Skip to content

Commit 0a0ffb6

Browse files
ddelnanoddelnano
authored
[trivy] Include vizier and cloud dependency images in image scan (#2231)
Summary: [trivy] Include vizier and cloud dependency images in image scan While are aware of CVEs and vulnerabilities with Pixie's code, our dependency images are a blind spot in our security scanning. This change updates the trivy-image GitHub action to include the cloud and vizier dependency images so we can address those vulnerabilities in a timely manner. This change makes it possible to add the operator dependency images in the future, but for now I've omitted them (dealing with helm is a bit challenging without some additional work). Relevant Issues: N/A Type of change: /kind dependencies Test Plan: Verified the following - [x] Simulated test works ``` $ bazel build k8s/cloud:cloud_image_list $ cat bazel-bin/k8s/cloud/cloud_image_list.txt | grep -v '\/cloud' | xargs -I{} sh -c 'trivy image {}' $ bazel build k8s/vizier:vizier_image_list $ cat bazel-bin/k8s/vizier/vizier_image_list.txt | grep -v '\/vizier' | xargs -I{} sh -c 'trivy image {}' ``` - [x] GitHub action completed successfully ([link](https://github.com/pixie-io/pixie/actions/runs/16327263639)) --------- Signed-off-by: Dom Del Nano <ddelnano@gmail.com>
1 parent 1ad28c4 commit 0a0ffb6

File tree

3 files changed

+95
-4
lines changed

3 files changed

+95
-4
lines changed

‎.github/workflows/trivy_images.yaml‎

Lines changed: 30 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -47,14 +47,40 @@ jobs:
4747
# yamllint disable rule:line-length
4848
run: |
4949
mkdir -p sarif/${{ matrix.artifact }}
50-
./bazel-bin/k8s/${{ matrix.artifact }}/list_image_bundle | xargs -I{} sh -c 'trivy image {} --format=sarif --output=sarif/${{ matrix.artifact }}/$(basename {} | cut -d":" -f1).sarif'
50+
./bazel-bin/k8s/${{ matrix.artifact }}/list_image_bundle | xargs -I{} sh -c 'trivy image --scanners vuln {} --format=sarif --output=sarif/${{ matrix.artifact }}/$(basename {} | cut -d":" -f1).sarif'
51+
52+
# TODO(ddelnano): Remove this check once the operator dependency images are supported.
53+
# This requires rendering helm templates and requires some additional work.
54+
if [ "${{ matrix.artifact }}" = "operator" ]; then
55+
echo "Skipping operator image scan for now."
56+
exit 0
57+
fi
58+
59+
echo "Found non bazel images for ${{ matrix.artifact }}."
60+
./scripts/bazel_ignore_codes.sh build \
61+
//k8s/${{ matrix.artifact }}:${{ matrix.artifact }}_image_list
62+
63+
mkdir -p sarif/${{ matrix.artifact }}_deps
64+
# Ignore images whose basename is "/${{ matrix.artifact }}" to avoid scanning the bazel built images (e.g. /vizier-, /cloud-)
65+
# The deps images must have their file named processed differently to avoid conflicts with the image name. For example,
66+
# ory/hydra:v1.9.2-alpine and ory/hydra:v1.9.2-sqlite must not conflict.
67+
cat ./bazel-bin/k8s/${{ matrix.artifact }}/${{ matrix.artifact }}_image_list.txt | grep -v "\/${{ matrix.artifact }}" | xargs -I{} sh -c 'trivy image --scanners vuln {} --format=sarif --output=sarif/${{ matrix.artifact }}_deps/$(basename {} | cut -d"@" -f1 | tr ":" "_").sarif'
5168
# yamllint enable rule:line-length
5269
- run: |
53-
for f in "sarif/${{ matrix.artifact }}/"*; do
70+
# Loop through all ${artifact} and ${artifact}_deps sarif files
71+
for f in "sarif/${{ matrix.artifact }}"*/*; do
5472
jq '.runs[].tool.driver.name = "trivy-images"' < "$f" > tmp
55-
mv tmp "$f"
73+
# The runAutomationDetails's object must contain a unique category as required by the CodeQL SARIF uploader
74+
# The id value will be interpreted like so: "${category}/${run_id}"
75+
filename=$(basename "$f")/
76+
jq --arg id "$filename" '.runs[].automationDetails.id = $id' < tmp > "$f"
5677
done
5778
- uses: github/codeql-action/upload-sarif@1b549b9259bda1cb5ddde3b41741a82a2d15a841 # v3.28.13
5879
with:
5980
sarif_file: sarif/${{ matrix.artifact }}
60-
category: trivy-images
81+
# TODO(ddelnano): Remove this check once the operator dependency images are supported.
82+
# This requires rendering helm templates and requires some additional work.
83+
- uses: github/codeql-action/upload-sarif@1b549b9259bda1cb5ddde3b41741a82a2d15a841 # v3.28.13
84+
if: ${{ matrix.artifact != 'operator' }}
85+
with:
86+
sarif_file: sarif/${{ matrix.artifact }}_deps

‎k8s/cloud/BUILD.bazel‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,26 @@ kustomize_build(
7979
],
8080
)
8181

82+
kustomize_build(
83+
name = "pixie_oss_cloud",
84+
srcs = glob(
85+
[
86+
"base/**/*.yaml",
87+
"overlays/**/*.yaml",
88+
"public/**/*.yaml",
89+
],
90+
exclude = ["public/kustomization.yaml"],
91+
),
92+
kustomization = "public/kustomization.yaml",
93+
replacements = image_replacements(
94+
image_map = CLOUD_IMAGE_TO_LABEL,
95+
),
96+
toolchains = [
97+
"//k8s:image_prefix",
98+
"//k8s:bundle_version",
99+
],
100+
)
101+
82102
container_bundle(
83103
name = "image_bundle",
84104
images = CLOUD_IMAGE_TO_LABEL,
@@ -102,3 +122,16 @@ container_push(
102122
bundle = ":image_bundle",
103123
format = "Docker",
104124
)
125+
126+
genrule(
127+
name = "cloud_image_list",
128+
srcs = [
129+
":pixie_oss_cloud",
130+
"//k8s/cloud_deps:public",
131+
],
132+
outs = ["cloud_image_list.txt"],
133+
cmd = """
134+
$(location @com_github_mikefarah_yq_v4//:v4) '..|.image?|select(.|type == "!!str")' -o json $(SRCS) | sort | uniq > $@
135+
""",
136+
tools = ["@com_github_mikefarah_yq_v4//:v4"],
137+
)

‎k8s/cloud_deps/BUILD.bazel‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Copyright 2018- The Pixie Authors.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
#
15+
# SPDX-License-Identifier: Apache-2.0
16+
17+
load("//bazel:kustomize.bzl", "kustomize_build")
18+
19+
package(default_visibility = ["//visibility:public"])
20+
21+
kustomize_build(
22+
name = "public",
23+
srcs = glob(
24+
[
25+
"base/**/*.yaml",
26+
"dev/**/*.yaml",
27+
"public/**/*.yaml",
28+
],
29+
exclude = ["public/kustomization.yaml"],
30+
),
31+
kustomization = "public/kustomization.yaml",
32+
)

0 commit comments

Comments
 (0)