From 1354c6a2585af1d9d41e54ba0d1cb486875dbfea Mon Sep 17 00:00:00 2001 From: Federico Mengozzi <19249682+fedemengo@users.noreply.github.com> Date: Mon, 27 Nov 2023 15:43:21 +0100 Subject: [PATCH 1/5] feat(registry-scanner): ovveride platform scanning logic --- charts/registry-scanner/README.md | 1 + charts/registry-scanner/templates/configmap.yaml | 1 + 2 files changed, 2 insertions(+) diff --git a/charts/registry-scanner/README.md b/charts/registry-scanner/README.md index bcd194828..8bb99f7e2 100644 --- a/charts/registry-scanner/README.md +++ b/charts/registry-scanner/README.md @@ -93,6 +93,7 @@ The following table lists the configurable parameters of the Sysdig Registry Sca | config.scan.jobs.resources.requests.cpu | The CPU request for the scanner job. | 500m | | config.scan.jobs.resources.limits.memory | The memory limit for the scanner job. | 2Gi | | config.scan.jobs.temporaryVolumeSizeLimit | The size limit for the emptyDir volume used by the scanner job.
This volume is used to store both the vulnerability database and the image to scan. | 2Gi | +| config.scan.disablePlatformScanning | Force the scan to happen on the client component rather than relying on backend scanning | false | | config.parallelGoRoutines | Number of goroutines running in parallel in metadata phase for ECR Org setup. | 100 | | ssl.ca.certs | For outbound connections.
List of PEM-encoded x509 certificate authority. | [] | | customLabels | The additional labels to add to CronJob and Scanning Jobs. The custom labels to be added to kubernetes manifests of all the resources created. | {} | diff --git a/charts/registry-scanner/templates/configmap.yaml b/charts/registry-scanner/templates/configmap.yaml index 7d460aa25..11d12a82f 100644 --- a/charts/registry-scanner/templates/configmap.yaml +++ b/charts/registry-scanner/templates/configmap.yaml @@ -54,6 +54,7 @@ data: k8sInCluster: true namespace: {{ .Release.Namespace }} workers: {{ .Values.config.maxWorkers }} + disablePlatformScanning: {{ default false .Values.config.scan.disablePlatformScanning }} jobs: ttlSecondsAfterFinished: {{ .Values.config.scan.jobs.ttlSecondsAfterFinished }} serviceAccountName: {{ include "registry-scanner.serviceAccountName" . }} From 21791f7bb8e693175f62902659e43b1599deca9a Mon Sep 17 00:00:00 2001 From: Federico Mengozzi <19249682+fedemengo@users.noreply.github.com> Date: Fri, 1 Dec 2023 18:05:27 +0100 Subject: [PATCH 2/5] feat(registry-scanner): propagate schedule as env var --- charts/registry-scanner/templates/_job.tpl | 2 ++ charts/registry-scanner/templates/configmap.yaml | 1 + 2 files changed, 3 insertions(+) diff --git a/charts/registry-scanner/templates/_job.tpl b/charts/registry-scanner/templates/_job.tpl index 92cde2b68..157b305a8 100644 --- a/charts/registry-scanner/templates/_job.tpl +++ b/charts/registry-scanner/templates/_job.tpl @@ -128,6 +128,8 @@ - name: REGISTRYSCANNER_PROFILING_ENABLED value: /profiling {{- end }} + - name: REGISTRYSCANNER_CRONJOB_SCHEDULE + value: {{ .Values.cronjob.schedule | quote }} {{- if .Values.extraEnvVars }} {{- toYaml .Values.extraEnvVars | nindent 10 }} {{- end }} diff --git a/charts/registry-scanner/templates/configmap.yaml b/charts/registry-scanner/templates/configmap.yaml index 11d12a82f..7c927263f 100644 --- a/charts/registry-scanner/templates/configmap.yaml +++ b/charts/registry-scanner/templates/configmap.yaml @@ -65,6 +65,7 @@ data: limits: memory: {{ .Values.config.scan.jobs.resources.limits.memory }} temporaryVolumeSizeLimit: {{ .Values.config.scan.jobs.temporaryVolumeSizeLimit }} + scheduleExpression: {{ .Values.cronjob.schedule | quote }} {{- if .Values.config.scan.inlineScanImage }} inlineScanImage: {{ .Values.config.scan.inlineScanImage }} {{- end }} From b17cd00c576c36e737db0021de62b9f5610f8b4d Mon Sep 17 00:00:00 2001 From: Federico Mengozzi <19249682+fedemengo@users.noreply.github.com> Date: Tue, 5 Dec 2023 17:31:10 +0100 Subject: [PATCH 3/5] remove unused var --- charts/registry-scanner/templates/configmap.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/charts/registry-scanner/templates/configmap.yaml b/charts/registry-scanner/templates/configmap.yaml index 7c927263f..11d12a82f 100644 --- a/charts/registry-scanner/templates/configmap.yaml +++ b/charts/registry-scanner/templates/configmap.yaml @@ -65,7 +65,6 @@ data: limits: memory: {{ .Values.config.scan.jobs.resources.limits.memory }} temporaryVolumeSizeLimit: {{ .Values.config.scan.jobs.temporaryVolumeSizeLimit }} - scheduleExpression: {{ .Values.cronjob.schedule | quote }} {{- if .Values.config.scan.inlineScanImage }} inlineScanImage: {{ .Values.config.scan.inlineScanImage }} {{- end }} From ed3164300d37b34b0ea5019012893ad97a44edd6 Mon Sep 17 00:00:00 2001 From: Federico Mengozzi <19249682+fedemengo@users.noreply.github.com> Date: Tue, 19 Dec 2023 11:36:08 +0100 Subject: [PATCH 4/5] add tests --- charts/registry-scanner/tests/configmap_test.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/charts/registry-scanner/tests/configmap_test.yaml b/charts/registry-scanner/tests/configmap_test.yaml index b66a4062a..14b24d8a6 100644 --- a/charts/registry-scanner/tests/configmap_test.yaml +++ b/charts/registry-scanner/tests/configmap_test.yaml @@ -139,3 +139,17 @@ tests: - matchRegex: path: data['config.yaml'] pattern: allowListMemberAccountIDs:\n\s*- 123456789 + - it: platform scanning is not disable by default + asserts: + - matchRegex: + path: data['config.yaml'] + pattern: scan:((.|\n)*)disablePlatformScanning:\s*false + - it: force scanning on the client component regardless of backend config + set: + config: + scan: + disablePlatformScanning: "true" + asserts: + - matchRegex: + path: data['config.yaml'] + pattern: scan:((.|\n)*)disablePlatformScanning:\s*true From cb0a6f4b40d90b50f77fc0cc815cf3a10d6bca94 Mon Sep 17 00:00:00 2001 From: Federico Mengozzi <19249682+fedemengo@users.noreply.github.com> Date: Tue, 19 Dec 2023 14:01:37 +0100 Subject: [PATCH 5/5] feat(registry-scanner): bump chart version --- charts/registry-scanner/Chart.yaml | 4 ++-- charts/registry-scanner/README.md | 2 +- charts/registry-scanner/README.tpl | 2 +- charts/registry-scanner/values.yaml | 2 ++ 4 files changed, 6 insertions(+), 4 deletions(-) diff --git a/charts/registry-scanner/Chart.yaml b/charts/registry-scanner/Chart.yaml index 0da670392..97892ccf9 100644 --- a/charts/registry-scanner/Chart.yaml +++ b/charts/registry-scanner/Chart.yaml @@ -4,7 +4,7 @@ description: Sysdig Registry Scanner type: application home: https://www.sysdig.com/ icon: https://avatars.githubusercontent.com/u/5068817?s=200&v=4 -version: 1.1.25 -appVersion: 0.2.60 +version: 1.1.26 +appVersion: 0.2.61 maintainers: - name: sysdiglabs diff --git a/charts/registry-scanner/README.md b/charts/registry-scanner/README.md index 8bb99f7e2..bb5884b18 100644 --- a/charts/registry-scanner/README.md +++ b/charts/registry-scanner/README.md @@ -130,7 +130,7 @@ Use the following command to deploy: helm upgrade --install registry-scanner \ --namespace sysdig-agent \ --create-namespace \ - --version=1.1.25 \ + --version=1.1.26 \ --set config.secureBaseURL= \ --set config.secureAPIToken= \ --set config.secureSkipTLS=true \ diff --git a/charts/registry-scanner/README.tpl b/charts/registry-scanner/README.tpl index e1950db19..9e7c5616d 100644 --- a/charts/registry-scanner/README.tpl +++ b/charts/registry-scanner/README.tpl @@ -62,7 +62,7 @@ Use the following command to deploy: helm upgrade --install registry-scanner \ --namespace sysdig-agent \ --create-namespace \ - {{ with .Chart.Version }}--version={{.}} {{ end }} \ + {{ with .Chart.Version }}--version={{.}}{{ end }} \ --set config.secureBaseURL= \ --set config.secureAPIToken= \ --set config.secureSkipTLS=true \ diff --git a/charts/registry-scanner/values.yaml b/charts/registry-scanner/values.yaml index 43fe49795..0a32ef66c 100644 --- a/charts/registry-scanner/values.yaml +++ b/charts/registry-scanner/values.yaml @@ -105,6 +105,8 @@ config: # The size limit for the emptyDir volume used by the scanner job.
# This volume is used to store both the vulnerability database and the image to scan. temporaryVolumeSizeLimit: 2Gi + # Force the scan to happen on the client component rather than relying on backend scanning + disablePlatformScanning: false # Number of goroutines running in parallel in metadata phase for ECR Org setup. parallelGoRoutines: 100 ssl: