Repository: aquasecurity/starboard
Pull request #289 (2020-12-23 02:40:47)

Issue 244 - Add affinity to the linux node by default
This PR add a default affinity to create the pod in the linux nodes.

Related the [issue-244](https://github.com/aquasecurity/starboard/issues/244)

codecov[bot]: # [Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/289?src=pr&el=h1) Report
> Merging [#289](https://codecov.io/gh/aquasecurity/starboard/pull/289?src=pr&el=desc) (88dfb7f) into [main](https://codecov.io/gh/aquasecurity/starboard/commit/9af5a04a21887c45f1f3b955742cbbbab253d6bc?el=desc) (9af5a04) will **decrease** coverage by `14.87%`.
> The diff coverage is `100.00%`.

[![Impacted file tree graph](https://codecov.io/gh/aquasecurity/starboard/pull/289/graphs/tree.svg?width=650&height=150&src=pr&token=qqTGKAJ0Wb)](https://codecov.io/gh/aquasecurity/starboard/pull/289?src=pr&el=tree)

```diff
@@             Coverage Diff             @@
##             main     #289       +/-   ##
===========================================
- Coverage   62.64%   47.76%   -14.88%     
===========================================
  Files          57       12       -45     
  Lines        2733      919     -1814     
===========================================
- Hits         1712      439     -1273     
+ Misses        801      414      -387     
+ Partials      220       66      -154     
```


| [Impacted Files](https://codecov.io/gh/aquasecurity/starboard/pull/289?src=pr&el=tree) | Coverage Δ | |
|---|---|---|
| [pkg/trivy/scanner.go](https://codecov.io/gh/aquasecurity/starboard/pull/289/diff?src=pr&el=tree#diff-cGtnL3RyaXZ5L3NjYW5uZXIuZ28=) | `45.01% <100.00%> (-27.95%)` | :arrow_down: |
| [pkg/vulnerabilityreport/writer.go](https://codecov.io/gh/aquasecurity/starboard/pull/289/diff?src=pr&el=tree#diff-cGtnL3Z1bG5lcmFiaWxpdHlyZXBvcnQvd3JpdGVyLmdv) | `0.00% <0.00%> (-84.38%)` | :arrow_down: |
| [pkg/vulnerabilityreport/scanner.go](https://codecov.io/gh/aquasecurity/starboard/pull/289/diff?src=pr&el=tree#diff-cGtnL3Z1bG5lcmFiaWxpdHlyZXBvcnQvc2Nhbm5lci5nbw==) | `0.00% <0.00%> (-73.47%)` | :arrow_down: |
| [pkg/vulnerabilityreport/store.go](https://codecov.io/gh/aquasecurity/starboard/pull/289/diff?src=pr&el=tree#diff-cGtnL3Z1bG5lcmFiaWxpdHlyZXBvcnQvc3RvcmUuZ28=) | `65.51% <0.00%> (-17.25%)` | :arrow_down: |
| [pkg/trivy/converter.go](https://codecov.io/gh/aquasecurity/starboard/pull/289/diff?src=pr&el=tree#diff-cGtnL3RyaXZ5L2NvbnZlcnRlci5nbw==) | `81.25% <0.00%> (-9.38%)` | :arrow_down: |
| [pkg/cmd/scan.go](https://codecov.io/gh/aquasecurity/starboard/pull/289/diff?src=pr&el=tree#diff-cGtnL2NtZC9zY2FuLmdv) | | |
| [pkg/cmd/kube\_bench.go](https://codecov.io/gh/aquasecurity/starboard/pull/289/diff?src=pr&el=tree#diff-cGtnL2NtZC9rdWJlX2JlbmNoLmdv) | | |
| [pkg/cmd/kube\_hunter.go](https://codecov.io/gh/aquasecurity/starboard/pull/289/diff?src=pr&el=tree#diff-cGtnL2NtZC9rdWJlX2h1bnRlci5nbw==) | | |
| [pkg/operator/aqua/client/client.go](https://codecov.io/gh/aquasecurity/starboard/pull/289/diff?src=pr&el=tree#diff-cGtnL29wZXJhdG9yL2FxdWEvY2xpZW50L2NsaWVudC5nbw==) | | |
| ... and [36 more](https://codecov.io/gh/aquasecurity/starboard/pull/289/diff?src=pr&el=tree-more) | |

------

[Continue to review full report at Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/289?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/289?src=pr&el=footer). Last update [9af5a04...9653e29](https://codecov.io/gh/aquasecurity/starboard/pull/289?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).


Patch:
diff --git a/pkg/cmd/scan_ciskubebench.go b/pkg/cmd/scan_ciskubebench.go
index 64e1955..98e9e9f 100644
--- a/pkg/cmd/scan_ciskubebench.go
+++ b/pkg/cmd/scan_ciskubebench.go
@@ -70,6 +70,13 @@ func ScanKubeBenchReports(cf *genericclioptions.ConfigFlags) func(cmd *cobra.Com
 		var wg sync.WaitGroup
 
 		for _, node := range nodeList.Items {
+
+			nodeValueLabel, exist := node.GetObjectMeta().GetLabels()["kubernetes.io/os"]
+			if exist && nodeValueLabel != "linux" {
+				klog.V(3).Infof("Skipping non linux node: %v %v", node.Name, node.Labels)
+				continue
+			}
+
 			wg.Add(1)
 			go func(node corev1.Node) {
 				defer wg.Done()
diff --git a/pkg/kubehunter/scanner.go b/pkg/kubehunter/scanner.go
index bb42faf..f64d27c 100644
--- a/pkg/kubehunter/scanner.go
+++ b/pkg/kubehunter/scanner.go
@@ -114,6 +114,7 @@ func (s *Scanner) prepareKubeHunterJob() (*batchv1.Job, error) {
 					ServiceAccountName: starboard.ServiceAccountName,
 					RestartPolicy:      corev1.RestartPolicyNever,
 					HostPID:            true,
+					Affinity:           starboard.LinuxNodeAffinity(),
 					Containers: []corev1.Container{
 						{
 							Name:                     kubeHunterContainerName,
diff --git a/pkg/polaris/scanner.go b/pkg/polaris/scanner.go
index 85fed0f..7563340 100644
--- a/pkg/polaris/scanner.go
+++ b/pkg/polaris/scanner.go
@@ -153,6 +153,7 @@ func (s *Scanner) preparePolarisJob(workload kube.Object, gvk schema.GroupVersio
 					ServiceAccountName:           starboard.ServiceAccountName,
 					AutomountServiceAccountToken: pointer.BoolPtr(true),
 					RestartPolicy:                corev1.RestartPolicyNever,
+					Affinity:                     starboard.LinuxNodeAffinity(),
 					Volumes: []corev1.Volume{
 						{
 							Name: configVolume,
diff --git a/pkg/starboard/config.go b/pkg/starboard/config.go
index f2f77c9..fc2c92e 100644
--- a/pkg/starboard/config.go
+++ b/pkg/starboard/config.go
@@ -440,3 +440,23 @@ func (c *configManager) Delete(ctx context.Context) error {
 	}
 	return nil
 }
+
+// LinuxNodeAffinity constructs a new Affinaty resource with linux supported nodes
+func LinuxNodeAffinity() *corev1.Affinity {
+	affinity := &corev1.Affinity{
+		NodeAffinity: &corev1.NodeAffinity{
+			RequiredDuringSchedulingIgnoredDuringExecution: &corev1.NodeSelector{
+				NodeSelectorTerms: []corev1.NodeSelectorTerm{
+					{
+						MatchExpressions: []corev1.NodeSelectorRequirement{
+							{
+								Key:      "kubernetes.io/os",
+								Operator: corev1.NodeSelectorOpIn,
+								Values:   []string{"linux"},
+							},
+						},
+					},
+				}}}}
+
+	return affinity
+}
diff --git a/pkg/trivy/scanner.go b/pkg/trivy/scanner.go
index 0facd34..17db38f 100644
--- a/pkg/trivy/scanner.go
+++ b/pkg/trivy/scanner.go
@@ -254,6 +254,7 @@ func (s *scanner) getPodSpecForStandaloneMode(spec corev1.PodSpec, credentials m
 	}
 
 	return corev1.PodSpec{
+		Affinity:                     starboard.LinuxNodeAffinity(),
 		RestartPolicy:                corev1.RestartPolicyNever,
 		AutomountServiceAccountToken: pointer.BoolPtr(false),
 		Volumes: []corev1.Volume{


Test patch:
diff --git a/pkg/trivy/scanner_test.go b/pkg/trivy/scanner_test.go
index 1fac1f6..ea15438 100644
--- a/pkg/trivy/scanner_test.go
+++ b/pkg/trivy/scanner_test.go
@@ -39,6 +39,7 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 				},
 			},
 			expectedJobSpec: corev1.PodSpec{
+				Affinity:                     starboard.LinuxNodeAffinity(),
 				RestartPolicy:                corev1.RestartPolicyNever,
 				AutomountServiceAccountToken: pointer.BoolPtr(false),
 				Volumes: []corev1.Volume{