fix: cannot create vulnerability report because name is too long (#773)

Resolves: #288

Signed-off-by: Daniel Pacak <[email protected]>

.github/workflows/build.yaml

@@ -30,7 +30,7 @@ env:
 jobs:
   unit-tests:
     name: Run unit tests
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-20.04
     steps:
       - name: Setup Go
         uses: actions/setup-go@v2
@@ -55,7 +55,7 @@ jobs:
     needs:
       - unit-tests
       - verify-code
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-20.04
     steps:
       - name: Setup Go
         uses: actions/setup-go@v2
@@ -72,14 +72,15 @@ jobs:
       - name: Release snapshot
         uses: goreleaser/goreleaser-action@v2
         with:
-          version: v0.175.0
+          version: v0.183.0
           args: release --snapshot --skip-publish --rm-dist
   itest-starboard:
     name: Run integration tests / Starboard CLI
     needs:
       - unit-tests
       - verify-code
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-20.04
+    timeout-minutes: 15
     steps:
       - name: Setup Go
         uses: actions/setup-go@v2
@@ -118,7 +119,8 @@ jobs:
     needs:
       - unit-tests
       - verify-code
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-20.04
+    timeout-minutes: 15
     steps:
       - name: Setup Go
         uses: actions/setup-go@v2
@@ -156,7 +158,6 @@ jobs:
         env:
           KUBECONFIG: /home/runner/.kube/config
           OPERATOR_NAMESPACE: starboard-operator
-          OPERATOR_SERVICE_ACCOUNT: starboard-operator
           OPERATOR_TARGET_NAMESPACES: default
       - name: Upload code coverage
         uses: codecov/codecov-action@v2
@@ -167,7 +168,8 @@ jobs:
     needs:
       - unit-tests
       - verify-code
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-20.04
+    timeout-minutes: 15
     steps:
       - name: Setup Go
         uses: actions/setup-go@v2
@@ -205,15 +207,14 @@ jobs:
         env:
           KUBECONFIG: /home/runner/.kube/config
           OPERATOR_NAMESPACE: starboard-operator
-          OPERATOR_SERVICE_ACCOUNT: starboard-operator
           OPERATOR_TARGET_NAMESPACES: default
       - name: Upload code coverage
         uses: codecov/codecov-action@v2
         with:
           files: ./itest/starboard-operator/configauditreport/conftest/coverage.txt
   verify-code:
     name: Verify code
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-20.04
     steps:
       - name: Setup Go
         uses: actions/setup-go@v2

.github/workflows/release.yaml

@@ -10,7 +10,7 @@ env:
 jobs:
   unit-tests:
     name: Run unit tests
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-20.04
     steps:
       - name: Setup Go
         uses: actions/setup-go@v2
@@ -32,7 +32,8 @@ jobs:
     name: Run integration tests / Starboard CLI
     needs:
       - unit-tests
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-20.04
+    timeout-minutes: 15
     steps:
       - name: Setup Go
         uses: actions/setup-go@v2
@@ -66,7 +67,8 @@ jobs:
     name: Run integration tests / Starboard Operator
     needs:
       - unit-tests
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-20.04
+    timeout-minutes: 15
     steps:
       - name: Setup Go
         uses: actions/setup-go@v2
@@ -110,7 +112,8 @@ jobs:
     name: Integration / Operator / Conftest
     needs:
       - unit-tests
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-20.04
+    timeout-minutes: 15
     steps:
       - name: Setup Go
         uses: actions/setup-go@v2
@@ -156,7 +159,7 @@ jobs:
       - itest-starboard
       - itest-starboard-operator
       - integration-operator-conftest
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-20.04
     steps:
       - name: Setup Go
         uses: actions/setup-go@v2
@@ -186,7 +189,7 @@ jobs:
       - name: Release
         uses: goreleaser/goreleaser-action@v2
         with:
-          version: v0.175.0
+          version: v0.183.0
           args: release --rm-dist
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

itest/helper/helper.go

@@ -224,9 +224,9 @@ type Helper struct {
 	kubeBenchReportReader kubebench.Reader
 }
 
-func NewHelper(scheme *runtime.Scheme, client client.Client) *Helper {
+func NewHelper(client client.Client) *Helper {
 	return &Helper{
-		scheme:                scheme,
+		scheme:                client.Scheme(),
 		kubeClient:            client,
 		kubeBenchReportReader: kubebench.NewReadWriter(client),
 	}
@@ -361,3 +361,14 @@ func (h *Helper) UpdateDeploymentImage(namespace, name string) error {
 		return err == nil, err
 	})
 }
+
+func (h *Helper) DeploymentIsReady(deploy client.ObjectKey) func() (bool, error) {
+	return func() (bool, error) {
+		var d appsv1.Deployment
+		err := h.kubeClient.Get(context.TODO(), client.ObjectKey{Namespace: deploy.Namespace, Name: deploy.Name}, &d)
+		if err != nil {
+			return false, err
+		}
+		return d.Status.ReadyReplicas == *d.Spec.Replicas, nil
+	}
+}

itest/matcher/matcher.go

@@ -7,9 +7,11 @@ import (
 	"fmt"
 
 	"github.com/aquasecurity/starboard/pkg/apis/aquasecurity/v1alpha1"
+	"github.com/aquasecurity/starboard/pkg/kube"
 	"github.com/aquasecurity/starboard/pkg/starboard"
 	"github.com/onsi/gomega/types"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/utils/pointer"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/apiutil"
@@ -40,12 +42,14 @@ var (
 // of the actual v1alpha1.VulnerabilityReport.
 func IsVulnerabilityReportForContainerOwnedBy(containerName string, owner client.Object) types.GomegaMatcher {
 	return &vulnerabilityReportMatcher{
+		scheme:        starboard.NewScheme(),
 		containerName: containerName,
 		owner:         owner,
 	}
 }
 
 type vulnerabilityReportMatcher struct {
+	scheme                *runtime.Scheme
 	owner                 client.Object
 	containerName         string
 	failureMessage        string
@@ -57,19 +61,20 @@ func (m *vulnerabilityReportMatcher) Match(actual interface{}) (bool, error) {
 	if !ok {
 		return false, fmt.Errorf("%T expects a %T", vulnerabilityReportMatcher{}, v1alpha1.VulnerabilityReport{})
 	}
-	gvk, err := apiutil.GVKForObject(m.owner, starboard.NewScheme())
+	gvk, err := apiutil.GVKForObject(m.owner, m.scheme)
+	if err != nil {
+		return false, err
+	}
+
+	keys, err := m.objectToLabelsAsMatchKeys(m.owner)
 	if err != nil {
 		return false, err
 	}
+	keys[starboard.LabelContainerName] = Equal(m.containerName)
 
 	matcher := MatchFields(IgnoreExtras, Fields{
 		"ObjectMeta": MatchFields(IgnoreExtras, Fields{
-			"Labels": MatchKeys(IgnoreExtras, Keys{
-				starboard.LabelContainerName:     Equal(m.containerName),
-				starboard.LabelResourceKind:      Equal(gvk.Kind),
-				starboard.LabelResourceName:      Equal(m.owner.GetName()),
-				starboard.LabelResourceNamespace: Equal(m.owner.GetNamespace()),
-			}),
+			"Labels": MatchKeys(IgnoreExtras, keys),
 			"OwnerReferences": ConsistOf(metav1.OwnerReference{
 				APIVersion:         gvk.GroupVersion().Identifier(),
 				Kind:               gvk.Kind,
@@ -94,6 +99,29 @@ func (m *vulnerabilityReportMatcher) Match(actual interface{}) (bool, error) {
 	return success, nil
 }
 
+func (m *vulnerabilityReportMatcher) objectToLabelsAsMatchKeys(obj client.Object) (map[interface{}]types.GomegaMatcher, error) {
+	kind := obj.GetObjectKind().GroupVersionKind().Kind
+	if kind == "" {
+		gvk, err := apiutil.GVKForObject(m.owner, m.scheme)
+		if err != nil {
+			return nil, err
+		}
+		kind = gvk.Kind
+	}
+
+	labels := kube.PartialObjectToLabels(kube.Object{
+		Kind:      kube.Kind(kind),
+		Name:      obj.GetName(),
+		Namespace: obj.GetNamespace(),
+	})
+
+	keys := make(map[interface{}]types.GomegaMatcher)
+	for k, v := range labels {
+		keys[k] = Equal(v)
+	}
+	return keys, nil
+}
+
 func (m *vulnerabilityReportMatcher) FailureMessage(_ interface{}) string {
 	// TODO Add more descriptive message rather than rely on composed matchers' defaults
 	return m.failureMessage

itest/starboard-operator/configauditreport/conftest/suite_test.go

@@ -85,7 +85,7 @@ var _ = BeforeSuite(func() {
 		ConfigAuditReportsPlugin: conftest.Plugin,
 
 		Client: kubeClient,
-		Helper: helper.NewHelper(scheme, kubeClient),
+		Helper: helper.NewHelper(kubeClient),
 	}
 
 	// We can disable vulnerability scanner and CIS benchmarks

itest/starboard-operator/suite_test.go

@@ -68,7 +68,7 @@ var _ = BeforeSuite(func() {
 		PrimaryWorkloadPrefix: "wordpress",
 
 		Client: kubeClient,
-		Helper: helper.NewHelper(scheme, kubeClient),
+		Helper: helper.NewHelper(kubeClient),
 	}
 
 	startCtx, stopFunc = context.WithCancel(context.Background())