{"id":13842244,"url":"https://github.com/banzaicloud/dast-operator","last_synced_at":"2025-04-13T16:53:39.911Z","repository":{"id":38817901,"uuid":"190701125","full_name":"banzaicloud/dast-operator","owner":"banzaicloud","description":"Dynamic Application and API Security Testing","archived":false,"fork":false,"pushed_at":"2023-04-05T09:57:11.000Z","size":24098,"stargazers_count":192,"open_issues_count":6,"forks_count":27,"subscribers_count":8,"default_branch":"master","last_synced_at":"2025-03-27T07:48:03.633Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/banzaicloud.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2019-06-07T06:59:32.000Z","updated_at":"2025-03-14T17:11:09.000Z","dependencies_parsed_at":"2024-01-14T19:27:54.870Z","dependency_job_id":null,"html_url":"https://github.com/banzaicloud/dast-operator","commit_stats":null,"previous_names":[],"tags_count":13,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/banzaicloud%2Fdast-operator","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/banzaicloud%2Fdast-operator/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/banzaicloud%2Fdast-operator/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/banzaicloud%2Fdast-operator/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/banzaicloud","download_url":"https://codeload.github.com/banzaicloud/dast-operator/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248750010,"owners_count":21155682,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:01:30.162Z","updated_at":"2025-04-13T16:53:39.888Z","avatar_url":"https://github.com/banzaicloud.png","language":"Go","funding_links":[],"categories":["Go"],"sub_categories":[],"readme":"# DAST operator\n\n\u003e Dynamic application security testing (DAST) is a process of testing an application or software in an operating state.\n\nThis operator leverages [OWASP ZAP](https://www.zaproxy.org) to make automated security testing for web applications and APIs based on OpenAPI definitions.\n\n### The operator current features:\n- Deploy OWASP ZAP proxy defined in custom resource\n- Scan external URL defined in custom resource\n- Scan internal services based on its annotations\n- API Security testing based on OpenAPI definition\n- Before deploying ingress, check backend services whether scanned and scan results are below defined thresholds\n\n### On the DAST operator roadmap:\n- In webhook, check the scanner job is running, completed or not exist\n- Improve service status check\n- Handle multiple service ports\n- Handle different service protocols\n- Use HTTPS instead of HTTP connecting to ZAP\n- Generate randomly ZAP API key if not defined\n- API testing with JMeter and ZAP\n- Parameterized security payload with fuzz\n- Automated SQLi testing using SQLmap\n\n## Structure of the DAST operator:\nDAST operator running two reconcilers and one [validating admission webhook](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#validatingadmissionwebhook)\n\n![DAST OPERATOR](docs/images/dast.png)\n\n### Reconcilers\n- DAST reconciler\n- Service reconciler\n\n### Webhook\n- Validating webhook for ingress\n\n## Current limitations:\nUsing the webhook feature, deploying an ingress is only successful when the backend service has been already scanned. If we deploy something with Helm that contains a service and an ingress definition as well, the ingress deployment will fail as to the scan progress of the backend service is not finished yet.\n\n## Deploy the cert-manager\n\nFirst of all we need to deploy `cert-manager`\n```shell\nkubectl create namespace cert-manager\nhelm repo add jetstack https://charts.jetstack.io\nhelm repo update\nkubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v1.0.4/cert-manager.crds.yaml\nhelm install cert-manager jetstack/cert-manager --namespace cert-manager --version v1.0.4\n```\n\nYou can read more about the installation of the cert-manager in the [official documentation](https://cert-manager.io/docs/installation/kubernetes/)\n\n## Deploy the dast-operator via helm\n\nOr you can install via helm:\n```shell\nhelm repo add banzaicloud https://kubernetes-charts.banzaicloud.com/\nhelm install dast-operator banzaicloud/dast-operator\n```\n\n## Build images and deploy the operator manually\n\n```shell\ngit clone https://github.com/banzaicloud/dast-operator.git\ncd dast-operator\nmake docker-build\nmake docker-analyzer\n```\n\nIf you're using `Kind` cluster for testing, you will have to load images to it.\n```shell\nkind load docker-image banzaicloud/dast-operator:latest\nkind load docker-image banzaicloud/dast-analyzer:latest\n```\n\nClone dast-operator\n```shell\ngit clone https://github.com/banzaicloud/dast-operator.git\ncd dast-operator\n```\n\nDeploy dast-operator\n```shell\nmake deploy\n```\n\n## Examples\n\n### Deploy OWASP ZAP\nDeploy example CR\n```shell\nkubectl create ns zaproxy\nkubectl apply -f https://raw.githubusercontent.com/banzaicloud/dast-operator/master/config/samples/security_v1alpha1_dast.yaml -n zaproxy\n```\n\nContent of Dast custom resource:\n```yaml\napiVersion: security.banzaicloud.io/v1alpha1\nkind: Dast\nmetadata:\n  name: dast-sample\nspec:\n  zaproxy:\n    name: dast-test\n    apikey: abcd1234\n```\n\n### Deploy the application and initiate active scan\n```shell\nkubectl create ns test\nkubectl apply -f https://raw.githubusercontent.com/banzaicloud/dast-operator/master/config/samples/test_service.yaml -n test\n```\n\nContent of `test_secvice.yaml`:\n```yaml\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: test-deployment\n  labels:\n    app: nginx\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app: nginx\n      secscan: dast\n  template:\n    metadata:\n      labels:\n        app: nginx\n        secscan: dast\n    spec:\n      containers:\n      - name: nginx\n        image: nginx:1.16.0-alpine\n        ports:\n        - containerPort: 80\n---\napiVersion: v1\nkind: Service\nmetadata:\n  name: test-service\n  annotations:\n    dast.security.banzaicloud.io/zaproxy: \"dast-test\"\n    dast.security.banzaicloud.io/zaproxy-namespace: \"zaproxy\"\nspec:\n  selector:\n    app: nginx\n    secscan: dast\n  ports:\n  - port: 80\n    targetPort: 80\n```\n\n### Test the validating webhook\n\nDeploy ingress with previously defined `test-service` backend.\n```shell\nkubectl apply -f https://raw.githubusercontent.com/banzaicloud/dast-operator/master/config/samples/test_ingress.yaml -n test\n```\n\nExample ingress definition:\n```yaml\napiVersion: extensions/v1beta1\nkind: Ingress\nmetadata:\n  name: test-ingress\n  annotations:\n    dast.security.banzaicloud.io/medium: \"2\"\n    dast.security.banzaicloud.io/low: \"5\"\n    dast.security.banzaicloud.io/informational: \"10\"\n    nginx.ingress.kubernetes.io/rewrite-target: /\nspec:\n  rules:\n  - http:\n      paths:\n      - path: /\n        backend:\n          serviceName: test-service\n          servicePort: 80\n```\n\n\n### Scan external URL\n```shell\nkubectl create ns external\nkubectl apply -f https://raw.githubusercontent.com/banzaicloud/dast-operator/master/config/samples/security_v1alpha1_dast_external.yaml -n external\n```\n\nContent of DAST CR\n```yaml\napiVersion: security.banzaicloud.io/v1alpha1\nkind: Dast\nmetadata:\n  name: dast-sample-external\nspec:\n  zaproxy:\n    name: dast-test-external\n    apikey: abcd1234\n  analyzer:\n    image: banzaicloud/dast-analyzer:latest\n    name: external-test\n    target: http://example.com\n```\n\n\n### Define OpenAPI definition as annotation in a service\n```yaml\n  apiVersion: v1\n  kind: Service\n  metadata:\n    name: test-api-service\n    annotations:\n      dast.security.banzaicloud.io/zaproxy: \"dast-test\"\n      dast.security.banzaicloud.io/zaproxy-namespace: \"zaproxy\"\n      dast.security.banzaicloud.io/apiscan: \"true\"\n      dast.security.banzaicloud.io/openapi-url: \"https://raw.githubusercontent.com/sagikazarmark/modern-go-application/master/api/openapi/todo/openapi.yaml\"\n  spec:\n    selector:\n      app: mga\n      secscan: dast\n    ports:\n    - port: 8000\n      targetPort: 8000\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbanzaicloud%2Fdast-operator","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbanzaicloud%2Fdast-operator","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbanzaicloud%2Fdast-operator/lists"}