - description: - secretName is the name of secret that contains - Azure Storage Account Name and Key - type: string - shareName: - description: shareName is the azure share Name - type: string - required: - - secretName - - shareName - type: object - cephfs: - description: - cephFS represents a Ceph FS mount on the host that - shares a pod's lifetime - properties: - monitors: - description: - "monitors is Required: Monitors is a collection - of Ceph monitors More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it" - items: - type: string - type: array - path: - description: - "path is Optional: Used as the mounted root, - rather than the full Ceph tree, default is /" - type: string - readOnly: - description: - "readOnly is Optional: Defaults to false (read/write). - ReadOnly here will force the ReadOnly setting in VolumeMounts. - More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it" - type: boolean - secretFile: - description: - "secretFile is Optional: SecretFile is the - path to key ring for User, default is /etc/ceph/user.secret - More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it" - type: string - secretRef: - description: - "secretRef is Optional: SecretRef is reference - to the authentication secret for User, default is empty. - More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it" - properties: - name: - description: - "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?" - type: string - type: object - x-kubernetes-map-type: atomic - user: - description: - "user is optional: User is the rados user name, - default is admin More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it" - type: string - required: - - monitors - type: object - cinder: - description: - "cinder represents a cinder volume attached and - mounted on kubelets host machine. More info: https://examples.k8s.io/mysql-cinder-pd/README.md" - properties: - fsType: - description: - 'fsType is the filesystem type to mount. Must - be a filesystem type supported by the host operating system. - Examples: "ext4", "xfs", "ntfs". Implicitly inferred to - be "ext4" if unspecified. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - type: string - readOnly: - description: - "readOnly defaults to false (read/write). ReadOnly - here will force the ReadOnly setting in VolumeMounts. - More info: https://examples.k8s.io/mysql-cinder-pd/README.md" - type: boolean - secretRef: - description: - "secretRef is optional: points to a secret - object containing parameters used to connect to OpenStack." - properties: - name: - description: - "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?" - type: string - type: object - x-kubernetes-map-type: atomic - volumeID: - description: - "volumeID used to identify the volume in cinder. - More info: https://examples.k8s.io/mysql-cinder-pd/README.md" - type: string - required: - - volumeID - type: object - configMap: - description: - configMap represents a configMap that should populate - this volume - properties: - defaultMode: - description: - "defaultMode is optional: mode bits used to - set permissions on created files by default. Must be an - octal value between 0000 and 0777 or a decimal value between - 0 and 511. YAML accepts both octal and decimal values, - JSON requires decimal values for mode bits. Defaults to - 0644. Directories within the path are not affected by - this setting. This might be in conflict with other options - that affect the file mode, like fsGroup, and the result - can be other mode bits set." - format: int32 - type: integer - items: - description: - items if unspecified, each key-value pair in - the Data field of the referenced ConfigMap will be projected - into the volume as a file whose name is the key and content - is the value. If specified, the listed keys will be projected - into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in - the ConfigMap, the volume setup will error unless it is - marked optional. Paths must be relative and may not contain - the '..' path or start with '..'. - items: - description: Maps a string key to a path within a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: - "mode is Optional: mode bits used to - set permissions on this file. Must be an octal value - between 0000 and 0777 or a decimal value between - 0 and 511. YAML accepts both octal and decimal values, - JSON requires decimal values for mode bits. If not - specified, the volume defaultMode will be used. - This might be in conflict with other options that - affect the file mode, like fsGroup, and the result - can be other mode bits set." - format: int32 - type: integer - path: - description: - path is the relative path of the file - to map the key to. May not be an absolute path. - May not contain the path element '..'. May not start - with the string '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: - "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?" - type: string - optional: - description: - optional specify whether the ConfigMap or its - keys must be defined - type: boolean - type: object - x-kubernetes-map-type: atomic - csi: - description: - csi (Container Storage Interface) represents ephemeral - storage that is handled by certain external CSI drivers (Beta - feature). - properties: - driver: - description: - driver is the name of the CSI driver that handles - this volume. Consult with your admin for the correct name - as registered in the cluster. - type: string - fsType: - description: - fsType to mount. Ex. "ext4", "xfs", "ntfs". - If not provided, the empty value is passed to the associated - CSI driver which will determine the default filesystem - to apply. - type: string - nodePublishSecretRef: - description: - nodePublishSecretRef is a reference to the - secret object containing sensitive information to pass - to the CSI driver to complete the CSI NodePublishVolume - and NodeUnpublishVolume calls. This field is optional, - and may be empty if no secret is required. If the secret - object contains more than one secret, all secret references - are passed. - properties: - name: - description: - "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?" - type: string - type: object - x-kubernetes-map-type: atomic - readOnly: - description: - readOnly specifies a read-only configuration - for the volume. Defaults to false (read/write). - type: boolean - volumeAttributes: - additionalProperties: - type: string - description: - volumeAttributes stores driver-specific properties - that are passed to the CSI driver. Consult your driver's - documentation for supported values. - type: object - required: - - driver - type: object - downwardAPI: - description: - downwardAPI represents downward API about the pod - that should populate this volume - properties: - defaultMode: - description: - "Optional: mode bits to use on created files - by default. Must be a Optional: mode bits used to set - permissions on created files by default. Must be an octal - value between 0000 and 0777 or a decimal value between - 0 and 511. YAML accepts both octal and decimal values, - JSON requires decimal values for mode bits. Defaults to - 0644. Directories within the path are not affected by - this setting. This might be in conflict with other options - that affect the file mode, like fsGroup, and the result - can be other mode bits set." - format: int32 - type: integer - items: - description: Items is a list of downward API volume file - items: - description: - DownwardAPIVolumeFile represents information - to create the file containing the pod field - properties: - fieldRef: - description: - "Required: Selects a field of the pod: - only annotations, labels, name and namespace are - supported." - properties: - apiVersion: - description: - Version of the schema the FieldPath - is written in terms of, defaults to "v1". - type: string - fieldPath: - description: - Path of the field to select in the - specified API version. - type: string - required: - - fieldPath - type: object - x-kubernetes-map-type: atomic - mode: - description: - "Optional: mode bits used to set permissions - on this file, must be an octal value between 0000 - and 0777 or a decimal value between 0 and 511. YAML - accepts both octal and decimal values, JSON requires - decimal values for mode bits. If not specified, - the volume defaultMode will be used. This might - be in conflict with other options that affect the - file mode, like fsGroup, and the result can be other - mode bits set." - format: int32 - type: integer - path: - description: - "Required: Path is the relative path - name of the file to be created. Must not be absolute - or contain the '..' path. Must be utf-8 encoded. - The first item of the relative path must not start - with '..'" - type: string - resourceFieldRef: - description: - "Selects a resource of the container: - only resources limits and requests (limits.cpu, - limits.memory, requests.cpu and requests.memory) - are currently supported." - properties: - containerName: - description: - "Container name: required for volumes, - optional for env vars" - type: string - divisor: - anyOf: - - type: integer - - type: string - description: - Specifies the output format of the - exposed resources, defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: "Required: resource to select" - type: string - required: - - resource - type: object - x-kubernetes-map-type: atomic - required: - - path - type: object - type: array - type: object - emptyDir: - description: - "emptyDir represents a temporary directory that - shares a pod's lifetime. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir" - properties: - medium: - description: - 'medium represents what type of storage medium - should back this directory. The default is "" which means - to use the node''s default medium. Must be an empty string - (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' - type: string - sizeLimit: - anyOf: - - type: integer - - type: string - description: - "sizeLimit is the total amount of local storage - required for this EmptyDir volume. The size limit is also - applicable for memory medium. The maximum usage on memory - medium EmptyDir would be the minimum value between the - SizeLimit specified here and the sum of memory limits - of all containers in a pod. The default is nil which means - that the limit is undefined. More info: http://kubernetes.io/docs/user-guide/volumes#emptydir" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - ephemeral: - description: - "ephemeral represents a volume that is handled - by a cluster storage driver. The volume's lifecycle is tied - to the pod that defines it - it will be created before the - pod starts, and deleted when the pod is removed. \n Use this - if: a) the volume is only needed while the pod runs, b) features - of normal volumes like restoring from snapshot or capacity - tracking are needed, c) the storage driver is specified through - a storage class, and d) the storage driver supports dynamic - volume provisioning through a PersistentVolumeClaim (see EphemeralVolumeSource - for more information on the connection between this volume - type and PersistentVolumeClaim). \n Use PersistentVolumeClaim - or one of the vendor-specific APIs for volumes that persist - for longer than the lifecycle of an individual pod. \n Use - CSI for light-weight local ephemeral volumes if the CSI driver - is meant to be used that way - see the documentation of the - driver for more information. \n A pod can use both types of - ephemeral volumes and persistent volumes at the same time." - properties: - volumeClaimTemplate: - description: - "Will be used to create a stand-alone PVC to - provision the volume. The pod in which this EphemeralVolumeSource - is embedded will be the owner of the PVC, i.e. the PVC - will be deleted together with the pod. The name of the - PVC will be `-` where `` is the name from the `PodSpec.Volumes` array entry. - Pod validation will reject the pod if the concatenated - name is not valid for a PVC (for example, too long). \n - An existing PVC with that name that is not owned by the - pod will *not* be used for the pod to avoid using an unrelated - volume by mistake. Starting the pod is then blocked until - the unrelated PVC is removed. If such a pre-created PVC - is meant to be used by the pod, the PVC has to updated - with an owner reference to the pod once the pod exists. - Normally this should not be necessary, but it may be useful - when manually reconstructing a broken cluster. \n This - field is read-only and no changes will be made by Kubernetes - to the PVC after it has been created. \n Required, must - not be nil." - properties: - metadata: - description: - May contain labels and annotations that - will be copied into the PVC when creating it. No other - fields are allowed and will be rejected during validation. - type: object - spec: - description: - The specification for the PersistentVolumeClaim. - The entire content is copied unchanged into the PVC - that gets created from this template. The same fields - as in a PersistentVolumeClaim are also valid here. + serviceAccountToken: + description: serviceAccountToken is information about + the serviceAccountToken data to project properties: - accessModes: - description: - "accessModes contains the desired access - modes the volume should have. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1" - items: - type: string - type: array - dataSource: - description: - "dataSource field can be used to specify - either: * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) - * An existing PVC (PersistentVolumeClaim) If the - provisioner or an external controller can support - the specified data source, it will create a new - volume based on the contents of the specified - data source. If the AnyVolumeDataSource feature - gate is enabled, this field will always have the - same contents as the DataSourceRef field." - properties: - apiGroup: - description: - APIGroup is the group for the resource - being referenced. If APIGroup is not specified, - the specified Kind must be in the core API - group. For any other third-party types, APIGroup - is required. - type: string - kind: - description: - Kind is the type of resource being - referenced - type: string - name: - description: - Name is the name of resource being - referenced - type: string - required: - - kind - - name - type: object - x-kubernetes-map-type: atomic - dataSourceRef: - description: - "dataSourceRef specifies the object - from which to populate the volume with data, if - a non-empty volume is desired. This may be any - local object from a non-empty API group (non core - object) or a PersistentVolumeClaim object. When - this field is specified, volume binding will only - succeed if the type of the specified object matches - some installed volume populator or dynamic provisioner. - This field will replace the functionality of the - DataSource field and as such if both fields are - non-empty, they must have the same value. For - backwards compatibility, both fields (DataSource - and DataSourceRef) will be set to the same value - automatically if one of them is empty and the - other is non-empty. There are two important differences - between DataSource and DataSourceRef: * While - DataSource only allows two specific types of objects, - DataSourceRef allows any non-core object, as well - as PersistentVolumeClaim objects. * While DataSource - ignores disallowed values (dropping them), DataSourceRef - preserves all values, and generates an error if - a disallowed value is specified. (Beta) Using - this field requires the AnyVolumeDataSource feature - gate to be enabled." - properties: - apiGroup: - description: - APIGroup is the group for the resource - being referenced. If APIGroup is not specified, - the specified Kind must be in the core API - group. For any other third-party types, APIGroup - is required. - type: string - kind: - description: - Kind is the type of resource being - referenced - type: string - name: - description: - Name is the name of resource being - referenced - type: string - required: - - kind - - name - type: object - x-kubernetes-map-type: atomic - resources: - description: - "resources represents the minimum resources - the volume should have. If RecoverVolumeExpansionFailure - feature is enabled users are allowed to specify - resource requirements that are lower than previous - value but must still be higher than capacity recorded - in the status field of the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources" - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: - "Limits describes the maximum amount - of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/" - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: - "Requests describes the minimum - amount of compute resources required. If Requests - is omitted for a container, it defaults to - Limits if that is explicitly specified, otherwise - to an implementation-defined value. More info: - https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/" - type: object - type: object - selector: - description: - selector is a label query over volumes - to consider for binding. - properties: - matchExpressions: - description: - matchExpressions is a list of label - selector requirements. The requirements are - ANDed. - items: - description: - A label selector requirement - is a selector that contains values, a key, - and an operator that relates the key and - values. - properties: - key: - description: - key is the label key that - the selector applies to. - type: string - operator: - description: - operator represents a key's - relationship to a set of values. Valid - operators are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: - values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. - If the operator is Exists or DoesNotExist, - the values array must be empty. This - array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: - matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is - "In", and the values array contains only "value". - The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - storageClassName: - description: - "storageClassName is the name of the - StorageClass required by the claim. More info: - https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1" - type: string - volumeMode: - description: - volumeMode defines what type of volume - is required by the claim. Value of Filesystem - is implied when not included in claim spec. + audience: + description: audience is the intended audience + of the token. A recipient of a token must identify + itself with an identifier specified in the audience + of the token, and otherwise should reject the + token. The audience defaults to the identifier + of the apiserver. type: string - volumeName: - description: - volumeName is the binding reference - to the PersistentVolume backing this claim. + expirationSeconds: + description: expirationSeconds is the requested + duration of validity of the service account + token. As the token approaches expiration, the + kubelet volume plugin will proactively rotate + the service account token. The kubelet will + start trying to rotate the token if the token + is older than 80 percent of its time to live + or if the token is older than 24 hours.Defaults + to 1 hour and must be at least 10 minutes. + format: int64 + type: integer + path: + description: path is the path relative to the + mount point of the file to project the token + into. type: string + required: + - path type: object - required: - - spec type: object - type: object - fc: - description: - fc represents a Fibre Channel resource that is - attached to a kubelet's host machine and then exposed to the - pod. - properties: - fsType: - description: - 'fsType is the filesystem type to mount. Must - be a filesystem type supported by the host operating system. - Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. TODO: how do we prevent errors in the - filesystem from compromising the machine' + type: array + type: object + quobyte: + description: quobyte represents a Quobyte mount on the host + that shares a pod's lifetime + properties: + group: + description: group to map volume access to Default is no + group + type: string + readOnly: + description: readOnly here will force the Quobyte volume + to be mounted with read-only permissions. Defaults to + false. + type: boolean + registry: + description: registry represents a single or multiple Quobyte + Registry services specified as a string as host:port pair + (multiple entries are separated with commas) which acts + as the central registry for volumes + type: string + tenant: + description: tenant owning the given Quobyte volume in the + Backend Used with dynamically provisioned Quobyte volumes, + value is set by the plugin + type: string + user: + description: user to map volume access to Defaults to serivceaccount + user + type: string + volume: + description: volume is a string that references an already + created Quobyte volume by name. + type: string + required: + - registry + - volume + type: object + rbd: + description: 'rbd represents a Rados Block Device mount on the + host that shares a pod''s lifetime. More info: https://examples.k8s.io/volumes/rbd/README.md' + properties: + fsType: + description: 'fsType is the filesystem type of the volume + that you want to mount. Tip: Ensure that the filesystem + type is supported by the host operating system. Examples: + "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd + TODO: how do we prevent errors in the filesystem from + compromising the machine' + type: string + image: + description: 'image is the rados image name. More info: + https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' + type: string + keyring: + description: 'keyring is the path to key ring for RBDUser. + Default is /etc/ceph/keyring. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' + type: string + monitors: + description: 'monitors is a collection of Ceph monitors. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' + items: type: string - lun: - description: "lun is Optional: FC target lun number" - format: int32 - type: integer - readOnly: - description: - "readOnly is Optional: Defaults to false (read/write). - ReadOnly here will force the ReadOnly setting in VolumeMounts." - type: boolean - targetWWNs: - description: - "targetWWNs is Optional: FC target worldwide - names (WWNs)" - items: - type: string - type: array - wwids: - description: - "wwids Optional: FC volume world wide identifiers - (wwids) Either wwids or combination of targetWWNs and - lun must be set, but not both simultaneously." - items: + type: array + pool: + description: 'pool is the rados pool name. Default is rbd. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' + type: string + readOnly: + description: 'readOnly here will force the ReadOnly setting + in VolumeMounts. Defaults to false. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' + type: boolean + secretRef: + description: 'secretRef is name of the authentication secret + for RBDUser. If provided overrides keyring. Default is + nil. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' type: string - type: array - type: object - flexVolume: - description: - flexVolume represents a generic volume resource - that is provisioned/attached using an exec based plugin. - properties: - driver: - description: - driver is the name of the driver to use for - this volume. - type: string - fsType: - description: - fsType is the filesystem type to mount. Must - be a filesystem type supported by the host operating system. - Ex. "ext4", "xfs", "ntfs". The default filesystem depends - on FlexVolume script. - type: string - options: - additionalProperties: + type: object + x-kubernetes-map-type: atomic + user: + description: 'user is the rados user name. Default is admin. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' + type: string + required: + - image + - monitors + type: object + scaleIO: + description: scaleIO represents a ScaleIO persistent volume + attached and mounted on Kubernetes nodes. + properties: + fsType: + description: fsType is the filesystem type to mount. Must + be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Default is "xfs". + type: string + gateway: + description: gateway is the host address of the ScaleIO + API Gateway. + type: string + protectionDomain: + description: protectionDomain is the name of the ScaleIO + Protection Domain for the configured storage. + type: string + readOnly: + description: readOnly Defaults to false (read/write). ReadOnly + here will force the ReadOnly setting in VolumeMounts. + type: boolean + secretRef: + description: secretRef references to the secret for ScaleIO + user and other sensitive information. If this is not provided, + Login operation will fail. + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' type: string - description: - "options is Optional: this field holds extra - command options if any." - type: object - readOnly: - description: - "readOnly is Optional: defaults to false (read/write). - ReadOnly here will force the ReadOnly setting in VolumeMounts." - type: boolean - secretRef: - description: - "secretRef is Optional: secretRef is reference - to the secret object containing sensitive information - to pass to the plugin scripts. This may be empty if no - secret object is specified. If the secret object contains - more than one secret, all secrets are passed to the plugin - scripts." + type: object + x-kubernetes-map-type: atomic + sslEnabled: + description: sslEnabled Flag enable/disable SSL communication + with Gateway, default false + type: boolean + storageMode: + description: storageMode indicates whether the storage for + a volume should be ThickProvisioned or ThinProvisioned. + Default is ThinProvisioned. + type: string + storagePool: + description: storagePool is the ScaleIO Storage Pool associated + with the protection domain. + type: string + system: + description: system is the name of the storage system as + configured in ScaleIO. + type: string + volumeName: + description: volumeName is the name of a volume already + created in the ScaleIO system that is associated with + this volume source. + type: string + required: + - gateway + - secretRef + - system + type: object + secret: + description: 'secret represents a secret that should populate + this volume. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret' + properties: + defaultMode: + description: 'defaultMode is Optional: mode bits used to + set permissions on created files by default. Must be an + octal value between 0000 and 0777 or a decimal value between + 0 and 511. YAML accepts both octal and decimal values, + JSON requires decimal values for mode bits. Defaults to + 0644. Directories within the path are not affected by + this setting. This might be in conflict with other options + that affect the file mode, like fsGroup, and the result + can be other mode bits set.' + format: int32 + type: integer + items: + description: items If unspecified, each key-value pair in + the Data field of the referenced Secret will be projected + into the volume as a file whose name is the key and content + is the value. If specified, the listed keys will be projected + into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in + the Secret, the volume setup will error unless it is marked + optional. Paths must be relative and may not contain the + '..' path or start with '..'. + items: + description: Maps a string key to a path within a volume. properties: - name: - description: - "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?" + key: + description: key is the key to project. type: string - type: object - x-kubernetes-map-type: atomic - required: - - driver - type: object - flocker: - description: - flocker represents a Flocker volume attached to - a kubelet's host machine. This depends on the Flocker control - service being running - properties: - datasetName: - description: - datasetName is Name of the dataset stored as - metadata -> name on the dataset for Flocker should be - considered as deprecated - type: string - datasetUUID: - description: - datasetUUID is the UUID of the dataset. This - is unique identifier of a Flocker dataset - type: string - type: object - gcePersistentDisk: - description: - "gcePersistentDisk represents a GCE Disk resource - that is attached to a kubelet's host machine and then exposed - to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk" - properties: - fsType: - description: - 'fsType is filesystem type of the volume that - you want to mount. Tip: Ensure that the filesystem type - is supported by the host operating system. Examples: "ext4", - "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. - More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk - TODO: how do we prevent errors in the filesystem from - compromising the machine' - type: string - partition: - description: - 'partition is the partition in the volume that - you want to mount. If omitted, the default is to mount - by volume name. Examples: For volume /dev/sda1, you specify - the partition as "1". Similarly, the volume partition - for /dev/sda is "0" (or you can leave the property empty). - More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - format: int32 - type: integer - pdName: - description: - "pdName is unique name of the PD resource in - GCE. Used to identify the disk in GCE. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk" - type: string - readOnly: - description: - "readOnly here will force the ReadOnly setting - in VolumeMounts. Defaults to false. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk" - type: boolean - required: - - pdName - type: object - gitRepo: - description: - "gitRepo represents a git repository at a particular - revision. DEPRECATED: GitRepo is deprecated. To provision - a container with a git repo, mount an EmptyDir into an InitContainer - that clones the repo using git, then mount the EmptyDir into - the Pod's container." - properties: - directory: - description: - directory is the target directory name. Must - not contain or start with '..'. If '.' is supplied, the - volume directory will be the git repository. Otherwise, - if specified, the volume will contain the git repository - in the subdirectory with the given name. - type: string - repository: - description: repository is the URL - type: string - revision: - description: - revision is the commit hash for the specified - revision. - type: string - required: - - repository - type: object - glusterfs: - description: - "glusterfs represents a Glusterfs mount on the - host that shares a pod's lifetime. More info: https://examples.k8s.io/volumes/glusterfs/README.md" - properties: - endpoints: - description: - "endpoints is the endpoint name that details - Glusterfs topology. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod" - type: string - path: - description: - "path is the Glusterfs volume path. More info: - https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod" - type: string - readOnly: - description: - "readOnly here will force the Glusterfs volume - to be mounted with read-only permissions. Defaults to - false. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod" - type: boolean - required: - - endpoints - - path - type: object - hostPath: - description: - "hostPath represents a pre-existing file or directory - on the host machine that is directly exposed to the container. - This is generally used for system agents or other privileged - things that are allowed to see the host machine. Most containers - will NOT need this. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath - --- TODO(jonesdl) We need to restrict who can use host directory - mounts and who can/can not mount host directories as read/write." - properties: - path: - description: - "path of the directory on the host. If the - path is a symlink, it will follow the link to the real - path. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath" - type: string - type: - description: - 'type for HostPath Volume Defaults to "" More - info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' - type: string - required: - - path - type: object - iscsi: - description: - "iscsi represents an ISCSI Disk resource that is - attached to a kubelet's host machine and then exposed to - the pod. More info: https://examples.k8s.io/volumes/iscsi/README.md" - properties: - chapAuthDiscovery: - description: - chapAuthDiscovery defines whether support iSCSI - Discovery CHAP authentication - type: boolean - chapAuthSession: - description: - chapAuthSession defines whether support iSCSI - Session CHAP authentication - type: boolean - fsType: - description: - 'fsType is the filesystem type of the volume - that you want to mount. Tip: Ensure that the filesystem - type is supported by the host operating system. Examples: - "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi - TODO: how do we prevent errors in the filesystem from - compromising the machine' - type: string - initiatorName: - description: - initiatorName is the custom iSCSI Initiator - Name. If initiatorName is specified with iscsiInterface - simultaneously, new iSCSI interface : will be created for the connection. - type: string - iqn: - description: iqn is the target iSCSI Qualified Name. - type: string - iscsiInterface: - description: - iscsiInterface is the interface Name that uses - an iSCSI transport. Defaults to 'default' (tcp). - type: string - lun: - description: lun represents iSCSI Target Lun number. - format: int32 - type: integer - portals: - description: - portals is the iSCSI Target Portal List. The - portal is either an IP or ip_addr:port if the port is - other than default (typically TCP ports 860 and 3260). - items: - type: string - type: array - readOnly: - description: - readOnly here will force the ReadOnly setting - in VolumeMounts. Defaults to false. - type: boolean - secretRef: - description: - secretRef is the CHAP Secret for iSCSI target - and initiator authentication - properties: - name: - description: - "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?" + mode: + description: 'mode is Optional: mode bits used to + set permissions on this file. Must be an octal value + between 0000 and 0777 or a decimal value between + 0 and 511. YAML accepts both octal and decimal values, + JSON requires decimal values for mode bits. If not + specified, the volume defaultMode will be used. + This might be in conflict with other options that + affect the file mode, like fsGroup, and the result + can be other mode bits set.' + format: int32 + type: integer + path: + description: path is the relative path of the file + to map the key to. May not be an absolute path. + May not contain the path element '..'. May not start + with the string '..'. type: string + required: + - key + - path type: object - x-kubernetes-map-type: atomic - targetPortal: - description: - targetPortal is iSCSI Target Portal. The Portal - is either an IP or ip_addr:port if the port is other than - default (typically TCP ports 860 and 3260). - type: string - required: - - iqn - - lun - - targetPortal - type: object - name: - description: - "name of the volume. Must be a DNS_LABEL and unique - within the pod. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names" - type: string - nfs: - description: - "nfs represents an NFS mount on the host that shares - a pod's lifetime More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs" - properties: - path: - description: - "path that is exported by the NFS server. More - info: https://kubernetes.io/docs/concepts/storage/volumes#nfs" - type: string - readOnly: - description: - "readOnly here will force the NFS export to - be mounted with read-only permissions. Defaults to false. - More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs" - type: boolean - server: - description: - "server is the hostname or IP address of the - NFS server. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs" - type: string - required: - - path - - server - type: object - persistentVolumeClaim: - description: - "persistentVolumeClaimVolumeSource represents a - reference to a PersistentVolumeClaim in the same namespace. - More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims" - properties: - claimName: - description: - "claimName is the name of a PersistentVolumeClaim - in the same namespace as the pod using this volume. More - info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims" - type: string - readOnly: - description: - readOnly Will force the ReadOnly setting in - VolumeMounts. Default false. - type: boolean - required: - - claimName - type: object - photonPersistentDisk: - description: - photonPersistentDisk represents a PhotonController - persistent disk attached and mounted on kubelets host machine - properties: - fsType: - description: - fsType is the filesystem type to mount. Must - be a filesystem type supported by the host operating system. - Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. - type: string - pdID: - description: - pdID is the ID that identifies Photon Controller - persistent disk - type: string - required: - - pdID - type: object - portworxVolume: - description: - portworxVolume represents a portworx volume attached - and mounted on kubelets host machine - properties: - fsType: - description: - fSType represents the filesystem type to mount - Must be a filesystem type supported by the host operating - system. Ex. "ext4", "xfs". Implicitly inferred to be "ext4" - if unspecified. - type: string - readOnly: - description: - readOnly defaults to false (read/write). ReadOnly - here will force the ReadOnly setting in VolumeMounts. - type: boolean - volumeID: - description: volumeID uniquely identifies a Portworx volume - type: string - required: - - volumeID - type: object - projected: - description: - projected items for all in one resources secrets, - configmaps, and downward API - properties: - defaultMode: - description: - defaultMode are the mode bits used to set permissions - on created files by default. Must be an octal value between - 0000 and 0777 or a decimal value between 0 and 511. YAML - accepts both octal and decimal values, JSON requires decimal - values for mode bits. Directories within the path are - not affected by this setting. This might be in conflict - with other options that affect the file mode, like fsGroup, - and the result can be other mode bits set. - format: int32 - type: integer - sources: - description: sources is the list of volume projections - items: - description: - Projection that may be projected along with - other supported volume types - properties: - configMap: - description: - configMap information about the configMap - data to project - properties: - items: - description: - items if unspecified, each key-value - pair in the Data field of the referenced ConfigMap - will be projected into the volume as a file - whose name is the key and content is the value. - If specified, the listed keys will be projected - into the specified paths, and unlisted keys - will not be present. If a key is specified which - is not present in the ConfigMap, the volume - setup will error unless it is marked optional. - Paths must be relative and may not contain the - '..' path or start with '..'. - items: - description: - Maps a string key to a path within - a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: - "mode is Optional: mode bits - used to set permissions on this file. - Must be an octal value between 0000 and - 0777 or a decimal value between 0 and - 511. YAML accepts both octal and decimal - values, JSON requires decimal values for - mode bits. If not specified, the volume - defaultMode will be used. This might be - in conflict with other options that affect - the file mode, like fsGroup, and the result - can be other mode bits set." - format: int32 - type: integer - path: - description: - path is the relative path of - the file to map the key to. May not be - an absolute path. May not contain the - path element '..'. May not start with - the string '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: - "Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?" - type: string - optional: - description: - optional specify whether the ConfigMap - or its keys must be defined - type: boolean - type: object - x-kubernetes-map-type: atomic - downwardAPI: - description: - downwardAPI information about the downwardAPI - data to project - properties: - items: - description: - Items is a list of DownwardAPIVolume - file - items: - description: - DownwardAPIVolumeFile represents - information to create the file containing - the pod field - properties: - fieldRef: - description: - "Required: Selects a field - of the pod: only annotations, labels, - name and namespace are supported." - properties: - apiVersion: - description: - Version of the schema the - FieldPath is written in terms of, - defaults to "v1". - type: string - fieldPath: - description: - Path of the field to select - in the specified API version. - type: string - required: - - fieldPath - type: object - x-kubernetes-map-type: atomic - mode: - description: - "Optional: mode bits used to - set permissions on this file, must be - an octal value between 0000 and 0777 or - a decimal value between 0 and 511. YAML - accepts both octal and decimal values, - JSON requires decimal values for mode - bits. If not specified, the volume defaultMode - will be used. This might be in conflict - with other options that affect the file - mode, like fsGroup, and the result can - be other mode bits set." - format: int32 - type: integer - path: - description: - "Required: Path is the relative - path name of the file to be created. Must - not be absolute or contain the '..' - path. Must be utf-8 encoded. The first - item of the relative path must not start - with '..'" - type: string - resourceFieldRef: - description: - "Selects a resource of the - container: only resources limits and requests - (limits.cpu, limits.memory, requests.cpu - and requests.memory) are currently supported." - properties: - containerName: - description: - "Container name: required - for volumes, optional for env vars" - type: string - divisor: - anyOf: - - type: integer - - type: string - description: - Specifies the output format - of the exposed resources, defaults - to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: - "Required: resource to - select" - type: string - required: - - resource - type: object - x-kubernetes-map-type: atomic - required: - - path - type: object - type: array - type: object - secret: - description: - secret information about the secret data - to project - properties: - items: - description: - items if unspecified, each key-value - pair in the Data field of the referenced Secret - will be projected into the volume as a file - whose name is the key and content is the value. - If specified, the listed keys will be projected - into the specified paths, and unlisted keys - will not be present. If a key is specified which - is not present in the Secret, the volume setup - will error unless it is marked optional. Paths - must be relative and may not contain the '..' - path or start with '..'. - items: - description: - Maps a string key to a path within - a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: - "mode is Optional: mode bits - used to set permissions on this file. - Must be an octal value between 0000 and - 0777 or a decimal value between 0 and - 511. YAML accepts both octal and decimal - values, JSON requires decimal values for - mode bits. If not specified, the volume - defaultMode will be used. This might be - in conflict with other options that affect - the file mode, like fsGroup, and the result - can be other mode bits set." - format: int32 - type: integer - path: - description: - path is the relative path of - the file to map the key to. May not be - an absolute path. May not contain the - path element '..'. May not start with - the string '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: - "Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?" - type: string - optional: - description: - optional field specify whether the - Secret or its key must be defined - type: boolean - type: object - x-kubernetes-map-type: atomic - serviceAccountToken: - description: - serviceAccountToken is information about - the serviceAccountToken data to project - properties: - audience: - description: - audience is the intended audience - of the token. A recipient of a token must identify - itself with an identifier specified in the audience - of the token, and otherwise should reject the - token. The audience defaults to the identifier - of the apiserver. - type: string - expirationSeconds: - description: - expirationSeconds is the requested - duration of validity of the service account - token. As the token approaches expiration, the - kubelet volume plugin will proactively rotate - the service account token. The kubelet will - start trying to rotate the token if the token - is older than 80 percent of its time to live - or if the token is older than 24 hours.Defaults - to 1 hour and must be at least 10 minutes. - format: int64 - type: integer - path: - description: - path is the path relative to the - mount point of the file to project the token - into. - type: string - required: - - path - type: object - type: object - type: array - type: object - quobyte: - description: - quobyte represents a Quobyte mount on the host - that shares a pod's lifetime - properties: - group: - description: - group to map volume access to Default is no - group - type: string - readOnly: - description: - readOnly here will force the Quobyte volume - to be mounted with read-only permissions. Defaults to - false. - type: boolean - registry: - description: - registry represents a single or multiple Quobyte - Registry services specified as a string as host:port pair - (multiple entries are separated with commas) which acts - as the central registry for volumes - type: string - tenant: - description: - tenant owning the given Quobyte volume in the - Backend Used with dynamically provisioned Quobyte volumes, - value is set by the plugin - type: string - user: - description: - user to map volume access to Defaults to serivceaccount - user - type: string - volume: - description: - volume is a string that references an already - created Quobyte volume by name. - type: string - required: - - registry - - volume - type: object - rbd: - description: - "rbd represents a Rados Block Device mount on the - host that shares a pod's lifetime. More info: https://examples.k8s.io/volumes/rbd/README.md" - properties: - fsType: - description: - 'fsType is the filesystem type of the volume - that you want to mount. Tip: Ensure that the filesystem - type is supported by the host operating system. Examples: - "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd - TODO: how do we prevent errors in the filesystem from - compromising the machine' - type: string - image: - description: - "image is the rados image name. More info: - https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it" - type: string - keyring: - description: - "keyring is the path to key ring for RBDUser. - Default is /etc/ceph/keyring. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it" - type: string - monitors: - description: - "monitors is a collection of Ceph monitors. - More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it" - items: + type: array + optional: + description: optional field specify whether the Secret or + its keys must be defined + type: boolean + secretName: + description: 'secretName is the name of the secret in the + pod''s namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret' + type: string + type: object + storageos: + description: storageOS represents a StorageOS volume attached + and mounted on Kubernetes nodes. + properties: + fsType: + description: fsType is the filesystem type to mount. Must + be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. + type: string + readOnly: + description: readOnly defaults to false (read/write). ReadOnly + here will force the ReadOnly setting in VolumeMounts. + type: boolean + secretRef: + description: secretRef specifies the secret to use for obtaining + the StorageOS API credentials. If not specified, default + values will be attempted. + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' type: string - type: array - pool: - description: - "pool is the rados pool name. Default is rbd. - More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it" - type: string - readOnly: - description: - "readOnly here will force the ReadOnly setting - in VolumeMounts. Defaults to false. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it" - type: boolean - secretRef: - description: - "secretRef is name of the authentication secret - for RBDUser. If provided overrides keyring. Default is - nil. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it" - properties: - name: - description: - "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?" - type: string - type: object - x-kubernetes-map-type: atomic - user: - description: - "user is the rados user name. Default is admin. - More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it" - type: string - required: - - image - - monitors - type: object - scaleIO: - description: - scaleIO represents a ScaleIO persistent volume - attached and mounted on Kubernetes nodes. - properties: - fsType: - description: - fsType is the filesystem type to mount. Must - be a filesystem type supported by the host operating system. - Ex. "ext4", "xfs", "ntfs". Default is "xfs". - type: string - gateway: - description: - gateway is the host address of the ScaleIO - API Gateway. - type: string - protectionDomain: - description: - protectionDomain is the name of the ScaleIO - Protection Domain for the configured storage. - type: string - readOnly: - description: - readOnly Defaults to false (read/write). ReadOnly - here will force the ReadOnly setting in VolumeMounts. - type: boolean - secretRef: - description: - secretRef references to the secret for ScaleIO - user and other sensitive information. If this is not provided, - Login operation will fail. - properties: - name: - description: - "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?" - type: string - type: object - x-kubernetes-map-type: atomic - sslEnabled: - description: - sslEnabled Flag enable/disable SSL communication - with Gateway, default false - type: boolean - storageMode: - description: - storageMode indicates whether the storage for - a volume should be ThickProvisioned or ThinProvisioned. - Default is ThinProvisioned. - type: string - storagePool: - description: - storagePool is the ScaleIO Storage Pool associated - with the protection domain. - type: string - system: - description: - system is the name of the storage system as - configured in ScaleIO. - type: string - volumeName: - description: - volumeName is the name of a volume already - created in the ScaleIO system that is associated with - this volume source. - type: string - required: - - gateway - - secretRef - - system - type: object - secret: - description: - "secret represents a secret that should populate - this volume. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret" - properties: - defaultMode: - description: - "defaultMode is Optional: mode bits used to - set permissions on created files by default. Must be an - octal value between 0000 and 0777 or a decimal value between - 0 and 511. YAML accepts both octal and decimal values, - JSON requires decimal values for mode bits. Defaults to - 0644. Directories within the path are not affected by - this setting. This might be in conflict with other options - that affect the file mode, like fsGroup, and the result - can be other mode bits set." - format: int32 - type: integer - items: - description: - items If unspecified, each key-value pair in - the Data field of the referenced Secret will be projected - into the volume as a file whose name is the key and content - is the value. If specified, the listed keys will be projected - into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in - the Secret, the volume setup will error unless it is marked - optional. Paths must be relative and may not contain the - '..' path or start with '..'. - items: - description: Maps a string key to a path within a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: - "mode is Optional: mode bits used to - set permissions on this file. Must be an octal value - between 0000 and 0777 or a decimal value between - 0 and 511. YAML accepts both octal and decimal values, - JSON requires decimal values for mode bits. If not - specified, the volume defaultMode will be used. - This might be in conflict with other options that - affect the file mode, like fsGroup, and the result - can be other mode bits set." - format: int32 - type: integer - path: - description: - path is the relative path of the file - to map the key to. May not be an absolute path. - May not contain the path element '..'. May not start - with the string '..'. - type: string - required: - - key - - path - type: object - type: array - optional: - description: - optional field specify whether the Secret or - its keys must be defined - type: boolean - secretName: - description: - "secretName is the name of the secret in the - pod's namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret" - type: string - type: object - storageos: - description: - storageOS represents a StorageOS volume attached - and mounted on Kubernetes nodes. - properties: - fsType: - description: - fsType is the filesystem type to mount. Must - be a filesystem type supported by the host operating system. - Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. - type: string - readOnly: - description: - readOnly defaults to false (read/write). ReadOnly - here will force the ReadOnly setting in VolumeMounts. - type: boolean - secretRef: - description: - secretRef specifies the secret to use for obtaining - the StorageOS API credentials. If not specified, default - values will be attempted. - properties: - name: - description: - "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?" - type: string - type: object - x-kubernetes-map-type: atomic - volumeName: - description: - volumeName is the human-readable name of the - StorageOS volume. Volume names are only unique within - a namespace. - type: string - volumeNamespace: - description: - volumeNamespace specifies the scope of the - volume within StorageOS. If no namespace is specified - then the Pod's namespace will be used. This allows the - Kubernetes name scoping to be mirrored within StorageOS - for tighter integration. Set VolumeName to any name to - override the default behaviour. Set to "default" if you - are not using namespaces within StorageOS. Namespaces - that do not pre-exist within StorageOS will be created. - type: string - type: object - vsphereVolume: - description: - vsphereVolume represents a vSphere volume attached - and mounted on kubelets host machine - properties: - fsType: - description: - fsType is filesystem type to mount. Must be - a filesystem type supported by the host operating system. - Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. - type: string - storagePolicyID: - description: - storagePolicyID is the storage Policy Based - Management (SPBM) profile ID associated with the StoragePolicyName. - type: string - storagePolicyName: - description: - storagePolicyName is the storage Policy Based - Management (SPBM) profile name. - type: string - volumePath: - description: - volumePath is the path that identifies vSphere - volume vmdk - type: string - required: - - volumePath - type: object - required: - - name - type: object - type: array - type: object - status: - description: ParseDefinitionStatus defines the observed state of ParseDefinition - type: object - type: object - served: true - storage: true - subresources: {} + type: object + x-kubernetes-map-type: atomic + volumeName: + description: volumeName is the human-readable name of the + StorageOS volume. Volume names are only unique within + a namespace. + type: string + volumeNamespace: + description: volumeNamespace specifies the scope of the + volume within StorageOS. If no namespace is specified + then the Pod's namespace will be used. This allows the + Kubernetes name scoping to be mirrored within StorageOS + for tighter integration. Set VolumeName to any name to + override the default behaviour. Set to "default" if you + are not using namespaces within StorageOS. Namespaces + that do not pre-exist within StorageOS will be created. + type: string + type: object + vsphereVolume: + description: vsphereVolume represents a vSphere volume attached + and mounted on kubelets host machine + properties: + fsType: + description: fsType is filesystem type to mount. Must be + a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. + type: string + storagePolicyID: + description: storagePolicyID is the storage Policy Based + Management (SPBM) profile ID associated with the StoragePolicyName. + type: string + storagePolicyName: + description: storagePolicyName is the storage Policy Based + Management (SPBM) profile name. + type: string + volumePath: + description: volumePath is the path that identifies vSphere + volume vmdk + type: string + required: + - volumePath + type: object + required: + - name + type: object + type: array + type: object + status: + description: ParseDefinitionStatus defines the observed state of ParseDefinition + type: object + type: object + served: true + storage: true + subresources: {} diff --git a/operator/crds/execution.securecodebox.io_parsedefinitions.yaml b/operator/crds/execution.securecodebox.io_parsedefinitions.yaml index 8a6a982885..b39eb0852f 100644 --- a/operator/crds/execution.securecodebox.io_parsedefinitions.yaml +++ b/operator/crds/execution.securecodebox.io_parsedefinitions.yaml @@ -1,7 +1,3 @@ -# SPDX-FileCopyrightText: the secureCodeBox authors -# -# SPDX-License-Identifier: Apache-2.0 - --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -19,3001 +15,2640 @@ spec: singular: parsedefinition scope: Namespaced versions: - - additionalPrinterColumns: - - description: Scanner Container Image - jsonPath: .spec.image - name: Image - type: string - name: v1 - schema: - openAPIV3Schema: - description: ParseDefinition is the Schema for the parsedefinitions API - properties: - apiVersion: - description: - "APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources" - type: string - kind: - description: - "Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" - type: string - metadata: - type: object - spec: - description: ParseDefinitionSpec defines the desired state of ParseDefinition - properties: - affinity: - description: - "Affinity allows to specify a node affinity, to control - on which nodes you want a parser to run. See: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/" - properties: - nodeAffinity: - description: - Describes node affinity scheduling rules for the - pod. - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: - The scheduler will prefer to schedule pods to - nodes that satisfy the affinity expressions specified by - this field, but it may choose a node that violates one or - more of the expressions. The node that is most preferred - is the one with the greatest sum of weights, i.e. for each - node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, - etc.), compute a sum by iterating through the elements of - this field and adding "weight" to the sum if the node matches - the corresponding matchExpressions; the node(s) with the - highest sum are the most preferred. - items: - description: - An empty preferred scheduling term matches - all objects with implicit weight 0 (i.e. it's a no-op). - A null preferred scheduling term matches no objects (i.e. - is also a no-op). - properties: - preference: - description: - A node selector term, associated with the - corresponding weight. - properties: - matchExpressions: - description: - A list of node selector requirements - by node's labels. - items: - description: - A node selector requirement is a - selector that contains values, a key, and an - operator that relates the key and values. - properties: - key: - description: - The label key that the selector - applies to. + - additionalPrinterColumns: + - description: Scanner Container Image + jsonPath: .spec.image + name: Image + type: string + name: v1 + schema: + openAPIV3Schema: + description: ParseDefinition is the Schema for the parsedefinitions API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ParseDefinitionSpec defines the desired state of ParseDefinition + properties: + affinity: + description: 'Affinity allows to specify a node affinity, to control + on which nodes you want a parser to run. See: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/' + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the + pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to + nodes that satisfy the affinity expressions specified by + this field, but it may choose a node that violates one or + more of the expressions. The node that is most preferred + is the one with the greatest sum of weights, i.e. for each + node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, + etc.), compute a sum by iterating through the elements of + this field and adding "weight" to the sum if the node matches + the corresponding matchExpressions; the node(s) with the + highest sum are the most preferred. + items: + description: An empty preferred scheduling term matches + all objects with implicit weight 0 (i.e. it's a no-op). + A null preferred scheduling term matches no objects (i.e. + is also a no-op). + properties: + preference: + description: A node selector term, associated with the + corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: A node selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. + type: string + values: + description: An array of string values. If + the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values array + must be empty. If the operator is Gt or + Lt, the values array must have a single + element, which will be interpreted as an + integer. This array is replaced during a + strategic merge patch. + items: type: string - operator: - description: - Represents a key's relationship - to a set of values. Valid operators are - In, NotIn, Exists, DoesNotExist. Gt, and - Lt. + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: A node selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. + type: string + values: + description: An array of string values. If + the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values array + must be empty. If the operator is Gt or + Lt, the values array must have a single + element, which will be interpreted as an + integer. This array is replaced during a + strategic merge patch. + items: type: string - values: - description: - An array of string values. If - the operator is In or NotIn, the values - array must be non-empty. If the operator - is Exists or DoesNotExist, the values array - must be empty. If the operator is Gt or - Lt, the values array must have a single - element, which will be interpreted as an - integer. This array is replaced during a - strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchFields: - description: - A list of node selector requirements - by node's fields. - items: - description: - A node selector requirement is a - selector that contains values, a key, and an - operator that relates the key and values. - properties: - key: - description: - The label key that the selector - applies to. + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the corresponding + nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this + field are not met at scheduling time, the pod will not be + scheduled onto the node. If the affinity requirements specified + by this field cease to be met at some point during pod execution + (e.g. due to an update), the system may or may not try to + eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. + items: + description: A null or empty node selector term matches + no objects. The requirements of them are ANDed. The + TopologySelectorTerm type implements a subset of the + NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: A node selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. + type: string + values: + description: An array of string values. If + the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values array + must be empty. If the operator is Gt or + Lt, the values array must have a single + element, which will be interpreted as an + integer. This array is replaced during a + strategic merge patch. + items: type: string - operator: - description: - Represents a key's relationship - to a set of values. Valid operators are - In, NotIn, Exists, DoesNotExist. Gt, and - Lt. + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: A node selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. + type: string + values: + description: An array of string values. If + the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values array + must be empty. If the operator is Gt or + Lt, the values array must have a single + element, which will be interpreted as an + integer. This array is replaced during a + strategic merge patch. + items: type: string - values: - description: - An array of string values. If - the operator is In or NotIn, the values - array must be non-empty. If the operator - is Exists or DoesNotExist, the values array - must be empty. If the operator is Gt or - Lt, the values array must have a single - element, which will be interpreted as an - integer. This array is replaced during a - strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - type: object - x-kubernetes-map-type: atomic - weight: - description: - Weight associated with matching the corresponding - nodeSelectorTerm, in the range 1-100. - format: int32 - type: integer - required: - - preference - - weight - type: object - type: array - requiredDuringSchedulingIgnoredDuringExecution: - description: - If the affinity requirements specified by this - field are not met at scheduling time, the pod will not be - scheduled onto the node. If the affinity requirements specified - by this field cease to be met at some point during pod execution - (e.g. due to an update), the system may or may not try to - eventually evict the pod from its node. + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate + this pod in the same node, zone, etc. as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to + nodes that satisfy the affinity expressions specified by + this field, but it may choose a node that violates one or + more of the expressions. The node that is most preferred + is the one with the greatest sum of weights, i.e. for each + node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, + etc.), compute a sum by iterating through the elements of + this field and adding "weight" to the sum if the node has + pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred node(s) properties: - nodeSelectorTerms: - description: - Required. A list of node selector terms. - The terms are ORed. - items: - description: - A null or empty node selector term matches - no objects. The requirements of them are ANDed. The - TopologySelectorTerm type implements a subset of the - NodeSelectorTerm. - properties: - matchExpressions: - description: - A list of node selector requirements - by node's labels. - items: - description: - A node selector requirement is a - selector that contains values, a key, and an - operator that relates the key and values. - properties: - key: - description: - The label key that the selector - applies to. - type: string - operator: - description: - Represents a key's relationship - to a set of values. Valid operators are - In, NotIn, Exists, DoesNotExist. Gt, and - Lt. - type: string - values: - description: - An array of string values. If - the operator is In or NotIn, the values - array must be non-empty. If the operator - is Exists or DoesNotExist, the values array - must be empty. If the operator is Gt or - Lt, the values array must have a single - element, which will be interpreted as an - integer. This array is replaced during a - strategic merge patch. - items: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: A label query over a set of resources, + in this case pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: A label selector requirement + is a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: key is the label key that + the selector applies to. type: string - type: array - required: + operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: - key - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only "value". + The requirements are ANDed. type: object - type: array - matchFields: - description: - A list of node selector requirements - by node's fields. - items: - description: - A node selector requirement is a - selector that contains values, a key, and an - operator that relates the key and values. - properties: - key: - description: - The label key that the selector - applies to. - type: string - operator: - description: - Represents a key's relationship - to a set of values. Valid operators are - In, NotIn, Exists, DoesNotExist. Gt, and - Lt. - type: string - values: - description: - An array of string values. If - the operator is In or NotIn, the values - array must be non-empty. If the operator - is Exists or DoesNotExist, the values array - must be empty. If the operator is Gt or - Lt, the values array must have a single - element, which will be interpreted as an - integer. This array is replaced during a - strategic merge patch. - items: + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + description: A label query over the set of namespaces + that the term applies to. The term is applied + to the union of the namespaces selected by this + field and the ones listed in the namespaces field. + null selector and null or empty namespaces list + means "this pod's namespace". An empty selector + ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: A label selector requirement + is a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: key is the label key that + the selector applies to. type: string - type: array - required: + operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: - key - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only "value". + The requirements are ANDed. type: object - type: array - type: object - x-kubernetes-map-type: atomic - type: array + type: object + x-kubernetes-map-type: atomic + namespaces: + description: namespaces specifies a static list + of namespace names that the term applies to. The + term is applied to the union of the namespaces + listed in this field and the ones selected by + namespaceSelector. null or empty namespaces list + and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods + matching the labelSelector in the specified namespaces, + where co-located is defined as running on a node + whose value of the label with key topologyKey + matches that of any node on which any of the selected + pods is running. Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: weight associated with matching the corresponding + podAffinityTerm, in the range 1-100. + format: int32 + type: integer required: - - nodeSelectorTerms + - podAffinityTerm + - weight type: object - x-kubernetes-map-type: atomic - type: object - podAffinity: - description: - Describes pod affinity scheduling rules (e.g. co-locate - this pod in the same node, zone, etc. as some other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: - The scheduler will prefer to schedule pods to - nodes that satisfy the affinity expressions specified by - this field, but it may choose a node that violates one or - more of the expressions. The node that is most preferred - is the one with the greatest sum of weights, i.e. for each - node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, - etc.), compute a sum by iterating through the elements of - this field and adding "weight" to the sum if the node has - pods which matches the corresponding podAffinityTerm; the - node(s) with the highest sum are the most preferred. - items: - description: - The weights of all of the matched WeightedPodAffinityTerm - fields are added per-node to find the most preferred node(s) - properties: - podAffinityTerm: - description: - Required. A pod affinity term, associated - with the corresponding weight. - properties: - labelSelector: - description: - A label query over a set of resources, - in this case pods. + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this + field are not met at scheduling time, the pod will not be + scheduled onto the node. If the affinity requirements specified + by this field cease to be met at some point during pod execution + (e.g. due to a pod label update), the system may or may + not try to eventually evict the pod from its node. When + there are multiple elements, the lists of nodes corresponding + to each podAffinityTerm are intersected, i.e. all terms + must be satisfied. + items: + description: Defines a set of pods (namely those matching + the labelSelector relative to the given namespace(s)) + that this pod should be co-located (affinity) or not co-located + (anti-affinity) with, where co-located is defined as running + on a node whose value of the label with key + matches that of any node on which a pod of the set of + pods is running + properties: + labelSelector: + description: A label query over a set of resources, + in this case pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are ANDed. + items: + description: A label selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. properties: - matchExpressions: - description: - matchExpressions is a list of label - selector requirements. The requirements are - ANDed. + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: operator represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. If the + operator is Exists or DoesNotExist, the + values array must be empty. This array is + replaced during a strategic merge patch. items: - description: - A label selector requirement - is a selector that contains values, a key, - and an operator that relates the key and - values. - properties: - key: - description: - key is the label key that - the selector applies to. - type: string - operator: - description: - operator represents a key's - relationship to a set of values. Valid - operators are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: - values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. - If the operator is Exists or DoesNotExist, - the values array must be empty. This - array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: type: string - description: - matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is - "In", and the values array contains only "value". - The requirements are ANDed. - type: object + type: array + required: + - key + - operator type: object - x-kubernetes-map-type: atomic - namespaceSelector: - description: - A label query over the set of namespaces - that the term applies to. The term is applied - to the union of the namespaces selected by this - field and the ones listed in the namespaces field. - null selector and null or empty namespaces list - means "this pod's namespace". An empty selector - ({}) matches all namespaces. + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is "In", + and the values array contains only "value". The + requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + description: A label query over the set of namespaces + that the term applies to. The term is applied to the + union of the namespaces selected by this field and + the ones listed in the namespaces field. null selector + and null or empty namespaces list means "this pod's + namespace". An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are ANDed. + items: + description: A label selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. properties: - matchExpressions: - description: - matchExpressions is a list of label - selector requirements. The requirements are - ANDed. + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: operator represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. If the + operator is Exists or DoesNotExist, the + values array must be empty. This array is + replaced during a strategic merge patch. items: - description: - A label selector requirement - is a selector that contains values, a key, - and an operator that relates the key and - values. - properties: - key: - description: - key is the label key that - the selector applies to. - type: string - operator: - description: - operator represents a key's - relationship to a set of values. Valid - operators are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: - values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. - If the operator is Exists or DoesNotExist, - the values array must be empty. This - array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: type: string - description: - matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is - "In", and the values array contains only "value". - The requirements are ANDed. - type: object + type: array + required: + - key + - operator type: object - x-kubernetes-map-type: atomic - namespaces: - description: - namespaces specifies a static list - of namespace names that the term applies to. The - term is applied to the union of the namespaces - listed in this field and the ones selected by - namespaceSelector. null or empty namespaces list - and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - topologyKey: - description: - This pod should be co-located (affinity) - or not co-located (anti-affinity) with the pods - matching the labelSelector in the specified namespaces, - where co-located is defined as running on a node - whose value of the label with key topologyKey - matches that of any node on which any of the selected - pods is running. Empty topologyKey is not allowed. + type: array + matchLabels: + additionalProperties: type: string - required: - - topologyKey - type: object - weight: - description: - weight associated with matching the corresponding - podAffinityTerm, in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - requiredDuringSchedulingIgnoredDuringExecution: - description: - If the affinity requirements specified by this - field are not met at scheduling time, the pod will not be - scheduled onto the node. If the affinity requirements specified - by this field cease to be met at some point during pod execution - (e.g. due to a pod label update), the system may or may - not try to eventually evict the pod from its node. When - there are multiple elements, the lists of nodes corresponding - to each podAffinityTerm are intersected, i.e. all terms - must be satisfied. - items: - description: - Defines a set of pods (namely those matching - the labelSelector relative to the given namespace(s)) - that this pod should be co-located (affinity) or not co-located - (anti-affinity) with, where co-located is defined as running - on a node whose value of the label with key - matches that of any node on which a pod of the set of - pods is running - properties: - labelSelector: - description: - A label query over a set of resources, - in this case pods. - properties: - matchExpressions: - description: - matchExpressions is a list of label - selector requirements. The requirements are ANDed. - items: - description: - A label selector requirement is a - selector that contains values, a key, and an - operator that relates the key and values. - properties: - key: - description: - key is the label key that the - selector applies to. - type: string - operator: - description: - operator represents a key's relationship - to a set of values. Valid operators are - In, NotIn, Exists and DoesNotExist. - type: string - values: - description: - values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. If the - operator is Exists or DoesNotExist, the - values array must be empty. This array is - replaced during a strategic merge patch. - items: + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is "In", + and the values array contains only "value". The + requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: namespaces specifies a static list of namespace + names that the term applies to. The term is applied + to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. null or + empty namespaces list and null namespaceSelector means + "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where + co-located is defined as running on a node whose value + of the label with key topologyKey matches that of + any node on which any of the selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. + avoid putting this pod in the same node, zone, etc. as some + other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to + nodes that satisfy the anti-affinity expressions specified + by this field, but it may choose a node that violates one + or more of the expressions. The node that is most preferred + is the one with the greatest sum of weights, i.e. for each + node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, + etc.), compute a sum by iterating through the elements of + this field and adding "weight" to the sum if the node has + pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: A label query over a set of resources, + in this case pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: A label selector requirement + is a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: key is the label key that + the selector applies to. type: string - type: array - required: + operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: - key - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only "value". + The requirements are ANDed. type: object - type: array - matchLabels: - additionalProperties: - type: string - description: - matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is "In", - and the values array contains only "value". The - requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaceSelector: - description: - A label query over the set of namespaces - that the term applies to. The term is applied to the - union of the namespaces selected by this field and - the ones listed in the namespaces field. null selector - and null or empty namespaces list means "this pod's - namespace". An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: - matchExpressions is a list of label - selector requirements. The requirements are ANDed. - items: - description: - A label selector requirement is a - selector that contains values, a key, and an - operator that relates the key and values. - properties: - key: - description: - key is the label key that the - selector applies to. - type: string - operator: - description: - operator represents a key's relationship - to a set of values. Valid operators are - In, NotIn, Exists and DoesNotExist. - type: string - values: - description: - values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. If the - operator is Exists or DoesNotExist, the - values array must be empty. This array is - replaced during a strategic merge patch. - items: + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + description: A label query over the set of namespaces + that the term applies to. The term is applied + to the union of the namespaces selected by this + field and the ones listed in the namespaces field. + null selector and null or empty namespaces list + means "this pod's namespace". An empty selector + ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: A label selector requirement + is a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: key is the label key that + the selector applies to. type: string - type: array - required: + operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: - key - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only "value". + The requirements are ANDed. type: object - type: array - matchLabels: - additionalProperties: - type: string - description: - matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is "In", - and the values array contains only "value". The - requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: - namespaces specifies a static list of namespace - names that the term applies to. The term is applied - to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. null or - empty namespaces list and null namespaceSelector means - "this pod's namespace". - items: + type: object + x-kubernetes-map-type: atomic + namespaces: + description: namespaces specifies a static list + of namespace names that the term applies to. The + term is applied to the union of the namespaces + listed in this field and the ones selected by + namespaceSelector. null or empty namespaces list + and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods + matching the labelSelector in the specified namespaces, + where co-located is defined as running on a node + whose value of the label with key topologyKey + matches that of any node on which any of the selected + pods is running. Empty topologyKey is not allowed. type: string - type: array - topologyKey: - description: - This pod should be co-located (affinity) - or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where - co-located is defined as running on a node whose value - of the label with key topologyKey matches that of - any node on which any of the selected pods is running. - Empty topologyKey is not allowed. - type: string - required: + required: - topologyKey - type: object - type: array - type: object - podAntiAffinity: - description: - Describes pod anti-affinity scheduling rules (e.g. - avoid putting this pod in the same node, zone, etc. as some - other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: - The scheduler will prefer to schedule pods to - nodes that satisfy the anti-affinity expressions specified - by this field, but it may choose a node that violates one - or more of the expressions. The node that is most preferred - is the one with the greatest sum of weights, i.e. for each - node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling anti-affinity expressions, - etc.), compute a sum by iterating through the elements of - this field and adding "weight" to the sum if the node has - pods which matches the corresponding podAffinityTerm; the - node(s) with the highest sum are the most preferred. - items: - description: - The weights of all of the matched WeightedPodAffinityTerm - fields are added per-node to find the most preferred node(s) - properties: - podAffinityTerm: - description: - Required. A pod affinity term, associated - with the corresponding weight. - properties: - labelSelector: - description: - A label query over a set of resources, - in this case pods. + type: object + weight: + description: weight associated with matching the corresponding + podAffinityTerm, in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: If the anti-affinity requirements specified by + this field are not met at scheduling time, the pod will + not be scheduled onto the node. If the anti-affinity requirements + specified by this field cease to be met at some point during + pod execution (e.g. due to a pod label update), the system + may or may not try to eventually evict the pod from its + node. When there are multiple elements, the lists of nodes + corresponding to each podAffinityTerm are intersected, i.e. + all terms must be satisfied. + items: + description: Defines a set of pods (namely those matching + the labelSelector relative to the given namespace(s)) + that this pod should be co-located (affinity) or not co-located + (anti-affinity) with, where co-located is defined as running + on a node whose value of the label with key + matches that of any node on which a pod of the set of + pods is running + properties: + labelSelector: + description: A label query over a set of resources, + in this case pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are ANDed. + items: + description: A label selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. properties: - matchExpressions: - description: - matchExpressions is a list of label - selector requirements. The requirements are - ANDed. + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: operator represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. If the + operator is Exists or DoesNotExist, the + values array must be empty. This array is + replaced during a strategic merge patch. items: - description: - A label selector requirement - is a selector that contains values, a key, - and an operator that relates the key and - values. - properties: - key: - description: - key is the label key that - the selector applies to. - type: string - operator: - description: - operator represents a key's - relationship to a set of values. Valid - operators are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: - values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. - If the operator is Exists or DoesNotExist, - the values array must be empty. This - array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: type: string - description: - matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is - "In", and the values array contains only "value". - The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaceSelector: - description: - A label query over the set of namespaces - that the term applies to. The term is applied - to the union of the namespaces selected by this - field and the ones listed in the namespaces field. - null selector and null or empty namespaces list - means "this pod's namespace". An empty selector - ({}) matches all namespaces. + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is "In", + and the values array contains only "value". The + requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + description: A label query over the set of namespaces + that the term applies to. The term is applied to the + union of the namespaces selected by this field and + the ones listed in the namespaces field. null selector + and null or empty namespaces list means "this pod's + namespace". An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are ANDed. + items: + description: A label selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. properties: - matchExpressions: - description: - matchExpressions is a list of label - selector requirements. The requirements are - ANDed. + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: operator represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. If the + operator is Exists or DoesNotExist, the + values array must be empty. This array is + replaced during a strategic merge patch. items: - description: - A label selector requirement - is a selector that contains values, a key, - and an operator that relates the key and - values. - properties: - key: - description: - key is the label key that - the selector applies to. - type: string - operator: - description: - operator represents a key's - relationship to a set of values. Valid - operators are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: - values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. - If the operator is Exists or DoesNotExist, - the values array must be empty. This - array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: type: string - description: - matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is - "In", and the values array contains only "value". - The requirements are ANDed. - type: object + type: array + required: + - key + - operator type: object - x-kubernetes-map-type: atomic - namespaces: - description: - namespaces specifies a static list - of namespace names that the term applies to. The - term is applied to the union of the namespaces - listed in this field and the ones selected by - namespaceSelector. null or empty namespaces list - and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - topologyKey: - description: - This pod should be co-located (affinity) - or not co-located (anti-affinity) with the pods - matching the labelSelector in the specified namespaces, - where co-located is defined as running on a node - whose value of the label with key topologyKey - matches that of any node on which any of the selected - pods is running. Empty topologyKey is not allowed. + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is "In", + and the values array contains only "value". The + requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: namespaces specifies a static list of namespace + names that the term applies to. The term is applied + to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. null or + empty namespaces list and null namespaceSelector means + "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where + co-located is defined as running on a node whose value + of the label with key topologyKey matches that of + any node on which any of the selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + encodingType: + description: 'EncodingType specifies the encoding type of the scan + result Valid values are: - "Text" (default): the scan result is + a text file - "Binary": the scan result is a binary file' + type: string + env: + description: Env allows to specify environment vars for the parser + container. + items: + description: EnvVar represents an environment variable present in + a Container. + properties: + name: + description: Name of the environment variable. Must be a C_IDENTIFIER. + type: string + value: + description: 'Variable references $(VAR_NAME) are expanded using + the previously defined environment variables in the container + and any service environment variables. If a variable cannot + be resolved, the reference in the input string will be unchanged. + Double $$ are reduced to a single $, which allows for escaping + the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the + string literal "$(VAR_NAME)". Escaped references will never + be expanded, regardless of whether the variable exists or + not. Defaults to "".' + type: string + valueFrom: + description: Source for the environment variable's value. Cannot + be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: 'Selects a field of the pod: supports metadata.name, + metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, + status.podIP, status.podIPs.' + properties: + apiVersion: + description: Version of the schema the FieldPath is + written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the specified + API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: 'Selects a resource of the container: only + resources limits and requests (limits.cpu, limits.memory, + limits.ephemeral-storage, requests.cpu, requests.memory + and requests.ephemeral-storage) are currently supported.' + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of the exposed + resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's namespace + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + image: + description: Image is the reference to the parser container image + which ca transform the raw scan report into findings + type: string + imagePullPolicy: + description: 'Image pull policy. One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent + otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images' + type: string + imagePullSecrets: + description: ImagePullSecrets used to access private parser images + items: + description: LocalObjectReference contains enough information to + let you locate the referenced object inside the same namespace. + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + type: array + resources: + default: + limits: + cpu: 400m + memory: 200Mi + requests: + cpu: 200m + memory: 100Mi + description: Resources lets you control resource limits and requests + for the parser container. See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount of compute resources + allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount of compute + resources required. If Requests is omitted for a container, + it defaults to Limits if that is explicitly specified, otherwise + to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + type: object + type: object + scopeLimiterAliases: + additionalProperties: + type: string + type: object + tolerations: + description: Tolerations are a different way to control on which nodes + your parser is executed. See https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ + items: + description: The pod this Toleration is attached to tolerates any + taint that matches the triple using the matching + operator . + properties: + effect: + description: Effect indicates the taint effect to match. Empty + means match all taint effects. When specified, allowed values + are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: Key is the taint key that the toleration applies + to. Empty means match all taint keys. If the key is empty, + operator must be Exists; this combination means to match all + values and all keys. + type: string + operator: + description: Operator represents a key's relationship to the + value. Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod + can tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: TolerationSeconds represents the period of time + the toleration (which must be of effect NoExecute, otherwise + this field is ignored) tolerates the taint. By default, it + is not set, which means tolerate the taint forever (do not + evict). Zero and negative values will be treated as 0 (evict + immediately) by the system. + format: int64 + type: integer + value: + description: Value is the taint value the toleration matches + to. If the operator is Exists, the value should be empty, + otherwise just a regular string. + type: string + type: object + type: array + ttlSecondsAfterFinished: + description: TTLSecondsAfterFinished configures the ttlSecondsAfterFinished + field for the created parse job + format: int32 + nullable: true + type: integer + volumeMounts: + description: VolumeMounts allows to specify volume mounts for the + parser container. + items: + description: VolumeMount describes a mounting of a Volume within + a container. + properties: + mountPath: + description: Path within the container at which the volume should + be mounted. Must not contain ':'. + type: string + mountPropagation: + description: mountPropagation determines how mounts are propagated + from the host to container and the other way around. When + not set, MountPropagationNone is used. This field is beta + in 1.10. + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: Mounted read-only if true, read-write otherwise + (false or unspecified). Defaults to false. + type: boolean + subPath: + description: Path within the volume from which the container's + volume should be mounted. Defaults to "" (volume's root). + type: string + subPathExpr: + description: Expanded path within the volume from which the + container's volume should be mounted. Behaves similarly to + SubPath but environment variable references $(VAR_NAME) are + expanded using the container's environment. Defaults to "" + (volume's root). SubPathExpr and SubPath are mutually exclusive. + type: string + required: + - mountPath + - name + type: object + type: array + volumes: + description: Volumes allows to specify volumes for the parser container. + items: + description: Volume represents a named volume in a pod that may + be accessed by any container in the pod. + properties: + awsElasticBlockStore: + description: 'awsElasticBlockStore represents an AWS Disk resource + that is attached to a kubelet''s host machine and then exposed + to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' + properties: + fsType: + description: 'fsType is the filesystem type of the volume + that you want to mount. Tip: Ensure that the filesystem + type is supported by the host operating system. Examples: + "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + TODO: how do we prevent errors in the filesystem from + compromising the machine' + type: string + partition: + description: 'partition is the partition in the volume that + you want to mount. If omitted, the default is to mount + by volume name. Examples: For volume /dev/sda1, you specify + the partition as "1". Similarly, the volume partition + for /dev/sda is "0" (or you can leave the property empty).' + format: int32 + type: integer + readOnly: + description: 'readOnly value true will force the readOnly + setting in VolumeMounts. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' + type: boolean + volumeID: + description: 'volumeID is unique ID of the persistent disk + resource in AWS (Amazon EBS volume). More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' + type: string + required: + - volumeID + type: object + azureDisk: + description: azureDisk represents an Azure Data Disk mount on + the host and bind mount to the pod. + properties: + cachingMode: + description: 'cachingMode is the Host Caching mode: None, + Read Only, Read Write.' + type: string + diskName: + description: diskName is the Name of the data disk in the + blob storage + type: string + diskURI: + description: diskURI is the URI of data disk in the blob + storage + type: string + fsType: + description: fsType is Filesystem type to mount. Must be + a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. + type: string + kind: + description: 'kind expected values are Shared: multiple + blob disks per storage account Dedicated: single blob + disk per storage account Managed: azure managed data + disk (only in managed availability set). defaults to shared' + type: string + readOnly: + description: readOnly Defaults to false (read/write). ReadOnly + here will force the ReadOnly setting in VolumeMounts. + type: boolean + required: + - diskName + - diskURI + type: object + azureFile: + description: azureFile represents an Azure File Service mount + on the host and bind mount to the pod. + properties: + readOnly: + description: readOnly defaults to false (read/write). ReadOnly + here will force the ReadOnly setting in VolumeMounts. + type: boolean + secretName: + description: secretName is the name of secret that contains + Azure Storage Account Name and Key + type: string + shareName: + description: shareName is the azure share Name + type: string + required: + - secretName + - shareName + type: object + cephfs: + description: cephFS represents a Ceph FS mount on the host that + shares a pod's lifetime + properties: + monitors: + description: 'monitors is Required: Monitors is a collection + of Ceph monitors More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' + items: + type: string + type: array + path: + description: 'path is Optional: Used as the mounted root, + rather than the full Ceph tree, default is /' + type: string + readOnly: + description: 'readOnly is Optional: Defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in VolumeMounts. + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' + type: boolean + secretFile: + description: 'secretFile is Optional: SecretFile is the + path to key ring for User, default is /etc/ceph/user.secret + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' + type: string + secretRef: + description: 'secretRef is Optional: SecretRef is reference + to the authentication secret for User, default is empty. + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + user: + description: 'user is optional: User is the rados user name, + default is admin More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' + type: string + required: + - monitors + type: object + cinder: + description: 'cinder represents a cinder volume attached and + mounted on kubelets host machine. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' + properties: + fsType: + description: 'fsType is the filesystem type to mount. Must + be a filesystem type supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to + be "ext4" if unspecified. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' + type: string + readOnly: + description: 'readOnly defaults to false (read/write). ReadOnly + here will force the ReadOnly setting in VolumeMounts. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md' + type: boolean + secretRef: + description: 'secretRef is optional: points to a secret + object containing parameters used to connect to OpenStack.' + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + volumeID: + description: 'volumeID used to identify the volume in cinder. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md' + type: string + required: + - volumeID + type: object + configMap: + description: configMap represents a configMap that should populate + this volume + properties: + defaultMode: + description: 'defaultMode is optional: mode bits used to + set permissions on created files by default. Must be an + octal value between 0000 and 0777 or a decimal value between + 0 and 511. YAML accepts both octal and decimal values, + JSON requires decimal values for mode bits. Defaults to + 0644. Directories within the path are not affected by + this setting. This might be in conflict with other options + that affect the file mode, like fsGroup, and the result + can be other mode bits set.' + format: int32 + type: integer + items: + description: items if unspecified, each key-value pair in + the Data field of the referenced ConfigMap will be projected + into the volume as a file whose name is the key and content + is the value. If specified, the listed keys will be projected + into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in + the ConfigMap, the volume setup will error unless it is + marked optional. Paths must be relative and may not contain + the '..' path or start with '..'. + items: + description: Maps a string key to a path within a volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: 'mode is Optional: mode bits used to + set permissions on this file. Must be an octal value + between 0000 and 0777 or a decimal value between + 0 and 511. YAML accepts both octal and decimal values, + JSON requires decimal values for mode bits. If not + specified, the volume defaultMode will be used. + This might be in conflict with other options that + affect the file mode, like fsGroup, and the result + can be other mode bits set.' + format: int32 + type: integer + path: + description: path is the relative path of the file + to map the key to. May not be an absolute path. + May not contain the path element '..'. May not start + with the string '..'. + type: string + required: + - key + - path + type: object + type: array + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: optional specify whether the ConfigMap or its + keys must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + csi: + description: csi (Container Storage Interface) represents ephemeral + storage that is handled by certain external CSI drivers (Beta + feature). + properties: + driver: + description: driver is the name of the CSI driver that handles + this volume. Consult with your admin for the correct name + as registered in the cluster. + type: string + fsType: + description: fsType to mount. Ex. "ext4", "xfs", "ntfs". + If not provided, the empty value is passed to the associated + CSI driver which will determine the default filesystem + to apply. + type: string + nodePublishSecretRef: + description: nodePublishSecretRef is a reference to the + secret object containing sensitive information to pass + to the CSI driver to complete the CSI NodePublishVolume + and NodeUnpublishVolume calls. This field is optional, + and may be empty if no secret is required. If the secret + object contains more than one secret, all secret references + are passed. + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + readOnly: + description: readOnly specifies a read-only configuration + for the volume. Defaults to false (read/write). + type: boolean + volumeAttributes: + additionalProperties: + type: string + description: volumeAttributes stores driver-specific properties + that are passed to the CSI driver. Consult your driver's + documentation for supported values. + type: object + required: + - driver + type: object + downwardAPI: + description: downwardAPI represents downward API about the pod + that should populate this volume + properties: + defaultMode: + description: 'Optional: mode bits to use on created files + by default. Must be a Optional: mode bits used to set + permissions on created files by default. Must be an octal + value between 0000 and 0777 or a decimal value between + 0 and 511. YAML accepts both octal and decimal values, + JSON requires decimal values for mode bits. Defaults to + 0644. Directories within the path are not affected by + this setting. This might be in conflict with other options + that affect the file mode, like fsGroup, and the result + can be other mode bits set.' + format: int32 + type: integer + items: + description: Items is a list of downward API volume file + items: + description: DownwardAPIVolumeFile represents information + to create the file containing the pod field + properties: + fieldRef: + description: 'Required: Selects a field of the pod: + only annotations, labels, name and namespace are + supported.' + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. type: string required: - - topologyKey + - fieldPath type: object - weight: - description: - weight associated with matching the corresponding - podAffinityTerm, in the range 1-100. + x-kubernetes-map-type: atomic + mode: + description: 'Optional: mode bits used to set permissions + on this file, must be an octal value between 0000 + and 0777 or a decimal value between 0 and 511. YAML + accepts both octal and decimal values, JSON requires + decimal values for mode bits. If not specified, + the volume defaultMode will be used. This might + be in conflict with other options that affect the + file mode, like fsGroup, and the result can be other + mode bits set.' format: int32 type: integer + path: + description: 'Required: Path is the relative path + name of the file to be created. Must not be absolute + or contain the ''..'' path. Must be utf-8 encoded. + The first item of the relative path must not start + with ''..''' + type: string + resourceFieldRef: + description: 'Selects a resource of the container: + only resources limits and requests (limits.cpu, + limits.memory, requests.cpu and requests.memory) + are currently supported.' + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic required: - - podAffinityTerm - - weight + - path type: object type: array - requiredDuringSchedulingIgnoredDuringExecution: - description: - If the anti-affinity requirements specified by - this field are not met at scheduling time, the pod will - not be scheduled onto the node. If the anti-affinity requirements - specified by this field cease to be met at some point during - pod execution (e.g. due to a pod label update), the system - may or may not try to eventually evict the pod from its - node. When there are multiple elements, the lists of nodes - corresponding to each podAffinityTerm are intersected, i.e. - all terms must be satisfied. + type: object + emptyDir: + description: 'emptyDir represents a temporary directory that + shares a pod''s lifetime. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' + properties: + medium: + description: 'medium represents what type of storage medium + should back this directory. The default is "" which means + to use the node''s default medium. Must be an empty string + (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + description: 'sizeLimit is the total amount of local storage + required for this EmptyDir volume. The size limit is also + applicable for memory medium. The maximum usage on memory + medium EmptyDir would be the minimum value between the + SizeLimit specified here and the sum of memory limits + of all containers in a pod. The default is nil which means + that the limit is undefined. More info: http://kubernetes.io/docs/user-guide/volumes#emptydir' + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + ephemeral: + description: "ephemeral represents a volume that is handled + by a cluster storage driver. The volume's lifecycle is tied + to the pod that defines it - it will be created before the + pod starts, and deleted when the pod is removed. \n Use this + if: a) the volume is only needed while the pod runs, b) features + of normal volumes like restoring from snapshot or capacity + tracking are needed, c) the storage driver is specified through + a storage class, and d) the storage driver supports dynamic + volume provisioning through a PersistentVolumeClaim (see EphemeralVolumeSource + for more information on the connection between this volume + type and PersistentVolumeClaim). \n Use PersistentVolumeClaim + or one of the vendor-specific APIs for volumes that persist + for longer than the lifecycle of an individual pod. \n Use + CSI for light-weight local ephemeral volumes if the CSI driver + is meant to be used that way - see the documentation of the + driver for more information. \n A pod can use both types of + ephemeral volumes and persistent volumes at the same time." + properties: + volumeClaimTemplate: + description: "Will be used to create a stand-alone PVC to + provision the volume. The pod in which this EphemeralVolumeSource + is embedded will be the owner of the PVC, i.e. the PVC + will be deleted together with the pod. The name of the + PVC will be `-` where `` is the name from the `PodSpec.Volumes` array entry. + Pod validation will reject the pod if the concatenated + name is not valid for a PVC (for example, too long). \n + An existing PVC with that name that is not owned by the + pod will *not* be used for the pod to avoid using an unrelated + volume by mistake. Starting the pod is then blocked until + the unrelated PVC is removed. If such a pre-created PVC + is meant to be used by the pod, the PVC has to updated + with an owner reference to the pod once the pod exists. + Normally this should not be necessary, but it may be useful + when manually reconstructing a broken cluster. \n This + field is read-only and no changes will be made by Kubernetes + to the PVC after it has been created. \n Required, must + not be nil." + properties: + metadata: + description: May contain labels and annotations that + will be copied into the PVC when creating it. No other + fields are allowed and will be rejected during validation. + type: object + spec: + description: The specification for the PersistentVolumeClaim. + The entire content is copied unchanged into the PVC + that gets created from this template. The same fields + as in a PersistentVolumeClaim are also valid here. + properties: + accessModes: + description: 'accessModes contains the desired access + modes the volume should have. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1' + items: + type: string + type: array + dataSource: + description: 'dataSource field can be used to specify + either: * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) If the + provisioner or an external controller can support + the specified data source, it will create a new + volume based on the contents of the specified + data source. If the AnyVolumeDataSource feature + gate is enabled, this field will always have the + same contents as the DataSourceRef field.' + properties: + apiGroup: + description: APIGroup is the group for the resource + being referenced. If APIGroup is not specified, + the specified Kind must be in the core API + group. For any other third-party types, APIGroup + is required. + type: string + kind: + description: Kind is the type of resource being + referenced + type: string + name: + description: Name is the name of resource being + referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: 'dataSourceRef specifies the object + from which to populate the volume with data, if + a non-empty volume is desired. This may be any + local object from a non-empty API group (non core + object) or a PersistentVolumeClaim object. When + this field is specified, volume binding will only + succeed if the type of the specified object matches + some installed volume populator or dynamic provisioner. + This field will replace the functionality of the + DataSource field and as such if both fields are + non-empty, they must have the same value. For + backwards compatibility, both fields (DataSource + and DataSourceRef) will be set to the same value + automatically if one of them is empty and the + other is non-empty. There are two important differences + between DataSource and DataSourceRef: * While + DataSource only allows two specific types of objects, + DataSourceRef allows any non-core object, as well + as PersistentVolumeClaim objects. * While DataSource + ignores disallowed values (dropping them), DataSourceRef + preserves all values, and generates an error if + a disallowed value is specified. (Beta) Using + this field requires the AnyVolumeDataSource feature + gate to be enabled.' + properties: + apiGroup: + description: APIGroup is the group for the resource + being referenced. If APIGroup is not specified, + the specified Kind must be in the core API + group. For any other third-party types, APIGroup + is required. + type: string + kind: + description: Kind is the type of resource being + referenced + type: string + name: + description: Name is the name of resource being + referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + resources: + description: 'resources represents the minimum resources + the volume should have. If RecoverVolumeExpansionFailure + feature is enabled users are allowed to specify + resource requirements that are lower than previous + value but must still be higher than capacity recorded + in the status field of the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources' + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount + of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Requests describes the minimum + amount of compute resources required. If Requests + is omitted for a container, it defaults to + Limits if that is explicitly specified, otherwise + to an implementation-defined value. More info: + https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + type: object + type: object + selector: + description: selector is a label query over volumes + to consider for binding. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: A label selector requirement + is a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only "value". + The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: 'storageClassName is the name of the + StorageClass required by the claim. More info: + https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1' + type: string + volumeMode: + description: volumeMode defines what type of volume + is required by the claim. Value of Filesystem + is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference + to the PersistentVolume backing this claim. + type: string + type: object + required: + - spec + type: object + type: object + fc: + description: fc represents a Fibre Channel resource that is + attached to a kubelet's host machine and then exposed to the + pod. + properties: + fsType: + description: 'fsType is the filesystem type to mount. Must + be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. TODO: how do we prevent errors in the + filesystem from compromising the machine' + type: string + lun: + description: 'lun is Optional: FC target lun number' + format: int32 + type: integer + readOnly: + description: 'readOnly is Optional: Defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in VolumeMounts.' + type: boolean + targetWWNs: + description: 'targetWWNs is Optional: FC target worldwide + names (WWNs)' + items: + type: string + type: array + wwids: + description: 'wwids Optional: FC volume world wide identifiers + (wwids) Either wwids or combination of targetWWNs and + lun must be set, but not both simultaneously.' + items: + type: string + type: array + type: object + flexVolume: + description: flexVolume represents a generic volume resource + that is provisioned/attached using an exec based plugin. + properties: + driver: + description: driver is the name of the driver to use for + this volume. + type: string + fsType: + description: fsType is the filesystem type to mount. Must + be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". The default filesystem depends + on FlexVolume script. + type: string + options: + additionalProperties: + type: string + description: 'options is Optional: this field holds extra + command options if any.' + type: object + readOnly: + description: 'readOnly is Optional: defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in VolumeMounts.' + type: boolean + secretRef: + description: 'secretRef is Optional: secretRef is reference + to the secret object containing sensitive information + to pass to the plugin scripts. This may be empty if no + secret object is specified. If the secret object contains + more than one secret, all secrets are passed to the plugin + scripts.' + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + required: + - driver + type: object + flocker: + description: flocker represents a Flocker volume attached to + a kubelet's host machine. This depends on the Flocker control + service being running + properties: + datasetName: + description: datasetName is Name of the dataset stored as + metadata -> name on the dataset for Flocker should be + considered as deprecated + type: string + datasetUUID: + description: datasetUUID is the UUID of the dataset. This + is unique identifier of a Flocker dataset + type: string + type: object + gcePersistentDisk: + description: 'gcePersistentDisk represents a GCE Disk resource + that is attached to a kubelet''s host machine and then exposed + to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' + properties: + fsType: + description: 'fsType is filesystem type of the volume that + you want to mount. Tip: Ensure that the filesystem type + is supported by the host operating system. Examples: "ext4", + "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + TODO: how do we prevent errors in the filesystem from + compromising the machine' + type: string + partition: + description: 'partition is the partition in the volume that + you want to mount. If omitted, the default is to mount + by volume name. Examples: For volume /dev/sda1, you specify + the partition as "1". Similarly, the volume partition + for /dev/sda is "0" (or you can leave the property empty). + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' + format: int32 + type: integer + pdName: + description: 'pdName is unique name of the PD resource in + GCE. Used to identify the disk in GCE. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' + type: string + readOnly: + description: 'readOnly here will force the ReadOnly setting + in VolumeMounts. Defaults to false. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' + type: boolean + required: + - pdName + type: object + gitRepo: + description: 'gitRepo represents a git repository at a particular + revision. DEPRECATED: GitRepo is deprecated. To provision + a container with a git repo, mount an EmptyDir into an InitContainer + that clones the repo using git, then mount the EmptyDir into + the Pod''s container.' + properties: + directory: + description: directory is the target directory name. Must + not contain or start with '..'. If '.' is supplied, the + volume directory will be the git repository. Otherwise, + if specified, the volume will contain the git repository + in the subdirectory with the given name. + type: string + repository: + description: repository is the URL + type: string + revision: + description: revision is the commit hash for the specified + revision. + type: string + required: + - repository + type: object + glusterfs: + description: 'glusterfs represents a Glusterfs mount on the + host that shares a pod''s lifetime. More info: https://examples.k8s.io/volumes/glusterfs/README.md' + properties: + endpoints: + description: 'endpoints is the endpoint name that details + Glusterfs topology. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' + type: string + path: + description: 'path is the Glusterfs volume path. More info: + https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' + type: string + readOnly: + description: 'readOnly here will force the Glusterfs volume + to be mounted with read-only permissions. Defaults to + false. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' + type: boolean + required: + - endpoints + - path + type: object + hostPath: + description: 'hostPath represents a pre-existing file or directory + on the host machine that is directly exposed to the container. + This is generally used for system agents or other privileged + things that are allowed to see the host machine. Most containers + will NOT need this. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + --- TODO(jonesdl) We need to restrict who can use host directory + mounts and who can/can not mount host directories as read/write.' + properties: + path: + description: 'path of the directory on the host. If the + path is a symlink, it will follow the link to the real + path. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' + type: string + type: + description: 'type for HostPath Volume Defaults to "" More + info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' + type: string + required: + - path + type: object + iscsi: + description: 'iscsi represents an ISCSI Disk resource that is + attached to a kubelet''s host machine and then exposed to + the pod. More info: https://examples.k8s.io/volumes/iscsi/README.md' + properties: + chapAuthDiscovery: + description: chapAuthDiscovery defines whether support iSCSI + Discovery CHAP authentication + type: boolean + chapAuthSession: + description: chapAuthSession defines whether support iSCSI + Session CHAP authentication + type: boolean + fsType: + description: 'fsType is the filesystem type of the volume + that you want to mount. Tip: Ensure that the filesystem + type is supported by the host operating system. Examples: + "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi + TODO: how do we prevent errors in the filesystem from + compromising the machine' + type: string + initiatorName: + description: initiatorName is the custom iSCSI Initiator + Name. If initiatorName is specified with iscsiInterface + simultaneously, new iSCSI interface : will be created for the connection. + type: string + iqn: + description: iqn is the target iSCSI Qualified Name. + type: string + iscsiInterface: + description: iscsiInterface is the interface Name that uses + an iSCSI transport. Defaults to 'default' (tcp). + type: string + lun: + description: lun represents iSCSI Target Lun number. + format: int32 + type: integer + portals: + description: portals is the iSCSI Target Portal List. The + portal is either an IP or ip_addr:port if the port is + other than default (typically TCP ports 860 and 3260). + items: + type: string + type: array + readOnly: + description: readOnly here will force the ReadOnly setting + in VolumeMounts. Defaults to false. + type: boolean + secretRef: + description: secretRef is the CHAP Secret for iSCSI target + and initiator authentication + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + targetPortal: + description: targetPortal is iSCSI Target Portal. The Portal + is either an IP or ip_addr:port if the port is other than + default (typically TCP ports 860 and 3260). + type: string + required: + - iqn + - lun + - targetPortal + type: object + name: + description: 'name of the volume. Must be a DNS_LABEL and unique + within the pod. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + nfs: + description: 'nfs represents an NFS mount on the host that shares + a pod''s lifetime More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' + properties: + path: + description: 'path that is exported by the NFS server. More + info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' + type: string + readOnly: + description: 'readOnly here will force the NFS export to + be mounted with read-only permissions. Defaults to false. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' + type: boolean + server: + description: 'server is the hostname or IP address of the + NFS server. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' + type: string + required: + - path + - server + type: object + persistentVolumeClaim: + description: 'persistentVolumeClaimVolumeSource represents a + reference to a PersistentVolumeClaim in the same namespace. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' + properties: + claimName: + description: 'claimName is the name of a PersistentVolumeClaim + in the same namespace as the pod using this volume. More + info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' + type: string + readOnly: + description: readOnly Will force the ReadOnly setting in + VolumeMounts. Default false. + type: boolean + required: + - claimName + type: object + photonPersistentDisk: + description: photonPersistentDisk represents a PhotonController + persistent disk attached and mounted on kubelets host machine + properties: + fsType: + description: fsType is the filesystem type to mount. Must + be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. + type: string + pdID: + description: pdID is the ID that identifies Photon Controller + persistent disk + type: string + required: + - pdID + type: object + portworxVolume: + description: portworxVolume represents a portworx volume attached + and mounted on kubelets host machine + properties: + fsType: + description: fSType represents the filesystem type to mount + Must be a filesystem type supported by the host operating + system. Ex. "ext4", "xfs". Implicitly inferred to be "ext4" + if unspecified. + type: string + readOnly: + description: readOnly defaults to false (read/write). ReadOnly + here will force the ReadOnly setting in VolumeMounts. + type: boolean + volumeID: + description: volumeID uniquely identifies a Portworx volume + type: string + required: + - volumeID + type: object + projected: + description: projected items for all in one resources secrets, + configmaps, and downward API + properties: + defaultMode: + description: defaultMode are the mode bits used to set permissions + on created files by default. Must be an octal value between + 0000 and 0777 or a decimal value between 0 and 511. YAML + accepts both octal and decimal values, JSON requires decimal + values for mode bits. Directories within the path are + not affected by this setting. This might be in conflict + with other options that affect the file mode, like fsGroup, + and the result can be other mode bits set. + format: int32 + type: integer + sources: + description: sources is the list of volume projections items: - description: - Defines a set of pods (namely those matching - the labelSelector relative to the given namespace(s)) - that this pod should be co-located (affinity) or not co-located - (anti-affinity) with, where co-located is defined as running - on a node whose value of the label with key - matches that of any node on which a pod of the set of - pods is running + description: Projection that may be projected along with + other supported volume types properties: - labelSelector: - description: - A label query over a set of resources, - in this case pods. + configMap: + description: configMap information about the configMap + data to project properties: - matchExpressions: - description: - matchExpressions is a list of label - selector requirements. The requirements are ANDed. + items: + description: items if unspecified, each key-value + pair in the Data field of the referenced ConfigMap + will be projected into the volume as a file + whose name is the key and content is the value. + If specified, the listed keys will be projected + into the specified paths, and unlisted keys + will not be present. If a key is specified which + is not present in the ConfigMap, the volume + setup will error unless it is marked optional. + Paths must be relative and may not contain the + '..' path or start with '..'. items: - description: - A label selector requirement is a - selector that contains values, a key, and an - operator that relates the key and values. + description: Maps a string key to a path within + a volume. properties: key: - description: - key is the label key that the - selector applies to. + description: key is the key to project. type: string - operator: - description: - operator represents a key's relationship - to a set of values. Valid operators are - In, NotIn, Exists and DoesNotExist. + mode: + description: 'mode is Optional: mode bits + used to set permissions on this file. + Must be an octal value between 0000 and + 0777 or a decimal value between 0 and + 511. YAML accepts both octal and decimal + values, JSON requires decimal values for + mode bits. If not specified, the volume + defaultMode will be used. This might be + in conflict with other options that affect + the file mode, like fsGroup, and the result + can be other mode bits set.' + format: int32 + type: integer + path: + description: path is the relative path of + the file to map the key to. May not be + an absolute path. May not contain the + path element '..'. May not start with + the string '..'. type: string - values: - description: - values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. If the - operator is Exists or DoesNotExist, the - values array must be empty. This array is - replaced during a strategic merge patch. - items: - type: string - type: array required: - - key - - operator + - key + - path type: object type: array - matchLabels: - additionalProperties: - type: string - description: - matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is "In", - and the values array contains only "value". The - requirements are ANDed. - type: object + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: optional specify whether the ConfigMap + or its keys must be defined + type: boolean type: object x-kubernetes-map-type: atomic - namespaceSelector: - description: - A label query over the set of namespaces - that the term applies to. The term is applied to the - union of the namespaces selected by this field and - the ones listed in the namespaces field. null selector - and null or empty namespaces list means "this pod's - namespace". An empty selector ({}) matches all namespaces. + downwardAPI: + description: downwardAPI information about the downwardAPI + data to project + properties: + items: + description: Items is a list of DownwardAPIVolume + file + items: + description: DownwardAPIVolumeFile represents + information to create the file containing + the pod field + properties: + fieldRef: + description: 'Required: Selects a field + of the pod: only annotations, labels, + name and namespace are supported.' + properties: + apiVersion: + description: Version of the schema the + FieldPath is written in terms of, + defaults to "v1". + type: string + fieldPath: + description: Path of the field to select + in the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + description: 'Optional: mode bits used to + set permissions on this file, must be + an octal value between 0000 and 0777 or + a decimal value between 0 and 511. YAML + accepts both octal and decimal values, + JSON requires decimal values for mode + bits. If not specified, the volume defaultMode + will be used. This might be in conflict + with other options that affect the file + mode, like fsGroup, and the result can + be other mode bits set.' + format: int32 + type: integer + path: + description: 'Required: Path is the relative + path name of the file to be created. Must + not be absolute or contain the ''..'' + path. Must be utf-8 encoded. The first + item of the relative path must not start + with ''..''' + type: string + resourceFieldRef: + description: 'Selects a resource of the + container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu + and requests.memory) are currently supported.' + properties: + containerName: + description: 'Container name: required + for volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format + of the exposed resources, defaults + to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to + select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + secret: + description: secret information about the secret data + to project properties: - matchExpressions: - description: - matchExpressions is a list of label - selector requirements. The requirements are ANDed. + items: + description: items if unspecified, each key-value + pair in the Data field of the referenced Secret + will be projected into the volume as a file + whose name is the key and content is the value. + If specified, the listed keys will be projected + into the specified paths, and unlisted keys + will not be present. If a key is specified which + is not present in the Secret, the volume setup + will error unless it is marked optional. Paths + must be relative and may not contain the '..' + path or start with '..'. items: - description: - A label selector requirement is a - selector that contains values, a key, and an - operator that relates the key and values. + description: Maps a string key to a path within + a volume. properties: key: - description: - key is the label key that the - selector applies to. + description: key is the key to project. type: string - operator: - description: - operator represents a key's relationship - to a set of values. Valid operators are - In, NotIn, Exists and DoesNotExist. + mode: + description: 'mode is Optional: mode bits + used to set permissions on this file. + Must be an octal value between 0000 and + 0777 or a decimal value between 0 and + 511. YAML accepts both octal and decimal + values, JSON requires decimal values for + mode bits. If not specified, the volume + defaultMode will be used. This might be + in conflict with other options that affect + the file mode, like fsGroup, and the result + can be other mode bits set.' + format: int32 + type: integer + path: + description: path is the relative path of + the file to map the key to. May not be + an absolute path. May not contain the + path element '..'. May not start with + the string '..'. type: string - values: - description: - values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. If the - operator is Exists or DoesNotExist, the - values array must be empty. This array is - replaced during a strategic merge patch. - items: - type: string - type: array required: - - key - - operator + - key + - path type: object type: array - matchLabels: - additionalProperties: - type: string - description: - matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is "In", - and the values array contains only "value". The - requirements are ANDed. - type: object + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: optional field specify whether the + Secret or its key must be defined + type: boolean type: object x-kubernetes-map-type: atomic - namespaces: - description: - namespaces specifies a static list of namespace - names that the term applies to. The term is applied - to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. null or - empty namespaces list and null namespaceSelector means - "this pod's namespace". - items: - type: string - type: array - topologyKey: - description: - This pod should be co-located (affinity) - or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where - co-located is defined as running on a node whose value - of the label with key topologyKey matches that of - any node on which any of the selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - type: object - type: object - env: - description: - Env allows to specify environment vars for the parser - container. - items: - description: - EnvVar represents an environment variable present in - a Container. - properties: - name: - description: Name of the environment variable. Must be a C_IDENTIFIER. - type: string - value: - description: - 'Variable references $(VAR_NAME) are expanded using - the previously defined environment variables in the container - and any service environment variables. If a variable cannot - be resolved, the reference in the input string will be unchanged. - Double $$ are reduced to a single $, which allows for escaping - the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the - string literal "$(VAR_NAME)". Escaped references will never - be expanded, regardless of whether the variable exists or - not. Defaults to "".' - type: string - valueFrom: - description: - Source for the environment variable's value. Cannot - be used if value is not empty. - properties: - configMapKeyRef: - description: Selects a key of a ConfigMap. - properties: - key: - description: The key to select. - type: string - name: - description: - "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?" - type: string - optional: - description: - Specify whether the ConfigMap or its key - must be defined - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - fieldRef: - description: - "Selects a field of the pod: supports metadata.name, - metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, - spec.nodeName, spec.serviceAccountName, status.hostIP, - status.podIP, status.podIPs." - properties: - apiVersion: - description: - Version of the schema the FieldPath is - written in terms of, defaults to "v1". - type: string - fieldPath: - description: - Path of the field to select in the specified - API version. - type: string - required: - - fieldPath - type: object - x-kubernetes-map-type: atomic - resourceFieldRef: - description: - "Selects a resource of the container: only - resources limits and requests (limits.cpu, limits.memory, - limits.ephemeral-storage, requests.cpu, requests.memory - and requests.ephemeral-storage) are currently supported." - properties: - containerName: - description: - "Container name: required for volumes, - optional for env vars" - type: string - divisor: - anyOf: - - type: integer - - type: string - description: - Specifies the output format of the exposed - resources, defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: "Required: resource to select" - type: string - required: - - resource - type: object - x-kubernetes-map-type: atomic - secretKeyRef: - description: Selects a key of a secret in the pod's namespace - properties: - key: - description: - The key of the secret to select from. Must - be a valid secret key. - type: string - name: - description: - "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?" - type: string - optional: - description: - Specify whether the Secret or its key must - be defined - type: boolean - required: - - key - type: object - x-kubernetes-map-type: atomic - type: object - required: - - name - type: object - type: array - image: - description: - Image is the reference to the parser container image - which ca transform the raw scan report into findings - type: string - imagePullPolicy: - description: - "Image pull policy. One of Always, Never, IfNotPresent. - Defaults to Always if :latest tag is specified, or IfNotPresent - otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images" - type: string - imagePullSecrets: - description: ImagePullSecrets used to access private parser images - items: - description: - LocalObjectReference contains enough information to - let you locate the referenced object inside the same namespace. - properties: - name: - description: - "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?" - type: string - type: object - x-kubernetes-map-type: atomic - type: array - resources: - default: - limits: - cpu: 400m - memory: 200Mi - requests: - cpu: 200m - memory: 100Mi - description: - Resources lets you control resource limits and requests - for the parser container. See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: - "Limits describes the maximum amount of compute resources - allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/" - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: - "Requests describes the minimum amount of compute - resources required. If Requests is omitted for a container, - it defaults to Limits if that is explicitly specified, otherwise - to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/" - type: object - type: object - scopeLimiterAliases: - additionalProperties: - type: string - type: object - tolerations: - description: - Tolerations are a different way to control on which nodes - your parser is executed. See https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ - items: - description: - The pod this Toleration is attached to tolerates any - taint that matches the triple using the matching - operator . - properties: - effect: - description: - Effect indicates the taint effect to match. Empty - means match all taint effects. When specified, allowed values - are NoSchedule, PreferNoSchedule and NoExecute. - type: string - key: - description: - Key is the taint key that the toleration applies - to. Empty means match all taint keys. If the key is empty, - operator must be Exists; this combination means to match all - values and all keys. - type: string - operator: - description: - Operator represents a key's relationship to the - value. Valid operators are Exists and Equal. Defaults to Equal. - Exists is equivalent to wildcard for value, so that a pod - can tolerate all taints of a particular category. - type: string - tolerationSeconds: - description: - TolerationSeconds represents the period of time - the toleration (which must be of effect NoExecute, otherwise - this field is ignored) tolerates the taint. By default, it - is not set, which means tolerate the taint forever (do not - evict). Zero and negative values will be treated as 0 (evict - immediately) by the system. - format: int64 - type: integer - value: - description: - Value is the taint value the toleration matches - to. If the operator is Exists, the value should be empty, - otherwise just a regular string. - type: string - type: object - type: array - ttlSecondsAfterFinished: - description: - TTLSecondsAfterFinished configures the ttlSecondsAfterFinished - field for the created parse job - format: int32 - nullable: true - type: integer - volumeMounts: - description: - VolumeMounts allows to specify volume mounts for the - parser container. - items: - description: - VolumeMount describes a mounting of a Volume within - a container. - properties: - mountPath: - description: - Path within the container at which the volume should - be mounted. Must not contain ':'. - type: string - mountPropagation: - description: - mountPropagation determines how mounts are propagated - from the host to container and the other way around. When - not set, MountPropagationNone is used. This field is beta - in 1.10. - type: string - name: - description: This must match the Name of a Volume. - type: string - readOnly: - description: - Mounted read-only if true, read-write otherwise - (false or unspecified). Defaults to false. - type: boolean - subPath: - description: - Path within the volume from which the container's - volume should be mounted. Defaults to "" (volume's root). - type: string - subPathExpr: - description: - Expanded path within the volume from which the - container's volume should be mounted. Behaves similarly to - SubPath but environment variable references $(VAR_NAME) are - expanded using the container's environment. Defaults to "" - (volume's root). SubPathExpr and SubPath are mutually exclusive. - type: string - required: - - mountPath - - name - type: object - type: array - volumes: - description: Volumes allows to specify volumes for the parser container. - items: - description: - Volume represents a named volume in a pod that may - be accessed by any container in the pod. - properties: - awsElasticBlockStore: - description: - "awsElasticBlockStore represents an AWS Disk resource - that is attached to a kubelet's host machine and then exposed - to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore" - properties: - fsType: - description: - 'fsType is the filesystem type of the volume - that you want to mount. Tip: Ensure that the filesystem - type is supported by the host operating system. Examples: - "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore - TODO: how do we prevent errors in the filesystem from - compromising the machine' - type: string - partition: - description: - 'partition is the partition in the volume that - you want to mount. If omitted, the default is to mount - by volume name. Examples: For volume /dev/sda1, you specify - the partition as "1". Similarly, the volume partition - for /dev/sda is "0" (or you can leave the property empty).' - format: int32 - type: integer - readOnly: - description: - "readOnly value true will force the readOnly - setting in VolumeMounts. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore" - type: boolean - volumeID: - description: - "volumeID is unique ID of the persistent disk - resource in AWS (Amazon EBS volume). More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore" - type: string - required: - - volumeID - type: object - azureDisk: - description: - azureDisk represents an Azure Data Disk mount on - the host and bind mount to the pod. - properties: - cachingMode: - description: - "cachingMode is the Host Caching mode: None, - Read Only, Read Write." - type: string - diskName: - description: - diskName is the Name of the data disk in the - blob storage - type: string - diskURI: - description: - diskURI is the URI of data disk in the blob - storage - type: string - fsType: - description: - fsType is Filesystem type to mount. Must be - a filesystem type supported by the host operating system. - Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. - type: string - kind: - description: - "kind expected values are Shared: multiple - blob disks per storage account Dedicated: single blob - disk per storage account Managed: azure managed data - disk (only in managed availability set). defaults to shared" - type: string - readOnly: - description: - readOnly Defaults to false (read/write). ReadOnly - here will force the ReadOnly setting in VolumeMounts. - type: boolean - required: - - diskName - - diskURI - type: object - azureFile: - description: - azureFile represents an Azure File Service mount - on the host and bind mount to the pod. - properties: - readOnly: - description: - readOnly defaults to false (read/write). ReadOnly - here will force the ReadOnly setting in VolumeMounts. - type: boolean - secretName: - description: - secretName is the name of secret that contains - Azure Storage Account Name and Key - type: string - shareName: - description: shareName is the azure share Name - type: string - required: - - secretName - - shareName - type: object - cephfs: - description: - cephFS represents a Ceph FS mount on the host that - shares a pod's lifetime - properties: - monitors: - description: - "monitors is Required: Monitors is a collection - of Ceph monitors More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it" - items: - type: string - type: array - path: - description: - "path is Optional: Used as the mounted root, - rather than the full Ceph tree, default is /" - type: string - readOnly: - description: - "readOnly is Optional: Defaults to false (read/write). - ReadOnly here will force the ReadOnly setting in VolumeMounts. - More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it" - type: boolean - secretFile: - description: - "secretFile is Optional: SecretFile is the - path to key ring for User, default is /etc/ceph/user.secret - More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it" - type: string - secretRef: - description: - "secretRef is Optional: SecretRef is reference - to the authentication secret for User, default is empty. - More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it" - properties: - name: - description: - "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?" - type: string - type: object - x-kubernetes-map-type: atomic - user: - description: - "user is optional: User is the rados user name, - default is admin More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it" - type: string - required: - - monitors - type: object - cinder: - description: - "cinder represents a cinder volume attached and - mounted on kubelets host machine. More info: https://examples.k8s.io/mysql-cinder-pd/README.md" - properties: - fsType: - description: - 'fsType is the filesystem type to mount. Must - be a filesystem type supported by the host operating system. - Examples: "ext4", "xfs", "ntfs". Implicitly inferred to - be "ext4" if unspecified. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - type: string - readOnly: - description: - "readOnly defaults to false (read/write). ReadOnly - here will force the ReadOnly setting in VolumeMounts. - More info: https://examples.k8s.io/mysql-cinder-pd/README.md" - type: boolean - secretRef: - description: - "secretRef is optional: points to a secret - object containing parameters used to connect to OpenStack." - properties: - name: - description: - "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?" - type: string - type: object - x-kubernetes-map-type: atomic - volumeID: - description: - "volumeID used to identify the volume in cinder. - More info: https://examples.k8s.io/mysql-cinder-pd/README.md" - type: string - required: - - volumeID - type: object - configMap: - description: - configMap represents a configMap that should populate - this volume - properties: - defaultMode: - description: - "defaultMode is optional: mode bits used to - set permissions on created files by default. Must be an - octal value between 0000 and 0777 or a decimal value between - 0 and 511. YAML accepts both octal and decimal values, - JSON requires decimal values for mode bits. Defaults to - 0644. Directories within the path are not affected by - this setting. This might be in conflict with other options - that affect the file mode, like fsGroup, and the result - can be other mode bits set." - format: int32 - type: integer - items: - description: - items if unspecified, each key-value pair in - the Data field of the referenced ConfigMap will be projected - into the volume as a file whose name is the key and content - is the value. If specified, the listed keys will be projected - into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in - the ConfigMap, the volume setup will error unless it is - marked optional. Paths must be relative and may not contain - the '..' path or start with '..'. - items: - description: Maps a string key to a path within a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: - "mode is Optional: mode bits used to - set permissions on this file. Must be an octal value - between 0000 and 0777 or a decimal value between - 0 and 511. YAML accepts both octal and decimal values, - JSON requires decimal values for mode bits. If not - specified, the volume defaultMode will be used. - This might be in conflict with other options that - affect the file mode, like fsGroup, and the result - can be other mode bits set." - format: int32 - type: integer - path: - description: - path is the relative path of the file - to map the key to. May not be an absolute path. - May not contain the path element '..'. May not start - with the string '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: - "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?" - type: string - optional: - description: - optional specify whether the ConfigMap or its - keys must be defined - type: boolean - type: object - x-kubernetes-map-type: atomic - csi: - description: - csi (Container Storage Interface) represents ephemeral - storage that is handled by certain external CSI drivers (Beta - feature). - properties: - driver: - description: - driver is the name of the CSI driver that handles - this volume. Consult with your admin for the correct name - as registered in the cluster. - type: string - fsType: - description: - fsType to mount. Ex. "ext4", "xfs", "ntfs". - If not provided, the empty value is passed to the associated - CSI driver which will determine the default filesystem - to apply. - type: string - nodePublishSecretRef: - description: - nodePublishSecretRef is a reference to the - secret object containing sensitive information to pass - to the CSI driver to complete the CSI NodePublishVolume - and NodeUnpublishVolume calls. This field is optional, - and may be empty if no secret is required. If the secret - object contains more than one secret, all secret references - are passed. - properties: - name: - description: - "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?" - type: string - type: object - x-kubernetes-map-type: atomic - readOnly: - description: - readOnly specifies a read-only configuration - for the volume. Defaults to false (read/write). - type: boolean - volumeAttributes: - additionalProperties: - type: string - description: - volumeAttributes stores driver-specific properties - that are passed to the CSI driver. Consult your driver's - documentation for supported values. - type: object - required: - - driver - type: object - downwardAPI: - description: - downwardAPI represents downward API about the pod - that should populate this volume - properties: - defaultMode: - description: - "Optional: mode bits to use on created files - by default. Must be a Optional: mode bits used to set - permissions on created files by default. Must be an octal - value between 0000 and 0777 or a decimal value between - 0 and 511. YAML accepts both octal and decimal values, - JSON requires decimal values for mode bits. Defaults to - 0644. Directories within the path are not affected by - this setting. This might be in conflict with other options - that affect the file mode, like fsGroup, and the result - can be other mode bits set." - format: int32 - type: integer - items: - description: Items is a list of downward API volume file - items: - description: - DownwardAPIVolumeFile represents information - to create the file containing the pod field - properties: - fieldRef: - description: - "Required: Selects a field of the pod: - only annotations, labels, name and namespace are - supported." - properties: - apiVersion: - description: - Version of the schema the FieldPath - is written in terms of, defaults to "v1". - type: string - fieldPath: - description: - Path of the field to select in the - specified API version. - type: string - required: - - fieldPath - type: object - x-kubernetes-map-type: atomic - mode: - description: - "Optional: mode bits used to set permissions - on this file, must be an octal value between 0000 - and 0777 or a decimal value between 0 and 511. YAML - accepts both octal and decimal values, JSON requires - decimal values for mode bits. If not specified, - the volume defaultMode will be used. This might - be in conflict with other options that affect the - file mode, like fsGroup, and the result can be other - mode bits set." - format: int32 - type: integer - path: - description: - "Required: Path is the relative path - name of the file to be created. Must not be absolute - or contain the '..' path. Must be utf-8 encoded. - The first item of the relative path must not start - with '..'" - type: string - resourceFieldRef: - description: - "Selects a resource of the container: - only resources limits and requests (limits.cpu, - limits.memory, requests.cpu and requests.memory) - are currently supported." - properties: - containerName: - description: - "Container name: required for volumes, - optional for env vars" - type: string - divisor: - anyOf: - - type: integer - - type: string - description: - Specifies the output format of the - exposed resources, defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: "Required: resource to select" - type: string - required: - - resource - type: object - x-kubernetes-map-type: atomic - required: - - path - type: object - type: array - type: object - emptyDir: - description: - "emptyDir represents a temporary directory that - shares a pod's lifetime. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir" - properties: - medium: - description: - 'medium represents what type of storage medium - should back this directory. The default is "" which means - to use the node''s default medium. Must be an empty string - (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' - type: string - sizeLimit: - anyOf: - - type: integer - - type: string - description: - "sizeLimit is the total amount of local storage - required for this EmptyDir volume. The size limit is also - applicable for memory medium. The maximum usage on memory - medium EmptyDir would be the minimum value between the - SizeLimit specified here and the sum of memory limits - of all containers in a pod. The default is nil which means - that the limit is undefined. More info: http://kubernetes.io/docs/user-guide/volumes#emptydir" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - ephemeral: - description: - "ephemeral represents a volume that is handled - by a cluster storage driver. The volume's lifecycle is tied - to the pod that defines it - it will be created before the - pod starts, and deleted when the pod is removed. \n Use this - if: a) the volume is only needed while the pod runs, b) features - of normal volumes like restoring from snapshot or capacity - tracking are needed, c) the storage driver is specified through - a storage class, and d) the storage driver supports dynamic - volume provisioning through a PersistentVolumeClaim (see EphemeralVolumeSource - for more information on the connection between this volume - type and PersistentVolumeClaim). \n Use PersistentVolumeClaim - or one of the vendor-specific APIs for volumes that persist - for longer than the lifecycle of an individual pod. \n Use - CSI for light-weight local ephemeral volumes if the CSI driver - is meant to be used that way - see the documentation of the - driver for more information. \n A pod can use both types of - ephemeral volumes and persistent volumes at the same time." - properties: - volumeClaimTemplate: - description: - "Will be used to create a stand-alone PVC to - provision the volume. The pod in which this EphemeralVolumeSource - is embedded will be the owner of the PVC, i.e. the PVC - will be deleted together with the pod. The name of the - PVC will be `-` where `` is the name from the `PodSpec.Volumes` array entry. - Pod validation will reject the pod if the concatenated - name is not valid for a PVC (for example, too long). \n - An existing PVC with that name that is not owned by the - pod will *not* be used for the pod to avoid using an unrelated - volume by mistake. Starting the pod is then blocked until - the unrelated PVC is removed. If such a pre-created PVC - is meant to be used by the pod, the PVC has to updated - with an owner reference to the pod once the pod exists. - Normally this should not be necessary, but it may be useful - when manually reconstructing a broken cluster. \n This - field is read-only and no changes will be made by Kubernetes - to the PVC after it has been created. \n Required, must - not be nil." - properties: - metadata: - description: - May contain labels and annotations that - will be copied into the PVC when creating it. No other - fields are allowed and will be rejected during validation. - type: object - spec: - description: - The specification for the PersistentVolumeClaim. - The entire content is copied unchanged into the PVC - that gets created from this template. The same fields - as in a PersistentVolumeClaim are also valid here. + serviceAccountToken: + description: serviceAccountToken is information about + the serviceAccountToken data to project properties: - accessModes: - description: - "accessModes contains the desired access - modes the volume should have. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1" - items: - type: string - type: array - dataSource: - description: - "dataSource field can be used to specify - either: * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) - * An existing PVC (PersistentVolumeClaim) If the - provisioner or an external controller can support - the specified data source, it will create a new - volume based on the contents of the specified - data source. If the AnyVolumeDataSource feature - gate is enabled, this field will always have the - same contents as the DataSourceRef field." - properties: - apiGroup: - description: - APIGroup is the group for the resource - being referenced. If APIGroup is not specified, - the specified Kind must be in the core API - group. For any other third-party types, APIGroup - is required. - type: string - kind: - description: - Kind is the type of resource being - referenced - type: string - name: - description: - Name is the name of resource being - referenced - type: string - required: - - kind - - name - type: object - x-kubernetes-map-type: atomic - dataSourceRef: - description: - "dataSourceRef specifies the object - from which to populate the volume with data, if - a non-empty volume is desired. This may be any - local object from a non-empty API group (non core - object) or a PersistentVolumeClaim object. When - this field is specified, volume binding will only - succeed if the type of the specified object matches - some installed volume populator or dynamic provisioner. - This field will replace the functionality of the - DataSource field and as such if both fields are - non-empty, they must have the same value. For - backwards compatibility, both fields (DataSource - and DataSourceRef) will be set to the same value - automatically if one of them is empty and the - other is non-empty. There are two important differences - between DataSource and DataSourceRef: * While - DataSource only allows two specific types of objects, - DataSourceRef allows any non-core object, as well - as PersistentVolumeClaim objects. * While DataSource - ignores disallowed values (dropping them), DataSourceRef - preserves all values, and generates an error if - a disallowed value is specified. (Beta) Using - this field requires the AnyVolumeDataSource feature - gate to be enabled." - properties: - apiGroup: - description: - APIGroup is the group for the resource - being referenced. If APIGroup is not specified, - the specified Kind must be in the core API - group. For any other third-party types, APIGroup - is required. - type: string - kind: - description: - Kind is the type of resource being - referenced - type: string - name: - description: - Name is the name of resource being - referenced - type: string - required: - - kind - - name - type: object - x-kubernetes-map-type: atomic - resources: - description: - "resources represents the minimum resources - the volume should have. If RecoverVolumeExpansionFailure - feature is enabled users are allowed to specify - resource requirements that are lower than previous - value but must still be higher than capacity recorded - in the status field of the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources" - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: - "Limits describes the maximum amount - of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/" - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: - "Requests describes the minimum - amount of compute resources required. If Requests - is omitted for a container, it defaults to - Limits if that is explicitly specified, otherwise - to an implementation-defined value. More info: - https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/" - type: object - type: object - selector: - description: - selector is a label query over volumes - to consider for binding. - properties: - matchExpressions: - description: - matchExpressions is a list of label - selector requirements. The requirements are - ANDed. - items: - description: - A label selector requirement - is a selector that contains values, a key, - and an operator that relates the key and - values. - properties: - key: - description: - key is the label key that - the selector applies to. - type: string - operator: - description: - operator represents a key's - relationship to a set of values. Valid - operators are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: - values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. - If the operator is Exists or DoesNotExist, - the values array must be empty. This - array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: - matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is - "In", and the values array contains only "value". - The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - storageClassName: - description: - "storageClassName is the name of the - StorageClass required by the claim. More info: - https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1" - type: string - volumeMode: - description: - volumeMode defines what type of volume - is required by the claim. Value of Filesystem - is implied when not included in claim spec. + audience: + description: audience is the intended audience + of the token. A recipient of a token must identify + itself with an identifier specified in the audience + of the token, and otherwise should reject the + token. The audience defaults to the identifier + of the apiserver. type: string - volumeName: - description: - volumeName is the binding reference - to the PersistentVolume backing this claim. + expirationSeconds: + description: expirationSeconds is the requested + duration of validity of the service account + token. As the token approaches expiration, the + kubelet volume plugin will proactively rotate + the service account token. The kubelet will + start trying to rotate the token if the token + is older than 80 percent of its time to live + or if the token is older than 24 hours.Defaults + to 1 hour and must be at least 10 minutes. + format: int64 + type: integer + path: + description: path is the path relative to the + mount point of the file to project the token + into. type: string + required: + - path type: object - required: - - spec type: object - type: object - fc: - description: - fc represents a Fibre Channel resource that is - attached to a kubelet's host machine and then exposed to the - pod. - properties: - fsType: - description: - 'fsType is the filesystem type to mount. Must - be a filesystem type supported by the host operating system. - Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. TODO: how do we prevent errors in the - filesystem from compromising the machine' + type: array + type: object + quobyte: + description: quobyte represents a Quobyte mount on the host + that shares a pod's lifetime + properties: + group: + description: group to map volume access to Default is no + group + type: string + readOnly: + description: readOnly here will force the Quobyte volume + to be mounted with read-only permissions. Defaults to + false. + type: boolean + registry: + description: registry represents a single or multiple Quobyte + Registry services specified as a string as host:port pair + (multiple entries are separated with commas) which acts + as the central registry for volumes + type: string + tenant: + description: tenant owning the given Quobyte volume in the + Backend Used with dynamically provisioned Quobyte volumes, + value is set by the plugin + type: string + user: + description: user to map volume access to Defaults to serivceaccount + user + type: string + volume: + description: volume is a string that references an already + created Quobyte volume by name. + type: string + required: + - registry + - volume + type: object + rbd: + description: 'rbd represents a Rados Block Device mount on the + host that shares a pod''s lifetime. More info: https://examples.k8s.io/volumes/rbd/README.md' + properties: + fsType: + description: 'fsType is the filesystem type of the volume + that you want to mount. Tip: Ensure that the filesystem + type is supported by the host operating system. Examples: + "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd + TODO: how do we prevent errors in the filesystem from + compromising the machine' + type: string + image: + description: 'image is the rados image name. More info: + https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' + type: string + keyring: + description: 'keyring is the path to key ring for RBDUser. + Default is /etc/ceph/keyring. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' + type: string + monitors: + description: 'monitors is a collection of Ceph monitors. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' + items: type: string - lun: - description: "lun is Optional: FC target lun number" - format: int32 - type: integer - readOnly: - description: - "readOnly is Optional: Defaults to false (read/write). - ReadOnly here will force the ReadOnly setting in VolumeMounts." - type: boolean - targetWWNs: - description: - "targetWWNs is Optional: FC target worldwide - names (WWNs)" - items: - type: string - type: array - wwids: - description: - "wwids Optional: FC volume world wide identifiers - (wwids) Either wwids or combination of targetWWNs and - lun must be set, but not both simultaneously." - items: + type: array + pool: + description: 'pool is the rados pool name. Default is rbd. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' + type: string + readOnly: + description: 'readOnly here will force the ReadOnly setting + in VolumeMounts. Defaults to false. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' + type: boolean + secretRef: + description: 'secretRef is name of the authentication secret + for RBDUser. If provided overrides keyring. Default is + nil. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' type: string - type: array - type: object - flexVolume: - description: - flexVolume represents a generic volume resource - that is provisioned/attached using an exec based plugin. - properties: - driver: - description: - driver is the name of the driver to use for - this volume. - type: string - fsType: - description: - fsType is the filesystem type to mount. Must - be a filesystem type supported by the host operating system. - Ex. "ext4", "xfs", "ntfs". The default filesystem depends - on FlexVolume script. - type: string - options: - additionalProperties: + type: object + x-kubernetes-map-type: atomic + user: + description: 'user is the rados user name. Default is admin. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' + type: string + required: + - image + - monitors + type: object + scaleIO: + description: scaleIO represents a ScaleIO persistent volume + attached and mounted on Kubernetes nodes. + properties: + fsType: + description: fsType is the filesystem type to mount. Must + be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Default is "xfs". + type: string + gateway: + description: gateway is the host address of the ScaleIO + API Gateway. + type: string + protectionDomain: + description: protectionDomain is the name of the ScaleIO + Protection Domain for the configured storage. + type: string + readOnly: + description: readOnly Defaults to false (read/write). ReadOnly + here will force the ReadOnly setting in VolumeMounts. + type: boolean + secretRef: + description: secretRef references to the secret for ScaleIO + user and other sensitive information. If this is not provided, + Login operation will fail. + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' type: string - description: - "options is Optional: this field holds extra - command options if any." - type: object - readOnly: - description: - "readOnly is Optional: defaults to false (read/write). - ReadOnly here will force the ReadOnly setting in VolumeMounts." - type: boolean - secretRef: - description: - "secretRef is Optional: secretRef is reference - to the secret object containing sensitive information - to pass to the plugin scripts. This may be empty if no - secret object is specified. If the secret object contains - more than one secret, all secrets are passed to the plugin - scripts." + type: object + x-kubernetes-map-type: atomic + sslEnabled: + description: sslEnabled Flag enable/disable SSL communication + with Gateway, default false + type: boolean + storageMode: + description: storageMode indicates whether the storage for + a volume should be ThickProvisioned or ThinProvisioned. + Default is ThinProvisioned. + type: string + storagePool: + description: storagePool is the ScaleIO Storage Pool associated + with the protection domain. + type: string + system: + description: system is the name of the storage system as + configured in ScaleIO. + type: string + volumeName: + description: volumeName is the name of a volume already + created in the ScaleIO system that is associated with + this volume source. + type: string + required: + - gateway + - secretRef + - system + type: object + secret: + description: 'secret represents a secret that should populate + this volume. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret' + properties: + defaultMode: + description: 'defaultMode is Optional: mode bits used to + set permissions on created files by default. Must be an + octal value between 0000 and 0777 or a decimal value between + 0 and 511. YAML accepts both octal and decimal values, + JSON requires decimal values for mode bits. Defaults to + 0644. Directories within the path are not affected by + this setting. This might be in conflict with other options + that affect the file mode, like fsGroup, and the result + can be other mode bits set.' + format: int32 + type: integer + items: + description: items If unspecified, each key-value pair in + the Data field of the referenced Secret will be projected + into the volume as a file whose name is the key and content + is the value. If specified, the listed keys will be projected + into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in + the Secret, the volume setup will error unless it is marked + optional. Paths must be relative and may not contain the + '..' path or start with '..'. + items: + description: Maps a string key to a path within a volume. properties: - name: - description: - "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?" + key: + description: key is the key to project. type: string - type: object - x-kubernetes-map-type: atomic - required: - - driver - type: object - flocker: - description: - flocker represents a Flocker volume attached to - a kubelet's host machine. This depends on the Flocker control - service being running - properties: - datasetName: - description: - datasetName is Name of the dataset stored as - metadata -> name on the dataset for Flocker should be - considered as deprecated - type: string - datasetUUID: - description: - datasetUUID is the UUID of the dataset. This - is unique identifier of a Flocker dataset - type: string - type: object - gcePersistentDisk: - description: - "gcePersistentDisk represents a GCE Disk resource - that is attached to a kubelet's host machine and then exposed - to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk" - properties: - fsType: - description: - 'fsType is filesystem type of the volume that - you want to mount. Tip: Ensure that the filesystem type - is supported by the host operating system. Examples: "ext4", - "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. - More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk - TODO: how do we prevent errors in the filesystem from - compromising the machine' - type: string - partition: - description: - 'partition is the partition in the volume that - you want to mount. If omitted, the default is to mount - by volume name. Examples: For volume /dev/sda1, you specify - the partition as "1". Similarly, the volume partition - for /dev/sda is "0" (or you can leave the property empty). - More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - format: int32 - type: integer - pdName: - description: - "pdName is unique name of the PD resource in - GCE. Used to identify the disk in GCE. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk" - type: string - readOnly: - description: - "readOnly here will force the ReadOnly setting - in VolumeMounts. Defaults to false. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk" - type: boolean - required: - - pdName - type: object - gitRepo: - description: - "gitRepo represents a git repository at a particular - revision. DEPRECATED: GitRepo is deprecated. To provision - a container with a git repo, mount an EmptyDir into an InitContainer - that clones the repo using git, then mount the EmptyDir into - the Pod's container." - properties: - directory: - description: - directory is the target directory name. Must - not contain or start with '..'. If '.' is supplied, the - volume directory will be the git repository. Otherwise, - if specified, the volume will contain the git repository - in the subdirectory with the given name. - type: string - repository: - description: repository is the URL - type: string - revision: - description: - revision is the commit hash for the specified - revision. - type: string - required: - - repository - type: object - glusterfs: - description: - "glusterfs represents a Glusterfs mount on the - host that shares a pod's lifetime. More info: https://examples.k8s.io/volumes/glusterfs/README.md" - properties: - endpoints: - description: - "endpoints is the endpoint name that details - Glusterfs topology. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod" - type: string - path: - description: - "path is the Glusterfs volume path. More info: - https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod" - type: string - readOnly: - description: - "readOnly here will force the Glusterfs volume - to be mounted with read-only permissions. Defaults to - false. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod" - type: boolean - required: - - endpoints - - path - type: object - hostPath: - description: - "hostPath represents a pre-existing file or directory - on the host machine that is directly exposed to the container. - This is generally used for system agents or other privileged - things that are allowed to see the host machine. Most containers - will NOT need this. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath - --- TODO(jonesdl) We need to restrict who can use host directory - mounts and who can/can not mount host directories as read/write." - properties: - path: - description: - "path of the directory on the host. If the - path is a symlink, it will follow the link to the real - path. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath" - type: string - type: - description: - 'type for HostPath Volume Defaults to "" More - info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' - type: string - required: - - path - type: object - iscsi: - description: - "iscsi represents an ISCSI Disk resource that is - attached to a kubelet's host machine and then exposed to - the pod. More info: https://examples.k8s.io/volumes/iscsi/README.md" - properties: - chapAuthDiscovery: - description: - chapAuthDiscovery defines whether support iSCSI - Discovery CHAP authentication - type: boolean - chapAuthSession: - description: - chapAuthSession defines whether support iSCSI - Session CHAP authentication - type: boolean - fsType: - description: - 'fsType is the filesystem type of the volume - that you want to mount. Tip: Ensure that the filesystem - type is supported by the host operating system. Examples: - "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi - TODO: how do we prevent errors in the filesystem from - compromising the machine' - type: string - initiatorName: - description: - initiatorName is the custom iSCSI Initiator - Name. If initiatorName is specified with iscsiInterface - simultaneously, new iSCSI interface : will be created for the connection. - type: string - iqn: - description: iqn is the target iSCSI Qualified Name. - type: string - iscsiInterface: - description: - iscsiInterface is the interface Name that uses - an iSCSI transport. Defaults to 'default' (tcp). - type: string - lun: - description: lun represents iSCSI Target Lun number. - format: int32 - type: integer - portals: - description: - portals is the iSCSI Target Portal List. The - portal is either an IP or ip_addr:port if the port is - other than default (typically TCP ports 860 and 3260). - items: - type: string - type: array - readOnly: - description: - readOnly here will force the ReadOnly setting - in VolumeMounts. Defaults to false. - type: boolean - secretRef: - description: - secretRef is the CHAP Secret for iSCSI target - and initiator authentication - properties: - name: - description: - "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?" + mode: + description: 'mode is Optional: mode bits used to + set permissions on this file. Must be an octal value + between 0000 and 0777 or a decimal value between + 0 and 511. YAML accepts both octal and decimal values, + JSON requires decimal values for mode bits. If not + specified, the volume defaultMode will be used. + This might be in conflict with other options that + affect the file mode, like fsGroup, and the result + can be other mode bits set.' + format: int32 + type: integer + path: + description: path is the relative path of the file + to map the key to. May not be an absolute path. + May not contain the path element '..'. May not start + with the string '..'. type: string + required: + - key + - path type: object - x-kubernetes-map-type: atomic - targetPortal: - description: - targetPortal is iSCSI Target Portal. The Portal - is either an IP or ip_addr:port if the port is other than - default (typically TCP ports 860 and 3260). - type: string - required: - - iqn - - lun - - targetPortal - type: object - name: - description: - "name of the volume. Must be a DNS_LABEL and unique - within the pod. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names" - type: string - nfs: - description: - "nfs represents an NFS mount on the host that shares - a pod's lifetime More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs" - properties: - path: - description: - "path that is exported by the NFS server. More - info: https://kubernetes.io/docs/concepts/storage/volumes#nfs" - type: string - readOnly: - description: - "readOnly here will force the NFS export to - be mounted with read-only permissions. Defaults to false. - More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs" - type: boolean - server: - description: - "server is the hostname or IP address of the - NFS server. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs" - type: string - required: - - path - - server - type: object - persistentVolumeClaim: - description: - "persistentVolumeClaimVolumeSource represents a - reference to a PersistentVolumeClaim in the same namespace. - More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims" - properties: - claimName: - description: - "claimName is the name of a PersistentVolumeClaim - in the same namespace as the pod using this volume. More - info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims" - type: string - readOnly: - description: - readOnly Will force the ReadOnly setting in - VolumeMounts. Default false. - type: boolean - required: - - claimName - type: object - photonPersistentDisk: - description: - photonPersistentDisk represents a PhotonController - persistent disk attached and mounted on kubelets host machine - properties: - fsType: - description: - fsType is the filesystem type to mount. Must - be a filesystem type supported by the host operating system. - Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. - type: string - pdID: - description: - pdID is the ID that identifies Photon Controller - persistent disk - type: string - required: - - pdID - type: object - portworxVolume: - description: - portworxVolume represents a portworx volume attached - and mounted on kubelets host machine - properties: - fsType: - description: - fSType represents the filesystem type to mount - Must be a filesystem type supported by the host operating - system. Ex. "ext4", "xfs". Implicitly inferred to be "ext4" - if unspecified. - type: string - readOnly: - description: - readOnly defaults to false (read/write). ReadOnly - here will force the ReadOnly setting in VolumeMounts. - type: boolean - volumeID: - description: volumeID uniquely identifies a Portworx volume - type: string - required: - - volumeID - type: object - projected: - description: - projected items for all in one resources secrets, - configmaps, and downward API - properties: - defaultMode: - description: - defaultMode are the mode bits used to set permissions - on created files by default. Must be an octal value between - 0000 and 0777 or a decimal value between 0 and 511. YAML - accepts both octal and decimal values, JSON requires decimal - values for mode bits. Directories within the path are - not affected by this setting. This might be in conflict - with other options that affect the file mode, like fsGroup, - and the result can be other mode bits set. - format: int32 - type: integer - sources: - description: sources is the list of volume projections - items: - description: - Projection that may be projected along with - other supported volume types - properties: - configMap: - description: - configMap information about the configMap - data to project - properties: - items: - description: - items if unspecified, each key-value - pair in the Data field of the referenced ConfigMap - will be projected into the volume as a file - whose name is the key and content is the value. - If specified, the listed keys will be projected - into the specified paths, and unlisted keys - will not be present. If a key is specified which - is not present in the ConfigMap, the volume - setup will error unless it is marked optional. - Paths must be relative and may not contain the - '..' path or start with '..'. - items: - description: - Maps a string key to a path within - a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: - "mode is Optional: mode bits - used to set permissions on this file. - Must be an octal value between 0000 and - 0777 or a decimal value between 0 and - 511. YAML accepts both octal and decimal - values, JSON requires decimal values for - mode bits. If not specified, the volume - defaultMode will be used. This might be - in conflict with other options that affect - the file mode, like fsGroup, and the result - can be other mode bits set." - format: int32 - type: integer - path: - description: - path is the relative path of - the file to map the key to. May not be - an absolute path. May not contain the - path element '..'. May not start with - the string '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: - "Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?" - type: string - optional: - description: - optional specify whether the ConfigMap - or its keys must be defined - type: boolean - type: object - x-kubernetes-map-type: atomic - downwardAPI: - description: - downwardAPI information about the downwardAPI - data to project - properties: - items: - description: - Items is a list of DownwardAPIVolume - file - items: - description: - DownwardAPIVolumeFile represents - information to create the file containing - the pod field - properties: - fieldRef: - description: - "Required: Selects a field - of the pod: only annotations, labels, - name and namespace are supported." - properties: - apiVersion: - description: - Version of the schema the - FieldPath is written in terms of, - defaults to "v1". - type: string - fieldPath: - description: - Path of the field to select - in the specified API version. - type: string - required: - - fieldPath - type: object - x-kubernetes-map-type: atomic - mode: - description: - "Optional: mode bits used to - set permissions on this file, must be - an octal value between 0000 and 0777 or - a decimal value between 0 and 511. YAML - accepts both octal and decimal values, - JSON requires decimal values for mode - bits. If not specified, the volume defaultMode - will be used. This might be in conflict - with other options that affect the file - mode, like fsGroup, and the result can - be other mode bits set." - format: int32 - type: integer - path: - description: - "Required: Path is the relative - path name of the file to be created. Must - not be absolute or contain the '..' - path. Must be utf-8 encoded. The first - item of the relative path must not start - with '..'" - type: string - resourceFieldRef: - description: - "Selects a resource of the - container: only resources limits and requests - (limits.cpu, limits.memory, requests.cpu - and requests.memory) are currently supported." - properties: - containerName: - description: - "Container name: required - for volumes, optional for env vars" - type: string - divisor: - anyOf: - - type: integer - - type: string - description: - Specifies the output format - of the exposed resources, defaults - to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: - "Required: resource to - select" - type: string - required: - - resource - type: object - x-kubernetes-map-type: atomic - required: - - path - type: object - type: array - type: object - secret: - description: - secret information about the secret data - to project - properties: - items: - description: - items if unspecified, each key-value - pair in the Data field of the referenced Secret - will be projected into the volume as a file - whose name is the key and content is the value. - If specified, the listed keys will be projected - into the specified paths, and unlisted keys - will not be present. If a key is specified which - is not present in the Secret, the volume setup - will error unless it is marked optional. Paths - must be relative and may not contain the '..' - path or start with '..'. - items: - description: - Maps a string key to a path within - a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: - "mode is Optional: mode bits - used to set permissions on this file. - Must be an octal value between 0000 and - 0777 or a decimal value between 0 and - 511. YAML accepts both octal and decimal - values, JSON requires decimal values for - mode bits. If not specified, the volume - defaultMode will be used. This might be - in conflict with other options that affect - the file mode, like fsGroup, and the result - can be other mode bits set." - format: int32 - type: integer - path: - description: - path is the relative path of - the file to map the key to. May not be - an absolute path. May not contain the - path element '..'. May not start with - the string '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: - "Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?" - type: string - optional: - description: - optional field specify whether the - Secret or its key must be defined - type: boolean - type: object - x-kubernetes-map-type: atomic - serviceAccountToken: - description: - serviceAccountToken is information about - the serviceAccountToken data to project - properties: - audience: - description: - audience is the intended audience - of the token. A recipient of a token must identify - itself with an identifier specified in the audience - of the token, and otherwise should reject the - token. The audience defaults to the identifier - of the apiserver. - type: string - expirationSeconds: - description: - expirationSeconds is the requested - duration of validity of the service account - token. As the token approaches expiration, the - kubelet volume plugin will proactively rotate - the service account token. The kubelet will - start trying to rotate the token if the token - is older than 80 percent of its time to live - or if the token is older than 24 hours.Defaults - to 1 hour and must be at least 10 minutes. - format: int64 - type: integer - path: - description: - path is the path relative to the - mount point of the file to project the token - into. - type: string - required: - - path - type: object - type: object - type: array - type: object - quobyte: - description: - quobyte represents a Quobyte mount on the host - that shares a pod's lifetime - properties: - group: - description: - group to map volume access to Default is no - group - type: string - readOnly: - description: - readOnly here will force the Quobyte volume - to be mounted with read-only permissions. Defaults to - false. - type: boolean - registry: - description: - registry represents a single or multiple Quobyte - Registry services specified as a string as host:port pair - (multiple entries are separated with commas) which acts - as the central registry for volumes - type: string - tenant: - description: - tenant owning the given Quobyte volume in the - Backend Used with dynamically provisioned Quobyte volumes, - value is set by the plugin - type: string - user: - description: - user to map volume access to Defaults to serivceaccount - user - type: string - volume: - description: - volume is a string that references an already - created Quobyte volume by name. - type: string - required: - - registry - - volume - type: object - rbd: - description: - "rbd represents a Rados Block Device mount on the - host that shares a pod's lifetime. More info: https://examples.k8s.io/volumes/rbd/README.md" - properties: - fsType: - description: - 'fsType is the filesystem type of the volume - that you want to mount. Tip: Ensure that the filesystem - type is supported by the host operating system. Examples: - "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd - TODO: how do we prevent errors in the filesystem from - compromising the machine' - type: string - image: - description: - "image is the rados image name. More info: - https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it" - type: string - keyring: - description: - "keyring is the path to key ring for RBDUser. - Default is /etc/ceph/keyring. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it" - type: string - monitors: - description: - "monitors is a collection of Ceph monitors. - More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it" - items: + type: array + optional: + description: optional field specify whether the Secret or + its keys must be defined + type: boolean + secretName: + description: 'secretName is the name of the secret in the + pod''s namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret' + type: string + type: object + storageos: + description: storageOS represents a StorageOS volume attached + and mounted on Kubernetes nodes. + properties: + fsType: + description: fsType is the filesystem type to mount. Must + be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. + type: string + readOnly: + description: readOnly defaults to false (read/write). ReadOnly + here will force the ReadOnly setting in VolumeMounts. + type: boolean + secretRef: + description: secretRef specifies the secret to use for obtaining + the StorageOS API credentials. If not specified, default + values will be attempted. + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' type: string - type: array - pool: - description: - "pool is the rados pool name. Default is rbd. - More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it" - type: string - readOnly: - description: - "readOnly here will force the ReadOnly setting - in VolumeMounts. Defaults to false. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it" - type: boolean - secretRef: - description: - "secretRef is name of the authentication secret - for RBDUser. If provided overrides keyring. Default is - nil. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it" - properties: - name: - description: - "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?" - type: string - type: object - x-kubernetes-map-type: atomic - user: - description: - "user is the rados user name. Default is admin. - More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it" - type: string - required: - - image - - monitors - type: object - scaleIO: - description: - scaleIO represents a ScaleIO persistent volume - attached and mounted on Kubernetes nodes. - properties: - fsType: - description: - fsType is the filesystem type to mount. Must - be a filesystem type supported by the host operating system. - Ex. "ext4", "xfs", "ntfs". Default is "xfs". - type: string - gateway: - description: - gateway is the host address of the ScaleIO - API Gateway. - type: string - protectionDomain: - description: - protectionDomain is the name of the ScaleIO - Protection Domain for the configured storage. - type: string - readOnly: - description: - readOnly Defaults to false (read/write). ReadOnly - here will force the ReadOnly setting in VolumeMounts. - type: boolean - secretRef: - description: - secretRef references to the secret for ScaleIO - user and other sensitive information. If this is not provided, - Login operation will fail. - properties: - name: - description: - "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?" - type: string - type: object - x-kubernetes-map-type: atomic - sslEnabled: - description: - sslEnabled Flag enable/disable SSL communication - with Gateway, default false - type: boolean - storageMode: - description: - storageMode indicates whether the storage for - a volume should be ThickProvisioned or ThinProvisioned. - Default is ThinProvisioned. - type: string - storagePool: - description: - storagePool is the ScaleIO Storage Pool associated - with the protection domain. - type: string - system: - description: - system is the name of the storage system as - configured in ScaleIO. - type: string - volumeName: - description: - volumeName is the name of a volume already - created in the ScaleIO system that is associated with - this volume source. - type: string - required: - - gateway - - secretRef - - system - type: object - secret: - description: - "secret represents a secret that should populate - this volume. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret" - properties: - defaultMode: - description: - "defaultMode is Optional: mode bits used to - set permissions on created files by default. Must be an - octal value between 0000 and 0777 or a decimal value between - 0 and 511. YAML accepts both octal and decimal values, - JSON requires decimal values for mode bits. Defaults to - 0644. Directories within the path are not affected by - this setting. This might be in conflict with other options - that affect the file mode, like fsGroup, and the result - can be other mode bits set." - format: int32 - type: integer - items: - description: - items If unspecified, each key-value pair in - the Data field of the referenced Secret will be projected - into the volume as a file whose name is the key and content - is the value. If specified, the listed keys will be projected - into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in - the Secret, the volume setup will error unless it is marked - optional. Paths must be relative and may not contain the - '..' path or start with '..'. - items: - description: Maps a string key to a path within a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: - "mode is Optional: mode bits used to - set permissions on this file. Must be an octal value - between 0000 and 0777 or a decimal value between - 0 and 511. YAML accepts both octal and decimal values, - JSON requires decimal values for mode bits. If not - specified, the volume defaultMode will be used. - This might be in conflict with other options that - affect the file mode, like fsGroup, and the result - can be other mode bits set." - format: int32 - type: integer - path: - description: - path is the relative path of the file - to map the key to. May not be an absolute path. - May not contain the path element '..'. May not start - with the string '..'. - type: string - required: - - key - - path - type: object - type: array - optional: - description: - optional field specify whether the Secret or - its keys must be defined - type: boolean - secretName: - description: - "secretName is the name of the secret in the - pod's namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret" - type: string - type: object - storageos: - description: - storageOS represents a StorageOS volume attached - and mounted on Kubernetes nodes. - properties: - fsType: - description: - fsType is the filesystem type to mount. Must - be a filesystem type supported by the host operating system. - Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. - type: string - readOnly: - description: - readOnly defaults to false (read/write). ReadOnly - here will force the ReadOnly setting in VolumeMounts. - type: boolean - secretRef: - description: - secretRef specifies the secret to use for obtaining - the StorageOS API credentials. If not specified, default - values will be attempted. - properties: - name: - description: - "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?" - type: string - type: object - x-kubernetes-map-type: atomic - volumeName: - description: - volumeName is the human-readable name of the - StorageOS volume. Volume names are only unique within - a namespace. - type: string - volumeNamespace: - description: - volumeNamespace specifies the scope of the - volume within StorageOS. If no namespace is specified - then the Pod's namespace will be used. This allows the - Kubernetes name scoping to be mirrored within StorageOS - for tighter integration. Set VolumeName to any name to - override the default behaviour. Set to "default" if you - are not using namespaces within StorageOS. Namespaces - that do not pre-exist within StorageOS will be created. - type: string - type: object - vsphereVolume: - description: - vsphereVolume represents a vSphere volume attached - and mounted on kubelets host machine - properties: - fsType: - description: - fsType is filesystem type to mount. Must be - a filesystem type supported by the host operating system. - Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. - type: string - storagePolicyID: - description: - storagePolicyID is the storage Policy Based - Management (SPBM) profile ID associated with the StoragePolicyName. - type: string - storagePolicyName: - description: - storagePolicyName is the storage Policy Based - Management (SPBM) profile name. - type: string - volumePath: - description: - volumePath is the path that identifies vSphere - volume vmdk - type: string - required: - - volumePath - type: object - required: - - name - type: object - type: array - type: object - status: - description: ParseDefinitionStatus defines the observed state of ParseDefinition - type: object - type: object - served: true - storage: true - subresources: {} + type: object + x-kubernetes-map-type: atomic + volumeName: + description: volumeName is the human-readable name of the + StorageOS volume. Volume names are only unique within + a namespace. + type: string + volumeNamespace: + description: volumeNamespace specifies the scope of the + volume within StorageOS. If no namespace is specified + then the Pod's namespace will be used. This allows the + Kubernetes name scoping to be mirrored within StorageOS + for tighter integration. Set VolumeName to any name to + override the default behaviour. Set to "default" if you + are not using namespaces within StorageOS. Namespaces + that do not pre-exist within StorageOS will be created. + type: string + type: object + vsphereVolume: + description: vsphereVolume represents a vSphere volume attached + and mounted on kubelets host machine + properties: + fsType: + description: fsType is filesystem type to mount. Must be + a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. + type: string + storagePolicyID: + description: storagePolicyID is the storage Policy Based + Management (SPBM) profile ID associated with the StoragePolicyName. + type: string + storagePolicyName: + description: storagePolicyName is the storage Policy Based + Management (SPBM) profile name. + type: string + volumePath: + description: volumePath is the path that identifies vSphere + volume vmdk + type: string + required: + - volumePath + type: object + required: + - name + type: object + type: array + type: object + status: + description: ParseDefinitionStatus defines the observed state of ParseDefinition + type: object + type: object + served: true + storage: true + subresources: {} diff --git a/parser-sdk/nodejs/parser-wrapper.js b/parser-sdk/nodejs/parser-wrapper.js index 04c951558c..de0115fcb7 100644 --- a/parser-sdk/nodejs/parser-wrapper.js +++ b/parser-sdk/nodejs/parser-wrapper.js @@ -109,12 +109,35 @@ async function extractScan() { console.error(err); process.exit(1); } + +} + +async function extractParseDefinition(scan) { + try { + const { body } = await k8sApi.getNamespacedCustomObject( + "execution.securecodebox.io", + "v1", + namespace, + "parsedefinitions", + scan.status.rawResultType + ); + return body; + } catch (err) { + console.error("Failed to get ParseDefinition from the kubernetes api"); + console.error(err); + process.exit(1); + } } + + + async function main() { console.log("Starting Parser"); let scan = await extractScan(); - + console.log("Extracted Scan" + JSON.stringify(scan)); + let parseDefinition = await extractParseDefinition(scan); + console.log("Extracted ParseDefinition" + JSON.stringify(parseDefinition)); const resultFileUrl = process.argv[2]; const resultUploadUrl = process.argv[3]; diff --git a/scanners/amass/templates/amass-parse-definition.yaml b/scanners/amass/templates/amass-parse-definition.yaml index d877984933..d2334a4bad 100644 --- a/scanners/amass/templates/amass-parse-definition.yaml +++ b/scanners/amass/templates/amass-parse-definition.yaml @@ -26,6 +26,8 @@ spec: resources: {{- toYaml . | nindent 4 }} {{- end }} + encodingType: Binary + volumes: - name: temp-storage emptyDir: {} # This will create an empty directory as volume. From 5bd824372627bc7360e9536aec4cfcc7dc8f1ef1 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Fri, 1 Sep 2023 13:42:04 +0200 Subject: [PATCH 22/33] #1833 Changed parser-wrapper to check parseDefinition encodingType instead of ScanType Signed-off-by: Ilyes Ben Dlala --- parser-sdk/nodejs/parser-wrapper.js | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/parser-sdk/nodejs/parser-wrapper.js b/parser-sdk/nodejs/parser-wrapper.js index de0115fcb7..16071cac81 100644 --- a/parser-sdk/nodejs/parser-wrapper.js +++ b/parser-sdk/nodejs/parser-wrapper.js @@ -135,15 +135,13 @@ async function extractParseDefinition(scan) { async function main() { console.log("Starting Parser"); let scan = await extractScan(); - console.log("Extracted Scan" + JSON.stringify(scan)); let parseDefinition = await extractParseDefinition(scan); - console.log("Extracted ParseDefinition" + JSON.stringify(parseDefinition)); const resultFileUrl = process.argv[2]; const resultUploadUrl = process.argv[3]; console.log("Fetching result file"); let response; - if(scan.spec.scanType === "amass"){ + if(parseDefinition.spec.encodingType === "Binary"){ response = await axios.get(resultFileUrl, {responseType: 'arraybuffer'}); } else { response = await axios.get(resultFileUrl); From 3395516dd52f2652cb6bff534f6330424eaa4019 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Fri, 1 Sep 2023 13:49:25 +0200 Subject: [PATCH 23/33] #1833 Renamed ParseDefinition CRD attribute from encodingType to contentType It's a more fitting name for types such as "Binary" Signed-off-by: Ilyes Ben Dlala --- .../apis/execution/v1/parsedefinition_types.go | 14 +++++++------- ...n.securecodebox.io_clusterparsedefinitions.yaml | 8 ++++---- ...xecution.securecodebox.io_parsedefinitions.yaml | 8 ++++---- ...n.securecodebox.io_clusterparsedefinitions.yaml | 12 ++++++++---- ...xecution.securecodebox.io_parsedefinitions.yaml | 12 ++++++++---- parser-sdk/nodejs/parser-wrapper.js | 2 +- .../amass/templates/amass-parse-definition.yaml | 2 +- 7 files changed, 33 insertions(+), 25 deletions(-) diff --git a/operator/apis/execution/v1/parsedefinition_types.go b/operator/apis/execution/v1/parsedefinition_types.go index 1c7a54dd11..2c7ac7716d 100644 --- a/operator/apis/execution/v1/parsedefinition_types.go +++ b/operator/apis/execution/v1/parsedefinition_types.go @@ -30,12 +30,12 @@ type ParseDefinitionSpec struct { // +nullable TTLSecondsAfterFinished *int32 `json:"ttlSecondsAfterFinished,omitempty"` - // EncodingType specifies the encoding type of the scan result + // ContentType specifies the content type of the scan result // Valid values are: // - "Text" (default): the scan result is a text file // - "Binary": the scan result is a binary file //+kubebuilder:default=Text - EncodingType EncodingType `json:"encodingType,omitempty"` + ContentType ContentType `json:"contentType,omitempty"` // Env allows to specify environment vars for the parser container. Env []corev1.EnvVar `json:"env,omitempty"` @@ -60,15 +60,15 @@ type ParseDefinitionStatus struct { // Important: Run "make" to regenerate code after modifying this file } -// EncodingType specifies the encoding type of the scan result +// ContentType specifies the content type of the scan result // +kubebuilder:validation:Enum=Text;Binary -type EncodingType string +type ContentType string const ( - // Text is the default encoding type and will be used if no encoding type is specified - Text EncodingType = "Text" + // Text is the default content type and will be used if no content type is specified + Text ContentType = "Text" // Binary is used for binary scan results - Binary EncodingType = "Binary" + Binary ContentType = "Binary" ) // +kubebuilder:object:root=true diff --git a/operator/config/crd/bases/execution.securecodebox.io_clusterparsedefinitions.yaml b/operator/config/crd/bases/execution.securecodebox.io_clusterparsedefinitions.yaml index 0643e00dac..c5cb71899d 100644 --- a/operator/config/crd/bases/execution.securecodebox.io_clusterparsedefinitions.yaml +++ b/operator/config/crd/bases/execution.securecodebox.io_clusterparsedefinitions.yaml @@ -870,11 +870,11 @@ spec: type: array type: object type: object - encodingType: + contentType: default: Text - description: 'EncodingType specifies the encoding type of the scan - result Valid values are: - "Text" (default): the scan result is - a text file - "Binary": the scan result is a binary file' + description: 'ContentType specifies the content type of the scan result + Valid values are: - "Text" (default): the scan result is a text + file - "Binary": the scan result is a binary file' enum: - Text - Binary diff --git a/operator/config/crd/bases/execution.securecodebox.io_parsedefinitions.yaml b/operator/config/crd/bases/execution.securecodebox.io_parsedefinitions.yaml index c250c3674a..5463c1e16e 100644 --- a/operator/config/crd/bases/execution.securecodebox.io_parsedefinitions.yaml +++ b/operator/config/crd/bases/execution.securecodebox.io_parsedefinitions.yaml @@ -869,11 +869,11 @@ spec: type: array type: object type: object - encodingType: + contentType: default: Text - description: 'EncodingType specifies the encoding type of the scan - result Valid values are: - "Text" (default): the scan result is - a text file - "Binary": the scan result is a binary file' + description: 'ContentType specifies the content type of the scan result + Valid values are: - "Text" (default): the scan result is a text + file - "Binary": the scan result is a binary file' enum: - Text - Binary diff --git a/operator/crds/execution.securecodebox.io_clusterparsedefinitions.yaml b/operator/crds/execution.securecodebox.io_clusterparsedefinitions.yaml index ed933fc50b..c5cb71899d 100644 --- a/operator/crds/execution.securecodebox.io_clusterparsedefinitions.yaml +++ b/operator/crds/execution.securecodebox.io_clusterparsedefinitions.yaml @@ -870,10 +870,14 @@ spec: type: array type: object type: object - encodingType: - description: 'EncodingType specifies the encoding type of the scan - result Valid values are: - "Text" (default): the scan result is - a text file - "Binary": the scan result is a binary file' + contentType: + default: Text + description: 'ContentType specifies the content type of the scan result + Valid values are: - "Text" (default): the scan result is a text + file - "Binary": the scan result is a binary file' + enum: + - Text + - Binary type: string env: description: Env allows to specify environment vars for the parser diff --git a/operator/crds/execution.securecodebox.io_parsedefinitions.yaml b/operator/crds/execution.securecodebox.io_parsedefinitions.yaml index b39eb0852f..5463c1e16e 100644 --- a/operator/crds/execution.securecodebox.io_parsedefinitions.yaml +++ b/operator/crds/execution.securecodebox.io_parsedefinitions.yaml @@ -869,10 +869,14 @@ spec: type: array type: object type: object - encodingType: - description: 'EncodingType specifies the encoding type of the scan - result Valid values are: - "Text" (default): the scan result is - a text file - "Binary": the scan result is a binary file' + contentType: + default: Text + description: 'ContentType specifies the content type of the scan result + Valid values are: - "Text" (default): the scan result is a text + file - "Binary": the scan result is a binary file' + enum: + - Text + - Binary type: string env: description: Env allows to specify environment vars for the parser diff --git a/parser-sdk/nodejs/parser-wrapper.js b/parser-sdk/nodejs/parser-wrapper.js index 16071cac81..50a789e305 100644 --- a/parser-sdk/nodejs/parser-wrapper.js +++ b/parser-sdk/nodejs/parser-wrapper.js @@ -141,7 +141,7 @@ async function main() { console.log("Fetching result file"); let response; - if(parseDefinition.spec.encodingType === "Binary"){ + if(parseDefinition.spec.contentType === "Binary"){ response = await axios.get(resultFileUrl, {responseType: 'arraybuffer'}); } else { response = await axios.get(resultFileUrl); diff --git a/scanners/amass/templates/amass-parse-definition.yaml b/scanners/amass/templates/amass-parse-definition.yaml index d2334a4bad..ee8931448d 100644 --- a/scanners/amass/templates/amass-parse-definition.yaml +++ b/scanners/amass/templates/amass-parse-definition.yaml @@ -26,7 +26,7 @@ spec: resources: {{- toYaml . | nindent 4 }} {{- end }} - encodingType: Binary + contentType: Binary volumes: - name: temp-storage From 308daadc7b0ff4aaf7f14e3e3acd73a2a1ea36f6 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Fri, 1 Sep 2023 16:00:35 +0200 Subject: [PATCH 24/33] #1833 Changed amass Dockerfile to be based on the official amass image This is done to avoid the shorter lifecycle of amass docker images, and to also avoid the platform dependency Signed-off-by: Ilyes Ben Dlala --- scanners/amass/scanner/Dockerfile | 25 ++++--------------------- 1 file changed, 4 insertions(+), 21 deletions(-) diff --git a/scanners/amass/scanner/Dockerfile b/scanners/amass/scanner/Dockerfile index e3095f2f21..8745e7698b 100644 --- a/scanners/amass/scanner/Dockerfile +++ b/scanners/amass/scanner/Dockerfile @@ -2,26 +2,9 @@ # # SPDX-License-Identifier: Apache-2.0 -# Base Image -FROM alpine:3.18 as base -ARG scannerVersion - -RUN apk add --no-cache wget unzip \ - && wget https://github.com/owasp-amass/amass/releases/download/${scannerVersion}/amass_Linux_i386.zip \ - && unzip amass_Linux_i386.zip \ - && rm amass_Linux_i386.zip - -# Runtime Image -FROM alpine:3.18 as runtime +# Older amass versions are regularly removed from the official docker registry, this is often breaks our builds. +# To prevent this we create a new image based on the official one and push it to our docker registry. -RUN apk --no-cache add ca-certificates pax-utils \ - && addgroup amass \ - && adduser amass -D -G amass \ - && mkdir -p /.config/amass /home/securecodebox/ \ - && chown -R amass:amass /.config /home/securecodebox/ - -COPY --from=base amass_Linux_i386/amass /bin/amass - -ENV HOME=/ -USER amass +ARG scannerVersion +FROM caffix/amass:${scannerVersion} ENTRYPOINT ["/bin/amass"] From 3ebae4b7de68037a8b14ac6bc0e1935ab37b13df Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Tue, 5 Sep 2023 10:15:17 +0200 Subject: [PATCH 25/33] #1833 Updated amass scan examples by removing nolonger supported parameters Signed-off-by: Ilyes Ben Dlala --- scanners/amass/examples/example.com/scan.yaml | 2 -- scanners/amass/examples/secureCodeBox.io/scan.yaml | 1 - 2 files changed, 3 deletions(-) diff --git a/scanners/amass/examples/example.com/scan.yaml b/scanners/amass/examples/example.com/scan.yaml index 93de15a1cf..3087d87f4b 100644 --- a/scanners/amass/examples/example.com/scan.yaml +++ b/scanners/amass/examples/example.com/scan.yaml @@ -9,8 +9,6 @@ metadata: spec: scanType: "amass" parameters: - - "-noalts" - "-norecursive" - - "-nolocaldb" - "-d" - "example.com" diff --git a/scanners/amass/examples/secureCodeBox.io/scan.yaml b/scanners/amass/examples/secureCodeBox.io/scan.yaml index 24afbc6394..2a570fbd42 100644 --- a/scanners/amass/examples/secureCodeBox.io/scan.yaml +++ b/scanners/amass/examples/secureCodeBox.io/scan.yaml @@ -11,7 +11,6 @@ metadata: spec: scanType: "amass" parameters: - - "-noalts" - "-norecursive" - "-d" - "securecodebox.io" From a16f5ba7246bdee60a98cba8799f95379cac68bc Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Tue, 5 Sep 2023 10:16:28 +0200 Subject: [PATCH 26/33] #715 Set Amass Docker Image in a numeric way to allow runAsNonRoot Signed-off-by: Ilyes Ben Dlala --- scanners/amass/scanner/Dockerfile | 2 ++ scanners/amass/values.yaml | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/scanners/amass/scanner/Dockerfile b/scanners/amass/scanner/Dockerfile index 8745e7698b..78d17e1ddc 100644 --- a/scanners/amass/scanner/Dockerfile +++ b/scanners/amass/scanner/Dockerfile @@ -7,4 +7,6 @@ ARG scannerVersion FROM caffix/amass:${scannerVersion} +# The amass image uses the user "user" with the id 1000, we set it here as a numeric value to allow runAsNonRoot +USER 1000 ENTRYPOINT ["/bin/amass"] diff --git a/scanners/amass/values.yaml b/scanners/amass/values.yaml index a6e7e7d594..7e0dc78114 100644 --- a/scanners/amass/values.yaml +++ b/scanners/amass/values.yaml @@ -89,7 +89,7 @@ scanner: # scanner.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) securityContext: # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user - runAsNonRoot: false + runAsNonRoot: true # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system readOnlyRootFilesystem: false # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated From 0b7c01d0dc2724c84666b37b891d1f82d7f0e633 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Tue, 5 Sep 2023 10:17:15 +0200 Subject: [PATCH 27/33] #1833 Added a notice to the DockerHub webpage for Amass image copyright Signed-off-by: Ilyes Ben Dlala --- scanners/amass/.helm-docs.gotmpl | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/scanners/amass/.helm-docs.gotmpl b/scanners/amass/.helm-docs.gotmpl index 08f8b7a0a5..f82a449ecf 100644 --- a/scanners/amass/.helm-docs.gotmpl +++ b/scanners/amass/.helm-docs.gotmpl @@ -19,6 +19,12 @@ usecase: "Subdomain Enumeration Scanner" {{- end }} {{- define "extra.dockerDeploymentSection" -}} + +## Notice +This image is a workaround for the official Amass docker image, older amass versions are regularly removed from the official docker registry, this is often breaks our builds. +To prevent this we create a new image based on the official one and push it to our docker registry. +Copyright 2017 Jeff Foley. All rights reserved. + ## Supported Tags - `latest` (represents the latest stable release build) - tagged releases, e.g. `3.0.0`, `2.9.0`, `2.8.0`, `2.7.0` From 03d71b20461d1fc4cda444b42c7a7872312829ae Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Tue, 5 Sep 2023 12:54:08 +0200 Subject: [PATCH 28/33] secureCodeBox/documentation#157 Updated and corrected Amass docs to fit v4 changes Signed-off-by: Ilyes Ben Dlala --- scanners/amass/.helm-docs.gotmpl | 7 +- scanners/amass/README.md | 15 ++- scanners/amass/docs/README.ArtifactHub.md | 13 +-- .../amass/docs/README.DockerHub-Parser.md | 5 + .../amass/docs/README.DockerHub-Scanner.md | 107 ++++++++++++++++++ 5 files changed, 128 insertions(+), 19 deletions(-) create mode 100644 scanners/amass/docs/README.DockerHub-Scanner.md diff --git a/scanners/amass/.helm-docs.gotmpl b/scanners/amass/.helm-docs.gotmpl index f82a449ecf..1f411898c8 100644 --- a/scanners/amass/.helm-docs.gotmpl +++ b/scanners/amass/.helm-docs.gotmpl @@ -45,16 +45,15 @@ The [OWASP Amass Project][owasp_amass_project] has developed a tool to help info {{- define "extra.scannerConfigurationSection" -}} ## Scanner Configuration -The following security scan configuration example are based on the [Amass User Guide], please take a look at the original documentation for more configuration examples. +The following security scan configuration example are based on the [Amass User Guide](https://github.com/owasp-amass/amass/blob/master/doc/user_guide.md#the-enum-subcommand), please take a look at the original documentation for more configuration examples. - The most basic use of the tool for subdomain enumeration: `amass enum -d example.com` -- Typical parameters for DNS enumeration: `amass enum -v -src -ip -brute -min-for-recursive 2 -d example.com` +- Typical parameters for DNS enumeration: `amass enum -v -brute -min-for-recursive 2 -d example.com` Special command line options: -- Disable generation of altered names `amass enum -noalts -d example.com` +- Enable generation of altered names `amass enum -alts -d example.com` - Turn off recursive brute forcing `amass enum -brute -norecursive -d example.com` -- Disable saving data into a local database `amass enum -nolocaldb -d example.com` - Domain names separated by commas (can be used multiple times) `amass enum -d example.com` {{- end }} diff --git a/scanners/amass/README.md b/scanners/amass/README.md index 01ddc828d8..f9394c8ad0 100644 --- a/scanners/amass/README.md +++ b/scanners/amass/README.md @@ -3,7 +3,7 @@ title: "Amass" category: "scanner" type: "Network" state: "released" -appVersion: "v3.23.3" +appVersion: "v4.1.0" usecase: "Subdomain Enumeration Scanner" --- @@ -54,16 +54,15 @@ helm upgrade --install amass secureCodeBox/amass ## Scanner Configuration -The following security scan configuration example are based on the [Amass User Guide], please take a look at the original documentation for more configuration examples. +The following security scan configuration example are based on the [Amass User Guide](https://github.com/owasp-amass/amass/blob/master/doc/user_guide.md#the-enum-subcommand), please take a look at the original documentation for more configuration examples. - The most basic use of the tool for subdomain enumeration: `amass enum -d example.com` -- Typical parameters for DNS enumeration: `amass enum -v -src -ip -brute -min-for-recursive 2 -d example.com` +- Typical parameters for DNS enumeration: `amass enum -v -brute -min-for-recursive 2 -d example.com` Special command line options: -- Disable generation of altered names `amass enum -noalts -d example.com` +- Enable generation of altered names `amass enum -alts -d example.com` - Turn off recursive brute forcing `amass enum -brute -norecursive -d example.com` -- Disable saving data into a local database `amass enum -nolocaldb -d example.com` - Domain names separated by commas (can be used multiple times) `amass enum -d example.com` ## Requirements @@ -93,17 +92,17 @@ Kubernetes: `>=v1.11.0-0` | scanner.extraVolumeMounts | list | `[{"mountPath":"/amass/output/config.ini","name":"amass-config","subPath":"config.ini"}]` | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.extraVolumes | list | `[{"configMap":{"name":"amass-config"},"name":"amass-config"}]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | -| scanner.image.repository | string | `"caffix/amass"` | Container Image to run the scan | +| scanner.image.repository | string | `"docker.io/securecodebox/scanner-amass"` | Container Image to run the scan | | scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.podSecurityContext | object | `{}` | Optional securityContext set on scanner pod (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":false,"runAsNonRoot":false}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":false,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | | scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | | scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | | scanner.securityContext.readOnlyRootFilesystem | bool | `false` | Prevents write access to the containers file system | -| scanner.securityContext.runAsNonRoot | bool | `false` | Enforces that the scanner image is run as a non root user | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.suspend | bool | `false` | if set to true the scan job will be suspended after creation. You can then resume the job using `kubectl resume ` or using a job scheduler like kueue | | scanner.tolerations | list | `[]` | Optional tolerations settings that control how the scanner job is scheduled (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the Kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | diff --git a/scanners/amass/docs/README.ArtifactHub.md b/scanners/amass/docs/README.ArtifactHub.md index 2db6f66aa7..0130121961 100644 --- a/scanners/amass/docs/README.ArtifactHub.md +++ b/scanners/amass/docs/README.ArtifactHub.md @@ -59,16 +59,15 @@ helm upgrade --install amass secureCodeBox/amass ## Scanner Configuration -The following security scan configuration example are based on the [Amass User Guide], please take a look at the original documentation for more configuration examples. +The following security scan configuration example are based on the [Amass User Guide](https://github.com/owasp-amass/amass/blob/master/doc/user_guide.md#the-enum-subcommand), please take a look at the original documentation for more configuration examples. - The most basic use of the tool for subdomain enumeration: `amass enum -d example.com` -- Typical parameters for DNS enumeration: `amass enum -v -src -ip -brute -min-for-recursive 2 -d example.com` +- Typical parameters for DNS enumeration: `amass enum -v -brute -min-for-recursive 2 -d example.com` Special command line options: -- Disable generation of altered names `amass enum -noalts -d example.com` +- Enable generation of altered names `amass enum -alts -d example.com` - Turn off recursive brute forcing `amass enum -brute -norecursive -d example.com` -- Disable saving data into a local database `amass enum -nolocaldb -d example.com` - Domain names separated by commas (can be used multiple times) `amass enum -d example.com` ## Requirements @@ -98,17 +97,17 @@ Kubernetes: `>=v1.11.0-0` | scanner.extraVolumeMounts | list | `[{"mountPath":"/amass/output/config.ini","name":"amass-config","subPath":"config.ini"}]` | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.extraVolumes | list | `[{"configMap":{"name":"amass-config"},"name":"amass-config"}]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | -| scanner.image.repository | string | `"caffix/amass"` | Container Image to run the scan | +| scanner.image.repository | string | `"docker.io/securecodebox/scanner-amass"` | Container Image to run the scan | | scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.podSecurityContext | object | `{}` | Optional securityContext set on scanner pod (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":false,"runAsNonRoot":false}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":false,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | | scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | | scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | | scanner.securityContext.readOnlyRootFilesystem | bool | `false` | Prevents write access to the containers file system | -| scanner.securityContext.runAsNonRoot | bool | `false` | Enforces that the scanner image is run as a non root user | +| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.suspend | bool | `false` | if set to true the scan job will be suspended after creation. You can then resume the job using `kubectl resume ` or using a job scheduler like kueue | | scanner.tolerations | list | `[]` | Optional tolerations settings that control how the scanner job is scheduled (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the Kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | diff --git a/scanners/amass/docs/README.DockerHub-Parser.md b/scanners/amass/docs/README.DockerHub-Parser.md index 3314289efe..230421b2f0 100644 --- a/scanners/amass/docs/README.DockerHub-Parser.md +++ b/scanners/amass/docs/README.DockerHub-Parser.md @@ -40,6 +40,11 @@ The secureCodeBox project is running on [Kubernetes](https://kubernetes.io/). To You can find resources to help you get started on our [documentation website](https://www.securecodebox.io) including instruction on how to [install the secureCodeBox project](https://www.securecodebox.io/docs/getting-started/installation) and guides to help you [run your first scans](https://www.securecodebox.io/docs/getting-started/first-scans) with it. +## Notice +This image is a workaround for the official Amass docker image, older amass versions are regularly removed from the official docker registry, this is often breaks our builds. +To prevent this we create a new image based on the official one and push it to our docker registry. +Copyright 2017 Jeff Foley. All rights reserved. + ## Supported Tags - `latest` (represents the latest stable release build) - tagged releases, e.g. `3.0.0`, `2.9.0`, `2.8.0`, `2.7.0` diff --git a/scanners/amass/docs/README.DockerHub-Scanner.md b/scanners/amass/docs/README.DockerHub-Scanner.md new file mode 100644 index 0000000000..f043f28b80 --- /dev/null +++ b/scanners/amass/docs/README.DockerHub-Scanner.md @@ -0,0 +1,107 @@ + + + +

+ License Apache-2.0 + GitHub release (latest SemVer) + OWASP Lab Project + Artifact HUB + GitHub Repo stars + Twitter Follower +

+ +## What is OWASP secureCodeBox? + +

+ secureCodeBox Logo +

+ +_[OWASP secureCodeBox][scb-github]_ is an automated and scalable open source solution that can be used to integrate various *security vulnerability scanners* with a simple and lightweight interface. The _secureCodeBox_ mission is to support *DevSecOps* Teams to make it easy to automate security vulnerability testing in different scenarios. + +With the _secureCodeBox_ we provide a toolchain for continuous scanning of applications to find the low-hanging fruit issues early in the development process and free the resources of the penetration tester to concentrate on the major security issues. + +The secureCodeBox project is running on [Kubernetes](https://kubernetes.io/). To install it you need [Helm](https://helm.sh), a package manager for Kubernetes. It is also possible to start the different integrated security vulnerability scanners based on a docker infrastructure. + +### Quickstart with secureCodeBox on Kubernetes + +You can find resources to help you get started on our [documentation website](https://www.securecodebox.io) including instruction on how to [install the secureCodeBox project](https://www.securecodebox.io/docs/getting-started/installation) and guides to help you [run your first scans](https://www.securecodebox.io/docs/getting-started/first-scans) with it. + +## Notice +This image is a workaround for the official Amass docker image, older amass versions are regularly removed from the official docker registry, this is often breaks our builds. +To prevent this we create a new image based on the official one and push it to our docker registry. +Copyright 2017 Jeff Foley. All rights reserved. + +## Supported Tags +- `latest` (represents the latest stable release build) +- tagged releases, e.g. `3.0.0`, `2.9.0`, `2.8.0`, `2.7.0` + +## How to use this image +This `scanner` image is intended to work in combination with the corresponding `parser` image to parse the scanner `findings` to generic secureCodeBox results. For more information details please take a look at the [project page][scb-docs] or [documentation page][https://www.securecodebox.io/docs/scanners/Amass]. + +```bash +docker pull securecodebox/scanner-amass +``` + +## What is OWASP Amass? + +:::caution +Amass is currently not functional in the secureCodeBox due to a bug in the underlying docker image. We are working on a fix. +See [Issue #1847](https://github.com/secureCodeBox/secureCodeBox/issues/1847). +::: + +The [OWASP Amass Project][owasp_amass_project] has developed a tool to help information security professionals perform network mapping of attack surfaces and perform external asset discovery using open source information gathering and active reconnaissance techniques. To learn more about the Amass scanner itself visit [OWASP Amass Project][owasp_amass_project] or [Amass GitHub]. + +## Scanner Configuration + +The following security scan configuration example are based on the [Amass User Guide](https://github.com/owasp-amass/amass/blob/master/doc/user_guide.md#the-enum-subcommand), please take a look at the original documentation for more configuration examples. + +- The most basic use of the tool for subdomain enumeration: `amass enum -d example.com` +- Typical parameters for DNS enumeration: `amass enum -v -brute -min-for-recursive 2 -d example.com` + +Special command line options: + +- Enable generation of altered names `amass enum -alts -d example.com` +- Turn off recursive brute forcing `amass enum -brute -norecursive -d example.com` +- Domain names separated by commas (can be used multiple times) `amass enum -d example.com` + +## Community + +You are welcome, please join us on... 👋 + +- [GitHub][scb-github] +- [Slack][scb-slack] +- [Twitter][scb-twitter] + +secureCodeBox is an official [OWASP][scb-owasp] project. + +## License +[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0) + +As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained). + +As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within. + +[scb-owasp]: https://www.owasp.org/index.php/OWASP_secureCodeBox +[scb-docs]: https://www.securecodebox.io/ +[scb-site]: https://www.securecodebox.io/ +[scb-github]: https://github.com/secureCodeBox/ +[scb-twitter]: https://twitter.com/secureCodeBox +[scb-slack]: https://join.slack.com/t/securecodebox/shared_invite/enQtNDU3MTUyOTM0NTMwLTBjOWRjNjVkNGEyMjQ0ZGMyNDdlYTQxYWQ4MzNiNGY3MDMxNThkZjJmMzY2NDRhMTk3ZWM3OWFkYmY1YzUxNTU +[scb-license]: https://github.com/secureCodeBox/secureCodeBox/blob/master/LICENSE +[owasp_amass_project]: https://owasp.org/www-project-amass/ +[amass github]: https://github.com/OWASP/Amass +[amass user guide]: https://github.com/OWASP/Amass/blob/master/doc/user_guide.md From 52ad968cd17156dbea275628e73e9f9529cad6fa Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Tue, 12 Sep 2023 10:23:53 +0200 Subject: [PATCH 29/33] #1833 Included amass upgrade to v4.2.0 Signed-off-by: Ilyes Ben Dlala --- scanners/amass/Chart.yaml | 2 +- scanners/amass/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/scanners/amass/Chart.yaml b/scanners/amass/Chart.yaml index a50cf6beb1..41b79759a6 100644 --- a/scanners/amass/Chart.yaml +++ b/scanners/amass/Chart.yaml @@ -8,7 +8,7 @@ description: A Helm chart for the Amass security scanner that integrates with th type: application # version - gets automatically set to the secureCodeBox release version when the helm charts gets published version: v3.1.0-alpha1 -appVersion: "v4.1.0" +appVersion: "v4.2.0" kubeVersion: ">=v1.11.0-0" annotations: versionApi: https://api.github.com/repos/OWASP/Amass/releases/latest diff --git a/scanners/amass/README.md b/scanners/amass/README.md index f9394c8ad0..e4e4822abd 100644 --- a/scanners/amass/README.md +++ b/scanners/amass/README.md @@ -3,7 +3,7 @@ title: "Amass" category: "scanner" type: "Network" state: "released" -appVersion: "v4.1.0" +appVersion: "v4.2.0" usecase: "Subdomain Enumeration Scanner" --- From f08fcb48502f4812c60dff1ddebcfe8d3184474e Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Tue, 12 Sep 2023 15:01:49 +0200 Subject: [PATCH 30/33] #1833 Renamed the unit test to emptyRelations table, since the term "passive" is deprecated Signed-off-by: Ilyes Ben Dlala --- .../{passive.sqlite => emptyRelations.sqlite} | Bin ...sqlite.license => emptyRelations.sqlite.license} | 0 scanners/amass/parser/parser.test.js | 4 ++-- 3 files changed, 2 insertions(+), 2 deletions(-) rename scanners/amass/parser/__testFiles__/{passive.sqlite => emptyRelations.sqlite} (100%) rename scanners/amass/parser/__testFiles__/{passive.sqlite.license => emptyRelations.sqlite.license} (100%) diff --git a/scanners/amass/parser/__testFiles__/passive.sqlite b/scanners/amass/parser/__testFiles__/emptyRelations.sqlite similarity index 100% rename from scanners/amass/parser/__testFiles__/passive.sqlite rename to scanners/amass/parser/__testFiles__/emptyRelations.sqlite diff --git a/scanners/amass/parser/__testFiles__/passive.sqlite.license b/scanners/amass/parser/__testFiles__/emptyRelations.sqlite.license similarity index 100% rename from scanners/amass/parser/__testFiles__/passive.sqlite.license rename to scanners/amass/parser/__testFiles__/emptyRelations.sqlite.license diff --git a/scanners/amass/parser/parser.test.js b/scanners/amass/parser/parser.test.js index f6997b7946..5f9b27dfbd 100644 --- a/scanners/amass/parser/parser.test.js +++ b/scanners/amass/parser/parser.test.js @@ -42,9 +42,9 @@ test("parser parses sqlite results database with no tables successfully", async expect(findings).toEqual([]); }); -test("parser parses sqlite results database with empty relations (i.e with -passive arg) successfully", async () => { +test("parser parses sqlite results database with empty relations table successfully", async () => { const fileContent = await readFile( - __dirname + "/__testFiles__/passive.sqlite", + __dirname + "/__testFiles__/emptyRelations.sqlite", ); const findings = await parse(fileContent); From 8b4dbe522ef7e6b66c4cf16cc23591ef0a58734e Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Tue, 12 Sep 2023 15:04:09 +0200 Subject: [PATCH 31/33] #1833 Added a timeout to the amass integration-test since the amass docker image does not exit directly after enum Signed-off-by: Ilyes Ben Dlala --- scanners/amass/integration-tests/amass.test.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scanners/amass/integration-tests/amass.test.js b/scanners/amass/integration-tests/amass.test.js index 6ad4d2c15f..be2d4a6c44 100644 --- a/scanners/amass/integration-tests/amass.test.js +++ b/scanners/amass/integration-tests/amass.test.js @@ -11,10 +11,10 @@ test( const { count } = await scan( "amass-scanner-dummy-scan", "amass", - ["-passive", "-norecursive", "-d", "owasp.org"], + ["-norecursive", "-timeout", "2", "-d", "owasp.org"], 180 ); - expect(count).toBeGreaterThanOrEqual(20); + expect(count).toBeGreaterThanOrEqual(100); // The scan is passive, so we can expect a lot of subdomains }, 6 * 60 * 1000 ); From 5284432a89b291c70f341b1a019b2ec4d905f2d4 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Tue, 12 Sep 2023 16:51:52 +0200 Subject: [PATCH 32/33] #1833 updated unit tests snapshot Signed-off-by: Ilyes Ben Dlala --- scanners/amass/parser/__snapshots__/parser.test.js.snap | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scanners/amass/parser/__snapshots__/parser.test.js.snap b/scanners/amass/parser/__snapshots__/parser.test.js.snap index 9b0df8f15f..6fda32d6b5 100644 --- a/scanners/amass/parser/__snapshots__/parser.test.js.snap +++ b/scanners/amass/parser/__snapshots__/parser.test.js.snap @@ -185,7 +185,7 @@ exports[`parser parses example.com sqlite results database successfully 1`] = ` ] `; -exports[`parser parses sqlite results database with empty relations (i.e with -passive arg) successfully 1`] = ` +exports[`parser parses sqlite results database with empty relations table successfully 1`] = ` [ { "attributes": { From 36f06140dbe84cf235d82abfcd330499cdffabd4 Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Fri, 15 Sep 2023 11:26:18 +0200 Subject: [PATCH 33/33] #1833 Refactor parser async handling Signed-off-by: Jannik Hollenbach --- scanners/amass/parser/parser.js | 136 ++++++++++++++------------- scanners/amass/parser/parser.test.js | 12 +-- 2 files changed, 74 insertions(+), 74 deletions(-) diff --git a/scanners/amass/parser/parser.js b/scanners/amass/parser/parser.js index 81838c3d1b..b248ccb05d 100644 --- a/scanners/amass/parser/parser.js +++ b/scanners/amass/parser/parser.js @@ -2,50 +2,66 @@ // // SPDX-License-Identifier: Apache-2.0 -const sqlite3 = require('sqlite3').verbose(); -const fs = require('fs'); -const path = require('path'); -const os = require('os'); - -async function checkifTableExists(db) { - const query = `select count(*) from sqlite_master m where m.name="assets" OR m.name="relations"` +const sqlite3 = require("sqlite3").verbose(); +const fs = require("node:fs/promises"); +const path = require("node:path"); +const os = require("node:os"); + +async function checkIfTableExists(db) { + const query = `select count(*) from sqlite_master m where m.name="assets" OR m.name="relations"`; + const [row] = await queryAll(db, query); + return row["count(*)"] === 2; +} +function queryAll(db, query) { return new Promise((resolve, reject) => { - db.get(query, [], (err, row) => { + db.all(query, [], (err, rows) => { if (err) { reject(err); return; } - resolve(row["count(*)"] === 2); + resolve(rows); }); }); - } async function openDatabase(fileContent) { - const tempFilePath = path.join(os.tmpdir(), 'temp-sqlite' + '.sqlite'); + const tempFilePath = path.join(os.tmpdir(), "temp-sqlite" + ".sqlite"); // Write the content to a temporary file - await fs.promises.writeFile(tempFilePath, fileContent); + await fs.writeFile(tempFilePath, fileContent); + + return await new Promise((resolve, reject) => { + const db = new sqlite3.Database( + tempFilePath, + sqlite3.OPEN_READONLY, + (err) => { + if (err) { + reject(err.message); + return; + } + } + ); + resolve(db); + }); +} +function closeDatabase(db) { return new Promise((resolve, reject) => { - const db = new sqlite3.Database(tempFilePath, sqlite3.OPEN_READONLY, (err) => { + db.close((err) => { + resolve(); if (err) { - reject(err.message); - return; + reject(err); } }); - resolve(db); }); } async function parse(fileContent) { const db = await openDatabase(fileContent); - const tableExists = await checkifTableExists(db); + const tableExists = await checkIfTableExists(db); if (!tableExists) return []; - return new Promise((resolve, reject) => { - - const query = ` + const query = ` WITH relation_chain AS ( SELECT fqdn.content AS subdomain, @@ -77,54 +93,40 @@ async function parse(fileContent) { LEFT JOIN relations r ON rc.asn_id = r.from_asset_id AND r.type = 'managed_by' LEFT JOIN assets a ON r.to_asset_id = a.id;`; - db.all(query, [], (err, rows) => { - if (err) { - reject(err); - return; - } - - const results = rows.map((row) => { - // Parse the stringified JSON values - const domainObj = JSON.parse(row.domain); - const subdomainObj = JSON.parse(row.subdomain); - const ipObj = JSON.parse(row.ip); - const cidrObj = JSON.parse(row.cidr); - const asnObj = JSON.parse(row.asn); - const managedByObj = JSON.parse(row.managed_by); - - return { - name: subdomainObj.name, - identified_at: null, - description: `Found subdomain ${subdomainObj.name}`, - category: "Subdomain", - location: subdomainObj.name, - osi_layer: "NETWORK", - severity: "INFORMATIONAL", - attributes: { - addresses: { - ip: ipObj?.address || null, - cidr: cidrObj?.cidr || null, - asn: asnObj?.number || null, - desc: managedByObj?.name || null - }, - domain: domainObj?.name || null, - hostname: subdomainObj?.name || null, - ip_addresses: ipObj?.address || null, - }, - }; - }); - - resolve(results); - - db.close((closeErr) => { - if (closeErr) { - reject(closeErr.message); - } - }); - }); + const rows = await queryAll(db, query); + + await closeDatabase(db); + + return rows.map((row) => { + // Parse the stringified JSON values + const domainObj = JSON.parse(row.domain); + const subdomainObj = JSON.parse(row.subdomain); + const ipObj = JSON.parse(row.ip); + const cidrObj = JSON.parse(row.cidr); + const asnObj = JSON.parse(row.asn); + const managedByObj = JSON.parse(row.managed_by); + + return { + name: subdomainObj.name, + identified_at: null, + description: `Found subdomain ${subdomainObj.name}`, + category: "Subdomain", + location: subdomainObj.name, + osi_layer: "NETWORK", + severity: "INFORMATIONAL", + attributes: { + addresses: { + ip: ipObj?.address || null, + cidr: cidrObj?.cidr || null, + asn: asnObj?.number || null, + desc: managedByObj?.name || null, + }, + domain: domainObj?.name || null, + hostname: subdomainObj?.name || null, + ip_addresses: ipObj?.address || null, + }, + }; }); } - - module.exports.parse = parse; diff --git a/scanners/amass/parser/parser.test.js b/scanners/amass/parser/parser.test.js index 5f9b27dfbd..d8af5b4119 100644 --- a/scanners/amass/parser/parser.test.js +++ b/scanners/amass/parser/parser.test.js @@ -2,11 +2,9 @@ // // SPDX-License-Identifier: Apache-2.0 -const fs = require("fs"); -const util = require("util"); -const readFile = util.promisify(fs.readFile); +const {readFile} = require("node:fs/promises"); -const { parse } = require("./parser"); +const {parse} = require("./parser"); const { validateParser, @@ -26,7 +24,7 @@ test("parser parses sqlite results database with empty tables successfully", asy const fileContent = await readFile( __dirname + "/__testFiles__/emptyTables.sqlite" ); - + const findings = await parse(fileContent); await expect(validateParser(findings)).resolves.toBeUndefined(); expect(findings).toEqual([]); @@ -34,7 +32,7 @@ test("parser parses sqlite results database with empty tables successfully", asy test("parser parses sqlite results database with no tables successfully", async () => { const fileContent = await readFile( - __dirname + "/__testFiles__/noTables.sqlite", + __dirname + "/__testFiles__/noTables.sqlite" ); const findings = await parse(fileContent); @@ -44,7 +42,7 @@ test("parser parses sqlite results database with no tables successfully", async test("parser parses sqlite results database with empty relations table successfully", async () => { const fileContent = await readFile( - __dirname + "/__testFiles__/emptyRelations.sqlite", + __dirname + "/__testFiles__/emptyRelations.sqlite" ); const findings = await parse(fileContent);