Skip to content

Commit 2e30611

Browse files
Prajyot-ParabPrajyot-Parab
committed
add targets for verifying code and images for vulnerabilities
Signed-off-by: Prajyot-Parab <[email protected]>
1 parent e4c4c87 commit 2e30611

File tree

4 files changed

+139
-0
lines changed

4 files changed

+139
-0
lines changed

‎Makefile

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,8 @@ MOCKGEN := $(TOOLS_BIN_DIR)/mockgen
4646
CONTROLLER_GEN := $(TOOLS_BIN_DIR)/controller-gen
4747
CONVERSION_VERIFIER := $(TOOLS_BIN_DIR)/conversion-verifier
4848
SETUP_ENVTEST := $(TOOLS_BIN_DIR)/setup-envtest
49+
GOVULNCHECK := $(TOOLS_BIN_DIR)/govulncheck
50+
TRIVY_VER := 0.45.0
4951

5052
STAGING_REGISTRY ?= gcr.io/k8s-staging-capi-ibmcloud
5153
STAGING_BUCKET ?= artifacts.k8s-staging-capi-ibmcloud.appspot.com
@@ -512,6 +514,27 @@ verify-gen: generate ## Verfiy go generated files are up to date
512514
verify-conversions: $(CONVERSION_VERIFIER) ## Verifies expected API conversion are in place
513515
$(CONVERSION_VERIFIER)
514516

517+
.PHONY: verify-container-images
518+
verify-container-images: ## Verify container images
519+
TRACE=$(TRACE) ./hack/verify-container-images.sh $(TRIVY_VER)
520+
521+
.PHONY: verify-govulncheck
522+
verify-govulncheck: $(GOVULNCHECK) ## Verify code for vulnerabilities
523+
$(GOVULNCHECK) ./... && R1=$$? || R1=$$?; \
524+
$(GOVULNCHECK) -C "$(TOOLS_DIR)" ./... && R2=$$? || R2=$$?; \
525+
if [ "$$R1" -ne "0" ] || [ "$$R2" -ne "0" ]; then \
526+
exit 1; \
527+
fi
528+
529+
.PHONY: verify-security
530+
verify-security: ## Verify code and images for vulnerabilities
531+
$(MAKE) verify-container-images && R1=$$? || R1=$$?; \
532+
$(MAKE) verify-govulncheck && R2=$$? || R2=$$?; \
533+
if [ "$$R1" -ne "0" ] || [ "$$R2" -ne "0" ]; then \
534+
echo "Check for vulnerabilities failed! There are vulnerabilities to be fixed"; \
535+
exit 1; \
536+
fi
537+
515538
## --------------------------------------
516539
## Cleanup / Verification
517540
## --------------------------------------
@@ -543,6 +566,10 @@ clean-temporary: ## Remove all temporary files and folders
543566
clean-release: ## Remove the release folder
544567
rm -rf $(RELEASE_DIR)
545568

569+
.PHONY: clean-release-git
570+
clean-release-git: ## Restores the git files usually modified during a release
571+
git restore ./*manager_image_patch.yaml ./*manager_pull_policy.yaml
572+
546573
.PHONY: clean-generated-conversions
547574
clean-generated-conversions: ## Remove files generated by conversion-gen from the mentioned dirs
548575
(IFS=','; for i in $(SRC_DIRS); do find $$i -type f -name 'zz_generated.conversion*' -exec rm -f {} \;; done)

‎hack/ensure-trivy.sh

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
#!/bin/bash
2+
3+
# Copyright 2023 The Kubernetes Authors.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
set -o errexit
18+
set -o nounset
19+
set -o pipefail
20+
21+
if [[ "${TRACE-0}" == "1" ]]; then
22+
set -o xtrace
23+
fi
24+
25+
VERSION=${1}
26+
27+
GO_OS="$(go env GOOS)"
28+
if [[ "${GO_OS}" == "linux" ]]; then
29+
TRIVY_OS="Linux"
30+
elif [[ "${GO_OS}" == "darwin"* ]]; then
31+
TRIVY_OS="macOS"
32+
fi
33+
34+
GO_ARCH="$(go env GOARCH)"
35+
if [[ "${GO_ARCH}" == "amd" ]]; then
36+
TRIVY_ARCH="32bit"
37+
elif [[ "${GO_ARCH}" == "amd64"* ]]; then
38+
TRIVY_ARCH="64bit"
39+
elif [[ "${GO_ARCH}" == "arm" ]]; then
40+
TRIVY_ARCH="ARM"
41+
elif [[ "${GO_ARCH}" == "arm64" ]]; then
42+
TRIVY_ARCH="ARM64"
43+
fi
44+
45+
TOOL_BIN=hack/tools/bin
46+
mkdir -p ${TOOL_BIN}
47+
48+
TRIVY="${TOOL_BIN}/trivy/${VERSION}/trivy"
49+
50+
# Downloads trivy scanner
51+
if [ ! -f "$TRIVY" ]; then
52+
curl -L -o ${TOOL_BIN}/trivy.tar.gz "https://github.com/aquasecurity/trivy/releases/download/v${VERSION}/trivy_${VERSION}_${TRIVY_OS}-${TRIVY_ARCH}.tar.gz"
53+
mkdir -p "$(dirname "$0")/tools/bin/trivy/${VERSION}"
54+
tar -xf "${TOOL_BIN}/trivy.tar.gz" -C "${TOOL_BIN}/trivy/${VERSION}" trivy
55+
chmod +x "${TOOL_BIN}/trivy/${VERSION}/trivy"
56+
rm "${TOOL_BIN}/trivy.tar.gz"
57+
fi

‎hack/tools/Makefile

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,3 +121,7 @@ $(CONVERSION_VERIFIER): $(BIN_DIR) go.mod go.sum ## Build a local copy of conver
121121
SETUP_ENVTEST := $(BIN_DIR)/setup-envtest
122122
$(SETUP_ENVTEST): $(BIN_DIR) go.mod go.sum ## Build a local copy of setup-envtest.
123123
go build -tags=capibmtools -o $@ sigs.k8s.io/controller-runtime/tools/setup-envtest
124+
125+
GOVULNCHECK := $(BIN_DIR)/govulncheck
126+
$(GOVULNCHECK): ## Install govulncheck.
127+
GOBIN=$(abspath $(BIN_DIR)) go install golang.org/x/vuln/cmd/[email protected]

‎hack/verify-container-images.sh

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
#!/bin/bash
2+
3+
# Copyright 2023 The Kubernetes Authors.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
set -o errexit
18+
set -o nounset
19+
set -o pipefail
20+
21+
if [[ "${TRACE-0}" == "1" ]]; then
22+
set -o xtrace
23+
fi
24+
25+
VERSION=${1}
26+
GO_ARCH="$(go env GOARCH)"
27+
28+
REPO_ROOT=$(git rev-parse --show-toplevel)
29+
"${REPO_ROOT}/hack/ensure-trivy.sh" "${VERSION}"
30+
31+
TRIVY="${REPO_ROOT}/hack/tools/bin/trivy/${VERSION}/trivy"
32+
33+
# Builds all the container images to be scanned and cleans up changes to ./*manager_image_patch.yaml ./*manager_pull_policy.yaml.
34+
make REGISTRY=gcr.io/k8s-staging-capi-ibmcloud PULL_POLICY=IfNotPresent TAG=dev OUTPUT_TYPE=type=docker docker-build
35+
make clean-release-git
36+
37+
# Scan the images
38+
"${TRIVY}" image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-capi-ibmcloud/cluster-api-ibmcloud-controller-"${GO_ARCH}":dev && R1=$? || R1=$?
39+
40+
echo ""
41+
BRed='\033[1;31m'
42+
BGreen='\033[1;32m'
43+
NC='\033[0m' # No
44+
45+
if [ "$R1" -ne "0" ]
46+
then
47+
echo -e "${BRed}Check container images failed! There are vulnerabilities to be fixed${NC}"
48+
exit 1
49+
fi
50+
51+
echo -e "${BGreen}Check container images passed! No vulnerability found${NC}"

0 commit comments

Comments
 (0)