From a065510ba5c5a58823b3231d0602fc244d93fb8c Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Wed, 14 May 2025 10:59:05 +0200 Subject: [PATCH 1/7] Make trivy db cache resources configurable Signed-off-by: Jannik Hollenbach --- scanners/trivy/templates/trivy-database-cache.yaml | 2 ++ scanners/trivy/tests/__snapshot__/scanner_test.yaml.snap | 2 ++ scanners/trivy/values.yaml | 2 ++ 3 files changed, 6 insertions(+) diff --git a/scanners/trivy/templates/trivy-database-cache.yaml b/scanners/trivy/templates/trivy-database-cache.yaml index 5e8e2bbaed..b160c1856f 100644 --- a/scanners/trivy/templates/trivy-database-cache.yaml +++ b/scanners/trivy/templates/trivy-database-cache.yaml @@ -45,6 +45,8 @@ spec: - name: trivy-database image: "{{ .Values.scanner.image.repository }}:{{ .Values.scanner.image.tag | default .Chart.AppVersion }}" imagePullPolicy: IfNotPresent + resources: + {{- toYaml .Values.trivyDatabaseCache.resources | nindent 10 }} args: - "server" - "--listen" diff --git a/scanners/trivy/tests/__snapshot__/scanner_test.yaml.snap b/scanners/trivy/tests/__snapshot__/scanner_test.yaml.snap index 79eb4605cd..dd4b1dbc10 100644 --- a/scanners/trivy/tests/__snapshot__/scanner_test.yaml.snap +++ b/scanners/trivy/tests/__snapshot__/scanner_test.yaml.snap @@ -61,6 +61,7 @@ matches the snapshot: initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 + resources: {} imagePullSecrets: - name: foo 3: | @@ -449,6 +450,7 @@ works properly in k8sScanScope=cluster: initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 + resources: {} 3: | apiVersion: execution.securecodebox.io/v1 kind: ParseDefinition diff --git a/scanners/trivy/values.yaml b/scanners/trivy/values.yaml index 806e62fc41..31be42ba5c 100644 --- a/scanners/trivy/values.yaml +++ b/scanners/trivy/values.yaml @@ -117,6 +117,8 @@ trivyDatabaseCache: enabled: true # -- amount of replicas to configure for the Deployment replicas: 1 + # -- Optional resource limits/requests for the trivy database cache container + resources: {} cascadingRules: # cascadingRules.enabled -- Enables or disables the installation of the default cascading rules for this scanner From e2a009c6435226f2fb43923579dd521664a879b9 Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Wed, 14 May 2025 11:06:52 +0200 Subject: [PATCH 2/7] Add sensible security context settings for trivy db cache Signed-off-by: Jannik Hollenbach --- .../trivy/templates/trivy-database-cache.yaml | 9 +++++++++ .../tests/__snapshot__/scanner_test.yaml.snap | 18 ++++++++++++++++++ scanners/trivy/values.yaml | 14 ++++++++++++++ 3 files changed, 41 insertions(+) diff --git a/scanners/trivy/templates/trivy-database-cache.yaml b/scanners/trivy/templates/trivy-database-cache.yaml index b160c1856f..0c8a7c2ce3 100644 --- a/scanners/trivy/templates/trivy-database-cache.yaml +++ b/scanners/trivy/templates/trivy-database-cache.yaml @@ -37,6 +37,11 @@ spec: labels: app: trivy-database spec: + automountServiceAccountToken: false + {{- with .Values.trivyDatabaseCache.podSecurityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} {{- with .Values.imagePullSecrets }} imagePullSecrets: {{- toYaml . | nindent 8 }} @@ -45,6 +50,10 @@ spec: - name: trivy-database image: "{{ .Values.scanner.image.repository }}:{{ .Values.scanner.image.tag | default .Chart.AppVersion }}" imagePullPolicy: IfNotPresent + {{- with .Values.trivyDatabaseCache.securityContext }} + securityContext: + {{- toYaml . | nindent 10 }} + {{- end }} resources: {{- toYaml .Values.trivyDatabaseCache.resources | nindent 10 }} args: diff --git a/scanners/trivy/tests/__snapshot__/scanner_test.yaml.snap b/scanners/trivy/tests/__snapshot__/scanner_test.yaml.snap index dd4b1dbc10..4aad8ce06a 100644 --- a/scanners/trivy/tests/__snapshot__/scanner_test.yaml.snap +++ b/scanners/trivy/tests/__snapshot__/scanner_test.yaml.snap @@ -31,6 +31,7 @@ matches the snapshot: labels: app: trivy-database spec: + automountServiceAccountToken: false containers: - args: - server @@ -62,6 +63,14 @@ matches the snapshot: periodSeconds: 10 successThreshold: 1 resources: {} + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + readOnlyRootFilesystem: false + runAsNonRoot: true imagePullSecrets: - name: foo 3: | @@ -420,6 +429,7 @@ works properly in k8sScanScope=cluster: labels: app: trivy-database spec: + automountServiceAccountToken: false containers: - args: - server @@ -451,6 +461,14 @@ works properly in k8sScanScope=cluster: periodSeconds: 10 successThreshold: 1 resources: {} + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + readOnlyRootFilesystem: false + runAsNonRoot: true 3: | apiVersion: execution.securecodebox.io/v1 kind: ParseDefinition diff --git a/scanners/trivy/values.yaml b/scanners/trivy/values.yaml index 31be42ba5c..592c88b621 100644 --- a/scanners/trivy/values.yaml +++ b/scanners/trivy/values.yaml @@ -119,6 +119,20 @@ trivyDatabaseCache: replicas: 1 # -- Optional resource limits/requests for the trivy database cache container resources: {} + # -- Optional securityContext set on database cache pod (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) + podSecurityContext: + {} + + # -- Optional securityContext set on database cache container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) + securityContext: + runAsNonRoot: true + # -- trivy db cache needs fs access to write the cache + readOnlyRootFilesystem: false + allowPrivilegeEscalation: false + privileged: false + capabilities: + drop: + - ALL cascadingRules: # cascadingRules.enabled -- Enables or disables the installation of the default cascading rules for this scanner From c3e674774266169dcfbfd24b4dd626db06c36da5 Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Wed, 14 May 2025 11:20:09 +0200 Subject: [PATCH 3/7] Explicitly run trivy db cache with a non root user id Event though it's not configured in the upstream image Signed-off-by: Jannik Hollenbach --- scanners/trivy/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scanners/trivy/values.yaml b/scanners/trivy/values.yaml index 592c88b621..2896f9b9b4 100644 --- a/scanners/trivy/values.yaml +++ b/scanners/trivy/values.yaml @@ -121,7 +121,7 @@ trivyDatabaseCache: resources: {} # -- Optional securityContext set on database cache pod (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) podSecurityContext: - {} + runAsUser: 10001 # -- Optional securityContext set on database cache container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) securityContext: From 935148eb3259fb40a8f4e5c55443364a959edae6 Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Wed, 14 May 2025 11:21:23 +0200 Subject: [PATCH 4/7] Add volume mounts to trivy container to allow to set the general FS to read only Signed-off-by: Jannik Hollenbach --- scanners/trivy/templates/trivy-database-cache.yaml | 10 ++++++++++ scanners/trivy/values.yaml | 3 +-- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/scanners/trivy/templates/trivy-database-cache.yaml b/scanners/trivy/templates/trivy-database-cache.yaml index 0c8a7c2ce3..05ac119d67 100644 --- a/scanners/trivy/templates/trivy-database-cache.yaml +++ b/scanners/trivy/templates/trivy-database-cache.yaml @@ -46,9 +46,19 @@ spec: imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} + volumes: + - name: cache-dir + emptyDir: {} + - name: tmp-dir + emptyDir: {} containers: - name: trivy-database image: "{{ .Values.scanner.image.repository }}:{{ .Values.scanner.image.tag | default .Chart.AppVersion }}" + volumeMounts: + - name: cache-dir + mountPath: /.cache + - name: tmp-dir + mountPath: /tmp imagePullPolicy: IfNotPresent {{- with .Values.trivyDatabaseCache.securityContext }} securityContext: diff --git a/scanners/trivy/values.yaml b/scanners/trivy/values.yaml index 2896f9b9b4..48e1b62fc3 100644 --- a/scanners/trivy/values.yaml +++ b/scanners/trivy/values.yaml @@ -126,8 +126,7 @@ trivyDatabaseCache: # -- Optional securityContext set on database cache container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) securityContext: runAsNonRoot: true - # -- trivy db cache needs fs access to write the cache - readOnlyRootFilesystem: false + readOnlyRootFilesystem: true allowPrivilegeEscalation: false privileged: false capabilities: From 4b3485b3cccb5fb54b8362d24866bd9ed0803445 Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Wed, 14 May 2025 11:34:09 +0200 Subject: [PATCH 5/7] Update JuiceShop example scan image Old ones were outdated and not supported by trivy anymore Signed-off-by: Jannik Hollenbach --- scanners/trivy-sbom/examples/image-juice-shop/scan.yaml | 2 +- scanners/trivy/examples/image-juice-shop/scan.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/scanners/trivy-sbom/examples/image-juice-shop/scan.yaml b/scanners/trivy-sbom/examples/image-juice-shop/scan.yaml index 662be10a7d..63ca2c6f3f 100644 --- a/scanners/trivy-sbom/examples/image-juice-shop/scan.yaml +++ b/scanners/trivy-sbom/examples/image-juice-shop/scan.yaml @@ -9,4 +9,4 @@ metadata: spec: scanType: "trivy-sbom-image" parameters: - - "bkimminich/juice-shop:v15.0.0" + - "bkimminich/juice-shop:v17.3.0" diff --git a/scanners/trivy/examples/image-juice-shop/scan.yaml b/scanners/trivy/examples/image-juice-shop/scan.yaml index 8b2967617a..6163dbbb22 100644 --- a/scanners/trivy/examples/image-juice-shop/scan.yaml +++ b/scanners/trivy/examples/image-juice-shop/scan.yaml @@ -11,4 +11,4 @@ metadata: spec: scanType: "trivy-image" parameters: - - "bkimminich/juice-shop:v10.2.0" + - "bkimminich/juice-shop:v17.3.0" From 22894347253dccc956b727b6c03d3d16403f8e00 Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Wed, 14 May 2025 11:43:29 +0200 Subject: [PATCH 6/7] Update helm snapshot for security & volume changes Signed-off-by: Jannik Hollenbach --- .../tests/__snapshot__/scanner_test.yaml.snap | 28 +++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-) diff --git a/scanners/trivy/tests/__snapshot__/scanner_test.yaml.snap b/scanners/trivy/tests/__snapshot__/scanner_test.yaml.snap index 4aad8ce06a..04f2c53894 100644 --- a/scanners/trivy/tests/__snapshot__/scanner_test.yaml.snap +++ b/scanners/trivy/tests/__snapshot__/scanner_test.yaml.snap @@ -69,10 +69,22 @@ matches the snapshot: drop: - ALL privileged: false - readOnlyRootFilesystem: false + readOnlyRootFilesystem: true runAsNonRoot: true + volumeMounts: + - mountPath: /.cache + name: cache-dir + - mountPath: /tmp + name: tmp-dir imagePullSecrets: - name: foo + securityContext: + runAsUser: 10001 + volumes: + - emptyDir: {} + name: cache-dir + - emptyDir: {} + name: tmp-dir 3: | apiVersion: execution.securecodebox.io/v1 kind: ParseDefinition @@ -467,8 +479,20 @@ works properly in k8sScanScope=cluster: drop: - ALL privileged: false - readOnlyRootFilesystem: false + readOnlyRootFilesystem: true runAsNonRoot: true + volumeMounts: + - mountPath: /.cache + name: cache-dir + - mountPath: /tmp + name: tmp-dir + securityContext: + runAsUser: 10001 + volumes: + - emptyDir: {} + name: cache-dir + - emptyDir: {} + name: tmp-dir 3: | apiVersion: execution.securecodebox.io/v1 kind: ParseDefinition From 76c33c7ba005e81c14737772fadfd0fa96ee966d Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Wed, 14 May 2025 11:46:51 +0200 Subject: [PATCH 7/7] Set storage limits for cache volumes Signed-off-by: Jannik Hollenbach --- scanners/trivy/templates/trivy-database-cache.yaml | 6 ++++-- .../trivy/tests/__snapshot__/scanner_test.yaml.snap | 12 ++++++++---- scanners/trivy/values.yaml | 3 +++ 3 files changed, 15 insertions(+), 6 deletions(-) diff --git a/scanners/trivy/templates/trivy-database-cache.yaml b/scanners/trivy/templates/trivy-database-cache.yaml index 05ac119d67..cd701f8b5c 100644 --- a/scanners/trivy/templates/trivy-database-cache.yaml +++ b/scanners/trivy/templates/trivy-database-cache.yaml @@ -48,9 +48,11 @@ spec: {{- end }} volumes: - name: cache-dir - emptyDir: {} + emptyDir: + sizeLimit: {{ .Values.trivyDatabaseCache.cacheStorageLimit }} - name: tmp-dir - emptyDir: {} + emptyDir: + sizeLimit: {{ .Values.trivyDatabaseCache.cacheStorageLimit }} containers: - name: trivy-database image: "{{ .Values.scanner.image.repository }}:{{ .Values.scanner.image.tag | default .Chart.AppVersion }}" diff --git a/scanners/trivy/tests/__snapshot__/scanner_test.yaml.snap b/scanners/trivy/tests/__snapshot__/scanner_test.yaml.snap index 04f2c53894..c1b5c93c07 100644 --- a/scanners/trivy/tests/__snapshot__/scanner_test.yaml.snap +++ b/scanners/trivy/tests/__snapshot__/scanner_test.yaml.snap @@ -81,9 +81,11 @@ matches the snapshot: securityContext: runAsUser: 10001 volumes: - - emptyDir: {} + - emptyDir: + sizeLimit: 1Gi name: cache-dir - - emptyDir: {} + - emptyDir: + sizeLimit: 1Gi name: tmp-dir 3: | apiVersion: execution.securecodebox.io/v1 @@ -489,9 +491,11 @@ works properly in k8sScanScope=cluster: securityContext: runAsUser: 10001 volumes: - - emptyDir: {} + - emptyDir: + sizeLimit: 1Gi name: cache-dir - - emptyDir: {} + - emptyDir: + sizeLimit: 1Gi name: tmp-dir 3: | apiVersion: execution.securecodebox.io/v1 diff --git a/scanners/trivy/values.yaml b/scanners/trivy/values.yaml index 48e1b62fc3..172c6eb321 100644 --- a/scanners/trivy/values.yaml +++ b/scanners/trivy/values.yaml @@ -123,6 +123,9 @@ trivyDatabaseCache: podSecurityContext: runAsUser: 10001 + # -- storage limit for the trivy db cache emptyDir volumes. (applied to two volumes) + cacheStorageLimit: 1Gi + # -- Optional securityContext set on database cache container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) securityContext: runAsNonRoot: true