feat(trivy): Add dbRepository flag to get advisory database from OCI registry #1064

ksashikumar · 2022-03-23T15:32:55Z

This PR adds --db-repository flag to trivy plugin and helm config. The flag is introduced in aquasecurity/trivy#1873

Related issue in GitLab: #350232

…registry

CLAassistant · 2022-03-23T16:26:04Z

All committers have signed the CLA.

CLAassistant · 2022-03-23T16:26:17Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

ksashikumar · 2022-03-24T17:47:09Z

@knqyf263 Could you please review this dependent PR also? Thanks 🙂

codecov · 2022-03-25T14:52:02Z

Codecov Report

Merging #1064 (942fc57) into main (369589a) will decrease coverage by 0.03%.
The diff coverage is 62.50%.

@@            Coverage Diff             @@
##             main    #1064      +/-   ##
==========================================
- Coverage   58.00%   57.96%   -0.04%     
==========================================
  Files          71       71              
  Lines        9290     9305      +15     
==========================================
+ Hits         5389     5394       +5     
- Misses       3354     3361       +7     
- Partials      547      550       +3

Impacted Files	Coverage Δ
itest/matcher/matcher.go	`75.65% <ø> (ø)`
pkg/plugin/trivy/plugin.go	`81.02% <62.50%> (-0.29%)`	⬇️
pkg/operator/controller/ciskubebenchreport.go	`50.99% <0.00%> (-3.59%)`	⬇️
pkg/vulnerabilityreport/controller.go	`57.31% <0.00%> (+1.52%)`	⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 369589a...942fc57. Read the comment docs.

pkg/plugin/trivy/plugin.go

deploy/helm/values.yaml

ksashikumar · 2022-04-05T06:28:36Z

@chen-keinan Thanks for the comments, I've addressed them 🙂 Could you please take an another look?

chen-keinan · 2022-04-05T06:33:03Z

@chen-keinan Thanks for the comments, I've addressed them 🙂 Could you please take an another look?

Thank you for the update; LGTM!!

knqyf263 · 2022-04-05T13:15:40Z

Note that Trivy added --db-repository in v0.25.1, but it had a critical bug. Please use v0.25.2 or greater.

chen-keinan · 2022-04-05T13:53:03Z

@ksashikumar this PR should also include the trivy version change from : trivy:0.24.2 to trivy:0.25.2 (the version that support --db-repository flag) Its used in various places in the code:
example: values.yaml , starboard.yaml etc. (test files)

ksashikumar · 2022-04-05T17:45:28Z

@ksashikumar this PR should also include the trivy version change from : trivy:0.24.2 to trivy:0.25.2 (the version that support --db-repository flag) Its used in various places in the code: example: values.yaml , starboard.yaml etc. (test files)

@chen-keinan Thanks for that! I've updated the version in the files. Could you please take another look?

chen-keinan · 2022-04-06T05:41:27Z

@ksashikumar thank you for this effort;
It is also required to update trivy version on itest--> matcher.go and matcher_test.go
I think this is the cause for the Integration tests --> Run integration tests / Starboard CLI to fail

ksashikumar · 2022-04-06T06:07:57Z

@ksashikumar thank you for this effort; need also to update trivy version on itest--> matcher.go and matcher_test.go I think this is the cause for the Integration tests --> Run integration tests / Starboard CLI to fail

@chen-keinan Oops, I missed that. Thanks for letting me know. I've fixed that 👍

danielpacak

I've just run the code in my cluster, following the contributing guide, and I'm getting the following errors:

{"level":"error","ts":1649332073.3865209,"logger":"controller.replicaset","msg":"Reconciler error","reconciler group":"apps","reconciler kind":"ReplicaSet","name":"local-path-provisioner-5ddd94ff66","namespace":"local-path-storage","error":"constructing scan job: property trivy.dbRepository not set","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/Users/dpacak/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/Users/dpacak/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:227"}

Please check my comments to see why it may happen. This should also fix integration tests run in the CI workflow.

deploy/static/starboard.yaml

docs/vulnerability-scanning/trivy.md

pkg/plugin/trivy/plugin_test.go

ksashikumar added 2 commits March 23, 2022 21:01

feat(trivy): Add dbRepository flag to get advisory database from OCI …

f2a6160

…registry

Merge branch 'main' into sk/add-db-repository

1ba688e

ksashikumar marked this pull request as ready for review March 24, 2022 17:23

Merge branch 'main' into sk/add-db-repository

d69030e

Merge branch 'main' into sk/add-db-repository

d922ec2

chen-keinan reviewed Mar 28, 2022

View reviewed changes

pkg/plugin/trivy/plugin.go Outdated Show resolved Hide resolved

pkg/plugin/trivy/plugin.go Outdated Show resolved Hide resolved

pkg/plugin/trivy/plugin.go Outdated Show resolved Hide resolved

Review comment: Use err in GetDBRepository

aaf6bb1

ksashikumar requested a review from chen-keinan March 28, 2022 17:17

Merge branch 'main' into sk/add-db-repository

37227ba

chen-keinan added this to the Release v0.16.0 milestone Mar 29, 2022

chen-keinan reviewed Mar 29, 2022

View reviewed changes

deploy/helm/values.yaml Show resolved Hide resolved

chen-keinan added the 🔦 plugin/trivy This issue is related to Trivy vulnerability scanner label Mar 29, 2022

danielpacak self-requested a review March 31, 2022 20:10

ksashikumar added 2 commits April 5, 2022 11:48

Merge branch 'main' into sk/add-db-repository

73a5414

Review comment: Use defaultDBRepository const in test

35fd6da

ksashikumar added 2 commits April 5, 2022 22:57

Update trivy version to 0.25.2

32885d4

Merge branch 'main' into sk/add-db-repository

104447d

Update version in test matcher

5ffe0e1

Merge branch 'main' into sk/add-db-repository

2841fa0

danielpacak suggested changes Apr 7, 2022

View reviewed changes

deploy/static/starboard.yaml Show resolved Hide resolved

docs/vulnerability-scanning/trivy.md Show resolved Hide resolved

pkg/plugin/trivy/plugin_test.go Show resolved Hide resolved

Update docs and add dbRepository to yaml values

942fc57

danielpacak approved these changes Apr 8, 2022

View reviewed changes

danielpacak merged commit 7d53816 into aquasecurity:main Apr 8, 2022

ksashikumar deleted the sk/add-db-repository branch April 8, 2022 15:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(trivy): Add dbRepository flag to get advisory database from OCI registry #1064

feat(trivy): Add dbRepository flag to get advisory database from OCI registry #1064

ksashikumar commented Mar 23, 2022 •

edited

Loading

CLAassistant commented Mar 23, 2022 •

edited

Loading

CLAassistant commented Mar 23, 2022

ksashikumar commented Mar 24, 2022

codecov bot commented Mar 25, 2022 •

edited

Loading

ksashikumar commented Apr 5, 2022

chen-keinan commented Apr 5, 2022

knqyf263 commented Apr 5, 2022 •

edited

Loading

chen-keinan commented Apr 5, 2022 •

edited

Loading

ksashikumar commented Apr 5, 2022

chen-keinan commented Apr 6, 2022 •

edited

Loading

ksashikumar commented Apr 6, 2022

danielpacak left a comment •

edited

Loading

feat(trivy): Add dbRepository flag to get advisory database from OCI registry #1064

feat(trivy): Add dbRepository flag to get advisory database from OCI registry #1064

Conversation

ksashikumar commented Mar 23, 2022 • edited Loading

CLAassistant commented Mar 23, 2022 • edited Loading

CLAassistant commented Mar 23, 2022

ksashikumar commented Mar 24, 2022

codecov bot commented Mar 25, 2022 • edited Loading

Codecov Report

ksashikumar commented Apr 5, 2022

chen-keinan commented Apr 5, 2022

knqyf263 commented Apr 5, 2022 • edited Loading

chen-keinan commented Apr 5, 2022 • edited Loading

ksashikumar commented Apr 5, 2022

chen-keinan commented Apr 6, 2022 • edited Loading

ksashikumar commented Apr 6, 2022

danielpacak left a comment • edited Loading

Choose a reason for hiding this comment

ksashikumar commented Mar 23, 2022 •

edited

Loading

CLAassistant commented Mar 23, 2022 •

edited

Loading

codecov bot commented Mar 25, 2022 •

edited

Loading

knqyf263 commented Apr 5, 2022 •

edited

Loading

chen-keinan commented Apr 5, 2022 •

edited

Loading

chen-keinan commented Apr 6, 2022 •

edited

Loading

danielpacak left a comment •

edited

Loading