Refine CVE check in check script for k8s version policy #779

piobig2871 · 2024-10-11T09:29:20Z

No description provided.

Signed-off-by: Piotr <[email protected]>

piobig2871 · 2024-10-11T10:39:27Z

initial codes pushed to the git, the rest will be upcoming after tests

Signed-off-by: Piotr <[email protected]>

mbuechse

A few remarks regarding the standard. The code I can't review in a reasonable way because it seems to be work in progress (which is okay). Maybe you can mark this PR as draft?

Standards/scs-0210-v2-k8s-version-policy.md

mbuechse · 2024-10-16T12:49:38Z

Standards/scs-0210-v2-k8s-version-policy.md

+3. CI Integration
+   * Trivy
+     - Providers should integrate Trivy into their CI pipeline to automatically scan Kubernetes cluster components,
+    including kubelet, apiserver, and others.
+     - The CI job MUST fail if critical vulnerabilities (CVSS >= 8) are detected in the cluster components.
+     - JSON reports from Trivy scans should be reviewed, and Trivy's experimental status should be monitored for changes
+     in output formats.
+   * nvdlib (Fallback):
+     - If Trivy fails or cannot meet requierements, nvdlib MUST be used as a fallback to query CVE data for Kubernetes
+     versions, laveraging CPE-based searches to track vunerabilities for specific versions. 
+     - Providers using nvdlib MUST periodically query for critical cunerabilities affecting the Kubernetes version in production.
+
+4. TBD


This standard has been stabilized already, for better or worse. New requirements can only be introduced in a new major version (then v3). However, I'm not sure that this was the original objective of this PR; here, we mainly wanted some tooling for the compliance check, and the providers are free to use whatever tools they want. (We can put these items into the implementation notes though, but only as non-authoritative recommendation!)

does that mean that I should restore original version of standard?

It would be good to make your research results available. We should just reframe them as guidelines for operators. We could write a blog post. I would then ask you to get feedback from Team Container. It would be good to talk to people who already use Trivy.

What I have done right now is restore the original standard text and drop the changes.

According to the code, there were several changes made:

Integrated Trivy for scanning Kubernetes pod images for security vulnerabilities.

Fixed issue with ClusterInfo object being incorrectly passed where kubeconfig path was expected.

Added logging improvements to provide clearer insights during version compliance checks.

Refined the code structure to handle K8s image scanning and cluster versioning in an async manner.

What I have done right now is restore the original standard text and drop the changes

This is not what I see.

I would then ask you to get feedback from Team Container

Have you done that?

What I have done right now is restore the original standard text and drop the changes

@mbuechse I do apologize, I have reverted it now, it was lost somewhere on my git in the mess with the branches

I would then ask you to get feedback from Team Container

Have you done that?

I have not, I will bring that topic on the nearest container call(last week there was not a container call at all).

Sounds good!

mbuechse · 2024-10-16T12:52:51Z

Sorry, I went ahead and marked this as draft, and I changed the title as well to give context.

- Integrated Trivy for scanning Kubernetes pod images for security vulnerabilities. - Fixed issue with ClusterInfo object being incorrectly passed where kubeconfig path was expected. - Addressed SSL certificate verification error when making external HTTP requests by adding proper handling. - Updated the compliance check logic to ensure correct validation of Kubernetes cluster versions and vulnerability checks. - Added logging improvements to provide clearer insights during version compliance checks. - Refined the code structure to handle K8s image scanning and cluster versioning in an async manner. Signed-off-by: Piotr <[email protected]>

Signed-off-by: Piotr <[email protected]>

mbuechse

See my remarks. Two general remarks:

it would be good to have some explanation what is being done and how it relates to the standard -- please expand the docstrings and/or README.md
do we now have redundant checks? the old CVE check doesn't seem to be gone?

mbuechse · 2024-10-25T07:25:04Z

Standards/scs-0210-v2-k8s-version-policy.md

+3. CI Integration
+   * Trivy
+     - Providers should integrate Trivy into their CI pipeline to automatically scan Kubernetes cluster components,
+    including kubelet, apiserver, and others.
+     - The CI job MUST fail if critical vulnerabilities (CVSS >= 8) are detected in the cluster components.
+     - JSON reports from Trivy scans should be reviewed, and Trivy's experimental status should be monitored for changes
+     in output formats.
+   * nvdlib (Fallback):
+     - If Trivy fails or cannot meet requierements, nvdlib MUST be used as a fallback to query CVE data for Kubernetes
+     versions, laveraging CPE-based searches to track vunerabilities for specific versions. 
+     - Providers using nvdlib MUST periodically query for critical cunerabilities affecting the Kubernetes version in production.
+
+4. TBD


What I have done right now is restore the original standard text and drop the changes

This is not what I see.

mbuechse · 2024-10-25T10:49:38Z

Standards/scs-0210-v2-k8s-version-policy.md

+3. CI Integration
+   * Trivy
+     - Providers should integrate Trivy into their CI pipeline to automatically scan Kubernetes cluster components,
+    including kubelet, apiserver, and others.
+     - The CI job MUST fail if critical vulnerabilities (CVSS >= 8) are detected in the cluster components.
+     - JSON reports from Trivy scans should be reviewed, and Trivy's experimental status should be monitored for changes
+     in output formats.
+   * nvdlib (Fallback):
+     - If Trivy fails or cannot meet requierements, nvdlib MUST be used as a fallback to query CVE data for Kubernetes
+     versions, laveraging CPE-based searches to track vunerabilities for specific versions. 
+     - Providers using nvdlib MUST periodically query for critical cunerabilities affecting the Kubernetes version in production.
+
+4. TBD


I would then ask you to get feedback from Team Container

Have you done that?

mbuechse · 2024-10-25T10:50:16Z

Tests/kaas/k8s-version-policy/k8s_version_policy.py

+
+async def get_k8s_pod_images(kubeconfig, context=None) -> list[str]:
+    """Get the list of container images used by all the pods in the Kubernetes cluster."""
+    cluster_config = await kubernetes_asyncio.config.load_kube_config(kubeconfig, context)


This variable is not used (this fact gets reported by flake8 as well), and this doesn't seem right?!

Tests/kaas/k8s-version-policy/k8s_version_policy.py

mbuechse · 2024-10-25T10:55:23Z

Tests/kaas/k8s-version-policy/k8s_version_policy.py

    connector = aiohttp.TCPConnector(limit=5)
    async with aiohttp.ClientSession(connector=connector) as session:
        cve_affected_ranges = await collect_cve_versions(session)
    releases_data = fetch_k8s_releases_data()

+    try:
+        logger.info(f"Checking cluster specified by {kubeconfig_path}")


This needs some more explanation, because almost the same message will be displayed in line 577 (only better, because there, it contains the context as well).

would that be satisfying?

f""" Initiating scan on the Kubernetes cluster specified by kubeconfig at '{kubeconfig_path}'
{' with context ' + config.context if config.context else ''}.
Fetching cluster information and verifying access.""")

scanner provides in the output additional info regarding vulnerability.

My point was that it looks like a duplicate of the other line, and it appears to me that the script now tries to achieve the same objective with two different means, one after the other.

Signed-off-by: Piotr <[email protected]>

…d, providing more specific description for initiating scan on the kubernetes, removing cluster_config variable Signed-off-by: Piotr <[email protected]>

Signed-off-by: Piotr <[email protected]>

Co-authored-by: Matthias Büchse <[email protected]> Signed-off-by: Piotr <[email protected]>

Signed-off-by: Piotr <[email protected]>

jschoone · 2024-11-07T10:12:27Z

Hi @mbuechse and @piobig2871,
as requested in the Container Call, I just tried that script but get some weird result:

./k8s_version_policy.py -k /tmp/kubeconfig                                                                                                                         ⎈ (kind-kind/default)
WARNING: The EOL data in k8s-eol-data.yml isn't up-to-date.
INFO: Initiating scan on the Kubernetes cluster specified by kubeconfig at /tmp/kubeconfig
            with context .
            Fetching cluster information and verifying access.
INFO: Scanning image: /
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: t
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: m
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: p
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: /
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: k
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: u
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: b
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: e
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: c
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: o
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: n
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: f
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: i
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: g
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Checking cluster specified by default context in /tmp/kubeconfig.
ERROR: The K8s cluster version 1.29.9 of cluster 'cs-cluster-admin@cs-cluster' is outdated according to the standard.
version-policy-check: FAIL

It looks like it loops over the path to the kubeconfig and uses every character as image to scan.
Yes, I'm aware of that trivy is not found and I also tried with that installed, but the output is the same, just noisier:

./k8s_version_policy.py -k /tmp/kubeconfig
WARNING: The EOL data in k8s-eol-data.yml isn't up-to-date.
INFO: Initiating scan on the Kubernetes cluster specified by kubeconfig at /tmp/kubeconfig
            with context .
            Fetching cluster information and verifying access.
INFO: Scanning image: /
ERROR: Trivy scan failed: 2024-11-07T11:07:03+01:00	INFO	Need to update DB
2024-11-07T11:07:03+01:00	INFO	Downloading DB...	repository="ghcr.io/aquasecurity/trivy-db:2"
2024-11-07T11:07:05+01:00	FATAL	Fatal error	init error: DB error: failed to download vulnerability DB: database download error: OCI repository error: 1 error occurred:
	* GET https://ghcr.io/v2/aquasecurity/trivy-db/manifests/2: TOOMANYREQUESTS: retry-after: 522.404µs, allowed: 44000/minute
INFO: Scanning image: t
ERROR: Trivy scan failed: 2024-11-07T11:07:05+01:00	INFO	Need to update DB
2024-11-07T11:07:05+01:00	INFO	Downloading DB...	repository="ghcr.io/aquasecurity/trivy-db:2"
2024-11-07T11:07:20+01:00	INFO	Vulnerability scanning is enabled
2024-11-07T11:07:20+01:00	INFO	Secret scanning is enabled
2024-11-07T11:07:20+01:00	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-07T11:07:20+01:00	INFO	Please see also https://aquasecurity.github.io/trivy/dev/docs/scanner/secret/#recommendation for faster secret detection
2024-11-07T11:07:20+01:00	FATAL	Fatal error	image scan error: scan error: unable to initialize a scanner: unable to initialize an image scanner: failed to parse the image name: could not parse reference: t
INFO: Scanning image: m
ERROR: Trivy scan failed: 2024-11-07T11:07:20+01:00	INFO	Vulnerability scanning is enabled
2024-11-07T11:07:20+01:00	INFO	Secret scanning is enabled
2024-11-07T11:07:20+01:00	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-07T11:07:20+01:00	INFO	Please see also https://aquasecurity.github.io/trivy/dev/docs/scanner/secret/#recommendation for faster secret detection
2024-11-07T11:07:20+01:00	FATAL	Fatal error	image scan error: scan error: unable to initialize a scanner: unable to initialize an image scanner: failed to parse the image name: could not parse reference: m
INFO: Scanning image: p
ERROR: Trivy scan failed: 2024-11-07T11:07:20+01:00	INFO	Vulnerability scanning is enabled
2024-11-07T11:07:20+01:00	INFO	Secret scanning is enabled
2024-11-07T11:07:20+01:00	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-07T11:07:20+01:00	INFO	Please see also https://aquasecurity.github.io/trivy/dev/docs/scanner/secret/#recommendation for faster secret detection
2024-11-07T11:07:20+01:00	FATAL	Fatal error	image scan error: scan error: unable to initialize a scanner: unable to initialize an image scanner: failed to parse the image name: could not parse reference: p
INFO: Scanning image: /
ERROR: Trivy scan failed: 2024-11-07T11:07:20+01:00	INFO	Vulnerability scanning is enabled
2024-11-07T11:07:20+01:00	INFO	Secret scanning is enabled
2024-11-07T11:07:20+01:00	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-07T11:07:20+01:00	INFO	Please see also https://aquasecurity.github.io/trivy/dev/docs/scanner/secret/#recommendation for faster secret detection
2024-11-07T11:07:20+01:00	FATAL	Fatal error	image scan error: scan error: unable to initialize a scanner: unable to initialize an image scanner: failed to parse the image name: could not parse reference: /
INFO: Scanning image: k
ERROR: Trivy scan failed: 2024-11-07T11:07:21+01:00	INFO	Vulnerability scanning is enabled
2024-11-07T11:07:21+01:00	INFO	Secret scanning is enabled
2024-11-07T11:07:21+01:00	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-07T11:07:21+01:00	INFO	Please see also https://aquasecurity.github.io/trivy/dev/docs/scanner/secret/#recommendation for faster secret detection
2024-11-07T11:07:21+01:00	FATAL	Fatal error	image scan error: scan error: unable to initialize a scanner: unable to initialize an image scanner: failed to parse the image name: could not parse reference: k
INFO: Scanning image: u
ERROR: Trivy scan failed: 2024-11-07T11:07:21+01:00	INFO	Vulnerability scanning is enabled
2024-11-07T11:07:21+01:00	INFO	Secret scanning is enabled
2024-11-07T11:07:21+01:00	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-07T11:07:21+01:00	INFO	Please see also https://aquasecurity.github.io/trivy/dev/docs/scanner/secret/#recommendation for faster secret detection
2024-11-07T11:07:21+01:00	FATAL	Fatal error	image scan error: scan error: unable to initialize a scanner: unable to initialize an image scanner: failed to parse the image name: could not parse reference: u
INFO: Scanning image: b
ERROR: Trivy scan failed: 2024-11-07T11:07:21+01:00	INFO	Vulnerability scanning is enabled
2024-11-07T11:07:21+01:00	INFO	Secret scanning is enabled
2024-11-07T11:07:21+01:00	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-07T11:07:21+01:00	INFO	Please see also https://aquasecurity.github.io/trivy/dev/docs/scanner/secret/#recommendation for faster secret detection
2024-11-07T11:07:21+01:00	FATAL	Fatal error	image scan error: scan error: unable to initialize a scanner: unable to initialize an image scanner: failed to parse the image name: could not parse reference: b
INFO: Scanning image: e
ERROR: Trivy scan failed: 2024-11-07T11:07:22+01:00	INFO	Vulnerability scanning is enabled
2024-11-07T11:07:22+01:00	INFO	Secret scanning is enabled
2024-11-07T11:07:22+01:00	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-07T11:07:22+01:00	INFO	Please see also https://aquasecurity.github.io/trivy/dev/docs/scanner/secret/#recommendation for faster secret detection
2024-11-07T11:07:22+01:00	FATAL	Fatal error	image scan error: scan error: unable to initialize a scanner: unable to initialize an image scanner: failed to parse the image name: could not parse reference: e
INFO: Scanning image: c
ERROR: Trivy scan failed: 2024-11-07T11:07:22+01:00	INFO	Vulnerability scanning is enabled
2024-11-07T11:07:22+01:00	INFO	Secret scanning is enabled
2024-11-07T11:07:22+01:00	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-07T11:07:22+01:00	INFO	Please see also https://aquasecurity.github.io/trivy/dev/docs/scanner/secret/#recommendation for faster secret detection
2024-11-07T11:07:22+01:00	FATAL	Fatal error	image scan error: scan error: unable to initialize a scanner: unable to initialize an image scanner: failed to parse the image name: could not parse reference: c
INFO: Scanning image: o
ERROR: Trivy scan failed: 2024-11-07T11:07:22+01:00	INFO	Vulnerability scanning is enabled
2024-11-07T11:07:22+01:00	INFO	Secret scanning is enabled
2024-11-07T11:07:22+01:00	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-07T11:07:22+01:00	INFO	Please see also https://aquasecurity.github.io/trivy/dev/docs/scanner/secret/#recommendation for faster secret detection
2024-11-07T11:07:22+01:00	FATAL	Fatal error	image scan error: scan error: unable to initialize a scanner: unable to initialize an image scanner: failed to parse the image name: could not parse reference: o
INFO: Scanning image: n
ERROR: Trivy scan failed: 2024-11-07T11:07:22+01:00	INFO	Vulnerability scanning is enabled
2024-11-07T11:07:22+01:00	INFO	Secret scanning is enabled
2024-11-07T11:07:22+01:00	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-07T11:07:22+01:00	INFO	Please see also https://aquasecurity.github.io/trivy/dev/docs/scanner/secret/#recommendation for faster secret detection
2024-11-07T11:07:22+01:00	FATAL	Fatal error	image scan error: scan error: unable to initialize a scanner: unable to initialize an image scanner: failed to parse the image name: could not parse reference: n
INFO: Scanning image: f
ERROR: Trivy scan failed: 2024-11-07T11:07:23+01:00	INFO	Vulnerability scanning is enabled
2024-11-07T11:07:23+01:00	INFO	Secret scanning is enabled
2024-11-07T11:07:23+01:00	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-07T11:07:23+01:00	INFO	Please see also https://aquasecurity.github.io/trivy/dev/docs/scanner/secret/#recommendation for faster secret detection
2024-11-07T11:07:23+01:00	FATAL	Fatal error	image scan error: scan error: unable to initialize a scanner: unable to initialize an image scanner: failed to parse the image name: could not parse reference: f
INFO: Scanning image: i
ERROR: Trivy scan failed: 2024-11-07T11:07:23+01:00	INFO	Vulnerability scanning is enabled
2024-11-07T11:07:23+01:00	INFO	Secret scanning is enabled
2024-11-07T11:07:23+01:00	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-07T11:07:23+01:00	INFO	Please see also https://aquasecurity.github.io/trivy/dev/docs/scanner/secret/#recommendation for faster secret detection
2024-11-07T11:07:23+01:00	FATAL	Fatal error	image scan error: scan error: unable to initialize a scanner: unable to initialize an image scanner: failed to parse the image name: could not parse reference: i
INFO: Scanning image: g
ERROR: Trivy scan failed: 2024-11-07T11:07:23+01:00	INFO	Vulnerability scanning is enabled
2024-11-07T11:07:23+01:00	INFO	Secret scanning is enabled
2024-11-07T11:07:23+01:00	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-07T11:07:23+01:00	INFO	Please see also https://aquasecurity.github.io/trivy/dev/docs/scanner/secret/#recommendation for faster secret detection
2024-11-07T11:07:23+01:00	FATAL	Fatal error	image scan error: scan error: unable to initialize a scanner: unable to initialize an image scanner: failed to parse the image name: could not parse reference: g
INFO: Checking cluster specified by default context in /tmp/kubeconfig.
ERROR: The K8s cluster version 1.29.9 of cluster 'cs-cluster-admin@cs-cluster' is outdated according to the standard.
version-policy-check: FAIL

Signed-off-by: Piotr <[email protected]>

piobig2871 · 2024-11-08T07:56:54Z

Hi @jschoone there was a problem with one argument, I have fixed the issue.

jschoone · 2024-11-19T15:13:09Z

Hi @jschoone there was a problem with one argument, I have fixed the issue.

Hi @piobig2871 looks good now!

./k8s_version_policy.py --kubeconfig /tmp/kubeconfig
....
version-policy-check: PASS

I'd just recommend to check for trivy before it starts to prevent all these output:

./k8s_version_policy.py -k /tmp/kubeconfig
WARNING: The EOL data in k8s-eol-data.yml isn't up-to-date.
INFO: Initiating scan on the Kubernetes cluster specified by kubeconfig at /tmp/kubeconfig
            with context .
            Fetching cluster information and verifying access.
INFO: Scanning image: registry.k8s.io/kube-apiserver:v1.29.10
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: registry.k8s.io/metrics-server/metrics-server:v0.7.2
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: registry.k8s.io/sig-storage/csi-attacher:v4.4.2
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: registry.k8s.io/sig-storage/csi-snapshotter:v6.3.2
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: registry.k8s.io/provider-os/cinder-csi-plugin:v1.29.1
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: registry.k8s.io/coredns/coredns:v1.11.1
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: registry.k8s.io/kube-controller-manager:v1.29.10
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: registry.k8s.io/provider-os/openstack-cloud-controller-manager:v1.29.1
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: registry.k8s.io/etcd:3.5.15-0
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: quay.io/cilium/cilium:v1.16.3@sha256:62d2a09bbef840a46099ac4c69421c90f84f28d018d479749049011329aa7f28
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: registry.k8s.io/sig-storage/csi-provisioner:v3.6.2
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: registry.k8s.io/kube-scheduler:v1.29.10
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: quay.io/cilium/cilium-envoy:v1.29.9-1728346947-0d05e48bfbb8c4737ec40d5781d970a550ed2bbd@sha256:42614a44e508f70d03a04470df5f61e3cffd22462471a0be0544cf116f2c50ba
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.9.2
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: registry.k8s.io/sig-storage/livenessprobe:v2.11.0
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: quay.io/cilium/operator-generic:v1.16.3@sha256:6e2925ef47a1c76e183c48f95d4ce0d34a1e5e848252f910476c3e11ce1ec94b
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: registry.k8s.io/kube-proxy:v1.29.10
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Scanning image: registry.k8s.io/sig-storage/csi-resizer:v1.9.2
ERROR: Error running Trivy scan: [Errno 2] No such file or directory: 'trivy'
INFO: Checking cluster specified by default context in /tmp/kubeconfig.
INFO: The K8s cluster version 1.29.10 of cluster 'scs-cluster-129-admin@scs-cluster-129' is still in the recency time window.
version-policy-check: FAIL

Tests/kaas/k8s-version-policy/k8s_version_policy.py

Co-authored-by: Kurt Garloff <[email protected]> Signed-off-by: Piotr <[email protected]>

piobig2871 added 2 commits October 10, 2024 13:41

adding functions for getting more information & debug

d96edd7

Signed-off-by: Piotr <[email protected]>

Merge branch 'main' into 526-refine-cve-check-in-scs-0210-v2-test-script

0caf99d

piobig2871 added 3 commits October 16, 2024 12:15

solving conflicts

ebfe951

Signed-off-by: Piotr <[email protected]>

fixing git inset

e635411

Signed-off-by: Piotr <[email protected]>

Merge branch 'main' into 526-refine-cve-check-in-scs-0210-v2-test-script

a298678

mbuechse self-requested a review October 16, 2024 11:30

mbuechse reviewed Oct 16, 2024

View reviewed changes

mbuechse marked this pull request as draft October 16, 2024 12:51

mbuechse changed the title ~~adding functions for getting more information & debug~~ Refine CVE check in check script for k8s version policy Oct 16, 2024

Merge branch 'main' into 526-refine-cve-check-in-scs-0210-v2-test-script

cfc3dc6

mbuechse linked an issue Oct 18, 2024 that may be closed by this pull request

Refine CVE check in scs-0210-v2 test script. #526

Open

piobig2871 added 2 commits October 18, 2024 15:03

Merge branch 'main' into 526-refine-cve-check-in-scs-0210-v2-test-script

cc87097

piobig2871 requested a review from mbuechse October 22, 2024 09:19

Merge branch 'main' into 526-refine-cve-check-in-scs-0210-v2-test-script

38921f1

piobig2871 marked this pull request as ready for review October 23, 2024 08:28

removing comments

12987e5

Signed-off-by: Piotr <[email protected]>

mbuechse reviewed Oct 25, 2024

View reviewed changes

piobig2871 and others added 6 commits November 4, 2024 15:20

reseting standard to it's original form

1d332ae

Signed-off-by: Piotr <[email protected]>

reverting ClusterInfo to its original shape, removing kubeconfig fiel…

11daeac

…d, providing more specific description for initiating scan on the kubernetes, removing cluster_config variable Signed-off-by: Piotr <[email protected]>

removing unused kubeconfig variable

e62b347

Signed-off-by: Piotr <[email protected]>

fixing pylint and docstring formatting

5ab2bd0

Signed-off-by: Piotr <[email protected]>

Update Tests/kaas/k8s-version-policy/k8s_version_policy.py

5e2b764

Co-authored-by: Matthias Büchse <[email protected]> Signed-off-by: Piotr <[email protected]>

fixing pylint and resolving conflict which appeard after review

3348960

Signed-off-by: Piotr <[email protected]>

piobig2871 added 2 commits November 7, 2024 15:18

fixing the script with providing proper images list to check out

4a59878

Signed-off-by: Piotr <[email protected]>

femoving unused lines

cea9840

Signed-off-by: Piotr <[email protected]>

Merge branch 'main' into 526-refine-cve-check-in-scs-0210-v2-test-script

c676f5f

garloff reviewed Nov 20, 2024

View reviewed changes

Tests/kaas/k8s-version-policy/k8s_version_policy.py Outdated Show resolved Hide resolved

piobig2871 and others added 3 commits November 21, 2024 08:43

Update Tests/kaas/k8s-version-policy/k8s_version_policy.py

f1674fe

Co-authored-by: Kurt Garloff <[email protected]> Signed-off-by: Piotr <[email protected]>

Merge branch 'main' into 526-refine-cve-check-in-scs-0210-v2-test-script

f51a46c

Merge branch 'main' into 526-refine-cve-check-in-scs-0210-v2-test-script

48ba4d7

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Refine CVE check in check script for k8s version policy #779

Refine CVE check in check script for k8s version policy #779

piobig2871 commented Oct 11, 2024

piobig2871 commented Oct 11, 2024

mbuechse left a comment

mbuechse Oct 16, 2024

piobig2871 Oct 16, 2024 •

edited

Loading

mbuechse Oct 18, 2024

piobig2871 Oct 18, 2024

mbuechse Oct 25, 2024

mbuechse Oct 25, 2024

piobig2871 Nov 4, 2024

piobig2871 Nov 4, 2024 •

edited

Loading

mbuechse Nov 4, 2024

mbuechse commented Oct 16, 2024

mbuechse left a comment

mbuechse Oct 25, 2024

mbuechse Oct 25, 2024

mbuechse Oct 25, 2024

piobig2871 Nov 4, 2024

mbuechse Oct 25, 2024

piobig2871 Nov 4, 2024

mbuechse Nov 4, 2024

jschoone commented Nov 7, 2024

piobig2871 commented Nov 8, 2024

jschoone commented Nov 19, 2024

Refine CVE check in check script for k8s version policy #779

Are you sure you want to change the base?

Refine CVE check in check script for k8s version policy #779

Conversation

piobig2871 commented Oct 11, 2024

piobig2871 commented Oct 11, 2024

mbuechse left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

piobig2871 Oct 16, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

piobig2871 Nov 4, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mbuechse commented Oct 16, 2024

mbuechse left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jschoone commented Nov 7, 2024

piobig2871 commented Nov 8, 2024

jschoone commented Nov 19, 2024

piobig2871 Oct 16, 2024 •

edited

Loading

piobig2871 Nov 4, 2024 •

edited

Loading