feat: add NodeVulnerabilityReport for node rootfs vulnerability scanning

deploy/helm/crds/aquasecurity.github.io_nodevulnerabilityreports.yaml

@@ -0,0 +1,283 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.18.0
+  name: nodevulnerabilityreports.aquasecurity.github.io
+spec:
+  group: aquasecurity.github.io
+  names:
+    kind: NodeVulnerabilityReport
+    listKind: NodeVulnerabilityReportList
+    plural: nodevulnerabilityreports
+    shortNames:
+    - nodevuln
+    - nodevulns
+    singular: nodevulnerabilityreport
+  scope: Cluster
+  versions:
+  - additionalPrinterColumns:
+    - description: The name of the node
+      jsonPath: .report.artifact.nodeName
+      name: Node
+      type: string
+    - description: The name of the vulnerability scanner
+      jsonPath: .report.scanner.name
+      name: Scanner
+      type: string
+    - description: The age of the report
+      jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    - description: The number of critical vulnerabilities
+      jsonPath: .report.summary.criticalCount
+      name: Critical
+      priority: 1
+      type: integer
+    - description: The number of high vulnerabilities
+      jsonPath: .report.summary.highCount
+      name: High
+      priority: 1
+      type: integer
+    - description: The number of medium vulnerabilities
+      jsonPath: .report.summary.mediumCount
+      name: Medium
+      priority: 1
+      type: integer
+    - description: The number of low vulnerabilities
+      jsonPath: .report.summary.lowCount
+      name: Low
+      priority: 1
+      type: integer
+    - description: The number of unknown vulnerabilities
+      jsonPath: .report.summary.unknownCount
+      name: Unknown
+      priority: 1
+      type: integer
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: |-
+          NodeVulnerabilityReport summarizes vulnerabilities in operating system packages
+          and software installed on a Kubernetes node's filesystem (rootfs).
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          report:
+            description: Report is the actual node vulnerability report data.
+            properties:
+              artifact:
+                description: Artifact represents the node filesystem that was scanned.
+                properties:
+                  kind:
+                    description: |-
+                      Kind indicates the type of artifact being scanned.
+                      For node rootfs scanning, this is typically "node-rootfs".
+                    type: string
+                  nodeName:
+                    description: NodeName is the name of the Kubernetes node.
+                    type: string
+                  rootPath:
+                    description: RootPath is the path that was scanned on the node.
+                    type: string
+                required:
+                - nodeName
+                type: object
+              os:
+                description: OS information of the node
+                properties:
+                  eosl:
+                    description: Eosl is true if OS version has reached end of service
+                      life
+                    type: boolean
+                  family:
+                    description: Operating System Family
+                    type: string
+                  name:
+                    description: Name or version of the OS
+                    type: string
+                type: object
+              scanner:
+                description: Scanner is the scanner that generated this report.
+                properties:
+                  name:
+                    description: Name the name of the scanner.
+                    type: string
+                  vendor:
+                    description: Vendor the name of the vendor providing the scanner.
+                    type: string
+                  version:
+                    description: Version the version of the scanner.
+                    type: string
+                required:
+                - name
+                - vendor
+                - version
+                type: object
+              summary:
+                description: Summary is a summary of Vulnerability counts grouped
+                  by Severity.
+                properties:
+                  criticalCount:
+                    description: CriticalCount is the number of vulnerabilities with
+                      Critical Severity.
+                    minimum: 0
+                    type: integer
+                  highCount:
+                    description: HighCount is the number of vulnerabilities with High
+                      Severity.
+                    minimum: 0
+                    type: integer
+                  lowCount:
+                    description: LowCount is the number of vulnerabilities with Low
+                      Severity.
+                    minimum: 0
+                    type: integer
+                  mediumCount:
+                    description: MediumCount is the number of vulnerabilities with
+                      Medium Severity.
+                    minimum: 0
+                    type: integer
+                  noneCount:
+                    description: NoneCount is the number of packages without any vulnerability.
+                    minimum: 0
+                    type: integer
+                  unknownCount:
+                    description: UnknownCount is the number of vulnerabilities with
+                      unknown severity.
+                    minimum: 0
+                    type: integer
+                required:
+                - criticalCount
+                - highCount
+                - lowCount
+                - mediumCount
+                - unknownCount
+                type: object
+              updateTimestamp:
+                description: UpdateTimestamp is a timestamp representing the server
+                  time in UTC when this report was updated.
+                format: date-time
+                type: string
+              vulnerabilities:
+                description: |-
+                  Vulnerabilities is a list of operating system (OS) or application software
+                  Vulnerability items found on the node filesystem.
+                items:
+                  description: Vulnerability is the spec for a vulnerability record.
+                  properties:
+                    class:
+                      type: string
+                    cvss:
+                      additionalProperties:
+                        properties:
+                          V2Score:
+                            type: number
+                          V2Vector:
+                            type: string
+                          V3Score:
+                            type: number
+                          V3Vector:
+                            type: string
+                          V40Score:
+                            type: number
+                          V40Vector:
+                            type: string
+                        type: object
+                      type: object
+                    cvsssource:
+                      type: string
+                    description:
+                      type: string
+                    fixedVersion:
+                      description: FixedVersion indicates the version of the Resource
+                        in which this vulnerability has been fixed.
+                      type: string
+                    installedVersion:
+                      description: InstalledVersion indicates the installed version
+                        of the Resource.
+                      type: string
+                    lastModifiedDate:
+                      description: LastModifiedDate indicates the last date CVE has
+                        been modified.
+                      type: string
+                    links:
+                      items:
+                        type: string
+                      type: array
+                    packagePURL:
+                      type: string
+                    packagePath:
+                      type: string
+                    packageType:
+                      type: string
+                    primaryLink:
+                      type: string
+                    publishedDate:
+                      description: PublishedDate indicates the date of published CVE.
+                      type: string
+                    resource:
+                      description: Resource is a vulnerable package, application,
+                        or library.
+                      type: string
+                    score:
+                      type: number
+                    severity:
+                      description: Severity level of a vulnerability or a configuration
+                        audit check.
+                      enum:
+                      - CRITICAL
+                      - HIGH
+                      - MEDIUM
+                      - LOW
+                      - UNKNOWN
+                      type: string
+                    target:
+                      type: string
+                    title:
+                      type: string
+                    vulnerabilityID:
+                      description: VulnerabilityID the vulnerability identifier.
+                      type: string
+                  required:
+                  - fixedVersion
+                  - installedVersion
+                  - lastModifiedDate
+                  - publishedDate
+                  - resource
+                  - severity
+                  - title
+                  - vulnerabilityID
+                  type: object
+                type: array
+            required:
+            - artifact
+            - os
+            - scanner
+            - summary
+            - updateTimestamp
+            - vulnerabilities
+            type: object
+        required:
+        - report
+        type: object
+        x-kubernetes-preserve-unknown-fields: true
+    served: true
+    storage: true
+    subresources: {}

deploy/helm/generated/role.yaml

@@ -71,6 +71,7 @@ rules:
   - configauditreports
   - exposedsecretreports
   - infraassessmentreports
+  - nodevulnerabilityreports
   - rbacassessmentreports
   - sbomreports
   - vulnerabilityreports

deploy/helm/templates/configmaps/trivy-operator-config.yaml

@@ -49,6 +49,15 @@ data:
   TRIVY_SERVER_HEALTH_CHECK_CACHE_EXPIRATION: {{ .Values.operator.trivyServerHealthCheckCacheExpiration | quote }}
   OPERATOR_MERGE_RBAC_FINDING_WITH_CONFIG_AUDIT: {{ .Values.operator.mergeRbacFindingWithConfigAudit | quote }}
   OPERATOR_CLUSTER_COMPLIANCE_ENABLED: {{ .Values.operator.clusterComplianceEnabled | quote }}
+  OPERATOR_NODE_SCANNING_ENABLED: {{ .Values.operator.nodeScanningEnabled | quote }}
+  OPERATOR_NODE_SCANNING_SCANNERS: {{ .Values.operator.nodeScanningScanners | quote }}
+  OPERATOR_NODE_SCANNING_PKG_TYPES: {{ .Values.operator.nodeScanningPkgTypes | quote }}
+  OPERATOR_NODE_SCANNING_SKIP_DIRS: {{ .Values.operator.nodeScanningSkipDirs | quote }}
+  OPERATOR_NODE_SCANNING_TIMEOUT: {{ .Values.operator.nodeScanningTimeout | quote }}
+  OPERATOR_CONCURRENT_NODE_SCANNING_LIMIT: {{ .Values.operator.concurrentNodeScanningLimit | quote }}
+  OPERATOR_NODE_SCANNING_NODE_SELECTOR: {{ .Values.operator.nodeScanningNodeSelector | quote }}
+  OPERATOR_NODE_SCANNING_SEVERITIES: {{ .Values.operator.nodeScanningSeverities | quote }}
+  OPERATOR_NODE_SCANNING_HIDE_UNFIXED_CVES: {{ .Values.operator.nodeScanningHideUnfixedCVEs | quote }}
 {{- if gt (int .Values.operator.replicas) 1 }}
   OPERATOR_LEADER_ELECTION_ENABLED: "true"
   OPERATOR_LEADER_ELECTION_ID: {{ .Values.operator.leaderElectionId | quote }}

deploy/helm/values.yaml

@@ -107,6 +107,28 @@ operator:
   infraAssessmentScannerEnabled: true
   # -- clusterComplianceEnabled the flag to enable cluster compliance scanner
   clusterComplianceEnabled: true
+
+  # -- nodeScanningEnabled the flag to enable node vulnerability scanning
+  # This feature scans the host filesystem of each node for OS package vulnerabilities.
+  nodeScanningEnabled: false
+  # -- nodeScanningScanners comma-separated list of scanners for node scan (default: vuln)
+  nodeScanningScanners: "vuln"
+  # -- nodeScanningPkgTypes comma-separated list of package types to scan (default: os)
+  nodeScanningPkgTypes: "os"
+  # -- nodeScanningSkipDirs comma-separated list of directories to skip during node scanning
+  # By default, container runtime directories and virtual filesystems are excluded.
+  nodeScanningSkipDirs: "/proc,/sys,/dev,/run,/var/lib/containerd,/var/lib/docker,/var/lib/kubelet/pods"
+  # -- nodeScanningTimeout the timeout for node scan jobs. If not set, uses scanJobTimeout.
+  nodeScanningTimeout: ""
+  # -- concurrentNodeScanningLimit the maximum number of node scan jobs to run concurrently
+  concurrentNodeScanningLimit: 1
+  # -- nodeScanningNodeSelector filter nodes by labels (JSON format).
+  nodeScanningNodeSelector: ""
+  # -- nodeScanningSeverities filter vulnerabilities by severity (comma-separated).
+  # WARNING: Without filtering, reports can exceed etcd's 3MB object size limit on nodes with many packages.
+  nodeScanningSeverities: "CRITICAL,HIGH"
+  # -- nodeScanningHideUnfixedCVEs when true, only report vulnerabilities that have a fix available.
+  nodeScanningHideUnfixedCVEs: false
   # -- batchDeleteLimit the maximum number of config audit reports deleted by the operator when the plugin's config has changed.
   batchDeleteLimit: 10
   # -- vulnerabilityScannerScanOnlyCurrentRevisions the flag to only create vulnerability scans on the current revision of a deployment.