Repository: aquasecurity/starboard (go)

Issue:
More proxy settings needed for Trivy
**What steps did you take and what happened:**

With Trivy in standalone mode, only the `HTTP_PROXY` proxy setting is available in the Trivy pod. 

With Trivy in ClientServer mode, no proxy settings are passed to the Trivy pod.

**What did you expect to happen:**

In both modes, `HTTP_PROXY`, `HTTPS_PROXY` and `NO_PROXY` should be available in the Trivy pod as they are supported by Trivy. This would make Trivy usable in all deployment scenarios.

These proxy settings are used for:
- downloading the vulnerabilty database from Github (only in standalone mode)
- pulling the Docker images to scan (in Standalone and ClientServer mode)
- contacting the Trivy server (only in ClientServer mode)


**Environment:**

- Starboard version: 0.9.2
- Kubernetes version: 1.20.1
- OS: Ubuntu 18.04


Pull request:
Add more proxy settings for Trivy
Fix #442 

Patch:
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index dd639b2..e205329 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -138,10 +138,13 @@ To open the test coverage report in your web browser, run:
 $ go tool cover -html=itest/starboard/coverage.txt
 ```
 
-Similarly, to run the integration tests for Starboard Operator and view the coverage report, run:
+To run the integration tests for Starboard Operator and view the coverage report, first do the [prerequisite steps](https://github.com/aquasecurity/starboard/blob/main/CONTRIBUTING.md#prerequisites), and then run:
 
 ```
-$ make itests-starboard-operator
+$ OPERATOR_NAMESPACE=starboard-operator \
+     OPERATOR_TARGET_NAMESPACES=default \
+     OPERATOR_LOG_DEV_MODE=true \
+     make itests-starboard-operator
 $ go tool cover -html=itest/starboard-operator/coverage.txt
 ```
 
diff --git a/deploy/helm/templates/configmap.yaml b/deploy/helm/templates/configmap.yaml
index ffd612d..348d86c 100644
--- a/deploy/helm/templates/configmap.yaml
+++ b/deploy/helm/templates/configmap.yaml
@@ -12,9 +12,9 @@ data:
   {{- if eq .Values.trivy.mode "ClientServer" }}
   trivy.serverURL: "{{ .Values.trivy.serverURL }}"
   {{- end }}
-  {{- if eq .Values.trivy.mode "Standalone" }}
   trivy.httpProxy: "{{ .Values.trivy.httpProxy }}"
-  {{- end }}
+  trivy.httpsProxy: "{{ .Values.trivy.httpsProxy }}"
+  trivy.noProxy: "{{ .Values.trivy.noProxy }}"
   trivy.severity: "{{ .Values.trivy.severity }}"
   {{- end }}
   {{- if .Values.kubeBench.enabled }}
diff --git a/deploy/helm/values.yaml b/deploy/helm/values.yaml
index 34cc061..1afd78e 100644
--- a/deploy/helm/values.yaml
+++ b/deploy/helm/values.yaml
@@ -58,6 +58,8 @@ trivy:
   mode: Standalone
   serverURL: 
   httpProxy: 
+  httpsProxy: 
+  noProxy: 
   severity: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
 
 kubeBench:
diff --git a/docs/cli/getting-started.md b/docs/cli/getting-started.md
index cedb3ee..10b09e8 100644
--- a/docs/cli/getting-started.md
+++ b/docs/cli/getting-started.md
@@ -87,7 +87,7 @@ starboard scan configauditreports deployment/nginx
 Retrieve the configuration audit report:
 
 ```
-starboard get configauditreport deployment/nginx -o yaml
+starboard get configaudit deployment/nginx -o yaml
 ```
 
 or
diff --git a/docs/settings.md b/docs/settings.md
index 2a733d9..259e49a 100644
--- a/docs/settings.md
+++ b/docs/settings.md
@@ -59,7 +59,9 @@ The following tables list available configuration settings with their default va
 | CONFIGMAP KEY                  | DEFAULT                                                | DESCRIPTION |
 | ------------------------------ | ------------------------------------------------------ | ----------- |
 | `vulnerabilityReports.scanner` | `Trivy`                                                | The name of the scanner that generates vulnerability reports. Either `Trivy` or `Aqua`. |
-| `trivy.httpProxy`              | N/A                                                    | The HTTP proxy used by Trivy to download the vulnerabilities database from GitHub. Only applicable in `Standalone` mode. |
+| `trivy.httpProxy`              | N/A                                                    | The HTTP proxy used by Trivy to download the vulnerabilities database from GitHub. |
+| `trivy.httpsProxy`             | N/A                                                    | The HTTPS proxy used by Trivy to download the vulnerabilities database from GitHub. |
+| `trivy.noProxy`                | N/A                                                    | A comma separated list of IPs and domain names that are not subject to proxy settings. |
 | `trivy.severity`               | `UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL`                     | A comma separated list of severity levels reported by Trivy |
 | `trivy.imageRef`               | `docker.io/aquasec/trivy:0.16.0`                       | Trivy image reference |
 | `trivy.mode`                   | `Standalone`                                           | Trivy client mode. Either `Standalone` or `ClientServer`. Depending on the active mode other settings might be applicable or required. |
diff --git a/pkg/plugin/trivy/plugin.go b/pkg/plugin/trivy/plugin.go
index 47c8c17..3d8fc6a 100644
--- a/pkg/plugin/trivy/plugin.go
+++ b/pkg/plugin/trivy/plugin.go
@@ -134,6 +134,30 @@ func (s *scanner) getPodSpecForStandaloneMode(spec corev1.PodSpec, credentials m
 					},
 				},
 			},
+                        {
+                                Name: "HTTPS_PROXY",
+                                ValueFrom: &corev1.EnvVarSource{
+                                        ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
+                                                LocalObjectReference: corev1.LocalObjectReference{
+                                                        Name: starboard.ConfigMapName,
+                                                },
+                                                Key:      "trivy.httpsProxy",
+                                                Optional: pointer.BoolPtr(true),
+                                        },
+                                },
+                        },
+                        {
+                                Name: "NO_PROXY",
+                                ValueFrom: &corev1.EnvVarSource{
+                                        ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
+                                                LocalObjectReference: corev1.LocalObjectReference{
+                                                        Name: starboard.ConfigMapName,
+                                                },
+                                                Key:      "trivy.noProxy",
+                                                Optional: pointer.BoolPtr(true),
+                                        },
+                                },
+                        },
 			{
 				Name: "GITHUB_TOKEN",
 				ValueFrom: &corev1.EnvVarSource{
@@ -194,6 +218,30 @@ func (s *scanner) getPodSpecForStandaloneMode(spec corev1.PodSpec, credentials m
 					},
 				},
 			},
+                        {
+                                Name: "HTTPS_PROXY",
+                                ValueFrom: &corev1.EnvVarSource{
+                                        ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
+                                                LocalObjectReference: corev1.LocalObjectReference{
+                                                        Name: starboard.ConfigMapName,
+                                                },
+                                                Key:      "trivy.httpsProxy",
+                                                Optional: pointer.BoolPtr(true),
+                                        },
+                                },
+                        },
+                        {
+                                Name: "NO_PROXY",
+                                ValueFrom: &corev1.EnvVarSource{
+                                        ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
+                                                LocalObjectReference: corev1.LocalObjectReference{
+                                                        Name: starboard.ConfigMapName,
+                                                },
+                                                Key:      "trivy.noProxy",
+                                                Optional: pointer.BoolPtr(true),
+                                        },
+                                },
+                        },
 		}
 
 		if _, ok := credentials[c.Name]; ok && secret != nil {
@@ -317,6 +365,42 @@ func (s *scanner) getPodSpecForClientServerMode(spec corev1.PodSpec, credentials
 	for _, container := range spec.Containers {
 
 		env := []corev1.EnvVar{
+                        {
+                                Name: "HTTP_PROXY",
+                                ValueFrom: &corev1.EnvVarSource{
+                                        ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
+                                                LocalObjectReference: corev1.LocalObjectReference{
+                                                        Name: starboard.ConfigMapName,
+                                                },
+                                                Key:      "trivy.httpProxy",
+                                                Optional: pointer.BoolPtr(true),
+                                        },
+                                },
+                        },
+                        {
+                                Name: "HTTPS_PROXY",
+                                ValueFrom: &corev1.EnvVarSource{
+                                        ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
+                                                LocalObjectReference: corev1.LocalObjectReference{
+                                                        Name: starboard.ConfigMapName,
+                                                },
+                                                Key:      "trivy.httpsProxy",
+                                                Optional: pointer.BoolPtr(true),
+                                        },
+                                },
+                        },
+                        {
+                                Name: "NO_PROXY",
+                                ValueFrom: &corev1.EnvVarSource{
+                                        ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
+                                                LocalObjectReference: corev1.LocalObjectReference{
+                                                        Name: starboard.ConfigMapName,
+                                                },
+                                                Key:      "trivy.noProxy",
+                                                Optional: pointer.BoolPtr(true),
+                                        },
+                                },
+                        },
 			{
 				Name: "TRIVY_SEVERITY",
 				ValueFrom: &corev1.EnvVarSource{


Test patch:
diff --git a/pkg/plugin/trivy/plugin_test.go b/pkg/plugin/trivy/plugin_test.go
index 078633f..0d292d0 100644
--- a/pkg/plugin/trivy/plugin_test.go
+++ b/pkg/plugin/trivy/plugin_test.go
@@ -71,6 +71,31 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 									},
 								},
 							},
+							{
+								Name: "HTTPS_PROXY",
+								ValueFrom: &corev1.EnvVarSource{
+									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
+										LocalObjectReference: corev1.LocalObjectReference{
+											Name: starboard.ConfigMapName,
+										},
+										Key:      "trivy.httpsProxy",
+										Optional: pointer.BoolPtr(true),
+									},
+								},
+							},
+							{
+								Name: "NO_PROXY",
+								ValueFrom: &corev1.EnvVarSource{
+									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
+										LocalObjectReference: corev1.LocalObjectReference{
+											Name: starboard.ConfigMapName,
+										},
+										Key:      "trivy.noProxy",
+										Optional: pointer.BoolPtr(true),
+									},
+								},
+							},
+
 							{
 								Name: "GITHUB_TOKEN",
 								ValueFrom: &corev1.EnvVarSource{
@@ -140,6 +165,30 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 									},
 								},
 							},
+							{
+								Name: "HTTPS_PROXY",
+								ValueFrom: &corev1.EnvVarSource{
+									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
+										LocalObjectReference: corev1.LocalObjectReference{
+											Name: starboard.ConfigMapName,
+										},
+										Key:      "trivy.httpsProxy",
+										Optional: pointer.BoolPtr(true),
+									},
+								},
+							},
+							{
+								Name: "NO_PROXY",
+								ValueFrom: &corev1.EnvVarSource{
+									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
+										LocalObjectReference: corev1.LocalObjectReference{
+											Name: starboard.ConfigMapName,
+										},
+										Key:      "trivy.noProxy",
+										Optional: pointer.BoolPtr(true),
+									},
+								},
+							},
 						},
 						Command: []string{
 							"trivy",
@@ -212,6 +261,42 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 						ImagePullPolicy:          corev1.PullIfNotPresent,
 						TerminationMessagePolicy: corev1.TerminationMessageFallbackToLogsOnError,
 						Env: []corev1.EnvVar{
+                                                        {
+                                                                Name: "HTTP_PROXY",
+                                                                ValueFrom: &corev1.EnvVarSource{
+                                                                        ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
+                                                                                LocalObjectReference: corev1.LocalObjectReference{
+                                                                                        Name: starboard.ConfigMapName,
+                                                                                },
+                                                                                Key:      "trivy.httpProxy",
+                                                                                Optional: pointer.BoolPtr(true),
+                                                                        },
+                                                                },
+                                                        },
+                                                        {
+                                                                Name: "HTTPS_PROXY",
+                                                                ValueFrom: &corev1.EnvVarSource{
+                                                                        ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
+                                                                                LocalObjectReference: corev1.LocalObjectReference{
+                                                                                        Name: starboard.ConfigMapName,
+                                                                                },
+                                                                                Key:      "trivy.httpsProxy",
+                                                                                Optional: pointer.BoolPtr(true),
+                                                                        },
+                                                                },
+                                                        },
+                                                        {
+                                                                Name: "NO_PROXY",
+                                                                ValueFrom: &corev1.EnvVarSource{
+                                                                        ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
+                                                                                LocalObjectReference: corev1.LocalObjectReference{
+                                                                                        Name: starboard.ConfigMapName,
+                                                                                },
+                                                                                Key:      "trivy.noProxy",
+                                                                                Optional: pointer.BoolPtr(true),
+                                                                        },
+                                                                },
+                                                        },
 							{
 								Name: "TRIVY_SEVERITY",
 								ValueFrom: &corev1.EnvVarSource{