From 023b8ee4c84712d183a13d523427ab745d4a5c71 Mon Sep 17 00:00:00 2001 From: Federico Mengozzi <19249682+fedemengo@users.noreply.github.com> Date: Tue, 19 Dec 2023 14:41:10 +0100 Subject: [PATCH] feat(registry-scanner): ovveride platform scanning logic (#1496) --- charts/registry-scanner/Chart.yaml | 4 ++-- charts/registry-scanner/README.md | 3 ++- charts/registry-scanner/README.tpl | 2 +- charts/registry-scanner/templates/_job.tpl | 2 ++ charts/registry-scanner/templates/configmap.yaml | 1 + charts/registry-scanner/tests/configmap_test.yaml | 14 ++++++++++++++ charts/registry-scanner/values.yaml | 2 ++ 7 files changed, 24 insertions(+), 4 deletions(-) diff --git a/charts/registry-scanner/Chart.yaml b/charts/registry-scanner/Chart.yaml index 0da670392..97892ccf9 100644 --- a/charts/registry-scanner/Chart.yaml +++ b/charts/registry-scanner/Chart.yaml @@ -4,7 +4,7 @@ description: Sysdig Registry Scanner type: application home: https://www.sysdig.com/ icon: https://avatars.githubusercontent.com/u/5068817?s=200&v=4 -version: 1.1.25 -appVersion: 0.2.60 +version: 1.1.26 +appVersion: 0.2.61 maintainers: - name: sysdiglabs diff --git a/charts/registry-scanner/README.md b/charts/registry-scanner/README.md index bcd194828..bb5884b18 100644 --- a/charts/registry-scanner/README.md +++ b/charts/registry-scanner/README.md @@ -93,6 +93,7 @@ The following table lists the configurable parameters of the Sysdig Registry Sca | config.scan.jobs.resources.requests.cpu | The CPU request for the scanner job. | 500m | | config.scan.jobs.resources.limits.memory | The memory limit for the scanner job. | 2Gi | | config.scan.jobs.temporaryVolumeSizeLimit | The size limit for the emptyDir volume used by the scanner job.
This volume is used to store both the vulnerability database and the image to scan. | 2Gi | +| config.scan.disablePlatformScanning | Force the scan to happen on the client component rather than relying on backend scanning | false | | config.parallelGoRoutines | Number of goroutines running in parallel in metadata phase for ECR Org setup. | 100 | | ssl.ca.certs | For outbound connections.
List of PEM-encoded x509 certificate authority. | [] | | customLabels | The additional labels to add to CronJob and Scanning Jobs. The custom labels to be added to kubernetes manifests of all the resources created. | {} | @@ -129,7 +130,7 @@ Use the following command to deploy: helm upgrade --install registry-scanner \ --namespace sysdig-agent \ --create-namespace \ - --version=1.1.25 \ + --version=1.1.26 \ --set config.secureBaseURL= \ --set config.secureAPIToken= \ --set config.secureSkipTLS=true \ diff --git a/charts/registry-scanner/README.tpl b/charts/registry-scanner/README.tpl index e1950db19..9e7c5616d 100644 --- a/charts/registry-scanner/README.tpl +++ b/charts/registry-scanner/README.tpl @@ -62,7 +62,7 @@ Use the following command to deploy: helm upgrade --install registry-scanner \ --namespace sysdig-agent \ --create-namespace \ - {{ with .Chart.Version }}--version={{.}} {{ end }} \ + {{ with .Chart.Version }}--version={{.}}{{ end }} \ --set config.secureBaseURL= \ --set config.secureAPIToken= \ --set config.secureSkipTLS=true \ diff --git a/charts/registry-scanner/templates/_job.tpl b/charts/registry-scanner/templates/_job.tpl index 92cde2b68..157b305a8 100644 --- a/charts/registry-scanner/templates/_job.tpl +++ b/charts/registry-scanner/templates/_job.tpl @@ -128,6 +128,8 @@ - name: REGISTRYSCANNER_PROFILING_ENABLED value: /profiling {{- end }} + - name: REGISTRYSCANNER_CRONJOB_SCHEDULE + value: {{ .Values.cronjob.schedule | quote }} {{- if .Values.extraEnvVars }} {{- toYaml .Values.extraEnvVars | nindent 10 }} {{- end }} diff --git a/charts/registry-scanner/templates/configmap.yaml b/charts/registry-scanner/templates/configmap.yaml index 7d460aa25..11d12a82f 100644 --- a/charts/registry-scanner/templates/configmap.yaml +++ b/charts/registry-scanner/templates/configmap.yaml @@ -54,6 +54,7 @@ data: k8sInCluster: true namespace: {{ .Release.Namespace }} workers: {{ .Values.config.maxWorkers }} + disablePlatformScanning: {{ default false .Values.config.scan.disablePlatformScanning }} jobs: ttlSecondsAfterFinished: {{ .Values.config.scan.jobs.ttlSecondsAfterFinished }} serviceAccountName: {{ include "registry-scanner.serviceAccountName" . }} diff --git a/charts/registry-scanner/tests/configmap_test.yaml b/charts/registry-scanner/tests/configmap_test.yaml index b66a4062a..14b24d8a6 100644 --- a/charts/registry-scanner/tests/configmap_test.yaml +++ b/charts/registry-scanner/tests/configmap_test.yaml @@ -139,3 +139,17 @@ tests: - matchRegex: path: data['config.yaml'] pattern: allowListMemberAccountIDs:\n\s*- 123456789 + - it: platform scanning is not disable by default + asserts: + - matchRegex: + path: data['config.yaml'] + pattern: scan:((.|\n)*)disablePlatformScanning:\s*false + - it: force scanning on the client component regardless of backend config + set: + config: + scan: + disablePlatformScanning: "true" + asserts: + - matchRegex: + path: data['config.yaml'] + pattern: scan:((.|\n)*)disablePlatformScanning:\s*true diff --git a/charts/registry-scanner/values.yaml b/charts/registry-scanner/values.yaml index 43fe49795..0a32ef66c 100644 --- a/charts/registry-scanner/values.yaml +++ b/charts/registry-scanner/values.yaml @@ -105,6 +105,8 @@ config: # The size limit for the emptyDir volume used by the scanner job.
# This volume is used to store both the vulnerability database and the image to scan. temporaryVolumeSizeLimit: 2Gi + # Force the scan to happen on the client component rather than relying on backend scanning + disablePlatformScanning: false # Number of goroutines running in parallel in metadata phase for ECR Org setup. parallelGoRoutines: 100 ssl: