add rapidast config and instruction to run it by PratikMahajan · Pull Request #1054 · openshift/cincinnati

PratikMahajan · 2025-11-04T16:55:57Z

No description provided.

openshift-ci · 2025-11-04T16:58:12Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: PratikMahajan

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [PratikMahajan]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

DavidHurta · 2025-11-04T17:12:42Z

/cc

openshift-ci · 2025-11-04T18:15:35Z

@PratikMahajan: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/yaml-lint	`713a3a4`	link	true	`/test yaml-lint`
ci/prow/cargo-test	`713a3a4`	link	true	`/test cargo-test`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

DavidHurta

A few notes and requests for changes.

Is there also a Jira we can link the PR to using the PR title?

DavidHurta · 2025-11-07T14:18:56Z

dist/rapidast/README.md

+podman run --rm \
+  -v $(pwd)/rapidast-config.yaml:/tmp/config.yaml \
+  -v $(pwd)/results:/opt/rapidast/results \
+  quay.io/redhatproductsecurity/rapidast:latest \
+  --config /tmp/config.yaml


Running the command as is results in (with a modified results directory permissions):

$ podman run -v $(pwd)/rapidast-config.yaml:/tmp/config.yaml -v $(pwd)/results:/opt/rapidast/results quay.io/redhatproductsecurity/rapidast:latest --config /tmp/config.yaml Traceback (most recent call last): File "/opt/rapidast/./rapidast.py", line 625, in <module> run() File "/opt/rapidast/./rapidast.py", line 348, in run validate_config_schema(config_file) File "/opt/rapidast/./rapidast.py", line 293, in validate_config_schema config = yaml.safe_load(load_config_file(config_file)) File "/opt/rapidast/./rapidast.py", line 91, in load_config_file return open(config_file_location, mode="r", encoding="utf-8") PermissionError: [Errno 13] Permission denied: '/tmp/config.yaml'

I had a look at the respective docs. They reference the usage of :Z regarding the permissions on the mounts.

DavidHurta · 2025-11-07T14:22:29Z

dist/rapidast/README.md

+podman pull quay.io/redhatproductsecurity/rapidast:latest
+
+# Create results directory
+mkdir -p results


Running the following podman command as is results in:

$ podman run -v $(pwd)/rapidast-config.yaml:/tmp/config.yaml:Z -v $(pwd)/results:/opt/rapidast/results:Z quay.io/redhatproductsecurity/rapidast:latest --config /tmp/config.yaml INFO:Validating configuration INFO:Configuration is valid INFO:Starting the redaction and dumping process for the configuration file: /tmp/config.yaml ERROR:Error occurred while dumping redacted config: [Errno 13] Permission denied: './results/openshift-upgrades-api' ERROR:Failed to dump configuration. Exiting.

I had a look at the respective docs. They reference running $ chmod o+w ./results after creating the directory. This fixes the issue for me.

Maybe I am a mac user (same as Pratik?), the exact command works for me.

NIT: Could we add dist/rapidast/results/ into .gitignore?

DavidHurta · 2025-11-07T14:26:06Z

dist/rapidast/README.md

+  -v $(pwd)/rapidast-config.yaml:/tmp/config.yaml \
+  -v $(pwd)/results:/opt/rapidast/results \
+  quay.io/redhatproductsecurity/rapidast:latest \
+  --config /tmp/config.yaml


Note: We can omit the --config flag if we utilize the default configuration path /opt/rapidast/config/config.yaml for the mount. Noting this in case you find it helpful.

DavidHurta · 2025-11-07T14:34:41Z

dist/rapidast/rapidast-config.yaml

+      # 10054: Cookie without SameSite Attribute (not applicable)
+      # 10112: Session Management Response Identified (not applicable)
+      disabledRules: "10054,10112"
+


Note: I have quickly found out that html reports are supported! Could we add them as a format for a human-readable output? Although that may depend on how the configuration is to be consumed, which is not clear to me at the moment.

Suggested change

report:

format: ["json","html"]

DavidHurta · 2025-11-07T14:38:06Z

The ci/prow/yaml-lint job needs to be addressed.

And the cargo-test is failing?? 👀

hongkailiu

The scanning result looks not bad.
2 Low and 1 Informative risks. 😄

hongkailiu · 2025-11-07T15:40:43Z

dist/rapidast/README.md

@@ -0,0 +1,26 @@
+# RapidAST Security Scanning
+
+Run automated security scans against OpenShift APIs using RapidAST container.


NIT: to keep consistent with last section in the page.

Suggested change

Run automated security scans against OpenShift APIs using RapidAST container.

Run automated security scans against OpenShift upgrades APIs using RapidAST container.

hongkailiu · 2025-11-07T15:41:30Z

dist/rapidast/README.md

+podman pull quay.io/redhatproductsecurity/rapidast:latest
+
+# Create results directory
+mkdir -p results


Maybe I am a mac user (same as Pratik?), the exact command works for me.

hongkailiu · 2025-11-07T16:30:18Z

dist/rapidast/rapidast-config.yaml

+
+    # Additional ZAP extensions
+    miscOptions:
+      additionalAddons: "ascanrulesBeta"  # Beta active scan rules


What is ascanrulesBeta for?
I cannot see its meaning in https://github.com/search?q=repo%3ARedHatProductSecurity%2Frapidast%20ascanrulesBeta&type=code

I cannot tell the difference either in the generated report withoutmiscOptions.

openshift-bot · 2026-02-06T01:00:51Z

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

coderabbitai · 2026-02-06T01:01:05Z

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Review skipped — only excluded labels are configured. (1)

do-not-merge/work-in-progress

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

🔍 Trigger a full review

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

add rapidast config and instruction to run it

713a3a4

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 4, 2025

openshift-ci bot requested a review from DavidHurta November 4, 2025 17:12

DavidHurta requested changes Nov 7, 2025

View reviewed changes

openshift-ci bot assigned DavidHurta Nov 7, 2025

hongkailiu reviewed Nov 7, 2025

View reviewed changes

openshift-ci bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Feb 6, 2026

		@@ -0,0 +1,26 @@
		# RapidAST Security Scanning

		Run automated security scans against OpenShift APIs using RapidAST container.

Conversation

PratikMahajan commented Nov 4, 2025

Uh oh!

openshift-ci bot commented Nov 4, 2025

Uh oh!

DavidHurta commented Nov 4, 2025

Uh oh!

openshift-ci bot commented Nov 4, 2025

Uh oh!

DavidHurta left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

DavidHurta Nov 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

DavidHurta commented Nov 7, 2025

Uh oh!

hongkailiu left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

openshift-bot commented Feb 6, 2026

Uh oh!

coderabbitai bot commented Feb 6, 2026

Review skipped

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

DavidHurta Nov 7, 2025 •

edited

Loading