ci: image collection and scanning #461
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,84 @@ | ||
| #!/usr/bin/env bash | ||
|
|
||
|
|
||
| # pipefail that pipes break | ||
| set -euo pipefail | ||
|
|
||
| export PATH="$HOME/.local/bin/:$PATH" | ||
| SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" | ||
|
|
||
| MANAGED="${MANAGED:-${PWD}/platform-components/helm}" | ||
| CONFIG_FILE="${CONFIG_FILE:-config.yaml}" | ||
| CLUSTER_NAME="$(yq -r '.clusters[0].name' "$CONFIG_FILE")" | ||
|
Contributor
There was a problem hiding this comment. Tiny thing: |
||
| CONFIGS="${CONFIGS:-platform-configs/${CLUSTER_NAME}/helm}" | ||
| OUTPUT_FILE="${OUTPUT_FILE:-}" | ||
|
tuunit marked this conversation as resolved.
|
||
|
|
||
| [[ -f "$CONFIG_FILE" ]] || { echo "::error::Missing $CONFIG_FILE — run 'kubara generate' first (or cd into its output)"; exit 1; } | ||
| [[ -d "$MANAGED" ]] || { echo "::error::Missing $MANAGED — run 'kubara generate' first"; exit 1; } | ||
| command -v helm >/dev/null 2>&1 || { echo "::error::helm not found on PATH"; exit 1; } | ||
| command -v yq >/dev/null 2>&1 || { echo "::error::yq not found on PATH"; exit 1; } | ||
|
|
||
| KUBE_VERSION=$(yq -r '.clusters[0].terraform.kubernetesVersion' "$CONFIG_FILE") | ||
|
|
||
| PROMETHEUS_STATUS="$(yq -r '.clusters[0].services."kube-prometheus-stack".status // "disabled"' "$CONFIG_FILE")" | ||
|
|
||
| # helm template flags advertise the monitoring API only when | ||
| # kube-prometheus-stack is enabled, since some charts (eg. traefik) render | ||
| # ServiceMonitors guarded by a `fail` on monitoring.coreos.com/v1. | ||
| HELM_TEMPLATE_ARGS=(--kube-version "$KUBE_VERSION" --include-crds) | ||
| if [[ "$PROMETHEUS_STATUS" == enabled ]]; then | ||
| HELM_TEMPLATE_ARGS+=(--api-versions "monitoring.coreos.com/v1") | ||
| fi | ||
|
|
||
|
|
||
| echo "Rendering charts from $MANAGED (kube-version=$KUBE_VERSION)" >&2 | ||
|
|
||
|
|
||
| render_dir="$(mktemp -d)"; trap 'rm -rf "$render_dir"' EXIT | ||
| FAILED=() | ||
|
Contributor
There was a problem hiding this comment. Nice that failures get collected in Could we fail (or at least emit a visible Minor: on the |
||
|
|
||
| for chart_path in "$MANAGED"/*/; do | ||
| chart=$(basename "$chart_path") | ||
| [[ -f "$chart_path/Chart.yaml" ]] || continue | ||
|
|
||
| # Don't render library charts | ||
| [[ "$(yq '.type // "application"' "$chart_path/Chart.yaml")" == library ]] && continue | ||
|
|
||
| echo "Updating dependency for ${chart_path}" >&2 | ||
|
|
||
| if ! dep_out=$(helm dependency update "$chart_path" >/dev/null 2>&1); then | ||
| echo "::error::helm dependency update failed for '$chart_path'"; echo "$dep_out" >&2 | ||
| FAILED+=("$chart:dependency-update"); continue | ||
| fi | ||
|
|
||
| values_file="$CONFIGS/$chart/values.generated.yaml" | ||
| base_values=(); [[ -f "$values_file" ]] && base_values=(-f "$values_file") | ||
|
|
||
| if ! helm template "${HELM_TEMPLATE_ARGS[@]}" \ | ||
| "$chart" "$chart_path" "${base_values[@]}" \ | ||
| > "$render_dir/$chart.yaml" 2> "$render_dir/$chart.err"; then | ||
| echo "::error::helm template for for '$chart':" | ||
| sed 's/^/ /' "$render_dir/$chart.err" >&2 | ||
| FAILED+=("$chart:template"); continue | ||
| fi | ||
| done | ||
|
|
||
| IMAGES="$( | ||
| cat "$render_dir"/*.yaml | | ||
| grep -E '^[[:space:]]*image:' | | ||
|
Contributor
There was a problem hiding this comment. Quick note on coverage: since extraction is a
Not a blocker, but might be worth a comment noting this is best-effort, so "scan passed" isn't read as "every running image was scanned." |
||
| sed -E "s/^[[:space:]]*image:[[:space:]]*//; s/[\"']//g" | | ||
| grep -vE '[*!]' | # drop kyverno wildcard/negation entries | ||
| grep -vE '^[[:space:]]*$' | | ||
| sort -u | ||
| )" | ||
|
|
||
| echo "Done Rendering!" | ||
|
|
||
| [[ -n "$IMAGES" ]] || { echo "::warning::No image references found"; exit 0; } | ||
|
Contributor
There was a problem hiding this comment. With A |
||
|
|
||
| echo "$IMAGES" | ||
|
|
||
| if [[ -n "$OUTPUT_FILE" ]]; then | ||
| echo "$IMAGES" > "$OUTPUT_FILE" | ||
| echo "::notice::Image list written to $OUTPUT_FILE" | ||
| fi | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
severity: HIGHonly reports HIGH —CRITICALfindings are excluded from the SARIF. Did you meanseverity: HIGH,CRITICAL? (Combined withexit-code: '0'the scan is report-only, which is totally fine if that's intended.)