From c811eb747d9d95e9c3938ec0f0ad201f3bcea33b Mon Sep 17 00:00:00 2001 From: Dimitris Sotirakis Date: Mon, 28 Aug 2023 15:56:49 +0300 Subject: [PATCH] [v9.5.x] Security: Authenticate to GCR for trivy scans (#73925) Security: Authenticate to GCR for trivy scans (#72658) * Authenticate to GCR for trivy scans # Conflicts: # .drone.yml * verify-starlark * Change secret # Conflicts: # .drone.yml (cherry picked from commit e100fc927ec00ae3df7ee1420374b10b834c277c) # Conflicts: # .drone.yml # scripts/drone/vault.star --- .drone.yml | 138 +++++++++++++++++++++++++++++++-- scripts/drone/events/cron.star | 25 ++++++ scripts/drone/vault.star | 10 +-- 3 files changed, 161 insertions(+), 12 deletions(-) diff --git a/.drone.yml b/.drone.yml index a02b3e74bfc..b20f54a1f38 100644 --- a/.drone.yml +++ b/.drone.yml @@ -3663,14 +3663,34 @@ platform: arch: amd64 os: linux steps: +- commands: + - echo $${GCR_CREDENTIALS} | docker login -u _json_key --password-stdin https://us.gcr.io + environment: + GCR_CREDENTIALS: + from_secret: gcr_credentials + image: docker:dind + name: authenticate-gcr + volumes: + - name: docker + path: /var/run/docker.sock - commands: - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM grafana/grafana:latest + depends_on: + - authenticate-gcr image: aquasec/trivy:0.21.0 name: scan-unknown-low-medium-vulnerabilities + volumes: + - name: docker + path: /var/run/docker.sock - commands: - trivy --exit-code 1 --severity HIGH,CRITICAL grafana/grafana:latest + depends_on: + - authenticate-gcr image: aquasec/trivy:0.21.0 name: scan-high-critical-vulnerabilities + volumes: + - name: docker + path: /var/run/docker.sock - image: plugins/slack name: slack-notify-failure settings: @@ -3684,6 +3704,10 @@ trigger: cron: nightly event: cron type: docker +volumes: +- host: + path: /var/run/docker.sock + name: docker --- clone: retries: 3 @@ -3693,14 +3717,34 @@ platform: arch: amd64 os: linux steps: +- commands: + - echo $${GCR_CREDENTIALS} | docker login -u _json_key --password-stdin https://us.gcr.io + environment: + GCR_CREDENTIALS: + from_secret: gcr_credentials + image: docker:dind + name: authenticate-gcr + volumes: + - name: docker + path: /var/run/docker.sock - commands: - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM grafana/grafana:main + depends_on: + - authenticate-gcr image: aquasec/trivy:0.21.0 name: scan-unknown-low-medium-vulnerabilities + volumes: + - name: docker + path: /var/run/docker.sock - commands: - trivy --exit-code 1 --severity HIGH,CRITICAL grafana/grafana:main + depends_on: + - authenticate-gcr image: aquasec/trivy:0.21.0 name: scan-high-critical-vulnerabilities + volumes: + - name: docker + path: /var/run/docker.sock - image: plugins/slack name: slack-notify-failure settings: @@ -3714,6 +3758,10 @@ trigger: cron: nightly event: cron type: docker +volumes: +- host: + path: /var/run/docker.sock + name: docker --- clone: retries: 3 @@ -3723,14 +3771,34 @@ platform: arch: amd64 os: linux steps: +- commands: + - echo $${GCR_CREDENTIALS} | docker login -u _json_key --password-stdin https://us.gcr.io + environment: + GCR_CREDENTIALS: + from_secret: gcr_credentials + image: docker:dind + name: authenticate-gcr + volumes: + - name: docker + path: /var/run/docker.sock - commands: - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM grafana/grafana:latest-ubuntu + depends_on: + - authenticate-gcr image: aquasec/trivy:0.21.0 name: scan-unknown-low-medium-vulnerabilities + volumes: + - name: docker + path: /var/run/docker.sock - commands: - trivy --exit-code 1 --severity HIGH,CRITICAL grafana/grafana:latest-ubuntu + depends_on: + - authenticate-gcr image: aquasec/trivy:0.21.0 name: scan-high-critical-vulnerabilities + volumes: + - name: docker + path: /var/run/docker.sock - image: plugins/slack name: slack-notify-failure settings: @@ -3745,6 +3813,10 @@ trigger: cron: nightly event: cron type: docker +volumes: +- host: + path: /var/run/docker.sock + name: docker --- clone: retries: 3 @@ -3754,14 +3826,34 @@ platform: arch: amd64 os: linux steps: +- commands: + - echo $${GCR_CREDENTIALS} | docker login -u _json_key --password-stdin https://us.gcr.io + environment: + GCR_CREDENTIALS: + from_secret: gcr_credentials + image: docker:dind + name: authenticate-gcr + volumes: + - name: docker + path: /var/run/docker.sock - commands: - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM grafana/grafana:main-ubuntu + depends_on: + - authenticate-gcr image: aquasec/trivy:0.21.0 name: scan-unknown-low-medium-vulnerabilities + volumes: + - name: docker + path: /var/run/docker.sock - commands: - trivy --exit-code 1 --severity HIGH,CRITICAL grafana/grafana:main-ubuntu + depends_on: + - authenticate-gcr image: aquasec/trivy:0.21.0 name: scan-high-critical-vulnerabilities + volumes: + - name: docker + path: /var/run/docker.sock - image: plugins/slack name: slack-notify-failure settings: @@ -3776,6 +3868,10 @@ trigger: cron: nightly event: cron type: docker +volumes: +- host: + path: /var/run/docker.sock + name: docker --- clone: retries: 3 @@ -3785,6 +3881,16 @@ platform: arch: amd64 os: linux steps: +- commands: + - echo $${GCR_CREDENTIALS} | docker login -u _json_key --password-stdin https://us.gcr.io + environment: + GCR_CREDENTIALS: + from_secret: gcr_credentials + image: docker:dind + name: authenticate-gcr + volumes: + - name: docker + path: /var/run/docker.sock - commands: - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM google/cloud-sdk:431.0.0 - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM grafana/build-container:1.7.5 @@ -3805,8 +3911,13 @@ steps: - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM grafana/docs-base:dbd975af06 - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM cypress/included:9.5.1-node16.14.0-slim-chrome99-ff97 - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM us-docker.pkg.dev/grafanalabs-dev/cloud-data-sources/e2e:latest + depends_on: + - authenticate-gcr image: aquasec/trivy:0.21.0 name: scan-unknown-low-medium-vulnerabilities + volumes: + - name: docker + path: /var/run/docker.sock - commands: - trivy --exit-code 1 --severity HIGH,CRITICAL google/cloud-sdk:431.0.0 - trivy --exit-code 1 --severity HIGH,CRITICAL grafana/build-container:1.7.5 @@ -3827,8 +3938,13 @@ steps: - trivy --exit-code 1 --severity HIGH,CRITICAL grafana/docs-base:dbd975af06 - trivy --exit-code 1 --severity HIGH,CRITICAL cypress/included:9.5.1-node16.14.0-slim-chrome99-ff97 - trivy --exit-code 1 --severity HIGH,CRITICAL us-docker.pkg.dev/grafanalabs-dev/cloud-data-sources/e2e:latest + depends_on: + - authenticate-gcr image: aquasec/trivy:0.21.0 name: scan-high-critical-vulnerabilities + volumes: + - name: docker + path: /var/run/docker.sock - image: plugins/slack name: slack-notify-failure settings: @@ -3842,6 +3958,10 @@ trigger: cron: nightly event: cron type: docker +volumes: +- host: + path: /var/run/docker.sock + name: docker --- clone: retries: 3 @@ -3873,6 +3993,10 @@ trigger: cron: grafana-com-nightly event: cron type: docker +volumes: +- host: + path: /var/run/docker.sock + name: docker --- get: name: credentials.json @@ -4000,12 +4124,6 @@ get: kind: secret name: enterprise2-cdn-path --- -get: - name: security_prefix - path: infra/data/ci/grafana-release-eng/enterprise2 -kind: secret -name: enterprise2_security_prefix ---- get: name: gcp_service_account_prod_base64 path: infra/data/ci/grafana-release-eng/rgm @@ -4066,7 +4184,13 @@ get: kind: secret name: github_token --- +get: + name: service-account + path: secret/data/common/gcr +kind: secret +name: gcr_credentials +--- kind: signature -hmac: 2a4b30f9f3cbbb57221e6d9e22afca00a2dfbc89ce0d4ec8297037a9d84bfd9c +hmac: 8ea972fb9df645d27b0a827c5bfbf86ab75e08929dfaa49c54e2f999444bab51 ... diff --git a/scripts/drone/events/cron.star b/scripts/drone/events/cron.star index d73e1074562..2e7e83faa85 100644 --- a/scripts/drone/events/cron.star +++ b/scripts/drone/events/cron.star @@ -24,6 +24,17 @@ def cronjobs(): grafana_com_nightly_pipeline(), ] +def authenticate_gcr_step(): + return { + "name": "authenticate-gcr", + "image": "docker:dind", + "commands": ["echo $${GCR_CREDENTIALS} | docker login -u _json_key --password-stdin https://us.gcr.io"], + "environment": { + "GCR_CREDENTIALS": from_secret("gcr_credentials"), + }, + "volumes": [{"name": "docker", "path": "/var/run/docker.sock"}], + } + def cron_job_pipeline(cronName, name, steps): return { "kind": "pipeline", @@ -41,6 +52,14 @@ def cron_job_pipeline(cronName, name, steps): "retries": 3, }, "steps": steps, + "volumes": [ + { + "name": "docker", + "host": { + "path": "/var/run/docker.sock", + }, + }, + ], } def scan_docker_image_pipeline(tag): @@ -58,6 +77,7 @@ def scan_docker_image_pipeline(tag): cronName = "nightly", name = "scan-" + docker_image + "-image", steps = [ + authenticate_gcr_step(), scan_docker_image_unknown_low_medium_vulnerabilities_step(docker_image), scan_docker_image_high_critical_vulnerabilities_step(docker_image), slack_job_failed_step("grafana-backend-ops", docker_image), @@ -75,6 +95,7 @@ def scan_build_test_publish_docker_image_pipeline(): cronName = "nightly", name = "scan-build-test-and-publish-docker-images", steps = [ + authenticate_gcr_step(), scan_docker_image_unknown_low_medium_vulnerabilities_step("all"), scan_docker_image_high_critical_vulnerabilities_step("all"), slack_job_failed_step("grafana-backend-ops", "build-images"), @@ -101,6 +122,8 @@ def scan_docker_image_unknown_low_medium_vulnerabilities_step(docker_image): "name": "scan-unknown-low-medium-vulnerabilities", "image": aquasec_trivy_image, "commands": cmds, + "depends_on": ["authenticate-gcr"], + "volumes": [{"name": "docker", "path": "/var/run/docker.sock"}], } def scan_docker_image_high_critical_vulnerabilities_step(docker_image): @@ -123,6 +146,8 @@ def scan_docker_image_high_critical_vulnerabilities_step(docker_image): "name": "scan-high-critical-vulnerabilities", "image": aquasec_trivy_image, "commands": cmds, + "depends_on": ["authenticate-gcr"], + "volumes": [{"name": "docker", "path": "/var/run/docker.sock"}], } def slack_job_failed_step(channel, image): diff --git a/scripts/drone/vault.star b/scripts/drone/vault.star index 929fe8ffa46..142ce80bbff 100644 --- a/scripts/drone/vault.star +++ b/scripts/drone/vault.star @@ -112,11 +112,6 @@ def secrets(): "infra/data/ci/grafana-release-eng/enterprise2", "cdn_path", ), - vault_secret( - "enterprise2_security_prefix", - "infra/data/ci/grafana-release-eng/enterprise2", - "security_prefix", - ), vault_secret( rgm_gcp_key_base64, "infra/data/ci/grafana-release-eng/rgm", @@ -168,4 +163,9 @@ def secrets(): "infra/data/ci/github/grafanabot", "pat", ), + vault_secret( + "gcr_credentials", + "secret/data/common/gcr", + "service-account", + ), ]