Skip to content

Commit 6257be4

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #7604 from fabriziopandini/add-verify-container-images
✨ Adds a verify script that run trivy scanner on container images
2 parents afc37d3 + 93819a2 commit 6257be4

File tree

5 files changed

+147
-32
lines changed

5 files changed

+147
-32
lines changed

‎.github/workflows/scan.yml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: scan-images
2+
3+
on:
4+
schedule:
5+
- cron: "0 12 * * 1"
6+
7+
# Remove all permissions from GITHUB_TOKEN except metadata.
8+
permissions: {}
9+
10+
jobs:
11+
scan:
12+
name: Trivy
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Check out code
16+
uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3.1.0
17+
- name: Setup go
18+
uses: actions/setup-go@d0a58c1c4d2b25278816e339b944508c875f3613 # tag=v3.4.0
19+
with:
20+
go-version: 1.19
21+
- name: Run verify container script
22+
run: make verify-container-images

‎Makefile

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -624,6 +624,10 @@ verify-shellcheck: ## Verify shell files
624624
verify-tiltfile: ## Verify Tiltfile format
625625
TRACE=$(TRACE) ./hack/verify-starlark.sh
626626

627+
.PHONY: verify-container-images
628+
verify-container-images: ## Verify container images
629+
TRACE=$(TRACE) ./hack/verify-container-images.sh
630+
627631
## --------------------------------------
628632
## Binaries
629633
## --------------------------------------

‎docs/book/src/reference/jobs.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,13 @@ GitHub Presubmit Workflows:
4343
* release (run on tags)
4444
* Creates a GitHub release with release notes for the tag.
4545

46+
47+
GitHub Weekly Workflows:
48+
* golangci-lint: golangci/golangci-lint-action
49+
* Weekly check all Markdown links
50+
* scan-images:
51+
* Scan all images for vulnerabilities. Can be run locally via `make verify-container-images`
52+
4653
### Postsubmits
4754

4855
Prow Postsubmits:

‎docs/release/release-tasks.md

Lines changed: 36 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -12,38 +12,39 @@ This document details the responsibilities and tasks for each role in the releas
1212
<!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
1313
**Table of Contents**
1414

15-
- [Release Lead](#release-lead)
16-
- [Responsibilities](#responsibilities)
17-
- [Tasks](#tasks)
18-
- [Set a tentative release date for the minor release](#set-a-tentative-release-date-for-the-minor-release)
19-
- [Assemble release team](#assemble-release-team)
20-
- [Finalize release schedule and team](#finalize-release-schedule-and-team)
21-
- [Prepare main branch for development of the new release](#prepare-main-branch-for-development-of-the-new-release)
22-
- [Create a new GitHub milestone for the next release](#create-a-new-github-milestone-for-the-next-release)
23-
- [[Track] Remove previously deprecated code](#track-remove-previously-deprecated-code)
24-
- [[Track] Bump dependencies](#track-bump-dependencies)
25-
- [Create a release branch](#create-a-release-branch)
26-
- [[Continuously] Maintain the GitHub release milestone](#continuously-maintain-the-github-release-milestone)
27-
- [[Repeatedly] Cut a release](#repeatedly-cut-a-release)
28-
- [[Optional] [Track] Bump the Cluster API apiVersion](#optional-track-bump-the-cluster-api-apiversion)
29-
- [[Optional] [Track] Bump the Kubernetes version](#optional-track-bump-the-kubernetes-version)
30-
- [Communications/Docs/Release Notes Manager](#communicationsdocsrelease-notes-manager)
31-
- [Responsibilities](#responsibilities-1)
32-
- [Tasks](#tasks-1)
33-
- [Add docs to collect release notes for users and migration notes for provider implementers](#add-docs-to-collect-release-notes-for-users-and-migration-notes-for-provider-implementers)
34-
- [Update supported versions](#update-supported-versions)
35-
- [Ensure the book for the new release is available](#ensure-the-book-for-the-new-release-is-available)
36-
- [Polish release notes](#polish-release-notes)
37-
- [Change production branch in Netlify to the new release branch](#change-production-branch-in-netlify-to-the-new-release-branch)
38-
- [Update clusterctl links in the quickstart](#update-clusterctl-links-in-the-quickstart)
39-
- [Continuously: Communicate key dates to the community](#continuously-communicate-key-dates-to-the-community)
40-
- [CI Signal/Bug Triage/Automation Manager](#ci-signalbug-triageautomation-manager)
41-
- [Responsibilities](#responsibilities-2)
42-
- [Tasks](#tasks-2)
43-
- [Setup jobs and dashboards for a new release branch](#setup-jobs-and-dashboards-for-a-new-release-branch)
44-
- [[Continuously] Monitor CI signal](#continuously-monitor-ci-signal)
45-
- [[Continuously] Reduce the amount of flaky tests](#continuously-reduce-the-amount-of-flaky-tests)
46-
- [[Continuously] Bug triage](#continuously-bug-triage)
15+
- [Release Tasks](#release-tasks)
16+
- [Release Lead](#release-lead)
17+
- [Responsibilities](#responsibilities)
18+
- [Tasks](#tasks)
19+
- [Set a tentative release date for the minor release](#set-a-tentative-release-date-for-the-minor-release)
20+
- [Assemble release team](#assemble-release-team)
21+
- [Finalize release schedule and team](#finalize-release-schedule-and-team)
22+
- [Prepare main branch for development of the new release](#prepare-main-branch-for-development-of-the-new-release)
23+
- [Create a new GitHub milestone for the next release](#create-a-new-github-milestone-for-the-next-release)
24+
- [\[Track\] Remove previously deprecated code](#track-remove-previously-deprecated-code)
25+
- [\[Track\] Bump dependencies](#track-bump-dependencies)
26+
- [Create a release branch](#create-a-release-branch)
27+
- [\[Continuously\] Maintain the GitHub release milestone](#continuously-maintain-the-github-release-milestone)
28+
- [\[Repeatedly\] Cut a release](#repeatedly-cut-a-release)
29+
- [\[Optional\] \[Track\] Bump the Cluster API apiVersion](#optional-track-bump-the-cluster-api-apiversion)
30+
- [\[Optional\] \[Track\] Bump the Kubernetes version](#optional-track-bump-the-kubernetes-version)
31+
- [Communications/Docs/Release Notes Manager](#communicationsdocsrelease-notes-manager)
32+
- [Responsibilities](#responsibilities-1)
33+
- [Tasks](#tasks-1)
34+
- [Add docs to collect release notes for users and migration notes for provider implementers](#add-docs-to-collect-release-notes-for-users-and-migration-notes-for-provider-implementers)
35+
- [Update supported versions](#update-supported-versions)
36+
- [Ensure the book for the new release is available](#ensure-the-book-for-the-new-release-is-available)
37+
- [Polish release notes](#polish-release-notes)
38+
- [Change production branch in Netlify to the new release branch](#change-production-branch-in-netlify-to-the-new-release-branch)
39+
- [Update clusterctl links in the quickstart](#update-clusterctl-links-in-the-quickstart)
40+
- [Continuously: Communicate key dates to the community](#continuously-communicate-key-dates-to-the-community)
41+
- [CI Signal/Bug Triage/Automation Manager](#ci-signalbug-triageautomation-manager)
42+
- [Responsibilities](#responsibilities-2)
43+
- [Tasks](#tasks-2)
44+
- [Setup jobs and dashboards for a new release branch](#setup-jobs-and-dashboards-for-a-new-release-branch)
45+
- [\[Continuously\] Monitor CI signal](#continuously-monitor-ci-signal)
46+
- [\[Continuously\] Reduce the amount of flaky tests](#continuously-reduce-the-amount-of-flaky-tests)
47+
- [\[Continuously\] Bug triage](#continuously-bug-triage)
4748

4849
<!-- END doctoc generated TOC please keep comment here to allow auto update -->
4950

@@ -155,6 +156,7 @@ This can be done by:
155156
#### [Repeatedly] Cut a release
156157

157158
1. Ensure CI is stable before cutting the release (e.g. by checking with the CI manager)
159+
Note: special attention should be given to image scan results, so we can avoid cutting a release with CVE or document known CVEs in release notes.
158160
2. Create and push the release tags to the GitHub repository:
159161
```bash
160162
# Export the tag of the release to be cut, e.g.:
@@ -388,6 +390,8 @@ The goal of this task is to keep our tests running in CI stable.
388390
1. Create an issue using an appropriate template (failing-test) in the Cluster API repository to surface the CI failure.
389391
2. Identify if the issue is a known issue, new issue or a regression.
390392
3. Mark the issue as `release-blocking` if applicable.
393+
4. Triage periodic GitHub actions failures, with special attention to image scan results;
394+
Eventually open issues as described above.
391395

392396
#### [Continuously] Reduce the amount of flaky tests
393397

‎hack/verify-container-images.sh

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
#!/bin/bash
2+
3+
# Copyright 2022 The Kubernetes Authors.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
set -o errexit
18+
set -o nounset
19+
set -o pipefail
20+
21+
if [[ "${TRACE-0}" == "1" ]]; then
22+
set -o xtrace
23+
fi
24+
25+
TRIVY_VERSION=0.34.0
26+
27+
GO_OS="$(go env GOOS)"
28+
if [[ "${GO_OS}" == "linux" ]]; then
29+
TRIVY_OS="Linux"
30+
elif [[ "${GO_OS}" == "darwin"* ]]; then
31+
TRIVY_OS="macOS"
32+
fi
33+
34+
GO_ARCH="$(go env GOARCH)"
35+
if [[ "${GO_ARCH}" == "amd" ]]; then
36+
TRIVY_ARCH="32bit"
37+
elif [[ "${GO_ARCH}" == "amd64"* ]]; then
38+
TRIVY_ARCH="64bit"
39+
elif [[ "${GO_ARCH}" == "arm" ]]; then
40+
TRIVY_ARCH="ARM"
41+
elif [[ "${GO_ARCH}" == "arm64" ]]; then
42+
TRIVY_ARCH="ARM64"
43+
fi
44+
45+
TOOL_BIN=hack/tools/bin
46+
mkdir -p ${TOOL_BIN}
47+
48+
# Downloads trivy scanner
49+
curl -L -o ${TOOL_BIN}/trivy.tar.gz "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_${TRIVY_OS}-${TRIVY_ARCH}.tar.gz"
50+
51+
tar -xf "${TOOL_BIN}/trivy.tar.gz" -C "${TOOL_BIN}" trivy
52+
chmod +x ${TOOL_BIN}/trivy
53+
rm ${TOOL_BIN}/trivy.tar.gz
54+
55+
# Builds all the container images to be scanned and cleans up changes to ./*manager_image_patch.yaml ./*manager_pull_policy.yaml.
56+
make REGISTRY=gcr.io/k8s-staging-cluster-api PULL_POLICY=IfNotPresent TAG=dev docker-build
57+
make clean-release-git
58+
59+
# Scan the images
60+
${TOOL_BIN}/trivy image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/clusterctl-"${GO_ARCH}":dev && R1=$? || R1=$?
61+
${TOOL_BIN}/trivy image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/test-extension-"${GO_ARCH}":dev && R2=$? || R2=$?
62+
${TOOL_BIN}/trivy image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/kubeadm-control-plane-controller-"${GO_ARCH}":dev && R3=$? || R3=$?
63+
${TOOL_BIN}/trivy image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/kubeadm-bootstrap-controller-"${GO_ARCH}":dev && R4=$? || R4=$?
64+
${TOOL_BIN}/trivy image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/cluster-api-controller-"${GO_ARCH}":dev && R5=$? || R5=$?
65+
${TOOL_BIN}/trivy image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/capd-manager-"${GO_ARCH}":dev && R6=$? || R6=$?
66+
67+
echo ""
68+
BRed='\033[1;31m'
69+
BGreen='\033[1;32m'
70+
NC='\033[0m' # No
71+
72+
if [ "$R1" -ne "0" ] || [ "$R2" -ne "0" ] || [ "$R3" -ne "0" ] || [ "$R4" -ne "0" ] || [ "$R5" -ne "0" ] || [ "$R6" -ne "0" ]
73+
then
74+
echo -e "${BRed}Check container images failed! There are vulnerability to be fixed${NC}"
75+
exit 1
76+
fi
77+
78+
echo -e "${BGreen}Check container images passed! No vulnerability found${NC}"

0 commit comments

Comments
 (0)