Skip to content
This repository was archived by the owner on Sep 20, 2024. It is now read-only.

Commit 15a53a7

Browse files
danielpacakdanielpacak
authored
feat: Configure Trivy timeout (#191)
Resolves: #186 Signed-off-by: Daniel Pacak <[email protected]>
1 parent de5045b commit 15a53a7

File tree

14 files changed

+75
-41
lines changed

14 files changed

+75
-41
lines changed

‎CONTRIBUTING.md

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,13 +38,17 @@
3838
```
3939
vagrant up
4040
```
41-
3. SSH into a running Vagrant machine.
41+
If everything goes well Harbor will be accessible at http://localhost:8181 (admin/Harbor12345).
42+
43+
To SSH into a running Vagrant machine.
4244
```
4345
vagrant ssh
4446
```
45-
4. Change directory to `/vagrant` in the development machine, which is shared between host and guest.
47+
The `/vagrant` directory in the development machine is shared between host and guest. This, for example, allows you
48+
to rebuild a container image for testing.
4649
```
4750
vagrant@ubuntu-focal:~$ cd /vagrant
51+
vagrant@ubuntu-focal:/vagrant$ make docker-build
4852
```
4953

5054
## Build Binaries

‎README.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -130,10 +130,11 @@ Configuration of the adapter is done via environment variables at startup.
130130
| `SCANNER_TRIVY_VULN_TYPE` | `os,library` | Comma-separated list of vulnerability types. Possible values are `os` and `library`. |
131131
| `SCANNER_TRIVY_SEVERITY` | `UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL` | Comma-separated list of vulnerabilities severities to be displayed |
132132
| `SCANNER_TRIVY_IGNORE_UNFIXED` | `false` | The flag to display only fixed vulnerabilities |
133-
| `SCANNER_TRIVY_IGNORE_POLICY` | `` | The path for the Trivy ignore policy OPA Rego file |
133+
| `SCANNER_TRIVY_IGNORE_POLICY` | `` | The path for the Trivy ignore policy OPA Rego file |
134134
| `SCANNER_TRIVY_SKIP_UPDATE` | `false` | The flag to enable or disable [Trivy DB][trivy-db] downloads from GitHub |
135135
| `SCANNER_TRIVY_GITHUB_TOKEN` | N/A | The GitHub access token to download [Trivy DB][trivy-db] (see [GitHub rate limiting][gh-rate-limit]) |
136136
| `SCANNER_TRIVY_INSECURE` | `false` | The flag to skip verifying registry certificate |
137+
| `SCANNER_TRIVY_TIMEOUT` | `5m0s` | The duration to wait for scan completion |
137138
| `SCANNER_STORE_REDIS_NAMESPACE` | `harbor.scanner.trivy:store` | The namespace for keys in the Redis store |
138139
| `SCANNER_STORE_REDIS_SCAN_JOB_TTL` | `1h` | The time to live for persisting scan jobs and associated scan reports |
139140
| `SCANNER_JOB_QUEUE_REDIS_NAMESPACE` | `harbor.scanner.trivy:job-queue` | The namespace for keys in the scan jobs queue backed by Redis |

‎Vagrantfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,9 @@ Vagrant.configure("2") do |config|
99
vb.memory = "2096"
1010
end
1111

12+
config.vm.provision "install-go", type: "shell", path: "vagrant/install-go.sh"
1213
config.vm.provision "install-docker", type: "shell", path: "vagrant/install-docker.sh"
1314
config.vm.provision "install-harbor", type: "shell", path: "vagrant/install-harbor.sh"
14-
config.vm.provision "install-go", type: "shell", path: "vagrant/install-go.sh"
1515

1616
config.vm.network :forwarded_port, guest: 80, host: 8181
1717
end

‎helm/harbor-scanner-trivy/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,7 @@ The following table lists the configurable parameters of the scanner adapter cha
9494
| `scanner.trivy.ignorepolicy` | The OPA rego script used by Trivy to evaluate each vulnerability | ` ` |
9595
| `scanner.trivy.severity` | Comma-separated list of vulnerabilities severities to be displayed | `UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL` |
9696
| `scanner.trivy.ignoreUnfixed` | The flag to display only fixed vulnerabilities | `false` |
97+
| `scanner.trivy.timeout` | The duration to wait for scan completion | `5m0s` |
9798
| `scanner.trivy.skipUpdate` | The flag to enable or disable Trivy DB downloads from GitHub | `false` |
9899
| `scanner.trivy.gitHubToken` | The GitHub access token to download Trivy DB | |
99100
| `scanner.trivy.insecure` | The flag to skip verifying registry certificate | `false` |

‎helm/harbor-scanner-trivy/templates/statefulset.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,8 @@ spec:
6969
value: {{ .Values.scanner.trivy.severity | default "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL" | quote }}
7070
- name: "SCANNER_TRIVY_IGNORE_UNFIXED"
7171
value: {{ .Values.scanner.trivy.ignoreUnfixed | default false | quote }}
72+
- name: "SCANNER_TRIVY_TIMEOUT"
73+
value: {{ .Values.scanner.trivy.timeout | quote }}
7274
- name: "SCANNER_TRIVY_SKIP_UPDATE"
7375
value: {{ .Values.scanner.trivy.skipUpdate | default false | quote }}
7476
- name: "SCANNER_TRIVY_GITHUB_TOKEN"

‎helm/harbor-scanner-trivy/values.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,8 @@ scanner:
6666
severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
6767
## ignoreUnfixed the flag to display only fixed vulnerabilities
6868
ignoreUnfixed: false
69+
## timeout the duration to wait for scan completion
70+
timeout: 5m0s
6971
## skipUpdate the flag to enable or disable Trivy DB downloads from GitHub
7072
##
7173
## You might want to enable this flag in test or CI/CD environments to avoid GitHub rate limiting issues.

‎pkg/etc/config.go

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -24,16 +24,17 @@ type Config struct {
2424
}
2525

2626
type Trivy struct {
27-
CacheDir string `env:"SCANNER_TRIVY_CACHE_DIR" envDefault:"/home/scanner/.cache/trivy"`
28-
ReportsDir string `env:"SCANNER_TRIVY_REPORTS_DIR" envDefault:"/home/scanner/.cache/reports"`
29-
DebugMode bool `env:"SCANNER_TRIVY_DEBUG_MODE" envDefault:"false"`
30-
VulnType string `env:"SCANNER_TRIVY_VULN_TYPE" envDefault:"os,library"`
31-
Severity string `env:"SCANNER_TRIVY_SEVERITY" envDefault:"UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"`
32-
IgnoreUnfixed bool `env:"SCANNER_TRIVY_IGNORE_UNFIXED" envDefault:"false"`
33-
IgnorePolicy string `env:"SCANNER_TRIVY_IGNORE_POLICY"`
34-
SkipUpdate bool `env:"SCANNER_TRIVY_SKIP_UPDATE" envDefault:"false"`
35-
GitHubToken string `env:"SCANNER_TRIVY_GITHUB_TOKEN"`
36-
Insecure bool `env:"SCANNER_TRIVY_INSECURE" envDefault:"false"`
27+
CacheDir string `env:"SCANNER_TRIVY_CACHE_DIR" envDefault:"/home/scanner/.cache/trivy"`
28+
ReportsDir string `env:"SCANNER_TRIVY_REPORTS_DIR" envDefault:"/home/scanner/.cache/reports"`
29+
DebugMode bool `env:"SCANNER_TRIVY_DEBUG_MODE" envDefault:"false"`
30+
VulnType string `env:"SCANNER_TRIVY_VULN_TYPE" envDefault:"os,library"`
31+
Severity string `env:"SCANNER_TRIVY_SEVERITY" envDefault:"UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"`
32+
IgnoreUnfixed bool `env:"SCANNER_TRIVY_IGNORE_UNFIXED" envDefault:"false"`
33+
IgnorePolicy string `env:"SCANNER_TRIVY_IGNORE_POLICY"`
34+
SkipUpdate bool `env:"SCANNER_TRIVY_SKIP_UPDATE" envDefault:"false"`
35+
GitHubToken string `env:"SCANNER_TRIVY_GITHUB_TOKEN"`
36+
Insecure bool `env:"SCANNER_TRIVY_INSECURE" envDefault:"false"`
37+
Timeout time.Duration `env:"SCANNER_TRIVY_TIMEOUT" envDefault:"5m0s"`
3738
}
3839

3940
type API struct {

‎pkg/etc/config_test.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,7 @@ func TestGetConfig(t *testing.T) {
7474
Severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
7575
Insecure: false,
7676
GitHubToken: "",
77+
Timeout: parseDuration(t, "5m0s"),
7778
},
7879
RedisPool: RedisPool{
7980
URL: "redis://localhost:6379",
@@ -111,6 +112,7 @@ func TestGetConfig(t *testing.T) {
111112
Severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
112113
Insecure: false,
113114
GitHubToken: "",
115+
Timeout: parseDuration(t, "5m0s"),
114116
},
115117
RedisPool: RedisPool{
116118
URL: "redis://localhost:6379",
@@ -153,6 +155,7 @@ func TestGetConfig(t *testing.T) {
153155
"SCANNER_TRIVY_INSECURE": "true",
154156
"SCANNER_TRIVY_SKIP_UPDATE": "true",
155157
"SCANNER_TRIVY_GITHUB_TOKEN": "<GITHUB_TOKEN>",
158+
"SCANNER_TRIVY_TIMEOUT": "15m30s",
156159

157160
"SCANNER_STORE_REDIS_NAMESPACE": "store.ns",
158161
"SCANNER_STORE_REDIS_SCAN_JOB_TTL": "2h45m15s",
@@ -185,6 +188,7 @@ func TestGetConfig(t *testing.T) {
185188
SkipUpdate: true,
186189
Insecure: true,
187190
GitHubToken: "<GITHUB_TOKEN>",
191+
Timeout: parseDuration(t, "15m30s"),
188192
},
189193
RedisPool: RedisPool{
190194
URL: "redis://harbor-harbor-redis:6379",

‎pkg/http/api/v1/handler.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -225,6 +225,7 @@ func (h *requestHandler) GetMetadata(res http.ResponseWriter, _ *http.Request) {
225225
"env.SCANNER_TRIVY_INSECURE": strconv.FormatBool(h.config.Trivy.Insecure),
226226
"env.SCANNER_TRIVY_VULN_TYPE": h.config.Trivy.VulnType,
227227
"env.SCANNER_TRIVY_SEVERITY": h.config.Trivy.Severity,
228+
"env.SCANNER_TRIVY_TIMEOUT": h.config.Trivy.Timeout.String(),
228229
}
229230

230231
vi, err := h.wrapper.GetVersion()

‎pkg/http/api/v1/handler_test.go

Lines changed: 26 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -428,31 +428,32 @@ func TestRequestHandler_GetReady(t *testing.T) {
428428
func TestRequestHandler_GetMetadata(t *testing.T) {
429429
testCases := []struct {
430430
name string
431-
mockedBuildInfo etc.BuildInfo
432-
mockedVersion trivy.VersionInfo
433-
mockedConfig etc.Config
431+
buildInfo etc.BuildInfo
432+
version trivy.VersionInfo
433+
config etc.Config
434434
mockedError error
435435
expectedHTTPCode int
436436
expectedResp string
437437
expectedError error
438438
}{
439439
{
440-
name: "Should respond with a valid Metadata JSON and HTTP 200 OK",
441-
mockedBuildInfo: etc.BuildInfo{Version: "0.1", Commit: "abc", Date: "2019-01-03T13:40"},
442-
mockedVersion: trivy.VersionInfo{
440+
name: "Should respond with a valid Metadata JSON and HTTP 200 OK",
441+
buildInfo: etc.BuildInfo{Version: "0.1", Commit: "abc", Date: "2019-01-03T13:40"},
442+
version: trivy.VersionInfo{
443443
Version: "v0.5.2-17-g3c9af62",
444444
VulnerabilityDB: &trivy.Metadata{
445445
NextUpdate: time.Unix(1584507644, 0).UTC(),
446446
UpdatedAt: time.Unix(1584517644, 0).UTC(),
447447
},
448448
},
449-
mockedConfig: etc.Config{Trivy: etc.Trivy{
449+
config: etc.Config{Trivy: etc.Trivy{
450450
SkipUpdate: false,
451451
IgnoreUnfixed: true,
452452
DebugMode: true,
453453
Insecure: true,
454454
VulnType: "os,library",
455455
Severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
456+
Timeout: 5 * time.Minute,
456457
}},
457458
expectedHTTPCode: http.StatusOK,
458459
expectedResp: `{
@@ -485,23 +486,25 @@ func TestRequestHandler_GetMetadata(t *testing.T) {
485486
"env.SCANNER_TRIVY_DEBUG_MODE": "true",
486487
"env.SCANNER_TRIVY_INSECURE": "true",
487488
"env.SCANNER_TRIVY_VULN_TYPE": "os,library",
488-
"env.SCANNER_TRIVY_SEVERITY": "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
489+
"env.SCANNER_TRIVY_SEVERITY": "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
490+
"env.SCANNER_TRIVY_TIMEOUT": "5m0s"
489491
}
490492
}`,
491493
},
492494
{
493-
name: "Should respond with a valid Metadata JSON and HTTP 200 OK, when there's no trivy Metadata present",
494-
mockedBuildInfo: etc.BuildInfo{Version: "0.1", Commit: "abc", Date: "2019-01-03T13:40"},
495-
mockedVersion: trivy.VersionInfo{
495+
name: "Should respond with a valid Metadata JSON and HTTP 200 OK, when there's no trivy Metadata present",
496+
buildInfo: etc.BuildInfo{Version: "0.1", Commit: "abc", Date: "2019-01-03T13:40"},
497+
version: trivy.VersionInfo{
496498
Version: "v0.5.2-17-g3c9af62",
497499
},
498-
mockedConfig: etc.Config{Trivy: etc.Trivy{
500+
config: etc.Config{Trivy: etc.Trivy{
499501
SkipUpdate: false,
500502
IgnoreUnfixed: true,
501503
DebugMode: true,
502504
Insecure: true,
503505
VulnType: "os,library",
504506
Severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
507+
Timeout: 5 * time.Minute,
505508
}},
506509
expectedHTTPCode: http.StatusOK,
507510
expectedResp: `{
@@ -532,18 +535,20 @@ func TestRequestHandler_GetMetadata(t *testing.T) {
532535
"env.SCANNER_TRIVY_DEBUG_MODE": "true",
533536
"env.SCANNER_TRIVY_INSECURE": "true",
534537
"env.SCANNER_TRIVY_VULN_TYPE": "os,library",
535-
"env.SCANNER_TRIVY_SEVERITY": "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
538+
"env.SCANNER_TRIVY_SEVERITY": "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
539+
"env.SCANNER_TRIVY_TIMEOUT": "5m0s"
536540
}
537541
}`,
538542
},
539543
{
540-
name: "Should respond with a valid Metadata JSON and HTTP 200 OK when GetVersion fails",
541-
mockedError: errors.New("get version failed"),
542-
mockedBuildInfo: etc.BuildInfo{Version: "0.1", Commit: "abc", Date: "2019-01-03T13:40"},
543-
mockedConfig: etc.Config{
544+
name: "Should respond with a valid Metadata JSON and HTTP 200 OK when GetVersion fails",
545+
mockedError: errors.New("get version failed"),
546+
buildInfo: etc.BuildInfo{Version: "0.1", Commit: "abc", Date: "2019-01-03T13:40"},
547+
config: etc.Config{
544548
Trivy: etc.Trivy{
545549
VulnType: "os,library",
546550
Severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
551+
Timeout: 5 * time.Minute,
547552
},
548553
},
549554
expectedHTTPCode: http.StatusOK,
@@ -575,7 +580,8 @@ func TestRequestHandler_GetMetadata(t *testing.T) {
575580
"env.SCANNER_TRIVY_DEBUG_MODE": "false",
576581
"env.SCANNER_TRIVY_INSECURE": "false",
577582
"env.SCANNER_TRIVY_VULN_TYPE": "os,library",
578-
"env.SCANNER_TRIVY_SEVERITY": "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
583+
"env.SCANNER_TRIVY_SEVERITY": "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
584+
"env.SCANNER_TRIVY_TIMEOUT": "5m0s"
579585
}
580586
}`,
581587
},
@@ -586,14 +592,14 @@ func TestRequestHandler_GetMetadata(t *testing.T) {
586592
enqueuer := mock.NewEnqueuer()
587593
store := mock.NewStore()
588594
wrapper := trivy.NewMockWrapper()
589-
wrapper.On("GetVersion").Return(tc.mockedVersion, tc.mockedError)
595+
wrapper.On("GetVersion").Return(tc.version, tc.mockedError)
590596

591597
rr := httptest.NewRecorder()
592598

593599
r, err := http.NewRequest(http.MethodGet, "/api/v1/metadata", nil)
594600
require.NoError(t, err, tc.name)
595601

596-
NewAPIHandler(tc.mockedBuildInfo, tc.mockedConfig, enqueuer, store, wrapper).ServeHTTP(rr, r)
602+
NewAPIHandler(tc.buildInfo, tc.config, enqueuer, store, wrapper).ServeHTTP(rr, r)
597603

598604
rs := rr.Result()
599605

0 commit comments

Comments
 (0)