Skip to content

Commit c92c7d8

Browse files
fbelter-iteratecfbelter-iteratec
committed
Add trivy k8s scan support
Signed-off-by: Frank Belter <frank.belter@iteratec.com> Add trivy k8s scan support and Upgrade trivy from 0.37.3 to 0.39.1 Signed-off-by: Frank Belter <frank.belter@iteratec.com> Add missing license header to 'examples/k8s/scan.yaml' Signed-off-by: Frank Belter <frank.belter@iteratec.com> Fix unit-tests for trivy-scanner Signed-off-by: Frank Belter <frank.belter@iteratec.com> Adjusts parsing of trivy scan results to version Trivy version 0.42 Signed-off-by: Frank Belter <frank.belter@iteratec.com>
1 parent d983486 commit c92c7d8

18 files changed

Lines changed: 245659 additions & 15 deletions

‎CONTRIBUTORS.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,3 +49,4 @@ Committing with `git commit -s` will add the sign-off at the end of the commit m
4949
- Sofia Lohr <sofia.lohr@iteratec.com>
5050
- Vanessa Hermann <vanessa.hermann@iteratec.com>
5151
- Lukas Fischer <lukas.fischer@iteratec.com>
52+
- Frank Belter <frank.belter@iteratec.com>

‎scanners/trivy/.helm-docs.gotmpl‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,13 +39,15 @@ The following security scan configuration example are based on the [Trivy Docume
3939

4040
### Trivy Container Image Scan
4141

42-
Currently we support the follwing 3 scanTypes, corresponding to the trivy scanning modes:
42+
Currently we support the follwing 4 scanTypes, corresponding to the trivy scanning modes:
4343
- scanType: "trivy-image"
4444
- parameters: `[YOUR_IMAGE_NAME]`
4545
- scanType: "trivy-filesystem"
4646
- parameters: `[YOUR_PATH_TO_FILES]`
4747
- scanType: "trivy-repo"
4848
- parameters: `[YOUR_GITHUB_REPO]`
49+
- scanType: "trivy-k8s"
50+
- parameters: `[KUBERNETES_RESOURCE]`
4951

5052
A complete example of each scanType are listed below in our [example docs section](https://www.securecodebox.io/docs/scanners/trivy/#examples).
5153

‎scanners/trivy/examples/k8s/README.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
<!--
2+
SPDX-FileCopyrightText: the secureCodeBox authors
3+
4+
SPDX-License-Identifier: Apache-2.0
5+
-->
6+
7+
This example shows how to use the `trivy k8s` scan with the secureCodeBox.

‎scanners/trivy/examples/k8s/scan.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# SPDX-FileCopyrightText: the secureCodeBox authors
2+
#
3+
# SPDX-License-Identifier: Apache-2.0
4+
5+
apiVersion: "execution.securecodebox.io/v1"
6+
kind: Scan
7+
metadata:
8+
name: "trivy-k8s"
9+
spec:
10+
scanType: "trivy-k8s"
11+
parameters:
12+
- "cluster"

‎scanners/trivy/integration-tests/trivy.test.js‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,3 +98,31 @@ test(
9898
},
9999
3 * 60 * 1000
100100
);
101+
102+
test(
103+
"trivy k8s scan should not fail",
104+
async () => {
105+
const { categories, severities, count } = await scan(
106+
"trivy-k8s-test",
107+
"trivy-k8s",
108+
["cluster"],
109+
10 * 60 * 1000
110+
);
111+
112+
// since the state of the k8s cluster in the test environment cannot be predicted, only the structure of the result is assured here
113+
expect(count).toBeGreaterThanOrEqual(1);
114+
115+
const categoryNames = Object.keys(categories);
116+
expect(categoryNames).toHaveLength(2);
117+
expect(categoryNames.includes("Misconfiguration")).toBeTruthy();
118+
expect(categoryNames.includes("Vulnerability")).toBeTruthy();
119+
120+
const severityNames = Object.keys(severities);
121+
expect(severityNames).toHaveLength(4);
122+
expect(severityNames.includes("high")).toBeTruthy();
123+
expect(severityNames.includes("informational")).toBeTruthy();
124+
expect(severityNames.includes("low")).toBeTruthy();
125+
expect(severityNames.includes("medium")).toBeTruthy();
126+
},
127+
10 * 60 * 1000
128+
);

0 commit comments

Comments
 (0)