Skip to content

Commit b9cab9c

Browse files
airadierairadier
authored
feat: Use new inline scan container (#2)
* Use new inline-scan container * Remove unused configmap parameter
1 parent 2a32623 commit b9cab9c

File tree

3 files changed

+32
-189
lines changed

3 files changed

+32
-189
lines changed

‎cmd/harbor-scanner-sysdig-secure/main.go

+2-4
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,6 @@ func configure() error {
4646
pflag.Bool("verify_ssl", true, "Verify SSL when connecting to Sysdig Secure URL Endpoint")
4747
pflag.Bool("inline_scanning", false, "Use Inline Scanning Adapter")
4848
pflag.String("namespace_name", "", "Namespace where inline scanning jobs are spawned")
49-
pflag.String("configmap_name", "", "Configmap which keeps the inline scanning settings")
5049
pflag.String("secret_name", "", "Secret which keeps the inline scanning secrets ")
5150

5251
pflag.VisitAll(func(flag *pflag.Flag) { viper.BindPFlag(flag.Name, flag) })
@@ -57,8 +56,8 @@ func configure() error {
5756
return errors.New("secure_api_token is required")
5857
}
5958

60-
if viper.GetBool("inline_scanning") && (viper.Get("namespace_name") == "" || viper.Get("configmap_name") == "" || viper.Get("secret_name") == "") {
61-
return errors.New("namespace_name, configmap_name and secret_name are required when running inline scanning")
59+
if viper.GetBool("inline_scanning") && (viper.Get("namespace_name") == "" || viper.Get("secret_name") == "") {
60+
return errors.New("namespace_name and secret_name are required when running inline scanning")
6261
}
6362

6463
return nil
@@ -83,7 +82,6 @@ func getAdapter() scanner.Adapter {
8382
clientset,
8483
viper.GetString("secure_url"),
8584
viper.GetString("namespace_name"),
86-
viper.GetString("configmap_name"),
8785
viper.GetString("secret_name"))
8886
}
8987

‎pkg/scanner/inline_adapter.go

+16-94
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ import (
44
"context"
55
"crypto/md5"
66
"fmt"
7-
"net/url"
87
"time"
98

109
batchv1 "k8s.io/api/batch/v1"
@@ -22,18 +21,16 @@ type inlineAdapter struct {
2221
k8sClient kubernetes.Interface
2322
secureURL string
2423
namespace string
25-
configMap string
2624
secret string
2725
jobTTL int32
2826
}
2927

30-
func NewInlineAdapter(secureClient secure.Client, k8sClient kubernetes.Interface, secureURL string, namespace string, configMap string, secret string) Adapter {
28+
func NewInlineAdapter(secureClient secure.Client, k8sClient kubernetes.Interface, secureURL string, namespace string, secret string) Adapter {
3129
return &inlineAdapter{
3230
BaseAdapter: BaseAdapter{secureClient: secureClient},
3331
k8sClient: k8sClient,
3432
secureURL: secureURL,
3533
namespace: namespace,
36-
configMap: configMap,
3734
secret: secret,
3835
jobTTL: int32(24 * time.Hour.Seconds()),
3936
}
@@ -64,7 +61,8 @@ func (i *inlineAdapter) createJobFrom(req harbor.ScanRequest) error {
6461

6562
func (i *inlineAdapter) buildJob(req harbor.ScanRequest) *batchv1.Job {
6663
name := jobName(req.Artifact.Repository, req.Artifact.Digest)
67-
repositoryURL, _ := url.Parse(req.Registry.URL)
64+
user, password := getUserAndPasswordFrom(req.Registry.Authorization)
65+
userPassword := fmt.Sprintf("%s:%s", user, password)
6866

6967
return &batchv1.Job{
7068
ObjectMeta: metav1.ObjectMeta{
@@ -75,36 +73,22 @@ func (i *inlineAdapter) buildJob(req harbor.ScanRequest) *batchv1.Job {
7573
Template: corev1.PodTemplateSpec{
7674
Spec: corev1.PodSpec{
7775
RestartPolicy: "OnFailure",
78-
InitContainers: []corev1.Container{
79-
{
80-
Name: "harbor-certificate-dumper",
81-
Image: "busybox",
82-
Command: []string{
83-
"sh",
84-
"-c",
85-
fmt.Sprintf("mkdir -p /etc/docker/certs.d/%s && cp /tmp/ca.crt /etc/docker/certs.d/%s", repositoryURL.Host, repositoryURL.Host),
86-
},
87-
VolumeMounts: []corev1.VolumeMount{
88-
{
89-
Name: "docker-certificates",
90-
MountPath: "/etc/docker/certs.d",
91-
ReadOnly: false,
92-
},
93-
{
94-
Name: "certificate",
95-
MountPath: "/tmp",
96-
},
97-
},
98-
},
99-
},
10076
Containers: []corev1.Container{
10177
{
102-
Name: "scanner",
103-
Image: "sysdiglabs/secure-inline-scan",
104-
Command: []string{"/bin/bash"},
78+
Name: "scanner",
79+
Image: "sysdiglabs/sysdig-inline-scan:harbor-1.0",
10580
Args: []string{
106-
"-c",
107-
fmt.Sprintf("docker login %s -u '$(HARBOR_ROBOTACCOUNT_USER)' -p '$(HARBOR_ROBOTACCOUNT_PASSWORD)' && (/bin/inline_scan.sh analyze -s '%s' -k '$(SYSDIG_SECURE_API_TOKEN)' -d '%s' -P %s || true )", repositoryURL.Host, i.secureURL, req.Artifact.Digest, getImageFrom(req)),
81+
"-s",
82+
i.secureURL,
83+
"-k",
84+
"$(SYSDIG_SECURE_API_TOKEN)",
85+
"-d",
86+
req.Artifact.Digest,
87+
"-P",
88+
"-n",
89+
"-u",
90+
userPassword,
91+
getImageFrom(req),
10892
},
10993
Env: []corev1.EnvVar{
11094
{
@@ -118,68 +102,6 @@ func (i *inlineAdapter) buildJob(req harbor.ScanRequest) *batchv1.Job {
118102
},
119103
},
120104
},
121-
{
122-
Name: "HARBOR_ROBOTACCOUNT_USER",
123-
ValueFrom: &corev1.EnvVarSource{
124-
SecretKeyRef: &corev1.SecretKeySelector{
125-
LocalObjectReference: corev1.LocalObjectReference{
126-
Name: i.secret,
127-
},
128-
Key: "harbor_robot_account_name",
129-
},
130-
},
131-
},
132-
{
133-
Name: "HARBOR_ROBOTACCOUNT_PASSWORD",
134-
ValueFrom: &corev1.EnvVarSource{
135-
SecretKeyRef: &corev1.SecretKeySelector{
136-
LocalObjectReference: corev1.LocalObjectReference{
137-
Name: i.secret,
138-
},
139-
Key: "harbor_robot_account_password",
140-
},
141-
},
142-
},
143-
},
144-
VolumeMounts: []corev1.VolumeMount{
145-
{
146-
Name: "docker-daemon",
147-
MountPath: "/var/run/docker.sock",
148-
},
149-
},
150-
},
151-
},
152-
Volumes: []corev1.Volume{
153-
{
154-
Name: "docker-daemon",
155-
VolumeSource: corev1.VolumeSource{
156-
HostPath: &corev1.HostPathVolumeSource{
157-
Path: "/var/run/docker.sock",
158-
},
159-
},
160-
},
161-
{
162-
Name: "docker-certificates",
163-
VolumeSource: corev1.VolumeSource{
164-
HostPath: &corev1.HostPathVolumeSource{
165-
Path: "/etc/docker/certs.d",
166-
},
167-
},
168-
},
169-
{
170-
Name: "certificate",
171-
VolumeSource: corev1.VolumeSource{
172-
ConfigMap: &corev1.ConfigMapVolumeSource{
173-
LocalObjectReference: corev1.LocalObjectReference{
174-
Name: i.configMap,
175-
},
176-
Items: []corev1.KeyToPath{
177-
{
178-
Key: "harbor_ca",
179-
Path: "ca.crt",
180-
},
181-
},
182-
},
183105
},
184106
},
185107
},

‎pkg/scanner/inline_adapter_test.go

+14-91
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@ import (
2727
const (
2828
secureURL = "https://secure.sysdig.com"
2929
namespace = "a-namespace"
30-
configMap = "a-configmap"
3130
secret = "a-secret"
3231
resourceName = "inline-scan-1e668f7cc4c27e915cfed9793808357e"
3332
)
@@ -44,7 +43,7 @@ var _ = Describe("InlineAdapter", func() {
4443
controller = gomock.NewController(GinkgoT())
4544
client = mocks.NewMockClient(controller)
4645
k8sClient = fake.NewSimpleClientset()
47-
inlineAdapter = scanner.NewInlineAdapter(client, k8sClient, secureURL, namespace, configMap, secret)
46+
inlineAdapter = scanner.NewInlineAdapter(client, k8sClient, secureURL, namespace, secret)
4847
})
4948

5049
AfterEach(func() {
@@ -147,36 +146,22 @@ func job() *batchv1.Job {
147146
Template: corev1.PodTemplateSpec{
148147
Spec: corev1.PodSpec{
149148
RestartPolicy: "OnFailure",
150-
InitContainers: []corev1.Container{
151-
{
152-
Name: "harbor-certificate-dumper",
153-
Image: "busybox",
154-
Command: []string{
155-
"sh",
156-
"-c",
157-
"mkdir -p /etc/docker/certs.d/harbor.sysdig-demo.zone && cp /tmp/ca.crt /etc/docker/certs.d/harbor.sysdig-demo.zone",
158-
},
159-
VolumeMounts: []corev1.VolumeMount{
160-
{
161-
Name: "docker-certificates",
162-
MountPath: "/etc/docker/certs.d",
163-
ReadOnly: false,
164-
},
165-
{
166-
Name: "certificate",
167-
MountPath: "/tmp",
168-
},
169-
},
170-
},
171-
},
172149
Containers: []corev1.Container{
173150
{
174-
Name: "scanner",
175-
Image: "sysdiglabs/secure-inline-scan",
176-
Command: []string{"/bin/bash"},
151+
Name: "scanner",
152+
Image: "sysdiglabs/sysdig-inline-scan:harbor-1.0",
177153
Args: []string{
178-
"-c",
179-
"docker login harbor.sysdig-demo.zone -u '$(HARBOR_ROBOTACCOUNT_USER)' -p '$(HARBOR_ROBOTACCOUNT_PASSWORD)' && (/bin/inline_scan.sh analyze -s 'https://secure.sysdig.com' -k '$(SYSDIG_SECURE_API_TOKEN)' -d 'an image digest' -P harbor.sysdig-demo.zone/sysdig/agent:9.7.0 || true )",
154+
"-s",
155+
"https://secure.sysdig.com",
156+
"-k",
157+
"$(SYSDIG_SECURE_API_TOKEN)",
158+
"-d",
159+
"an image digest",
160+
"-P",
161+
"-n",
162+
"-u",
163+
"robot$9f6711d1-834d-11ea-867f-76103d08dca8:eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE1OTAwMDk5OTksImlhdCI6MTU4NzQxNzk5OSwiaXNzIjoiaGFyYm9yLXRva2VuLWRlZmF1bHRJc3N1ZXIiLCJpZCI6OSwicGlkIjoyLCJhY2Nlc3MiOlt7IlJlc291cmNlIjoiL3Byb2plY3QvMi9yZXBvc2l0b3J5IiwiQWN0aW9uIjoic2Nhbm5lci1wdWxsIiwiRWZmZWN0IjoiIn1dfQ.A3_aTzvxqSTvl26pQKa97ay15zRPC9K55NE0WbEyOsY3m0KFz-HuSDatncWLSYvOlcGVdysKlF3JXYWIjQ7tEI4V76WA9UMoi-fr9vEEdWLF5C1uWZJOz_S72sQ3G1BzsLp3HyWe9ZN5EBK9mhXzYNv2rONYrr0UJeBmNnMf2mU3sH71OO_G6JvRl5fwFSLSYx8nQs82PhfVhx50wRuWl_zyeCCDy_ytLzjRBvZwKuI9iVIxgM1pRfKG15NWMHfl0lcYnjm7f1_WFGKtVddkLOTICK0_FPtef1L8A16ozo_2NA32WD9PstdcTuD37XbZ6AFXUAZFoZLfCEW97mtIZBY2uYMwDQtc6Nme4o3Ya-MnBEIAs9Vi9d5a4pkf7Two-xjI-9ESgVz79YqL-_OnecQPNJ9yAFtJuxQ7StfsCIZx84hh5VdcZmW9jlezRHh4hTAjsNmrOBFTAjPyaXk98Se3Fj0Ev3bChod63og4frE7_fE7HnoBKVPHRAdBhJ2yrAiPymfij_kD4ke1Vb0AxmGGOwRP2K3TZNqEdKcq89lU6lHYV2UfrWchuF3u4ieNEC1BGu1_m_c55f0YZH1FAq6evCyA0JnFuXzO4cCxC7WHzXXRGSC9Lm3LF7cbaZAgFj5d34gbgUQmJst8nPlpW-KtwRL-pHC6mipunCBv9bU",
164+
"harbor.sysdig-demo.zone/sysdig/agent:9.7.0",
180165
},
181166
Env: []corev1.EnvVar{
182167
{
@@ -190,68 +175,6 @@ func job() *batchv1.Job {
190175
},
191176
},
192177
},
193-
{
194-
Name: "HARBOR_ROBOTACCOUNT_USER",
195-
ValueFrom: &corev1.EnvVarSource{
196-
SecretKeyRef: &corev1.SecretKeySelector{
197-
LocalObjectReference: corev1.LocalObjectReference{
198-
Name: secret,
199-
},
200-
Key: "harbor_robot_account_name",
201-
},
202-
},
203-
},
204-
{
205-
Name: "HARBOR_ROBOTACCOUNT_PASSWORD",
206-
ValueFrom: &corev1.EnvVarSource{
207-
SecretKeyRef: &corev1.SecretKeySelector{
208-
LocalObjectReference: corev1.LocalObjectReference{
209-
Name: secret,
210-
},
211-
Key: "harbor_robot_account_password",
212-
},
213-
},
214-
},
215-
},
216-
VolumeMounts: []corev1.VolumeMount{
217-
{
218-
Name: "docker-daemon",
219-
MountPath: "/var/run/docker.sock",
220-
},
221-
},
222-
},
223-
},
224-
Volumes: []corev1.Volume{
225-
{
226-
Name: "docker-daemon",
227-
VolumeSource: corev1.VolumeSource{
228-
HostPath: &corev1.HostPathVolumeSource{
229-
Path: "/var/run/docker.sock",
230-
},
231-
},
232-
},
233-
{
234-
Name: "docker-certificates",
235-
VolumeSource: corev1.VolumeSource{
236-
HostPath: &corev1.HostPathVolumeSource{
237-
Path: "/etc/docker/certs.d",
238-
},
239-
},
240-
},
241-
{
242-
Name: "certificate",
243-
VolumeSource: corev1.VolumeSource{
244-
ConfigMap: &corev1.ConfigMapVolumeSource{
245-
LocalObjectReference: corev1.LocalObjectReference{
246-
Name: configMap,
247-
},
248-
Items: []corev1.KeyToPath{
249-
{
250-
Key: "harbor_ca",
251-
Path: "ca.crt",
252-
},
253-
},
254-
},
255178
},
256179
},
257180
},

0 commit comments

Comments
 (0)