WIP -DO NOT MERGE - HOFF-615: Replace Anchore with Trivy #215
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* Trivy Scanner & cron job added to pipeline * trivy-cve-exceptions file path added * Trivy will scan images, file systems and repositories for any vulnerabilities and issues. * Trivy is supported by ACP team
adityababumallisettiHO
requested review from
sulthan-ahmed,
Rhodine-orleans-lindsay,
shamiluwais,
william-gu-hof and
jamiecarterHO
* Remove Trivy reference from Dockerfile Comments * Trivy Scanner & cron job added to pipeline * trivy-cve-exceptions file path added * Trivy will scan images, file systems and repositories for any vulnerabilities and issues. * Trivy is supported by ACP team
sulthan-ahmed
approved these changes
Feb 26, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What?
I've added Trivy Scanner to Pipeline and removed deprecated Anchore Scanner for the UKVI end tenancy service, see ticket
https://collaboration.homeoffice.gov.uk/jira/browse/HOFF-615
Why?
Trivy will let you scan images, file systems and repositories for any vulnerabilities and issues. It will detect CVEs of OS packages, applications susceptibilities, and exposures of IaC in Terraform files, Kubernetes and Docker. Drawback of Anchore Scanner is it’s significantly slower, the process of using it is more cumbersome, the output is less friendly and most importantly, it scans fewer CVEs.
How?
Removed Anchore cve exception file and added trivy cve exception file in hof-services-config repo from UKVI end tenancy configs. Removed Anchore Scanner steps from pipeline and added trivy scanner steps with cron scanner. Our Acceptance criteria is to list the Medium to Critical vulnerabilities.
Testing?
We can test it by raising pull request to Master branch. Drone Pipeline should run through the steps and should list the Medium to Critical Vulnerabilties and should progress to next steps of deployment to branch
https://drone-gh.acp.homeoffice.gov.uk/UKHomeOffice/end-tenancy/1178
Screenshots This screenshot is from Drone CI console
