-
Notifications
You must be signed in to change notification settings - Fork 50
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(secure-vm): implement sysdig_secure_accept_vulnerability_risk re…
…source (#579) * chore(nix): add flake for reproducible development environment * build: update project to go 1.23 * fix: solve vulnerabilities by upgrading deps Solved the following vulnerabilities: - GO-2024-2947 - GO-2024-2687 - GO-2024-2611 - GO-2023-2153 * feat: implement sysdig_secure_accept_vulnerability_risk resource * build(nix): add package and app to bundle terraform with the provider * build(nix): add devshell to be able to launch a local dev shell from remote/local code * build(nix): use 1.0.0-local version in the nix package * fix: use correct format for expiration_date * fix(lint): solve linter problems * chore(build): downgrade dependencies from sysdig that break the tests * fix(lint): adjust drift in lint options from makefile to gh actions * ci: reenable go:build flag for tf_acc_sysdig_secure * fix(ci): use the api.us1.sysdig.com url in case of secure.sysdig.com * docs: add doc for sysdig_secure_vulnerability_accept_risk * fix(ci): restore or remove env var from tests * ci: add more dependencies to check target * chore: update flake dependencies to update terraform to 1.10 * fix(docs): correct example of hostname_contains * docs: clarify that image wildcard can only be used at the beginning or the end * docs: rename opt args to context args and clarify they are not fully optional * Update website/docs/r/secure_vulnerability_accept_risk.md Co-authored-by: Alvaro Iradier <airadier@gmail.com> * Update website/docs/r/secure_vulnerability_accept_risk.md Co-authored-by: Alvaro Iradier <airadier@gmail.com> * fix(docs): add again the rule risk acceptance * ci: remove hacky way to make tests pass in us1 --------- Co-authored-by: Alvaro Iradier <airadier@gmail.com>
- Loading branch information
1 parent
edee724
commit b442838
Showing
9 changed files
with
1,206 additions
and
52 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,98 @@ | ||
| package v2 | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "time" | ||
| ) | ||
|
|
||
| type ( | ||
| EntityType string | ||
| ReasonType string | ||
| StatusType string | ||
| StageType string | ||
| ContextType string | ||
| ) | ||
|
|
||
| const ( | ||
| EntityTypeImageName EntityType = "imageName" | ||
| EntityTypeImagePrefix EntityType = "imagePrefix" | ||
| EntityTypeImageSuffix EntityType = "imageSuffix" | ||
| EntityTypeImageNameContains EntityType = "imageNameContains" | ||
| EntityTypeVulnerability EntityType = "vulnerability" | ||
| EntityTypeHostName EntityType = "hostName" | ||
| EntityTypeHostNameContains EntityType = "hostNameContains" | ||
| EntityTypePolicyRule EntityType = "policyRule" | ||
| ) | ||
|
|
||
| const ( | ||
| ReasonRiskTransferred ReasonType = "RiskTransferred" | ||
| ReasonRiskAvoided ReasonType = "RiskAvoided" | ||
| ReasonRiskMitigated ReasonType = "RiskMitigated" | ||
| ReasonRiskOwned ReasonType = "RiskOwned" | ||
| ReasonRiskNotRelevant ReasonType = "RiskNotRelevant" | ||
| ReasonCustom ReasonType = "Custom" | ||
| ) | ||
|
|
||
| func ReasonTypeFromString(value string) (ReasonType, error) { | ||
| t := ReasonType(value) | ||
| switch t { | ||
| case ReasonRiskTransferred, ReasonRiskAvoided, ReasonRiskMitigated, ReasonRiskOwned, ReasonRiskNotRelevant, ReasonCustom: | ||
| return t, nil | ||
| default: | ||
| return "", fmt.Errorf("unsupported reason type: %s", value) | ||
| } | ||
| } | ||
|
|
||
| const ( | ||
| StatusActive StatusType = "active" | ||
| StatusExpired StatusType = "expired" | ||
| ) | ||
|
|
||
| const ( | ||
| ContextTypeImageName ContextType = "imageName" | ||
| ContextTypeImagePrefix ContextType = "imagePrefix" | ||
| ContextTypeImageSuffix ContextType = "imageSuffix" | ||
| ContextTypeImageNameContains ContextType = "imageNameContains" | ||
| ContextTypeHostName ContextType = "hostName" | ||
| ContextTypeHostNameContains ContextType = "hostNameContains" | ||
| ContextTypePackageName ContextType = "packageName" | ||
| ContextTypePackageVersion ContextType = "packageVersion" | ||
| ) | ||
|
|
||
| type AcceptVulnerabilityRiskRequest struct { | ||
| EntityType EntityType `json:"entityType"` | ||
| EntityValue string `json:"entityValue"` | ||
| Reason ReasonType `json:"reason"` | ||
| Description string `json:"description"` | ||
| ExpirationDate string `json:"expirationDate,omitempty"` | ||
| Context []AcceptVulnerabilityRiskContext `json:"context"` | ||
| Stages []StageType `json:"stages,omitempty"` | ||
| } | ||
|
|
||
| type UpdateAcceptVulnerabilityRiskRequest struct { | ||
| ID string `json:"id"` | ||
| ExpirationDate string `json:"expirationDate,omitempty"` | ||
| Reason ReasonType `json:"reason"` | ||
| Description string `json:"description"` | ||
| } | ||
|
|
||
| type AcceptVulnerabilityRisk struct { | ||
| ID string `json:"id"` | ||
| EntityType EntityType `json:"entityType"` | ||
| EntityValue string `json:"entityValue"` | ||
| Reason ReasonType `json:"reason"` | ||
| Description string `json:"description"` | ||
| ExpirationDate string `json:"expirationDate,omitempty"` | ||
| Status StatusType `json:"status"` | ||
| CreatedAt time.Time `json:"createdAt,omitempty"` | ||
| UpdatedAt time.Time `json:"updatedAt,omitempty"` | ||
| CreatedBy string `json:"createdBy,omitempty"` | ||
| UpdatedBy string `json:"updatedBy,omitempty"` | ||
| Context []AcceptVulnerabilityRiskContext `json:"context"` | ||
| Stages []StageType `json:"stages,omitempty"` | ||
| } | ||
|
|
||
| type AcceptVulnerabilityRiskContext struct { | ||
| ContextType ContextType `json:"contextType"` | ||
| ContextValue string `json:"contextValue"` | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,104 @@ | ||
| package v2 | ||
|
|
||
| import ( | ||
| "context" | ||
| "fmt" | ||
| "net/http" | ||
| ) | ||
|
|
||
| type PostureVulnerabilityAcceptRiskInterface interface { | ||
| Base | ||
|
|
||
| SaveAcceptVulnerabilityRisk(ctx context.Context, p *AcceptVulnerabilityRiskRequest) (*AcceptVulnerabilityRisk, int, error) | ||
| GetAcceptanceVulnerabilityRisk(ctx context.Context, id string) (*AcceptVulnerabilityRisk, int, error) | ||
| DeleteAcceptanceVulnerabilityRisk(ctx context.Context, id string) error | ||
| UpdateAcceptanceVulnerabilityRisk(ctx context.Context, p *UpdateAcceptVulnerabilityRiskRequest) (*AcceptVulnerabilityRisk, int, error) | ||
| } | ||
|
|
||
| const ( | ||
| AcceptVulnerabilityRiskCreatePath = "%s/secure/vulnerability/v1beta1/accepted-risks" | ||
| AcceptVulnerabilityRiskGetPath = "%s/secure/vulnerability/v1beta1/accepted-risks/%s" | ||
| AcceptVulnerabilityRiskDeletePath = "%s/secure/vulnerability/v1beta1/accepted-risks/%s" | ||
| AcceptVulnerabilityRiskUpdatePath = "%s/secure/vulnerability/v1beta1/accepted-risks/%s" | ||
| ) | ||
|
|
||
| func (c *Client) SaveAcceptVulnerabilityRisk(ctx context.Context, p *AcceptVulnerabilityRiskRequest) (*AcceptVulnerabilityRisk, int, error) { | ||
| payload, err := Marshal(p) | ||
| if err != nil { | ||
| return nil, 0, err | ||
| } | ||
|
|
||
| response, err := c.requester.Request(ctx, http.MethodPost, fmt.Sprintf(AcceptVulnerabilityRiskCreatePath, c.config.url), payload) | ||
| if err != nil { | ||
| return nil, 0, err | ||
| } | ||
| defer response.Body.Close() | ||
|
|
||
| if response.StatusCode != http.StatusCreated { | ||
| return nil, response.StatusCode, c.ErrorFromResponse(response) | ||
| } | ||
|
|
||
| resp, err := Unmarshal[AcceptVulnerabilityRisk](response.Body) | ||
| if err != nil { | ||
| return nil, 0, err | ||
| } | ||
|
|
||
| return &resp, 0, nil | ||
| } | ||
|
|
||
| func (c *Client) GetAcceptanceVulnerabilityRisk(ctx context.Context, id string) (*AcceptVulnerabilityRisk, int, error) { | ||
| response, err := c.requester.Request(ctx, http.MethodGet, fmt.Sprintf(AcceptVulnerabilityRiskGetPath, c.config.url, id), nil) | ||
| if err != nil { | ||
| return nil, 0, err | ||
| } | ||
| defer response.Body.Close() | ||
|
|
||
| if response.StatusCode != http.StatusOK { | ||
| return nil, response.StatusCode, c.ErrorFromResponse(response) | ||
| } | ||
|
|
||
| resp, err := Unmarshal[AcceptVulnerabilityRisk](response.Body) | ||
| if err != nil { | ||
| return nil, 0, err | ||
| } | ||
|
|
||
| return &resp, 0, nil | ||
| } | ||
|
|
||
| func (c *Client) DeleteAcceptanceVulnerabilityRisk(ctx context.Context, id string) error { | ||
| response, err := c.requester.Request(ctx, http.MethodDelete, fmt.Sprintf(AcceptVulnerabilityRiskDeletePath, c.config.url, id), nil) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| defer response.Body.Close() | ||
|
|
||
| if response.StatusCode != http.StatusNoContent { | ||
| return c.ErrorFromResponse(response) | ||
| } | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| func (c *Client) UpdateAcceptanceVulnerabilityRisk(ctx context.Context, p *UpdateAcceptVulnerabilityRiskRequest) (*AcceptVulnerabilityRisk, int, error) { | ||
| payload, err := Marshal(p) | ||
| if err != nil { | ||
| return nil, 0, err | ||
| } | ||
|
|
||
| response, err := c.requester.Request(ctx, http.MethodPut, fmt.Sprintf(AcceptVulnerabilityRiskUpdatePath, c.config.url, p.ID), payload) | ||
| if err != nil { | ||
| return nil, 0, err | ||
| } | ||
| defer response.Body.Close() | ||
|
|
||
| if response.StatusCode != http.StatusOK { | ||
| return nil, response.StatusCode, c.ErrorFromResponse(response) | ||
| } | ||
|
|
||
| resp, err := Unmarshal[AcceptVulnerabilityRisk](response.Body) | ||
| if err != nil { | ||
| return nil, 0, err | ||
| } | ||
|
|
||
| return &resp, 0, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.