Skip to content

Commit 8239741

Browse files
author
Lukas Fischer
committed
#911 Document trivy vulnerability database cache
Update the documentation to reflect that the trivy vulnerability DB is now by default served by a trivy server container. This shortens this section of the documentation quite a bit, because most of it was example code to set up what is now integrated. Signed-off-by: Lukas Fischer <lukas.fischer@iteratec.com>
1 parent ec87d50 commit 8239741

3 files changed

Lines changed: 15 additions & 258 deletions

File tree

‎scanners/trivy/.helm-docs.gotmpl‎

Lines changed: 5 additions & 86 deletions
Original file line numberDiff line numberDiff line change
@@ -68,95 +68,14 @@ spec:
6868
```
6969

7070
### Scanning Many Targets
71-
By default, the docker container of trivy will download new rulesets when starting the process.
71+
By default, the docker container of trivy will download the vulnerability database when starting the process.
7272
As this download is performed directly from GitHub, you will run into API rate limiting issues after roughly 50 requests.
73-
Trivy [supports a client-server mode](https://aquasecurity.github.io/trivy/latest/advanced/modes/client-server/) where one process downloads a copy of the rule database and provides it to the others.
74-
Due to [limitations in trivy](https://github.com/aquasecurity/trivy/issues/634), this mode currently only supports scanning container images.
75-
If this fits your use case, you can deploy a rule service with the following template:
76-
```yaml
77-
# First declare a service that will serve requests to the rule pod
78-
kind: Service
79-
apiVersion: v1
80-
metadata:
81-
name: trivy-rules
82-
# Update the namespace here if you are using a different one
83-
namespace: default
84-
labels:
85-
app: trivy-rules
86-
spec:
87-
selector:
88-
app: trivy-rules
89-
ports:
90-
- port: 8080
91-
protocol: TCP
92-
targetPort: 8080
93-
type: ClusterIP
94-
---
95-
# Now declare the actual deployment of the rule server
96-
apiVersion: apps/v1
97-
kind: Deployment
98-
metadata:
99-
name: trivy-rules
100-
# Again, update the namespace here
101-
namespace: default
102-
labels:
103-
app: trivy-rules
104-
spec:
105-
replicas: 1
106-
selector:
107-
matchLabels:
108-
app: trivy-rules
109-
template:
110-
metadata:
111-
labels:
112-
app: trivy-rules
113-
spec:
114-
containers:
115-
- name: trivy-rules
116-
# Don't forget to set this to a version matching that used in secureCodeBox
117-
image: aquasec/trivy:0.20.2
118-
imagePullPolicy: Always
119-
args:
120-
- "server"
121-
- "--listen"
122-
- "0.0.0.0:8080"
123-
ports:
124-
- containerPort: 8080
125-
protocol: TCP
126-
```
127-
128-
You can then start scans of images using the client mode. For example:
73+
Trivy [supports a client-server mode](https://aquasecurity.github.io/trivy/latest/docs/references/modes/client-server/) where one process downloads a copy of the vulnerability database and provides it to the others.
12974

130-
```yaml
131-
apiVersion: "execution.securecodebox.io/v1"
132-
kind: Scan
133-
metadata:
134-
name: "test-trivy"
135-
# Don't forget to update the namespace if necessary
136-
namespace: default
137-
spec:
138-
scanType: "trivy-image"
139-
parameters:
140-
- "client"
141-
# Again, add the extra parameters here (required to make the parser work)
142-
# But don't add the --no-progress switch.
143-
- "--format"
144-
- "json"
145-
- "--output"
146-
- "/home/securecodebox/trivy-results.json"
147-
# Specify the rule service internal DNS name here.
148-
# (Substitute a different namespace if you changed it)
149-
- "--remote"
150-
- "http://trivy-rules.default.svc:8080"
151-
# Finally, specify the image you want to scan
152-
- "securecodebox/operator:3.0.0"
153-
```
75+
This mode is implemented and active by default.
76+
A separate Deployment for the trivy server will be created during the installation and the trivy scanTypes are automatically configured to run in client mode and connect to the server.
15477

155-
If you want to scan anything other than docker images, you currently [cannot use the client-server mode](https://github.com/aquasecurity/trivy/issues/634) described above.
156-
Instead, you have to [manually download the ruleset and provide it to trivy](https://aquasecurity.github.io/trivy/latest/advanced/air-gap/).
157-
In practice, this is a difficult problem because the most natural method for providing these files in kubernetes, ConfigMaps, has a size limit of 1 MB, while the vulnerability database is over 200 MB in size (28 MB after compression).
158-
Your best bet would thus be to serve the files from your own servers and load them into the scanner [using an initContainer](https://www.securecodebox.io/docs/api/crds/scan#initcontainers-optional), taking care to keep the databases on your server up to date.
159-
Consult the [trivy documentation](https://aquasecurity.github.io/trivy/latest/advanced/air-gap/) for additional details on the required steps.
78+
In case only a single scan or very few are run, and you want to avoid the small performance overhead, client/server mode can be disabled by setting `--set="trivyDatabaseCache.enabled=false"` during helm install.
16079
{{- end }}
16180

16281
{{- define "extra.chartConfigurationSection" -}}

‎scanners/trivy/README.md‎

Lines changed: 5 additions & 86 deletions
Original file line numberDiff line numberDiff line change
@@ -85,95 +85,14 @@ spec:
8585
```
8686
8787
### Scanning Many Targets
88-
By default, the docker container of trivy will download new rulesets when starting the process.
88+
By default, the docker container of trivy will download the vulnerability database when starting the process.
8989
As this download is performed directly from GitHub, you will run into API rate limiting issues after roughly 50 requests.
90-
Trivy [supports a client-server mode](https://aquasecurity.github.io/trivy/latest/advanced/modes/client-server/) where one process downloads a copy of the rule database and provides it to the others.
91-
Due to [limitations in trivy](https://github.com/aquasecurity/trivy/issues/634), this mode currently only supports scanning container images.
92-
If this fits your use case, you can deploy a rule service with the following template:
93-
```yaml
94-
# First declare a service that will serve requests to the rule pod
95-
kind: Service
96-
apiVersion: v1
97-
metadata:
98-
name: trivy-rules
99-
# Update the namespace here if you are using a different one
100-
namespace: default
101-
labels:
102-
app: trivy-rules
103-
spec:
104-
selector:
105-
app: trivy-rules
106-
ports:
107-
- port: 8080
108-
protocol: TCP
109-
targetPort: 8080
110-
type: ClusterIP
111-
---
112-
# Now declare the actual deployment of the rule server
113-
apiVersion: apps/v1
114-
kind: Deployment
115-
metadata:
116-
name: trivy-rules
117-
# Again, update the namespace here
118-
namespace: default
119-
labels:
120-
app: trivy-rules
121-
spec:
122-
replicas: 1
123-
selector:
124-
matchLabels:
125-
app: trivy-rules
126-
template:
127-
metadata:
128-
labels:
129-
app: trivy-rules
130-
spec:
131-
containers:
132-
- name: trivy-rules
133-
# Don't forget to set this to a version matching that used in secureCodeBox
134-
image: aquasec/trivy:0.20.2
135-
imagePullPolicy: Always
136-
args:
137-
- "server"
138-
- "--listen"
139-
- "0.0.0.0:8080"
140-
ports:
141-
- containerPort: 8080
142-
protocol: TCP
143-
```
144-
145-
You can then start scans of images using the client mode. For example:
90+
Trivy [supports a client-server mode](https://aquasecurity.github.io/trivy/latest/docs/references/modes/client-server/) where one process downloads a copy of the vulnerability database and provides it to the others.
14691
147-
```yaml
148-
apiVersion: "execution.securecodebox.io/v1"
149-
kind: Scan
150-
metadata:
151-
name: "test-trivy"
152-
# Don't forget to update the namespace if necessary
153-
namespace: default
154-
spec:
155-
scanType: "trivy-image"
156-
parameters:
157-
- "client"
158-
# Again, add the extra parameters here (required to make the parser work)
159-
# But don't add the --no-progress switch.
160-
- "--format"
161-
- "json"
162-
- "--output"
163-
- "/home/securecodebox/trivy-results.json"
164-
# Specify the rule service internal DNS name here.
165-
# (Substitute a different namespace if you changed it)
166-
- "--remote"
167-
- "http://trivy-rules.default.svc:8080"
168-
# Finally, specify the image you want to scan
169-
- "securecodebox/operator:3.0.0"
170-
```
92+
This mode is implemented and active by default.
93+
A separate Deployment for the trivy server will be created during the installation and the trivy scanTypes are automatically configured to run in client mode and connect to the server.
17194
172-
If you want to scan anything other than docker images, you currently [cannot use the client-server mode](https://github.com/aquasecurity/trivy/issues/634) described above.
173-
Instead, you have to [manually download the ruleset and provide it to trivy](https://aquasecurity.github.io/trivy/latest/advanced/air-gap/).
174-
In practice, this is a difficult problem because the most natural method for providing these files in kubernetes, ConfigMaps, has a size limit of 1 MB, while the vulnerability database is over 200 MB in size (28 MB after compression).
175-
Your best bet would thus be to serve the files from your own servers and load them into the scanner [using an initContainer](https://www.securecodebox.io/docs/api/crds/scan#initcontainers-optional), taking care to keep the databases on your server up to date.
176-
Consult the [trivy documentation](https://aquasecurity.github.io/trivy/latest/advanced/air-gap/) for additional details on the required steps.
95+
In case only a single scan or very few are run, and you want to avoid the small performance overhead, client/server mode can be disabled by setting `--set="trivyDatabaseCache.enabled=false"` during helm install.
17796

17897
## Requirements
17998

‎scanners/trivy/docs/README.ArtifactHub.md‎

Lines changed: 5 additions & 86 deletions
Original file line numberDiff line numberDiff line change
@@ -92,95 +92,14 @@ spec:
9292
```
9393
9494
### Scanning Many Targets
95-
By default, the docker container of trivy will download new rulesets when starting the process.
95+
By default, the docker container of trivy will download the vulnerability database when starting the process.
9696
As this download is performed directly from GitHub, you will run into API rate limiting issues after roughly 50 requests.
97-
Trivy [supports a client-server mode](https://aquasecurity.github.io/trivy/latest/advanced/modes/client-server/) where one process downloads a copy of the rule database and provides it to the others.
98-
Due to [limitations in trivy](https://github.com/aquasecurity/trivy/issues/634), this mode currently only supports scanning container images.
99-
If this fits your use case, you can deploy a rule service with the following template:
100-
```yaml
101-
# First declare a service that will serve requests to the rule pod
102-
kind: Service
103-
apiVersion: v1
104-
metadata:
105-
name: trivy-rules
106-
# Update the namespace here if you are using a different one
107-
namespace: default
108-
labels:
109-
app: trivy-rules
110-
spec:
111-
selector:
112-
app: trivy-rules
113-
ports:
114-
- port: 8080
115-
protocol: TCP
116-
targetPort: 8080
117-
type: ClusterIP
118-
---
119-
# Now declare the actual deployment of the rule server
120-
apiVersion: apps/v1
121-
kind: Deployment
122-
metadata:
123-
name: trivy-rules
124-
# Again, update the namespace here
125-
namespace: default
126-
labels:
127-
app: trivy-rules
128-
spec:
129-
replicas: 1
130-
selector:
131-
matchLabels:
132-
app: trivy-rules
133-
template:
134-
metadata:
135-
labels:
136-
app: trivy-rules
137-
spec:
138-
containers:
139-
- name: trivy-rules
140-
# Don't forget to set this to a version matching that used in secureCodeBox
141-
image: aquasec/trivy:0.20.2
142-
imagePullPolicy: Always
143-
args:
144-
- "server"
145-
- "--listen"
146-
- "0.0.0.0:8080"
147-
ports:
148-
- containerPort: 8080
149-
protocol: TCP
150-
```
97+
Trivy [supports a client-server mode](https://aquasecurity.github.io/trivy/latest/docs/references/modes/client-server/) where one process downloads a copy of the vulnerability database and provides it to the others.
15198
152-
You can then start scans of images using the client mode. For example:
153-
154-
```yaml
155-
apiVersion: "execution.securecodebox.io/v1"
156-
kind: Scan
157-
metadata:
158-
name: "test-trivy"
159-
# Don't forget to update the namespace if necessary
160-
namespace: default
161-
spec:
162-
scanType: "trivy-image"
163-
parameters:
164-
- "client"
165-
# Again, add the extra parameters here (required to make the parser work)
166-
# But don't add the --no-progress switch.
167-
- "--format"
168-
- "json"
169-
- "--output"
170-
- "/home/securecodebox/trivy-results.json"
171-
# Specify the rule service internal DNS name here.
172-
# (Substitute a different namespace if you changed it)
173-
- "--remote"
174-
- "http://trivy-rules.default.svc:8080"
175-
# Finally, specify the image you want to scan
176-
- "securecodebox/operator:3.0.0"
177-
```
99+
This mode is implemented and active by default.
100+
A separate Deployment for the trivy server will be created during the installation and the trivy scanTypes are automatically configured to run in client mode and connect to the server.
178101
179-
If you want to scan anything other than docker images, you currently [cannot use the client-server mode](https://github.com/aquasecurity/trivy/issues/634) described above.
180-
Instead, you have to [manually download the ruleset and provide it to trivy](https://aquasecurity.github.io/trivy/latest/advanced/air-gap/).
181-
In practice, this is a difficult problem because the most natural method for providing these files in kubernetes, ConfigMaps, has a size limit of 1 MB, while the vulnerability database is over 200 MB in size (28 MB after compression).
182-
Your best bet would thus be to serve the files from your own servers and load them into the scanner [using an initContainer](https://www.securecodebox.io/docs/api/crds/scan#initcontainers-optional), taking care to keep the databases on your server up to date.
183-
Consult the [trivy documentation](https://aquasecurity.github.io/trivy/latest/advanced/air-gap/) for additional details on the required steps.
102+
In case only a single scan or very few are run, and you want to avoid the small performance overhead, client/server mode can be disabled by setting `--set="trivyDatabaseCache.enabled=false"` during helm install.
184103

185104
## Requirements
186105

0 commit comments

Comments
 (0)