Commit bcfe2483 authored by Thomas Boni's avatar Thomas Boni
Browse files

Merge branch '248-job-trivy-add-exit_on_severity-variable-to-improve-job' into 'latest' 

Resolve "[job]Trivy - add EXIT_ON_SEVERITY variable to improve job"

Closes #248

See merge request r2devops/hub!239
parents 842b7f7b ce983982

jobs/trivy_image/README.md

+6 −4
Original line number Diff line number Diff line
@@ -7,10 +7,10 @@ vulnerability detection capabilities are available in its official 
[README](https://github.com/aquasecurity/trivy#vulnerability-detection){:target="_blank"}



!!! warning

    With the default configuration, this job will fail if errors are detected.

    With the default configuration, this job will fail if detected errors are in severity `MEDIUM`,`HIGH`,`CRITICAL`.

    It's the recommended configuration to reduce security risks in your

    software. You can disable this behaviour by setting the value `0` to the

    variable `TRIVY_EXIT_CODE`.

    software. You can disable this behaviour by emptying the value of the

    variable `TRIVY_EXIT_ON_SEVERITY`.



## How to use it
@@ -36,7 +36,8 @@ vulnerability detection capabilities are available in its official 
|:-|:-|:-

| `TRIVY_VERSION` <img width=450/> | Version of trivy to use. Releases version are available [here](https://github.com/aquasecurity/trivy/releases){:target="_blank"} | `0.9.2` |

| `TRIVY_SEVERITY` | Severities of vulnerabilities to be displayed | `UNKNOWN`,`LOW`,`MEDIUM`,`HIGH`,`CRITICAL`|

| `TRIVY_EXIT_CODE` | Exit code when vulnerabilities were found | 1 |

| `TRIVY_EXIT_ON_SEVERITY` | Severities of vulnerabilities for the job to fail at | `MEDIUM`,`HIGH`,`CRITICAL`|

| `TRIVY_EXIT_CODE` | Exit code when vulnerabilities were found | 0 |

| `TRIVY_VULN_TYPE` | List of vulnerability types | os,library |

| `TRIVY_OUTPUT` | Output file name | junit-report.xml |

| `TRIVY_IGNOREFILE` | Specify .trivyignore file | .trivyignore |
@@ -46,6 +47,7 @@ vulnerability detection capabilities are available in its official 
| `TRIVY_CLEAR_CACHE` | Clear image caches without scanning | false |

| `TRIVY_IGNORE_UNFIXED` | Display only fixed vulnerabilities | false |

| `TRIVY_DEBUG` | Debug mode | false |

| `TRIVY_OPTIONS` | Options for command `trivy` | ` ` |

| `DOCKER_HOST` | Daemon socket to connect to | tcp://docker:2375 |

| `TRIVY_TIMEOUT` | Docker timeout | 2m0s |

| `TRIVY_LIGHT` | Trivy faster without descriptions and refs | false |

jobs/trivy_image/trivy_image.yml

+16 −6
Original line number Diff line number Diff line
@@ -13,8 +13,9 @@ trivy_image: 
      command: ["dockerd-entrypoint.sh"]



  variables:

    TRIVY_SEVERITY: "LOW,MEDIUM,HIGH,CRITICAL"

    TRIVY_EXIT_CODE: 1

    TRIVY_SEVERITY: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"

    TRIVY_EXIT_ON_SEVERITY: "MEDIUM,HIGH,CRITICAL"

    TRIVY_EXIT_CODE: 0

    TRIVY_VULN_TYPE: "os,library"

    TRIVY_NO_PROGRESS: "false"

    TRIVY_OUTPUT: "junit-report.xml"
@@ -25,6 +26,7 @@ trivy_image: 
    TRIVY_CLEAR_CACHE: "false"

    TRIVY_IGNORE_UNFIXED: "false"

    TRIVY_DEBUG: "false"

    TRIVY_OPTIONS: ""



    DOCKER_HOST: tcp://docker:2375

    DOCKER_DRIVER: overlay2
@@ -57,12 +59,21 @@ trivy_image: 
    - fi



    - if [ ! -z ${CUSTOM_TAG} ]; then

    -   ./trivy --template "@$TEMPLATE_NAME" -o $TRIVY_OUTPUT $REGISTRY_IMAGE:$CUSTOM_TAG

    -   IMAGE="$REGISTRY_IMAGE:$CUSTOM_TAG"

    - elif [ ! -z ${CI_COMMIT_TAG} ]; then

    -   ./trivy --template "@$TEMPLATE_NAME" -o $TRIVY_OUTPUT $REGISTRY_IMAGE:$CI_COMMIT_TAG

    -   IMAGE="$REGISTRY_IMAGE:$CI_COMMIT_TAG"

    - else

    -   ./trivy --template "@$TEMPLATE_NAME" -o $TRIVY_OUTPUT $REGISTRY_IMAGE:$CI_COMMIT_SHA

    -   IMAGE="$REGISTRY_IMAGE:$CI_COMMIT_SHA"

    - fi



    - if [ ! -z ${TRIVY_EXIT_ON_SEVERITY} ]; then

    -   TRIVY_OPTIONS="--exit-code 1 --severity ${TRIVY_EXIT_ON_SEVERITY} --output ${TRIVY_OUTPUT} ${TRIVY_OPTIONS}"

    - else

        TRIVY_OPTIONS="--output ${TRIVY_OUTPUT} ${TRIVY_OPTIONS}"

    - fi



    - ./trivy --template "@${TEMPLATE_NAME}" ${TRIVY_OPTIONS} $IMAGE



  cache:

    paths:

      - "$TRIVY_CACHE_DIR"
@@ -72,4 +83,3 @@ trivy_image: 
      junit: "$TRIVY_OUTPUT"

    expire_in: 30 days

    when: always

jobs/trivy_image/versions/0.3.0.md

0 → 100644
+2 −0
Original line number Diff line number Diff line 
* Add ability to exit on a particular severity

* Add possibility to append options for command `trivy`
 
 No newline at end of file