Skip to content

Transform Trivy report into a ConsolidatedReport and process data

Nick Ilieskou requested to merge trivy_to_vulnerabilities_pb into 434301_cm

What does this MR do?

  • Adds data/kas package that contains the ConsolidatedReport struct. The struct and related functions are extracted from the gitlab-agent code. The code has been refactored so that it returns prototool.Payload which resembles the payload used for create-starboard-vulnerability API for KAS. Notice that the payload contains only the vulnerability and not the scanner information. That part will be filled in by the gitlab-agent.
  • Extends kube/client.go with PodControlledByBuiltInWorkload functionality. Added respective mock.
  • Adds Trivy report.go responsible for reading the report and throwing an error if the size of the report is more than 100MB.
  • Adds prototool package that contains the prototool.Payload. Notice that payload.pb.go is autogenerated every time we change payload.proto.
  • Adds ConsolidatedReportConverter that is responsible for:
    • Reading the Trivy report
    • Transforming it to a ConsolidatedReport
    • Transforming it to protobuffer format.
    • Gzips the payload
    • Base64 encode the payload
  • main was updated with all the payload transformation steps.

Why are we doing this?

The goal here is to minimise the size of the data we send through configmaps to the gitlab-agent OCS module. In order to do that instead of sending the Trivy report we extract the vulnerabilities that will be sent to KAS by the gitlab-agent using the create-starboard-vulnerability API. Then we transform it to protobuf format which reduces the size, we gzip it and finally we encode it in base64. This last step will increase the size but is required in order to store the data in a configmap.

What are the relevant issue numbers?

Trivy-k8s-wrapper should extract save vulnerabi... (gitlab-org/gitlab#434301 - closed) • Nick Ilieskou • 16.8 • On track

Overall design

gitlab-org&11968 (comment 1683845311)

Merging Order

Edited by Nick Ilieskou

Merge request reports