Merge pull request #614 from kubescape/feature/bump

Updating rules
kubescape · Feb 10, 2025 · 7cb0a4e · 7cb0a4e
2 parents 418bb04 + 6e10501
commit 7cb0a4e
Show file tree

Hide file tree

Showing 4 changed files with 26 additions and 10 deletions.
diff --git a/charts/kubescape-operator/templates/node-agent/default-rule-binding-namespaced.yaml b/charts/kubescape-operator/templates/node-agent/default-rule-binding-namespaced.yaml
@@ -44,4 +44,8 @@ spec:
     - ruleName: "XML External Entity Attack Attempt"
     - ruleName: "Server-Side Template Injection Attack"
     - ruleName: "Command Injection Attempt"
+    - ruleName: "Unexpected Exec Source"
+    - ruleName: "Unexpected Open Source"
+    - ruleName: "Unexpected Symlink Source"
+    - ruleName: "Unexpected Hardlink Source"
 {{- end }}
diff --git a/charts/kubescape-operator/templates/node-agent/default-rule-binding.yaml b/charts/kubescape-operator/templates/node-agent/default-rule-binding.yaml
@@ -62,4 +62,8 @@ spec:
     - ruleName: "XML External Entity Attack Attempt"
     - ruleName: "Server-Side Template Injection Attack"
     - ruleName: "Command Injection Attempt"
+    - ruleName: "Unexpected Exec Source"
+    - ruleName: "Unexpected Open Source"
+    - ruleName: "Unexpected Symlink Source"
+    - ruleName: "Unexpected Hardlink Source"
 {{- end }}
diff --git a/charts/kubescape-operator/tests/__snapshot__/snapshot_test.yaml.snap b/charts/kubescape-operator/tests/__snapshot__/snapshot_test.yaml.snap
@@ -2468,7 +2468,7 @@ all capabilities:
                     fieldRef:
                       fieldPath: metadata.namespace
                 - name: NodeName
-              image: quay.io/kubescape/node-agent:v0.2.238
+              image: quay.io/kubescape/node-agent:v0.2.246
               imagePullPolicy: IfNotPresent
               livenessProbe:
                 httpGet:
@@ -2674,6 +2674,10 @@ all capabilities:
         - ruleName: XML External Entity Attack Attempt
         - ruleName: Server-Side Template Injection Attack
         - ruleName: Command Injection Attempt
+        - ruleName: Unexpected Exec Source
+        - ruleName: Unexpected Open Source
+        - ruleName: Unexpected Symlink Source
+        - ruleName: Unexpected Hardlink Source
   50: |
     apiVersion: networking.k8s.io/v1
     kind: NetworkPolicy
@@ -4659,7 +4663,7 @@ all capabilities:
                       name: cloud-secret
                 - name: OTEL_COLLECTOR_SVC
                   value: otel-collector:4318
-              image: quay.io/kubescape/storage:v0.0.156
+              image: quay.io/kubescape/storage:v0.0.158
               imagePullPolicy: IfNotPresent
               livenessProbe:
                 tcpSocket:
@@ -7701,7 +7705,7 @@ default capabilities:
                     fieldRef:
                       fieldPath: metadata.namespace
                 - name: NodeName
-              image: quay.io/kubescape/node-agent:v0.2.238
+              image: quay.io/kubescape/node-agent:v0.2.246
               imagePullPolicy: IfNotPresent
               livenessProbe:
                 httpGet:
@@ -7905,6 +7909,10 @@ default capabilities:
         - ruleName: XML External Entity Attack Attempt
         - ruleName: Server-Side Template Injection Attack
         - ruleName: Command Injection Attempt
+        - ruleName: Unexpected Exec Source
+        - ruleName: Unexpected Open Source
+        - ruleName: Unexpected Symlink Source
+        - ruleName: Unexpected Hardlink Source
   37: |
     apiVersion: networking.k8s.io/v1
     kind: NetworkPolicy
@@ -9410,7 +9418,7 @@ default capabilities:
                   value: otel-collector:4318
                 - name: DISABLE_VIRTUAL_CRDS
                   value: "true"
-              image: quay.io/kubescape/storage:v0.0.156
+              image: quay.io/kubescape/storage:v0.0.158
               imagePullPolicy: IfNotPresent
               livenessProbe:
                 tcpSocket:
@@ -11890,7 +11898,7 @@ disable otel:
                     fieldRef:
                       fieldPath: metadata.namespace
                 - name: NodeName
-              image: quay.io/kubescape/node-agent:v0.2.238
+              image: quay.io/kubescape/node-agent:v0.2.246
               imagePullPolicy: IfNotPresent
               livenessProbe:
                 httpGet:
@@ -13337,7 +13345,7 @@ disable otel:
                   value: otel-collector:4318
                 - name: DISABLE_VIRTUAL_CRDS
                   value: "true"
-              image: quay.io/kubescape/storage:v0.0.156
+              image: quay.io/kubescape/storage:v0.0.158
               imagePullPolicy: IfNotPresent
               livenessProbe:
                 tcpSocket:
@@ -15476,7 +15484,7 @@ minimal capabilities:
                     fieldRef:
                       fieldPath: metadata.namespace
                 - name: NodeName
-              image: quay.io/kubescape/node-agent:v0.2.238
+              image: quay.io/kubescape/node-agent:v0.2.246
               imagePullPolicy: IfNotPresent
               livenessProbe:
                 httpGet:
@@ -16688,7 +16696,7 @@ minimal capabilities:
                       name: cloud-secret
                 - name: OTEL_COLLECTOR_SVC
                   value: otel-collector:4318
-              image: quay.io/kubescape/storage:v0.0.156
+              image: quay.io/kubescape/storage:v0.0.158
               imagePullPolicy: IfNotPresent
               livenessProbe:
                 tcpSocket:

diff --git a/charts/kubescape-operator/values.yaml b/charts/kubescape-operator/values.yaml
@@ -424,7 +424,7 @@ storage:
   image:
     # -- source code: https://github.com/kubescape/storage
     repository: quay.io/kubescape/storage
-    tag: v0.0.156
+    tag: v0.0.158
     pullPolicy: IfNotPresent
 
   # cleanup interval is a duration string
@@ -448,7 +448,7 @@ nodeAgent:
   image:
     # -- source code: https://github.com/kubescape/node-agent
     repository: quay.io/kubescape/node-agent
-    tag: v0.2.238
+    tag: v0.2.246
     pullPolicy: IfNotPresent
 
   config: