Bug 1826354: Container Security Fixes #5326

alecmerdler · 2020-05-07T06:55:59Z

Description

Addresses a few issues in the UI for the Container Security Operator, including clarification of text on the popover card, fixing link creation, and fixing page crashes caused by unsafe k8s property access.

Screenshots

Image Security breakdown card (vulns present):

Image Security breakdown card (no vulns present):

Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1826354
Fixes https://issues.redhat.com/browse/PROJQUAY-676
Addresses https://issues.redhat.com/browse/PROJQUAY-482

openshift-ci-robot · 2020-05-07T13:36:26Z

@alecmerdler: This pull request references Bugzilla bug 1826354, which is invalid:

expected the bug to target the "4.5.0" release, but it targets "---" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Bug 1826354: Container Security Fixes

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

spadgett · 2020-05-07T13:37:31Z

/bugzilla refresh

openshift-ci-robot · 2020-05-07T13:37:37Z

@spadgett: This pull request references Bugzilla bug 1826354, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target release (4.5.0) matches configured target release for branch (4.5.0)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

In response to this:

/bugzilla refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

spadgett · 2020-05-07T13:39:26Z

frontend/packages/container-security/src/components/image-manifest-vuln.tsx

      Header={ImageManifestVulnTableHeader}
      Row={ImageManifestVulnTableRow}
+      EmptyMsg={() => <MsgBox title="No Image Vulnerabilities Found" detail="" />}


This will unmount and remount the empty msg component on each render. It would be better not to inline.

spadgett · 2020-05-07T13:42:33Z

frontend/packages/container-security/src/components/summary.tsx

-                          .color.value
-                      }
+                    <ExclamationTriangleIcon
+                      color={priorityFor(_.get(v.status, 'highestSeverity')).color.value}


We've been trying to remove _.get in favor of optional chaining when already updating the code.

Suggested change

color={priorityFor(_.get(v.status, 'highestSeverity')).color.value}

color={priorityFor(v.status?.highestSeverity).color.value}

Having said that, I'm not sure _.get even helps here since we'll have a runtime error on lin 142 if v.status is undefined.

spadgett · 2020-05-07T13:45:13Z

frontend/packages/container-security/src/components/image-manifest-vuln.tsx

@@ -378,7 +380,7 @@ export const ContainerVulnerabilities: React.FC<ContainerVulnerabilitiesProps> =
                          title={vuln.metadata.uid}
                          displayName={`${totalFor(
                            vulnPriority.findKey(
-                              ({ title }) => vuln.status.highestSeverity === title,
+                              ({ title }) => _.get(vuln.status, 'highestSeverity') === title,


Suggested change

({ title }) => _.get(vuln.status, 'highestSeverity') === title,

({ title }) => vuln.status?.highestSeverity === title,

spadgett · 2020-05-07T13:45:31Z

frontend/packages/container-security/src/components/image-manifest-vuln.tsx

-                            vulnPriority.find(({ title }) => vuln.status.highestSeverity === title)
-                              .color.value
-                          }
+                          color={priorityFor(_.get(vuln.status, 'highestSeverity')).color.value}


Suggested change

color={priorityFor(_.get(vuln.status, 'highestSeverity')).color.value}

color={priorityFor(vuln.status?.highestSeverity).color.value}

spadgett · 2020-05-07T13:45:59Z

frontend/packages/container-security/src/components/image-manifest-vuln.tsx

-          color={vulnPriority.find(({ title }) => obj.status.highestSeverity === title).color.value}
-        />
-        &nbsp;{obj.status.highestSeverity}
+        {_.get(obj.status, 'highestSeverity') ? (


Suggested change

{_.get(obj.status, 'highestSeverity') ? (

{obj.status?.highestSeverity ? (

spadgett · 2020-05-07T13:46:44Z

frontend/packages/container-security/src/components/image-manifest-vuln.tsx

-        &nbsp;{obj.status.highestSeverity}
+        {_.get(obj.status, 'highestSeverity') ? (
+          <>
+            <SecurityIcon color={priorityFor(_.get(obj.status, 'highestSeverity')).color.value} />


This _.get shouldn't be needed since we already check for highSeverity above.

Suggested change

<SecurityIcon color={priorityFor(_.get(obj.status, 'highestSeverity')).color.value} />

<SecurityIcon color={priorityFor(obj.status.highestSeverity).color.value} />

spadgett · 2020-05-07T13:47:07Z

/assign

itsptk · 2020-05-07T13:49:26Z

Does this PR also change the nav item and IMV list to "Image Vulnerabilities?"

cc @beanh66 @alimobrem

itsptk · 2020-05-07T14:06:42Z

The top section is showing a count of containers? And the bottom is images?
Perhaps we can change the status (outside of the popover) to:

Image Vulnerabilities
8 vulnerable containers

And the top section's heading to:
"Vulnerable Containers" (don't really think the "by severity" is needed)

alecmerdler · 2020-05-07T19:29:54Z

@itsptk The top section is unique container images in the cluster, deduplicated by namespace and pod. That way it aligns with the section below, which is unique container images and shows the impacted namespaces as a column.

openshift-ci-robot · 2020-05-07T20:39:17Z

@alecmerdler: This pull request references Bugzilla bug 1826354, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target release (4.5.0) matches configured target release for branch (4.5.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

In response to this:

Bug 1826354: Container Security Fixes

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

alecmerdler · 2020-05-07T20:40:15Z

@spadgett Addressed the issues you pointed out.

spadgett

/approve
/lgtm

openshift-ci-robot · 2020-05-08T15:11:22Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: alecmerdler, spadgett

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~frontend/OWNERS~~ [spadgett]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci-robot · 2020-05-08T16:45:12Z

@alecmerdler: All pull requests linked via external trackers have merged: openshift/console#5326. Bugzilla bug 1826354 has been moved to the MODIFIED state.

In response to this:

Bug 1826354: Container Security Fixes

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot requested review from jcaianirh and spadgett May 7, 2020 06:57

spadgett changed the title ~~Container Security Fixes~~ Bug 1826354: Container Security Fixes May 7, 2020

openshift-ci-robot added the bugzilla/severity-medium Referenced Bugzilla bug's severity is medium for the branch this PR is targeting. label May 7, 2020

openshift-ci-robot added the bugzilla/invalid-bug Indicates that a referenced Bugzilla bug is invalid for the branch this PR is targeting. label May 7, 2020

openshift-ci-robot added the bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. label May 7, 2020

openshift-ci-robot removed the bugzilla/invalid-bug Indicates that a referenced Bugzilla bug is invalid for the branch this PR is targeting. label May 7, 2020

spadgett added this to the v4.5 milestone May 7, 2020

spadgett reviewed May 7, 2020

View reviewed changes

openshift-ci-robot assigned spadgett May 7, 2020

alecmerdler force-pushed the bugzilla-1826354 branch from 900dc9b to 78bc48e Compare May 7, 2020 20:38

fixes to Image Vulnerabilities cluster status

01423b8

alecmerdler force-pushed the bugzilla-1826354 branch from 78bc48e to 01423b8 Compare May 7, 2020 20:38

spadgett approved these changes May 8, 2020

View reviewed changes

openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label May 8, 2020

openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 8, 2020

openshift-merge-robot merged commit 4e57b07 into openshift:master May 8, 2020

alecmerdler deleted the bugzilla-1826354 branch May 8, 2020 16:51

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bug 1826354: Container Security Fixes #5326

Bug 1826354: Container Security Fixes #5326

alecmerdler commented May 7, 2020 •

edited

openshift-ci-robot commented May 7, 2020

spadgett commented May 7, 2020

openshift-ci-robot commented May 7, 2020

spadgett May 7, 2020

alecmerdler May 7, 2020

spadgett May 7, 2020

spadgett May 7, 2020

spadgett May 7, 2020

spadgett May 7, 2020

spadgett May 7, 2020

spadgett commented May 7, 2020

itsptk commented May 7, 2020

itsptk commented May 7, 2020

alecmerdler commented May 7, 2020

openshift-ci-robot commented May 7, 2020

alecmerdler commented May 7, 2020

spadgett left a comment

openshift-ci-robot commented May 8, 2020

openshift-ci-robot commented May 8, 2020

	color={priorityFor(_.get(v.status, 'highestSeverity')).color.value}
	color={priorityFor(v.status?.highestSeverity).color.value}

	({ title }) => _.get(vuln.status, 'highestSeverity') === title,
	({ title }) => vuln.status?.highestSeverity === title,

	color={priorityFor(_.get(vuln.status, 'highestSeverity')).color.value}
	color={priorityFor(vuln.status?.highestSeverity).color.value}

	{_.get(obj.status, 'highestSeverity') ? (
	{obj.status?.highestSeverity ? (

	<SecurityIcon color={priorityFor(_.get(obj.status, 'highestSeverity')).color.value} />
	<SecurityIcon color={priorityFor(obj.status.highestSeverity).color.value} />

Bug 1826354: Container Security Fixes #5326

Bug 1826354: Container Security Fixes #5326

Conversation

alecmerdler commented May 7, 2020 • edited

Description

Screenshots

openshift-ci-robot commented May 7, 2020

spadgett commented May 7, 2020

openshift-ci-robot commented May 7, 2020

spadgett May 7, 2020

Choose a reason for hiding this comment

alecmerdler May 7, 2020

Choose a reason for hiding this comment

spadgett May 7, 2020

Choose a reason for hiding this comment

spadgett May 7, 2020

Choose a reason for hiding this comment

spadgett May 7, 2020

Choose a reason for hiding this comment

spadgett May 7, 2020

Choose a reason for hiding this comment

spadgett May 7, 2020

Choose a reason for hiding this comment

spadgett commented May 7, 2020

itsptk commented May 7, 2020

itsptk commented May 7, 2020

alecmerdler commented May 7, 2020

openshift-ci-robot commented May 7, 2020

alecmerdler commented May 7, 2020

spadgett left a comment

Choose a reason for hiding this comment

openshift-ci-robot commented May 8, 2020

openshift-ci-robot commented May 8, 2020

alecmerdler commented May 7, 2020 •

edited