Develop

cronjob/configmap.yaml

@@ -10,12 +10,7 @@ data:
 
     mkdir -p /tmp/reports
 
-    run_kubectl_command() {
-        report_type=$1
-        timestamp=$(date +%s)
-        kubectl get $report_type -o json > /tmp/reports/${report_type}_${timestamp}.json
-        echo "/tmp/reports/${report_type}_${timestamp}.json"
-    }
+    timestamp=$(date +%s)
 
     report_types=(
         'vulnerabilityreports'
@@ -28,48 +23,13 @@ data:
     )
 
     for report_type in "${report_types[@]}"; do
-        run_kubectl_command $report_type $1
+        output_file="/tmp/reports/${report_type}_${timestamp}.json"
+        if kubectl get "$report_type" -o json > "$output_file"; then
+            echo "Successfully wrote $output_file"
+        else
+            echo "Failed to get $report_type" >&2
+        fi
     done
 
     touch /tmp/reports/report_done
     ls /tmp/reports
-
-  upload.sh: |
-    #!/bin/sh
-
-    # Load credentials from the OpenStack credentials file
-    vault_path="/etc/openstack/credentials"
-    if [ -f "$vault_path" ]; then
-        while IFS='=' read -r key value; do
-            export "$key"="$value"
-        done < "$vault_path"
-    else
-        echo "Error: Vault credentials file not found at $vault_path"
-        exit 1
-    fi
-
-    # Config environment variables
-    export OS_PROJECT_NAME="your-bucket-s3"
-    export OS_AUTH_URL="https://api.wavestack.de:5000"
-    export OS_PROJECT_NAME="project_name"
-    export OS_AUTH_TYPE="v3applicationcredential"
-
-    # Report directory and OpenStack container name
-    report_directory="/tmp/reports"
-    container_name="object_storage_container_name"
-
-    # Proccess and upload JSON files to OpenStack container
-    for file_path in "$report_directory"/*.json; do
-        if [ -f "$file_path" ]; then
-            object_name="scan_results/$(basename "$file_path")"
-            openstack object create "$container_name" "$file_path" --name "$object_name"
-            if [ $? -ne 0 ]; then
-                echo "Error: Failed to upload $file_path to $container_name/$object_name"
-                exit 1
-            else
-                echo "Uploaded $file_path to $container_name/$object_name successfully."
-            fi
-        else
-            echo "No JSON files found in $report_directory."
-        fi
-    done

cronjob/trivy-cronjob.yaml

@@ -10,41 +10,6 @@ spec:
         spec:
           serviceAccountName: "trivy-operator"
           restartPolicy: OnFailure
-          initContainers:
-            - name: "vault-agent-init"
-              args:
-                - touch /home/vault/.vault-token && vault agent -config=/vault/configs/changeme.hcl -exit-after-auth=true #Hcl file must be created before in Vault
-              command:
-                - "/bin/sh"
-                - "-ec"
-              env:
-                - name: "VAULT_ADDR"
-                  value: "https://vault.infra.sovereignit.cloud:8200"
-                - name: "VAULT_LOG_LEVEL"
-                  value: "debug"
-                - name: "VAULT_LOG_FORMAT"
-                  value: "standard"
-              image: "hashicorp/vault"
-              securityContext:
-                allowPrivilegeEscalation: false
-                capabilities:
-                  drop:
-                    - ALL
-                readOnlyRootFilesystem: true
-                runAsGroup: 10001
-                runAsNonRoot: true
-                runAsUser: 10001
-              resources:
-                limits:
-                  memory: "256Mi"
-                requests:
-                  cpu: "5m"
-                  memory: "32Mi"
-              volumeMounts:
-                - mountPath: "/home/vault"
-                  name: "home-init"
-                - mountPath: "/vault/secrets"
-                  name: "cron-config"
           containers:
           - name: trivy-reports-getter
             image: bitnami/kubectl
@@ -57,17 +22,35 @@ spec:
               subPath: "openstack"
             - mountPath: "/tmp/reports"
               name: "reports"
-          - name: trivy-reports-uploader
-            image: openstacktools/openstack-client
-            command: ["/bin/sh", "-c", "timeout=60; while [ ! -f /tmp/reports/report_done ] && [ $timeout -gt 0 ]; do sleep 1; timeout=$((timeout - 1)); done; [ ! -f /tmp/reports/report_done ] && { echo 'Error: report_done file not found after waiting.'; exit 1; }; cp /scripts/upload.sh /tmp/upload.sh && chmod +x /tmp/upload.sh && /tmp/upload.sh"]
+          - name: "trivy-reports-uploader"
+            image: "ghcr.io/gtema/openstack"
+            command:
+              - "/bin/sh"
+              - "-c"
+            args:
+              - |
+                timeout=60; \
+                while [ ! -f /tmp/reports/report_done ] && [ $timeout -gt 0 ]; do \
+                  sleep 1; \
+                  timeout=$((timeout - 1)); \
+                done; \
+                if [ ! -f /tmp/reports/report_done ]; then \
+                  echo "Error: report_done file not found after waiting."; \
+                  exit 1; \
+                fi; \
+                cd /tmp/reports && \
+                for file in *.json; do \
+                  osc --os-cloud backup object-store object upload backup scan_results/${file} -vv; \
+                done
+            envFrom:
+              - secretRef:
+                  name: openstack-credentials
             volumeMounts:
-            - name: scripts
-              mountPath: "/scripts"
-            - mountPath: "/etc/openstack"
-              name: "cron-config"
-              subPath: "openstack"
-            - mountPath: "/tmp/reports"
-              name: "reports"
+              - mountPath: "/tmp/reports"
+                name: "reports"
+              - mountPath: "/etc/openstack"
+                name: "cron-config"
+                subPath: "openstack"
 
 
           volumes:

docs/overview.md

@@ -58,6 +58,10 @@ See [the quickstart page](./quickstart.md).
 
 See [the tools page](./tools.md).
 
+## Reports
+
+See [the reports page](./reports.md).
+
 ## Source
 
 [github.com/SovereignCloudStack/security-k8s-scan-pipeline](https://github.com/SovereignCloudStack/security-k8s-scan-pipeline).