Skip to content

ROX-8825: local scanner operator API#277

Closed
porridge wants to merge 1 commit intomasterfrom
porridge/ROX-8825-local-scanner-api
Closed

ROX-8825: local scanner operator API#277
porridge wants to merge 1 commit intomasterfrom
porridge/ROX-8825-local-scanner-api

Conversation

@porridge
Copy link
Contributor

Description

First stab at exposing local scanner in SecuredCluster CR.

Checklist

  • Investigated and inspected CI test results
  • Unit test and regression tests added
  • Evaluated and added CHANGELOG entry if required
  • Determined and documented upgrade steps

If any of these don't apply, please comment below.

Testing Performed

TODO(replace-me)
Use this space to explain how you tested your PR, or, if you didn't test it, why you did not do so. (Valid reasons include "CI is sufficient" or "No testable changes")
In addition to reviewing your code, reviewers must also review your testing instructions, and make sure they are sufficient.

For more details, ref the Confluence page about this section.

@porridge porridge requested a review from SimonBaeumer January 11, 2022 14:44
@porridge porridge changed the title ROX-8825: local scanner operator API ROX-8920: local scanner operator API Jan 12, 2022
@porridge porridge force-pushed the porridge/ROX-8825-local-scanner-api branch from f066ed0 to b0510f5 Compare January 12, 2022 08:56
@ghost
Copy link

ghost commented Jan 12, 2022

Tag for build #221570 is 3.68.x-220-ge207aaae10.

💻 For deploying this image using the dev scripts, run the following first:

export MAIN_IMAGE_TAG='3.68.x-220-ge207aaae10'

📦 You can also generate an installation bundle with:

docker run -i --rm stackrox/main:3.68.x-220-ge207aaae10 central generate interactive > bundle.zip

🕹️ A roxctl binary artifact can be downloaded from CircleCI.

Copy link
Contributor

@SimonBaeumer SimonBaeumer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good so far, pulled @RTann in to give feedback on the configuration.

// Settings for the local Scanner component, which is responsible for vulnerability scanning of container
// images stored in a cluster-local image repository.
//+operator-sdk:csv:customresourcedefinitions:type=spec,order=7,displayName="Local Scanner Component Settings"
Scanner *ScannerComponentSpec `json:"scanner,omitempty"`
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you see a chance that we can protect the API changes by the ROX_LOCAL_IMAGE_SCANNING flag?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Apart from introducing whole another operators, which IMHO is definitely not worth the effort, I can see the following options.

Regarding visibility of this feature in the OpenShift UI:

  • attempt to initially hide the new API in the UI using some magic annotations, not sure if it's actually possible
  • initially document this config section as "pre-alpha, don't look here"

Orthogonal to the above: introduce an environment variable (that can be set in the operator Subscription), which would control whether the reconciliation fails with an error in case spec.scanner is non-nil, or proceeds as in this PR. This flag could also control whether our validation webhook prevents specifying a scanner or not.

Actually e2e-testing the behaviour in both cases would require some additional effort.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So WDYT @SimonBaeumer ? Given the recent developments, perhaps we should just not worry about the feature flag at all, since this PR will not make it to release 68, anyway, and hopefully the complete thing will land in release 69?

}

// ScannerComponentSpec defines settings for the "scanner" component.
type ScannerComponentSpec struct {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@RTann Can you give us insights how the local scanner should be configured?
Can we assume that the local scanner has the same configuration options like Central?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe the only difference between the main Scanner and a Secured Cluster's Scanner is the image name.

Scanner and Scanner-DB remain as scanner and scanner-db. The "local" Scanner and Scanner-DB will be scanner-slim and scanner-db-slim. Internally, they use an environment variable to differentiate (ROX_SLIM_MODE), as they use the same binary, but the env var is embedded into the images already.

Aside from that, I don't think any of the configurations need to be different. Perhaps we can look into some metrics at some point to see if we should default to 3 replicas or some other number, but I'd say it's fine for now. I believe the ConfigMap and Service would all be the same, too.

@@ -1,32 +1,31 @@
**/go.sum
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we move this and tools/detect-large-files.sh into a different PR?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The change to operator/... path is a pre-requisite, but yes, I plan to restructure this and the followup PR a bit to make them smaller.

}

// ScannerComponentSpec defines settings for the "scanner" component.
type ScannerComponentSpec struct {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe the only difference between the main Scanner and a Secured Cluster's Scanner is the image name.

Scanner and Scanner-DB remain as scanner and scanner-db. The "local" Scanner and Scanner-DB will be scanner-slim and scanner-db-slim. Internally, they use an environment variable to differentiate (ROX_SLIM_MODE), as they use the same binary, but the env var is embedded into the images already.

Aside from that, I don't think any of the configurations need to be different. Perhaps we can look into some metrics at some point to see if we should default to 3 replicas or some other number, but I'd say it's fine for now. I believe the ConfigMap and Service would all be the same, too.

//+operator-sdk:csv:customresourcedefinitions:type=spec,order=6,displayName="Kubernetes Audit Logs Ingestion Settings"
AuditLogs *AuditLogsSpec `json:"auditLogs,omitempty"`

// Settings for the local Scanner component, which is responsible for vulnerability scanning of container
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@RTann so how should we call this scanner in the description which is shown in the OpenShift UI? "Local scanner"? "Secured cluster scanner"? Just "scanner" and hope the user does not get confused?

@porridge porridge changed the title ROX-8920: local scanner operator API ROX-8825: local scanner operator API Feb 17, 2022
@porridge porridge force-pushed the porridge/ROX-8825-local-scanner-api branch from 4e0e958 to e207aaa Compare February 17, 2022 10:32
@porridge
Copy link
Contributor Author

porridge commented Mar 8, 2022

Superseded by #691

@porridge porridge closed this Mar 8, 2022
@porridge porridge deleted the porridge/ROX-8825-local-scanner-api branch July 19, 2022 07:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants