diff --git a/Makefile b/Makefile index 136d8827f..aad67631d 100644 --- a/Makefile +++ b/Makefile @@ -77,6 +77,7 @@ REGISTRYPROJECTNAME=goharbor DEVFLAG=true NOTARYFLAG=false CLAIRFLAG=false +TRIVYFLAG=false HTTPPROXY= BUILDBIN=false MIGRATORFLAG=false @@ -104,6 +105,8 @@ MIGRATORVERSION=$(VERSIONTAG) REDISVERSION=$(VERSIONTAG) NOTARYMIGRATEVERSION=v3.5.4 CLAIRADAPTERVERSION=v1.0.1 +TRIVYVERSION=v0.4.3 +TRIVYADAPTERVERSION=v0.2.3 # version of chartmuseum CHARTMUSEUMVERSION=v0.9.0 @@ -117,6 +120,8 @@ REGISTRY_VERSION: $(REGISTRYVERSION) NOTARY_VERSION: $(NOTARYVERSION) CLAIR_VERSION: $(CLAIRVERSION) CLAIR_ADAPTER_VERSION: $(CLAIRADAPTERVERSION) +TRIVY_VERSION: $(TRIVYVERSION) +TRIVY_ADAPTER_VERSION: $(TRIVYADAPTERVERSION) CHARTMUSEUM_VERSION: $(CHARTMUSEUMVERSION) endef @@ -193,6 +198,9 @@ endif ifeq ($(CLAIRFLAG), true) PREPARECMD_PARA+= --with-clair endif +ifeq ($(TRIVYFLAG), true) + PREPARECMD_PARA+= --with-trivy +endif # append chartmuseum parameters if set ifeq ($(CHARTFLAG), true) PREPARECMD_PARA+= --with-chartmuseum @@ -272,6 +280,9 @@ endif ifeq ($(CLAIRFLAG), true) DOCKERSAVE_PARA+= goharbor/clair-photon:$(CLAIRVERSION)-$(VERSIONTAG) goharbor/clair-adapter-photon:$(CLAIRADAPTERVERSION)-$(VERSIONTAG) endif +ifeq ($(TRIVYFLAG), true) + DOCKERSAVE_PARA+= goharbor/trivy-adapter-photon:$(TRIVYADAPTERVERSION)-$(VERSIONTAG) +endif ifeq ($(MIGRATORFLAG), true) DOCKERSAVE_PARA+= goharbor/harbor-migrator:$(MIGRATORVERSION) endif @@ -340,14 +351,16 @@ prepare: build: make -f $(MAKEFILEPATH_PHOTON)/Makefile $(BUILDTARGET) -e DEVFLAG=$(DEVFLAG) -e GOBUILDIMAGE=$(GOBUILDIMAGE) \ - -e REGISTRYVERSION=$(REGISTRYVERSION) -e REGISTRY_SRC_TAG=$(REGISTRY_SRC_TAG) -e NGINXVERSION=$(NGINXVERSION) -e NOTARYVERSION=$(NOTARYVERSION) -e NOTARYMIGRATEVERSION=$(NOTARYMIGRATEVERSION) \ + -e REGISTRYVERSION=$(REGISTRYVERSION) -e REGISTRY_SRC_TAG=$(REGISTRY_SRC_TAG) -e NGINXVERSION=$(NGINXVERSION) \ + -e NOTARYVERSION=$(NOTARYVERSION) -e NOTARYMIGRATEVERSION=$(NOTARYMIGRATEVERSION) \ + -e TRIVYVERSION=$(TRIVYVERSION) -e TRIVYADAPTERVERSION=$(TRIVYADAPTERVERSION) \ -e CLAIRVERSION=$(CLAIRVERSION) -e CLAIRADAPTERVERSION=$(CLAIRADAPTERVERSION) -e VERSIONTAG=$(VERSIONTAG) \ -e BUILDBIN=$(BUILDBIN) -e REDISVERSION=$(REDISVERSION) -e MIGRATORVERSION=$(MIGRATORVERSION) \ -e CHARTMUSEUMVERSION=$(CHARTMUSEUMVERSION) -e DOCKERIMAGENAME_CHART_SERVER=$(DOCKERIMAGENAME_CHART_SERVER) \ -e NPM_REGISTRY=$(NPM_REGISTRY) -e BASEIMAGETAG=$(BASEIMAGETAG) build_base_docker: - @for name in chartserver clair clair-adapter core db jobservice log nginx notary-server notary-signer portal prepare redis registry registryctl; do \ + @for name in chartserver clair clair-adapter trivy-adapter core db jobservice log nginx notary-server notary-signer portal prepare redis registry registryctl; do \ echo $$name ; \ $(DOCKERBUILD) --pull -f $(MAKEFILEPATH_PHOTON)/$$name/Dockerfile.base -t goharbor/harbor-$$name-base:$(BASEIMAGETAG) . ; \ $(PUSHSCRIPTPATH)/$(PUSHSCRIPTNAME) goharbor/harbor-$$name-base:$(BASEIMAGETAG) $(REGISTRYUSER) $(REGISTRYPASSWORD) ; \ diff --git a/make/install.sh b/make/install.sh index c06a1220d..1824df256 100755 --- a/make/install.sh +++ b/make/install.sh @@ -10,6 +10,7 @@ set +o noglob usage=$'Please set hostname and other necessary attributes in harbor.yml first. DO NOT use localhost or 127.0.0.1 for hostname, because Harbor needs to be accessed by external clients. Please set --with-notary if needs enable Notary in Harbor, and set ui_url_protocol/ssl_cert/ssl_cert_key in harbor.yml bacause notary must run under https. Please set --with-clair if needs enable Clair in Harbor +Please set --with-tivy if needs enable Trivy in Harbor Please set --with-chartmuseum if needs enable Chartmuseum in Harbor' item=0 @@ -17,6 +18,8 @@ item=0 with_notary=$false # clair is not enabled by default with_clair=$false +# trivy is not enabled by default +with_trivy=$false # chartmuseum is not enabled by default with_chartmuseum=$false @@ -29,6 +32,8 @@ while [ $# -gt 0 ]; do with_notary=true;; --with-clair) with_clair=true;; + --with-trivy) + with_trivy=true;; --with-chartmuseum) with_chartmuseum=true;; *) @@ -70,6 +75,10 @@ if [ $with_clair ] then prepare_para="${prepare_para} --with-clair" fi +if [ $with_trivy ] +then + prepare_para="${prepare_para} --with-trivy" +fi if [ $with_chartmuseum ] then prepare_para="${prepare_para} --with-chartmuseum" diff --git a/make/photon/Makefile b/make/photon/Makefile index 2c23c37b1..1f9f42576 100644 --- a/make/photon/Makefile +++ b/make/photon/Makefile @@ -65,6 +65,10 @@ DOCKERFILEPATH_CLAIR_ADAPTER=$(DOCKERFILEPATH)/clair-adapter DOCKERFILENAME_CLAIR_ADAPTER=Dockerfile DOCKERIMAGENAME_CLAIR_ADAPTER=goharbor/clair-adapter-photon +DOCKERFILEPATH_TRIVY_ADAPTER=$(DOCKERFILEPATH)/trivy-adapter +DOCKERFILENAME_TRIVY_ADAPTER=Dockerfile +DOCKERIMAGENAME_TRIVY_ADAPTER=goharbor/trivy-adapter-photon + DOCKERFILEPATH_NGINX=$(DOCKERFILEPATH)/nginx DOCKERFILENAME_NGINX=Dockerfile DOCKERIMAGENAME_NGINX=goharbor/nginx-photon @@ -159,6 +163,19 @@ _build_clair_adapter: echo "Done." ; \ fi +_build_trivy_adapter: + @if [ "$(TRIVYFLAG)" = "true" ] ; then \ + if [ "$(BUILDBIN)" != "true" ] ; then \ + rm -rf $(DOCKERFILEPATH_TRIVY_ADAPTER)/binary && mkdir -p $(DOCKERFILEPATH_TRIVY_ADAPTER)/binary && \ + $(call _extract_archive, https://github.com/aquasecurity/trivy/releases/download/$(TRIVYVERSION)/trivy_$(TRIVYVERSION:v%=%)_Linux-64bit.tar.gz, $(DOCKERFILEPATH_TRIVY_ADAPTER)/binary/) && \ + $(call _extract_archive, https://github.com/aquasecurity/harbor-scanner-trivy/releases/download/$(TRIVYADAPTERVERSION)/harbor-scanner-trivy_$(TRIVYADAPTERVERSION:v%=%)_Linux_x86_64.tar.gz, $(DOCKERFILEPATH_TRIVY_ADAPTER)/binary/) ; \ + fi ; \ + echo "building trivy adapter container for photon..." ; \ + $(DOCKERBUILD) --build-arg harbor_base_image_version=$(BASEIMAGETAG) --build-arg trivy_version=$(TRIVYVERSION) -f $(DOCKERFILEPATH_TRIVY_ADAPTER)/$(DOCKERFILENAME_TRIVY_ADAPTER) -t $(DOCKERIMAGENAME_TRIVY_ADAPTER):$(TRIVYADAPTERVERSION)-$(VERSIONTAG) . ; \ + rm -rf $(DOCKERFILEPATH_TRIVY_ADAPTER)/binary; \ + echo "Done." ; \ + fi + _build_chart_server: @if [ "$(CHARTFLAG)" = "true" ] ; then \ if [ "$(BUILDBIN)" != "true" ] ; then \ @@ -231,7 +248,7 @@ define _get_binary $(WGET) --timeout 30 --no-check-certificate $1 -O $2 || exit 1 endef -build: _build_prepare _build_db _build_portal _build_core _build_jobservice _build_log _build_nginx _build_registry _build_registryctl _build_notary _build_clair _build_clair_adapter _build_redis _build_migrator _build_chart_server +build: _build_prepare _build_db _build_portal _build_core _build_jobservice _build_log _build_nginx _build_registry _build_registryctl _build_notary _build_clair _build_clair_adapter _build_trivy_adapter _build_redis _build_migrator _build_chart_server cleanimage: @echo "cleaning image for photon..." diff --git a/make/photon/prepare/main.py b/make/photon/prepare/main.py index 2439e6f33..9028a1a13 100644 --- a/make/photon/prepare/main.py +++ b/make/photon/prepare/main.py @@ -15,6 +15,7 @@ from utils.notary import prepare_notary from utils.log import prepare_log_configs from utils.clair import prepare_clair from utils.clair_adapter import prepare_clair_adapter +from utils.trivy_adapter import prepare_trivy_adapter from utils.chart import prepare_chartmuseum from utils.docker_compose import prepare_docker_compose from utils.nginx import prepare_nginx, nginx_confd_dir @@ -27,11 +28,12 @@ old_private_key_pem_path, old_crt_path) @click.option('--conf', default=input_config_path, help="the path of Harbor configuration file") @click.option('--with-notary', is_flag=True, help="the Harbor instance is to be deployed with notary") @click.option('--with-clair', is_flag=True, help="the Harbor instance is to be deployed with clair") +@click.option('--with-trivy', is_flag=True, help="the Harbor instance is to be deployed with Trivy") @click.option('--with-chartmuseum', is_flag=True, help="the Harbor instance is to be deployed with chart repository supporting") -def main(conf, with_notary, with_clair, with_chartmuseum): +def main(conf, with_notary, with_clair, with_trivy, with_chartmuseum): delfile(config_dir) - config_dict = parse_yaml_config(conf, with_notary=with_notary, with_clair=with_clair, with_chartmuseum=with_chartmuseum) + config_dict = parse_yaml_config(conf, with_notary=with_notary, with_clair=with_clair, with_trivy=with_trivy, with_chartmuseum=with_chartmuseum) try: validate(config_dict, notary_mode=with_notary) except Exception as e: @@ -41,7 +43,7 @@ def main(conf, with_notary, with_clair, with_chartmuseum): prepare_log_configs(config_dict) prepare_nginx(config_dict) - prepare_core(config_dict, with_notary=with_notary, with_clair=with_clair, with_chartmuseum=with_chartmuseum) + prepare_core(config_dict, with_notary=with_notary, with_clair=with_clair, with_trivy=with_trivy, with_chartmuseum=with_chartmuseum) prepare_registry(config_dict) prepare_registry_ctl(config_dict) prepare_db(config_dict) @@ -63,10 +65,13 @@ def main(conf, with_notary, with_clair, with_chartmuseum): prepare_clair(config_dict) prepare_clair_adapter(config_dict) + if with_trivy: + prepare_trivy_adapter(config_dict) + if with_chartmuseum: prepare_chartmuseum(config_dict) - prepare_docker_compose(config_dict, with_clair, with_notary, with_chartmuseum) + prepare_docker_compose(config_dict, with_clair, with_trivy, with_notary, with_chartmuseum) if __name__ == '__main__': - main() \ No newline at end of file + main() diff --git a/make/photon/prepare/templates/core/env.jinja b/make/photon/prepare/templates/core/env.jinja index c965a9dbb..0c01a9c79 100644 --- a/make/photon/prepare/templates/core/env.jinja +++ b/make/photon/prepare/templates/core/env.jinja @@ -26,6 +26,7 @@ CORE_SECRET={{core_secret}} JOBSERVICE_SECRET={{jobservice_secret}} WITH_NOTARY={{with_notary}} WITH_CLAIR={{with_clair}} +WITH_TRIVY={{with_trivy}} CLAIR_DB_PASSWORD={{clair_db_password}} CLAIR_DB_HOST={{clair_db_host}} CLAIR_DB_PORT={{clair_db_port}} @@ -37,6 +38,7 @@ CORE_LOCAL_URL={{core_local_url}} JOBSERVICE_URL={{jobservice_url}} CLAIR_URL={{clair_url}} CLAIR_ADAPTER_URL={{clair_adapter_url}} +TRIVY_ADAPTER_URL={{trivy_adapter_url}} NOTARY_URL={{notary_url}} REGISTRY_STORAGE_PROVIDER_NAME={{storage_provider_name}} READ_ONLY=false diff --git a/make/photon/prepare/templates/docker_compose/docker-compose.yml.jinja b/make/photon/prepare/templates/docker_compose/docker-compose.yml.jinja index 1aabb6f8b..167aa4f6c 100644 --- a/make/photon/prepare/templates/docker_compose/docker-compose.yml.jinja +++ b/make/photon/prepare/templates/docker_compose/docker-compose.yml.jinja @@ -437,6 +437,35 @@ services: env_file: ./common/config/clair-adapter/env {% endif %} +{% if with_trivy %} + trivy-adapter: + container_name: trivy-adapter + image: goharbor/trivy-adapter-photon:{{trivy_adapter_version}} + restart: always + cap_drop: + - ALL + dns_search: . + networks: + - harbor +{% if external_redis == False %} + depends_on: + - redis +{% endif %} + volumes: + - type: bind + source: {{data_volume}}/trivy-adapter/trivy + target: /home/scanner/.cache/trivy + - type: bind + source: {{data_volume}}/trivy-adapter/reports + target: /home/scanner/.cache/reports + logging: + driver: "syslog" + options: + syslog-address: "tcp://127.0.0.1:1514" + tag: "trivy-adapter" + env_file: + ./common/config/trivy-adapter/env +{% endif %} {% if with_chartmuseum %} chartmuseum: container_name: chartmuseum @@ -491,4 +520,4 @@ networks: {% if with_chartmuseum %} harbor-chartmuseum: external: false -{% endif %} \ No newline at end of file +{% endif %} diff --git a/make/photon/prepare/templates/trivy-adapter/env.jinja b/make/photon/prepare/templates/trivy-adapter/env.jinja new file mode 100644 index 000000000..4739e574d --- /dev/null +++ b/make/photon/prepare/templates/trivy-adapter/env.jinja @@ -0,0 +1,7 @@ +SCANNER_LOG_LEVEL={{log_level}} +SCANNER_STORE_REDIS_URL=redis://redis:6379 +SCANNER_JOB_QUEUE_REDIS_URL=redis://redis:6379 +SCANNER_TRIVY_CACHE_DIR=/home/scanner/.cache/trivy +SCANNER_TRIVY_REPORTS_DIR=/home/scanner/.cache/reports +SCANNER_TRIVY_VULN_TYPE=os,library +SCANNER_TRIVY_SEVERITY=UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL diff --git a/make/photon/prepare/utils/configs.py b/make/photon/prepare/utils/configs.py index df24f8122..499b208ce 100644 --- a/make/photon/prepare/utils/configs.py +++ b/make/photon/prepare/utils/configs.py @@ -94,7 +94,7 @@ def parse_versions(): return versions -def parse_yaml_config(config_file_path, with_notary, with_clair, with_chartmuseum): +def parse_yaml_config(config_file_path, with_notary, with_clair, with_trivy, with_chartmuseum): ''' :param configs: config_parser object :returns: dict of configs @@ -113,6 +113,7 @@ def parse_yaml_config(config_file_path, with_notary, with_clair, with_chartmuseu 'jobservice_url': 'http://jobservice:8080', 'clair_url': 'http://clair:6060', 'clair_adapter_url': 'http://clair-adapter:8080', + 'trivy_adapter_url': 'http://trivy-adapter:8080', 'notary_url': 'http://notary-server:4443', 'chart_repository_url': 'http://chartmuseum:9999' } diff --git a/make/photon/prepare/utils/core.py b/make/photon/prepare/utils/core.py index a1dd7aa46..4d669a954 100644 --- a/make/photon/prepare/utils/core.py +++ b/make/photon/prepare/utils/core.py @@ -13,7 +13,7 @@ core_conf = os.path.join(config_dir, "core", "app.conf") ca_download_dir = os.path.join(data_dir, 'ca_download') -def prepare_core(config_dict, with_notary, with_clair, with_chartmuseum): +def prepare_core(config_dict, with_notary, with_clair, with_trivy, with_chartmuseum): prepare_dir(ca_download_dir, uid=DEFAULT_UID, gid=DEFAULT_GID) prepare_dir(core_config_dir) # Render Core @@ -30,6 +30,7 @@ def prepare_core(config_dict, with_notary, with_clair, with_chartmuseum): chart_cache_driver=chart_cache_driver, with_notary=with_notary, with_clair=with_clair, + with_trivy=with_trivy, with_chartmuseum=with_chartmuseum, **config_dict) @@ -41,7 +42,6 @@ def prepare_core(config_dict, with_notary, with_clair, with_chartmuseum): xsrf_key=generate_random_string(40)) - def copy_core_config(core_templates_path, core_config_path): shutil.copyfile(core_templates_path, core_config_path) print("Generated configuration file: %s" % core_config_path) diff --git a/make/photon/prepare/utils/docker_compose.py b/make/photon/prepare/utils/docker_compose.py index 7716b7e39..6667e82fb 100644 --- a/make/photon/prepare/utils/docker_compose.py +++ b/make/photon/prepare/utils/docker_compose.py @@ -8,13 +8,14 @@ docker_compose_template_path = os.path.join(templates_dir, 'docker_compose', 'do docker_compose_yml_path = '/compose_location/docker-compose.yml' # render docker-compose -def prepare_docker_compose(configs, with_clair, with_notary, with_chartmuseum): +def prepare_docker_compose(configs, with_clair, with_trivy, with_notary, with_chartmuseum): versions = parse_versions() VERSION_TAG = versions.get('VERSION_TAG') or 'dev' REGISTRY_VERSION = versions.get('REGISTRY_VERSION') or 'v2.7.1-patch-2819-2553' NOTARY_VERSION = versions.get('NOTARY_VERSION') or 'v0.6.1' CLAIR_VERSION = versions.get('CLAIR_VERSION') or 'v2.0.9' CLAIR_ADAPTER_VERSION = versions.get('CLAIR_ADAPTER_VERSION') or 'v1.0.0' + TRIVY_ADAPTER_VERSION = versions.get('TRIVY_ADAPTER_VERSION') or 'v0.2.3' CHARTMUSEUM_VERSION = versions.get('CHARTMUSEUM_VERSION') or 'v0.9.0' rendering_variables = { @@ -24,6 +25,7 @@ def prepare_docker_compose(configs, with_clair, with_notary, with_chartmuseum): 'notary_version': '{}-{}'.format(NOTARY_VERSION, VERSION_TAG), 'clair_version': '{}-{}'.format(CLAIR_VERSION, VERSION_TAG), 'clair_adapter_version': '{}-{}'.format(CLAIR_ADAPTER_VERSION, VERSION_TAG), + 'trivy_adapter_version': '{}-{}'.format(TRIVY_ADAPTER_VERSION, VERSION_TAG), 'chartmuseum_version': '{}-{}'.format(CHARTMUSEUM_VERSION, VERSION_TAG), 'data_volume': configs['data_volume'], 'log_location': configs['log_location'], @@ -34,6 +36,7 @@ def prepare_docker_compose(configs, with_clair, with_notary, with_chartmuseum): 'external_database': configs['external_database'], 'with_notary': with_notary, 'with_clair': with_clair, + 'with_trivy': with_trivy, 'with_chartmuseum': with_chartmuseum } diff --git a/make/photon/prepare/utils/trivy_adapter.py b/make/photon/prepare/utils/trivy_adapter.py new file mode 100644 index 000000000..c314c1a67 --- /dev/null +++ b/make/photon/prepare/utils/trivy_adapter.py @@ -0,0 +1,21 @@ +import os + +from g import templates_dir, config_dir, data_dir, DEFAULT_UID, DEFAULT_GID +from .jinja import render_jinja +from .misc import prepare_dir + +trivy_adapter_template_dir = os.path.join(templates_dir, "trivy-adapter") + + +def prepare_trivy_adapter(config_dict): + trivy_adapter_config_dir = prepare_dir(config_dir, "trivy-adapter") + prepare_dir(data_dir, "trivy-adapter", "trivy", uid=DEFAULT_UID, gid=DEFAULT_GID) + prepare_dir(data_dir, "trivy-adapter", "reports", uid=DEFAULT_UID, gid=DEFAULT_GID) + + trivy_adapter_env_path = os.path.join(trivy_adapter_config_dir, "env") + trivy_adapter_env_template = os.path.join(trivy_adapter_template_dir, "env.jinja") + + render_jinja( + trivy_adapter_env_template, + trivy_adapter_env_path, + **config_dict) diff --git a/make/photon/trivy-adapter/Dockerfile b/make/photon/trivy-adapter/Dockerfile new file mode 100644 index 000000000..fc21b698b --- /dev/null +++ b/make/photon/trivy-adapter/Dockerfile @@ -0,0 +1,17 @@ +ARG harbor_base_image_version +FROM goharbor/harbor-trivy-adapter-base:${harbor_base_image_version} + +ARG trivy_version + +COPY ./make/photon/trivy-adapter/binary/trivy /usr/local/bin/trivy +COPY ./make/photon/trivy-adapter/binary/scanner-trivy /home/scanner/bin/scanner-trivy + +EXPOSE 8080 + +HEALTHCHECK --interval=30s --timeout=10s --retries=3 CMD curl -sS 127.0.0.1:8080/probe/healthy || exit 1 + +ENV TRIVY_VERSION=${trivy_version} + +USER scanner + +ENTRYPOINT ["/home/scanner/bin/scanner-trivy"] diff --git a/make/photon/trivy-adapter/Dockerfile.base b/make/photon/trivy-adapter/Dockerfile.base new file mode 100644 index 000000000..3b38817dc --- /dev/null +++ b/make/photon/trivy-adapter/Dockerfile.base @@ -0,0 +1,6 @@ +FROM photon:2.0 + +RUN tdnf install -y sudo rpm >> /dev/null \ + && tdnf clean all \ + && groupadd -r -g 10000 scanner \ + && useradd --no-log-init -m -r -g 10000 -u 10000 scanner diff --git a/src/common/config/metadata/metadatalist.go b/src/common/config/metadata/metadatalist.go index 07bbd0d0a..17216060d 100644 --- a/src/common/config/metadata/metadatalist.go +++ b/src/common/config/metadata/metadatalist.go @@ -73,6 +73,7 @@ var ( {Name: common.ClairDBUsername, Scope: SystemScope, Group: ClairGroup, EnvKey: "CLAIR_DB_USERNAME", DefaultValue: "postgres", ItemType: &StringType{}, Editable: false}, {Name: common.ClairURL, Scope: SystemScope, Group: ClairGroup, EnvKey: "CLAIR_URL", DefaultValue: "http://clair:6060", ItemType: &StringType{}, Editable: false}, {Name: common.ClairAdapterURL, Scope: SystemScope, Group: ClairGroup, EnvKey: "CLAIR_ADAPTER_URL", DefaultValue: "http://clair-adapter:8080", ItemType: &StringType{}, Editable: false}, + {Name: common.TrivyAdapterURL, Scope: SystemScope, Group: ClairGroup, EnvKey: "TRIVY_ADAPTER_URL", DefaultValue: "http://trivy-adapter:8080", ItemType: &StringType{}, Editable: false}, {Name: common.CoreURL, Scope: SystemScope, Group: BasicGroup, EnvKey: "CORE_URL", DefaultValue: "http://core:8080", ItemType: &StringType{}, Editable: false}, {Name: common.CoreLocalURL, Scope: SystemScope, Group: BasicGroup, EnvKey: "CORE_LOCAL_URL", DefaultValue: "http://127.0.0.1:8080", ItemType: &StringType{}, Editable: false}, @@ -150,6 +151,7 @@ var ( {Name: common.WithChartMuseum, Scope: SystemScope, Group: BasicGroup, EnvKey: "WITH_CHARTMUSEUM", DefaultValue: "false", ItemType: &BoolType{}, Editable: true}, {Name: common.WithClair, Scope: SystemScope, Group: BasicGroup, EnvKey: "WITH_CLAIR", DefaultValue: "false", ItemType: &BoolType{}, Editable: true}, + {Name: common.WithTrivy, Scope: SystemScope, Group: BasicGroup, EnvKey: "WITH_TRIVY", DefaultValue: "false", ItemType: &BoolType{}, Editable: true}, {Name: common.WithNotary, Scope: SystemScope, Group: BasicGroup, EnvKey: "WITH_NOTARY", DefaultValue: "false", ItemType: &BoolType{}, Editable: true}, // the unit of expiration is minute, 43200 minutes = 30 days {Name: common.RobotTokenDuration, Scope: UserScope, Group: BasicGroup, EnvKey: "ROBOT_TOKEN_DURATION", DefaultValue: "43200", ItemType: &IntType{}, Editable: true}, diff --git a/src/common/const.go b/src/common/const.go index 1dc3937df..09be9fe31 100755 --- a/src/common/const.go +++ b/src/common/const.go @@ -89,6 +89,7 @@ const ( AdminInitialPassword = "admin_initial_password" WithNotary = "with_notary" WithClair = "with_clair" + WithTrivy = "with_trivy" ScanAllPolicy = "scan_all_policy" ClairDBPassword = "clair_db_password" ClairDBHost = "clair_db_host" @@ -123,6 +124,7 @@ const ( ReadOnly = "read_only" ClairURL = "clair_url" ClairAdapterURL = "clair_adapter_url" + TrivyAdapterURL = "trivy_adapter_url" NotaryURL = "notary_url" DefaultCoreEndpoint = "http://core:8080" DefaultNotaryEndpoint = "http://notary-server:4443" diff --git a/src/core/config/config.go b/src/core/config/config.go index e40d7a7c8..0c18486b0 100755 --- a/src/core/config/config.go +++ b/src/core/config/config.go @@ -348,6 +348,16 @@ func ClairAdapterEndpoint() string { return cfgMgr.Get(common.ClairAdapterURL).GetString() } +// WithTrivy returns a bool value to indicate if Harbor's deployed with Trivy. +func WithTrivy() bool { + return cfgMgr.Get(common.WithTrivy).GetBool() +} + +// TrivyAdapterURL returns the endpoint URL of a Trivy adapter instance, by default it's the one deployed within Harbor. +func TrivyAdapterURL() string { + return cfgMgr.Get(common.TrivyAdapterURL).GetString() +} + // UAASettings returns the UAASettings to access UAA service. func UAASettings() (*models.UAASettings, error) { err := cfgMgr.Load() diff --git a/src/core/main.go b/src/core/main.go index cd389549e..6be3a15a3 100755 --- a/src/core/main.go +++ b/src/core/main.go @@ -208,7 +208,22 @@ func main() { log.Fatalf("Failed to initialize API handlers with error: %s", err.Error()) } + if config.WithTrivy() { + log.Info("Registering Trivy scanner adapter") + reg := &scanner.Registration{ + Name: "Trivy", + Description: "The Trivy scanner adapter", + URL: config.TrivyAdapterURL(), + UseInternalAddr: true, + Immutable: true, + } + if err := scan.EnsureScanner(reg, true); err != nil { + log.Fatalf("failed to initialize Trivy scanner: %v", err) + } + } + if config.WithClair() { + log.Info("Registering Clair scanner adapter") clairDB, err := config.ClairDB() if err != nil { log.Fatalf("failed to load clair database information: %v", err) @@ -228,11 +243,12 @@ func main() { if err := scan.EnsureScanner(reg, true); err != nil { log.Fatalf("failed to initialize clair scanner: %v", err) } - } else { - if err := scan.RemoveImmutableScanners(); err != nil { - log.Warningf("failed to remove immutable scanners: %v", err) - } } + //} else { + // if err := scan.RemoveImmutableScanners(); err != nil { + // log.Warningf("failed to remove immutable scanners: %v", err) + // } + //} closing := make(chan struct{}) done := make(chan struct{})