snyk-labs/helm-snyk

Check images in your charts for vulnerabilities

Check your Helm chart for vulnerabilities

The Helm plugin for Snyk provides a subcommand for testing the images in a given Helm chart for known vulnerabilities.

Installation

Install the plugin using the built-in helm plugin command:

helm plugin install https://github.com/snyk-labs/helm-snyk

The plugin connects to the Snyk service to lookup vulnerability information. If you don't have a Snyk account, go to snyk.io/login to sign up for free. You can then obtain an access token from app.snyk.io/account or for information on using service accounts, see snyk.io/docs/service-accounts/.

Once you have an account, you should set the SNYK_TOKEN environment variable:

export SNYK_TOKEN=<your-snyk-token>

The plugin also requires a local Docker installation and uses this to download and test each of the images discovered in the chart.

Usage

With the plugin installed, simply run the new helm snyk test command and point it to the directory of the chart. For instance:

$ helm snyk test stable/redis
Image: docker.io/bitnami/redis:5.0.5-debian-9-r181
Testing docker.io/bitnami/redis:5.0.5-debian-9-r181...
✗ Low severity vulnerability found in tar
  Description: CVE-2005-2541
  Info: https://snyk.io/vuln/SNYK-LINUX-TAR-105079
  Introduced through: meta-common-packages@meta
  From: meta-common-packages@meta > [email protected]
✗ Low severity vulnerability found in systemd/libsystemd0
  Description: CVE-2019-9619
  Info: https://snyk.io/vuln/SNYK-LINUX-SYSTEMD-442642
  Introduced through: systemd/libsystemd0@232-25+deb9u12, util-linux/bsdutils@1:2.29.2-1+deb9u1, procps@2:3.3.12-3+deb9u1, sysvinit/[email protected], systemd/libudev1@232-25+deb9u12, util-linux/[email protected]+deb9u1
  From: systemd/libsystemd0@232-25+deb9u12
  From: util-linux/bsdutils@1:2.29.2-1+deb9u1 > systemd/libsystemd0@232-25+deb9u12
  From: procps@2:3.3.12-3+deb9u1 > procps/libprocps6@2:3.3.12-3+deb9u1 > systemd/libsystemd0@232-25+deb9u12
  and 4 more...
...

The plugin also supports the various arguments for modifying the chart, including --set and --values. So for instance you can test the same chart but override the image tag like so:

helm snyk test --set image.tag=latest

As well as the user-friendly output above the plugin also supports outputting the results as a JSON document. This can be useful for further analysis or integration with other tooling.

$ helm snyk test stable/mysql --json
{
  "helmChart": "[email protected]",
  "images": [
    {
      "imageName": "dduportal/bats:0.4.0",
      "results": {
        "vulnerabilities": [
          {
            "CVSSv3": null,
            "creationTime": "2019-02-06T14:40:43.295348Z",
            "credit": [
              ""
            ],
            "cvssScore": null,
            "description": "## Overview\nCVE-2011-3374",
            "disclosureTime": null,
            "id": "SNYK-LINUX-APT-116518",
            "identifiers": {
              "ALTERNATIVE": [
                "SNYK-DEBIAN8-APT-407500",
...

For further options and features see the help instructions with the --help flag.

helm-snyk's Issues

line 1: Not: command not found

With fresh install on Ubuntu LTS (as well as fresh install on macos), seeing

:~$ helm snyk test
/home/ubuntu/.local/share/helm/plugins/helm-snyk/bin/helm-snyk-linux: line 1: Not: command not found
Error: plugin "snyk" exited with error
:~$ helm snyk --help
/home/ubuntu/.local/share/helm/plugins/helm-snyk/bin/helm-snyk-linux: line 1: Not: command not found
Error: plugin "snyk" exited with error
:~$ helm snyk test --help
/home/ubuntu/.local/share/helm/plugins/helm-snyk/bin/helm-snyk-linux: line 1: Not: command not found
Error: plugin "snyk" exited with error

Install script is broken

The install script is currently broken due to latest_version not being selected properly.

$ curl -Is "https://github.com/snyk-labs/helm-snyk/releases/latest" | grep -i "location" | sed s#.*tag/##g | tr -d "\r"
v1.2.5
Content-Security-Policy: default-src 'none'; base-uri 'self'; block-all-mixed-content; connect-src 'self' uploads.github.com www.githubstatus.com collector.githubapp.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com html-translator.herokuapp.com cdn.optimizely.com logx.optimizely.com/v1/events wss://alive.github.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com online.visualstudio.com/api/v1/locations insights.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com secured-user-images.githubusercontent.com/ *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/socket-worker-3f088aa2.js gist.github.com/socket-worker-3f088aa2.js

As you can see, not only is the version returned, but other headers are as well, so the subsequent requests to download the release fail.

Difficulties descending into nested chart directories for dependencies

When pulling a dependent chart, helm snyk test seems to not be able to descend into dependency directories. The example I'm using was

helm pull sumologic/sumologic --untar=true --untardir=sumologic_sumologic

I then do:

:~$ helm snyk test sumologic_sumologic/sumologic/

try to run 'helm template sumologic_sumologic/sumologic/' first!
ubuntu@ip-10-42-75-92:~$ ls sumologic_sumologic/sumologic/

there is a Chart.yaml in the directory noted already:

:~$ ls sumologic_sumologic/sumologic/
charts  Chart.yaml  conf  requirements.lock  requirements.yaml  sumologic_sumologic_prometheus_operator_kube_state_metrics.txt  templates  values.yaml

Descending into the dependency directory, does work however:

helm snyk test sumologic_sumologic/sumologic/charts/falco/

Perhaps this is more of a feature request, though I feel the inability to deal with chart dependencies should be noted in Readme. However, I think since I get an error message with the top level chart, the tool may still be missing images that are in the top level chart.

helm-snyk-macos Not Found

After following the install instructions and everything looking great, i attempt to run the "helm snyk test" command get the following.

/Users/username/Library/helm/plugins/helm-snyk/bin/helm-snyk-macos: line 1: Not: command not found Error: plugin "snyk" exited with error

When i open the file helm-snyk-macos it only contains "Not Found"

pulling from private container registries?

Hi

I'm trying to run the plugin against a helm chart using containers hosted on quay.io in a private registry.
I've looked at --help and the README, but it wasn't obvious how I can provide credentials for this scenario.

I can docker pull the images myself without problems, but snyk fails like so:

helm snyk test <chartdir>/
failed pulling image
err.statusCode: 500
err.message: (HTTP code 500) server error - unauthorized: access to the requested resource is not authorized 
Error caught: (HTTP code 500) server error - unauthorized: access to the requested resource is not authorized

Thank you!

PS: in the readme, you're using stable/redis as an example chart, except the command doesn't really work like that - you need to run a helm fetch stable/redis --untar first, in which case the chart dir is just redis, or you need to run helm fetch stable/redis --untar --untardir stable :)

[BUG]: debug flag doesn't work

Is there an existing issue for this?

• I have searched the existing issues

Description of the bug

Debug flag does not work because helm does not pass --debug into plugins; instead, when the flag is found, it sets $HELM_DEBUG to 1.

Steps To Reproduce

helm snyk test --debug some/chart

Observe that no debug output is displayed.

Additional Information

No response

helm: no output

Successful install of chart with

helm pull stable/redis --untar=true --untardir=stable_redis_pull
helm install stable-redis-from-pull ./stable_redis_pull/redis/

ubuntu@:~$ helm list
NAME                    NAMESPACE       REVISION        UPDATED                                 STATUS          CHART           APP VERSION
stable-redis-from-pull  sumologic       1               2020-04-08 16:40:44.99386781 +0000 UTC  deployed        redis-10.5.7    5.0.7

ubuntu@:~$ helm snyk test  ./stable_redis_pull/redis/
/bin/sh: 1: helm: not found

try to run 'helm template ./stable_redis_pull/redis/' first!

contents of the directory seem to contain templated chart:

ubuntu@:~$ ls ./stable_redis_pull/redis/
Chart.yaml  ci  README.md  templates  values-production.yaml  values.schema.json  values.yaml