public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security Scans: Add trivy scans to every docker image used for building/testing/publishing (#69911)

Browse Source 
* Created images.star

* Fix typo

* Add cronjobs for build-images
This commit is contained in:
Dimitris Sotirakis
2023-06-12 16:41:18 +03:00
committed by GitHub
parent d363741d39
commit 2cda971796
12 changed files with 290 additions and 124 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/drone/events/cron.star
+60 -13
View File
@@ -6,7 +6,10 @@ load("scripts/drone/vault.star", "from_secret")
load(
"scripts/drone/steps/lib.star",
"compile_build_cmd",
"publish_image",
)
load(
"scripts/drone/utils/images.star",
"images",
)
aquasec_trivy_image = "aquasec/trivy:0.21.0"
@@ -17,6 +20,7 @@ def cronjobs():
scan_docker_image_pipeline("main"),
scan_docker_image_pipeline("latest-ubuntu"),
scan_docker_image_pipeline("main-ubuntu"),
scan_build_test_publish_docker_image_pipeline(),
grafana_com_nightly_pipeline(),
]
@@ -54,34 +58,77 @@ def scan_docker_image_pipeline(tag):
cronName = "nightly",
name = "scan-" + docker_image + "-image",
steps = [
scan_docker_image_unkown_low_medium_vulnerabilities_step(docker_image),
scan_docker_image_unknown_low_medium_vulnerabilities_step(docker_image),
scan_docker_image_high_critical_vulnerabilities_step(docker_image),
slack_job_failed_step("grafana-backend-ops", docker_image),
],
)
def scan_docker_image_unkown_low_medium_vulnerabilities_step(docker_image):
return {
"name": "scan-unkown-low-medium-vulnerabilities",
"image": aquasec_trivy_image,
"commands": [
"trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM " + docker_image,
def scan_build_test_publish_docker_image_pipeline():
"""Generates a cronjob pipeline for nightly scans of grafana Docker images.
Returns:
Drone cronjob pipeline.
"""
return cron_job_pipeline(
cronName = "nightly",
name = "scan-build-test-and-publish-docker-images",
steps = [
scan_docker_image_unknown_low_medium_vulnerabilities_step("all"),
scan_docker_image_high_critical_vulnerabilities_step("all"),
slack_job_failed_step("grafana-backend-ops", "build-images"),
],
)
def scan_docker_image_unknown_low_medium_vulnerabilities_step(docker_image):
"""Generates a step for scans of Grafana Docker images.
Args:
docker_image: determines which image is scanned.
Returns:
Drone cronjob step .
"""
cmds = []
if docker_image == "all":
for key in images:
cmds = cmds + ["trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM " + images[key]]
else:
cmds = ["trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM " + docker_image]
return {
"name": "scan-unknown-low-medium-vulnerabilities",
"image": aquasec_trivy_image,
"commands": cmds,
}
def scan_docker_image_high_critical_vulnerabilities_step(docker_image):
"""Generates a step for scans of Grafana Docker images.
Args:
docker_image: determines which image is scanned.
Returns:
Drone cronjob step .
"""
cmds = []
if docker_image == "all":
for key in images:
cmds = cmds + ["trivy --exit-code 1 --severity HIGH,CRITICAL " + images[key]]
else:
cmds = ["trivy --exit-code 1 --severity HIGH,CRITICAL " + docker_image]
return {
"name": "scan-high-critical-vulnerabilities",
"image": aquasec_trivy_image,
"commands": [
"trivy --exit-code 1 --severity HIGH,CRITICAL " + docker_image,
],
"commands": cmds,
}
def slack_job_failed_step(channel, image):
return {
"name": "slack-notify-failure",
"image": "plugins/slack",
"image": images["plugins_slack_image"],
"settings": {
"webhook": from_secret("slack_webhook_backend"),
"channel": channel,
@@ -95,7 +142,7 @@ def slack_job_failed_step(channel, image):
def post_to_grafana_com_step():
return {
"name": "post-to-grafana-com",
"image": publish_image,
"image": images["publish_image"],
"environment": {
"GRAFANA_COM_API_KEY": from_secret("grafana_api_key"),
"GCP_KEY": from_secret("gcp_key"),
scripts/drone/events/release.star
+11 -10
View File
@@ -9,11 +9,9 @@ load(
"build_docker_images_step",
"build_frontend_package_step",
"build_frontend_step",
"build_image",
"build_plugins_step",
"build_storybook_step",
"clone_enterprise_step",
"cloudsdk_image",
"compile_build_cmd",
"copy_packages_for_docker_step",
"download_grabpl_step",
@@ -29,7 +27,6 @@ load(
"package_step",
"postgres_integration_tests_step",
"publish_grafanacom_step",
"publish_image",
"publish_images_step",
"publish_linux_packages_step",
"redis_integration_tests_step",
@@ -63,6 +60,10 @@ load(
"test_backend_enterprise",
)
load("scripts/drone/vault.star", "from_secret", "prerelease_bucket")
load(
"scripts/drone/utils/images.star",
"images",
)
ver_mode = "release"
release_trigger = {
@@ -84,7 +85,7 @@ release_trigger = {
def store_npm_packages_step():
return {
"name": "store-npm-packages",
"image": build_image,
"image": images["build_image"],
"depends_on": [
"compile-build-cmd",
"build-frontend-packages",
@@ -99,7 +100,7 @@ def store_npm_packages_step():
def retrieve_npm_packages_step():
return {
"name": "retrieve-npm-packages",
"image": publish_image,
"image": images["publish_image"],
"depends_on": [
"compile-build-cmd",
"yarn-install",
@@ -115,7 +116,7 @@ def retrieve_npm_packages_step():
def release_npm_packages_step():
return {
"name": "release-npm-packages",
"image": build_image,
"image": images["build_image"],
"depends_on": [
"compile-build-cmd",
"retrieve-npm-packages",
@@ -554,7 +555,7 @@ def publish_artifacts_step(mode):
security = "--security "
return {
"name": "publish-artifacts",
"image": publish_image,
"image": images["publish_image"],
"environment": {
"GCP_KEY": from_secret("gcp_key"),
"PRERELEASE_BUCKET": from_secret("prerelease_bucket"),
@@ -572,7 +573,7 @@ def publish_artifacts_step(mode):
def publish_static_assets_step():
return {
"name": "publish-static-assets",
"image": publish_image,
"image": images["publish_image"],
"environment": {
"GCP_KEY": from_secret("gcp_key"),
"PRERELEASE_BUCKET": from_secret("prerelease_bucket"),
@@ -587,7 +588,7 @@ def publish_static_assets_step():
def publish_storybook_step():
return {
"name": "publish-storybook",
"image": publish_image,
"image": images["publish_image"],
"environment": {
"GCP_KEY": from_secret("gcp_key"),
"PRERELEASE_BUCKET": from_secret("prerelease_bucket"),
@@ -817,7 +818,7 @@ def verify_release_pipeline(
step = {
"name": "gsutil-stat",
"depends_on": ["clone"],
"image": cloudsdk_image,
"image": images["cloudsdk_image"],
"environment": {
"BUCKET": bucket,
"GCP_KEY": gcp_key,