Skip to content

Commit

Permalink
refactor: pass client.Object instead of PodSpec to vulnerabilityrepor…
Browse files Browse the repository at this point in the history 
…t.Plugin (#894)

This is needed for future development where we need more information of object which we are scanning.
  • Loading branch information
@deven0t
deven0t committed Jan 11, 2022
1 parent 48a5371 commit 3d0417d
Show file tree
Hide file tree
Showing 6 changed files with 163 additions and 53 deletions.
9 changes: 8 additions & 1 deletion pkg/plugin/aqua/plugin.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,11 +8,13 @@ import (
"github.com/aquasecurity/starboard/pkg/apis/aquasecurity/v1alpha1"
"github.com/aquasecurity/starboard/pkg/docker"
"github.com/aquasecurity/starboard/pkg/ext"
"github.com/aquasecurity/starboard/pkg/kube"
"github.com/aquasecurity/starboard/pkg/starboard"
"github.com/aquasecurity/starboard/pkg/vulnerabilityreport"
corev1 "k8s.io/api/core/v1"
"k8s.io/apimachinery/pkg/api/resource"
"k8s.io/utils/pointer"
"sigs.k8s.io/controller-runtime/pkg/client"
)

type plugin struct {
Expand All @@ -37,7 +39,12 @@ func (s *plugin) Init(_ starboard.PluginContext) error {
return nil
}

func (s *plugin) GetScanJobSpec(ctx starboard.PluginContext, spec corev1.PodSpec, _ map[string]docker.Auth) (corev1.PodSpec, []*corev1.Secret, error) {
func (s *plugin) GetScanJobSpec(ctx starboard.PluginContext, workload client.Object, _ map[string]docker.Auth) (corev1.PodSpec, []*corev1.Secret, error) {
spec, err := kube.GetPodSpec(workload)
if err != nil {
return corev1.PodSpec{}, nil, err
}

initContainerName := s.idGenerator.GenerateID()

aquaImageRef, err := s.getImageRef(ctx)
Expand Down
8 changes: 7 additions & 1 deletion pkg/plugin/trivy/plugin.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ import (
"k8s.io/apimachinery/pkg/api/resource"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/utils/pointer"
"sigs.k8s.io/controller-runtime/pkg/client"
)

const (
Expand Down Expand Up @@ -207,7 +208,12 @@ func (p *plugin) Init(ctx starboard.PluginContext) error {
})
}

func (p *plugin) GetScanJobSpec(ctx starboard.PluginContext, spec corev1.PodSpec, credentials map[string]docker.Auth) (corev1.PodSpec, []*corev1.Secret, error) {
func (p *plugin) GetScanJobSpec(ctx starboard.PluginContext, workload client.Object, credentials map[string]docker.Auth) (corev1.PodSpec, []*corev1.Secret, error) {
spec, err := kube.GetPodSpec(workload)
if err != nil {
return corev1.PodSpec{}, nil, err
}

config, err := p.newConfigFrom(ctx)
if err != nil {
return corev1.PodSpec{}, nil, err
Expand Down
191 changes: 143 additions & 48 deletions pkg/plugin/trivy/plugin_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,11 +14,13 @@ import (
"github.com/aquasecurity/starboard/pkg/starboard"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
appsv1 "k8s.io/api/apps/v1"
corev1 "k8s.io/api/core/v1"
"k8s.io/apimachinery/pkg/api/resource"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/types"
"k8s.io/utils/pointer"
"sigs.k8s.io/controller-runtime/pkg/client"
"sigs.k8s.io/controller-runtime/pkg/client/fake"
)

Expand Down Expand Up @@ -442,7 +444,7 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
name string

config map[string]string
workloadSpec corev1.PodSpec
workloadSpec client.Object

expectedSecrets []corev1.Secret
expectedJobSpec corev1.PodSpec
Expand All @@ -458,11 +460,25 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
"trivy.resources.limits.cpu": "500m",
"trivy.resources.limits.memory": "500M",
},
workloadSpec: corev1.PodSpec{
Containers: []corev1.Container{
{
Name: "nginx",
Image: "nginx:1.16",
workloadSpec: &appsv1.ReplicaSet{
TypeMeta: metav1.TypeMeta{
Kind: "ReplicaSet",
APIVersion: "apps/v1",
},
ObjectMeta: metav1.ObjectMeta{
Name: "nginx-6799fc88d8",
Namespace: "prod-ns",
},
Spec: appsv1.ReplicaSetSpec{
Template: corev1.PodTemplateSpec{
Spec: corev1.PodSpec{
Containers: []corev1.Container{
{
Name: "nginx",
Image: "nginx:1.16",
},
},
},
},
},
},
Expand Down Expand Up @@ -708,14 +724,23 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
"trivy.resources.limits.cpu": "500m",
"trivy.resources.limits.memory": "500M",
},
workloadSpec: corev1.PodSpec{
Containers: []corev1.Container{
{
Name: "nginx",
Image: "poc.myregistry.harbor.com.pl/nginx:1.16",
},
workloadSpec: &corev1.Pod{
TypeMeta: metav1.TypeMeta{
Kind: "Pod",
APIVersion: "v1",
},
},
ObjectMeta: metav1.ObjectMeta{
Name: "nginx",
Namespace: "prod-ns",
},
Spec: corev1.PodSpec{
Containers: []corev1.Container{
{
Name: "nginx",
Image: "poc.myregistry.harbor.com.pl/nginx:1.16",
},
},
}},
expectedJobSpec: corev1.PodSpec{
Affinity: starboard.LinuxNodeAffinity(),
RestartPolicy: corev1.RestartPolicyNever,
Expand Down Expand Up @@ -960,11 +985,21 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
"trivy.resources.limits.cpu": "500m",
"trivy.resources.limits.memory": "500M",
},
workloadSpec: corev1.PodSpec{
Containers: []corev1.Container{
{
Name: "nginx",
Image: "poc.myregistry.harbor.com.pl/nginx:1.16",
workloadSpec: &corev1.Pod{
TypeMeta: metav1.TypeMeta{
Kind: "Pod",
APIVersion: "v1",
},
ObjectMeta: metav1.ObjectMeta{
Name: "nginx",
Namespace: "prod-ns",
},
Spec: corev1.PodSpec{
Containers: []corev1.Container{
{
Name: "nginx",
Image: "poc.myregistry.harbor.com.pl/nginx:1.16",
},
},
},
},
Expand Down Expand Up @@ -1216,11 +1251,21 @@ CVE-2019-1543`,
"trivy.resources.limits.cpu": "500m",
"trivy.resources.limits.memory": "500M",
},
workloadSpec: corev1.PodSpec{
Containers: []corev1.Container{
{
Name: "nginx",
Image: "nginx:1.16",
workloadSpec: &corev1.Pod{
TypeMeta: metav1.TypeMeta{
Kind: "Pod",
APIVersion: "v1",
},
ObjectMeta: metav1.ObjectMeta{
Name: "nginx",
Namespace: "prod-ns",
},
Spec: corev1.PodSpec{
Containers: []corev1.Container{
{
Name: "nginx",
Image: "nginx:1.16",
},
},
},
},
Expand Down Expand Up @@ -1492,11 +1537,21 @@ CVE-2019-1543`,

"trivy.registry.mirror.index.docker.io": "mirror.io",
},
workloadSpec: corev1.PodSpec{
Containers: []corev1.Container{
{
Name: "nginx",
Image: "nginx:1.16",
workloadSpec: &corev1.Pod{
TypeMeta: metav1.TypeMeta{
Kind: "Pod",
APIVersion: "v1",
},
ObjectMeta: metav1.ObjectMeta{
Name: "nginx",
Namespace: "prod-ns",
},
Spec: corev1.PodSpec{
Containers: []corev1.Container{
{
Name: "nginx",
Image: "nginx:1.16",
},
},
},
},
Expand Down Expand Up @@ -1741,11 +1796,21 @@ CVE-2019-1543`,
"trivy.resources.limits.cpu": "500m",
"trivy.resources.limits.memory": "500M",
},
workloadSpec: corev1.PodSpec{
Containers: []corev1.Container{
{
Name: "nginx",
Image: "nginx:1.16",
workloadSpec: &corev1.Pod{
TypeMeta: metav1.TypeMeta{
Kind: "Pod",
APIVersion: "v1",
},
ObjectMeta: metav1.ObjectMeta{
Name: "nginx",
Namespace: "prod-ns",
},
Spec: corev1.PodSpec{
Containers: []corev1.Container{
{
Name: "nginx",
Image: "nginx:1.16",
},
},
},
},
Expand Down Expand Up @@ -1920,11 +1985,21 @@ CVE-2019-1543`,
"trivy.resources.limits.cpu": "500m",
"trivy.resources.limits.memory": "500M",
},
workloadSpec: corev1.PodSpec{
Containers: []corev1.Container{
{
Name: "nginx",
Image: "poc.myregistry.harbor.com.pl/nginx:1.16",
workloadSpec: &corev1.Pod{
TypeMeta: metav1.TypeMeta{
Kind: "Pod",
APIVersion: "v1",
},
ObjectMeta: metav1.ObjectMeta{
Name: "nginx",
Namespace: "prod-ns",
},
Spec: corev1.PodSpec{
Containers: []corev1.Container{
{
Name: "nginx",
Image: "poc.myregistry.harbor.com.pl/nginx:1.16",
},
},
},
},
Expand Down Expand Up @@ -2103,11 +2178,21 @@ CVE-2019-1543`,
"trivy.resources.limits.cpu": "500m",
"trivy.resources.limits.memory": "500M",
},
workloadSpec: corev1.PodSpec{
Containers: []corev1.Container{
{
Name: "nginx",
Image: "poc.myregistry.harbor.com.pl/nginx:1.16",
workloadSpec: &corev1.Pod{
TypeMeta: metav1.TypeMeta{
Kind: "Pod",
APIVersion: "v1",
},
ObjectMeta: metav1.ObjectMeta{
Name: "nginx",
Namespace: "prod-ns",
},
Spec: corev1.PodSpec{
Containers: []corev1.Container{
{
Name: "nginx",
Image: "poc.myregistry.harbor.com.pl/nginx:1.16",
},
},
},
},
Expand Down Expand Up @@ -2290,11 +2375,21 @@ CVE-2019-1543`,
"trivy.resources.limits.cpu": "500m",
"trivy.resources.limits.memory": "500M",
},
workloadSpec: corev1.PodSpec{
Containers: []corev1.Container{
{
Name: "nginx",
Image: "nginx:1.16",
workloadSpec: &corev1.Pod{
TypeMeta: metav1.TypeMeta{
Kind: "Pod",
APIVersion: "v1",
},
ObjectMeta: metav1.ObjectMeta{
Name: "nginx",
Namespace: "prod-ns",
},
Spec: corev1.PodSpec{
Containers: []corev1.Container{
{
Name: "nginx",
Image: "nginx:1.16",
},
},
},
},
Expand Down
2 changes: 1 addition & 1 deletion pkg/vulnerabilityreport/builder.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,7 @@ func (s *ScanJobBuilder) Get() (*batchv1.Job, []*corev1.Secret, error) {
return nil, nil, err
}

templateSpec, secrets, err := s.plugin.GetScanJobSpec(s.pluginContext, spec, s.credentials)
templateSpec, secrets, err := s.plugin.GetScanJobSpec(s.pluginContext, s.object, s.credentials)
if err != nil {
return nil, nil, err
}
Expand Down
3 changes: 2 additions & 1 deletion pkg/vulnerabilityreport/builder_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/client-go/kubernetes/scheme"
"k8s.io/utils/pointer"
"sigs.k8s.io/controller-runtime/pkg/client"
)

func TestReportBuilder(t *testing.T) {
Expand Down Expand Up @@ -141,7 +142,7 @@ func (p *testPlugin) Init(_ starboard.PluginContext) error {
return nil
}

func (p *testPlugin) GetScanJobSpec(_ starboard.PluginContext, _ corev1.PodSpec, _ map[string]docker.Auth) (corev1.PodSpec, []*corev1.Secret, error) {
func (p *testPlugin) GetScanJobSpec(_ starboard.PluginContext, _ client.Object, _ map[string]docker.Auth) (corev1.PodSpec, []*corev1.Secret, error) {
return corev1.PodSpec{}, nil, nil
}

Expand Down
3 changes: 2 additions & 1 deletion pkg/vulnerabilityreport/plugin.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ import (
"github.com/aquasecurity/starboard/pkg/docker"
"github.com/aquasecurity/starboard/pkg/starboard"
corev1 "k8s.io/api/core/v1"
"sigs.k8s.io/controller-runtime/pkg/client"
)

// Plugin defines the interface between Starboard and static vulnerability
Expand All @@ -23,7 +24,7 @@ type Plugin interface {
// The second argument maps container names to Docker registry credentials,
// which can be passed to the scanner as environment variables with values
// set from returned secrets.
GetScanJobSpec(ctx starboard.PluginContext, spec corev1.PodSpec, credentials map[string]docker.Auth) (
GetScanJobSpec(ctx starboard.PluginContext, workload client.Object, credentials map[string]docker.Auth) (
corev1.PodSpec, []*corev1.Secret, error)

// ParseVulnerabilityReportData is a callback to parse and convert logs of
Expand Down

0 comments on commit 3d0417d

Please sign in to comment.