-
Notifications
You must be signed in to change notification settings - Fork 22
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Plumb scanner CLI into runtime scan job #31
Conversation
- Generates the families configuration for the scanner and passes it to the cloud-init - Passes the server endpoint and scan result ID to the scanner CLI in cloud-init - Updates the backend cloudformation to configure the scanner container image which is passed to the cloud-init
@@ -224,7 +235,20 @@ func (s *Scanner) runJob(ctx context.Context, data *scanData) (types.Job, error) | |||
} | |||
} | |||
|
|||
launchInstance, err = s.providerClient.RunScanningJob(ctx, launchSnapshot, s.scanConfig) | |||
volumeMountDirectory := "/vmToBeScanned" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Better to add a comment here. This is the path inside the docker that will run in the VM job where the snapshot is mapped to.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
its the directory chosen by the orchestrator where the job should mount the VM's volume so that the VMClarity CLI can find it
@@ -233,6 +257,78 @@ func (s *Scanner) runJob(ctx context.Context, data *scanData) (types.Job, error) | |||
return job, nil | |||
} | |||
|
|||
func (s *Scanner) getFamiliesConfigurationYaml(scanRootDirectory string) (string, error) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
maybe better to call it generateFamiliesConfigurationYaml?
} | ||
|
||
func userSBOMConfigToFamiliesSbomConfig(sbomConfig *models.SBOMConfig, scanRootDirectory string) familiesSbom.Config { | ||
if sbomConfig != nil && sbomConfig.Enabled != nil && !*sbomConfig.Enabled { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If the config is nil sbom will be enabled. not sure it's the required behaviour. I think that it's better to return an empty config in each of the checks or convert it to OR checks
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
ah yup, good catch my mistake
} | ||
|
||
func userVulnConfigToFamiliesVulnConfig(vulnerabilitiesConfig *models.VulnerabilitiesConfig) familiesVulnerabilities.Config { | ||
if vulnerabilitiesConfig != nil && vulnerabilitiesConfig.Enabled != nil && !*vulnerabilitiesConfig.Enabled { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
same
// TODO(sambetts) The user needs to be able to provide this configuration | ||
Registry: &kubeclarityConfig.Registry{}, | ||
Scanner: &kubeclarityConfig.Scanner{ | ||
GrypeConfig: kubeclarityConfig.GrypeConfig{ |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Need to add a todo to run it in a remote mode and to run Grype server
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good!
No description provided.