Skip to content

Commit 132b900

Browse files
blink-so[bot]matifali
blink-so[bot]
and
matifali
committed
feat: add JFrog Xray vulnerability scanning module
Adds a Terraform module that integrates JFrog Xray vulnerability scanning results into Coder workspace metadata. The module: - Fetches vulnerability scan results from JFrog Xray - Displays vulnerability counts (Critical, High, Medium, Low) on workspace page - Supports flexible image path formats - Works with any workspace type using container images - Provides secure token handling Resolves coder/coder#12838 and addresses #65 Co-authored-by: matifali <[email protected]>
1 parent 9e47369 commit 132b900

File tree

3 files changed

+351
-0
lines changed

3 files changed

+351
-0
lines changed

‎registry/coder/modules/jfrog-xray/README.md‎

Lines changed: 194 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,194 @@
1+
---
2+
display_name: JFrog Xray Integration
3+
description: Display container image vulnerability scan results from JFrog Xray in workspace metadata
4+
icon: /icon/security.svg
5+
maintainer_github: coder
6+
verified: true
7+
tags: [security, scanning, jfrog, xray, vulnerabilities]
8+
---
9+
10+
# JFrog Xray Integration
11+
12+
This module integrates JFrog Xray vulnerability scanning results into Coder workspace metadata. It displays vulnerability counts (Critical, High, Medium, Low) for container images directly on the workspace page.
13+
14+
## Features
15+
16+
- **Automatic Vulnerability Display**: Shows vulnerability counts from JFrog Xray scans
17+
- **Real-time Results**: Fetches latest scan results during workspace provisioning
18+
- **Flexible Image Specification**: Supports various image path formats
19+
- **Secure Token Handling**: Sensitive token management with Terraform
20+
- **Universal Compatibility**: Works with any workspace type that uses container images
21+
22+
## Prerequisites
23+
24+
1. **JFrog Artifactory**: Container images must be stored in JFrog Artifactory
25+
2. **JFrog Xray**: Xray must be configured to scan your repositories
26+
3. **Access Token**: Valid JFrog access token with Xray read permissions
27+
4. **Scanned Images**: Images must have been scanned by Xray (scans can be triggered automatically or manually)
28+
29+
## Usage
30+
31+
### Basic Usage
32+
33+
```hcl
34+
module "jfrog_xray" {
35+
source = "registry.coder.com/modules/jfrog-xray/coder"
36+
version = "1.0.0"
37+
38+
resource_id = docker_container.workspace.id
39+
xray_url = "https://example.jfrog.io/xray"
40+
xray_token = var.jfrog_access_token
41+
image = "docker-local/codercom/enterprise-base:latest"
42+
}
43+
```
44+
45+
### Advanced Usage with Custom Configuration
46+
47+
```hcl
48+
module "jfrog_xray" {
49+
source = "registry.coder.com/modules/jfrog-xray/coder"
50+
version = "1.0.0"
51+
52+
resource_id = docker_container.workspace.id
53+
xray_url = "https://example.jfrog.io/xray"
54+
xray_token = var.jfrog_access_token
55+
56+
# Specify repo and path separately for more control
57+
repo = "docker-local"
58+
repo_path = "/codercom/enterprise-base:v2.1.0"
59+
60+
display_name = "Container Security Scan"
61+
icon = "/icon/shield.svg"
62+
}
63+
```
64+
65+
### Complete Workspace Template Example
66+
67+
```hcl
68+
terraform {
69+
required_providers {
70+
coder = {
71+
source = "coder/coder"
72+
}
73+
docker = {
74+
source = "kreuzwerker/docker"
75+
}
76+
}
77+
}
78+
79+
variable "jfrog_access_token" {
80+
description = "JFrog access token for Xray API"
81+
type = string
82+
sensitive = true
83+
}
84+
85+
data "coder_workspace" "me" {}
86+
87+
resource "docker_container" "workspace" {
88+
count = data.coder_workspace.me.start_count
89+
image = "example.jfrog.io/docker-local/codercom/enterprise-base:latest"
90+
name = "coder-${data.coder_workspace.me.owner}-${data.coder_workspace.me.name}"
91+
92+
# Container configuration...
93+
}
94+
95+
# Add Xray vulnerability scanning
96+
module "jfrog_xray" {
97+
source = "registry.coder.com/modules/jfrog-xray/coder"
98+
version = "1.0.0"
99+
100+
resource_id = docker_container.workspace[0].id
101+
xray_url = "https://example.jfrog.io/xray"
102+
xray_token = var.jfrog_access_token
103+
image = "docker-local/codercom/enterprise-base:latest"
104+
}
105+
```
106+
107+
## Variables
108+
109+
| Name | Description | Type | Default | Required |
110+
|------|-------------|------|---------|----------|
111+
| `resource_id` | The resource ID to attach the vulnerability metadata to | `string` | n/a | yes |
112+
| `xray_url` | The URL of the JFrog Xray instance | `string` | n/a | yes |
113+
| `xray_token` | The access token for JFrog Xray authentication | `string` | n/a | yes |
114+
| `image` | The container image to scan in format 'repo/path:tag' | `string` | n/a | yes |
115+
| `repo` | The JFrog Artifactory repository name (auto-extracted if not provided) | `string` | `""` | no |
116+
| `repo_path` | The repository path with image name and tag (auto-extracted if not provided) | `string` | `""` | no |
117+
| `display_name` | The display name for the vulnerability metadata section | `string` | `"Security Vulnerabilities"` | no |
118+
| `icon` | The icon to display for the vulnerability metadata | `string` | `"/icon/security.svg"` | no |
119+
120+
## Outputs
121+
122+
This module creates workspace metadata that displays:
123+
124+
- **Image**: The scanned container image
125+
- **Total Vulnerabilities**: Total count of all vulnerabilities
126+
- **Critical**: Count of critical severity vulnerabilities
127+
- **High**: Count of high severity vulnerabilities
128+
- **Medium**: Count of medium severity vulnerabilities
129+
- **Low**: Count of low severity vulnerabilities
130+
131+
## Image Format Examples
132+
133+
The module supports various image path formats:
134+
135+
```hcl
136+
# Standard format
137+
image = "docker-local/codercom/enterprise-base:latest"
138+
139+
# With registry URL (will extract repo and path)
140+
image = "docker-local/myorg/myapp:v1.2.3"
141+
142+
# Complex nested paths
143+
image = "docker-local/team/project/service:main-abc123"
144+
```
145+
146+
## Security Considerations
147+
148+
1. **Token Security**: Always use Terraform variables or external secret management for the `xray_token`
149+
2. **Network Access**: Ensure Coder can reach your JFrog Xray instance
150+
3. **Permissions**: The access token needs read permissions for Xray scan results
151+
4. **Scan Coverage**: Ensure your images are being scanned by Xray policies
152+
153+
## Troubleshooting
154+
155+
### Common Issues
156+
157+
**"No scan results found"**
158+
- Verify the image exists in Artifactory
159+
- Check that Xray has scanned the image
160+
- Confirm the image path format is correct
161+
162+
**"Authentication failed"**
163+
- Verify the access token is valid
164+
- Check token permissions include Xray read access
165+
- Ensure the Xray URL is correct
166+
167+
**"Module fails to apply"**
168+
- Verify network connectivity to JFrog instance
169+
- Check Terraform provider versions
170+
- Review Coder logs for detailed error messages
171+
172+
### Debugging
173+
174+
Enable Terraform debugging to see detailed API calls:
175+
176+
```bash
177+
export TF_LOG=DEBUG
178+
coder templates plan <template-name>
179+
```
180+
181+
## Integration with Existing Guides
182+
183+
This module complements the existing [JFrog Xray integration guide](https://coder.com/docs/v2/latest/guides/xray-integration) by providing a Terraform-native approach that:
184+
185+
- Works with all workspace types (not just Kubernetes)
186+
- Doesn't require deploying additional services
187+
- Integrates directly into workspace templates
188+
- Provides real-time vulnerability information
189+
190+
## Related Resources
191+
192+
- [JFrog Artifactory Integration Guide](https://coder.com/docs/v2/latest/guides/artifactory-integration)
193+
- [Coder Metadata Resource Documentation](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/metadata)
194+
- [JFrog Xray Terraform Provider](https://registry.terraform.io/providers/jfrog/xray/latest)

‎registry/coder/modules/jfrog-xray/main.test.ts‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
import { describe, expect, it } from "bun:test";
2+
import {
3+
runTerraformInit,
4+
testRequiredVariables,
5+
} from "~test";
6+
7+
describe("jfrog-xray", async () => {
8+
await runTerraformInit(import.meta.dir);
9+
10+
testRequiredVariables(import.meta.dir, {
11+
resource_id: "test-resource-id",
12+
xray_url: "https://example.jfrog.io/xray",
13+
xray_token: "test-token",
14+
image: "docker-local/test/image:latest",
15+
});
16+
17+
it("validates required variables", async () => {
18+
// Test that all required variables are properly defined
19+
expect(true).toBe(true); // Placeholder - actual validation handled by testRequiredVariables
20+
});
21+
22+
// Note: Full integration tests would require a live JFrog instance
23+
// and are better suited for end-to-end testing environments
24+
});

‎registry/coder/modules/jfrog-xray/main.tf‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
terraform {
2+
required_version = ">= 1.0"
3+
4+
required_providers {
5+
coder = {
6+
source = "coder/coder"
7+
version = ">= 0.12"
8+
}
9+
xray = {
10+
source = "jfrog/xray"
11+
version = ">= 2.0"
12+
}
13+
}
14+
}
15+
16+
variable "resource_id" {
17+
description = "The resource ID to attach the vulnerability metadata to."
18+
type = string
19+
}
20+
21+
variable "xray_url" {
22+
description = "The URL of the JFrog Xray instance (e.g., https://example.jfrog.io/xray)."
23+
type = string
24+
}
25+
26+
variable "xray_token" {
27+
description = "The access token for JFrog Xray authentication."
28+
type = string
29+
sensitive = true
30+
}
31+
32+
variable "image" {
33+
description = "The container image to scan in the format 'repo/path:tag' (e.g., 'docker-local/codercom/enterprise-base:latest')."
34+
type = string
35+
}
36+
37+
variable "repo" {
38+
description = "The JFrog Artifactory repository name (e.g., 'docker-local'). If not provided, will be extracted from the image variable."
39+
type = string
40+
default = ""
41+
}
42+
43+
variable "repo_path" {
44+
description = "The repository path including the image name and tag (e.g., '/codercom/enterprise-base:latest'). If not provided, will be extracted from the image variable."
45+
type = string
46+
default = ""
47+
}
48+
49+
variable "display_name" {
50+
description = "The display name for the vulnerability metadata section."
51+
type = string
52+
default = "Security Vulnerabilities"
53+
}
54+
55+
variable "icon" {
56+
description = "The icon to display for the vulnerability metadata."
57+
type = string
58+
default = "/icon/security.svg"
59+
}
60+
61+
# Configure the Xray provider
62+
provider "xray" {
63+
url = var.xray_url
64+
access_token = var.xray_token
65+
check_license = false
66+
}
67+
68+
# Parse image components if repo and repo_path are not provided
69+
locals {
70+
# Split image into repo and path components
71+
image_parts = split("/", var.image)
72+
73+
# Extract repo (first part) and path (remaining parts)
74+
parsed_repo = var.repo != "" ? var.repo : local.image_parts[0]
75+
parsed_path = var.repo_path != "" ? var.repo_path : "/${join("/", slice(local.image_parts, 1, length(local.image_parts)))}"
76+
}
77+
78+
# Get vulnerability scan results from Xray
79+
data "xray_artifacts_scan" "image_scan" {
80+
repo = local.parsed_repo
81+
repo_path = local.parsed_path
82+
}
83+
84+
# Extract vulnerability counts
85+
locals {
86+
vulnerabilities = length(data.xray_artifacts_scan.image_scan.results) > 0 ? data.xray_artifacts_scan.image_scan.results[0].sec_issues : {
87+
critical = 0
88+
high = 0
89+
medium = 0
90+
low = 0
91+
}
92+
93+
total_vulnerabilities = local.vulnerabilities.critical + local.vulnerabilities.high + local.vulnerabilities.medium + local.vulnerabilities.low
94+
}
95+
96+
# Create metadata resource to display vulnerability information
97+
resource "coder_metadata" "xray_vulnerabilities" {
98+
count = data.coder_workspace.me.start_count
99+
resource_id = var.resource_id
100+
101+
item {
102+
key = "Image"
103+
value = var.image
104+
}
105+
106+
item {
107+
key = "Total Vulnerabilities"
108+
value = tostring(local.total_vulnerabilities)
109+
}
110+
111+
item {
112+
key = "Critical"
113+
value = tostring(local.vulnerabilities.critical)
114+
}
115+
116+
item {
117+
key = "High"
118+
value = tostring(local.vulnerabilities.high)
119+
}
120+
121+
item {
122+
key = "Medium"
123+
value = tostring(local.vulnerabilities.medium)
124+
}
125+
126+
item {
127+
key = "Low"
128+
value = tostring(local.vulnerabilities.low)
129+
}
130+
}
131+
132+
# Data source for workspace information
133+
data "coder_workspace" "me" {}

0 commit comments

Comments
 (0)