Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update exclusions check for better new user experience #412

Merged
merged 7 commits into from
Oct 18, 2024
Merged

Update exclusions check for better new user experience #412

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
7606537
Update exclusions check to only fail under certain conditions. extern…
HN23 Oct 10, 2024
f7bca85
removing redundant github workflow helm-extra-set-args
HN23 Oct 10, 2024
1f2bbe4
toJson the list
HN23 Oct 10, 2024
e7c9d1b
test updates
HN23 Oct 10, 2024
903bfdf
allow changing data_syncer auto_sync_enabled
HN23 Oct 15, 2024
c8a2286
updating tests
HN23 Oct 15, 2024
fcb28ee
adding notes to helper function
HN23 Oct 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/openshift-test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,7 +128,7 @@ jobs:
mv ci/openshift-test.yaml ci/openshift-test-values.yaml
popd
done
ct install --config ct-config.yaml --helm-extra-args "--timeout 600s" --helm-extra-set-args "--set=useExistingPullCredSecret=true--set=useExistingLicenseSecret=true --set=anchoreConfig.policy_engine.vulnerabilities.matching.exclude.providers=[] --set=anchoreConfig.policy_engine.vulnerabilities.matching.exclude.package_types=[]"
ct install --config ct-config.yaml --helm-extra-args "--timeout 600s"
env:
KUBECONFIG: ./tmp/kubeconfig
TARGET_BRANCH: "${{ github.event.pull_request.base.ref }}"
2 changes: 1 addition & 1 deletion .github/workflows/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,4 +99,4 @@ jobs:

- name: Run chart-testing
if: steps.list-changed.outputs.CHANGED == 'true'
run: ct install --config ct-config.yaml --helm-extra-args "--timeout 600s" --helm-extra-set-args "--set=useExistingPullCredSecret=true --set=useExistingLicenseSecret=true --set=anchoreConfig.policy_engine.vulnerabilities.matching.exclude.providers=[] --set=anchoreConfig.policy_engine.vulnerabilities.matching.exclude.package_types=[]"
run: ct install --config ct-config.yaml --helm-extra-args "--timeout 600s"
2 changes: 1 addition & 1 deletion stable/enterprise/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
apiVersion: v2
name: enterprise
version: "3.0.0"
version: "3.0.1"
appVersion: "5.10.0"
kubeVersion: 1.23.x - 1.30.x || 1.23.x-x - 1.30.x-x
description: |
Expand Down
12 changes: 10 additions & 2 deletions stable/enterprise/files/default_config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -201,8 +201,16 @@ services:
enabled: true
matching:
exclude:
providers: {{ .Values.anchoreConfig.policy_engine.vulnerabilities.matching.exclude.providers }}
package_types: {{ .Values.anchoreConfig.policy_engine.vulnerabilities.matching.exclude.package_types }}
{{- if .Values.anchoreConfig.policy_engine.vulnerabilities.matching.exclude.providers }}
providers: {{ .Values.anchoreConfig.policy_engine.vulnerabilities.matching.exclude.providers | toJson }}
{{- else }}
providers: []
{{- end }}
{{- if .Values.anchoreConfig.policy_engine.vulnerabilities.matching.exclude.package_types }}
package_types: {{ .Values.anchoreConfig.policy_engine.vulnerabilities.matching.exclude.package_types | toJson }}
{{- else }}
package_types: []
{{- end }}
default:
search:
by_cpe:
Expand Down
12 changes: 10 additions & 2 deletions stable/enterprise/files/osaa_config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -209,8 +209,16 @@ services:
enabled: true
matching:
exclude:
providers: {{ .Values.anchoreConfig.policy_engine.vulnerabilities.matching.exclude.providers }}
package_types: {{ .Values.anchoreConfig.policy_engine.vulnerabilities.matching.exclude.package_types }}
{{- if .Values.anchoreConfig.policy_engine.vulnerabilities.matching.exclude.providers }}
providers: {{ .Values.anchoreConfig.policy_engine.vulnerabilities.matching.exclude.providers | toJson }}
{{- else }}
providers: []
{{- end }}
{{- if .Values.anchoreConfig.policy_engine.vulnerabilities.matching.exclude.package_types }}
package_types: {{ .Values.anchoreConfig.policy_engine.vulnerabilities.matching.exclude.package_types | toJson }}
{{- else }}
package_types: []
{{- end }}
default:
search:
by_cpe:
Expand Down
83 changes: 82 additions & 1 deletion stable/enterprise/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,4 +154,85 @@ secretName: {{ . }}
{{- else }}
secretName: {{ template "enterprise.fullname" . }}-license
{{- end }}
{{- end -}}
{{- end -}}

HN23 marked this conversation as resolved.
Show resolved Hide resolved
{{- define "checkDriverEnabled" -}}
{{- $drivers := .drivers -}}
{{- $driverName := .driverName -}}
{{- $driver := index $drivers $driverName -}}
{{- if $driver }}
{{- $driverEnabled := index $driver "enabled" -}}
{{- if not $driverEnabled }}
{{- $notify := .notify -}}
{{- $_ := set . "notify" true -}}
{{- end }}
{{- end }}
{{- end }}

{{- define "enterprise.exclusionCheck" -}}

{{ $notify := false }}

{{ $feeds := index .Values "feeds" }}
{{- if $feeds -}}
{{ $feedsChartEnabled := index .Values "feeds" "chartEnabled" }}
{{- if (not $feedsChartEnabled) -}}
{{ $notify = true }}
{{- end -}}

{{- if not $notify -}}
{{ $feedsExtraEnvs := index .Values "feeds" "extraEnv" }}
{{- if $feedsExtraEnvs -}}
{{- range $index, $val := $feedsExtraEnvs -}}
{{- if contains "ANCHORE_FEEDS_DRIVER" .name -}}
{{ $notify = true }}
{{- end -}}
{{- end -}}
{{- end -}}
{{- end -}}

HN23 marked this conversation as resolved.
Show resolved Hide resolved
{{- if not $notify -}}
{{- $anchoreConfig := index $feeds "anchoreConfig" }}
{{- if $anchoreConfig }}
{{- $anchoreFeeds := index $anchoreConfig "feeds" }}
{{- if $anchoreFeeds }}
{{- $drivers := index $anchoreFeeds "drivers" }}
{{- if $drivers }}

{{- $context := dict "drivers" $drivers "notify" $notify "driverName" "gem" }}
{{- include "checkDriverEnabled" $context }}
{{- $notify = $context.notify }}

{{- $context := dict "drivers" $drivers "notify" $notify "driverName" "github" }}
{{- include "checkDriverEnabled" $context }}
{{- $notify = $context.notify }}

{{- $context := dict "drivers" $drivers "notify" $notify "driverName" "msrc" }}
{{- include "checkDriverEnabled" $context }}
{{- $notify = $context.notify }}

{{- $context := dict "drivers" $drivers "notify" $notify "driverName" "npm" }}
{{- include "checkDriverEnabled" $context }}
{{- $notify = $context.notify }}
{{- end -}}
{{- end -}}
{{- end -}}
{{- end -}}


{{- end -}}

{{- if not $notify -}}
{{- range $index, $val := .Values.extraEnv -}}
{{- if contains "ANCHORE_FEEDS_DRIVER" .name -}}
{{ $notify = true }}
{{- end -}}
{{- end -}}
{{- end -}}

{{ if $notify }}
{{- $exclude_providers := required "anchoreConfig.policy_engine.vulnerabilities.matching.exclude.providers is required" .Values.anchoreConfig.policy_engine.vulnerabilities.matching.exclude.providers -}}
{{- $exclude_package := required "anchoreConfig.policy_engine.vulnerabilities.matching.exclude.package_types is required" .Values.anchoreConfig.policy_engine.vulnerabilities.matching.exclude.package_types -}}
{{- end -}}

{{- end -}}
3 changes: 1 addition & 2 deletions stable/enterprise/templates/anchore_configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,4 @@
{{- $exclude_providers := required "anchoreConfig.policy_engine.vulnerabilities.matching.exclude.providers is required" .Values.anchoreConfig.policy_engine.vulnerabilities.matching.exclude.providers -}}
{{- $exclude_package := required "anchoreConfig.policy_engine.vulnerabilities.matching.exclude.package_types is required" .Values.anchoreConfig.policy_engine.vulnerabilities.matching.exclude.package_types -}}
{{- include "enterprise.exclusionCheck" . -}}
kind: ConfigMap
apiVersion: v1
metadata:
Expand Down
Loading