[CI] Add Trivy vulnerables check (#17)

Signed-off-by: v.oleynikov <[email protected]> Signed-off-by: Aleksandr Zimin <[email protected]> Co-authored-by: Aleksandr Zimin <[email protected]>
deckhouse · Aug 28, 2024 · c95ca7d · c95ca7d
1 parent 01a5c65
commit c95ca7d
Show file tree

Hide file tree

Showing 32 changed files with 429 additions and 334 deletions.
diff --git a/.github/workflows/go_modules_check.yaml b/.github/workflows/go_modules_check.yaml
@@ -37,7 +37,7 @@ jobs:
           echo "Processing $go_mod_file"
           
           while IFS= read -r line; do
-            if [[ "$line" == *github.com/deckhouse/sds-* || "$line" == *github.com/deckhouse/csi-* || "$line" == *github.com/deckhouse/virtualization ]]; then
+            if [[ ("$line" == *github.com/deckhouse/sds-* || "$line" == *github.com/deckhouse/csi-* || "$line" == *github.com/deckhouse/virtualization) && "$line" =~ *replace* ]]; then
               repository=$(echo "$line" | awk '{print $1}' | awk -F'/' '{ print "https://"$1"/"$2"/"$3".git" }')
               pseudo_tag=$(echo "$line" | awk '{print $2}')
               echo "Cloning repo $repository into $temp_dir"

diff --git a/.github/workflows/trivy_check.yaml b/.github/workflows/trivy_check.yaml
@@ -0,0 +1,32 @@
+name: Trivy check for sub repos
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+jobs:
+  test:
+    name: Trivy check for sub repos
+    runs-on: [self-hosted, regular]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+
+      - name: Prepare sub repo
+        run: |
+          version=v`grep "version :=" images/csi-ceph/werf.inc.yaml | awk -F'"' '{ print $2}'`
+          git clone --depth 1 --branch $version ${{ secrets.SOURCE_REPO }}/ceph/ceph-csi.git ./ceph-csi
+          cp -R ./images/csi-ceph/patches ./ceph-csi
+          cd ./ceph-csi
+          for patchfile in ./patches/*.patch ; do echo -n "Apply ${patchfile} ... "; git apply ${patchfile}; done
+          cd ..
+
+      - name: Run Trivy vulnerability scanner in fs mode
+        uses: aquasecurity/trivy-action@master
+        with:
+          scan-type: 'fs'
+          scan-ref: '.'
+          trivy-config: trivy.yaml
diff --git a/.golangci.yaml b/.golangci.yaml
@@ -13,6 +13,10 @@ linters-settings:
     sections:
       - standard
       - default
+      - prefix(d8-controller)
+      - prefix(webhooks)
+
+
   errcheck:
     ignore: fmt:.*,[rR]ead|[wW]rite|[cC]lose,io:Copy
 
@@ -24,7 +28,7 @@ linters:
   - gci
   - gocritic
   - gofmt
-  - goimports
+# - goimports
   - gosimple
   - govet
   - ineffassign

diff --git a/api/v1alpha1/ceph_storage_class.go b/api/v1alpha1/ceph_storage_class.go
@@ -24,7 +24,7 @@ const (
 )
 
 var (
-	DefaultMountOptions = []string{"discard"}
+	DefaultMountOptionsRBD = []string{"discard"}
 )
 
 type CephStorageClass struct {

diff --git a/hooks/lib/module/module.py b/hooks/lib/module/module.py
@@ -35,25 +35,4 @@ def get_https_mode(module_name: str, values: dict) -> str:
     raise Exception("https mode is not defined")
 
 def get_module_name() -> str:
-    module = ""
-    file_path = os.path.abspath(__file__)
-    external_modules_dir = os.getenv("EXTERNAL_MODULES_DIR")
-    for dir in os.getenv("MODULES_DIR").split(":"):
-        if dir.startswith(external_modules_dir):
-            dir = external_modules_dir
-        if file_path.startswith(dir):
-            module = re.sub(f"{dir}/?\d?\d?\d?-?", "", file_path, 1).split("/")[0]
-            # /deckhouse/external-modules/virtualization/mr/hooks/hook_name.py
-            # {-------------------------- file_path --------------------------}
-            # {------ MODULES_DIR ------}{---------- regexp result ----------}} 
-            #                             virtualization/mr/hooks/hook_name.py 
-            #                            {-module-name-}{---------------------}
-            #                                  or
-            # /deckhouse/modules/900-virtualization/hooks/hook_name.py
-            # {---------------------- file_path ----------------------}
-            # {-- MODULES_DIR --}{---{-------- regexp result --------}} 
-            #                        virtualization/hooks/hook_name.py 
-            #                        {-module-name-}{-----------------}
-
-            break
-    return module
+    return "csi-ceph"
diff --git a/images/controller/src/cmd/main.go b/images/controller/src/cmd/main.go
@@ -18,25 +18,25 @@ package main
 
 import (
 	"context"
-	"d8-controller/pkg/config"
-	"d8-controller/pkg/controller"
-	"d8-controller/pkg/kubutils"
-	"d8-controller/pkg/logger"
 	"fmt"
-	"github.com/deckhouse/csi-ceph/api/v1alpha1"
 	"os"
 	goruntime "runtime"
 
-	"sigs.k8s.io/controller-runtime/pkg/cache"
-
+	"github.com/deckhouse/csi-ceph/api/v1alpha1"
 	v1 "k8s.io/api/core/v1"
 	sv1 "k8s.io/api/storage/v1"
 	extv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	apiruntime "k8s.io/apimachinery/pkg/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
+	"sigs.k8s.io/controller-runtime/pkg/cache"
 	"sigs.k8s.io/controller-runtime/pkg/healthz"
 	"sigs.k8s.io/controller-runtime/pkg/manager"
+
+	"d8-controller/pkg/config"
+	"d8-controller/pkg/controller"
+	"d8-controller/pkg/kubutils"
+	"d8-controller/pkg/logger"
 )
 
 var (
@@ -55,7 +55,7 @@ func main() {
 
 	log, err := logger.NewLogger(cfgParams.Loglevel)
 	if err != nil {
-		fmt.Println(fmt.Sprintf("unable to create NewLogger, err: %v", err))
+		fmt.Printf("unable to create NewLogger, err: %v\n", err)
 		os.Exit(1)
 	}
 

diff --git a/images/controller/src/go.mod b/images/controller/src/go.mod
@@ -3,26 +3,29 @@ module d8-controller
 go 1.22.2
 
 require (
-	github.com/deckhouse/csi-ceph/api v0.0.0-20240803013526-e9ed86f2f125
+	github.com/deckhouse/csi-ceph/api v0.0.0-20240820170126-01a5c651eb9d
 	github.com/go-logr/logr v1.4.2
-	github.com/onsi/ginkgo/v2 v2.17.2
-	github.com/onsi/gomega v1.33.1
-	k8s.io/api v0.30.2
-	k8s.io/apiextensions-apiserver v0.30.2
-	k8s.io/apimachinery v0.30.2
-	k8s.io/client-go v0.30.2
+	github.com/onsi/ginkgo/v2 v2.20.0
+	github.com/onsi/gomega v1.34.1
+	k8s.io/api v0.31.0
+	k8s.io/apiextensions-apiserver v0.31.0
+	k8s.io/apimachinery v0.31.0
+	k8s.io/client-go v0.31.0
 	k8s.io/klog/v2 v2.130.1
-	sigs.k8s.io/controller-runtime v0.18.4
+	sigs.k8s.io/controller-runtime v0.19.0
 )
 
+replace github.com/deckhouse/csi-ceph/api => ../../../api
+
 require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/emicklei/go-restful/v3 v3.12.1 // indirect
 	github.com/evanphx/json-patch v4.12.0+incompatible // indirect
 	github.com/evanphx/json-patch/v5 v5.9.0 // indirect
 	github.com/fsnotify/fsnotify v1.7.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.21.0 // indirect
 	github.com/go-openapi/swag v0.23.0 // indirect
@@ -33,36 +36,39 @@ require (
 	github.com/google/gnostic-models v0.6.8 // indirect
 	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/google/pprof v0.0.0-20240424215950-a892ee059fd6 // indirect
+	github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/imdario/mergo v0.3.16 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/klauspost/compress v1.17.9 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	github.com/prometheus/client_golang v1.19.1 // indirect
+	github.com/prometheus/client_golang v1.20.2 // indirect
 	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/prometheus/common v0.54.0 // indirect
+	github.com/prometheus/common v0.55.0 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
-	golang.org/x/exp v0.0.0-20240613232115-7f521ea00fb8 // indirect
-	golang.org/x/net v0.26.0 // indirect
-	golang.org/x/oauth2 v0.21.0 // indirect
-	golang.org/x/sys v0.21.0 // indirect
-	golang.org/x/term v0.21.0 // indirect
-	golang.org/x/text v0.16.0 // indirect
-	golang.org/x/time v0.5.0 // indirect
-	golang.org/x/tools v0.22.0 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	golang.org/x/exp v0.0.0-20240823005443-9b4947da3948 // indirect
+	golang.org/x/net v0.28.0 // indirect
+	golang.org/x/oauth2 v0.22.0 // indirect
+	golang.org/x/sys v0.24.0 // indirect
+	golang.org/x/term v0.23.0 // indirect
+	golang.org/x/text v0.17.0 // indirect
+	golang.org/x/time v0.6.0 // indirect
+	golang.org/x/tools v0.24.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
 	google.golang.org/protobuf v1.34.2 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20240620174524-b456828f718b // indirect
-	k8s.io/utils v0.0.0-20240502163921-fe8a2dddb1d0 // indirect
+	k8s.io/kube-openapi v0.0.0-20240826222958-65a50c78dec5 // indirect
+	k8s.io/utils v0.0.0-20240821151609-f90d01438635 // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
 	sigs.k8s.io/yaml v1.4.0 // indirect
-Original file line number
+Diff line change
@@ Expand Up / @@ -24,7 +24,7 @@ const ( @@
     )
     var (
-    	DefaultMountOptions = []string{"discard"}
+    	DefaultMountOptionsRBD = []string{"discard"}
     )
     type CephStorageClass struct {
@@ Expand Down @@