Skip to content

Commit 4a082ca

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #5798 from mboersma/security-scan
Run verify-security weekly as a GitHub action
2 parents 316370d + 5f304dd commit 4a082ca

File tree

5 files changed

+127
-56
lines changed

5 files changed

+127
-56
lines changed

‎.github/workflows/scan.yml‎

Lines changed: 0 additions & 27 deletions
This file was deleted.

‎.github/workflows/weekly-security-scan.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: Weekly security scan
2+
3+
on:
4+
schedule:
5+
# Cron for every Monday at 12:00 UTC.
6+
- cron: "0 12 * * 1"
7+
8+
# Remove all permissions from GITHUB_TOKEN except metadata.
9+
permissions: {}
10+
11+
jobs:
12+
scan:
13+
strategy:
14+
fail-fast: false
15+
matrix:
16+
branch: [ main, release-1.20, release-1.19 ]
17+
name: Trivy
18+
runs-on: ubuntu-latest
19+
steps:
20+
- name: Check out code
21+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # tag=v4.2.2
22+
with:
23+
ref: ${{ matrix.branch }}
24+
- name: Calculate go version
25+
id: vars
26+
run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
27+
- name: Set up Go
28+
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # tag=v5.5.0
29+
with:
30+
go-version: ${{ steps.vars.outputs.go_version }}
31+
- name: Run verify security target
32+
run: make verify-security

‎Makefile‎

Lines changed: 32 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,11 @@ GOLANGCI_LINT_VER := $(shell cat .github/workflows/pr-golangci-lint.yaml | grep
8686
GOLANGCI_LINT_BIN := golangci-lint
8787
GOLANGCI_LINT := $(TOOLS_BIN_DIR)/$(GOLANGCI_LINT_BIN)-$(GOLANGCI_LINT_VER)
8888

89+
GOVULNCHECK_BIN := govulncheck
90+
GOVULNCHECK_VER := v1.1.4
91+
GOVULNCHECK := $(abspath $(TOOLS_BIN_DIR)/$(GOVULNCHECK_BIN)-$(GOVULNCHECK_VER))
92+
GOVULNCHECK_PKG := golang.org/x/vuln/cmd/govulncheck
93+
8994
KUSTOMIZE_VER := v5.4.1
9095
KUSTOMIZE_BIN := kustomize
9196
KUSTOMIZE := $(TOOLS_BIN_DIR)/$(KUSTOMIZE_BIN)-$(KUSTOMIZE_VER)
@@ -102,6 +107,8 @@ RELEASE_NOTES_VER := v0.18.0
102107
RELEASE_NOTES_BIN := release-notes
103108
RELEASE_NOTES := $(TOOLS_BIN_DIR)/$(RELEASE_NOTES_BIN)-$(RELEASE_NOTES_VER)
104109

110+
TRIVY_VER := 0.64.0
111+
105112
KPROMO_VER := v4.0.5
106113
KPROMO_BIN := kpromo
107114
KPROMO := $(TOOLS_BIN_DIR)/$(KPROMO_BIN)-$(KPROMO_VER)
@@ -307,6 +314,24 @@ verify-tiltfile: ## Verify Tiltfile format.
307314
verify-codespell: codespell ## Verify codespell.
308315
@$(CODESPELL) $(ROOT_DIR) --ignore-words=$(ROOT_DIR)/.codespellignore --skip="*.git,*_artifacts,*.sum,$(ROOT_DIR)/docs/book/bookout,$(ROOT_DIR)/hack/tools/bin/codespell_dist"
309316

317+
.PHONY: verify-govulncheck
318+
verify-govulncheck: $(GOVULNCHECK) ## Verify code for vulnerabilities
319+
$(GOVULNCHECK) ./... && R1=$$? || R1=$$?; \
320+
$(GOVULNCHECK) -C "$(TOOLS_DIR)" ./... && R2=$$? || R2=$$?; \
321+
$(GOVULNCHECK) -C "$(TEST_DIR)" ./... && R3=$$? || R3=$$?; \
322+
if [ "$$R1" -ne "0" ] || [ "$$R2" -ne "0" ] || [ "$$R3" -ne "0" ]; then \
323+
exit 1; \
324+
fi
325+
326+
.PHONY: verify-security
327+
verify-security: ## Verify code and images for vulnerabilities
328+
$(MAKE) verify-container-images && R1=$$? || R1=$$?; \
329+
$(MAKE) verify-govulncheck && R2=$$? || R2=$$?; \
330+
if [ "$$R1" -ne "0" ] || [ "$$R2" -ne "0" ]; then \
331+
echo "Check for vulnerabilities failed! There are vulnerabilities to be fixed"; \
332+
exit 1; \
333+
fi
334+
310335
## --------------------------------------
311336
## Development
312337
## --------------------------------------
@@ -764,7 +789,7 @@ cleanup-workload-identity: ## Cleanup CI workload-identity infra
764789

765790
.PHONY: verify-container-images
766791
verify-container-images: ## Verify container images
767-
./hack/verify-container-images.sh
792+
TRACE=$(TRACE) ./hack/verify-container-images.sh $(TRIVY_VER)
768793

769794
## --------------------------------------
770795
## Tilt / Kind
@@ -846,6 +871,12 @@ $(CONVERSION_GEN): ## Build conversion-gen from tools folder.
846871
$(ENVSUBST): ## Build envsubst from tools folder.
847872
GOBIN=$(TOOLS_BIN_DIR) $(GO_INSTALL) github.com/drone/envsubst/v2/cmd/envsubst $(ENVSUBST_BIN) $(ENVSUBST_VER)
848873

874+
.PHONY: $(GOVULNCHECK_BIN)
875+
$(GOVULNCHECK_BIN): $(GOVULNCHECK) ## Build a local copy of govulncheck.
876+
877+
$(GOVULNCHECK): # Build govulncheck.
878+
GOBIN=$(TOOLS_BIN_DIR) $(GO_INSTALL) $(GOVULNCHECK_PKG) $(GOVULNCHECK_BIN) $(GOVULNCHECK_VER)
879+
849880
$(GOLANGCI_LINT): ## Build golangci-lint from tools folder.
850881
GOBIN=$(TOOLS_BIN_DIR) $(GO_INSTALL) github.com/golangci/golangci-lint/v2/cmd/golangci-lint $(GOLANGCI_LINT_BIN) $(GOLANGCI_LINT_VER)
851882

‎hack/ensure-trivy.sh‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
#!/bin/bash
2+
3+
# Copyright 2025 The Kubernetes Authors.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
set -o errexit
18+
set -o nounset
19+
set -o pipefail
20+
21+
if [[ "${TRACE-0}" == "1" ]]; then
22+
set -o xtrace
23+
fi
24+
25+
VERSION=${1}
26+
27+
GO_OS="$(go env GOOS)"
28+
if [[ "${GO_OS}" == "linux" ]]; then
29+
TRIVY_OS="Linux"
30+
elif [[ "${GO_OS}" == "darwin"* ]]; then
31+
TRIVY_OS="macOS"
32+
fi
33+
34+
GO_ARCH="$(go env GOARCH)"
35+
if [[ "${GO_ARCH}" == "amd" ]]; then
36+
TRIVY_ARCH="32bit"
37+
elif [[ "${GO_ARCH}" == "amd64"* ]]; then
38+
TRIVY_ARCH="64bit"
39+
elif [[ "${GO_ARCH}" == "arm" ]]; then
40+
TRIVY_ARCH="ARM"
41+
elif [[ "${GO_ARCH}" == "arm64" ]]; then
42+
TRIVY_ARCH="ARM64"
43+
fi
44+
45+
TOOL_BIN=hack/tools/bin
46+
mkdir -p ${TOOL_BIN}
47+
48+
TRIVY="${TOOL_BIN}/trivy/${VERSION}/trivy"
49+
50+
# Downloads trivy scanner
51+
if [ ! -f "$TRIVY" ]; then
52+
curl -L -o "${TOOL_BIN}/trivy.tar.gz" "https://github.com/aquasecurity/trivy/releases/download/v${VERSION}/trivy_${VERSION}_${TRIVY_OS}-${TRIVY_ARCH}.tar.gz"
53+
mkdir -p "${TOOL_BIN}/trivy/${VERSION}"
54+
tar -xf "${TOOL_BIN}/trivy.tar.gz" -C "${TOOL_BIN}/trivy/${VERSION}" trivy
55+
chmod +x "${TOOL_BIN}/trivy/${VERSION}/trivy"
56+
rm "${TOOL_BIN}/trivy.tar.gz"
57+
fi

‎hack/verify-container-images.sh‎

Lines changed: 6 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -22,42 +22,20 @@ if [[ "${TRACE-0}" == "1" ]]; then
2222
set -o xtrace
2323
fi
2424

25-
TRIVY_VERSION=0.34.0
26-
27-
GO_OS="$(go env GOOS)"
28-
if [[ "${GO_OS}" == "linux" ]]; then
29-
TRIVY_OS="Linux"
30-
elif [[ "${GO_OS}" == "darwin"* ]]; then
31-
TRIVY_OS="macOS"
32-
fi
33-
25+
VERSION=${1}
3426
GO_ARCH="$(go env GOARCH)"
35-
if [[ "${GO_ARCH}" == "amd" ]]; then
36-
TRIVY_ARCH="32bit"
37-
elif [[ "${GO_ARCH}" == "amd64"* ]]; then
38-
TRIVY_ARCH="64bit"
39-
elif [[ "${GO_ARCH}" == "arm" ]]; then
40-
TRIVY_ARCH="ARM"
41-
elif [[ "${GO_ARCH}" == "arm64" ]]; then
42-
TRIVY_ARCH="ARM64"
43-
fi
44-
45-
TOOL_BIN=hack/tools/bin
46-
mkdir -p ${TOOL_BIN}
4727

48-
# Downloads trivy scanner
49-
curl -L -o ${TOOL_BIN}/trivy.tar.gz "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_${TRIVY_OS}-${TRIVY_ARCH}.tar.gz"
28+
REPO_ROOT=$(git rev-parse --show-toplevel)
29+
"${REPO_ROOT}/hack/ensure-trivy.sh" "${VERSION}"
5030

51-
tar -xf "${TOOL_BIN}/trivy.tar.gz" -C "${TOOL_BIN}" trivy
52-
chmod +x ${TOOL_BIN}/trivy
53-
rm ${TOOL_BIN}/trivy.tar.gz
31+
TRIVY="${REPO_ROOT}/hack/tools/bin/trivy/${VERSION}/trivy"
5432

5533
# Builds all the container images to be scanned and cleans up changes to ./*manager_image_patch.yaml ./*manager_pull_policy.yaml.
5634
make REGISTRY=gcr.io/k8s-staging-cluster-api-azure PULL_POLICY=IfNotPresent TAG=dev docker-build
5735
make clean-release-git
5836

5937
# Scan the images
60-
${TOOL_BIN}/trivy image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api-azure/cluster-api-azure-controller-"${GO_ARCH}":dev && R1=$? || R1=$?
38+
"${TRIVY}" image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api-azure/cluster-api-azure-controller-"${GO_ARCH}":dev && R1=$? || R1=$?
6139

6240
echo ""
6341
BRed='\033[1;31m'
@@ -66,7 +44,7 @@ NC='\033[0m' # No
6644

6745
if [ "$R1" -ne "0" ]
6846
then
69-
echo -e "${BRed}Check container images failed! There are vulnerability to be fixed${NC}"
47+
echo -e "${BRed}Check container images failed! There are vulnerabilities to be fixed${NC}"
7048
exit 1
7149
fi
7250

0 commit comments

Comments
 (0)