Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: use SNYK_CFG for IaC OCI registry env vars [CFG-1165] #2336

Merged
merged 2 commits into from
Nov 8, 2021
Merged

feat: use SNYK_CFG for IaC OCI registry env vars [CFG-1165] #2336

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
932e69b
feat: use SNYK_CFG for OCI registry env vars
teodora-sandu Nov 2, 2021
0392d12
chore: update help
teodora-sandu Nov 5, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions help/commands-docs/_EXAMPLES.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,15 @@ See `snyk iac --help` for more details and examples:
$ snyk iac test /path/to/tf-plan.json
$ snyk iac test /path/to/arm_file.json

To use your own custom rules to scan IaC configuration files, download the `snyk-iac-rules` SDK from https://github.com/snyk/snyk-iac-rules. Follow the
instructions there to write, build, and push a custom rules bundle and then
either use the Snyk UI to configure your custom rules settings or configure
a remote OCI registry locally by running the following commands:

$ snyk config set oci-registry-url=https://registry-1.docker.io/username/repo:tag
$ snyk config set oci-registry-username=username
$ snyk config set oci-registry-password=password

### Static code analysis (SAST) scanning

See `snyk code --help` for more details and examples:
Expand Down
9 changes: 9 additions & 0 deletions help/commands-docs/config.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,3 +36,12 @@ This command does not manage the `.snyk` file that's part of your project. See `

- `disable-analytics`:
Turns off analytics reporting.

- `oci-registry-url`:
Configures the OCI registry used in IaC scannings with custom rules.

- `oci-registry-username`:
Configures the username for an OCI registry used in IaC scannings with custom rules.

- `oci-registry-password`:
Configures the password for an OCI registry used in IaC scannings with custom rules.
3 changes: 3 additions & 0 deletions help/commands-docs/iac-examples.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,3 +19,6 @@

- `Test matching files in a directory`:
\$ snyk iac test /path/to/directory

- `Test matching files in a directory using a local custom rules bundle`:
\$ snyk iac test /path/to/directory --rules=bundle.tar.gz
8 changes: 8 additions & 0 deletions help/commands-docs/iac.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,3 +66,11 @@ Find security issues in your Infrastructure as Code files.
Default: If the `--scan` flag is not provided it would scan the proposed changes only by default.
Example #1: `--scan=planned-values` (full state scan)
Example #2: `--scan=resource-changes` (proposed changes scan)

- `--rules=`<PATH_TO_CUSTOM_RULES_BUNDLE>:
Dedicated flag for Custom Rules scanning.
It enables the IaC scans to use a custom rules bundle generated via the `snyk-iac-rules` SDK. To download it and learn how to use it, go to
https://github.com/snyk/snyk-iac-rules.
This flag cannot be used if the custom rules settings were configured via the Snyk UI.
Default: If the `--rules` flag is not provided it would scan the configuration files using the internal Snyk rules only.
Example: `--rules=bundle.tar.gz` (scans the configuration files using custom rules and internal Snyk rules)
2 changes: 1 addition & 1 deletion help/commands-man/snyk-auth.1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
.\" generated with Ronn-NG/v0.9.1
.\" http://github.com/apjanke/ronn-ng/tree/0.9.1
.TH "SNYK\-AUTH" "1" "October 2021" "Snyk.io"
.TH "SNYK\-AUTH" "1" "November 2021" "Snyk.io"
.SH "NAME"
\fBsnyk\-auth\fR \- Authenticate Snyk CLI with a Snyk account
.SH "SYNOPSIS"
Expand Down
2 changes: 1 addition & 1 deletion help/commands-man/snyk-code.1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
.\" generated with Ronn-NG/v0.9.1
.\" http://github.com/apjanke/ronn-ng/tree/0.9.1
.TH "SNYK\-CODE" "1" "October 2021" "Snyk.io"
.TH "SNYK\-CODE" "1" "November 2021" "Snyk.io"
.SH "NAME"
\fBsnyk\-code\fR \- Find security issues using Static code analysis
.SH "SYNOPSIS"
Expand Down
11 changes: 10 additions & 1 deletion help/commands-man/snyk-config.1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
.\" generated with Ronn-NG/v0.9.1
.\" http://github.com/apjanke/ronn-ng/tree/0.9.1
.TH "SNYK\-CONFIG" "1" "October 2021" "Snyk.io"
.TH "SNYK\-CONFIG" "1" "November 2021" "Snyk.io"
.SH "NAME"
\fBsnyk\-config\fR \- Manage Snyk CLI configuration
.SH "SYNOPSIS"
Expand Down Expand Up @@ -33,6 +33,15 @@ Defines the API endpoint to use\.
.TP
\fBdisable\-analytics\fR
Turns off analytics reporting\.
.TP
\fBoci\-registry\-url\fR
Configures the OCI registry used in IaC scannings with custom rules\.
.TP
\fBoci\-registry\-username\fR
Configures the username for an OCI registry used in IaC scannings with custom rules\.
.TP
\fBoci\-registry\-password\fR
Configures the password for an OCI registry used in IaC scannings with custom rules\.
.SS "Flags available accross all commands"
.TP
\fB\-\-insecure\fR
Expand Down
2 changes: 1 addition & 1 deletion help/commands-man/snyk-container.1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
.\" generated with Ronn-NG/v0.9.1
.\" http://github.com/apjanke/ronn-ng/tree/0.9.1
.TH "SNYK\-CONTAINER" "1" "October 2021" "Snyk.io"
.TH "SNYK\-CONTAINER" "1" "November 2021" "Snyk.io"
.SH "NAME"
\fBsnyk\-container\fR \- Test container images for vulnerabilities
.SH "SYNOPSIS"
Expand Down
2 changes: 1 addition & 1 deletion help/commands-man/snyk-help.1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
.\" generated with Ronn-NG/v0.9.1
.\" http://github.com/apjanke/ronn-ng/tree/0.9.1
.TH "SNYK\-HELP" "1" "October 2021" "Snyk.io"
.TH "SNYK\-HELP" "1" "November 2021" "Snyk.io"
.SH "NAME"
\fBsnyk\-help\fR \- Prints help topics
.SH "SYNOPSIS"
Expand Down
12 changes: 11 additions & 1 deletion help/commands-man/snyk-iac.1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
.\" generated with Ronn-NG/v0.9.1
.\" http://github.com/apjanke/ronn-ng/tree/0.9.1
.TH "SNYK\-IAC" "1" "October 2021" "Snyk.io"
.TH "SNYK\-IAC" "1" "November 2021" "Snyk.io"
.SH "NAME"
\fBsnyk\-iac\fR \- Find security issues in your Infrastructure as Code files
.SH "SYNOPSIS"
Expand Down Expand Up @@ -62,6 +62,13 @@ It enables to control whether the scan should analyse the full final state (e\.g
Default: If the \fB\-\-scan\fR flag is not provided it would scan the proposed changes only by default\.
.br
Example #1: \fB\-\-scan=planned\-values\fR (full state scan) Example #2: \fB\-\-scan=resource\-changes\fR (proposed changes scan)
.TP
\fB\-\-rules=\fR\fIPATH_TO_CUSTOM_RULES_BUNDLE\fR
Dedicated flag for Custom Rules scanning\.
.br
It enables the IaC scans to use a custom rules bundle generated via the \fBsnyk\-iac\-rules\fR SDK\. To download it and learn how to use it, go to https://github\.com/snyk/snyk\-iac\-rules\. This flag cannot be used if the custom rules settings were configured via the Snyk UI\. Default: If the \fB\-\-rules\fR flag is not provided it would scan the configuration files using the internal Snyk rules only\.
.br
Example: \fB\-\-rules=bundle\.tar\.gz\fR (scans the configuration files using custom rules and internal Snyk rules)
.SS "Flags available accross all commands"
.TP
\fB\-\-insecure\fR
Expand Down Expand Up @@ -98,6 +105,9 @@ $ snyk iac test /path/to/arm_file\.json
.TP
\fBTest matching files in a directory\fR
$ snyk iac test /path/to/directory
.TP
\fBTest matching files in a directory using a local custom rules bundle\fR
$ snyk iac test /path/to/directory \-\-rules=bundle\.tar\.gz
.SH "EXIT CODES"
Possible exit codes and their meaning:
.P
Expand Down
2 changes: 1 addition & 1 deletion help/commands-man/snyk-ignore.1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
.\" generated with Ronn-NG/v0.9.1
.\" http://github.com/apjanke/ronn-ng/tree/0.9.1
.TH "SNYK\-IGNORE" "1" "October 2021" "Snyk.io"
.TH "SNYK\-IGNORE" "1" "November 2021" "Snyk.io"
.SH "NAME"
\fBsnyk\-ignore\fR \- Modifies the \.snyk policy to ignore stated issues
.SH "SYNOPSIS"
Expand Down
2 changes: 1 addition & 1 deletion help/commands-man/snyk-monitor.1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
.\" generated with Ronn-NG/v0.9.1
.\" http://github.com/apjanke/ronn-ng/tree/0.9.1
.TH "SNYK\-MONITOR" "1" "October 2021" "Snyk.io"
.TH "SNYK\-MONITOR" "1" "November 2021" "Snyk.io"
.SH "NAME"
\fBsnyk\-monitor\fR \- Snapshot and continuously monitor your project
.SH "SYNOPSIS"
Expand Down
2 changes: 1 addition & 1 deletion help/commands-man/snyk-policy.1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
.\" generated with Ronn-NG/v0.9.1
.\" http://github.com/apjanke/ronn-ng/tree/0.9.1
.TH "SNYK\-POLICY" "1" "October 2021" "Snyk.io"
.TH "SNYK\-POLICY" "1" "November 2021" "Snyk.io"
.SH "NAME"
\fBsnyk\-policy\fR \- Display the \.snyk policy for a package
.SH "SYNOPSIS"
Expand Down
2 changes: 1 addition & 1 deletion help/commands-man/snyk-protect.1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
.\" generated with Ronn-NG/v0.9.1
.\" http://github.com/apjanke/ronn-ng/tree/0.9.1
.TH "SNYK\-PROTECT" "1" "October 2021" "Snyk.io"
.TH "SNYK\-PROTECT" "1" "November 2021" "Snyk.io"
.SH "NAME"
\fBsnyk\-protect\fR \- Applies the patches specified in your \.snyk file to the local file system
.SH "SYNOPSIS"
Expand Down
2 changes: 1 addition & 1 deletion help/commands-man/snyk-test.1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
.\" generated with Ronn-NG/v0.9.1
.\" http://github.com/apjanke/ronn-ng/tree/0.9.1
.TH "SNYK\-TEST" "1" "October 2021" "Snyk.io"
.TH "SNYK\-TEST" "1" "November 2021" "Snyk.io"
.SH "NAME"
\fBsnyk\-test\fR \- test local project for vulnerabilities
.SH "SYNOPSIS"
Expand Down
2 changes: 1 addition & 1 deletion help/commands-man/snyk-wizard.1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
.\" generated with Ronn-NG/v0.9.1
.\" http://github.com/apjanke/ronn-ng/tree/0.9.1
.TH "SNYK\-WIZARD" "1" "October 2021" "Snyk.io"
.TH "SNYK\-WIZARD" "1" "November 2021" "Snyk.io"
.SH "NAME"
\fBsnyk\-wizard\fR \- Configure your policy file to update, auto patch and ignore vulnerabilities
.SH "SYNOPSIS"
Expand Down
2 changes: 1 addition & 1 deletion help/commands-man/snyk-woof.1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
.\" generated with Ronn-NG/v0.9.1
.\" http://github.com/apjanke/ronn-ng/tree/0.9.1
.TH "SNYK\-WOOF" "1" "October 2021" "Snyk.io"
.TH "SNYK\-WOOF" "1" "November 2021" "Snyk.io"
.SH "NAME"
\fBsnyk\-woof\fR \- W00f
.SH "SYNOPSIS"
Expand Down
11 changes: 10 additions & 1 deletion help/commands-man/snyk.1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
.\" generated with Ronn-NG/v0.9.1
.\" http://github.com/apjanke/ronn-ng/tree/0.9.1
.TH "SNYK" "1" "October 2021" "Snyk.io"
.TH "SNYK" "1" "November 2021" "Snyk.io"
.SH "NAME"
\fBsnyk\fR \- CLI and build\-time tool to find & fix known vulnerabilities in open\-source dependencies
.SH "SYNOPSIS"
Expand Down Expand Up @@ -282,6 +282,15 @@ $ snyk iac test /path/to/tf\-plan\.json
$ snyk iac test /path/to/arm_file\.json
.fi
.IP "" 0
.P
To use your own custom rules to scan IaC configuration files, download the \fBsnyk\-iac\-rules\fR SDK from https://github\.com/snyk/snyk\-iac\-rules\. Follow the instructions there to write, build, and push a custom rules bundle and then either use the Snyk UI to configure your custom rules settings or configure a remote OCI registry locally by running the following commands:
.IP "" 4
.nf
$ snyk config set oci\-registry\-url=https://registry\-1\.docker\.io/username/repo:tag
$ snyk config set oci\-registry\-username=username
$ snyk config set oci\-registry\-password=password
.fi
.IP "" 0
.SS "Static code analysis (SAST) scanning"
See \fBsnyk code \-\-help\fR for more details and examples:
.IP "" 4
Expand Down
9 changes: 9 additions & 0 deletions help/commands-md/snyk-config.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,15 @@ This command does not manage the `.snyk` file that's part of your project. See `
- `disable-analytics`:
Turns off analytics reporting.

- `oci-registry-url`:
Configures the OCI registry used in IaC scannings with custom rules.

- `oci-registry-username`:
Configures the username for an OCI registry used in IaC scannings with custom rules.

- `oci-registry-password`:
Configures the password for an OCI registry used in IaC scannings with custom rules.




Expand Down
11 changes: 11 additions & 0 deletions help/commands-md/snyk-iac.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,14 @@ Find security issues in your Infrastructure as Code files.
Example #1: `--scan=planned-values` (full state scan)
Example #2: `--scan=resource-changes` (proposed changes scan)

- `--rules=`<PATH_TO_CUSTOM_RULES_BUNDLE>:
Dedicated flag for Custom Rules scanning.
It enables the IaC scans to use a custom rules bundle generated via the `snyk-iac-rules` SDK. To download it and learn how to use it, go to
https://github.com/snyk/snyk-iac-rules.
This flag cannot be used if the custom rules settings were configured via the Snyk UI.
Default: If the `--rules` flag is not provided it would scan the configuration files using the internal Snyk rules only.
Example: `--rules=bundle.tar.gz` (scans the configuration files using custom rules and internal Snyk rules)




Expand Down Expand Up @@ -110,6 +118,9 @@ Find security issues in your Infrastructure as Code files.
- `Test matching files in a directory`:
\$ snyk iac test /path/to/directory

- `Test matching files in a directory using a local custom rules bundle`:
\$ snyk iac test /path/to/directory --rules=bundle.tar.gz


## EXIT CODES

Expand Down
9 changes: 9 additions & 0 deletions help/commands-md/snyk.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -324,6 +324,15 @@ See `snyk iac --help` for more details and examples:
$ snyk iac test /path/to/tf-plan.json
$ snyk iac test /path/to/arm_file.json

To use your own custom rules to scan IaC configuration files, download the `snyk-iac-rules` SDK from https://github.com/snyk/snyk-iac-rules. Follow the
instructions there to write, build, and push a custom rules bundle and then
either use the Snyk UI to configure your custom rules settings or configure
a remote OCI registry locally by running the following commands:

$ snyk config set oci-registry-url=https://registry-1.docker.io/username/repo:tag
$ snyk config set oci-registry-username=username
$ snyk config set oci-registry-password=password

### Static code analysis (SAST) scanning

See `snyk code --help` for more details and examples:
Expand Down
Loading