Add Registry Mirrors to Trivy #673
Conversation
This patch adds the option to use mirrors for the docker registries in trivy. This way it is possible to download the images from self-hosted mirrors instead of e.g. index.docker.io. This has some benefits, like not being hit by download restrictions.
Codecov Report
@@ Coverage Diff @@
## main #673 +/- ##
==========================================
- Coverage 66.20% 65.73% -0.47%
==========================================
Files 58 58
Lines 5903 6170 +267
==========================================
+ Hits 3908 4056 +148
- Misses 1617 1714 +97
- Partials 378 400 +22
Continue to review full report at Codecov.
|
There was a problem hiding this comment.
👋 Thank you for working on this enhancement @shaardie . I believe it can be useful. Please check my comments and questions before we merge the code.
* Use a single configuration key to describe the registry as well as the mirror. * More meaningful error inspection in tests. * Use github.com/google/go-containerregistry to parse image reference.
There was a problem hiding this comment.
LGTM! Thank you @shaardie for reworking this PR and great contribution 🚀
This patch adds the option to use image digest for the container scanning in Trivy. trivy --skip-update --cache-dir /var/lib/trivyx --format json <container imageID/Digest>
|
Is this a client-side setting or server-side setting? How would I utilize it running outside of k8s? Thanks in advance for examples! |
|
@travisghansen if you'll update it on the |
|
How would I configure it for basic cli usage (in a client server setup). I will add to starboard but I also run trivy in CI where I’d prefer to use local mirrors to keep the traffic down. I just don’t see cli arg that correspond for using it in that fashion so I’m trying to figure out what those helm values are really doing. |
|
@travisghansen you should update the configmap directly via |
|
For me when using via CI, k8s is not involved at all (neither server nor client). I’m trying to figure out what the requirements are to configure it without any k8s-isms. |
This patch adds the option to use mirrors for the docker registries in trivy.
This way it is possible to download the images from self-hosted mirrors instead
of e.g. index.docker.io. This has some benefits, like not being hit by download
restrictions.
I tried to also add this new Feature to the docs and I also wrote unit tests for it.
In the contributing guidelines is mentioned that for every PR there should also be a issue, but when generating a new issue of kind feature request, I am redirected to the discussion. So I skipped creating an issue for this, but I can do it afterwards, if necessary. For now I will point to the already existing discussion #260.