chore: bump up trivy to v0.57.1 #2301

afdesk · 2024-10-29T11:44:28Z

Description

This PR updates dependencies related on Trivy 0.57.0 and fixes some vulnerabilities inside these ones.

Notes:

Support NVD CVSS V4.0 Schema was added in Trivy DB: feat(vulnsrc/nvd): add CVSS v4.0 trivy-db#414.
controller-runtime v0.19.0 contains a breaking change - a check for duplicate controller names (⚠️ Validate controller names are unique kubernetes-sigs/controller-runtime#2902). It's disabled for this PR and should be disabled for tests.
More details: incorrect check for duplicate controller names kubernetes-sigs/controller-runtime#2937
Now using build-in Rego policies is disabled by default, useEmbeddedRegoPolicies is enabled. It allows to decrease downloads from ghcr.io (the single source for trivy-checks)
Trivy-operator uses mirror.gcr.io registry instead of ghcr.io by default for some available OCI artifacts (trivy-db, trivy-java-db).

Before:

trivy rootfs .
2024-10-29T17:43:58+06:00	INFO	[vuln] Vulnerability scanning is enabled
2024-10-29T17:43:58+06:00	INFO	[secret] Secret scanning is enabled
2024-10-29T17:43:58+06:00	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-29T17:43:58+06:00	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-29T17:43:58+06:00	INFO	Number of language-specific files	num=1
2024-10-29T17:43:58+06:00	INFO	[gobinary] Detecting vulnerabilities...

to (gobinary)

Total: 3 (UNKNOWN: 0, LOW: 1, MEDIUM: 1, HIGH: 0, CRITICAL: 1)

┌──────────────────────────────────┬─────────────────────┬──────────┬────────┬──────────────────────┬─────────────────────────────────┬───────────────────────────────────────────────────────────┐
│             Library              │    Vulnerability    │ Severity │ Status │  Installed Version   │          Fixed Version          │                           Title                           │
├──────────────────────────────────┼─────────────────────┼──────────┼────────┼──────────────────────┼─────────────────────────────────┼───────────────────────────────────────────────────────────┤
│ github.com/docker/docker         │ CVE-2024-41110      │ CRITICAL │ fixed  │ v26.1.3+incompatible │ 23.0.15, 26.1.5, 27.1.1, 25.0.6 │ moby: Authz zero length regression                        │
│                                  │                     │          │        │                      │                                 │ https://avd.aquasec.com/nvd/cve-2024-41110                │
├──────────────────────────────────┼─────────────────────┼──────────┤        ├──────────────────────┼─────────────────────────────────┼───────────────────────────────────────────────────────────┤
│ github.com/open-policy-agent/opa │ CVE-2024-8260       │ MEDIUM   │        │ v0.65.0              │ 0.68.0                          │ opa: OPA SMB Force-Authentication                         │
│                                  │                     │          │        │                      │                                 │ https://avd.aquasec.com/nvd/cve-2024-8260                 │
├──────────────────────────────────┼─────────────────────┼──────────┤        ├──────────────────────┼─────────────────────────────────┼───────────────────────────────────────────────────────────┤
│ google.golang.org/grpc           │ GHSA-xr7q-jx4m-x55m │ LOW      │        │ v1.64.0              │ 1.64.1                          │ Private tokens could appear in logs if context containing │
│                                  │                     │          │        │                      │                                 │ gRPC metadata is...                                       │
│                                  │                     │          │        │                      │                                 │ https://github.com/advisories/GHSA-xr7q-jx4m-x55m         │
└──────────────────────────────────┴─────────────────────┴──────────┴────────┴──────────────────────┴─────────────────────────────────┴───────────────────────────────────────────────────────────┘

After

 trivy rootfs .                                           
2024-10-29T17:40:31+06:00	INFO	[vuln] Vulnerability scanning is enabled
2024-10-29T17:40:31+06:00	INFO	[secret] Secret scanning is enabled
2024-10-29T17:40:31+06:00	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-29T17:40:31+06:00	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-29T17:40:31+06:00	INFO	Number of language-specific files	num=1
2024-10-29T17:40:31+06:00	INFO	[gobinary] Detecting vulnerabilities...

Checklist

I've read the guidelines for contributing to this repository.
I've added tests that prove my fix is effective or that my feature works.
I've updated the documentation with the relevant information (if needed).
I've added usage information (if the PR introduces new options)
I've included a "before" and "after" example to the description (if the PR is a user interface change).

afdesk · 2024-11-15T05:56:25Z

@simar7 @nikpivkin there were some changes (renaming) in iac/rego methods.
Could you check please that I update them correctly here? thanks!

iamhalje · 2024-11-18T21:54:10Z

PR mentions an upgrade to v0.57.0, but v0.57.1 is already available

simar7

I reviewed the pkg/ changes and they lgtm. @nikpivkin could you also take another look?

afdesk · 2024-11-19T04:26:54Z

PR mentions an upgrade to v0.57.0, but v0.57.1 is already available

fixed

nikpivkin · 2024-11-19T05:09:12Z

deploy/helm/values.yaml

@@ -690,7 +690,7 @@ policiesBundle:
  # -- repository of the policies bundle
  repository: aquasecurity/trivy-checks


I think it's worth changing the default value in the future after the release of trivy-checks in DockerHub in case the use of embedded checks is disabled.

nikpivkin

LGTM!

hebestreit · 2024-11-19T22:50:21Z

Did you miss to bump the version of the chart or is there any reason?

https://github.com/aquasecurity/trivy-operator/blob/main/deploy/helm/Chart.yaml#L9

I'm happy to provide a PR for the change.

hebestreit · 2024-11-19T23:24:59Z

I've just seen that other changes have also been merged recently, and I assume it's not being updated because of the upcoming release?

I apologize for my impatience and the inconvenience.

afdesk · 2024-11-20T04:35:00Z

I've just seen that other changes have also been merged recently, and I assume it's not being updated because of the upcoming release?

I apologize for my impatience and the inconvenience.

It's OK
You're right, we want to cut a new release today/tomorrow, but we need to clarify some details.
sorry for inconvenience

* chore: bump up trivy to v0.56.2 * bump up trivy-check * fix dep conflicts * refactor: rebase go.mod * chore: update static yaml files * chore: rerun tests * fix: incorrect check for duplicate controller names * ci: bump timeouts up 10 minutes * chore: bump Trivy up 0.57.0 * chore: install yamllint * chore: set up a specific ubuntu version for GH runners * ci: bump up helm chart testing * ci: set up a specific version for helm chart testing * chore: increase a timeout for helm test * ci: bump up timeouts * chore: bump Trivy up in helm chart * docs: bump up Trivy version * chore: update static yaml * chore: using docker.io as a registry * chore: update docs and static yaml * chore: skip validation of controller name * chore: revert registry from docker to ghcr * chore: remove timeouts for tests * chore: bump up trivy-check tag * chore: using embedded rego policies * chore: show logs for failures * chore: using mirror.gcr.io instead of ghcr.io * update to trivy v0.57.1 --------- Co-authored-by: Simar <[email protected]>

chore: bump up trivy to v0.56.2

71ca56f

github-actions bot added the misc label Oct 29, 2024

afdesk added 8 commits October 30, 2024 12:25

bump up trivy-check

89f21cc

fix dep conflicts

3a815a2

refactor: rebase go.mod

334751d

chore: update static yaml files

58e2136

chore: rerun tests

1204a96

fix: incorrect check for duplicate controller names

a89494d

ci: bump timeouts up 10 minutes

b03908a

chore: bump Trivy up 0.57.0

d8de3e3

afdesk changed the title ~~chore: bump up trivy to v0.56.2~~ chore: bump up trivy to v0.57.0 Nov 5, 2024

afdesk added 14 commits November 5, 2024 12:13

chore: install yamllint

6452f57

chore: set up a specific ubuntu version for GH runners

5a0d452

ci: bump up helm chart testing

87f353e

ci: set up a specific version for helm chart testing

f8575ea

chore: increase a timeout for helm test

ebc006d

ci: bump up timeouts

dcc5767

chore: bump Trivy up in helm chart

ba9d2a2

docs: bump up Trivy version

4a729eb

chore: update static yaml

04ef243

chore: using docker.io as a registry

b624330

chore: update docs and static yaml

0d7cd94

chore: skip validation of controller name

8756ee4

chore: revert registry from docker to ghcr

abb6ac0

chore: remove timeouts for tests

709ae3c

afdesk force-pushed the chore/bump-trivy-0.56.2 branch from d7b3e21 to 709ae3c Compare November 13, 2024 14:00

afdesk added 4 commits November 13, 2024 20:20

chore: bump up trivy-check tag

dd6e583

chore: using embedded rego policies

0ed3a51

chore: show logs for failures

873864d

chore: using mirror.gcr.io instead of ghcr.io

5fa71c0

afdesk force-pushed the chore/bump-trivy-0.56.2 branch from 033fb43 to 5fa71c0 Compare November 15, 2024 05:12

afdesk marked this pull request as ready for review November 15, 2024 05:51

afdesk requested review from itaysk, simar7 and nikpivkin November 15, 2024 05:51

afdesk mentioned this pull request Nov 18, 2024

Trivy Operator is not compatible with Kubernetes v1.31.0 #2251

Closed

update to trivy v0.57.1

402357b

simar7 approved these changes Nov 19, 2024

View reviewed changes

afdesk changed the title ~~chore: bump up trivy to v0.57.0~~ chore: bump up trivy to v0.57.1 Nov 19, 2024

simar7 mentioned this pull request Nov 19, 2024

fix: vuln scan success criteria met #2292

Merged

5 tasks

nikpivkin reviewed Nov 19, 2024

View reviewed changes

nikpivkin approved these changes Nov 19, 2024

View reviewed changes

afdesk merged commit 6f3499c into aquasecurity:main Nov 19, 2024
10 checks passed

afdesk deleted the chore/bump-trivy-0.56.2 branch November 19, 2024 05:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore: bump up trivy to v0.57.1 #2301

chore: bump up trivy to v0.57.1 #2301

Uh oh!

afdesk commented Oct 29, 2024 •

edited

Loading

Uh oh!

afdesk commented Nov 15, 2024

Uh oh!

iamhalje commented Nov 18, 2024 •

edited

Loading

Uh oh!

simar7 left a comment

Uh oh!

afdesk commented Nov 19, 2024

Uh oh!

nikpivkin Nov 19, 2024

Uh oh!

afdesk Nov 19, 2024

Uh oh!

nikpivkin left a comment

Uh oh!

Uh oh!

hebestreit commented Nov 19, 2024

Uh oh!

hebestreit commented Nov 19, 2024

Uh oh!

afdesk commented Nov 20, 2024 •

edited

Loading

Uh oh!

Uh oh!

		@@ -690,7 +690,7 @@ policiesBundle:
		# -- repository of the policies bundle
		repository: aquasecurity/trivy-checks

chore: bump up trivy to v0.57.1 #2301

chore: bump up trivy to v0.57.1 #2301

Uh oh!

Conversation

afdesk commented Oct 29, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Uh oh!

afdesk commented Nov 15, 2024

Uh oh!

iamhalje commented Nov 18, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

simar7 left a comment

Choose a reason for hiding this comment

Uh oh!

afdesk commented Nov 19, 2024

Uh oh!

nikpivkin Nov 19, 2024

Choose a reason for hiding this comment

Uh oh!

afdesk Nov 19, 2024

Choose a reason for hiding this comment

Uh oh!

nikpivkin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

hebestreit commented Nov 19, 2024

Uh oh!

hebestreit commented Nov 19, 2024

Uh oh!

afdesk commented Nov 20, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

afdesk commented Oct 29, 2024 •

edited

Loading

iamhalje commented Nov 18, 2024 •

edited

Loading

afdesk commented Nov 20, 2024 •

edited

Loading