feat(k8s-test): Try login and obtain API token

[kiblik]

Reopen #10496

[dryrunsecurity]

DryRun Security Summary

The GitHub Actions workflow file k8s-tests.yml manages the secure deployment of DefectDojo on a Kubernetes cluster using Minikube, including setup of essential components like PostgreSQL and Redis, validation steps, credential management, and error handling mechanisms.

Expand for full summary

Summary:

The provided code change is for a GitHub Actions workflow file named k8s-tests.yml that is responsible for deploying the DefectDojo application on a Kubernetes cluster using Minikube. From an application security perspective, the key points to highlight are:

1. The workflow sets up a Minikube cluster, loads the necessary Docker images, and deploys the DefectDojo application using Helm, including the database (PostgreSQL) and message broker (Redis) components, which are important from a security perspective as they handle sensitive application data.

2. The workflow includes several steps to validate the deployment, including checking the status of the Kubernetes resources, waiting for the pods to be ready, and performing a login check, which helps ensure the application is deployed correctly and is accessible.

3. The workflow retrieves the admin password for the DefectDojo application from a Kubernetes secret, which is a common practice, but it's important to ensure that these credentials are properly managed and rotated periodically to maintain security.

4. The workflow performs a simple API check by authenticating with the DefectDojo API using the admin credentials, which is a good practice to ensure the application is functioning correctly, but it's important to consider the security implications of hardcoding these credentials in the workflow.

5. The workflow includes error handling mechanisms, such as retrying the login check and dumping the logs of any pods in an error state, which helps with troubleshooting and identifying potential security issues that may arise during the deployment process.

Files Changed:

• .github/workflows/k8s-tests.yml: This file is a GitHub Actions workflow that is responsible for deploying the DefectDojo application on a Kubernetes cluster using Minikube. The changes in this file focus on ensuring a reliable and secure deployment of the application, including setting up the Kubernetes cluster, validating the deployment, and handling errors.

Code Analysis

We ran 9 analyzers against 1 file and 0 analyzers had findings. 9 analyzers had no findings.

View PR in the DryRun Dashboard.

[mtesauro]

Approved

[dsever]

@kiblik kubectl get svc defectdojo-django -o jsonpath='{.spec.clusterIP}'

unit tests

[cneill]

Any idea why the k8s unit tests are failing? I tried re-running, but no dice.

[kiblik]

Any idea why the k8s unit tests are failing? I tried re-running, but no dice.

Fixed