Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Set security context for trivy #359

Merged

Conversation

mlevesquedion
Copy link
Contributor

This PR adds SecurityContexts to the trivy Job in order to run the job with the least amount of privilege possible, in partial fulfillment of #163.

I ran the job with and without the changes in a local kind cluster and I did not see a difference in the output.

To obtain the output, I ran:

kubectl create deployment nginx --image nginx:1.16
kubectl wait --for=condition=available deploy/nginx --timeout=60s
./bin/starboard scan vulnerabilityreports deployment/nginx
./bin/starboard get vulnerabilities deployment/nginx -o yaml >vulns.yaml

Looking at issues on the trivy repo, I found this issue: aquasecurity/trivy#580, where running as a non-root user was causing trivy to be unable to run. It seems that this was due to using the Docker socket, which is not the case in starboard, so I don't think this could cause problems here.

@codecov
Copy link

codecov bot commented Jan 23, 2021

Codecov Report

Merging #359 (02fd12a) into main (ab281e4) will increase coverage by 0.16%.
The diff coverage is 100.00%.

Impacted file tree graph

@@            Coverage Diff             @@
##             main     #359      +/-   ##
==========================================
+ Coverage   66.35%   66.52%   +0.16%     
==========================================
  Files          58       58              
  Lines        3026     3041      +15     
==========================================
+ Hits         2008     2023      +15     
  Misses        769      769              
  Partials      249      249              
Impacted Files Coverage Δ
pkg/trivy/plugin.go 74.47% <100.00%> (+1.41%) ⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update ab281e4...02fd12a. Read the comment docs.

Copy link
Contributor

@danielpacak danielpacak left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you @mlevesquedion for taking care of this one! LGTM

@danielpacak danielpacak merged commit 81414f8 into aquasecurity:main Jan 25, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants