chore: added kyverno validation and updated deps

miracum · Oct 30, 2023 · 47c75e8 · 47c75e8
1 parent 9489084
commit 47c75e8
Show file tree

Hide file tree

Showing 7 changed files with 97 additions and 12 deletions.
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -54,6 +54,31 @@ jobs:
       - name: Generate changelogs (test)
         run: generate-chart-changelog.sh
 
+  test-kyverno:
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Add workspace as safe directory
+        run: |
+          git config --global --add safe.directory /__w/charts/charts
+
+      - name: Checkout
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+        with:
+          fetch-depth: 0
+
+      - name: Update dependencies
+        run: find charts/ ! -path charts/ -maxdepth 1 -type d -exec helm dependency update {} \;
+
+      - name: Test chart against Kyverno policies
+        uses: ckotzbauer/kyverno-test-action@0d96bdb966a134a9062c23284ac5585e44b7dc0b # main
+        with:
+          # for testing
+          chart-dir: charts/fhir-gateway
+          policy-files: |
+            policies/verify-images.yaml
+          kyverno-version: 1.10.3
+          debug: true
+
   test:
     runs-on: ubuntu-22.04
     needs:

diff --git a/.renovaterc.json b/.renovaterc.json
@@ -30,6 +30,10 @@
     {
       "matchPackageNames": ["postgresql", "ghcr.io/chgl/kube-powertools"],
       "extends": ["schedule:monthly"]
+    },
+    {
+      "matchPackagePatterns": ["^ghcr.io\\/miracum\\/"],
+      "pinDigests": false
     }
   ],
   "ignorePaths": [

diff --git a/charts/fhir-gateway/Chart.yaml b/charts/fhir-gateway/Chart.yaml
@@ -14,14 +14,10 @@ dependencies:
     condition: fhir-pseudonymizer.enabled
     version: 0.5.6
     repository: oci://ghcr.io/miracum/charts
-version: 6.0.19
+version: 6.0.20
 annotations:
   # When using the list of objects option the valid supported kinds are
   # added, changed, deprecated, removed, fixed and security.
   artifacthub.io/changes: |
     - kind: changed
-      description: update docker.io/curlimages/curl docker tag to v8.4.0
-    - kind: changed
-      description: refreshed docs with latest helm-docs
-    - kind: changed
-      description: fixed missing seccompProfile in initContainer
+      description: updated ghcr.io/miracum/fhir-gateway image tag to v3.12.4
diff --git a/charts/fhir-gateway/values.yaml b/charts/fhir-gateway/values.yaml
@@ -15,7 +15,7 @@ replicaCount: 1
 image: # +doc-gen:ignore
   registry: ghcr.io
   repository: miracum/fhir-gateway
-  tag: v3.12.4@sha256:865dccda7ebf958bf655ce0e4fefbfddcb6479f111db31a7a500e2a7c59d26e8
+  tag: v3.12.4
   pullPolicy: IfNotPresent
 
 # image pull secrets for the pod

diff --git a/charts/fhir-pseudonymizer/Chart.yaml b/charts/fhir-pseudonymizer/Chart.yaml
@@ -10,7 +10,7 @@ dependencies:
     version: 1.2.7
     repository: oci://ghcr.io/miracum/charts
     condition: vfps.enabled
-version: 0.5.7
+version: 0.5.8
 annotations:
   artifacthub.io/license: Apache-2.0
   artifacthub.io/containsSecurityUpdates: "false"
@@ -22,6 +22,4 @@ annotations:
   # added, changed, deprecated, removed, fixed and security.
   artifacthub.io/changes: |
     - kind: changed
-      description: update docker.io/curlimages/curl docker tag to v8.4.0
-    - kind: changed
-      description: refreshed docs with latest helm-docs
+      description: updated ghcr.io/miracum/fhir-pseudonymizer image tag to v2.21.1
diff --git a/charts/fhir-pseudonymizer/values.yaml b/charts/fhir-pseudonymizer/values.yaml
@@ -34,7 +34,7 @@ gpas:
 image: # +doc-gen:ignore
   registry: ghcr.io
   repository: miracum/fhir-pseudonymizer
-  tag: v2.21.0@sha256:42a49e389f52f52ea8edad38ea276038681b4a317eca628c58f96894805d6a94
+  tag: v2.21.1
   pullPolicy: IfNotPresent
 
 metrics:

diff --git a/policies/verify-images.yaml b/policies/verify-images.yaml
@@ -0,0 +1,62 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: verify-miracum-images
+  annotations:
+    policies.kyverno.io/title: >-
+      Verify signatures and SLSA Provenance for ghcr.io/miracum container images
+    policies.kyverno.io/category: Software Supply Chain Security
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+    policies.kyverno.io/minversion: 1.9.2
+    kyverno.io/kyverno-version: 1.9.2
+    kyverno.io/kubernetes-version: "1.26"
+    policies.kyverno.io/description: >-
+      Provenance is used to identify how an artifact was produced
+      and from where it originated. SLSA provenance is an industry-standard
+      method of representing that provenance. This policy verifies that an
+      image has SLSA provenance and was signed by the expected subject and issuer
+      when produced through GitHub Actions.
+spec:
+  validationFailureAction: Enforce
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-miracum-images
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/miracum/*"
+          attestors:
+            - entries:
+                - keyless:
+                    subject: "https://github.com/miracum/.github/.github/workflows/standard-build.yaml@*"
+                    issuer: "https://token.actions.githubusercontent.com"
+                    rekor:
+                      url: https://rekor.sigstore.dev
+                    additionalExtensions:
+                      githubWorkflowTrigger: release
+                      githubWorkflowName: ci
+                      githubWorkflowRepository: miracum/*
+          attestations:
+            # SLSA attestations
+            - predicateType: https://slsa.dev/provenance/v0.2
+              attestors:
+                - count: 1
+                  entries:
+                    - keyless:
+                        subject: "https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v*"
+                        issuer: "https://token.actions.githubusercontent.com"
+                        rekor:
+                          url: https://rekor.sigstore.dev
+              conditions:
+                - all:
+                    # This expression uses a regex pattern to ensure the builder.id in the attestation is equal to the official
+                    # SLSA provenance generator workflow and uses a tagged release in semver format. If using a specific SLSA
+                    # provenance generation workflow, you may need to adjust the first input as necessary.
+                    - key: "{{ regex_match('^https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v[0-9]+.[0-9]+.[0-9]+$', '{{ builder.id }}') }}"
+                      operator: Equals
+                      value: true