feat: monitor OS vulnerability in Skaffold LTS images. #6964

ChrisGe4 · 2021-12-13T22:38:08Z

Add a Cloud Build job to monitor the vulnerabilities that are found in the LTS images.

Reference: go/cd-lts-image-security.

codecov · 2021-12-13T23:01:05Z

Codecov Report

Merging #6964 (82424d1) into main (290280e) will decrease coverage by 1.71%.
The diff coverage is 56.70%.

@@            Coverage Diff             @@
##             main    #6964      +/-   ##
==========================================
- Coverage   70.48%   68.77%   -1.72%     
==========================================
  Files         515      551      +36     
  Lines       23150    25370    +2220     
==========================================
+ Hits        16317    17447    +1130     
- Misses       5776     6740     +964     
- Partials     1057     1183     +126

Impacted Files	Coverage Δ
cmd/skaffold/app/cmd/deploy.go	`52.00% <ø> (-1.85%)`	⬇️
cmd/skaffold/app/cmd/dev.go	`84.61% <0.00%> (ø)`
cmd/skaffold/app/cmd/render.go	`36.66% <0.00%> (-4.72%)`	⬇️
cmd/skaffold/skaffold.go	`0.00% <0.00%> (ø)`
cmd/skaffold/app/cmd/inspect_tests.go	`62.50% <14.28%> (-1.14%)`	⬇️
cmd/skaffold/app/cmd/lsp.go	`28.12% <28.12%> (ø)`
cmd/skaffold/app/cmd/fix.go	`68.85% <40.00%> (-7.62%)`	⬇️
cmd/skaffold/app/cmd/lint.go	`42.85% <42.85%> (ø)`
cmd/skaffold/app/cmd/find_configs.go	`48.88% <50.00%> (+0.24%)`	⬆️
cmd/skaffold/app/skaffold.go	`76.19% <70.00%> (-8.43%)`	⬇️
... and 175 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 248b74e...82424d1. Read the comment docs.

briandealwis · 2021-12-14T02:27:53Z

deploy/lts-vuln-monitor/cloudbuild.yaml

+steps:
+- id: Get github token.
+  name: gcr.io/cloud-builders/gcloud
+  entrypoint: 'bash'


Should use /bin/bash to be consistent with line 8

briandealwis · 2021-12-14T02:30:38Z

deploy/lts-vuln-monitor/report.sh

+check_existing_issue() {
+  label=$1
+  if [ $(gh issue list --label="$label" --repo="$_REPO" | wc -c) -ne 0 ]; then
+    echo "There is already an issue opened for the vulnerabilities that are found in the LTS images." && exit 0


What if there are new, more severe, vulnerabilities reported?

The github issue only serves as a reminder for skaffold team to look up the vulnerabilities in the report that is created by container analysis.

Except that you're listing the images with vulnerabilities, and a new vulnerability could have been discovered in a different image.

I added the code to update the existing issue.

deploy/lts-vuln-monitor/report.sh

deploy/lts-vuln-monitor/scan.sh

briandealwis · 2021-12-14T02:38:28Z

deploy/lts-vuln-monitor/scan.sh

+# If changed, also change the same variable in report.sh.
+OS_VULN_FILE=/workspace/os_vuln.txt
+GREP_TEMPLATE="-e "
+append() {


Feels like there should be a blank line to separate the unrelated variables from this function

deploy/lts-vuln-monitor/scan.sh

deploy/lts-vuln-monitor/cloudbuild.yaml

briandealwis · 2021-12-14T03:37:33Z

deploy/lts-vuln-monitor/report.sh

+
+set -x
+
+# Variables that will be substituted in cloudbuild.yaml.


Note that these substitutions must be explicitly propagated into the environment with an env: section on a step in the cloudbuild.yaml

ah, I only tested with default values before. Added the substitutions section.

deploy/lts-vuln-monitor/cloudbuild.yaml

tejal29 · 2021-12-15T09:04:31Z

Thanks. This is looking pretty solid.

Can you fix the CLA bot issue. https://github.com/GoogleContainerTools/skaffold/pull/6964/checks?check_run_id=4525719034
Can you link a sample build job?

ChrisGe4 · 2021-12-15T19:49:39Z

Thanks. This is looking pretty solid.

Can you fix the CLA bot issue. https://github.com/GoogleContainerTools/skaffold/pull/6964/checks?check_run_id=4525719034

Can you link a sample build job?

Resolved.
A job triggered from my test project with the code in this repo:https://pantheon.corp.google.com/cloud-build/builds;region=global/fe415473-1bb1-4b01-bf83-f0b317ef6262?project=cd-demo-01 Log: https://paste.googleplex.com/6644379658747904

…ound in the LTS images. Reference: go/cd-lts-image-security.

Update author.

tejal29 · 2021-12-16T17:27:59Z

A job triggered from my test project with the code in this repo:https://pantheon.corp.google.com/cloud-build/builds;region=global/fe415473-1bb1-4b01-bf83-f0b317ef6262?project=cd-demo-01

Can you copy the logs and share a gpaste/ link?
I don't have access to see the build log.

ChrisGe4 · 2021-12-20T19:29:13Z

A job triggered from my test project with the code in this repo:https://pantheon.corp.google.com/cloud-build/builds;region=global/fe415473-1bb1-4b01-bf83-f0b317ef6262?project=cd-demo-01

Can you copy the logs and share a gpaste/ link? I don't have access to see the build log.

I have added the gpaste link.

tejal29 · 2022-01-05T16:45:47Z

Nice! looks like issues are getting created here https://github.com/ChrisGe4/cd-lts-test/issues

tejal29 · 2022-01-05T16:47:53Z

Address google cloud API warning and then LGTM!.

Thank you for your patience.

Step #1 - "Check vulnerability report.": WARNING: --filter : operator evaluation is changing for consistency across Google APIs.  tags:v*lts currently matches but will not match in the near future.  Run `gcloud topic filters` for details.

ChrisGe4 requested a review from a team as a code owner December 13, 2021 22:38

ChrisGe4 requested a review from briandealwis December 13, 2021 22:38

pull-request-size bot added the size/L label Dec 13, 2021

ChrisGe4 assigned tejal29 Dec 13, 2021

ChrisGe4 changed the title ~~Monitor OS vulnerability in Skaffold LTS images.~~ feat: monitor OS vulnerability in Skaffold LTS images. Dec 13, 2021

briandealwis reviewed Dec 14, 2021

View reviewed changes

tejal29 reviewed Dec 14, 2021

View reviewed changes

deploy/lts-vuln-monitor/cloudbuild.yaml Outdated Show resolved Hide resolved

ChrisGe4 force-pushed the master branch from f1f02fe to 02b2680 Compare December 15, 2021 19:44

ChrisGe4 closed this Dec 15, 2021

ChrisGe4 reopened this Dec 15, 2021

ChrisGe4 force-pushed the master branch from 02b2680 to 3a1f92c Compare December 15, 2021 20:06

ChrisGe4 added 3 commits December 15, 2021 15:42

feat: add a Cloud Build job to monitor the vulnerabilities that are f…

d184ece

…ound in the LTS images. Reference: go/cd-lts-image-security.

Format the shell script and add substitutions to cloudbuild.yaml.

8d6bce7

Update the body of the existing issue.

db9c1e5

Update author.

ChrisGe4 force-pushed the master branch from 3a1f92c to db9c1e5 Compare December 15, 2021 20:45

tejal29 added the kokoro:force-run forces a kokoro re-run on a PR label Dec 16, 2021

kokoro-team removed the kokoro:force-run forces a kokoro re-run on a PR label Dec 16, 2021

Use key ~ value operator for --filter flag.

82424d1

tejal29 approved these changes Jan 5, 2022

View reviewed changes

tejal29 enabled auto-merge (squash) January 5, 2022 17:26

briandealwis added the kokoro:run runs the kokoro jobs on a PR label Jan 5, 2022

kokoro-team removed the kokoro:run runs the kokoro jobs on a PR label Jan 5, 2022

tejal29 merged commit e15fca6 into GoogleContainerTools:main Jan 5, 2022

ChrisGe4 mentioned this pull request Mar 7, 2022

WIP: only report the vulnerability of the LTS images with last patch version. #7167

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: monitor OS vulnerability in Skaffold LTS images. #6964

feat: monitor OS vulnerability in Skaffold LTS images. #6964

ChrisGe4 commented Dec 13, 2021

codecov bot commented Dec 13, 2021 •

edited

briandealwis Dec 14, 2021

ChrisGe4 Dec 14, 2021

briandealwis Dec 14, 2021

ChrisGe4 Dec 14, 2021

briandealwis Dec 14, 2021 •

edited

ChrisGe4 Dec 15, 2021

briandealwis Dec 14, 2021

ChrisGe4 Dec 14, 2021

briandealwis Dec 14, 2021

ChrisGe4 Dec 14, 2021

tejal29 commented Dec 15, 2021 •

edited

ChrisGe4 commented Dec 15, 2021 •

edited

tejal29 commented Dec 16, 2021

ChrisGe4 commented Dec 20, 2021

tejal29 commented Jan 5, 2022

tejal29 commented Jan 5, 2022


		set -x

		# Variables that will be substituted in cloudbuild.yaml.

feat: monitor OS vulnerability in Skaffold LTS images. #6964

feat: monitor OS vulnerability in Skaffold LTS images. #6964

Conversation

ChrisGe4 commented Dec 13, 2021

codecov bot commented Dec 13, 2021 • edited

Codecov Report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

briandealwis Dec 14, 2021 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tejal29 commented Dec 15, 2021 • edited

ChrisGe4 commented Dec 15, 2021 • edited

tejal29 commented Dec 16, 2021

ChrisGe4 commented Dec 20, 2021

tejal29 commented Jan 5, 2022

tejal29 commented Jan 5, 2022

codecov bot commented Dec 13, 2021 •

edited

briandealwis Dec 14, 2021 •

edited

tejal29 commented Dec 15, 2021 •

edited

ChrisGe4 commented Dec 15, 2021 •

edited