Vault Init script

[v-starodubov]

This is small rework of #3 request, related to #2

Changes:

• Lightweight and secure Docker image that contains all scripts required.
• Init scripts reworked to make API requests directly to k8s API server and Vault API without requiring installed kubectl (and corresponding RBAC permissions in cluster)
• Removed unnecessary dynamic RBAC manifests creation. We don't need to modify them dynamically.
• Deleted external-secrets dependency, because right now it don't have required namespace label for umbrella chart deployment (Changes requested)
• Removed ESO manifests and created templates/tests cases for helm test runs (requires installed ESO)
• Added helm repository, hosted here in helm-repo branch.
• GitHub Actions: build and scan Docker image with Trivy (triggered on tag with proper semver formating), helm packaging and deploying on changes in vault/Chart.yaml.
• Updated README.md with proper commands.

[v-starodubov]

Currently this branch is not fully tested and can contain some errors during run.
I'll update this PR with ready to review when everything is done.

[v-starodubov]

@jradikk ready to review.

[jradikk]

I think Github supports using nice reports for security findings. Although, it might require a subscription. Can you check that please? If it's not an option, let's think about maybe using badges in README or anything else that comes with a nicer UI than a log

[v-starodubov]

There two possible ways:

• SBOM report to Github Dependency Graph.
• SARIF report to Github Code Scanning.

I don't know which is better, so I'll test both.

[v-starodubov]

Choosed SARIF code scanning, because SBOM not working with non-default branches and tags. Example of medium severity report: https://github.com/Alpacked/security-hardening-helm/security/code-scanning/1

Another question about severity of reports, we can have all types in Security tab and GitHub will create alerts only for high and higher thresholds.
Or left or mechanism as is, create security findings only for HIGH and CRITICAL vulnerabilities?

[jradikk]

Let's capture all of them, but fail the build and alert for high and critical only

[v-starodubov]

If we want use SARIF/Code scanning reports, we can't fail our pipeline during scan action because it will prevent results from uploading. I'm thinking on two options:

1. (Lame) Make second scan right before pushing to Docker Hub.
2. Build and scan at (master) branch push (restrict to paths: scripts/*.sh and Dockerfile), build and push at tag push (will be restricted by ruleset if there high or higher errors not resolved).

What do you think?

[jradikk]

Is there an option to create a some sort of an artifact or a variable that would contain a boolean value, based on which a push job is triggered?

[v-starodubov]

Found a workaround for how to run the upload step even if 'scan' found some vulnerabilities, but if SARIF isn't limited by our rule (we can upload a full file with 'limit-severities-for-sarif' parameter) it will always fail if some vulnerabilities are found.

So in that case we need to limit SARIF output to our HIGH and CRITICAL, until trivy-action change something.

[v-starodubov]

Created issue in trivy-action repository: aquasecurity/trivy-action#309

For now, security findings will be limited by high and critical vulnerabilities.