diff --git a/charts/zora/README.md b/charts/zora/README.md index 6c9f2adc..90823a88 100644 --- a/charts/zora/README.md +++ b/charts/zora/README.md @@ -118,6 +118,8 @@ The following table lists the configurable parameters of the Zora chart and thei | kubexnsImage.repository | string | `"ghcr.io/undistro/kubexns"` | kubexns image repository | | kubexnsImage.tag | string | `"v0.1.2"` | kubexns image tag | | customChecksConfigMap | string | `"zora-custom-checks"` | Custom checks ConfigMap name | +| httpsProxy | string | `""` | HTTPS proxy URL | +| noProxy | string | `"kubernetes.default.svc.*,127.0.0.1,localhost"` | Comma-separated list of URL patterns to be excluded from going through the proxy | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, diff --git a/charts/zora/templates/operator/deployment.yaml b/charts/zora/templates/operator/deployment.yaml index 21a3ca84..9bd38ff9 100644 --- a/charts/zora/templates/operator/deployment.yaml +++ b/charts/zora/templates/operator/deployment.yaml @@ -59,6 +59,13 @@ spec: securityContext: {{- toYaml .Values.operator.rbacProxy.securityContext | nindent 12 }} - name: manager + {{- if .Values.httpsProxy }} + env: + - name: HTTPS_PROXY + value: {{ .Values.httpsProxy | quote }} + - name: NO_PROXY + value: {{ .Values.noProxy | quote }} + {{- end }} command: - /manager args: diff --git a/charts/zora/templates/plugins/trivy.yaml b/charts/zora/templates/plugins/trivy.yaml index cd9b025e..72b8cd87 100644 --- a/charts/zora/templates/plugins/trivy.yaml +++ b/charts/zora/templates/plugins/trivy.yaml @@ -31,6 +31,12 @@ spec: env: - name: TRIVY_IGNORE_VULN_DESCRIPTIONS value: {{ .Values.scan.plugins.trivy.ignoreDescriptions | quote }} + {{- if .Values.httpsProxy }} + - name: HTTPS_PROXY + value: {{ .Values.httpsProxy | quote }} + - name: NO_PROXY + value: {{ .Values.noProxy | quote }} + {{- end }} command: - /bin/sh - -c diff --git a/charts/zora/values.yaml b/charts/zora/values.yaml index a9728226..919aeb9e 100644 --- a/charts/zora/values.yaml +++ b/charts/zora/values.yaml @@ -235,3 +235,8 @@ kubexnsImage: # -- Custom checks ConfigMap name customChecksConfigMap: zora-custom-checks + +# -- HTTPS proxy URL +httpsProxy: "" +# -- Comma-separated list of URL patterns to be excluded from going through the proxy +noProxy: kubernetes.default.svc.*,127.0.0.1,localhost diff --git a/cmd/main.go b/cmd/main.go index f8abbf7a..07b03183 100644 --- a/cmd/main.go +++ b/cmd/main.go @@ -108,8 +108,9 @@ func main() { var onClusterUpdate, onClusterDelete saas.ClusterHook var onClusterScanUpdate, onClusterScanDelete saas.ClusterScanHook + client := &http.Client{Transport: &http.Transport{Proxy: http.ProxyFromEnvironment}} if saasWorkspaceID != "" { - saasClient, err := saas.NewClient(saasServer, version, saasWorkspaceID, http.DefaultClient) + saasClient, err := saas.NewClient(saasServer, version, saasWorkspaceID, client) if err != nil { setupLog.Error(err, "unable to create SaaS client", "workspaceID", saasWorkspaceID) os.Exit(1) diff --git a/docs/configuration/https-proxy.md b/docs/configuration/https-proxy.md new file mode 100644 index 00000000..cc087c5e --- /dev/null +++ b/docs/configuration/https-proxy.md @@ -0,0 +1,25 @@ +# HTTPS Proxy + +If your network environment requires the use of a proxy, you must ensure proper configuration of the `httpsProxy` +parameter when running `helm upgrade --install` command. + +```shell +# omitted "helm upgrade --install" command and parameters + +--set httpsProxy="https://secure.proxy.tld" +``` + +Additionally, you can specify URLs that should bypass the proxy, by setting the `noProxy` parameter in comma-separated +list format. Note that this parameter already has a default value: `kubernetes.default.svc.*,127.0.0.1,localhost`. + +Configuring proxy settings enables both `trivy` plugin and `zora-operator` to use the proxy for external requests. + +Zora OSS sends scan results to the following external URL if your installation is integrated with +[Zora Dashboard](../dashboard.md): + +- `https://zora-dashboard.undistro.io` + +While [Trivy](../plugins/trivy.md) downloads vulnerability databases during scans from the following external sources: + +- `ghcr.io/aquasecurity/trivy-db` +- `ghcr.io/aquasecurity/trivy-java-db` diff --git a/mkdocs.yml b/mkdocs.yml index a727fa53..2b58e87c 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -87,6 +87,7 @@ nav: - Suspending scans: configuration/suspend-scan.md - Retain issues: configuration/retain-issues.md - Ignore unfixed vulnerabilities: plugins/trivy/#large-vulnerability-reports + - HTTPS Proxy: configuration/https-proxy.md - "🔌 Plugins": - Overview: plugins/index.md - Misconfiguration: