8000 Enable ContainerAutodiscovery to scan images from private repos (ADR 17)(closes #1189) by the-simmon · Pull Request #1557 · secureCodeBox/secureCodeBox · GitHub
[go: up one dir, main page]
Skip to content

Enable ContainerAutodiscovery to scan images from private repos (ADR 17)(closes #1189) #1557

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
Weltraumschaf merged 63 commits into from
Mar 17, 2023
Merged

Enable ContainerAutodiscovery to scan images from private repos (ADR 17)(closes #1189) #1557

Weltraumschaf merged 63 commits into from
Mar 17, 2023

Conversation

@the-simmon
Copy link
Contributor
@the-simmon the-simmon commented Jan 21, 2023

fixes #1189

@the-simmon the-simmon self-assigned this Jan 21, 2023
@github-actions
Copy link
github-actions bot commented Jan 21, 2023 •
edited
Loading

MegaLinter status: ⚠️ WARNING

Descriptor Linter Files Fixed Errors Elapsed time
⚠️ ACTION actionlint 2 3 0.37s
✅ BASH shfmt 1 0 0.01s
⚠️ DOCKERFILE hadolint 1 1 0.07s
⚠️ GO golangci-lint 6 6 9.51s
⚠️ JAVASCRIPT eslint 1 1 1.04s
✅ JSON eslint-plugin-jsonc 3 0 1.71s
⚠️ PYTHON black 4 1 0.67s
✅ SPELL misspell 21 0 0.09s
⚠️ YAML prettier 5 1 1.5s

See errors details in artifact MegaLinter reports on CI Job page
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

@rfelber rfelber force-pushed the adr_17_autodiscovery_private_registry branch from 47b8d4d to 057139e Compare January 25, 2023 14:35
@rfelber rfelber changed the title ADR 17 Enable ContainerAutodiscovery to scan images from private repos Enable ContainerAutodiscovery to scan images from private repos (ADR 17)(closes #1189) Jan 25, 2023
@rfelber rfelber added the enhancement New feature or request label Jan 25, 2023
@the-simmon the-simmon force-pushed the adr_17_autodiscovery_private_registry branch from 057139e to 47b8d4d Compare January 25, 2023 14:52
@malexmave
Copy link
Member
malexmave commented Jan 25, 2023

The Python part looks good to me.

@the-simmon the-simmon marked this pull request as ready for review January 25, 2023 16:56
@the-simmon
Add initcontianer that extracts matching imagepullsecrets #1189
9d732c9 
Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@the-simmon
Add ownerreference to temporary container autodiscovery secret #1189
08ecdbc 
Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@the-simmon
Fix python docstrings in secretextractioninitcontainer #1189
292e4a1 
Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@the-simmon
Add readme to secretextractioninitcontainer explaining steps to creat…
9294ecf 
…e a local docker registry #1189

Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@the-simmon
Mock kubernetes import in unit test to be able to run tests with the …
cde0395 
…kubernetes packages installed #1189

Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@the-simmon
Add makefile #1189
22c2683 
Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@the-simmon
Add secretextractioninitcontainer to ci workflow #1189
0e7ae97 
Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@the-simmon
Update ci python version to 3.9 to support type hints used in secrete…
5cf8d9e 
…xtractioninitcontainer #1189

Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@the-simmon
Fix type in tests
be13ac0 
Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@the-simmon
Add unit tests for container autodiscovery with imagepullsecrets #1189
2f75c85 
Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@the-simmon
Fix seg fault in test #1189
715a9cc 
Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@the-simmon
Fix bug with nil arrays in existing container autodiscovery tests #1189
229821d 
Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@the-simmon
Add switch to enable secret mapping to container autodiscovery config #…
0424929 
…1189

Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@the-simmon
Add imagepullsecret logic to container autodiscovery #1189
cf3cbc8 
Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@the-simmon
Fix docker export name of secretextractioncontainer in ci #1189
c331c47 
Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@the-simmon
Add args to initcontainer in container autodiscovery #1189
3850793 
Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@the-simmon
Move secret volume mounts to initcontainer instead of scan #1189
4b78ac7 
Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@the-simmon
Add envvars with temporary secret to trivy container #1189
459af28 
Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@the-simmon
Rename temporary secret #1189
3d29862 
Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@the-simmon
Only map secrets to env when enabled #1189
55f21c6 
Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@the-simmon
Remove redundant statement #1189
4bb56fd 
Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@the-simmon the-simmon force-pushed the adr_17_autodiscovery_private_registry branch from 752d943 to d00740a Compare February 8, 2023 12:36
@the-simmon
Set correct python in ci unit test #1189
c978036 
Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@the-simmon the-simmon force-pushed the adr_17_autodiscovery_private_registry branch from a419a13 to c978036 Compare February 8, 2023 12:44
@the-simmon
Fix ci syntax #1189
bd03c56 
Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@the-simmon
Replace assertEqual with assertCountEqual to ensure tests are indepen…
acbaa50 
…dent of list order #1189

Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@the-simmon
Fix python unit test where list assertion fails because list order is…
bd06b02 
… different #1189

Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@the-simmon
Add working dir to ci integration test for pull secret extractation c…
1582605 
…ontainer #1189

Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@the-simmon
Add npm ci to makefile to install required modules before integration…
5fa3abe 
… test #1189

Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@the-simmon
Add pull secret extractor to release yaml #1189
3949390 
Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@the-simmon the-simmon force-pushed the adr_17_autodiscovery_private_registry branch from 3bacc71 to 3949390 Compare February 8, 2023 14:00
the-simmon and others added 14 commits February 8, 2023 15:45
@the-simmon
Add prereleased trigger to release build yaml #1189
718356d 
Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@the-simmon
Fix dockerhub name of pull secret extractor #1189
1be050a 
Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@the-simmon
Change name in release build to unique one #1189
37b37ee 
Signed-off-by: Simon Hülkenberg <simon.huelkenberg@iteratec.com>
@Weltraumschaf
Merge branch 'main' into adr_17_autodiscovery_private_registry
cdb6a6d
@Weltraumschaf
Merge branch 'main' into adr_17_autodiscovery_private_registry
c6ac930
@J12934
Merge branch 'main' into adr_17_autodiscovery_private_registry
77fd1ae
@J12934
Auto format test file
56178f3
@J12934
Fix author and license for package json in test dir
f5b1d29
@J12934
Fix name of trivy environment variables
57de936
@J12934
Only create trivy auto-discovery scanType when explicitly enabled
82e69c8 
Not all people have the permission ro create rbac rules.
This ensures that they can still use trivy normally.
@J12934
Change baseimage for consistency with our other python containers
2c0da66
@J12934
Fix message formatting and add success log
5064c6c
@J12934
Change casing of Dockerfile to match all our other dockerfile
17c6127
@J12934
Explicitly copy files to a folder
0849b0d 
Signed-off-by: Jannik Hollenbach <jannik.hollenbach@iteratec.com>
@Weltraumschaf Weltraumschaf merged commit 6aba062 into main Mar 17, 2023
@Weltraumschaf Weltraumschaf deleted the adr_17_autodiscovery_private_registry branch March 17, 2023 13:05
Ilyesbdlala added a commit that referenced this pull request Mar 21, 2023
@Ilyesbdlala
Apply changes to allow multiple ScanConfigs to work with #1557
320d968 
These issues arose after a rebase

Signed-off-by: Ilyes Ben Dlala <ilyes.bendlala@iteratec.com>
Ilyesbdlala added a commit that referenced this pull request Mar 22, 2023
@Ilyesbdlala
Apply changes to allow multiple ScanConfigs to work with #1557
6c7388e 
These issues arose after a rebase

Signed-off-by: Ilyes Ben Dlala <ilyes.bendlala@iteratec.com>
Ilyesbdlala added a commit that referenced this pull request Mar 22, 2023
@Ilyesbdlala
Apply changes to allow multiple ScanConfigs to work with #1557
15777df 
These issues arose after a rebase

Signed-off-by: Ilyes Ben Dlala <ilyes.bendlala@iteratec.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@J12934 J12934 J12934 approved these changes

Assignees

@the-simmon the-simmon

Labels

auto-discovery enhancement New feature or request

Projects

secureCodeBox
Archived in project

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Enable Container AutoDiscovery to work with non public images

6 participants

@the-simmon @malexmave @J12934 @Weltraumschaf @rfelber
0