Skip to content
This repository has been archived by the owner on Apr 30, 2021. It is now read-only.

check-vulnerabilities: Stop whitelisting some images that just need pulling down first #1133

Merged
merged 1 commit into from
May 7, 2020
Merged

check-vulnerabilities: Stop whitelisting some images that just need pulling down first #1133

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions components/concourse-task-toolbox/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ RUN apk add --update \
mailcap \
ncurses \
rpm \
docker \
&& pip3 install awscli s3cmd yq PyYAML kubernetes \
&& apk -v --purge del py3-pip \
&& rm /var/cache/apk/*
Expand Down
14 changes: 10 additions & 4 deletions components/concourse-task-toolbox/bin/findCVEs.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,18 +14,22 @@
'quay.io/coreos/configmap-reload:v0.0.1', # error in image scan: scan failed: failed to apply layers: unknown OS
'quay.io/coreos/prometheus-config-reloader:v0.38.1', # error in image scan: scan failed: failed to apply layers: unknown OS
'quay.io/coreos/prometheus-operator:v0.38.1', # error in image scan: scan failed: failed to apply layers: unknown OS
'quay.io/kiali/kiali:v1.9', # error in image scan: failed analysis: analyze error: unable to analyze config: json marshal error: unexpected end of JSON input
'quay.io/prometheus/node-exporter:v0.18.1', # error in image scan: scan failed: failed to apply layers: unknown OS
'quay.io/prometheus/prometheus:v2.17.2', # error in image scan: scan failed: failed to apply layers: unknown OS
'quay.io/bitnami/sealed-secrets-controller:v0.7.0', # error in image scan: failed analysis: analyze error: unable to analyze config: json marshal error: unexpected end of JSON input
'quay.io/calico/node:v3.8.1', # error in image scan: failed analysis: analyze error: unable to analyze config: json marshal error: unexpected end of JSON input
'quay.io/open-policy-agent/gatekeeper:v3.0.4-beta.1', # error in image scan: failed analysis: analyze error: unable to analyze config: json marshal error: unexpected end of JSON input
]
GLOBAL_IMAGE_SOURCE_WHITELIST = [
'.dkr.ecr.eu-west-2.amazonaws.com/', # ECR
'.dkr.ecr.us-west-2.amazonaws.com/', # ECR - for EKS upstream
]

# This is to work around trivy being unwilling to work with their seemingly broken responses, see https://github.com/aquasecurity/trivy/issues/401#issuecomment-611454832
PULL_FIRST = [
'quay.io/bitnami/sealed-secrets-controller:v0.7.0',
'quay.io/calico/node:v3.8.1',
'quay.io/open-policy-agent/gatekeeper:v3.0.4-beta.1',
'quay.io/kiali/kiali:v1.9',
]

# whitelists against vulnerabilities we've considered for various reasons


Expand Down Expand Up @@ -58,6 +62,8 @@ def whitelisted(vulnerability):
continue
if image_name not in trivy_cache:
trivy_cache[image_name] = []
if image_name in PULL_FIRST:
subprocess.check_call(['/usr/bin/docker', 'pull', image_name])
try:
output = subprocess.check_output([
'trivy',
Expand Down
2 changes: 2 additions & 0 deletions pipelines/deployer/deployer.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1066,6 +1066,7 @@ jobs:
ACCOUNT_ROLE_ARN: ((account-role-arn))
AWS_REGION: eu-west-2
AWS_DEFAULT_REGION: eu-west-2
privileged: true
config:
platform: linux
run:
Expand All @@ -1084,6 +1085,7 @@ jobs:
--kubeconfig ./kubeconfig
echo "done, looking for CVEs"
export KUBECONFIG=$(pwd)/kubeconfig
/usr/bin/dockerd &
python3 /usr/local/bin/findCVEs.py
- name: destroy
Expand Down