Skip to content

Commit 7cfdcfc

Browse files
lentzi90lentzi90
committed
Add weekly security scan using govulncheck and trivy
This is all based on how CAPI does the same. Signed-off-by: Lennart Jern <lennart.jern@est.tech>
1 parent a86c4d6 commit 7cfdcfc

File tree

4 files changed

+186
-3
lines changed

4 files changed

+186
-3
lines changed

‎.github/workflows/security-scan.yaml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: Weekly security scan
2+
3+
on:
4+
schedule:
5+
# Cron for every Monday at 9:12 UTC.
6+
- cron: "12 9 * * 1"
7+
8+
# Remove all permissions from GITHUB_TOKEN except metadata.
9+
permissions: {}
10+
11+
jobs:
12+
scan:
13+
strategy:
14+
fail-fast: false
15+
matrix:
16+
branch: [main, release-0.12, release-0.11, release-0.10]
17+
name: Trivy
18+
runs-on: ubuntu-latest
19+
steps:
20+
- name: Check out code
21+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # tag=v4.2.2
22+
with:
23+
ref: ${{ matrix.branch }}
24+
- name: Calculate go version
25+
id: vars
26+
run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
27+
- name: Set up Go
28+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # tag=v5.4.0
29+
with:
30+
go-version: ${{ steps.vars.outputs.go_version }}
31+
- name: Run verify security target
32+
run: make verify-security

‎Makefile

Lines changed: 45 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,16 +23,19 @@ include $(ROOT_DIR_RELATIVE)/common.mk
2323
export GO111MODULE=on
2424
unexport GOPATH
2525

26+
# Enables shell script tracing. Enable by running: TRACE=1 make <target>
27+
TRACE ?= 0
28+
2629
# Go
2730
GO_VERSION ?= 1.23.4
2831

2932
# Directories.
3033
ARTIFACTS ?= $(REPO_ROOT)/_artifacts
3134
TOOLS_DIR := hack/tools
35+
BIN_DIR := bin
3236
TOOLS_DIR_DEPS := $(TOOLS_DIR)/go.sum $(TOOLS_DIR)/go.mod $(TOOLS_DIR)/Makefile
33-
TOOLS_BIN_DIR := $(TOOLS_DIR)/bin
37+
TOOLS_BIN_DIR := $(TOOLS_DIR)/$(BIN_DIR)
3438

35-
BIN_DIR := bin
3639
REPO_ROOT := $(shell git rev-parse --show-toplevel)
3740
GH_REPO ?= kubernetes-sigs/cluster-api-provider-openstack
3841
TEST_E2E_DIR := test/e2e
@@ -49,6 +52,13 @@ GO_APIDIFF_VER := v0.8.2
4952
GO_APIDIFF_BIN := go-apidiff
5053
GO_APIDIFF_PKG := github.com/joelanford/go-apidiff
5154

55+
# govulncheck
56+
GOVULNCHECK_VER := v1.1.4
57+
GOVULNCHECK_BIN := govulncheck
58+
GOVULNCHECK_PKG := golang.org/x/vuln/cmd/govulncheck
59+
60+
TRIVY_VER := 0.49.1
61+
5262
# Binaries.
5363
CONTROLLER_GEN := $(TOOLS_BIN_DIR)/controller-gen
5464
ENVSUBST := $(TOOLS_BIN_DIR)/envsubst
@@ -62,6 +72,7 @@ RELEASE_NOTES := $(TOOLS_BIN_DIR)/release-notes
6272
SETUP_ENVTEST := $(TOOLS_BIN_DIR)/setup-envtest
6373
GEN_CRD_API_REFERENCE_DOCS := $(TOOLS_BIN_DIR)/gen-crd-api-reference-docs
6474
GO_APIDIFF := $(TOOLS_BIN_DIR)/$(GO_APIDIFF_BIN)-$(GO_APIDIFF_VER)
75+
GOVULNCHECK := $(TOOLS_BIN_DIR)/$(GOVULNCHECK_BIN)-$(GOVULNCHECK_VER)
6576

6677
# Kubebuilder
6778
export KUBEBUILDER_ENVTEST_KUBERNETES_VERSION ?= 1.28.0
@@ -253,6 +264,12 @@ $(GO_APIDIFF_BIN): $(GO_APIDIFF)
253264
$(GO_APIDIFF): # Build go-apidiff.
254265
GOBIN=$(abspath $(TOOLS_BIN_DIR)) $(GO_INSTALL) $(GO_APIDIFF_PKG) $(GO_APIDIFF_BIN) $(GO_APIDIFF_VER)
255266

267+
.PHONY: $(GOVULNCHECK_BIN)
268+
$(GOVULNCHECK_BIN): $(GOVULNCHECK) ## Build a local copy of govulncheck.
269+
270+
$(GOVULNCHECK): # Build govulncheck.
271+
GOBIN=$(abspath $(TOOLS_BIN_DIR)) $(GO_INSTALL) $(GOVULNCHECK_PKG) $(GOVULNCHECK_BIN) $(GOVULNCHECK_VER)
272+
256273
## --------------------------------------
257274
##@ Linting
258275
## --------------------------------------
@@ -549,8 +566,12 @@ clean-temporary: ## Remove all temporary files and folders
549566
clean-release: ## Remove the release folder
550567
rm -rf $(RELEASE_DIR)
551568

569+
.PHONY: clean-release-git
570+
clean-release-git: ## Restores the git files usually modified during a release
571+
git restore ./*manager_image_patch.yaml ./*manager_pull_policy.yaml
572+
552573
.PHONY: verify
553-
verify: verify-boilerplate verify-modules verify-gen
574+
verify: verify-boilerplate verify-modules verify-gen verify-govulncheck
554575

555576
.PHONY: verify-boilerplate
556577
verify-boilerplate:
@@ -570,6 +591,27 @@ verify-gen: generate
570591
echo "generated files are out of date, run make generate"; exit 1; \
571592
fi
572593

594+
.PHONY: verify-container-images
595+
verify-container-images: ## Verify container images
596+
TRACE=$(TRACE) ./hack/verify-container-images.sh $(TRIVY_VER)
597+
598+
.PHONY: verify-govulncheck
599+
verify-govulncheck: $(GOVULNCHECK) ## Verify code for vulnerabilities
600+
$(GOVULNCHECK) ./... && R1=$$? || R1=$$?; \
601+
$(GOVULNCHECK) -C "$(TOOLS_DIR)" ./... && R2=$$? || R2=$$?; \
602+
if [ "$$R1" -ne "0" ] || [ "$$R2" -ne "0" ]; then \
603+
exit 1; \
604+
fi
605+
606+
.PHONY: verify-security
607+
verify-security: ## Verify code and images for vulnerabilities
608+
$(MAKE) verify-container-images && R1=$$? || R1=$$?; \
609+
$(MAKE) verify-govulncheck && R2=$$? || R2=$$?; \
610+
if [ "$$R1" -ne "0" ] || [ "$$R2" -ne "0" ]; then \
611+
echo "Check for vulnerabilities failed! There are vulnerabilities to be fixed"; \
612+
exit 1; \
613+
fi
614+
573615
.PHONY: compile-e2e
574616
compile-e2e: ## Test e2e compilation
575617
go test -c -o /dev/null -tags=e2e ./test/e2e/suites/conformance

‎hack/ensure-trivy.sh

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
#!/bin/bash
2+
3+
# Copyright 2023 The Kubernetes Authors.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
set -o errexit
18+
set -o nounset
19+
set -o pipefail
20+
21+
if [[ "${TRACE-0}" == "1" ]]; then
22+
set -o xtrace
23+
fi
24+
25+
VERSION=${1}
26+
27+
GO_OS="$(go env GOOS)"
28+
if [[ "${GO_OS}" == "linux" ]]; then
29+
TRIVY_OS="Linux"
30+
elif [[ "${GO_OS}" == "darwin"* ]]; then
31+
TRIVY_OS="macOS"
32+
fi
33+
34+
GO_ARCH="$(go env GOARCH)"
35+
if [[ "${GO_ARCH}" == "amd" ]]; then
36+
TRIVY_ARCH="32bit"
37+
elif [[ "${GO_ARCH}" == "amd64"* ]]; then
38+
TRIVY_ARCH="64bit"
39+
elif [[ "${GO_ARCH}" == "arm" ]]; then
40+
TRIVY_ARCH="ARM"
41+
elif [[ "${GO_ARCH}" == "arm64" ]]; then
42+
TRIVY_ARCH="ARM64"
43+
fi
44+
45+
TOOL_BIN=hack/tools/bin
46+
mkdir -p ${TOOL_BIN}
47+
48+
TRIVY="${TOOL_BIN}/trivy/${VERSION}/trivy"
49+
50+
# Downloads trivy scanner
51+
if [ ! -f "$TRIVY" ]; then
52+
curl -L -o ${TOOL_BIN}/trivy.tar.gz "https://github.com/aquasecurity/trivy/releases/download/v${VERSION}/trivy_${VERSION}_${TRIVY_OS}-${TRIVY_ARCH}.tar.gz"
53+
mkdir -p "$(dirname "$0")/tools/bin/trivy/${VERSION}"
54+
tar -xf "${TOOL_BIN}/trivy.tar.gz" -C "${TOOL_BIN}/trivy/${VERSION}" trivy
55+
chmod +x "${TOOL_BIN}/trivy/${VERSION}/trivy"
56+
rm "${TOOL_BIN}/trivy.tar.gz"
57+
fi

‎hack/verify-container-images.sh

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
#!/bin/bash
2+
3+
# Copyright 2022 The Kubernetes Authors.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
set -o errexit
18+
set -o nounset
19+
set -o pipefail
20+
21+
if [[ "${TRACE-0}" == "1" ]]; then
22+
set -o xtrace
23+
fi
24+
25+
VERSION=${1}
26+
GO_ARCH="$(go env GOARCH)"
27+
DB_MIRROR="public.ecr.aws/aquasecurity/trivy-db"
28+
29+
REPO_ROOT=$(git rev-parse --show-toplevel)
30+
"${REPO_ROOT}/hack/ensure-trivy.sh" "${VERSION}"
31+
32+
TRIVY="${REPO_ROOT}/hack/tools/bin/trivy/${VERSION}/trivy"
33+
34+
# Builds all the container images to be scanned and cleans up changes to ./*manager_image_patch.yaml ./*manager_pull_policy.yaml.
35+
make REGISTRY=gcr.io/k8s-staging-capi-openstack PULL_POLICY=IfNotPresent TAG=dev docker-build
36+
make clean-release-git
37+
38+
# Scan the images
39+
"${TRIVY}" image --db-repository="${DB_MIRROR}" -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-capi-openstack/capi-openstack-controller-"${GO_ARCH}":dev && R1=$? || R1=$?
40+
41+
echo ""
42+
BRed='\033[1;31m'
43+
BGreen='\033[1;32m'
44+
NC='\033[0m' # No
45+
46+
if [ "$R1" -ne "0" ]
47+
then
48+
echo -e "${BRed}Check container images failed! There are vulnerabilities to be fixed${NC}"
49+
exit 1
50+
fi
51+
52+
echo -e "${BGreen}Check container images passed! No vulnerability found${NC}"

0 commit comments

Comments
 (0)