Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: support --skip-images scanning flag #6334

Merged
merged 5 commits into from
May 2, 2024
Merged

feat: support --skip-images scanning flag #6334

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
84b8592
feat: support skip-deep scanning flag
chen-keinan Mar 17, 2024
3c06e14
feat: support skip-deep scanning flag
chen-keinan Mar 17, 2024
04455e5
feat: change flag name from skip-deep to skip images
chen-keinan Apr 3, 2024
5ecb650
feat: update skip-images flag description
chen-keinan Apr 4, 2024
f660185
feat: support skip-images flag
chen-keinan Apr 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions docs/docs/references/configuration/cli/trivy_kubernetes.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,6 +96,7 @@ trivy kubernetes [flags] [CONTEXT]
--skip-db-update skip updating vulnerability database
--skip-dirs strings specify the directories or glob patterns to skip
--skip-files strings specify the files or glob patterns to skip
--skip-images skip the downloading and scanning of images (vulnerabilities and secrets) in the cluster resources
--skip-java-db-update skip updating Java index database
--skip-policy-update skip fetching rego policy updates
-t, --template string output template
Expand Down
10 changes: 10 additions & 0 deletions pkg/flag/kubernetes_flags.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,11 @@ var (
ConfigName: "kubernetes.exclude.owned",
Usage: "exclude resources that have an owner reference",
}
SkipImages = Flag[bool]{
Name: "skip-images",
ConfigName: "kubernetes.skipImages",
Usage: "skip the downloading and scanning of images (vulnerabilities and secrets) in the cluster resources",
}
ExcludeNodes = Flag[[]string]{
Name: "exclude-nodes",
ConfigName: "kubernetes.exclude.nodes",
Expand Down Expand Up @@ -103,6 +108,7 @@ type K8sFlagGroup struct {
NodeCollectorImageRef *Flag[string]
NodeCollectorNamespace *Flag[string]
ExcludeOwned *Flag[bool]
SkipImages *Flag[bool]
ExcludeNodes *Flag[[]string]
ExcludeKinds *Flag[[]string]
IncludeKinds *Flag[[]string]
Expand All @@ -126,6 +132,7 @@ type K8sOptions struct {
ExcludeNamespaces []string
IncludeNamespaces []string
QPS float32
SkipImages bool
Burst int
}

Expand All @@ -144,6 +151,7 @@ func NewK8sFlagGroup() *K8sFlagGroup {
IncludeNamespaces: IncludeNamespaces.Clone(),
NodeCollectorImageRef: NodeCollectorImageRef.Clone(),
QPS: QPS.Clone(),
SkipImages: SkipImages.Clone(),
Burst: Burst.Clone(),
}
}
Expand All @@ -167,6 +175,7 @@ func (f *K8sFlagGroup) Flags() []Flagger {
f.ExcludeNamespaces,
f.IncludeNamespaces,
f.QPS,
f.SkipImages,
f.Burst,
}
}
Expand Down Expand Up @@ -207,6 +216,7 @@ func (f *K8sFlagGroup) ToOptions() (K8sOptions, error) {
ExcludeNodes: exludeNodeLabels,
NodeCollectorImageRef: f.NodeCollectorImageRef.Value(),
QPS: float32(f.QPS.Value()),
SkipImages: f.SkipImages.Value(),
ExcludeKinds: f.ExcludeKinds.Value(),
IncludeKinds: f.IncludeKinds.Value(),
ExcludeNamespaces: f.ExcludeNamespaces.Value(),
Expand Down
2 changes: 1 addition & 1 deletion pkg/k8s/scanner/scanner.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,7 +89,7 @@ func (s *Scanner) Scan(ctx context.Context, artifactsData []*artifacts.Artifact)

onItem := func(ctx context.Context, artifact *artifacts.Artifact) (scanResult, error) {
scanResults := scanResult{}
if s.opts.Scanners.AnyEnabled(types.VulnerabilityScanner, types.SecretScanner) {
if s.opts.Scanners.AnyEnabled(types.VulnerabilityScanner, types.SecretScanner) && !s.opts.SkipImages {
opts := s.opts
opts.Credentials = make([]ftypes.Credential, len(s.opts.Credentials))
copy(opts.Credentials, s.opts.Credentials)
Expand Down