Skip to content

Commit 7b536a0

Browse files
tom1299Thomas Reuhl
tom1299
authored and
Thomas Reuhl
committed
Add image labels to artifact of vulnerability report
1 parent 1caa4d4 commit 7b536a0

10 files changed

+106
-6
lines changed

‎deploy/helm/crds/aquasecurity.github.io_clustersbomreports.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,12 @@ spec:
7878
description: Digest is a unique and immutable identifier of an
7979
Artifact.
8080
type: string
81+
labels:
82+
additionalProperties:
83+
type: string
84+
description: Labels is a map of key value pairs from the scanned
85+
artifact
86+
type: object
8187
mimeType:
8288
description: MimeType represents a type and format of an Artifact.
8389
type: string

‎deploy/helm/crds/aquasecurity.github.io_clustervulnerabilityreports.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,12 @@ spec:
9494
description: Digest is a unique and immutable identifier of an
9595
Artifact.
9696
type: string
97+
labels:
98+
additionalProperties:
99+
type: string
100+
description: Labels is a map of key value pairs from the scanned
101+
artifact
102+
type: object
97103
mimeType:
98104
description: MimeType represents a type and format of an Artifact.
99105
type: string

‎deploy/helm/crds/aquasecurity.github.io_exposedsecretreports.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,12 @@ spec:
8989
description: Digest is a unique and immutable identifier of an
9090
Artifact.
9191
type: string
92+
labels:
93+
additionalProperties:
94+
type: string
95+
description: Labels is a map of key value pairs from the scanned
96+
artifact
97+
type: object
9298
mimeType:
9399
description: MimeType represents a type and format of an Artifact.
94100
type: string

‎deploy/helm/crds/aquasecurity.github.io_sbomreports.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,12 @@ spec:
7979
description: Digest is a unique and immutable identifier of an
8080
Artifact.
8181
type: string
82+
labels:
83+
additionalProperties:
84+
type: string
85+
description: Labels is a map of key value pairs from the scanned
86+
artifact
87+
type: object
8288
mimeType:
8389
description: MimeType represents a type and format of an Artifact.
8490
type: string

‎deploy/helm/crds/aquasecurity.github.io_vulnerabilityreports.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,12 @@ spec:
9595
description: Digest is a unique and immutable identifier of an
9696
Artifact.
9797
type: string
98+
labels:
99+
additionalProperties:
100+
type: string
101+
description: Labels is a map of key value pairs from the scanned
102+
artifact
103+
type: object
98104
mimeType:
99105
description: MimeType represents a type and format of an Artifact.
100106
type: string

‎deploy/static/trivy-operator.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -890,6 +890,12 @@ spec:
890890
description: Digest is a unique and immutable identifier of an
891891
Artifact.
892892
type: string
893+
labels:
894+
additionalProperties:
895+
type: string
896+
description: Labels is a map of key value pairs from the scanned
897+
artifact
898+
type: object
893899
mimeType:
894900
description: MimeType represents a type and format of an Artifact.
895901
type: string
@@ -1301,6 +1307,12 @@ spec:
13011307
description: Digest is a unique and immutable identifier of an
13021308
Artifact.
13031309
type: string
1310+
labels:
1311+
additionalProperties:
1312+
type: string
1313+
description: Labels is a map of key value pairs from the scanned
1314+
artifact
1315+
type: object
13041316
mimeType:
13051317
description: MimeType represents a type and format of an Artifact.
13061318
type: string
@@ -1771,6 +1783,12 @@ spec:
17711783
description: Digest is a unique and immutable identifier of an
17721784
Artifact.
17731785
type: string
1786+
labels:
1787+
additionalProperties:
1788+
type: string
1789+
description: Labels is a map of key value pairs from the scanned
1790+
artifact
1791+
type: object
17741792
mimeType:
17751793
description: MimeType represents a type and format of an Artifact.
17761794
type: string
@@ -2328,6 +2346,12 @@ spec:
23282346
description: Digest is a unique and immutable identifier of an
23292347
Artifact.
23302348
type: string
2349+
labels:
2350+
additionalProperties:
2351+
type: string
2352+
description: Labels is a map of key value pairs from the scanned
2353+
artifact
2354+
type: object
23312355
mimeType:
23322356
description: MimeType represents a type and format of an Artifact.
23332357
type: string
@@ -2741,6 +2765,12 @@ spec:
27412765
description: Digest is a unique and immutable identifier of an
27422766
Artifact.
27432767
type: string
2768+
labels:
2769+
additionalProperties:
2770+
type: string
2771+
description: Labels is a map of key value pairs from the scanned
2772+
artifact
2773+
type: object
27442774
mimeType:
27452775
description: MimeType represents a type and format of an Artifact.
27462776
type: string

‎pkg/apis/aquasecurity/v1alpha1/vulnerability_types.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,10 @@ type Artifact struct {
6060
// MimeType represents a type and format of an Artifact.
6161
// +optional
6262
MimeType string `json:"mimeType,omitempty"`
63+
64+
// Labels is a map of key value pairs from the scanned artifact
65+
// +optional
66+
Labels map[string]string `json:"labels,omitempty"`
6367
}
6468

6569
// OS is the Operating System of the Artifact

‎pkg/apis/aquasecurity/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 10 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/plugins/trivy/plugin.go‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -150,14 +150,16 @@ func (p *plugin) ParseReportData(ctx trivyoperator.PluginContext, imageRef strin
150150
}
151151

152152
var reports ty.Report
153+
153154
err = json.NewDecoder(logsReader).Decode(&reports)
154155
if err != nil {
155156
return vulnReport, secretReport, nil, err
156157
}
157158

158159
imageDigest := p.getImageDigest(reports)
160+
imageLabels := reports.Metadata.ImageConfig.Config.Labels
159161

160-
registry, artifact, err := ParseImageRef(imageRef, imageDigest)
162+
registry, artifact, err := ParseImageRef(imageRef, imageDigest, imageLabels)
161163
if err != nil {
162164
return vulnReport, secretReport, nil, err
163165
}
@@ -215,7 +217,7 @@ func (p *plugin) NewConfigForConfigAudit(ctx trivyoperator.PluginContext) (confi
215217
return getConfig(ctx)
216218
}
217219

218-
func ParseImageRef(imageRef, imageDigest string) (v1alpha1.Registry, v1alpha1.Artifact, error) {
220+
func ParseImageRef(imageRef, imageDigest string, imageLabels map[string]string) (v1alpha1.Registry, v1alpha1.Artifact, error) {
219221
ref, err := containerimage.ParseReference(imageRef)
220222
if err != nil {
221223
return v1alpha1.Registry{}, v1alpha1.Artifact{}, err
@@ -236,6 +238,9 @@ func ParseImageRef(imageRef, imageDigest string) (v1alpha1.Registry, v1alpha1.Ar
236238
if artifact.Digest == "" {
237239
artifact.Digest = imageDigest
238240
}
241+
242+
artifact.Labels = imageLabels
243+
239244
return registry, artifact, nil
240245
}
241246

‎pkg/plugins/trivy/plugin_test.go‎

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8250,6 +8250,7 @@ func TestParseImageRef(t *testing.T) {
82508250
name string
82518251
inputImageRef string
82528252
inputImageID string
8253+
inputImageLabels map[string]string
82538254
expectedRegistry v1alpha1.Registry
82548255
expectedArtifact v1alpha1.Artifact
82558256
expectedErr error
@@ -8345,6 +8346,29 @@ func TestParseImageRef(t *testing.T) {
83458346
Tag: "1.0.0",
83468347
},
83478348
},
8349+
{
8350+
name: "well known image with labels",
8351+
inputImageRef: "docker.io/library/busybox:latest",
8352+
inputImageID: "sha256:2bc57c6bcb194869d18676e003dfed47b87d257fce49667557fb8eb1f324d5d6",
8353+
inputImageLabels: map[string]string{
8354+
"org.opencontainers.image.source": "https://github.com/docker-library/busybox",
8355+
"org.opencontainers.image.url": "docker.io/library/busybox",
8356+
"org.opencontainers.image.created": "2019-10-12T07:20:50.52Z",
8357+
},
8358+
expectedRegistry: v1alpha1.Registry{
8359+
Server: "index.docker.io",
8360+
},
8361+
expectedArtifact: v1alpha1.Artifact{
8362+
Repository: "library/busybox",
8363+
Digest: "sha256:2bc57c6bcb194869d18676e003dfed47b87d257fce49667557fb8eb1f324d5d6",
8364+
Labels: map[string]string{
8365+
"org.opencontainers.image.source": "https://github.com/docker-library/busybox",
8366+
"org.opencontainers.image.url": "docker.io/library/busybox",
8367+
"org.opencontainers.image.created": "2019-10-12T07:20:50.52Z",
8368+
},
8369+
Tag: "latest",
8370+
},
8371+
},
83488372
{
83498373
name: "repo with digest",
83508374
inputImageRef: "quay.io/prometheus-operator/prometheus-operator@sha256:1420cefd4b20014b3361951c22593de6e9a2476bbbadd1759464eab5bfc0d34f",
@@ -8380,7 +8404,7 @@ func TestParseImageRef(t *testing.T) {
83808404
}
83818405
for _, tc := range testCases {
83828406
t.Run(tc.name, func(t *testing.T) {
8383-
registry, artifact, err := trivy.ParseImageRef(tc.inputImageRef, tc.inputImageID)
8407+
registry, artifact, err := trivy.ParseImageRef(tc.inputImageRef, tc.inputImageID, tc.inputImageLabels)
83848408
if tc.expectedErr != nil {
83858409
require.Errorf(t, err, "expected: %v", tc.expectedErr)
83868410
}

0 commit comments

Comments
 (0)