Skip to content

Commit

Permalink
feat: skip dirs and files by resource annotation (#1227)
Browse files Browse the repository at this point in the history 
* feat: skip dirs and files by resource annotation

Signed-off-by: chenk <hen.keinan@gmail.com>
  • Loading branch information
@chen-keinan
chen-keinan committed May 23, 2023
1 parent 6b29e21 commit e909545
Show file tree
Hide file tree
Showing 2 changed files with 179 additions and 8 deletions.
30 changes: 22 additions & 8 deletions pkg/plugins/trivy/plugin.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,10 @@ const (
const (
AWSECR_Image_Regex = "^\\d+\\.dkr\\.ecr\\.(\\w+-\\w+-\\d+)\\.amazonaws\\.com\\/"
SupportedConfigAuditKinds = "Workload,Service,Role,ClusterRole,NetworkPolicy,Ingress,LimitRange,ResourceQuota"
// SkipDirsAnnotation annotation example: trivy-operator.aquasecurity.github.io/skip-dirs: "/tmp,/home"
SkipDirsAnnotation = "trivy-operator.aquasecurity.github.io/skip-dirs"
// SkipFilesAnnotation example: trivy-operator.aquasecurity.github.io/skip-files: "/src/Gemfile.lock,/examplebinary"
SkipFilesAnnotation = "trivy-operator.aquasecurity.github.io/skip-files"
)

const (
Expand Down Expand Up @@ -754,8 +758,8 @@ func (p *plugin) getPodSpecForStandaloneMode(ctx trivyoperator.PluginContext, co
constructEnvVarSourceFromConfigMap("TRIVY_OFFLINE_SCAN", trivyConfigName, keyTrivyOfflineScan),
constructEnvVarSourceFromConfigMap("TRIVY_JAVA_DB_REPOSITORY", trivyConfigName, keyTrivyJavaDBRepository),
constructEnvVarSourceFromConfigMap("TRIVY_TIMEOUT", trivyConfigName, keyTrivyTimeout),
constructEnvVarSourceFromConfigMap("TRIVY_SKIP_FILES", trivyConfigName, keyTrivySkipFiles),
constructEnvVarSourceFromConfigMap("TRIVY_SKIP_DIRS", trivyConfigName, keyTrivySkipDirs),
ConfigWorkloadAnnotationEnvVars(workload, SkipFilesAnnotation, "TRIVY_SKIP_FILES", trivyConfigName, keyTrivySkipFiles),
ConfigWorkloadAnnotationEnvVars(workload, SkipDirsAnnotation, "TRIVY_SKIP_DIRS", trivyConfigName, keyTrivySkipDirs),
constructEnvVarSourceFromConfigMap("HTTP_PROXY", trivyConfigName, keyTrivyHTTPProxy),
constructEnvVarSourceFromConfigMap("HTTPS_PROXY", trivyConfigName, keyTrivyHTTPSProxy),
constructEnvVarSourceFromConfigMap("NO_PROXY", trivyConfigName, keyTrivyNoProxy),
Expand Down Expand Up @@ -959,8 +963,8 @@ func (p *plugin) getPodSpecForClientServerMode(ctx trivyoperator.PluginContext,
constructEnvVarSourceFromConfigMap("TRIVY_OFFLINE_SCAN", trivyConfigName, keyTrivyOfflineScan),
constructEnvVarSourceFromConfigMap("TRIVY_JAVA_DB_REPOSITORY", trivyConfigName, keyTrivyJavaDBRepository),
constructEnvVarSourceFromConfigMap("TRIVY_TIMEOUT", trivyConfigName, keyTrivyTimeout),
constructEnvVarSourceFromConfigMap("TRIVY_SKIP_FILES", trivyConfigName, keyTrivySkipFiles),
constructEnvVarSourceFromConfigMap("TRIVY_SKIP_DIRS", trivyConfigName, keyTrivySkipDirs),
ConfigWorkloadAnnotationEnvVars(workload, SkipFilesAnnotation, "TRIVY_SKIP_FILES", trivyConfigName, keyTrivySkipFiles),
ConfigWorkloadAnnotationEnvVars(workload, SkipDirsAnnotation, "TRIVY_SKIP_DIRS", trivyConfigName, keyTrivySkipDirs),
constructEnvVarSourceFromConfigMap("TRIVY_TOKEN_HEADER", trivyConfigName, keyTrivyServerTokenHeader),
constructEnvVarSourceFromSecret("TRIVY_TOKEN", trivyConfigName, keyTrivyServerToken),
constructEnvVarSourceFromSecret("TRIVY_CUSTOM_HEADERS", trivyConfigName, keyTrivyServerCustomHeaders),
Expand Down Expand Up @@ -1337,8 +1341,8 @@ func (p *plugin) getPodSpecForStandaloneFSMode(ctx trivyoperator.PluginContext,
for _, c := range getContainers(spec) {
env := []corev1.EnvVar{
constructEnvVarSourceFromConfigMap("TRIVY_SEVERITY", trivyConfigName, KeyTrivySeverity),
constructEnvVarSourceFromConfigMap("TRIVY_SKIP_FILES", trivyConfigName, keyTrivySkipFiles),
constructEnvVarSourceFromConfigMap("TRIVY_SKIP_DIRS", trivyConfigName, keyTrivySkipDirs),
ConfigWorkloadAnnotationEnvVars(workload, SkipFilesAnnotation, "TRIVY_SKIP_FILES", trivyConfigName, keyTrivySkipFiles),
ConfigWorkloadAnnotationEnvVars(workload, SkipDirsAnnotation, "TRIVY_SKIP_DIRS", trivyConfigName, keyTrivySkipDirs),
constructEnvVarSourceFromConfigMap("HTTP_PROXY", trivyConfigName, keyTrivyHTTPProxy),
constructEnvVarSourceFromConfigMap("HTTPS_PROXY", trivyConfigName, keyTrivyHTTPSProxy),
constructEnvVarSourceFromConfigMap("NO_PROXY", trivyConfigName, keyTrivyNoProxy),
Expand Down Expand Up @@ -1531,8 +1535,8 @@ func (p *plugin) getPodSpecForClientServerFSMode(ctx trivyoperator.PluginContext
for _, c := range getContainers(spec) {
env := []corev1.EnvVar{
constructEnvVarSourceFromConfigMap("TRIVY_SEVERITY", trivyConfigName, KeyTrivySeverity),
constructEnvVarSourceFromConfigMap("TRIVY_SKIP_FILES", trivyConfigName, keyTrivySkipFiles),
constructEnvVarSourceFromConfigMap("TRIVY_SKIP_DIRS", trivyConfigName, keyTrivySkipDirs),
ConfigWorkloadAnnotationEnvVars(workload, SkipFilesAnnotation, "TRIVY_SKIP_FILES", trivyConfigName, keyTrivySkipFiles),
ConfigWorkloadAnnotationEnvVars(workload, SkipDirsAnnotation, "TRIVY_SKIP_DIRS", trivyConfigName, keyTrivySkipDirs),
constructEnvVarSourceFromConfigMap("HTTP_PROXY", trivyConfigName, keyTrivyHTTPProxy),
constructEnvVarSourceFromConfigMap("HTTPS_PROXY", trivyConfigName, keyTrivyHTTPSProxy),
constructEnvVarSourceFromConfigMap("NO_PROXY", trivyConfigName, keyTrivyNoProxy),
Expand Down Expand Up @@ -2019,3 +2023,13 @@ func getSecurityChecks(ctx trivyoperator.PluginContext) string {

return strings.Join(securityChecks, ",")
}

func ConfigWorkloadAnnotationEnvVars(workload client.Object, annotation string, envVarName string, trivyConfigName string, configKey string) corev1.EnvVar {
if value, ok := workload.GetAnnotations()[annotation]; ok {
return corev1.EnvVar{
Name: envVarName,
Value: value,
}
}
return constructEnvVarSourceFromConfigMap(envVarName, trivyConfigName, configKey)
}
157 changes: 157 additions & 0 deletions pkg/plugins/trivy/plugin_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7945,3 +7945,160 @@ func writeBzip2AndEncode(data []byte) (string, error) {
}
return base64.StdEncoding.EncodeToString(in.Bytes()), nil
}

func TestSkipDirFileEnvVars(t *testing.T) {
testCases := []struct {
name string
configName string
skipType string
envKey string
workload *corev1.Pod
configKey string
want corev1.EnvVar
}{
{
name: "read skip file from annotation",
configName: "trivy-operator-trivy-config",
skipType: trivy.SkipFilesAnnotation,
envKey: "TRIVY_SKIP_FILES",
configKey: "trivy.skipFiles",
workload: &corev1.Pod{
TypeMeta: metav1.TypeMeta{
Kind: "Pod",
APIVersion: "v1",
},
ObjectMeta: metav1.ObjectMeta{
Name: "nginx",
Namespace: "prod-ns",
Annotations: map[string]string{
trivy.SkipFilesAnnotation: "/src/Gemfile.lock,/examplebinary",
},
},
Spec: corev1.PodSpec{
Containers: []corev1.Container{
{
Name: "nginx",
Image: "nginx:1.16",
},
},
},
},
want: corev1.EnvVar{
Name: "TRIVY_SKIP_FILES",
Value: "/src/Gemfile.lock,/examplebinary",
},
},
{
name: "read skip file from config",
configName: "trivy-operator-trivy-config",
skipType: trivy.SkipFilesAnnotation,
envKey: "TRIVY_SKIP_FILES",
configKey: "trivy.skipFiles",
workload: &corev1.Pod{
TypeMeta: metav1.TypeMeta{
Kind: "Pod",
APIVersion: "v1",
},
ObjectMeta: metav1.ObjectMeta{
Name: "nginx",
Namespace: "prod-ns",
},
Spec: corev1.PodSpec{
Containers: []corev1.Container{
{
Name: "nginx",
Image: "nginx:1.16",
},
},
},
},
want: corev1.EnvVar{
Name: "TRIVY_SKIP_FILES",
ValueFrom: &corev1.EnvVarSource{
ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
LocalObjectReference: corev1.LocalObjectReference{
Name: "trivy-operator-trivy-config",
},
Key: "trivy.skipFiles",
Optional: pointer.Bool(true),
},
},
},
},
{
name: "read skip dir from annotation",
configName: "trivy-operator-trivy-config",
skipType: trivy.SkipDirsAnnotation,
envKey: "TRIVY_SKIP_DIRS",
configKey: "trivy.skipDirs",
workload: &corev1.Pod{
TypeMeta: metav1.TypeMeta{
Kind: "Pod",
APIVersion: "v1",
},
ObjectMeta: metav1.ObjectMeta{
Name: "nginx",
Namespace: "prod-ns",
Annotations: map[string]string{
trivy.SkipDirsAnnotation: "/src/",
},
},
Spec: corev1.PodSpec{
Containers: []corev1.Container{
{
Name: "nginx",
Image: "nginx:1.16",
},
},
},
},
want: corev1.EnvVar{
Name: "TRIVY_SKIP_DIRS",
Value: "/src/",
},
},
{
name: "read skip dir from config",
configName: "trivy-operator-trivy-config",
skipType: trivy.SkipDirsAnnotation,
envKey: "TRIVY_SKIP_DIRS",
configKey: "trivy.skipDirs",
workload: &corev1.Pod{
TypeMeta: metav1.TypeMeta{
Kind: "Pod",
APIVersion: "v1",
},
ObjectMeta: metav1.ObjectMeta{
Name: "nginx",
Namespace: "prod-ns",
},
Spec: corev1.PodSpec{
Containers: []corev1.Container{
{
Name: "nginx",
Image: "nginx:1.16",
},
},
},
},
want: corev1.EnvVar{
Name: "TRIVY_SKIP_DIRS",
ValueFrom: &corev1.EnvVarSource{
ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
LocalObjectReference: corev1.LocalObjectReference{
Name: "trivy-operator-trivy-config",
},
Key: "trivy.skipDirs",
Optional: pointer.Bool(true),
},
},
},
},
}
for _, tc := range testCases {
t.Run(tc.name, func(t *testing.T) {
got := trivy.ConfigWorkloadAnnotationEnvVars(tc.workload, tc.skipType, tc.envKey, tc.configName, tc.configKey)
assert.Equal(t, got, tc.want)
})
}
}

0 comments on commit e909545

Please sign in to comment.