Skip to content

Commit f3de7bc

Browse files
chen-keinanchen-keinan
authored
feat: scan vulns on k8s core component apps (#5418)
Signed-off-by: chenk <[email protected]>
1 parent e2fb3dd commit f3de7bc

File tree

9 files changed

+453
-59
lines changed

9 files changed

+453
-59
lines changed

‎go.mod

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ require (
2525
github.com/aquasecurity/tml v0.6.1
2626
github.com/aquasecurity/trivy-db v0.0.0-20231005141211-4fc651f7ac8d
2727
github.com/aquasecurity/trivy-java-db v0.0.0-20230209231723-7cddb1406728
28-
github.com/aquasecurity/trivy-kubernetes v0.5.8-0.20230928134646-b414e546fe6d
28+
github.com/aquasecurity/trivy-kubernetes v0.5.9-0.20231019164303-dcdfdc50763f
2929
github.com/aws/aws-sdk-go-v2 v1.21.2
3030
github.com/aws/aws-sdk-go-v2/config v1.18.45
3131
github.com/aws/aws-sdk-go-v2/credentials v1.13.43
@@ -107,7 +107,7 @@ require (
107107
golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2
108108
google.golang.org/protobuf v1.31.0
109109
gopkg.in/yaml.v3 v3.0.1
110-
k8s.io/api v0.28.1
110+
k8s.io/api v0.28.2
111111
k8s.io/utils v0.0.0-20230406110748-d93618cff8a2
112112
modernc.org/sqlite v1.23.1
113113
)
@@ -149,7 +149,7 @@ require (
149149
github.com/apparentlymart/go-cidr v1.1.0 // indirect
150150
github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
151151
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
152-
github.com/aws/aws-sdk-go v1.45.19 // indirect
152+
github.com/aws/aws-sdk-go v1.46.1 // indirect
153153
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.14 // indirect
154154
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.13 // indirect
155155
github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.43 // indirect
@@ -377,14 +377,14 @@ require (
377377
gopkg.in/yaml.v2 v2.4.0 // indirect
378378
helm.sh/helm/v3 v3.12.3 // indirect
379379
k8s.io/apiextensions-apiserver v0.27.3 // indirect
380-
k8s.io/apimachinery v0.28.1 // indirect
380+
k8s.io/apimachinery v0.28.2 // indirect
381381
k8s.io/apiserver v0.27.3 // indirect
382-
k8s.io/cli-runtime v0.28.1 // indirect
383-
k8s.io/client-go v0.28.1 // indirect
384-
k8s.io/component-base v0.28.1 // indirect
382+
k8s.io/cli-runtime v0.28.2 // indirect
383+
k8s.io/client-go v0.28.2 // indirect
384+
k8s.io/component-base v0.28.2 // indirect
385385
k8s.io/klog/v2 v2.100.1 // indirect
386386
k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9 // indirect
387-
k8s.io/kubectl v0.28.1 // indirect
387+
k8s.io/kubectl v0.28.2 // indirect
388388
lukechampine.com/uint128 v1.2.0 // indirect
389389
modernc.org/cc/v3 v3.40.0 // indirect
390390
modernc.org/ccgo/v3 v3.16.13 // indirect

‎go.sum

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -347,8 +347,8 @@ github.com/aquasecurity/trivy-db v0.0.0-20231005141211-4fc651f7ac8d h1:fjI9mkoTU
347347
github.com/aquasecurity/trivy-db v0.0.0-20231005141211-4fc651f7ac8d/go.mod h1:cj9/QmD9N3OZnKQMp+/DvdV+ym3HyIkd4e+F0ZM3ZGs=
348348
github.com/aquasecurity/trivy-java-db v0.0.0-20230209231723-7cddb1406728 h1:0eS+V7SXHgqoT99tV1mtMW6HL4HdoB9qGLMCb1fZp8A=
349349
github.com/aquasecurity/trivy-java-db v0.0.0-20230209231723-7cddb1406728/go.mod h1:Ldya37FLi0e/5Cjq2T5Bty7cFkzUDwTcPeQua+2M8i8=
350-
github.com/aquasecurity/trivy-kubernetes v0.5.8-0.20230928134646-b414e546fe6d h1:5urHj0NMGflp/M9Ll5QlKfo0Kf6nJ01RED1HRgl0CeE=
351-
github.com/aquasecurity/trivy-kubernetes v0.5.8-0.20230928134646-b414e546fe6d/go.mod h1:e1RaMcs2R/C+eP1Pi7JyhDB7Qn1PNRg5rTVwuJL7AiE=
350+
github.com/aquasecurity/trivy-kubernetes v0.5.9-0.20231019164303-dcdfdc50763f h1:HDWxGTNMAeX8LFUDQKME+JwE2sPkFEFLso1OicnoXgw=
351+
github.com/aquasecurity/trivy-kubernetes v0.5.9-0.20231019164303-dcdfdc50763f/go.mod h1:k2Nf7s+Gx88BZE/yjBv7Kqdng/quv/hwaYI2bjSWFqY=
352352
github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0 h1:jfIu9sQUG6Ig+0+Ap1h4unLjW6YQJpKZVmUzxsD4E/Q=
353353
github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0/go.mod h1:t2tdKJDJF9BV14lnkjHmOQgcvEKgtqs5a1N3LNdJhGE=
354354
github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
@@ -363,8 +363,8 @@ github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3d
363363
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
364364
github.com/aws/aws-sdk-go v1.15.11/go.mod h1:mFuSZ37Z9YOHbQEwBWztmVzqXrEkub65tZoCYDt7FT0=
365365
github.com/aws/aws-sdk-go v1.44.122/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
366-
github.com/aws/aws-sdk-go v1.45.19 h1:+4yXWhldhCVXWFOQRF99ZTJ92t4DtoHROZIbN7Ujk/U=
367-
github.com/aws/aws-sdk-go v1.45.19/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
366+
github.com/aws/aws-sdk-go v1.46.1 h1:U26quvBWFZMQuultLw5tloW4GnmWaChEwMZNq8uYatw=
367+
github.com/aws/aws-sdk-go v1.46.1/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
368368
github.com/aws/aws-sdk-go-v2 v1.16.16/go.mod h1:SwiyXi/1zTUZ6KIAmLK5V5ll8SiURNUYOqTerZPaF9k=
369369
github.com/aws/aws-sdk-go-v2 v1.17.1/go.mod h1:JLnGeGONAyi2lWXI1p0PCIOIy333JMVK1U7Hf0aRFLw=
370370
github.com/aws/aws-sdk-go-v2 v1.17.5/go.mod h1:uzbQtefpm44goOPmdKyAlXSNcwlRgF3ePWVW6EtJvvw=
@@ -2524,32 +2524,32 @@ honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9
25242524
k8s.io/api v0.20.1/go.mod h1:KqwcCVogGxQY3nBlRpwt+wpAMF/KjaCc7RpywacvqUo=
25252525
k8s.io/api v0.20.4/go.mod h1:++lNL1AJMkDymriNniQsWRkMDzRaX2Y/POTUi8yvqYQ=
25262526
k8s.io/api v0.20.6/go.mod h1:X9e8Qag6JV/bL5G6bU8sdVRltWKmdHsFUGS3eVndqE8=
2527-
k8s.io/api v0.28.1 h1:i+0O8k2NPBCPYaMB+uCkseEbawEt/eFaiRqUx8aB108=
2528-
k8s.io/api v0.28.1/go.mod h1:uBYwID+66wiL28Kn2tBjBYQdEU0Xk0z5qF8bIBqk/Dg=
2527+
k8s.io/api v0.28.2 h1:9mpl5mOb6vXZvqbQmankOfPIGiudghwCoLl1EYfUZbw=
2528+
k8s.io/api v0.28.2/go.mod h1:RVnJBsjU8tcMq7C3iaRSGMeaKt2TWEUXcpIt/90fjEg=
25292529
k8s.io/apiextensions-apiserver v0.27.3 h1:xAwC1iYabi+TDfpRhxh4Eapl14Hs2OftM2DN5MpgKX4=
25302530
k8s.io/apiextensions-apiserver v0.27.3/go.mod h1:BH3wJ5NsB9XE1w+R6SSVpKmYNyIiyIz9xAmBl8Mb+84=
25312531
k8s.io/apimachinery v0.20.1/go.mod h1:WlLqWAHZGg07AeltaI0MV5uk1Omp8xaN0JGLY6gkRpU=
25322532
k8s.io/apimachinery v0.20.4/go.mod h1:WlLqWAHZGg07AeltaI0MV5uk1Omp8xaN0JGLY6gkRpU=
25332533
k8s.io/apimachinery v0.20.6/go.mod h1:ejZXtW1Ra6V1O5H8xPBGz+T3+4gfkTCeExAHKU57MAc=
2534-
k8s.io/apimachinery v0.28.1 h1:EJD40og3GizBSV3mkIoXQBsws32okPOy+MkRyzh6nPY=
2535-
k8s.io/apimachinery v0.28.1/go.mod h1:X0xh/chESs2hP9koe+SdIAcXWcQ+RM5hy0ZynB+yEvw=
2534+
k8s.io/apimachinery v0.28.2 h1:KCOJLrc6gu+wV1BYgwik4AF4vXOlVJPdiqn0yAWWwXQ=
2535+
k8s.io/apimachinery v0.28.2/go.mod h1:RdzF87y/ngqk9H4z3EL2Rppv5jj95vGS/HaFXrLDApU=
25362536
k8s.io/apiserver v0.20.1/go.mod h1:ro5QHeQkgMS7ZGpvf4tSMx6bBOgPfE+f52KwvXfScaU=
25372537
k8s.io/apiserver v0.20.4/go.mod h1:Mc80thBKOyy7tbvFtB4kJv1kbdD0eIH8k8vianJcbFM=
25382538
k8s.io/apiserver v0.20.6/go.mod h1:QIJXNt6i6JB+0YQRNcS0hdRHJlMhflFmsBDeSgT1r8Q=
25392539
k8s.io/apiserver v0.27.3 h1:AxLvq9JYtveYWK+D/Dz/uoPCfz8JC9asR5z7+I/bbQ4=
25402540
k8s.io/apiserver v0.27.3/go.mod h1:Y61+EaBMVWUBJtxD5//cZ48cHZbQD+yIyV/4iEBhhNA=
2541-
k8s.io/cli-runtime v0.28.1 h1:7Njc4eD5kaO4tYdSYVJJEs54koYD/vT6gxOq8dEVf9g=
2542-
k8s.io/cli-runtime v0.28.1/go.mod h1:yIThSWkAVLqeRs74CMkq6lNFW42GyJmvMtcNn01SZho=
2541+
k8s.io/cli-runtime v0.28.2 h1:64meB2fDj10/ThIMEJLO29a1oujSm0GQmKzh1RtA/uk=
2542+
k8s.io/cli-runtime v0.28.2/go.mod h1:bTpGOvpdsPtDKoyfG4EG041WIyFZLV9qq4rPlkyYfDA=
25432543
k8s.io/client-go v0.20.1/go.mod h1:/zcHdt1TeWSd5HoUe6elJmHSQ6uLLgp4bIJHVEuy+/Y=
25442544
k8s.io/client-go v0.20.4/go.mod h1:LiMv25ND1gLUdBeYxBIwKpkSC5IsozMMmOOeSJboP+k=
25452545
k8s.io/client-go v0.20.6/go.mod h1:nNQMnOvEUEsOzRRFIIkdmYOjAZrC8bgq0ExboWSU1I0=
2546-
k8s.io/client-go v0.28.1 h1:pRhMzB8HyLfVwpngWKE8hDcXRqifh1ga2Z/PU9SXVK8=
2547-
k8s.io/client-go v0.28.1/go.mod h1:pEZA3FqOsVkCc07pFVzK076R+P/eXqsgx5zuuRWukNE=
2546+
k8s.io/client-go v0.28.2 h1:DNoYI1vGq0slMBN/SWKMZMw0Rq+0EQW6/AK4v9+3VeY=
2547+
k8s.io/client-go v0.28.2/go.mod h1:sMkApowspLuc7omj1FOSUxSoqjr+d5Q0Yc0LOFnYFJY=
25482548
k8s.io/component-base v0.20.1/go.mod h1:guxkoJnNoh8LNrbtiQOlyp2Y2XFCZQmrcg2n/DeYNLk=
25492549
k8s.io/component-base v0.20.4/go.mod h1:t4p9EdiagbVCJKrQ1RsA5/V4rFQNDfRlevJajlGwgjI=
25502550
k8s.io/component-base v0.20.6/go.mod h1:6f1MPBAeI+mvuts3sIdtpjljHWBQ2cIy38oBIWMYnrM=
2551-
k8s.io/component-base v0.28.1 h1:LA4AujMlK2mr0tZbQDZkjWbdhTV5bRyEyAFe0TJxlWg=
2552-
k8s.io/component-base v0.28.1/go.mod h1:jI11OyhbX21Qtbav7JkhehyBsIRfnO8oEgoAR12ArIU=
2551+
k8s.io/component-base v0.28.2 h1:Yc1yU+6AQSlpJZyvehm/NkJBII72rzlEsd6MkBQ+G0E=
2552+
k8s.io/component-base v0.28.2/go.mod h1:4IuQPQviQCg3du4si8GpMrhAIegxpsgPngPRR/zWpzc=
25532553
k8s.io/cri-api v0.17.3/go.mod h1:X1sbHmuXhwaHs9xxYffLqJogVsnI+f6cPRcgPel7ywM=
25542554
k8s.io/cri-api v0.20.1/go.mod h1:2JRbKt+BFLTjtrILYVqQK5jqhI+XNdF6UiGMgczeBCI=
25552555
k8s.io/cri-api v0.20.4/go.mod h1:2JRbKt+BFLTjtrILYVqQK5jqhI+XNdF6UiGMgczeBCI=
@@ -2562,8 +2562,8 @@ k8s.io/klog/v2 v2.100.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
25622562
k8s.io/kube-openapi v0.0.0-20201113171705-d219536bb9fd/go.mod h1:WOJ3KddDSol4tAGcJo0Tvi+dK12EcqSLqcWsryKMpfM=
25632563
k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9 h1:LyMgNKD2P8Wn1iAwQU5OhxCKlKJy0sHc+PcDwFB24dQ=
25642564
k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9/go.mod h1:wZK2AVp1uHCp4VamDVgBP2COHZjqD1T68Rf0CM3YjSM=
2565-
k8s.io/kubectl v0.28.1 h1:jAq4yKEqQL+fwkWcEsUWxhJ7uIRcOYQraJxx4SyAMTY=
2566-
k8s.io/kubectl v0.28.1/go.mod h1:a0nk/lMMeKBulp0lMTJAKbkjZg1ykqfLfz/d6dnv1ak=
2565+
k8s.io/kubectl v0.28.2 h1:fOWOtU6S0smdNjG1PB9WFbqEIMlkzU5ahyHkc7ESHgM=
2566+
k8s.io/kubectl v0.28.2/go.mod h1:6EQWTPySF1fn7yKoQZHYf9TPwIl2AygHEcJoxFekr64=
25672567
k8s.io/kubernetes v1.13.0/go.mod h1:ocZa8+6APFNC2tX1DZASIbocyYT5jHzqFVsY5aoB7Jk=
25682568
k8s.io/utils v0.0.0-20201110183641-67b214c5f920/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
25692569
k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 h1:qY1Ad8PODbnymg2pRbkyMT/ylpTrCM8P2RJ0yroCyIk=

‎magefiles/magefile.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@ func (Tool) Mockery() error {
108108
// Wire generates the wire_gen.go file for each package
109109
func Wire() error {
110110
mg.Deps(Tool{}.Wire)
111-
return sh.RunV("wire", "gen", "./pkg/commands/...", "./pkg/rpc/...")
111+
return sh.RunV("wire", "gen", "./pkg/commands/...", "./pkg/rpc/...", "./pkg/k8s/...")
112112
}
113113

114114
// Mock generates mocks

‎pkg/k8s/inject.go

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
//go:build wireinject
2+
// +build wireinject
3+
4+
package k8s
5+
6+
import (
7+
"github.com/google/wire"
8+
9+
"github.com/aquasecurity/trivy/pkg/fanal/cache"
10+
)
11+
12+
func initializeScanK8s(localArtifactCache cache.LocalArtifactCache) *ScanKubernetes {
13+
wire.Build(ScanSuperSet)
14+
return &ScanKubernetes{}
15+
}

‎pkg/k8s/k8s.go

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
package k8s
2+
3+
import (
4+
"context"
5+
6+
"github.com/google/wire"
7+
8+
ftypes "github.com/aquasecurity/trivy/pkg/fanal/types"
9+
"github.com/aquasecurity/trivy/pkg/scanner"
10+
"github.com/aquasecurity/trivy/pkg/scanner/local"
11+
"github.com/aquasecurity/trivy/pkg/types"
12+
)
13+
14+
// ScanSuperSet binds the dependencies for k8s
15+
var ScanSuperSet = wire.NewSet(
16+
local.SuperSet,
17+
wire.Bind(new(scanner.Driver), new(local.Scanner)),
18+
NewScanKubernetes,
19+
)
20+
21+
// ScanKubernetes implements the scanner
22+
type ScanKubernetes struct {
23+
localScanner local.Scanner
24+
}
25+
26+
// NewScanKubernetes is the factory method for scanner
27+
func NewScanKubernetes(s local.Scanner) *ScanKubernetes {
28+
return &ScanKubernetes{localScanner: s}
29+
}
30+
31+
// NewKubenetesScanner is the factory method for scanner
32+
func NewKubenetesScanner() *ScanKubernetes {
33+
return initializeScanK8s(nil)
34+
}
35+
36+
// // Scan scans k8s core components and return it findings
37+
func (sk ScanKubernetes) Scan(ctx context.Context, target types.ScanTarget, options types.ScanOptions) (types.Results, ftypes.OS, error) {
38+
return sk.localScanner.ScanTarget(ctx, target, options)
39+
}

‎pkg/k8s/report/report.go

Lines changed: 20 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -222,9 +222,22 @@ func infraResource(misConfig Resource) bool {
222222
}
223223

224224
func CreateResource(artifact *artifacts.Artifact, report types.Report, err error) Resource {
225-
results := make([]types.Result, 0, len(report.Results))
225+
r := CreateK8sResource(artifact, report.Results)
226+
227+
r.Metadata = report.Metadata
228+
r.Report = report
229+
// if there was any error during the scan
230+
if err != nil {
231+
r.Error = err.Error()
232+
}
233+
234+
return r
235+
}
236+
237+
func CreateK8sResource(artifact *artifacts.Artifact, scanResults types.Results) Resource {
238+
results := make([]types.Result, 0, len(scanResults))
226239
// fix target name
227-
for _, result := range report.Results {
240+
for _, result := range scanResults {
228241
// if resource is a kubernetes file fix the target name,
229242
// to avoid showing the temp file that was removed.
230243
if result.Type == ftypes.Kubernetes {
@@ -237,14 +250,12 @@ func CreateResource(artifact *artifacts.Artifact, report types.Report, err error
237250
Namespace: artifact.Namespace,
238251
Kind: artifact.Kind,
239252
Name: artifact.Name,
240-
Metadata: report.Metadata,
253+
Metadata: types.Metadata{},
241254
Results: results,
242-
Report: report,
243-
}
244-
245-
// if there was any error during the scan
246-
if err != nil {
247-
r.Error = err.Error()
255+
Report: types.Report{
256+
Results: results,
257+
ArtifactName: artifact.Name,
258+
},
248259
}
249260

250261
return r

0 commit comments

Comments
 (0)