Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WIP -DO NOT MERGE - HOFF-615: Replace Anchore with Trivy #215

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

WIP -DO NOT MERGE - HOFF-615: Replace Anchore with Trivy #215

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3f6c6f6
HOFF-615: Replace Anchore with Trivy
adityababumallisettiHO Feb 23, 2024
272a8b1
HOFF-615: Replace Anchore with Trivy
adityababumallisettiHO Feb 26, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 28 additions & 26 deletions .drone.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,6 +129,26 @@ steps:
branch: master
event: [push, pull_request]

# Trivy Security Scannner
- name: scan-image
pull: always
image: 340268328991.dkr.ecr.eu-west-2.amazonaws.com/acp/trivy/client:latest
resources:
limits:
cpu: 1000
memory: 1024Mi
environment:
IMAGE_NAME: end-tenancy:${DRONE_COMMIT_SHA}
SEVERITY: MEDIUM,HIGH,CRITICAL
FAIL_ON_DETECTION: false
IGNORE_UNFIXED: true
ALLOW_CVE_LIST_FILE: hof-services-config/UKVI_End_Tenancy/trivy-cve-exceptions.txt
when:
event:
- pull_request
- push
- tag

# Deploy to pull request UAT environment
- name: deploy_to_branch
pull: if-not-exists
Expand Down Expand Up @@ -230,7 +250,7 @@ steps:
branch: master
event: pull_request

# Snyk & Anchore security scans which run after branch deployment to prevent blocking of PR UAT tests
# Snyk security scans which run after branch deployment to prevent blocking of PR UAT tests
- name: snyk_scan
pull: if-not-exists
image: node:lts
Expand All @@ -246,18 +266,6 @@ steps:
- feature/*
event: pull_request

- name: anchore_scan
image: 340268328991.dkr.ecr.eu-west-2.amazonaws.com/acp/anchore-submission:latest
pull: always
environment:
IMAGE_NAME: end-tenancy:${DRONE_COMMIT_SHA}
LOCAL_IMAGE: true
TOLERATE: medium
WHITELIST_FILE: hof-services-config/UKVI_End_Tenancy/anchore-cve-exceptions.txt
when:
branch: master
event: pull_request

# Deploy to Master UAT environment
- name: deploy_to_uat
pull: if-not-exists
Expand Down Expand Up @@ -393,7 +401,7 @@ steps:
cron: tear_down_pr_envs
event: cron

# CRON job steps that runs security scans using Snyk & Anchore
# CRON job steps that runs security scans using Snyk & Trivy
- name: cron_clone_repos
image: alpine/git
environment:
Expand Down Expand Up @@ -432,14 +440,15 @@ steps:
cron: security_scans
event: cron

- name: cron_anchore_scan
image: 340268328991.dkr.ecr.eu-west-2.amazonaws.com/acp/anchore-submission:latest
- name: cron_trivy_scan
image: 340268328991.dkr.ecr.eu-west-2.amazonaws.com/acp/trivy/client:latest
pull: always
environment:
IMAGE_NAME: end-tenancy:${DRONE_COMMIT_SHA}
LOCAL_IMAGE: true
TOLERATE: medium
WHITELIST_FILE: hof-services-config/UKVI_End_Tenancy/anchore-cve-exceptions.txt
SEVERITY: MEDIUM,HIGH,CRITICAL
FAIL_ON_DETECTION: false
IGNORE_UNFIXED: true
ALLOW_CVE_LIST_FILE: hof-services-config/UKVI_End_Tenancy/trivy-cve-exceptions.txt
when:
cron: security_scans
event: cron
Expand Down Expand Up @@ -483,13 +492,6 @@ services:
- name: docker
image: 340268328991.dkr.ecr.eu-west-2.amazonaws.com/acp/dind

# Anchore scanning needs background service to run
- name: anchore-submission-server
image: 340268328991.dkr.ecr.eu-west-2.amazonaws.com/acp/anchore-submission:latest
pull: always
commands:
- /run.sh server

# Redis session setup in background so integration tests can run
- name: session
image: redis
Expand Down
1 change: 0 additions & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,6 @@ FROM node:lts-alpine@sha256:19eaf41f3b8c2ac2f609ac8103f9246a6a6d46716cdbe49103fd

USER root

# Update packages as a result of Anchore security vulnerability checks
RUN apk update && \
apk add --upgrade gnutls binutils nodejs apk-tools libjpeg-turbo libcurl libx11 libxml2

Expand Down