From 287a3e545efc20eca5670bfc407d2ea1873d753a Mon Sep 17 00:00:00 2001 From: Dimitris Sotirakis Date: Tue, 13 Jun 2023 11:07:55 +0300 Subject: [PATCH] [v10.0.x] Security Scans: Exclude windows container scans (#69977) (#69980) Security Scans: Exclude windows container scans (#69977) * Exclude windows container scans * Fixes according to reviewer's comments (cherry picked from commit fa70fba0e38ef7fb5dcda88767319308d26db915) # Conflicts: # .drone.yml --- .drone.yml | 10 +--------- scripts/drone/pipelines/ci_images.star | 8 ++++---- scripts/drone/pipelines/windows.star | 6 +++--- scripts/drone/steps/lib.star | 26 ++++++++++++++----------- scripts/drone/utils/images.star | 4 ---- scripts/drone/utils/windows_images.star | 12 ++++++++++++ 6 files changed, 35 insertions(+), 31 deletions(-) create mode 100644 scripts/drone/utils/windows_images.star diff --git a/.drone.yml b/.drone.yml index b798680883c..ca0b07deb81 100644 --- a/.drone.yml +++ b/.drone.yml @@ -6658,17 +6658,13 @@ steps: - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM grafana/grafana-ci-deploy:1.3.3 - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM alpine:3.17.1 - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM byrnedo/alpine-curl:0.1.8 - - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM mcr.microsoft.com/windows:1809 - - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM grafana/ci-wix:0.1.1 - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM golang:1.20.4 - - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM grafana/grafana-ci-windows-test:0.1.0 - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM plugins/slack - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM postgres:12.3-alpine - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM mysql:5.7.39 - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM mysql:8.0.32 - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM redis:6.2.11-alpine - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM memcached:1.6.9-alpine - - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM docker:windowsservercore-1809 - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM us.gcr.io/kubernetes-dev/package-publish:latest - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM osixia/openldap:1.4.0 - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM grafana/drone-downstream @@ -6684,17 +6680,13 @@ steps: - trivy --exit-code 1 --severity HIGH,CRITICAL grafana/grafana-ci-deploy:1.3.3 - trivy --exit-code 1 --severity HIGH,CRITICAL alpine:3.17.1 - trivy --exit-code 1 --severity HIGH,CRITICAL byrnedo/alpine-curl:0.1.8 - - trivy --exit-code 1 --severity HIGH,CRITICAL mcr.microsoft.com/windows:1809 - - trivy --exit-code 1 --severity HIGH,CRITICAL grafana/ci-wix:0.1.1 - trivy --exit-code 1 --severity HIGH,CRITICAL golang:1.20.4 - - trivy --exit-code 1 --severity HIGH,CRITICAL grafana/grafana-ci-windows-test:0.1.0 - trivy --exit-code 1 --severity HIGH,CRITICAL plugins/slack - trivy --exit-code 1 --severity HIGH,CRITICAL postgres:12.3-alpine - trivy --exit-code 1 --severity HIGH,CRITICAL mysql:5.7.39 - trivy --exit-code 1 --severity HIGH,CRITICAL mysql:8.0.32 - trivy --exit-code 1 --severity HIGH,CRITICAL redis:6.2.11-alpine - trivy --exit-code 1 --severity HIGH,CRITICAL memcached:1.6.9-alpine - - trivy --exit-code 1 --severity HIGH,CRITICAL docker:windowsservercore-1809 - trivy --exit-code 1 --severity HIGH,CRITICAL us.gcr.io/kubernetes-dev/package-publish:latest - trivy --exit-code 1 --severity HIGH,CRITICAL osixia/openldap:1.4.0 - trivy --exit-code 1 --severity HIGH,CRITICAL grafana/drone-downstream @@ -6900,6 +6892,6 @@ kind: secret name: delivery-bot-app-private-key --- kind: signature -hmac: 173ff54968a902c3201c8e12316cbb9a74b29e335e64782fa3d3aef5883a1a9d +hmac: 76493ca40e52d049728a17a6577728654628245e2412215c44018d73a27e9b7c ... diff --git a/scripts/drone/pipelines/ci_images.star b/scripts/drone/pipelines/ci_images.star index 734b731c2a8..269798741c5 100644 --- a/scripts/drone/pipelines/ci_images.star +++ b/scripts/drone/pipelines/ci_images.star @@ -11,8 +11,8 @@ load( "from_secret", ) load( - "scripts/drone/utils/images.star", - "images", + "scripts/drone/utils/windows_images.star", + "windows_images", ) def publish_ci_windows_test_image_pipeline(): @@ -28,7 +28,7 @@ def publish_ci_windows_test_image_pipeline(): steps = [ { "name": "clone", - "image": images["wix_image"], + "image": windows_images["wix_image"], "environment": { "GITHUB_TOKEN": from_secret("github_token"), }, @@ -39,7 +39,7 @@ def publish_ci_windows_test_image_pipeline(): }, { "name": "build-and-publish", - "image": images["windows_server_core_image"], + "image": windows_images["windows_server_core_image"], "environment": { "DOCKER_USERNAME": from_secret("docker_username"), "DOCKER_PASSWORD": from_secret("docker_password"), diff --git a/scripts/drone/pipelines/windows.star b/scripts/drone/pipelines/windows.star index e2ecd7a4f22..f20759c18e7 100644 --- a/scripts/drone/pipelines/windows.star +++ b/scripts/drone/pipelines/windows.star @@ -15,8 +15,8 @@ load( "windows_wire_install_step", ) load( - "scripts/drone/utils/images.star", - "images", + "scripts/drone/utils/windows_images.star", + "windows_images", ) def windows_test_backend(trigger, edition, ver_mode): @@ -39,7 +39,7 @@ def windows_test_backend(trigger, edition, ver_mode): else: steps.extend([{ "name": "windows-init", - "image": images["windows_go_image"], + "image": windows_images["windows_go_image"], "depends_on": ["clone"], "commands": [], }]) diff --git a/scripts/drone/steps/lib.star b/scripts/drone/steps/lib.star index 583f6557f80..6f1979a806d 100644 --- a/scripts/drone/steps/lib.star +++ b/scripts/drone/steps/lib.star @@ -11,6 +11,10 @@ load( "scripts/drone/utils/images.star", "images", ) +load( + "scripts/drone/utils/windows_images.star", + "windows_images", +) grabpl_version = "v3.0.38" @@ -56,7 +60,7 @@ def wire_install_step(): def windows_wire_install_step(edition): return { "name": "wire-install", - "image": images["windows_go_image"], + "image": windows_images["windows_go_image"], "commands": [ "go install github.com/google/wire/cmd/wire@v0.5.0", "wire gen -tags {} ./pkg/server".format(edition), @@ -78,7 +82,7 @@ def identify_runner_step(platform = "linux"): else: return { "name": "identify-runner", - "image": images["windows_image"], + "image": windows_images["1809_image"], "commands": [ "echo $env:DRONE_RUNNER_NAME", ], @@ -235,7 +239,7 @@ def windows_init_enterprise_steps(ver_mode): download_grabpl_step(platform = "windows"), { "name": "clone", - "image": images["wix_image"], + "image": windows_images["wix_image"], "environment": { "GITHUB_TOKEN": from_secret("github_token"), }, @@ -243,7 +247,7 @@ def windows_init_enterprise_steps(ver_mode): }, { "name": "windows-init", - "image": images["wix_image"], + "image": windows_images["wix_image"], "commands": init_cmds, "depends_on": ["clone"], "environment": {"GITHUB_TOKEN": from_secret("github_token")}, @@ -256,7 +260,7 @@ def download_grabpl_step(platform = "linux"): if platform == "windows": return { "name": "grabpl", - "image": images["wix_image"], + "image": windows_images["wix_image"], "commands": [ '$$ProgressPreference = "SilentlyContinue"', "Invoke-WebRequest https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/{}/windows/grabpl.exe -OutFile grabpl.exe".format( @@ -682,7 +686,7 @@ def test_backend_step(image = images["build_image"]): } def windows_test_backend_step(): - step = test_backend_step(image = images["windows_go_image"]) + step = test_backend_step(image = windows_images["windows_go_image"]) return step def test_backend_integration_step(): @@ -1382,7 +1386,7 @@ def publish_linux_packages_step(edition, package_manager = "deb"): def windows_clone_step(): return { "name": "clone", - "image": images["wix_image"], + "image": windows_images["wix_image"], "environment": { "GITHUB_TOKEN": from_secret("github_token"), }, @@ -1442,7 +1446,7 @@ def get_windows_steps(edition, ver_mode): [ { "name": "clone", - "image": images["wix_image"], + "image": windows_images["wix_image"], "environment": { "GITHUB_TOKEN": from_secret("github_token"), }, @@ -1450,7 +1454,7 @@ def get_windows_steps(edition, ver_mode): }, { "name": "windows-init", - "image": images["wix_image"], + "image": windows_images["wix_image"], "commands": init_cmds, "depends_on": ["clone"], "environment": {"GITHUB_TOKEN": from_secret("github_token")}, @@ -1469,7 +1473,7 @@ def get_windows_steps(edition, ver_mode): [ { "name": "windows-init", - "image": images["wix_image"], + "image": windows_images["wix_image"], "commands": init_cmds, }, ], @@ -1544,7 +1548,7 @@ def get_windows_steps(edition, ver_mode): steps.append( { "name": "build-windows-installer", - "image": images["wix_image"], + "image": windows_images["wix_image"], "depends_on": [ "windows-init", ], diff --git a/scripts/drone/utils/images.star b/scripts/drone/utils/images.star index 0450301c1c2..d260c1b28b0 100644 --- a/scripts/drone/utils/images.star +++ b/scripts/drone/utils/images.star @@ -8,17 +8,13 @@ images = { "publish_image": "grafana/grafana-ci-deploy:1.3.3", "alpine_image": "alpine:3.17.1", "curl_image": "byrnedo/alpine-curl:0.1.8", - "windows_image": "mcr.microsoft.com/windows:1809", - "wix_image": "grafana/ci-wix:0.1.1", "go_image": "golang:1.20.4", - "windows_go_image": "grafana/grafana-ci-windows-test:0.1.0", "plugins_slack_image": "plugins/slack", "postgres_alpine_image": "postgres:12.3-alpine", "mysql5_image": "mysql:5.7.39", "mysql8_image": "mysql:8.0.32", "redis_alpine_image": "redis:6.2.11-alpine", "memcached_alpine_image": "memcached:1.6.9-alpine", - "windows_server_core_image": "docker:windowsservercore-1809", "package_publish_image": "us.gcr.io/kubernetes-dev/package-publish:latest", "openldap_image": "osixia/openldap:1.4.0", "drone_downstream_image": "grafana/drone-downstream", diff --git a/scripts/drone/utils/windows_images.star b/scripts/drone/utils/windows_images.star new file mode 100644 index 00000000000..2a605727ba8 --- /dev/null +++ b/scripts/drone/utils/windows_images.star @@ -0,0 +1,12 @@ +""" +This module contains all the windows docker images that are used to build test and publish Grafana. +All the windows images needed to be in a different file than the other images, since they cannot be scanned +by trivy. Related issue: https://github.com/aquasecurity/trivy/issues/1392 +""" + +windows_images = { + "1809_image": "mcr.microsoft.com/windows:1809", + "wix_image": "grafana/ci-wix:0.1.1", + "windows_server_core_image": "docker:windowsservercore-1809", + "windows_go_image": "grafana/grafana-ci-windows-test:0.1.0", +}