Skip to content

Commit 4694d64

Browse files
ericzzzzzzzericzzzzzzz
authored
chore: enhance vuln monitor (#8570)
1 parent 70ed898 commit 4694d64

File tree

5 files changed

+192
-165
lines changed

5 files changed

+192
-165
lines changed

‎deploy/lts-vuln-monitor/report.sh

-85
This file was deleted.

‎deploy/lts-vuln-monitor/scan.sh

-68
This file was deleted.

‎deploy/lts-vuln-monitor/cloudbuild.yaml renamed to ‎deploy/vuln-monitor/cloudbuild.yaml

+6-12
Original file line numberDiff line numberDiff line change
@@ -7,26 +7,20 @@ steps:
77
name: gcr.io/cloud-builders/gcloud
88
entrypoint: /bin/bash
99
args:
10-
- ./deploy/lts-vuln-monitor/scan.sh
10+
- ./deploy/vuln-monitor/scan.sh
1111
env:
1212
- 'PROJECT_ID=$PROJECT_ID'
13-
- '_IMAGE=$_IMAGE'
13+
- '_BASE_IMAGE=$_BASE_IMAGE'
1414
- '_TAG_FILTER=$_TAG_FILTER'
15-
- '_SEVERITIES=$_SEVERITIES'
15+
- '_TAGS=$_TAGS'
1616
- id: Report vulnerability.
1717
name: 'gcr.io/$PROJECT_ID/github'
1818
entrypoint: /bin/bash
1919
args:
2020
- -c
2121
- |
22-
if test -f /workspace/os_vuln.txt; then ./deploy/lts-vuln-monitor/report.sh; fi
22+
if test -f /workspace/skaffold_vuln.txt; then ./deploy/vuln-monitor/report.sh; fi
2323
env:
24-
- '_OS_VULN_LABEL=$_OS_VULN_LABEL'
2524
- '_REPO=$_REPO'
26-
substitutions:
27-
_IMAGE: skaffold
28-
_TAG_FILTER: v.*lts
29-
_SEVERITIES: HIGH CRITICAL
30-
_OS_VULN_LABEL: lts os vuln
31-
_REPO: GoogleContainerTools/skaffold
32-
_GITHUB_TOKEN: LTS_IMAGE_CD_BOT_GITHUB_TOKEN
25+
- '_LABEL_PREFIX=$_LABEL_PREFIX'
26+
- '_TITLE_PREFIX=$_TITLE_PREFIX'

‎deploy/vuln-monitor/report.sh

+120
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
#!/bin/bash
2+
# Copyright 2021 The Skaffold Authors
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
# This script creates a github issue if it hasn't been created when there
17+
# are vulnerabilities found in the LTS image.
18+
19+
set -xeo pipefail
20+
21+
22+
if [ -z "$_REPO" ]; then
23+
_REPO="https://github.com/GoogleContainerTools/skaffold"
24+
fi
25+
26+
if [ -z "$_LABEL_PREFIX" ]; then
27+
_LABEL_PREFIX="bin-vul"
28+
fi
29+
30+
if [ -z "$_TITLE_PREFIX" ]; then
31+
_TITLE_PREFIX="vulnerabilities found in skaffold binary"
32+
fi
33+
34+
VULN_FILE=/workspace/skaffold_vuln.txt
35+
TOKEN_FILE=token.txt
36+
37+
append() {
38+
echo -e $1 >> $2
39+
}
40+
41+
find_issue() {
42+
label=$1
43+
issue=$(gh issue list --label "$label" --repo="$_REPO" --json number,title)
44+
echo "$issue"
45+
}
46+
47+
create_issue() {
48+
title=$1
49+
label=$2
50+
image_tag=$3
51+
body="Hi @GoogleContainerTools/skaffold-team,
52+
53+
Vulnerabilities were found in the skaffold binary or base image. Please fix the issue
54+
with the instructions mentioned [here](https://docs.google.com/document/d/1gYJVoBCZiRzUTQs_-wKsfhHdskiMtJtWWQyI-t0mhC8/edit?resourcekey=0-NdLapTumfpzxH_bri0fLZQ#heading=h.p4mphzyz8m7y)
55+
56+
Thank you for your attention.
57+
Vulnerabilities details: see [here](https://$image_tag)."
58+
59+
gh label create --repo="$_REPO" "$label" -c "1D76DB" -d "skaffold has vulnerabilities" --force
60+
gh issue create --repo="$_REPO" --title="$title" --label="$label" --body="$body"
61+
}
62+
63+
close_issue_as_fixed() {
64+
issue_num=$1
65+
tag=$2
66+
gh issue close "$issue_num" --repo="$_REPO" -c "Closing as the issue is fixed in $tag"
67+
}
68+
69+
close_issue_tracked_in_another() {
70+
issue_num=$1
71+
new_issue_url=$2
72+
gh issue close "$issue_num" --repo="$_REPO" -c "Closing as the issue is tracked in $new_issue_url"
73+
}
74+
75+
process_report_without_existing_issue() {
76+
title=$1
77+
label=$2
78+
vulnerable=$3
79+
image_tag=$4
80+
if [ "$vulnerable" == "true" ]; then
81+
new_issue_url=$(create_issue "$title" "$label" "$image_tag")
82+
fi
83+
}
84+
85+
process_report_with_existing_issue() {
86+
issue=$1
87+
title=$2
88+
label=$3
89+
vulnerable=$4
90+
image_tag=$5
91+
92+
issue_title=$(echo "$issue" | grep -oP '"title": *\K"[^"]*"' | head -n 1 | tr -d '"')
93+
issue_num=$(echo "$issue" | grep -oP 'number":\s*\K\d+' | head -n 1)
94+
95+
if [ "$vulnerable" == "false" ]; then
96+
close_issue_as_fixed "$issue_num" "$image_tag"
97+
elif [ "$issue_title" != "$title" ]; then
98+
new_issue_url=$(create_issue "$title" "$label" "$image_tag")
99+
close_issue_tracked_in_another "$issue_num" "$new_issue_url"
100+
fi
101+
}
102+
gh auth login --with-token < "$TOKEN_FILE"
103+
# process each line from the file, each line is in the format of title:tag:vulnerable .
104+
while IFS= read -r line; do
105+
echo "Text read from file: $line"
106+
tag=$(echo "$line" | awk -F '[:]' '{print $2}')
107+
image_tag=$(echo "$line" | awk -F '[:]' '{print $1":"$2}')
108+
vulnerable=$(echo "$line" | awk -F '[:]' '{print $3}')
109+
label="$_LABEL_PREFIX-${tag%.*}"
110+
title="$_TITLE_PREFIX:$tag"
111+
# the label is in the format of [bin|os]-vul-x where x is edge or a minor version, such as v1.37, v1.39, v2.0
112+
# we use this label to find if the vuls are already tracked and if the original issues should be close due to
113+
# the vuls have been fixed in the current tag, or tracked in another issue if the vuls still exist.
114+
issue=$(find_issue "$label")
115+
if [ '[]' == "$issue" ]; then
116+
process_report_without_existing_issue "$title" "$label" "$vulnerable" "$image_tag"
117+
else
118+
process_report_with_existing_issue "$issue" "$title" "$label" "$vulnerable" "$image_tag"
119+
fi
120+
done < "$VULN_FILE"

‎deploy/vuln-monitor/scan.sh

+66
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
#!/bin/bash
2+
# Copyright 2021 The Skaffold Authors
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
# This script scans the vulnerability report that is generated by Container Analysis.
17+
18+
set -xeo pipefail
19+
# Variables that will be substituted by trigger configuration or valued provided through command line with --substitutions flag.
20+
if [ -z "$_BASE_IMAGE" ] ; then
21+
_BASE_IMAGE="us-east1-docker.pkg.dev/k8s-skaffold/scanning/skaffold"
22+
fi
23+
# If changed, also change the same variable in report.sh.
24+
VULN_FILE=/workspace/skaffold_vuln.txt
25+
26+
append() {
27+
printf "%s\n" $1 >>$2
28+
}
29+
30+
check_vulnerability(){
31+
base_image=$1
32+
result_file=$2
33+
tags=$3
34+
tags_filter=""
35+
36+
if [ -z "$tags" ]; then
37+
# We should only scan lts images within 1 year window from the first patch of the release.
38+
targeted_base_tags="$(gcloud container images list-tags "$base_image" --filter="timestamp.datetime > -P1Y AND tags~v.*\.1-lts" --format='value(tags)')"
39+
for line in $targeted_base_tags; do
40+
IFS="," read -ra t <<< "${line}"
41+
replacement="\."
42+
t[0]="${t[0]//./$replacement}"
43+
tags_filter+="${t[0]/1-lts/.*-lts}|"
44+
done
45+
tags_filter+="^edge$"
46+
# get the latest patches tags for lts images. gcloud will return extra tags if an image has multiple tags and we only want tags specified in the filter, so use grep to further filter the result.
47+
tags=$(gcloud container images list-tags "$base_image" --filter="tags~$tags_filter" --format='value(tags)' | sort -nr | awk -F'[.]' '$1$2!=p&&p=$1$2' | grep -Po "$tags_filter|edge")
48+
fi
49+
50+
for tagsByComma in $tags; do
51+
IFS="," read -ra tagArr <<< "${tagsByComma}"
52+
image=$base_image:${tagArr[0]}
53+
echo "Checking vulnerabilities of image:" "$image"
54+
gcloud beta container images describe "$image" --show-package-vulnerability \
55+
| if grep -e "effectiveSeverity: HIGH" -e "effectiveSeverity: CRITICAL";
56+
then
57+
append "$base_image:$tagsByComma:true" "$result_file";
58+
else
59+
append "$base_image:$tagsByComma:false" "$result_file"
60+
fi
61+
done
62+
}
63+
64+
# Main
65+
# Scans images
66+
check_vulnerability $_BASE_IMAGE "$VULN_FILE" "$_TAGS"

0 commit comments

Comments
 (0)