feat(java-tls+webhook): Java TLS kprobe, mutating webhook, java-agent [AC-1059 4/4] - #179
feat(java-tls+webhook): Java TLS kprobe, mutating webhook, java-agent [AC-1059 4/4]#179ashevadepostman wants to merge 7 commits into
Conversation
![wiz-4570766290[bot]](https://avatars.githubusercontent.com/u/10251060?s=60&v=4){kind=small}
e5f206b to
825d166
Compare
1e12bb4 to
3e41fd3
Compare
- Add ebpf/ package: libssl uprobes, BPF ring-buffer reader, HTTP/2 adapter, gRPC framing decoder, per-PID rate cap, thermostat, discovery via /proc+cgroup - Add ebpf/uprobes/: OpenSSL uprobe attach (static + dynamic), stub for non-Linux - Add ebpf/events/: event types, HTTP/2 frame decoder, URL extractor, resolver - Add ebpf/loader/: bpf2go loader, config, rate-cap test (libssl path only) - Add ebpf/programs/libssl.bpf.c + event.h: BPF C source for SSL_read/SSL_write - Add cmd/internal/apidump-ebpf/: hidden dev command for credential-free capture - Wire --enable-https-capture flag into apidump and kube daemonset - Add integrations/cri_apis/: CRI client for container netns resolution - Bump Go to 1.25.0 / toolchain go1.25.11; update go.mod + go.sum - Update CI: install eBPF toolchain, bpftool (Ubuntu Noble workaround), generate vmlinux.h from host BTF, add helm-smoke job - Update Makefile, Dockerfiles, .gitignore for eBPF build - Add .wiz exceptions for required eBPF hostPath mounts and hostAliases rule
825d166 to
76c3a73
Compare
3e41fd3 to
f220c40
Compare
|
|
||
| plugins { | ||
| java | ||
| id("org.springframework.boot") version "3.5.14" |
There was a problem hiding this comment.
Code library with Restrictive license
More Details
Code library jakarta.annotation:jakarta.annotation-api version 2.1.1 has GPL-2.0-with-classpath-exception license, categorized as Restrictive, its use may cause a supply chain licensing issue.
Remediation guidance
- Review the license terms to understand its specific rules.
- If needed, Replace this component immediately with an alternative using a permissive license (e.g., MIT, Apache 2.0).
- Consult your legal team if the component is business-critical or the terms are unclear.
To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason
If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).
To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate
|
|
||
| plugins { | ||
| java | ||
| id("org.springframework.boot") version "3.5.14" |
There was a problem hiding this comment.
Code library with Restrictive license
More Details
Code library jakarta.transaction:jakarta.transaction-api version 2.0.1 has GPL-2.0-with-classpath-exception license, categorized as Restrictive, its use may cause a supply chain licensing issue.
Remediation guidance
- Review the license terms to understand its specific rules.
- If needed, Replace this component immediately with an alternative using a permissive license (e.g., MIT, Apache 2.0).
- Consult your legal team if the component is business-critical or the terms are unclear.
To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason
If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).
To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate
|
|
||
| plugins { | ||
| java | ||
| id("org.springframework.boot") version "3.5.14" |
There was a problem hiding this comment.
Code library with Restrictive license
More Details
Code library jakarta.interceptor:jakarta.interceptor-api version 2.1.0 has GPL-2.0-with-classpath-exception license, categorized as Restrictive, its use may cause a supply chain licensing issue.
Remediation guidance
- Review the license terms to understand its specific rules.
- If needed, Replace this component immediately with an alternative using a permissive license (e.g., MIT, Apache 2.0).
- Consult your legal team if the component is business-critical or the terms are unclear.
To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason
If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).
To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate
|
|
||
| plugins { | ||
| java | ||
| id("org.springframework.boot") version "3.5.14" |
There was a problem hiding this comment.
Code library with Restrictive license
More Details
Code library jakarta.annotation:jakarta.annotation-api version 2.1.1 has GPL-2.0-with-classpath-exception license, categorized as Restrictive, its use may cause a supply chain licensing issue.
Remediation guidance
- Review the license terms to understand its specific rules.
- If needed, Replace this component immediately with an alternative using a permissive license (e.g., MIT, Apache 2.0).
- Consult your legal team if the component is business-critical or the terms are unclear.
To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason
If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).
To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate
|
|
||
| plugins { | ||
| java | ||
| id("org.springframework.boot") version "3.5.14" |
There was a problem hiding this comment.
Code library with Restrictive license
More Details
Code library jakarta.servlet:jakarta.servlet-api version 6.0.0 has GPL-2.0-with-classpath-exception license, categorized as Restrictive, its use may cause a supply chain licensing issue.
Remediation guidance
- Review the license terms to understand its specific rules.
- If needed, Replace this component immediately with an alternative using a permissive license (e.g., MIT, Apache 2.0).
- Consult your legal team if the component is business-critical or the terms are unclear.
To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason
If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).
To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate
|
|
||
| plugins { | ||
| java | ||
| id("org.springframework.boot") version "3.5.14" |
There was a problem hiding this comment.
Code library with Restrictive license
More Details
Code library jakarta.annotation:jakarta.annotation-api version 2.1.1 has GPL-2.0-with-classpath-exception license, categorized as Restrictive, its use may cause a supply chain licensing issue.
Remediation guidance
- Review the license terms to understand its specific rules.
- If needed, Replace this component immediately with an alternative using a permissive license (e.g., MIT, Apache 2.0).
- Consult your legal team if the component is business-critical or the terms are unclear.
To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason
If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).
To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate
…1059) - Add test/kind/node-service/: gRPC + HTTP Node.js server and client, static and dynamic TLS variants, Dockerfile, k8s workload YAMLs - Add test/kind/dotnet-service/: ASP.NET gRPC server + client, Dockerfile, k8s workload YAML - Add deploy/run helper scripts for both services
- Update CLAUDE.md: Go 1.25, ebpf/ package layout, charts/ location, kube webhook - Add docs/webhook-runbook.md: production webhook deployment runbook - Add docs/kind-e2e-demo-presentation.md: kind cluster demo walkthrough - Add test/kind/SERVICE-TEST-GUIDE.md: guide for testing all language workloads - Add test/kind/deploy-e2e-demo.sh + deploy-e2e-prod.sh: end-to-end deploy scripts - Update test/kind/workloads.yaml: consolidated workload manifest Note: docs/phases/ (internal dev notes) intentionally excluded
…java-agent (AC-1059) - Add ebpf/programs/java_tls.bpf.c: BPF kprobe for JVM TLS interception - Add ebpf/collect_javatls_linux.go + ebpf/loader/loader_javatls_linux.go - Add cmd/internal/apidump-javatls/: hidden dev command for Java TLS capture - Add cmd/internal/kube-webhook/: mutating admission webhook (14 files, 25 tests) - Add charts/postman-insights-webhook/: Helm chart (cert-manager + TLS secret modes) - Wire kube webhook as subcommand: postman-insights-agent kube webhook - Add java-agent/: JNI bridge + ByteBuddy instrumentations (Jetty, SSLEngine) - Add test/kind/webhook/ + test/kind/certs/ + test/java-tls-harness/
76c3a73 to
433083e
Compare
f220c40 to
42b8198
Compare
| namespace: test-apps | ||
| labels: | ||
| app: java-https | ||
| spec: |
There was a problem hiding this comment.
Host Aliases Undefined Or Empty
on resource metadata.name={{java-https}}.spec
More Details
This rule checks if Kubernetes Pod resources have host aliases defined. This rule fails if a Pod specification does not have the hostAliases field defined or if the field is defined but empty. Host aliases allow you to add entries to a Pod's /etc/hosts file, providing custom host-to-IP mappings. Without defined host aliases, pods might rely on external DNS for name resolution, which could lead to DNS spoofing attacks or service disruptions if DNS services are unavailable. It is recommended to define appropriate host aliases for critical services to ensure reliable and secure name resolution within pods.
Expected
metadata.name=java-https.spec.hostAliases is defined
Found
metadata.name=java-https.spec.hostAliases is undefined
Security Frameworks: wf-id-199, wf-id-1
Rule ID: 4ea1c6c1-bb80-457b-a7a5-e3848ef33bad
To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason
If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).
To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate
| namespace: test-apps | ||
| labels: | ||
| app: java-service | ||
| spec: |
There was a problem hiding this comment.
Host Aliases Undefined Or Empty
on resource metadata.name={{java-service}}.spec
More Details
This rule checks if Kubernetes Pod resources have host aliases defined. This rule fails if a Pod specification does not have the hostAliases field defined or if the field is defined but empty. Host aliases allow you to add entries to a Pod's /etc/hosts file, providing custom host-to-IP mappings. Without defined host aliases, pods might rely on external DNS for name resolution, which could lead to DNS spoofing attacks or service disruptions if DNS services are unavailable. It is recommended to define appropriate host aliases for critical services to ensure reliable and secure name resolution within pods.
Expected
metadata.name=java-service.spec.hostAliases is defined
Found
metadata.name=java-service.spec.hostAliases is undefined
Security Frameworks: wf-id-199, wf-id-1
Rule ID: 4ea1c6c1-bb80-457b-a7a5-e3848ef33bad
To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason
If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).
To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate
1 participant
Summary
Adds Java TLS traffic capture via a BPF kprobe and a Kubernetes mutating admission webhook that auto-injects the Postman Java agent into pods.
What's included:
Java TLS kprobe:
ebpf/programs/java_tls.bpf.c: BPF kprobe for JVM TLS interception via ioctl bridgeebpf/collect_javatls_linux.go+ebpf/loader/loader_javatls_linux.go: Go-side collectorcmd/internal/apidump-javatls/: hidden dev command for Java TLS capture--enable-java-tlsflag wired intoapidumpandkube daemonsetMutating admission webhook (
kube webhook):cmd/internal/kube-webhook/: HTTPS webhook server (14 files, 25 tests)JAVA_TOOL_OPTIONS=-javaagent:...into Java podsfailurePolicy: Ignore— webhook failure never blocks pod creationpostman.com/insights=enablednamespace selector (consistent with existing labels)--init-imagerequired flag, no:latestdefaultcharts/postman-insights-webhook/: Helm chart (cert-manager + pre-existing TLS secret modes)postman-insights-agent kube webhooksubcommandJava agent:
java-agent/: JNI bridge + ByteBuddy instrumentations (Jetty SSL, SSLEngine)Kind test infrastructure:
test/kind/webhook/: dev TLS cert gen scripts + kind cluster manifeststest/kind/certs/+test/java-tls-harness/Test plan
makebuilds cleanly (including java-agent Gradle build)make testpasses (webhook unit tests: 25 tests)JAVA_TOOL_OPTIONSinto pods in labelled namespacesfailurePolicy: Ignore)helm lint+helm template)