Skip to content

Commit eb09788

Browse files
lentzi90lentzi90
committed
Add weekly security scan using govulncheck and trivy
This is all based on how CAPI does the same. Signed-off-by: Lennart Jern <[email protected]>
1 parent 168df33 commit eb09788

File tree

4 files changed

+186
-3
lines changed

4 files changed

+186
-3
lines changed

‎.github/workflows/security-scan.yaml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: Weekly security scan
2+
3+
on:
4+
schedule:
5+
# Cron for every Monday at 9:12 UTC.
6+
- cron: "12 9 * * 1"
7+
8+
# Remove all permissions from GITHUB_TOKEN except metadata.
9+
permissions: {}
10+
11+
jobs:
12+
scan:
13+
strategy:
14+
fail-fast: false
15+
matrix:
16+
branch: [main, release-0.12, release-0.11, release-0.10]
17+
name: Trivy
18+
runs-on: ubuntu-latest
19+
steps:
20+
- name: Check out code
21+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # tag=v4.2.2
22+
with:
23+
ref: ${{ matrix.branch }}
24+
- name: Calculate go version
25+
id: vars
26+
run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
27+
- name: Set up Go
28+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # tag=v5.4.0
29+
with:
30+
go-version: ${{ steps.vars.outputs.go_version }}
31+
- name: Run verify security target
32+
run: make verify-security

‎Makefile

Lines changed: 45 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,16 +23,19 @@ include $(ROOT_DIR_RELATIVE)/common.mk
2323
export GO111MODULE=on
2424
unexport GOPATH
2525

26+
# Enables shell script tracing. Enable by running: TRACE=1 make <target>
27+
TRACE ?= 0
28+
2629
# Go
2730
GO_VERSION ?= 1.22.7
2831

2932
# Directories.
3033
ARTIFACTS ?= $(REPO_ROOT)/_artifacts
3134
TOOLS_DIR := hack/tools
35+
BIN_DIR := bin
3236
TOOLS_DIR_DEPS := $(TOOLS_DIR)/go.sum $(TOOLS_DIR)/go.mod $(TOOLS_DIR)/Makefile
33-
TOOLS_BIN_DIR := $(TOOLS_DIR)/bin
37+
TOOLS_BIN_DIR := $(TOOLS_DIR)/$(BIN_DIR)
3438

35-
BIN_DIR := bin
3639
REPO_ROOT := $(shell git rev-parse --show-toplevel)
3740
GH_REPO ?= kubernetes-sigs/cluster-api-provider-openstack
3841
TEST_E2E_DIR := test/e2e
@@ -49,6 +52,13 @@ GO_APIDIFF_VER := v0.8.2
4952
GO_APIDIFF_BIN := go-apidiff
5053
GO_APIDIFF_PKG := github.com/joelanford/go-apidiff
5154

55+
# govulncheck
56+
GOVULNCHECK_VER := v1.1.4
57+
GOVULNCHECK_BIN := govulncheck
58+
GOVULNCHECK_PKG := golang.org/x/vuln/cmd/govulncheck
59+
60+
TRIVY_VER := 0.49.1
61+
5262
# Binaries.
5363
CONTROLLER_GEN := $(TOOLS_BIN_DIR)/controller-gen
5464
CONVERSION_GEN := $(TOOLS_BIN_DIR)/conversion-gen
@@ -63,6 +73,7 @@ RELEASE_NOTES := $(TOOLS_BIN_DIR)/release-notes
6373
SETUP_ENVTEST := $(TOOLS_BIN_DIR)/setup-envtest
6474
GEN_CRD_API_REFERENCE_DOCS := $(TOOLS_BIN_DIR)/gen-crd-api-reference-docs
6575
GO_APIDIFF := $(TOOLS_BIN_DIR)/$(GO_APIDIFF_BIN)-$(GO_APIDIFF_VER)
76+
GOVULNCHECK := $(TOOLS_BIN_DIR)/$(GOVULNCHECK_BIN)-$(GOVULNCHECK_VER)
6677

6778
# Kubebuilder
6879
export KUBEBUILDER_ENVTEST_KUBERNETES_VERSION ?= 1.28.0
@@ -252,6 +263,12 @@ $(GO_APIDIFF_BIN): $(GO_APIDIFF)
252263
$(GO_APIDIFF): # Build go-apidiff.
253264
GOBIN=$(abspath $(TOOLS_BIN_DIR)) $(GO_INSTALL) $(GO_APIDIFF_PKG) $(GO_APIDIFF_BIN) $(GO_APIDIFF_VER)
254265

266+
.PHONY: $(GOVULNCHECK_BIN)
267+
$(GOVULNCHECK_BIN): $(GOVULNCHECK) ## Build a local copy of govulncheck.
268+
269+
$(GOVULNCHECK): # Build govulncheck.
270+
GOBIN=$(abspath $(TOOLS_BIN_DIR)) $(GO_INSTALL) $(GOVULNCHECK_PKG) $(GOVULNCHECK_BIN) $(GOVULNCHECK_VER)
271+
255272
## --------------------------------------
256273
##@ Linting
257274
## --------------------------------------
@@ -563,8 +580,12 @@ clean-temporary: ## Remove all temporary files and folders
563580
clean-release: ## Remove the release folder
564581
rm -rf $(RELEASE_DIR)
565582

583+
.PHONY: clean-release-git
584+
clean-release-git: ## Restores the git files usually modified during a release
585+
git restore ./*manager_image_patch.yaml ./*manager_pull_policy.yaml
586+
566587
.PHONY: verify
567-
verify: verify-boilerplate verify-modules verify-gen verify-orc
588+
verify: verify-boilerplate verify-modules verify-gen verify-orc verify-govulncheck
568589

569590
.PHONY: verify-boilerplate
570591
verify-boilerplate:
@@ -588,6 +609,27 @@ verify-gen: generate
588609
verify-orc:
589610
$(MAKE) -C $(REPO_ROOT)/orc verify-generated
590611

612+
.PHONY: verify-container-images
613+
verify-container-images: ## Verify container images
614+
TRACE=$(TRACE) ./hack/verify-container-images.sh $(TRIVY_VER)
615+
616+
.PHONY: verify-govulncheck
617+
verify-govulncheck: $(GOVULNCHECK) ## Verify code for vulnerabilities
618+
$(GOVULNCHECK) ./... && R1=$$? || R1=$$?; \
619+
$(GOVULNCHECK) -C "$(TOOLS_DIR)" ./... && R2=$$? || R2=$$?; \
620+
if [ "$$R1" -ne "0" ] || [ "$$R2" -ne "0" ]; then \
621+
exit 1; \
622+
fi
623+
624+
.PHONY: verify-security
625+
verify-security: ## Verify code and images for vulnerabilities
626+
$(MAKE) verify-container-images && R1=$$? || R1=$$?; \
627+
$(MAKE) verify-govulncheck && R2=$$? || R2=$$?; \
628+
if [ "$$R1" -ne "0" ] || [ "$$R2" -ne "0" ]; then \
629+
echo "Check for vulnerabilities failed! There are vulnerabilities to be fixed"; \
630+
exit 1; \
631+
fi
632+
591633
.PHONY: compile-e2e
592634
compile-e2e: ## Test e2e compilation
593635
go test -c -o /dev/null -tags=e2e ./test/e2e/suites/conformance

‎hack/ensure-trivy.sh

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
#!/bin/bash
2+
3+
# Copyright 2023 The Kubernetes Authors.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
set -o errexit
18+
set -o nounset
19+
set -o pipefail
20+
21+
if [[ "${TRACE-0}" == "1" ]]; then
22+
set -o xtrace
23+
fi
24+
25+
VERSION=${1}
26+
27+
GO_OS="$(go env GOOS)"
28+
if [[ "${GO_OS}" == "linux" ]]; then
29+
TRIVY_OS="Linux"
30+
elif [[ "${GO_OS}" == "darwin"* ]]; then
31+
TRIVY_OS="macOS"
32+
fi
33+
34+
GO_ARCH="$(go env GOARCH)"
35+
if [[ "${GO_ARCH}" == "amd" ]]; then
36+
TRIVY_ARCH="32bit"
37+
elif [[ "${GO_ARCH}" == "amd64"* ]]; then
38+
TRIVY_ARCH="64bit"
39+
elif [[ "${GO_ARCH}" == "arm" ]]; then
40+
TRIVY_ARCH="ARM"
41+
elif [[ "${GO_ARCH}" == "arm64" ]]; then
42+
TRIVY_ARCH="ARM64"
43+
fi
44+
45+
TOOL_BIN=hack/tools/bin
46+
mkdir -p ${TOOL_BIN}
47+
48+
TRIVY="${TOOL_BIN}/trivy/${VERSION}/trivy"
49+
50+
# Downloads trivy scanner
51+
if [ ! -f "$TRIVY" ]; then
52+
curl -L -o ${TOOL_BIN}/trivy.tar.gz "https://github.com/aquasecurity/trivy/releases/download/v${VERSION}/trivy_${VERSION}_${TRIVY_OS}-${TRIVY_ARCH}.tar.gz"
53+
mkdir -p "$(dirname "$0")/tools/bin/trivy/${VERSION}"
54+
tar -xf "${TOOL_BIN}/trivy.tar.gz" -C "${TOOL_BIN}/trivy/${VERSION}" trivy
55+
chmod +x "${TOOL_BIN}/trivy/${VERSION}/trivy"
56+
rm "${TOOL_BIN}/trivy.tar.gz"
57+
fi

‎hack/verify-container-images.sh

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
#!/bin/bash
2+
3+
# Copyright 2022 The Kubernetes Authors.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
set -o errexit
18+
set -o nounset
19+
set -o pipefail
20+
21+
if [[ "${TRACE-0}" == "1" ]]; then
22+
set -o xtrace
23+
fi
24+
25+
VERSION=${1}
26+
GO_ARCH="$(go env GOARCH)"
27+
DB_MIRROR="public.ecr.aws/aquasecurity/trivy-db"
28+
29+
REPO_ROOT=$(git rev-parse --show-toplevel)
30+
"${REPO_ROOT}/hack/ensure-trivy.sh" "${VERSION}"
31+
32+
TRIVY="${REPO_ROOT}/hack/tools/bin/trivy/${VERSION}/trivy"
33+
34+
# Builds all the container images to be scanned and cleans up changes to ./*manager_image_patch.yaml ./*manager_pull_policy.yaml.
35+
make REGISTRY=gcr.io/k8s-staging-capi-openstack PULL_POLICY=IfNotPresent TAG=dev docker-build
36+
make clean-release-git
37+
38+
# Scan the images
39+
"${TRIVY}" image --db-repository="${DB_MIRROR}" -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-capi-openstack/capi-openstack-controller-"${GO_ARCH}":dev && R1=$? || R1=$?
40+
41+
echo ""
42+
BRed='\033[1;31m'
43+
BGreen='\033[1;32m'
44+
NC='\033[0m' # No
45+
46+
if [ "$R1" -ne "0" ]
47+
then
48+
echo -e "${BRed}Check container images failed! There are vulnerabilities to be fixed${NC}"
49+
exit 1
50+
fi
51+
52+
echo -e "${BGreen}Check container images passed! No vulnerability found${NC}"

0 commit comments

Comments
 (0)