Skip to content

Commit 90c9ad6

Browse files
matheusfmmatheusfm
authored
feat: add support to customize trivy vulnerability database repository (#330)
* feat: add Helm variables to customize trivy vuln db repository * docs: add note about customizing trivy vuln db repository * release v0.10.5
1 parent 78c6782 commit 90c9ad6

File tree

8 files changed

+42
-8
lines changed

8 files changed

+42
-8
lines changed

‎charts/zora/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ name: zora
1717
description: A multi-plugin solution that reports misconfigurations and vulnerabilities by scanning your cluster at scheduled times.
1818
icon: https://zora-docs.undistro.io/v0.7/assets/logo.svg
1919
type: application
20-
version: 0.10.4
21-
appVersion: "v0.10.4"
20+
version: 0.10.5
21+
appVersion: "v0.10.5"
2222
sources:
2323
- https://github.com/undistro/zora

‎charts/zora/README.md‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Zora Helm Chart
22

3-
![Version: 0.10.4](https://img.shields.io/badge/Version-0.10.4-informational?style=flat-square&color=3CA9DD) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square&color=3CA9DD) ![AppVersion: v0.10.4](https://img.shields.io/badge/AppVersion-v0.10.4-informational?style=flat-square&color=3CA9DD)
3+
![Version: 0.10.5](https://img.shields.io/badge/Version-0.10.5-informational?style=flat-square&color=3CA9DD) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square&color=3CA9DD) ![AppVersion: v0.10.5](https://img.shields.io/badge/AppVersion-v0.10.5-informational?style=flat-square&color=3CA9DD)
44

55
A multi-plugin solution that reports misconfigurations and vulnerabilities by scanning your cluster at scheduled times.
66

@@ -13,7 +13,7 @@ helm repo add undistro https://charts.undistro.io --force-update
1313
helm repo update undistro
1414
helm upgrade --install zora undistro/zora \
1515
-n zora-system \
16-
--version 0.10.4 \
16+
--version 0.10.5 \
1717
--create-namespace \
1818
--wait \
1919
--set clusterName="$(kubectl config current-context)"
@@ -107,8 +107,11 @@ The following table lists the configurable parameters of the Zora chart and thei
107107
| scan.plugins.marvin.image.pullPolicy | string | `"Always"` | Image pull policy |
108108
| scan.plugins.marvin.env | list | `[]` | List of environment variables to set in marvin container. |
109109
| scan.plugins.marvin.envFrom | list | `[]` | List of sources to populate environment variables in marvin container. |
110+
| scan.plugins.trivy.args | string | `""` | Specifies custom arguments for the Trivy command-line. |
110111
| scan.plugins.trivy.ignoreUnfixed | bool | `false` | Specifies whether only fixed vulnerabilities should be reported |
111112
| scan.plugins.trivy.ignoreDescriptions | bool | `false` | Specifies whether vulnerability descriptions should be ignored |
113+
| scan.plugins.trivy.dbRepository | string | `""` | Specifies a custom OCI repository(ies) to retrieve vulnerability database. |
114+
| scan.plugins.trivy.javaDbRepository | string | `""` | Specifies a custom OCI repository(ies) to retrieve Java vulnerability database. |
112115
| scan.plugins.trivy.resources | object | `{"limits":{"cpu":"1500m","memory":"4096Mi"},"requests":{"cpu":"500m","memory":"2048Mi"}}` | [Resources](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers) to add to `trivy` container |
113116
| scan.plugins.trivy.podAnnotations | object | `{}` | Annotations added to the trivy pods |
114117
| scan.plugins.trivy.image.repository | string | `"ghcr.io/undistro/trivy"` | trivy plugin image repository |

‎charts/zora/templates/plugins/trivy-job.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,9 @@ spec:
5757
{{- if .Values.scan.plugins.trivy.insecure }}
5858
--insecure \
5959
{{- end }}
60+
{{- if .Values.scan.plugins.trivy.dbRepository }}
61+
--db-repository={{ .Values.scan.plugins.trivy.dbRepository | quote }} \
62+
{{- end }}
6063
--download-db-only{{- if .Values.scan.plugins.trivy.persistence.downloadJavaDB }} && \
6164
time trivy image \
6265
--debug \
@@ -65,6 +68,9 @@ spec:
6568
{{- if .Values.scan.plugins.trivy.insecure }}
6669
--insecure \
6770
{{- end }}
71+
{{- if .Values.scan.plugins.trivy.javaDbRepository }}
72+
--java-db-repository={{ .Values.scan.plugins.trivy.javaDbRepository | quote }} \
73+
{{- end }}
6874
--download-java-db-only {{- end }}
6975
exitcode=$(echo $?)
7076
find /tmp/trivy-cache ! -group {{ .Values.scan.plugins.trivy.fsGroup }} | xargs -r chgrp -f {{ .Values.scan.plugins.trivy.fsGroup }} ;

‎charts/zora/templates/plugins/trivy.yaml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,15 @@ spec:
7272
--ignore-unfixed \
7373
{{- end }}
7474
--timeout={{ .Values.scan.plugins.trivy.timeout | quote }} \
75-
-o $(DONE_DIR)/results.json
75+
{{- if .Values.scan.plugins.trivy.dbRepository }}
76+
--db-repository={{ .Values.scan.plugins.trivy.dbRepository | quote }} \
77+
{{- end }}
78+
{{- if .Values.scan.plugins.trivy.javaDbRepository }}
79+
--java-db-repository={{ .Values.scan.plugins.trivy.javaDbRepository | quote }} \
80+
{{- end }}
81+
-o $(DONE_DIR)/results.json {{- if .Values.scan.plugins.trivy.args }} \
82+
{{ .Values.scan.plugins.trivy.args }}
83+
{{- end }}
7684
7785
exitcode=$(echo $?)
7886
if [ $exitcode -ne 0 ]; then

‎charts/zora/values.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -178,10 +178,16 @@ scan:
178178
envFrom: []
179179

180180
trivy:
181+
# -- Specifies custom arguments for the Trivy command-line.
182+
args: ""
181183
# -- Specifies whether only fixed vulnerabilities should be reported
182184
ignoreUnfixed: false
183185
# -- Specifies whether vulnerability descriptions should be ignored
184186
ignoreDescriptions: false
187+
# -- Specifies a custom OCI repository(ies) to retrieve vulnerability database.
188+
dbRepository: ""
189+
# -- Specifies a custom OCI repository(ies) to retrieve Java vulnerability database.
190+
javaDbRepository: ""
185191
# -- [Resources](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers) to add to `trivy` container
186192
resources:
187193
requests:

‎cmd/main.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ func main() {
109109
flag.StringVar(&cronJobAnnotations, "cronjob-serviceaccount-annotations", "annotaion1=value1,annotation2=value2", "Annotations to be applied to the CronJob Service Account")
110110
flag.StringVar(&saasWorkspaceID, "saas-workspace-id", "", "Your workspace ID in Zora SaaS")
111111
flag.StringVar(&saasServer, "saas-server", "http://localhost:3003", "Address for Zora's saas server")
112-
flag.StringVar(&version, "version", "0.10.4", "Zora version")
112+
flag.StringVar(&version, "version", "0.10.5", "Zora version")
113113
flag.StringVar(&checksConfigMapNamespace, "checks-configmap-namespace", "zora-system", "Namespace of custom checks ConfigMap")
114114
flag.StringVar(&checksConfigMapName, "checks-configmap-name", "zora-custom-checks", "Name of custom checks ConfigMap")
115115
flag.StringVar(&kubexnsImage, "kubexns-image", "ghcr.io/undistro/kubexns:latest", "kubexns image")

‎docs/configuration/https-proxy.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,3 +24,14 @@ While [Trivy](../plugins/trivy.md) downloads vulnerability databases during scan
2424
- `ghcr.io/aquasecurity/trivy-java-db`
2525
- `mirror.gcr.io/aquasec/trivy-db`
2626
- `mirror.gcr.io/aquasec/trivy-java-db`
27+
28+
!!! note
29+
A custom vulnerability database repository can be specified using the parameters `scan.plugins.trivy.dbRepository`
30+
and `scan.plugins.trivy.javaDbRepository`.
31+
You can use [skopeo](https://github.com/containers/skopeo/){:target="_blank"} to copy the official database to your
32+
own OCI-compliant registry with the command below.
33+
Keep in mind that the original database is **continuously updated with new vulnerabilities**,
34+
so it's important to regularly synchronize your copy if you choose to host it yourself.
35+
```
36+
skopeo copy docker://ghcr.io/aquasecurity/trivy-db:2 docker://registry.example.com/trivy-db:2
37+
```

‎docs/getting-started/installation.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ Then, run the following command to install or upgrade Zora [Helm chart](https://
3131
helm repo update undistro
3232
helm upgrade --install zora undistro/zora \
3333
-n zora-system \
34-
--version 0.10.4 \
34+
--version 0.10.5 \
3535
--create-namespace \
3636
--wait \
3737
--set clusterName="$(kubectl config current-context)"
@@ -42,7 +42,7 @@ Then, run the following command to install or upgrade Zora [Helm chart](https://
4242
```shell
4343
helm upgrade --install zora oci://ghcr.io/undistro/helm-charts/zora \
4444
-n zora-system \
45-
--version 0.10.4 \
45+
--version 0.10.5 \
4646
--create-namespace \
4747
--wait \
4848
--set clusterName="$(kubectl config current-context)"

0 commit comments

Comments
 (0)