Gitleaks
What is Gitleaks?
Gitleaks is a free and open source tool for finding secrets in git repositories. These secrets could be passwords, API keys, tokens, private keys or suspicious file names or file extensions like id_rsa, .pem, htpasswd. Furthermore, gitleaks can scan your whole repository's history with all commits up to the initial one.
To learn more about gitleaks visit https://github.com/zricethezav/gitleaks
Deployment
The gitleaks chart can be deployed via helm:
# Install HelmChart (use -n to configure another namespace)
helm upgrade --install gitleaks oci://ghcr.io/securecodebox/helm/gitleaks
Scanner Configuration
For a complete overview of the configuration options, see the Gitleaks documentation.
Starting with version 8.0, gitleaks no longer supports cloning the repository directly. Instead, you will have to use an init container to do so. We provide example scan definitions below that you can build on.
Scanning Specific Timeframes
When running gitleaks as a scheduled scan, you may not want to go through the entire repository history every time.
Gitleaks allows you to limit the commits it will scan using the --log-opts
parameter, which accepts all parameters supported by git log -p
.
For example, if you want to scan only commits made in the last 7 days, on all branches of the repository, use the following parameters:
parameters:
# Run gitleaks in "detect" mode
- "detect"
# Point it at the location of the repository
- "--source"
- "/repo/"
# Only consider commits within the last 7 days, on all branches
- "--log-opts=--since=7days --all --full-history"
Note that the parameters to --log-opts
are not quoted separately due to the way the scanner is called inside secureCodeBox - adding extra quotes will break the scan!
It is important to remember to pass --all --full-history
when using --log-opts
, as otherwise only the default branch will be scanned (when not using --log-opts
, gitleaks adds these parameters implicitly).
Human-Friendly Commit URLs
Before gitleaks 8.0, the findings used to contain a direct link to the commit that contained the secret.
The base URL was pulled from the parameter given to gitleaks.
Since this is no longer possible, we cannot automatically infer which repository the commits belong to.
However, you can provide this information manually using a scan annotation called metadata.scan.securecodebox.io/git-repo-url
.
See the examples below on how to use it.
Cascading Scans
Gitleaks works well in conjunction with git-repo-scanner to enumerate Git repositories and scan them using cascading rules. We do not ship default cascading rules for this purpose. However, you can find instructions on running such cascading scans in this article - simply adapt it to use gitleaks instead of semgrep and you are good to go.
Providing Your Own Ruleset
SecureCodeBox used to ship a number of default rulesets.
We have stopped doing this, as the official ruleset of gitleaks is much more up-to-date and well-maintained.
However, if you still want to write and use your own rulesets, we provide an example below.
The parser will set all found issues to medium
severity by default.
To override the severity in your own rulesets, include the result tag "HIGH" or "LOW" in your gitleaks rule.
Requirements
Kubernetes: >=v1.11.0-0
Do not override the option --report-format
or --report-path
. It is already configured for automatic findings parsing.
Values
Key | Type | Default | Description |
---|---|---|---|
cascadingRules.enabled | bool | false | Enables or disables the installation of the default cascading rules for this scanner |
imagePullSecrets | list | [] | Define imagePullSecrets when a private registry is used (see: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/) |
parser.affinity | object | {} | Optional affinity settings that control how the parser job is scheduled (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/) |
parser.env | list | [] | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) |
parser.image.pullPolicy | string | "IfNotPresent" | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images |
parser.image.repository | string | "docker.io/securecodebox/parser-gitleaks" | Parser image repository |
parser.image.tag | string | defaults to the charts version | Parser image tag |
parser.nodeSelector | object | {} | Optional nodeSelector settings that control how the scanner job is scheduled (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes/) |
parser.resources | object | { requests: { cpu: "200m", memory: "100Mi" }, limits: { cpu: "400m", memory: "200Mi" } } | Optional resources lets you control resource limits and requests for the parser container. See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ |
parser.scopeLimiterAliases | object | {} | Optional finding aliases to be used in the scopeLimiter. |
parser.tolerations | list | [] | Optional tolerations settings that control how the parser job is scheduled (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) |
parser.ttlSecondsAfterFinished | string | nil | seconds after which the Kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
scanner.activeDeadlineSeconds | string | nil | There are situations where you want to fail a scan Job after some amount of time. To do so, set activeDeadlineSeconds to define an active deadline (in seconds) when considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#job-termination-and-cleanup) |
scanner.affinity | object | {} | Optional affinity settings that control how the scanner job is scheduled (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/) |
scanner.backoffLimit | int | 3 | There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) |
scanner.env | list | [] | Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) |
scanner.extraContainers | list | [] | Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) |
scanner.extraVolumeMounts | list | [] | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
scanner.extraVolumes | list | [] | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
scanner.image.pullPolicy | string | "IfNotPresent" | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images |
scanner.image.repository | string | "docker.io/zricethezav/gitleaks" | Container Image to run the scan |
scanner.image.tag | string | nil | defaults to the charts appVersion |
scanner.nameAppend | string | nil | append a string to the default scantype name. |
scanner.nodeSelector | object | {} | Optional nodeSelector settings that control how the scanner job is scheduled (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes/) |
scanner.podSecurityContext | object | {} | Optional securityContext set on scanner pod (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) |
scanner.resources | object | {} | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) |
scanner.securityContext | object | {"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":false} | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) |
scanner.securityContext.allowPrivilegeEscalation | bool | false | Ensure that users privileges cannot be escalated |
scanner.securityContext.capabilities.drop[0] | string | "all" | This drops all linux privileges from the container. |
scanner.securityContext.privileged | bool | false | Ensures that the scanner container is not run in privileged mode |
scanner.securityContext.readOnlyRootFilesystem | bool | true | Prevents write access to the containers file system |
scanner.securityContext.runAsNonRoot | bool | false | Enforces that the scanner image is run as a non root user |
scanner.suspend | bool | false | if set to true the scan job will be suspended after creation. You can then resume the job using kubectl resume <jobname> or using a job scheduler like kueue |
scanner.tolerations | list | [] | Optional tolerations settings that control how the scanner job is scheduled (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) |
scanner.ttlSecondsAfterFinished | string | nil | seconds after which the Kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
License
Code of secureCodeBox is licensed under the Apache License 2.0.
CPU architectures
The scanner is currently supported for these CPU architectures:
- linux/amd64
- linux/arm64
Examples
private-repository
In some cases, you may have to authenticate to clone a repository. For this, you can place your relevant access token in a Kubernetes secret:
# Don't forget the leading whitespace in the command to avoid
# having your GitHub access token in your shell history!
echo -n 'gh_abcdef...' > github-token.txt # use -n to avoid trailing line break
kubectl create secret generic github-access-token --from-file=token=github-token.txt
rm github-token.txt
Then, you can use this token to perform an authenticated HTTPS clone, like in the following example.
- Scan
# SPDX-FileCopyrightText: the secureCodeBox authors
#
# SPDX-License-Identifier: Apache-2.0
apiVersion: "execution.securecodebox.io/v1"
kind: Scan
metadata:
name: "authenticated-clone-example"
annotations:
metadata.scan.securecodebox.io/git-repo-url: "https://github.com/yourOrg/yourRepo"
spec:
scanType: "gitleaks"
# Define a volume and mount it at /repo in the scan container
volumes:
- name: repo
emptyDir: {}
volumeMounts:
- name: repo
mountPath: "/repo/"
# Define an init container to run the git clone for us
initContainers:
- name: "git-clone"
image: bitnami/git
# Specify that the "repo" volume should also be mounted on the
# initContainer
volumeMounts:
- name: repo
mountPath: "/repo/"
# Clone to /repo in the init container
command:
- git
- clone
# Use the --mirror clone to get the complete repository, otherwise findings may be
# incomplete. See https://wwws.nightwatchcybersecurity.com/2022/02/11/gitbleed/
- "--mirror"
# Add access token to the URL for authenticated HTTPS clone
- "https://$(GITHUB_TOKEN)@github.com/yourOrg/yourRepo"
- /repo/
# Pull the access token into an env variable
env:
- name: GITHUB_TOKEN
valueFrom:
secretKeyRef:
name: github-access-token
key: token
parameters:
# Run Gitleaks in "detect" mode
- "detect"
# Point it at the location of the repository
- "--source"
- "/repo/"
provide-own-rules
If you don't want to use our predefined rule files you can easily provide your own
gitleaks rules config file. To do this, create a configMap
from your rules file:
kubectl create configmap --from-file /path/to/my/gitleaks-config.toml gitleaks-config
Now just mount that config in your scan and select the mounted path for your gitleaks
--config
option.
- Scan
# SPDX-FileCopyrightText: the secureCodeBox authors
#
# SPDX-License-Identifier: Apache-2.0
apiVersion: "execution.securecodebox.io/v1"
kind: Scan
metadata:
name: "scan-scb-with-own-rules"
annotations:
metadata.scan.securecodebox.io/git-repo-url: "https://github.com/secureCodeBox/secureCodeBox"
spec:
scanType: "gitleaks"
parameters:
- "-r"
- "https://github.com/iteratec/multi-juicer"
- "--config"
- "/config/gitleaks-config.toml"
volumes:
- name: "gitleaks-config"
configMap:
name: "gitleaks-config"
volumeMounts:
- name: "gitleaks-config"
mountPath: "/config/"
# SPDX-FileCopyrightText: the secureCodeBox authors
#
# SPDX-License-Identifier: Apache-2.0
apiVersion: "execution.securecodebox.io/v1"
kind: Scan
metadata:
name: "scan-scb-with-own-rules"
spec:
scanType: "gitleaks"
# Define a volume and mount it at /repo in the scan container
volumes:
- name: "repo"
emptyDir: {}
- name: "gitleaks-config"
configMap:
name: "gitleaks-config"
volumeMounts:
- name: "repo"
mountPath: "/repo/"
- name: "gitleaks-config"
mountPath: "/config/"
# Define an init container to run the git clone for us
initContainers:
- name: "git-clone"
image: bitnami/git
# Specify that the "repo" volume should also be mounted on the
# initContainer
volumeMounts:
- name: "repo"
mountPath: "/repo/"
# Clone to /repo in the init container
command:
- git
- clone
# Use the --mirror clone to get the complete repository, otherwise findings may be
# incomplete. See https://wwws.nightwatchcybersecurity.com/2022/02/11/gitbleed/
- "--mirror"
- "https://github.com/secureCodeBox/secureCodeBox"
- /repo/
parameters:
# Run Gitleaks in "detect" mode
- "detect"
# Point it at the location of the repository
- "--source"
- "/repo/"
# Point it at your own config file
- "--config"
- "/config/gitleaks-config.toml"
secureCodeBox
An Example for scanning all history of the secureCodeBox project on GitHub:
- Scan
- Findings
# SPDX-FileCopyrightText: the secureCodeBox authors
#
# SPDX-License-Identifier: Apache-2.0
apiVersion: "execution.securecodebox.io/v1"
kind: Scan
metadata:
name: "scan-scb-example"
annotations:
metadata.scan.securecodebox.io/git-repo-url: "https://github.com/secureCodeBox/secureCodeBox"
spec:
scanType: "gitleaks"
# Define a volume and mount it at /repo in the scan container
volumes:
- name: repo
emptyDir: {}
volumeMounts:
- name: repo
mountPath: "/repo/"
# Define an init container to run the git clone for us
initContainers:
- name: "git-clone"
image: bitnami/git
# Specify that the "repo" volume should also be mounted on the
# initContainer
volumeMounts:
- name: repo
mountPath: "/repo/"
# Clone to /repo in the init container
command:
- git
- clone
# Use the --mirror clone to get the complete repository, otherwise findings may be
# incomplete. See https://wwws.nightwatchcybersecurity.com/2022/02/11/gitbleed/
- "--mirror"
- "https://github.com/secureCodeBox/secureCodeBox"
- /repo/
parameters:
# Run Gitleaks in "detect" mode
- "detect"
# Point it at the location of the repository
- "--source"
- "/repo/"
# SPDX-FileCopyrightText: the secureCodeBox authors
#
# SPDX-License-Identifier: Apache-2.0
[
{
"name": "PKCS8-PK",
"description": "The name of the rule which triggered the finding: PKCS8-PK",
"osi_layer": "APPLICATION",
"severity": "MEDIUM",
"category": "Potential Secret",
"attributes": {
"commit": "https://github.com/secureCodeBox/secureCodeBox/commit/a674a178e0b7eb2975718e31ac2fb80f4f39f110",
"description": "PKCS8 private key",
"offender": "-----BEGIN PRIVATE KEY-----",
"author": "Max Maass",
"email": "max.maass@iteratec.com",
"date": "2022-01-25T12:30:04Z",
"file": "scanners/gitleaks/integration-tests/gitleaks.test.js",
"line_number": 40,
"tags": [],
"line": "-----BEGIN PRIVATE KEY-----"
},
"id": "fd1914a4-5a3e-4656-a532-ab1a0f645515",
"parsed_at": "2022-01-25T13:31:05.257Z"
},
{
"name": "PKCS8-PK",
"description": "The name of the rule which triggered the finding: PKCS8-PK",
"osi_layer": "APPLICATION",
"severity": "MEDIUM",
"category": "Potential Secret",
"attributes": {
"commit": "https://github.com/secureCodeBox/secureCodeBox/commit/1020a6520656922355d84eb6f3560650e40c722e",
"description": "PKCS8 private key",
"offender": "-----BEGIN PRIVATE KEY-----",
"author": "Max Maass",
"email": "max.maass@iteratec.com",
"date": "2022-01-24T08:24:50Z",
"file": "scanners/gitleaks/parser/__testFiles__/test-report-tags.json",
"line_number": 8,
"tags": [],
"line": "-----BEGIN PRIVATE KEY-----"
},
"id": "9b767656-48a8-45b3-aabd-c0a788ddec03",
"parsed_at": "2022-01-25T13:31:05.257Z"
},
{
"note": "Results truncated for space reasons"
}
]