Skip to content

Commit c2abb8a

Browse files
Strum355Strum355
committed
feat: add configurable values for exploit intelligence integration
1 parent cf6a851 commit c2abb8a

7 files changed

Lines changed: 286 additions & 5 deletions

File tree

‎config/samples/v1_trustedprofileanalyzer.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ spec:
77
appDomain: change-me
88
collector: {}
99
database: {}
10+
exploitIntelligence:
11+
enabled: false
1012
infrastructure:
1113
port: 9010
1214
ingress: {}
@@ -64,6 +66,4 @@ spec:
6466
storage: {}
6567
tls: {}
6668
tracing:
67-
enabled: false
68-
69-
69+
enabled: false

‎helm-charts/redhat-trusted-profile-analyzer/templates/helpers/_auth.tpl‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,9 @@ authentication:
9898

9999
additionalPermissions:
100100
- "ai"
101+
- "create.exploitIntelligence"
101102
- "read.advisory"
103+
- "read.exploitIntelligence"
102104
- "read.importer"
103105
- "read.metadata"
104106
- "read.sbom"
@@ -181,7 +183,7 @@ authentication:
181183
issuerUrl: {{ include "trustification.oidc.issuerUrlForClient" (dict "root" .root "clientId" "frontend" ) }}
182184
scopeMappings: &keycloakScopeMappings
183185
"create:document": [ "create.advisory", "create.importer", "create.metadata", "create.sbom", "create.sbomGroup", "create.weakness", "upload.dataset" ]
184-
"read:document": [ "ai", "read.advisory", "read.importer", "read.metadata", "read.sbom", "read.sbomGroup", "read.weakness", "read.systemInformation" ]
186+
"read:document": [ "ai", "create.exploitIntelligence", "read.advisory", "read.exploitIntelligence", "read.importer", "read.metadata", "read.sbom", "read.sbomGroup", "read.weakness", "read.systemInformation" ]
185187
"update:document": [ "update.advisory", "update.importer", "update.metadata", "update.sbom", "update.sbomGroup", "update.weakness" ]
186188
"delete:document": [ "delete.advisory", "delete.importer", "delete.metadata", "delete.sbom", "delete.sbomGroup", "delete.vulnerability", "delete.weakness" ]
187189
{{- with .root.Values.tls.additionalTrustAnchor }}

‎helm-charts/redhat-trusted-profile-analyzer/templates/helpers/_exploit_intelligence.tpl‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
{{/*
2+
Exploit Intelligence configuration env-vars.
3+
4+
Arguments (dict):
5+
* root - .
6+
*/}}
7+
{{- define "trustification.exploit-intelligence.envVars" }}
8+
9+
{{- if .root.Values.exploitIntelligence.enabled }}
10+
11+
{{- $ei := .root.Values.exploitIntelligence }}
12+
13+
- name: EXPLOIT_INTELLIGENCE_URL
14+
{{- include "trustification.common.requiredEnvVarValue" (dict "value" $ei.url "msg" "exploitIntelligence.url is required when exploitIntelligence.enabled is true") | nindent 2 }}
15+
16+
{{- with $ei.uiUrl }}
17+
- name: EXPLOIT_INTELLIGENCE_UI_URL
18+
{{- include "trustification.common.envVarValue" . | nindent 2 }}
19+
{{- end }}
20+
21+
{{- with $ei.pollInterval }}
22+
- name: EXPLOIT_INTELLIGENCE_POLL_INTERVAL
23+
value: {{ . | quote }}
24+
{{- end }}
25+
26+
{{- with $ei.maxPollDuration }}
27+
- name: EXPLOIT_INTELLIGENCE_MAX_POLL_DURATION
28+
value: {{ . | quote }}
29+
{{- end }}
30+
31+
{{- with $ei.uploadMaxRetries }}
32+
- name: EXPLOIT_INTELLIGENCE_UPLOAD_MAX_RETRIES
33+
value: {{ . | quote }}
34+
{{- end }}
35+
36+
{{- with $ei.uploadRetryDelay }}
37+
- name: EXPLOIT_INTELLIGENCE_UPLOAD_RETRY_DELAY
38+
value: {{ . | quote }}
39+
{{- end }}
40+
41+
{{- with $ei.maxConsecutivePollFailures }}
42+
- name: EXPLOIT_INTELLIGENCE_MAX_CONSECUTIVE_POLL_FAILURES
43+
value: {{ . | quote }}
44+
{{- end }}
45+
46+
{{- with $ei.authToken }}
47+
- name: EXPLOIT_INTELLIGENCE_AUTH_TOKEN
48+
{{- include "trustification.common.envVarValue" . | nindent 2 }}
49+
{{- end }}
50+
51+
{{- with $ei.oidc }}
52+
53+
{{- with .clientId }}
54+
- name: EXPLOIT_INTELLIGENCE_OIDC_CLIENT_ID
55+
{{- include "trustification.common.envVarValue" . | nindent 2 }}
56+
{{- end }}
57+
58+
{{- with .clientSecret }}
59+
- name: EXPLOIT_INTELLIGENCE_OIDC_CLIENT_SECRET
60+
{{- include "trustification.common.envVarValue" . | nindent 2 }}
61+
{{- end }}
62+
63+
{{- with .issuerUrl }}
64+
- name: EXPLOIT_INTELLIGENCE_OIDC_ISSUER_URL
65+
{{- include "trustification.common.envVarValue" . | nindent 2 }}
66+
{{- end }}
67+
68+
{{- with .refreshBefore }}
69+
- name: EXPLOIT_INTELLIGENCE_OIDC_REFRESH_BEFORE
70+
value: {{ . | quote }}
71+
{{- end }}
72+
73+
{{- if .tlsInsecure }}
74+
- name: EXPLOIT_INTELLIGENCE_OIDC_TLS_INSECURE
75+
value: "true"
76+
{{- end }}
77+
78+
{{- end }}{{/* with $ei.oidc */}}
79+
80+
{{- end }}{{/* if enabled */}}
81+
82+
{{- end }}

‎helm-charts/redhat-trusted-profile-analyzer/templates/services/server/030-Deployment.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ spec:
5353
{{- include "trustification.postgres.envVars" (dict "root" . "database" .Values.database) | nindent 12 }}
5454
{{- include "trustification.storage.envVars" $mod | nindent 12 }}
5555
{{- include "trustification.oidc.swaggerUi" $mod | nindent 12 }}
56+
{{- include "trustification.exploit-intelligence.envVars" $mod | nindent 12 }}
5657

5758
{{- with (include "trustification.application.cache.ttl" . | trim) }}
5859
- name: TRUSTD_PAGINATION_TOTAL_CACHE_TTL

‎helm-charts/redhat-trusted-profile-analyzer/values.schema.json‎

Lines changed: 102 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,9 @@
6464
"oidc": {
6565
"$ref": "#/definitions/Oidc"
6666
},
67+
"exploitIntelligence": {
68+
"$ref": "#/definitions/ExploitIntelligence"
69+
},
6770
"readOnly": {
6871
"type": "boolean",
6972
"default": false,
@@ -253,7 +256,7 @@
253256
},
254257
"cacheTTL": {
255258
"type": "string",
256-
"description": "the time a cache is allowed to live (in s) before forcing a reload.\n"
259+
"description": "Enable read-only mode. When true, the server rejects all mutating API\nrequests with 503 and the importer suspends all import jobs.\nthe time a cache is allowed to live (in s) before forcing a reload.\n"
257260
}
258261
}
259262
}
@@ -453,6 +456,31 @@
453456
}
454457
}
455458
}
459+
},
460+
{
461+
"if": {
462+
"properties": {
463+
"exploitIntelligence": {
464+
"properties": {
465+
"enabled": {
466+
"const": true
467+
}
468+
},
469+
"required": [
470+
"enabled"
471+
]
472+
}
473+
}
474+
},
475+
"then": {
476+
"properties": {
477+
"exploitIntelligence": {
478+
"required": [
479+
"url"
480+
]
481+
}
482+
}
483+
}
456484
}
457485
],
458486
"definitions": {
@@ -1158,6 +1186,79 @@
11581186
"description": "The number of HTTP workers of the Actix application.\n\nAlso see: <https://actix.rs/docs/server/#multi-threading>\n"
11591187
}
11601188
}
1189+
},
1190+
"ExploitIntelligence": {
1191+
"type": "object",
1192+
"additionalProperties": false,
1193+
"description": "Configuration for the Exploit Intelligence integration. When enabled, trustify can submit\nSBOMs and CVEs to an external EI client service (agent-morpheus-client) for automated\nvulnerability analysis and VEX document generation.\n",
1194+
"properties": {
1195+
"enabled": {
1196+
"type": "boolean",
1197+
"description": "Enable the Exploit Intelligence integration.\n",
1198+
"default": false
1199+
},
1200+
"url": {
1201+
"$ref": "#/definitions/ValueOrRef",
1202+
"description": "Base URL of the EI client service (agent-morpheus-client).\n"
1203+
},
1204+
"uiUrl": {
1205+
"$ref": "#/definitions/ValueOrRef",
1206+
"description": "Base URL of the EI web UI for deep-linking to reports. Fallsback to base URL of the EI client service if unset.\n"
1207+
},
1208+
"pollInterval": {
1209+
"type": "string",
1210+
"description": "Polling interval for analysis completion (humantime, e.g. \"30s\").\n"
1211+
},
1212+
"maxPollDuration": {
1213+
"type": "string",
1214+
"description": "Maximum duration before polling is considered timed out (humantime, e.g. \"30m\").\n"
1215+
},
1216+
"uploadMaxRetries": {
1217+
"type": "integer",
1218+
"minimum": 0,
1219+
"description": "Maximum number of upload retry attempts.\n"
1220+
},
1221+
"uploadRetryDelay": {
1222+
"type": "string",
1223+
"description": "Initial delay between upload retries (humantime, exponential backoff).\n"
1224+
},
1225+
"maxConsecutivePollFailures": {
1226+
"type": "integer",
1227+
"minimum": 0,
1228+
"description": "Maximum consecutive poll failures before giving up.\n"
1229+
},
1230+
"oidc": {
1231+
"$ref": "#/definitions/ExploitIntelligenceOidc"
1232+
}
1233+
}
1234+
},
1235+
"ExploitIntelligenceOidc": {
1236+
"type": "object",
1237+
"additionalProperties": false,
1238+
"description": "OIDC credentials for authenticating with the EI service using client credentials flow.\nAll three of clientId, clientSecret, and issuerUrl must be set together.\n",
1239+
"properties": {
1240+
"clientId": {
1241+
"$ref": "#/definitions/ValueOrRef",
1242+
"description": "OIDC client ID for EI service authentication.\n"
1243+
},
1244+
"clientSecret": {
1245+
"$ref": "#/definitions/ValueOrRef",
1246+
"description": "OIDC client secret for EI service authentication.\n"
1247+
},
1248+
"issuerUrl": {
1249+
"$ref": "#/definitions/ValueOrRef",
1250+
"description": "OIDC issuer URL for EI service authentication (client credentials flow with discovery).\n"
1251+
},
1252+
"refreshBefore": {
1253+
"type": "string",
1254+
"description": "Duration an access token must still be valid before requesting a new one (humantime).\n"
1255+
},
1256+
"tlsInsecure": {
1257+
"type": "boolean",
1258+
"default": false,
1259+
"description": "Allow insecure TLS connections with the EI OIDC issuer.\n"
1260+
}
1261+
}
11611262
}
11621263
}
11631264
}

‎helm-charts/redhat-trusted-profile-analyzer/values.schema.yaml‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,9 @@ properties:
6767
oidc:
6868
$ref: "#/definitions/Oidc"
6969

70+
exploitIntelligence:
71+
$ref: "#/definitions/ExploitIntelligence"
72+
7073
readOnly:
7174
type: boolean
7275
default: false
@@ -349,6 +352,19 @@ allOf:
349352
collector:
350353
required:
351354
- endpoint
355+
- if:
356+
properties:
357+
exploitIntelligence:
358+
properties:
359+
enabled:
360+
const: true
361+
required:
362+
- enabled
363+
then:
364+
properties:
365+
exploitIntelligence:
366+
required:
367+
- url
352368

353369
# all the definitions
354370

@@ -910,3 +926,79 @@ definitions:
910926
The number of HTTP workers of the Actix application.
911927
912928
Also see: <https://actix.rs/docs/server/#multi-threading>
929+
930+
ExploitIntelligence:
931+
type: object
932+
additionalProperties: false
933+
description: |
934+
Configuration for the Exploit Intelligence integration. When enabled, trustify can submit
935+
SBOMs and CVEs to an external EI client service (agent-morpheus-client) for automated
936+
vulnerability analysis and VEX document generation.
937+
properties:
938+
enabled:
939+
type: boolean
940+
description: |
941+
Enable the Exploit Intelligence integration.
942+
default: false
943+
url:
944+
$ref: "#/definitions/ValueOrRef"
945+
description: |
946+
Base URL of the EI client service (agent-morpheus-client).
947+
uiUrl:
948+
$ref: "#/definitions/ValueOrRef"
949+
description: |
950+
Base URL of the EI web UI for deep-linking to reports. Fallsback to base URL of the EI client service if unset.
951+
pollInterval:
952+
type: string
953+
description: |
954+
Polling interval for analysis completion (humantime, e.g. "30s").
955+
maxPollDuration:
956+
type: string
957+
description: |
958+
Maximum duration before polling is considered timed out (humantime, e.g. "30m").
959+
uploadMaxRetries:
960+
type: integer
961+
minimum: 0
962+
description: |
963+
Maximum number of upload retry attempts.
964+
uploadRetryDelay:
965+
type: string
966+
description: |
967+
Initial delay between upload retries (humantime, exponential backoff).
968+
maxConsecutivePollFailures:
969+
type: integer
970+
minimum: 0
971+
description: |
972+
Maximum consecutive poll failures before giving up.
973+
oidc:
974+
$ref: "#/definitions/ExploitIntelligenceOidc"
975+
976+
ExploitIntelligenceOidc:
977+
type: object
978+
additionalProperties: false
979+
description: |
980+
OIDC credentials for authenticating with the EI service using client credentials flow.
981+
All three of clientId, clientSecret, and issuerUrl must be set together.
982+
properties:
983+
clientId:
984+
$ref: "#/definitions/ValueOrRef"
985+
description: |
986+
OIDC client ID for EI service authentication.
987+
clientSecret:
988+
$ref: "#/definitions/ValueOrRef"
989+
description: |
990+
OIDC client secret for EI service authentication.
991+
issuerUrl:
992+
$ref: "#/definitions/ValueOrRef"
993+
description: |
994+
OIDC issuer URL for EI service authentication (client credentials flow with discovery).
995+
refreshBefore:
996+
type: string
997+
description: |
998+
Duration an access token must still be valid before requesting a new one (humantime).
999+
tlsInsecure:
1000+
type: boolean
1001+
default: false
1002+
description: |
1003+
Allow insecure TLS connections with the EI OIDC issuer.
1004+

‎helm-charts/redhat-trusted-profile-analyzer/values.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,9 @@ tracing:
4343

4444
collector: {}
4545

46+
exploitIntelligence:
47+
enabled: false
48+
4649
modules:
4750
server:
4851
enabled: true

0 commit comments

Comments
 (0)