Skip to content

Commit e782f3f

Browse files
Jujuyehaaronm-sysdig
Jujuyeh
and
aaronm-sysdig
authored
Initial CLI scanner commit (#18) (#19)
* Initial CLI scanner commit (#18) * Initial CLI scanner commit * Update install.md * Using bash not sh * Update for CVSS and temp removal of description * Update to revert to v1Beta1 public APIs. Leaving in most V2 code commented out until agree to commit to main * Update to revert to v1Beta1 public APIs. Leaving in most V2 code commented out until agree to commit to main * Update to revert to v1Beta1 public APIs. Leaving in most V2 code commented out until agree to commit to main * Removing v2 code altogether * Update README.md * Update for SaaS * Update install.md * Readme Updates. * Readme Updates. * Mock Update(s) * Test updates and removal of backend tests that are no longer needed * Update ci.yaml * Update image digest for tests * Set original test image * Update image digest for tests * Pump up golang builder version in Dockerfile * Updated tests, commented out backend adapter (#20) * Dev new engine (#21) * Updated tests, commented out backend adapter * Update of scanner job logic to handle the sysdig-cli-scanner container * Dev new engine (#22) * Updated tests, commented out backend adapter * Update of scanner job logic to handle the sysdig-cli-scanner container * Test update to cater for new job spec --------- Co-authored-by: Aaron Miles <132866139+aaronm-sysdig@users.noreply.github.com>
1 parent 7448ee5 commit e782f3f

File tree

24 files changed

+1087
-817
lines changed

24 files changed

+1087
-817
lines changed

‎.github/workflows/ci.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ jobs:
4444
run: make test
4545
env:
4646
SECURE_API_TOKEN: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
47-
SECURE_URL: https://secure.sysdig.com
47+
SECURE_URL: ${{ vars.SECURE_URL }}
4848

4949
docker:
5050
name: Build Docker Image

‎README.md‎

Lines changed: 10 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -9,46 +9,20 @@ The Sysdig Secure Harbor Scanner Adapter enables Harbor to use Sysdig Secure sca
99
This adapter also provides a service that translates the Harbor scanning API requests into Sysdig Secure API calls, allowing Harbor to retrieve vulnerability reports and additional information from the scanning adapter. This information will be presented in the Harbor UI, transparently for the user.
1010

1111
## Getting Started
12-
1312
You can follow a [detailed guide to deploy the Scanner Adapter](docs/install.md).
1413

15-
## Inline and Backend Scanning
16-
17-
This scanning adapter has two operation modes:
18-
* Backend Scanning: Image scanning happens in the Sysdig Secure Backend
19-
* Inline Scanning: Image scanning happens in the infrastructure where Harbor is hosted
20-
21-
### Backend Scanning
22-
23-
This is the default mode. The Sysdig Harbor adapter will forward the container image path to the Sysdig Secure backend (either SaaS or Onprem), for example `docker.io/alpine:latest`. The backend will use this path to retrieve and scan the container image, providing the results back to the Sysdig Harbor adapter.
24-
25-
PRO:
26-
* Easier to install
27-
28-
CON:
29-
* Sysdig Secure Backend needs to have network visibility in order to fetch images from Harbor
30-
31-
### Inline Scanning
32-
33-
Using inline scanning, the scanning operation itself will be triggered and performed on your own infrastructure. It spawns a Kubernetes job when a new image is pushed, this job will communicate **only** the container metadata to the Sysdig Secure Backend, which will perform the evaluation based on the configured image [scanning policies](https://docs.sysdig.com/en/manage-scanning-policies.html).
34-
35-
PRO:
36-
* No need to configure registry credentials in the Sysdig Secure Backend
37-
* No need to expose your registry externally, so it can be reached by Sysdig Secure (see CON in the section above)
38-
* Image contents are never transmitted outside the pipeline, just the image metadata
39-
40-
CON:
41-
* The job performing the inline scanning needs to have access to the host-local Docker daemon
14+
### CLI Scanning
15+
Using CLI scanning, the scanning operation itself will be triggered and performed on your own infrastructure. It spawns a Kubernetes job when a new image is pushed, this job will communicate **only** the container metadata to the Sysdig Secure Backend, which will perform the evaluation based on the configured image [scanning policies](https://docs.sysdig.com/en/manage-scanning-policies.html).
4216

4317
## Configuration
4418

4519
Configuration of the adapter is done via environment variables at startup.
4620

47-
| Name | Default | Description |
48-
| --- | --- | --- |
49-
| `SECURE_URL` | ` ` | Sysdig Secure URL |
50-
| `SECURE_API_TOKEN` | ` ` | Sysdig Secure API Token |
51-
| `INLINE_SCANNING` | ` ` | Enable Inline Scanning instead of Backend |
52-
| `NAMESPACE_NAME` | ` ` | Namespace where Inline Scanning will spawn jobs |
53-
| `CONFIGMAP_NAME` | ` ` | ConfigMap name where Harbor Certificate is available |
54-
| `SECRET_NAME` | ` ` | Secret name where Sysdig Secure API Token and Robot Account are available |
21+
| Name | Default | Description |
22+
|-------------------|-----------------------------| --- |
23+
| `SECURE_URL` | `https://secure.sysdig.com` | Sysdig Secure URL |
24+
| `SECURE_API_TOKEN` | ` ` | Sysdig Secure API Token |
25+
| `CLI_SCANNING` | ` ` | Enable CLI Scanning instead of Backend |
26+
| `NAMESPACE_NAME` | ` ` | Namespace where CLI Scanning will spawn jobs |
27+
| `CONFIGMAP_NAME` | ` ` | ConfigMap name where Harbor Certificate is available |
28+
| `SECRET_NAME` | ` ` | Secret name where Sysdig Secure API Token and Robot Account are available |

‎build/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM golang:1.16 as builder
1+
FROM golang:1.22.1 as builder
22
WORKDIR /harbor-scanner-sysdig-secure
33
COPY go.mod go.sum ./
44
COPY . .

‎cmd/harbor-scanner-sysdig-secure/main.go‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -53,11 +53,12 @@ func configure() error {
5353
pflag.String("secure_api_token", "", "Sysdig Secure API Token")
5454
pflag.String("secure_url", "https://secure.sysdig.com", "Sysdig Secure URL Endpoint")
5555
pflag.Bool("verify_ssl", true, "Verify SSL when connecting to Sysdig Secure URL Endpoint")
56-
pflag.Bool("inline_scanning", false, "Use Inline Scanning Adapter")
56+
pflag.Bool("cli_scanning", false, "Use Sysdig-Cli-Scanner Scanning Adapter")
5757
pflag.Bool("async_mode", false, "Use Async-Mode to perform reports retrieval")
5858
pflag.String("namespace_name", "", "Namespace where inline scanning jobs are spawned")
5959
pflag.String("secret_name", "", "Secret which keeps the inline scanning secrets ")
60-
pflag.String("inline_scanning_extra_params", "", "Extra parameters to provide to inline-scanner")
60+
pflag.String("cli_scanning_extra_params", "", "Extra parameters to provide to cli-scanner")
61+
pflag.String("cli_scanner_image", "", "Extra parameters to provide to cli-scanner")
6162

6263
pflag.VisitAll(func(flag *pflag.Flag) { viper.BindPFlag(flag.Name, flag) })
6364

@@ -67,8 +68,8 @@ func configure() error {
6768
return errors.New("secure_api_token is required")
6869
}
6970

70-
if viper.GetBool("inline_scanning") && (viper.Get("namespace_name") == "" || viper.Get("secret_name") == "") {
71-
return errors.New("namespace_name and secret_name are required when running inline scanning")
71+
if viper.GetBool("cli_scanning") && (viper.Get("namespace_name") == "" || viper.Get("secret_name") == "") {
72+
return errors.New("namespace_name and secret_name are required when running sysdig-cli-scanner")
7273
}
7374

7475
return nil
@@ -77,8 +78,8 @@ func configure() error {
7778
func getAdapter() scanner.Adapter {
7879
client := secure.NewClient(viper.GetString("secure_api_token"), viper.GetString("secure_url"), viper.GetBool("verify_ssl"))
7980

80-
if viper.GetBool("inline_scanning") {
81-
log.Info("Using inline-scanning adapter")
81+
if viper.GetBool("cli_scanning") {
82+
log.Info("Using cli-scanner adapter")
8283
config, err := rest.InClusterConfig()
8384
if err != nil {
8485
log.Fatal(err)
@@ -95,11 +96,11 @@ func getAdapter() scanner.Adapter {
9596
viper.GetString("secure_url"),
9697
viper.GetString("namespace_name"),
9798
viper.GetString("secret_name"),
98-
viper.GetString("inline_scanning_extra_params"),
99+
viper.GetString("cli_scanning_extra_params"),
99100
viper.GetBool("verify_ssl"),
100101
log.StandardLogger())
101102
}
102103

103-
log.Info("Using backend-scanning adapter")
104-
return scanner.NewBackendAdapter(client)
104+
log.Fatal("Please specify the cli-scanner (--cli_scanning) command line parameter, backend scanning no longer supported")
105+
return nil
105106
}

‎docs/images/secure_as_default_harbor_ui.png‎

141 KB
Loading

‎docs/install.md‎

Lines changed: 108 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,8 @@ This guide explains how to install Harbor Scanner Adapter for Sysdig Secure.
77
* Kubernetes >= 1.14
88
* Harbor >= 1.10
99
* Helm >= 3
10-
* A Sysdig Secure API Token
10+
* A valid Sysdig Secure API Token
11+
* A valid Sysdig URL
1112

1213
### Obtaining the Sysdig Secure API Token
1314

@@ -16,20 +17,122 @@ settings. Is just below the Get Started sidebar item.
1617

1718
![Getting Secure API Token](images/getting_secure_api_token.png)
1819

20+
### Obtaining the Sysdig Secure API Token
21+
Your URL is listed in the address bar of your browser. If you login to `https://secure.sysdig.com` then that is your URL.
22+
If you login to `https://app.au1.sysdig.com` for the AP region, then this is the URL you use.
23+
24+
### Example values.yaml configuration.
25+
26+
```yaml
27+
# Default values for harbor-scanner-sysdig-secure.
28+
# This is a YAML-formatted file.
29+
# Declare variables to be passed into your templates.
30+
31+
replicaCount: 1
32+
33+
image:
34+
repository: miles3719/harbor-scanner-sysdig-secure
35+
pullPolicy: IfNotPresent
36+
37+
imagePullSecrets: []
38+
nameOverride: ""
39+
fullnameOverride: ""
40+
41+
podAnnotations: {}
42+
43+
serviceAccount:
44+
# Specifies whether a service account should be created
45+
create: true
46+
# Annotations to add to the service account
47+
annotations: {}
48+
# The name of the service account to use.
49+
# If not set and create is true, a name is generated using the fullname template
50+
name:
51+
52+
rbac:
53+
create: true
54+
55+
podSecurityContext: {}
56+
# fsGroup: 2000
57+
58+
securityContext: {}
59+
# capabilities:
60+
# drop:
61+
# - ALL
62+
# readOnlyRootFilesystem: true
63+
# runAsNonRoot: true
64+
# runAsUser: 1000
65+
66+
service:
67+
type: ClusterIP
68+
port: 5000
69+
70+
resources: {}
71+
# We usually recommend not to specify default resources and to leave this as a conscious
72+
# choice for the user. This also increases chances charts run on environments with little
73+
# resources, such as Minikube. If you do want to specify resources, uncomment the following
74+
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
75+
# limits:
76+
# cpu: 100m
77+
# memory: 128Mi
78+
# requests:
79+
# cpu: 100m
80+
# memory: 128Mi
81+
82+
nodeSelector: {}
83+
84+
tolerations: []
85+
86+
affinity: {}
87+
88+
# Custom entrypoint for the harbor plugin
89+
customEntryPoint: []
90+
91+
sysdig:
92+
secure:
93+
94+
# **required**
95+
# API Token to access Sysdig Secure.
96+
# If neither this value nor `sysdig.secure.existingSecureAPITokenSecret` are configured, the
97+
# user will be required to provide the deployment the `SECURE_API_TOKEN` environment variables.
98+
apiToken: bs456348-45a6-4b5f-c57d-35572b981a3b
99+
100+
# Alternatively, specify the name of a Kubernetes secret containing an 'sysdig_secure_api_token' entry
101+
existingSecureAPITokenSecret: ""
102+
103+
# Sysdig backend URL (SaaS Regions API endpoints are listed here: https://docs.sysdig.com/en/docs/administration/saas-regions-and-ip-ranges/)
104+
url: https://app.au1.sysdig.com
105+
verifySSL: true
106+
107+
proxy:
108+
httpProxy:
109+
httpsProxy:
110+
# Comma-separated list of domain extensions proxy should not be used for.
111+
# Include in noProxy the internal IP of the kubeapi server,
112+
# and you probably need to add your registry if it is inside the cluster
113+
noProxy:
114+
115+
CliScanning:
116+
enabled: true
117+
118+
asyncMode:
119+
enabled: true
120+
```
121+
19122
## Deploying on Kubernetes using the Helm Chart
20123
21124
The fastest way to deploy the scanner adapter is using the Helm Chart we
22125
provide. Be aware that you need to provide the Sysdig Secure API token when
23126
you type the `helm install` command.
24127

25128
```
26-
$ helm repo add sysdiglabs https://sysdiglabs.github.io/charts
27-
"sysdiglabs" has been added to your repositories
129+
$ helm repo add aaronm-sysdig https://aaronm-sysdig.github.io/charts
130+
"aaronm-sysdig" has been added to your repositories
28131

29132
$ kubectl create namespace harbor-scanner-sysdig-secure
30133
namespace/harbor-scanner-sysdig-secure created
31134

32-
$ helm -n harbor-scanner-sysdig-secure install harbor-scanner-sysdig-secure --set sysdig.secure.apiToken=XXX sysdiglabs/harbor-scanner-sysdig-secure
135+
$ helm -n harbor-scanner-sysdig-secure install harbor-scanner-sysdig-secure --set sysdig.secure.apiToken=XXX aaronm-sysdig/harbor-scanner-sysdig-secure
33136
NAME: harbor-scanner-sysdig-secure
34137
LAST DEPLOYED: Tue Jun 9 13:38:12 2020
35138
NAMESPACE: harbor-scanner-sysdig-secure
@@ -46,22 +149,7 @@ kubectl --namespace harbor-scanner-sysdig-secure port-forward $POD_NAME 8080:80
46149
And that's it. The new scanner adapter is deployed. Now is time to tell Harbor
47150
to use it, and you can find [how to configure Harbor to use Sysdig Secure Scanner Adapter](#configuring-harbor-to-use-sysdig-secure-scanner-adapter) a few lines below.
48151
49-
### Using Backend Scanning instead of Inline Scanning
50-
51-
This mode is not recommended and it is supported only for legacy purposes.
52-
53-
You will need to disable inline scan by setting `inlineScanning.enabled: false` in the values.yaml:
54-
55-
```yaml
56-
sysdig:
57-
secure:
58-
apiToken: XXX
59-
60-
inlineScanning:
61-
enabled: false
62-
```
63-
64-
You already know [how to get the Sysdig Secure API Token](#obtaining-the-sysdig-secure-api-token).
152+
You already know [how to get the Sysdig Secure API Token](#obtaining-the-sysdig-secure-api-token) and the Secure URL
65153
66154
## Configuring Harbor to use Sysdig Secure Scanner Adapter
67155

‎go.mod‎

Lines changed: 68 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,75 @@
11
module github.com/sysdiglabs/harbor-scanner-sysdig-secure
22

3-
go 1.16
3+
go 1.22.0
4+
5+
toolchain go1.22.1
46

57
require (
6-
github.com/golang/mock v1.4.3
7-
github.com/gorilla/handlers v1.4.2
8-
github.com/gorilla/mux v1.7.4
8+
github.com/golang/mock v1.6.0
9+
github.com/gorilla/handlers v1.5.2
10+
github.com/gorilla/mux v1.8.1
911
github.com/onsi/ginkgo v1.16.5
10-
github.com/onsi/gomega v1.10.1
11-
github.com/sirupsen/logrus v1.5.0
12+
github.com/onsi/gomega v1.33.1
13+
github.com/sirupsen/logrus v1.9.3
1214
github.com/spf13/pflag v1.0.5
13-
github.com/spf13/viper v1.7.0
14-
k8s.io/api v0.19.13
15-
k8s.io/apimachinery v0.19.13
16-
k8s.io/client-go v0.19.13
15+
github.com/spf13/viper v1.18.2
16+
k8s.io/api v0.30.0
17+
k8s.io/apimachinery v0.30.0
18+
k8s.io/client-go v0.30.0
19+
)
20+
21+
require (
22+
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
23+
github.com/emicklei/go-restful/v3 v3.12.0 // indirect
24+
github.com/evanphx/json-patch v5.9.0+incompatible // indirect
25+
github.com/felixge/httpsnoop v1.0.4 // indirect
26+
github.com/fsnotify/fsnotify v1.7.0 // indirect
27+
github.com/go-logr/logr v1.4.1 // indirect
28+
github.com/go-openapi/jsonpointer v0.21.0 // indirect
29+
github.com/go-openapi/jsonreference v0.21.0 // indirect
30+
github.com/go-openapi/swag v0.23.0 // indirect
31+
github.com/gogo/protobuf v1.3.2 // indirect
32+
github.com/golang/protobuf v1.5.4 // indirect
33+
github.com/google/gnostic-models v0.6.8 // indirect
34+
github.com/google/go-cmp v0.6.0 // indirect
35+
github.com/google/gofuzz v1.2.0 // indirect
36+
github.com/google/uuid v1.6.0 // indirect
37+
github.com/hashicorp/hcl v1.0.0 // indirect
38+
github.com/josharian/intern v1.0.0 // indirect
39+
github.com/json-iterator/go v1.1.12 // indirect
40+
github.com/magiconair/properties v1.8.7 // indirect
41+
github.com/mailru/easyjson v0.7.7 // indirect
42+
github.com/mitchellh/mapstructure v1.5.0 // indirect
43+
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
44+
github.com/modern-go/reflect2 v1.0.2 // indirect
45+
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
46+
github.com/nxadm/tail v1.4.11 // indirect
47+
github.com/pelletier/go-toml/v2 v2.2.2 // indirect
48+
github.com/pkg/errors v0.9.1 // indirect
49+
github.com/sagikazarmark/locafero v0.4.0 // indirect
50+
github.com/sagikazarmark/slog-shim v0.1.0 // indirect
51+
github.com/sourcegraph/conc v0.3.0 // indirect
52+
github.com/spf13/afero v1.11.0 // indirect
53+
github.com/spf13/cast v1.6.0 // indirect
54+
github.com/subosito/gotenv v1.6.0 // indirect
55+
go.uber.org/multierr v1.11.0 // indirect
56+
golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842 // indirect
57+
golang.org/x/net v0.25.0 // indirect
58+
golang.org/x/oauth2 v0.20.0 // indirect
59+
golang.org/x/sys v0.20.0 // indirect
60+
golang.org/x/term v0.20.0 // indirect
61+
golang.org/x/text v0.15.0 // indirect
62+
golang.org/x/time v0.5.0 // indirect
63+
google.golang.org/protobuf v1.34.1 // indirect
64+
gopkg.in/inf.v0 v0.9.1 // indirect
65+
gopkg.in/ini.v1 v1.67.0 // indirect
66+
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
67+
gopkg.in/yaml.v2 v2.4.0 // indirect
68+
gopkg.in/yaml.v3 v3.0.1 // indirect
69+
k8s.io/klog/v2 v2.120.1 // indirect
70+
k8s.io/kube-openapi v0.0.0-20240430033511-f0e62f92d13f // indirect
71+
k8s.io/utils v0.0.0-20240502163921-fe8a2dddb1d0 // indirect
72+
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
73+
sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
74+
sigs.k8s.io/yaml v1.4.0 // indirect
1775
)

0 commit comments

Comments
 (0)