142 lines
4.0 KiB
Makefile
142 lines
4.0 KiB
Makefile
set fallback := true
|
|
|
|
export LOCAL_K8S_HOST := env("LOCAL_K8S_HOST", "")
|
|
|
|
[private]
|
|
default:
|
|
@just --list --unsorted --list-submodules
|
|
|
|
# Run Trivy security scan (quick: CRITICAL + HIGH only)
|
|
scan-quick:
|
|
#!/bin/bash
|
|
set -euo pipefail
|
|
just env::check
|
|
echo "Running quick security scan (CRITICAL + HIGH misconfigurations only)..."
|
|
trivy k8s --report summary \
|
|
--severity CRITICAL,HIGH \
|
|
--scanners misconfig \
|
|
--ignorefile .trivyignore \
|
|
"${LOCAL_K8S_HOST}" \
|
|
--timeout 30m
|
|
|
|
# Run Trivy security scan (standard: CRITICAL + HIGH + MEDIUM)
|
|
scan:
|
|
#!/bin/bash
|
|
set -euo pipefail
|
|
just env::check
|
|
echo "Running standard security scan (CRITICAL + HIGH + MEDIUM)..."
|
|
trivy k8s --report summary \
|
|
--severity CRITICAL,HIGH,MEDIUM \
|
|
"${LOCAL_K8S_HOST}" \
|
|
--timeout 30m
|
|
|
|
# Run Trivy security scan (full: all severities)
|
|
scan-full:
|
|
#!/bin/bash
|
|
set -euo pipefail
|
|
just env::check
|
|
echo "Running full security scan (all severities)..."
|
|
trivy k8s --report summary \
|
|
"${LOCAL_K8S_HOST}" \
|
|
--timeout 30m
|
|
|
|
# Run Trivy vulnerability scan only (CRITICAL + HIGH)
|
|
scan-vulns:
|
|
#!/bin/bash
|
|
set -euo pipefail
|
|
just env::check
|
|
echo "Running vulnerability scan (CRITICAL + HIGH only)..."
|
|
trivy k8s --report summary \
|
|
--severity CRITICAL,HIGH \
|
|
--scanners vuln \
|
|
"${LOCAL_K8S_HOST}" \
|
|
--timeout 30m
|
|
|
|
# Run Trivy misconfiguration scan only (CRITICAL + HIGH)
|
|
scan-misconfig:
|
|
#!/bin/bash
|
|
set -euo pipefail
|
|
just env::check
|
|
echo "Running misconfiguration scan (CRITICAL + HIGH only)..."
|
|
trivy k8s --report summary \
|
|
--severity CRITICAL,HIGH \
|
|
--scanners misconfig \
|
|
--ignorefile .trivyignore \
|
|
"${LOCAL_K8S_HOST}" \
|
|
--timeout 30m
|
|
|
|
# Run Trivy RBAC assessment
|
|
scan-rbac:
|
|
#!/bin/bash
|
|
set -euo pipefail
|
|
just env::check
|
|
echo "Running RBAC assessment..."
|
|
trivy k8s --report summary \
|
|
--severity CRITICAL,HIGH \
|
|
--scanners rbac \
|
|
"${LOCAL_K8S_HOST}" \
|
|
--timeout 30m
|
|
|
|
# Run Trivy scan for specific namespace
|
|
scan-namespace namespace severity='CRITICAL,HIGH':
|
|
#!/bin/bash
|
|
set -euo pipefail
|
|
just env::check
|
|
echo "Running security scan for namespace: {{ namespace }}..."
|
|
trivy k8s --report summary \
|
|
--severity {{ severity }} \
|
|
--include-namespaces {{ namespace }} \
|
|
"${LOCAL_K8S_HOST}" \
|
|
--timeout 30m
|
|
|
|
# Show detailed findings for specific namespace
|
|
scan-namespace-detail namespace severity='CRITICAL,HIGH':
|
|
#!/bin/bash
|
|
set -euo pipefail
|
|
just env::check
|
|
echo "Showing detailed findings for namespace: {{ namespace }}..."
|
|
trivy k8s --report all \
|
|
--severity {{ severity }} \
|
|
--include-namespaces {{ namespace }} \
|
|
"${LOCAL_K8S_HOST}" \
|
|
--timeout 30m
|
|
|
|
# Show detailed findings for specific resource
|
|
scan-resource namespace kind name severity='CRITICAL,HIGH':
|
|
#!/bin/bash
|
|
set -euo pipefail
|
|
just env::check
|
|
echo "Showing detailed findings for {{ kind }}/{{ name }} in {{ namespace }}..."
|
|
trivy k8s --report all \
|
|
--severity {{ severity }} \
|
|
--include-namespaces {{ namespace }} \
|
|
"${LOCAL_K8S_HOST}" \
|
|
--timeout 30m | grep -A 50 "{{ kind }}/{{ name }}"
|
|
|
|
# Generate detailed HTML report
|
|
report output='trivy-report.html':
|
|
#!/bin/bash
|
|
set -euo pipefail
|
|
just env::check
|
|
echo "Generating detailed security report..."
|
|
trivy k8s --report all \
|
|
--format template \
|
|
--template "@contrib/html.tpl" \
|
|
--output {{ output }} \
|
|
"${LOCAL_K8S_HOST}" \
|
|
--timeout 30m
|
|
echo "Report saved to: {{ output }}"
|
|
|
|
# Generate JSON report for automation
|
|
report-json output='trivy-report.json':
|
|
#!/bin/bash
|
|
set -euo pipefail
|
|
just env::check
|
|
echo "Generating JSON security report..."
|
|
trivy k8s --report all \
|
|
--format json \
|
|
--output {{ output }} \
|
|
"${LOCAL_K8S_HOST}" \
|
|
--timeout 30m
|
|
echo "Report saved to: {{ output }}"
|