Repository: aquasecurity/starboard (go)

Issue:
Trivy Version bump in Operator
**What steps did you take and what happened:**

To solve the issue https://github.com/aquasecurity/starboard/issues/1002, we need to update Trivy in the operator to version > 0.24




Pull request description:
chore: version bump of trivy to 0.24.2
Signed-off-by: Engin Diri <engin.diri@mail.schwarz>

This PR fixes #1007, this is needed to ensure the #1003 is working, as we need the TRIVY_INSECURE flag.

 



Patch:
diff --git a/deploy/helm/templates/config.yaml b/deploy/helm/templates/config.yaml
index 34b21d4..7bd5511 100644
--- a/deploy/helm/templates/config.yaml
+++ b/deploy/helm/templates/config.yaml
@@ -50,6 +50,9 @@ data:
   {{- if .httpsProxy }}
   trivy.httpsProxy: {{ .httpsProxy | quote }}
   {{- end }}
+  {{- if .serverInsecure }}
+  trivy.serverInsecure: {{ .serverInsecure | quote }}
+  {{- end }}
   {{- if .noProxy }}
   trivy.noProxy: {{ .noProxy | quote }}
   {{- end }}
diff --git a/deploy/helm/values.yaml b/deploy/helm/values.yaml
index e299b35..26106dd 100644
--- a/deploy/helm/values.yaml
+++ b/deploy/helm/values.yaml
@@ -94,7 +94,7 @@ trivy:
   createConfig: true
 
   # imageRef the Trivy image reference.
-  imageRef: docker.io/aquasec/trivy:0.23.0
+  imageRef: docker.io/aquasec/trivy:0.24.2
 
   # mode is the Trivy client mode. Either Standalone or ClientServer. Depending
   # on the active mode other settings might be applicable or required.
@@ -153,6 +153,9 @@ trivy:
   #
   # serverURL: "https://trivy.trivy:4975"
 
+  # serverInsecure is the flag to enable insecure connection to the Trivy server.
+  #
+  # serverInsecure: true
   # serverToken is the token to authenticate Trivy client with Trivy server. Only
   # applicable in ClientServer mode.
   #
diff --git a/deploy/static/03-starboard-operator.config.yaml b/deploy/static/03-starboard-operator.config.yaml
index e0753a9..3d3a07c 100644
--- a/deploy/static/03-starboard-operator.config.yaml
+++ b/deploy/static/03-starboard-operator.config.yaml
@@ -47,7 +47,7 @@ metadata:
     app.kubernetes.io/version: "0.14.1"
     app.kubernetes.io/managed-by: kubectl
 data:
-  trivy.imageRef: "docker.io/aquasec/trivy:0.23.0"
+  trivy.imageRef: "docker.io/aquasec/trivy:0.24.2"
   trivy.mode: "Standalone"
   trivy.severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
   trivy.timeout: "5m0s"
diff --git a/deploy/static/starboard.yaml b/deploy/static/starboard.yaml
index 80e5f4f..27c2402 100644
--- a/deploy/static/starboard.yaml
+++ b/deploy/static/starboard.yaml
@@ -628,7 +628,7 @@ metadata:
     app.kubernetes.io/version: "0.14.1"
     app.kubernetes.io/managed-by: kubectl
 data:
-  trivy.imageRef: "docker.io/aquasec/trivy:0.23.0"
+  trivy.imageRef: "docker.io/aquasec/trivy:0.24.2"
   trivy.mode: "Standalone"
   trivy.severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
   trivy.timeout: "5m0s"
diff --git a/docs/integrations/vulnerability-scanners/trivy.md b/docs/integrations/vulnerability-scanners/trivy.md
index 1f0e323..69cd10b 100644
--- a/docs/integrations/vulnerability-scanners/trivy.md
+++ b/docs/integrations/vulnerability-scanners/trivy.md
@@ -82,7 +82,7 @@ EOF
 
 | CONFIGMAP KEY                      | DEFAULT                            | DESCRIPTION                                                                                                                                                         |
 |------------------------------------|------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `trivy.imageRef`                   | `docker.io/aquasec/trivy:0.23.0`   | Trivy image reference                                                                                                                                               |
+| `trivy.imageRef`                   | `docker.io/aquasec/trivy:0.24.2`   | Trivy image reference                                                                                                                                               |
 | `trivy.mode`                       | `Standalone`                       | Trivy client mode. Either `Standalone` or `ClientServer`. Depending on the active mode other settings might be applicable or required.                              |
 | `trivy.severity`                   | `UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL` | A comma separated list of severity levels reported by Trivy                                                                                                         |
 | `trivy.ignoreUnfixed`              | N/A                                | Whether to show only fixed vulnerabilities in vulnerabilities reported by Trivy. Set to `"true"` to enable it.                                                      |
@@ -92,6 +92,7 @@ EOF
 | `trivy.timeout`                    | `5m0s`                             | The duration to wait for scan completion                                                                                                                            |
 | `trivy.serverURL`                  | N/A                                | The endpoint URL of the Trivy server. Required in `ClientServer` mode.                                                                                              |
 | `trivy.serverTokenHeader`          | `Trivy-Token`                      | The name of the HTTP header to send the authentication token to Trivy server. Only application in `ClientServer` mode when `trivy.serverToken` is specified.        |
+| `trivy.serverInsecure`             | N/A                                | The Flag to enable insecure connection to the Trivy server.                                                                                                         |
 | `trivy.insecureRegistry.<id>`      | N/A                                | The registry to which insecure connections are allowed. There can be multiple registries with different registry `<id>`.                                            |
 | `trivy.nonSslRegistry.<id>`        | N/A                                | A registry without SSL. There can be multiple registries with different registry `<id>`.                                                                            |
 | `trivy.registry.mirror.<registry>` | N/A                                | Mirror for the registry `<registry>`, e.g. `trivy.registry.mirror.index.docker.io: mirror.io` would use `mirror.io` to get images originated from `index.docker.io` |
diff --git a/pkg/plugin/trivy/plugin.go b/pkg/plugin/trivy/plugin.go
index b2d55de..73c42b0 100644
--- a/pkg/plugin/trivy/plugin.go
+++ b/pkg/plugin/trivy/plugin.go
@@ -46,6 +46,7 @@ const (
 
 	keyTrivyServerURL           = "trivy.serverURL"
 	keyTrivyServerTokenHeader   = "trivy.serverTokenHeader"
+	keyTrivyServerInsecure      = "trivy.serverInsecure"
 	keyTrivyServerToken         = "trivy.serverToken"
 	keyTrivyServerCustomHeaders = "trivy.serverCustomHeaders"
 
@@ -120,6 +121,11 @@ func (c Config) GetServerURL() (string, error) {
 	return c.GetRequiredData(keyTrivyServerURL)
 }
 
+func (c Config) GetServerInsecure() bool {
+	_, ok := c.Data[keyTrivyServerInsecure]
+	return ok
+}
+
 func (c Config) IgnoreFileExists() bool {
 	_, ok := c.Data[keyTrivyIgnoreFile]
 	return ok
@@ -234,7 +240,7 @@ func NewPlugin(clock ext.Clock, idGenerator ext.IDGenerator, client client.Clien
 func (p *plugin) Init(ctx starboard.PluginContext) error {
 	return ctx.EnsureConfig(starboard.PluginConfig{
 		Data: map[string]string{
-			keyTrivyImageRef: "docker.io/aquasec/trivy:0.23.0",
+			keyTrivyImageRef: "docker.io/aquasec/trivy:0.24.2",
 			keyTrivySeverity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
 			keyTrivyMode:     string(Standalone),
 			keyTrivyTimeout:  "5m0s",
@@ -866,6 +872,13 @@ func (p *plugin) getPodSpecForClientServerMode(ctx starboard.PluginContext, conf
 			return corev1.PodSpec{}, nil, err
 		}
 
+		if config.GetServerInsecure() {
+			env = append(env, corev1.EnvVar{
+				Name:  "TRIVY_INSECURE",
+				Value: "true",
+			})
+		}
+
 		if config.IgnoreFileExists() {
 			volumes = []corev1.Volume{
 				{


Test patch:
diff --git a/itest/matcher/matcher.go b/itest/matcher/matcher.go
index f6e558b..83bae70 100644
--- a/itest/matcher/matcher.go
+++ b/itest/matcher/matcher.go
@@ -22,7 +22,7 @@ var (
 	trivyScanner = v1alpha1.Scanner{
 		Name:    "Trivy",
 		Vendor:  "Aqua Security",
-		Version: "0.23.0",
+		Version: "0.24.2",
 	}
 	polarisScanner = v1alpha1.Scanner{
 		Name:    "Polaris",
diff --git a/itest/matcher/matcher_test.go b/itest/matcher/matcher_test.go
index cfa33ce..ead692d 100644
--- a/itest/matcher/matcher_test.go
+++ b/itest/matcher/matcher_test.go
@@ -58,7 +58,7 @@ func TestVulnerabilityReportMatcher(t *testing.T) {
 				Scanner: v1alpha1.Scanner{
 					Name:    "Trivy",
 					Vendor:  "Aqua Security",
-					Version: "0.23.0",
+					Version: "0.24.2",
 				},
 				Vulnerabilities: []v1alpha1.Vulnerability{},
 			},
diff --git a/pkg/plugin/trivy/plugin_test.go b/pkg/plugin/trivy/plugin_test.go
index 143442f..5fc9c05 100644
--- a/pkg/plugin/trivy/plugin_test.go
+++ b/pkg/plugin/trivy/plugin_test.go
@@ -470,7 +470,7 @@ func TestPlugin_Init(t *testing.T) {
 				ResourceVersion: "1",
 			},
 			Data: map[string]string{
-				"trivy.imageRef": "docker.io/aquasec/trivy:0.23.0",
+				"trivy.imageRef": "docker.io/aquasec/trivy:0.24.2",
 				"trivy.severity": "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
 				"trivy.mode":     "Standalone",
 				"trivy.timeout":  "5m0s",
@@ -496,7 +496,7 @@ func TestPlugin_Init(t *testing.T) {
 					ResourceVersion: "1",
 				},
 				Data: map[string]string{
-					"trivy.imageRef": "docker.io/aquasec/trivy:0.23.0",
+					"trivy.imageRef": "docker.io/aquasec/trivy:0.24.2",
 					"trivy.severity": "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
 					"trivy.mode":     "Standalone",
 				},
@@ -530,7 +530,7 @@ func TestPlugin_Init(t *testing.T) {
 				ResourceVersion: "1",
 			},
 			Data: map[string]string{
-				"trivy.imageRef": "docker.io/aquasec/trivy:0.23.0",
+				"trivy.imageRef": "docker.io/aquasec/trivy:0.24.2",
 				"trivy.severity": "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
 				"trivy.mode":     "Standalone",
 			},
@@ -2042,16 +2042,205 @@ CVE-2019-1543`,
 			},
 		},
 		{
-			name: "ClientServer mode with insecure registry",
+			name: "ClientServer mode without insecure registry",
 			config: map[string]string{
-				"trivy.imageRef":                     "docker.io/aquasec/trivy:0.14.0",
-				"trivy.mode":                         string(trivy.ClientServer),
-				"trivy.serverURL":                    "http://trivy.trivy:4954",
-				"trivy.insecureRegistry.pocRegistry": "poc.myregistry.harbor.com.pl",
-				"trivy.resources.requests.cpu":       "100m",
-				"trivy.resources.requests.memory":    "100M",
-				"trivy.resources.limits.cpu":         "500m",
-				"trivy.resources.limits.memory":      "500M",
+				"trivy.imageRef":                  "docker.io/aquasec/trivy:0.14.0",
+				"trivy.mode":                      string(trivy.ClientServer),
+				"trivy.serverURL":                 "http://trivy.trivy:4954",
+				"trivy.resources.requests.cpu":    "100m",
+				"trivy.resources.requests.memory": "100M",
+				"trivy.resources.limits.cpu":      "500m",
+				"trivy.resources.limits.memory":   "500M",
+			},
+			workloadSpec: &corev1.Pod{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "Pod",
+					APIVersion: "v1",
+				},
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "nginx",
+					Namespace: "prod-ns",
+				},
+				Spec: corev1.PodSpec{
+					Containers: []corev1.Container{
+						{
+							Name:  "nginx",
+							Image: "nginx:1.16",
+						},
+					},
+				},
+			},
+			expectedJobSpec: corev1.PodSpec{
+				Affinity:                     starboard.LinuxNodeAffinity(),
+				RestartPolicy:                corev1.RestartPolicyNever,
+				ServiceAccountName:           "starboard-sa",
+				AutomountServiceAccountToken: pointer.BoolPtr(false),
+				Containers: []corev1.Container{
+					{
+						Name:                     "nginx",
+						Image:                    "docker.io/aquasec/trivy:0.14.0",
+						ImagePullPolicy:          corev1.PullIfNotPresent,
+						TerminationMessagePolicy: corev1.TerminationMessageFallbackToLogsOnError,
+						Env: []corev1.EnvVar{
+							{
+								Name: "HTTP_PROXY",
+								ValueFrom: &corev1.EnvVarSource{
+									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
+										LocalObjectReference: corev1.LocalObjectReference{
+											Name: "starboard-trivy-config",
+										},
+										Key:      "trivy.httpProxy",
+										Optional: pointer.BoolPtr(true),
+									},
+								},
+							},
+							{
+								Name: "HTTPS_PROXY",
+								ValueFrom: &corev1.EnvVarSource{
+									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
+										LocalObjectReference: corev1.LocalObjectReference{
+											Name: "starboard-trivy-config",
+										},
+										Key:      "trivy.httpsProxy",
+										Optional: pointer.BoolPtr(true),
+									},
+								},
+							},
+							{
+								Name: "NO_PROXY",
+								ValueFrom: &corev1.EnvVarSource{
+									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
+										LocalObjectReference: corev1.LocalObjectReference{
+											Name: "starboard-trivy-config",
+										},
+										Key:      "trivy.noProxy",
+										Optional: pointer.BoolPtr(true),
+									},
+								},
+							},
+							{
+								Name: "TRIVY_SEVERITY",
+								ValueFrom: &corev1.EnvVarSource{
+									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
+										LocalObjectReference: corev1.LocalObjectReference{
+											Name: "starboard-trivy-config",
+										},
+										Key:      "trivy.severity",
+										Optional: pointer.BoolPtr(true),
+									},
+								},
+							},
+							{
+								Name: "TRIVY_IGNORE_UNFIXED",
+								ValueFrom: &corev1.EnvVarSource{
+									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
+										LocalObjectReference: corev1.LocalObjectReference{
+											Name: "starboard-trivy-config",
+										},
+										Key:      "trivy.ignoreUnfixed",
+										Optional: pointer.BoolPtr(true),
+									},
+								},
+							},
+							timeoutEnv,
+							{
+								Name: "TRIVY_SKIP_FILES",
+								ValueFrom: &corev1.EnvVarSource{
+									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
+										LocalObjectReference: corev1.LocalObjectReference{
+											Name: "starboard-trivy-config",
+										},
+										Key:      "trivy.skipFiles",
+										Optional: pointer.BoolPtr(true),
+									},
+								},
+							},
+							{
+								Name: "TRIVY_SKIP_DIRS",
+								ValueFrom: &corev1.EnvVarSource{
+									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
+										LocalObjectReference: corev1.LocalObjectReference{
+											Name: "starboard-trivy-config",
+										},
+										Key:      "trivy.skipDirs",
+										Optional: pointer.BoolPtr(true),
+									},
+								},
+							},
+							{
+								Name: "TRIVY_TOKEN_HEADER",
+								ValueFrom: &corev1.EnvVarSource{
+									ConfigMapKeyRef: &corev1.ConfigMapKeySelector{
+										LocalObjectReference: corev1.LocalObjectReference{
+											Name: "starboard-trivy-config",
+										},
+										Key:      "trivy.serverTokenHeader",
+										Optional: pointer.BoolPtr(true),
+									},
+								},
+							},
+							{
+								Name: "TRIVY_TOKEN",
+								ValueFrom: &corev1.EnvVarSource{
+									SecretKeyRef: &corev1.SecretKeySelector{
+										LocalObjectReference: corev1.LocalObjectReference{
+											Name: "starboard-trivy-config",
+										},
+										Key:      "trivy.serverToken",
+										Optional: pointer.BoolPtr(true),
+									},
+								},
+							},
+							{
+								Name: "TRIVY_CUSTOM_HEADERS",
+								ValueFrom: &corev1.EnvVarSource{
+									SecretKeyRef: &corev1.SecretKeySelector{
+										LocalObjectReference: corev1.LocalObjectReference{
+											Name: "starboard-trivy-config",
+										},
+										Key:      "trivy.serverCustomHeaders",
+										Optional: pointer.BoolPtr(true),
+									},
+								},
+							},
+						},
+						Command: []string{
+							"trivy",
+						},
+						Args: []string{
+							"--quiet",
+							"client",
+							"--format",
+							"json",
+							"--remote",
+							"http://trivy.trivy:4954",
+							"nginx:1.16",
+						},
+						Resources: corev1.ResourceRequirements{
+							Requests: corev1.ResourceList{
+								corev1.ResourceCPU:    resource.MustParse("100m"),
+								corev1.ResourceMemory: resource.MustParse("100M"),
+							},
+							Limits: corev1.ResourceList{
+								corev1.ResourceCPU:    resource.MustParse("500m"),
+								corev1.ResourceMemory: resource.MustParse("500M"),
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "ClientServer mode with insecure server",
+			config: map[string]string{
+				"trivy.imageRef":                  "docker.io/aquasec/trivy:0.14.0",
+				"trivy.mode":                      string(trivy.ClientServer),
+				"trivy.serverURL":                 "https://trivy.trivy:4954",
+				"trivy.serverInsecure":            "true",
+				"trivy.resources.requests.cpu":    "100m",
+				"trivy.resources.requests.memory": "100M",
+				"trivy.resources.limits.cpu":      "500m",
+				"trivy.resources.limits.memory":   "500M",
 			},
 			workloadSpec: &corev1.Pod{
 				TypeMeta: metav1.TypeMeta{
@@ -2218,7 +2407,7 @@ CVE-2019-1543`,
 							"--format",
 							"json",
 							"--remote",
-							"http://trivy.trivy:4954",
+							"https://trivy.trivy:4954",
 							"poc.myregistry.harbor.com.pl/nginx:1.16",
 						},
 						Resources: corev1.ResourceRequirements{
@@ -2655,7 +2844,7 @@ CVE-2019-1543`,
 		{
 			name: "Trivy fs scan command in Standalone mode",
 			config: map[string]string{
-				"trivy.imageRef":                  "docker.io/aquasec/trivy:0.23.0",
+				"trivy.imageRef":                  "docker.io/aquasec/trivy:0.24.2",
 				"trivy.mode":                      string(trivy.Standalone),
 				"trivy.command":                   string(trivy.Filesystem),
 				"trivy.resources.requests.cpu":    "100m",
@@ -2699,7 +2888,7 @@ CVE-2019-1543`,
 				InitContainers: []corev1.Container{
 					{
 						Name:                     "00000000-0000-0000-0000-000000000001",
-						Image:                    "docker.io/aquasec/trivy:0.23.0",
+						Image:                    "docker.io/aquasec/trivy:0.24.2",
 						ImagePullPolicy:          corev1.PullIfNotPresent,
 						TerminationMessagePolicy: corev1.TerminationMessageFallbackToLogsOnError,
 						Command: []string{
@@ -2728,7 +2917,7 @@ CVE-2019-1543`,
 					},
 					{
 						Name:                     "00000000-0000-0000-0000-000000000002",
-						Image:                    "docker.io/aquasec/trivy:0.23.0",
+						Image:                    "docker.io/aquasec/trivy:0.24.2",
 						ImagePullPolicy:          corev1.PullIfNotPresent,
 						TerminationMessagePolicy: corev1.TerminationMessageFallbackToLogsOnError,
 						Env: []corev1.EnvVar{