Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add persistence to trivy plugin for caching databases #266

Merged
merged 6 commits into from
Apr 3, 2024
Merged

Conversation

matheusfm
Copy link
Contributor

@matheusfm matheusfm commented Apr 3, 2024

Description

This PR adds persistence to trivy plugin for caching vulnerability databases.

  • When Zora Helm release is installed with default configuration, a PVC and a Job is created.
  • The Job, which uses the PVC, downloads the vulnerability database.
  • This Job is required when the persistence is enabled (true by default) so that PVC isn't in Pending status (WaitForFirstConsumer). Since the PVC is created by Helm with --wait flag, this Pending status would be a problem.
  • As a best practice, a PV is not created. Just a PVC. Then Kubernetes try to dynamically provision a volume specially for the PVC (Dynamic Provisioning).
  • The Java vulnerability database is not downloaded by default (not every cluster has Java apps). But it can be downloaded by setting scan.plugins.trivy.persistence.downloadJavaDB to true.
  • The Job is deleted immediately after it finishes, due to ttlSecondsAfterFinished: 0.
  • The scheduled Trivy scans use the PVC as well, so the vulnerability databases is just downloaded when needed and no longer for every scan.

How has this been tested?

  • kind create cluster
  • make docker-build
  • kind load docker-image controller:latest
  • helm upgrade --install zora charts/zora/ -n zora-system --create-namespace --wait -f values.yaml (content of values.yaml below)
  • Check the Job logs: kubectl logs job/trivy-download-db -n zora-system then you should see a Downloading DB... entry
  • Check the logs of the 1st Trivy scheduled scan: kubectl logs kind-kind-vuln-trivy-28535863-tdlxz -n zora-system then you should see a DB update was skipped because the local DB is the latest entry.

values.yaml content:

clusterName: kind-kind
operator:
  image:
    repository: controller
    tag: latest
scan:
  plugins:
    trivy:
      persistence:
        enabled: true

Checklist

  • I have labeled this PR with the relevant Type labels
  • I have documented my code (if applicable)
  • My changes are covered by tests

@matheusfm matheusfm added the enhancement New feature or request label Apr 3, 2024
@matheusfm matheusfm requested a review from knrc April 3, 2024 14:21
@matheusfm matheusfm self-assigned this Apr 3, 2024
@matheusfm matheusfm merged commit 30cce58 into main Apr 3, 2024
3 of 4 checks passed
@matheusfm matheusfm deleted the UD-1247 branch April 3, 2024 17:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants