-
Notifications
You must be signed in to change notification settings - Fork 469
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: Adds Copacetic plugin to patch vulnerable images (#4566)
* Adds copacetic plugin * copacetic plugin: adds plugin icon and updates url in migration file * Update 211_copacetic_plugin_v1_0_0.up.sql adds copa patch command exit condition * Update 211_copacetic_plugin_v1_0_0.up.sql adds exit 1 if patching multi architecture image * dummy commit 211_copacetic_plugin_v1_0_0.up.sql dummy commit * chore: added sql-validator in git-hub action (#4255) * added sql-validator in git-hub action * removed exit commands * edited the grep with whole word * modified * modified comments --------- Co-authored-by: Badal Kumar Prusty <badalkumar@Badals-MacBook-Pro.local> * updates migration no. --------- Co-authored-by: Badal Kumar <130441461+badal773@users.noreply.github.com> Co-authored-by: Badal Kumar Prusty <badalkumar@Badals-MacBook-Pro.local>
- Loading branch information
1 parent
2ac626e
commit 0f57778
Showing
3 changed files
with
89 additions
and
0 deletions.
There are no files selected for viewing
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,8 @@ | ||
DELETE FROM plugin_step_variable WHERE plugin_step_id=(SELECT ps.id FROM plugin_metadata p INNER JOIN plugin_step ps on ps.plugin_id=p.id WHERE p.name='Copacetic v1.0.0' and ps."index"=1 and ps.deleted=false); | ||
DELETE FROM plugin_step WHERE plugin_id=(SELECT id FROM plugin_metadata WHERE name='Copacetic v1.0.0'); | ||
DELETE FROM plugin_stage_mapping WHERE plugin_id=(SELECT id FROM plugin_metadata WHERE name='Copacetic v1.0.0'); | ||
DELETE FROM pipeline_stage_step_variable WHERE pipeline_stage_step_id in (SELECT pipeline_stage_id FROM pipeline_stage_step WHERE name='Copacetic v1.0.0'); | ||
DELETE FROM pipeline_stage_step_variable WHERE pipeline_stage_step_id in (SELECT id FROM pipeline_stage_step WHERE name='Copacetic v1.0.0'); | ||
DELETE FROM pipeline_stage_step WHERE name ='Copacetic v1.0.0'; | ||
DELETE FROM plugin_tag_relation WHERE plugin_id=(SELECT id FROM plugin_metadata WHERE name='Copacetic v1.0.0'); | ||
DELETE FROM plugin_metadata WHERE name='Copacetic v1.0.0'; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,81 @@ | ||
INSERT INTO plugin_metadata (id,name,description,type,icon,deleted,created_on,created_by,updated_on,updated_by) | ||
VALUES (nextval('id_seq_plugin_metadata'),'Copacetic v1.0.0','This plugin is used to patch the container image vulnerabilities (Patching for Multi Architecture Builds not supported currently).','PRESET','https://raw.githubusercontent.com/devtron-labs/devtron/main/assets/copa-plugin-icon.png',false,'now()',1,'now()',1); | ||
|
||
INSERT INTO "plugin_tag_relation" ("id", "tag_id", "plugin_id", "created_on", "created_by", "updated_on", "updated_by") VALUES (nextval('id_seq_plugin_tag_relation'), (SELECT id FROM plugin_tag WHERE name='Security'), (SELECT id FROM plugin_metadata WHERE name='Copacetic v1.0.0'),'now()', 1, 'now()', 1); | ||
INSERT INTO "plugin_tag_relation" ("id", "tag_id", "plugin_id", "created_on", "created_by", "updated_on", "updated_by") VALUES (nextval('id_seq_plugin_tag_relation'), (SELECT id FROM plugin_tag WHERE name='DevSecOps'), (SELECT id FROM plugin_metadata WHERE name='Copacetic v1.0.0'),'now()', 1, 'now()', 1); | ||
|
||
INSERT INTO plugin_stage_mapping (id,plugin_id,stage_type,created_on,created_by,updated_on,updated_by) | ||
VALUES (nextval('id_seq_plugin_stage_mapping'),(SELECT id from plugin_metadata where name='Copacetic v1.0.0'), 0,'now()',1,'now()',1); | ||
|
||
INSERT INTO "plugin_pipeline_script" ("id", "script","type","deleted","created_on", "created_by", "updated_on", "updated_by") | ||
VALUES ( | ||
nextval('id_seq_plugin_pipeline_script'), | ||
$$#!/bin/sh | ||
|
||
export appName=$(echo $CI_CD_EVENT | jq --raw-output .commonWorkflowRequest.appName) | ||
export registry=$(echo $CI_CD_EVENT | jq --raw-output .commonWorkflowRequest.dockerRegistryURL) | ||
export repo=$(echo $CI_CD_EVENT | jq --raw-output .commonWorkflowRequest.dockerRepository) | ||
export tag=$(echo $CI_CD_EVENT | jq --raw-output .commonWorkflowRequest.dockerImageTag) | ||
export platform=$(echo $CI_CD_EVENT | jq --raw-output .commonWorkflowRequest.ciBuildConfig.dockerBuildConfig.targetPlatform) | ||
|
||
if [[ $platform == "linux/arm64,linux/amd64" ]] ; then | ||
echo "platform = $platform" | ||
echo "------------------------------------------------------------------------------------------------------------------------" | ||
echo "######### Patching Multi Architecture Image not supported #########" | ||
echo "------------------------------------------------------------------------------------------------------------------------" | ||
echo "error: can't use copacetic plugin for muti-architecture builds" | ||
exit 1; | ||
else | ||
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.46.1 | ||
|
||
uname_arch() { | ||
arch=$(uname -m) | ||
case $arch in | ||
x86_64) arch="amd64" ;; | ||
aarch64) arch="arm64" ;; | ||
esac | ||
echo ${arch} | ||
} | ||
os=$(uname | tr "[:upper:]" "[:lower:]") | ||
uname_arch | ||
wget https://github.com/project-copacetic/copacetic/releases/download/v0.5.1/copa_0.5.1_${os}_${arch}.tar.gz | ||
tar -xvzf copa_0.5.1_${os}_${arch}.tar.gz | ||
mv copa /usr/local/bin/ | ||
|
||
trivy image --vuln-type os --ignore-unfixed $registry/$repo:$tag | grep -i total | ||
trivy image --vuln-type os --ignore-unfixed -f json -o $appName.json $registry/$repo:$tag | ||
|
||
export BUILDKIT_VERSION=v0.12.0 | ||
docker run \ | ||
--detach \ | ||
--rm \ | ||
--privileged \ | ||
--name buildkitd \ | ||
--entrypoint buildkitd \ | ||
"moby/buildkit:$BUILDKIT_VERSION" | ||
|
||
copa patch -i $registry/$repo:$tag -r $appName.json -t $tag --addr docker-container://buildkitd --timeout "$CopaTimeout" | ||
if [ $? -eq 0 ] ; then | ||
trivy image --vuln-type os --ignore-unfixed $registry/$repo:$tag | grep -i total | ||
docker push $registry/$repo:$tag | ||
else | ||
echo "------------------------------------------------------------------------------------------------------------------------" | ||
echo "BUILD FAILED: non zero exit status during copa patch..." | ||
echo "------------------------------------------------------------------------------------------------------------------------" | ||
exit 1; | ||
fi | ||
fi | ||
$$, | ||
'SHELL', | ||
'f', | ||
'now()', | ||
1, | ||
'now()', | ||
1 | ||
); | ||
|
||
INSERT INTO "plugin_step" ("id", "plugin_id","name","description","index","step_type","script_id","deleted", "created_on", "created_by", "updated_on", "updated_by") | ||
VALUES (nextval('id_seq_plugin_step'), (SELECT id FROM plugin_metadata WHERE name='Copacetic v1.0.0'),'Step 1','Step 1 - Copacetic v1.0.0','1','INLINE',(SELECT last_value FROM id_seq_plugin_pipeline_script),'f','now()', 1, 'now()', 1); | ||
|
||
INSERT INTO plugin_step_variable (id,plugin_step_id,name,format,description,is_exposed,allow_empty_value,default_value,value,variable_type,value_type,previous_step_index,variable_step_index,variable_step_index_in_plugin,reference_variable_name,deleted,created_on,created_by,updated_on,updated_by) | ||
VALUES (nextval('id_seq_plugin_step_variable'),(SELECT ps.id FROM plugin_metadata p inner JOIN plugin_step ps on ps.plugin_id=p.id WHERE p.name='Copacetic v1.0.0' and ps."index"=1 and ps.deleted=false),'CopaTimeout','STRING','Timeout for copa patch command, default timeout is 5 minutes. For ex: 10m','t','t','5m',null,'INPUT','NEW',null,1,null,null,'f','now()',1,'now()',1); |