modules-gitlab-ci/templates/CVE_Scan.gitlab-ci.yml at main · deckhouse/modules-gitlab-ci · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
.cve_scan:
  allow_failure: true
  variables:
    VAULT_ROLE: ""
    VAULT_ADDR: https://seguro.flant.com
    CVE_TEST_REPO_GIT: "vault:projects/data/24cb1d7c-717a-4f92-8547-26f632916a7a/Trivy_CVE_Scan_CI_Secrets#CVE_TEST_REPO_GIT"
    CVE_TEST_SSH_PRIVATE_KEY: "vault:projects/data/24cb1d7c-717a-4f92-8547-26f632916a7a/Trivy_CVE_Scan_CI_Secrets#CVE_TEST_SSH_PRIVATE_KEY"
    CS_SOURCE_TAG: ""
    CS_CASE: ""
    CS_EXTERNAL_MODULE_NAME: ""
    CS_DD_URL: "vault:projects/data/24cb1d7c-717a-4f92-8547-26f632916a7a/Trivy_CVE_Scan_CI_Secrets#DD_URL"
    CS_DD_TOKEN: "vault:projects/data/24cb1d7c-717a-4f92-8547-26f632916a7a/Trivy_CVE_Scan_CI_Secrets#DD_TOKEN"
    CS_CODEOWNERS_REPO_TOKEN: "vault:projects/data/24cb1d7c-717a-4f92-8547-26f632916a7a/Trivy_CVE_Scan_CI_Secrets#CODEOWNERS_REPO_TOKEN"
    CS_DECKHOUSE_PRIVATE_REPO: "vault:projects/data/24cb1d7c-717a-4f92-8547-26f632916a7a/Trivy_CVE_Scan_CI_Secrets#DECKHOUSE_PRIVATE_REPO"
    CS_TRIVY_PROD_REGISTRY: "vault:projects/data/24cb1d7c-717a-4f92-8547-26f632916a7a/Trivy_CVE_Scan_CI_Secrets#TRIVY_PROD_REGISTRY"
    CS_TRIVY_PROD_REGISTRY_USER: "vault:projects/data/24cb1d7c-717a-4f92-8547-26f632916a7a/Trivy_CVE_Scan_CI_Secrets#TRIVY_PROD_REGISTRY_USER"
    CS_TRIVY_PROD_REGISTRY_PASSWORD: "vault:projects/data/24cb1d7c-717a-4f92-8547-26f632916a7a/Trivy_CVE_Scan_CI_Secrets#TRIVY_PROD_REGISTRY_PASSWORD"
    CS_PROD_REGISTRY: "vault:projects/data/24cb1d7c-717a-4f92-8547-26f632916a7a/Trivy_CVE_Scan_CI_Secrets#PROD_READ_REGISTRY"
    CS_PROD_REGISTRY_USER: "vault:projects/data/24cb1d7c-717a-4f92-8547-26f632916a7a/Trivy_CVE_Scan_CI_Secrets#PROD_READ_REGISTRY_USER"
    CS_PROD_REGISTRY_PASSWORD: "vault:projects/data/24cb1d7c-717a-4f92-8547-26f632916a7a/Trivy_CVE_Scan_CI_Secrets#PROD_READ_REGISTRY_PASSWORD"
    CS_DEV_REGISTRY: "vault:projects/data/24cb1d7c-717a-4f92-8547-26f632916a7a/Trivy_CVE_Scan_CI_Secrets#DECKHOUSE_DEV_REGISTRY_HOST"
    CS_DEV_REGISTRY_USER: "vault:projects/data/24cb1d7c-717a-4f92-8547-26f632916a7a/Trivy_CVE_Scan_CI_Secrets#DEV_REGISTRY_USER"
    CS_DEV_REGISTRY_PASSWORD: "vault:projects/data/24cb1d7c-717a-4f92-8547-26f632916a7a/Trivy_CVE_Scan_CI_Secrets#DEV_REGISTRY_PASSWORD"
    CS_SCAN_USERS: "False"
    CS_SCAN_SEVERAL_LATEST_RELEASES: "False"
    CS_LATEST_RELEASES_AMOUNT: "3"
    CS_MODULE_PROD_REGISTRY_CUSTOM_PATH: "deckhouse/fe/modules"
    CS_MODULE_DEV_REGISTRY_CUSTOM_PATH: "sys/deckhouse-oss/modules"
    CS_DIGEST_FROM_WERF: "images_tags_werf"
    CS_TRIVY_REPORTS_LOG_OUTPUT: "1"
    CS_WORKDIR: "cve-scan"
    CS_CONFIGMAP_PROJECT_ID: "4352"
    CS_TRIVY_BIN_VERSION: "v0.67.2"
    CS_TRIVY_REPO_ID: "2181"

  id_tokens:
    VAULT_ID_TOKEN:
      aud: gitlab-access-aud

  before_script:
    - |
      set -e
      echo "Installing d8-cli"
      export D8_VERSION="v0.29.24"
      echo "D8_VERSION: $D8_VERSION"
      mkdir -p ~/bin
      D8_BIN=~/bin/d8-${D8_VERSION}
      if [ ! -x "$D8_BIN" ]; then
        curl --fail --show-error -L "https://github.com/deckhouse/deckhouse-cli/releases/download/${D8_VERSION}/d8-${D8_VERSION}-linux-amd64.tar.gz" -o d8-${D8_VERSION}-linux-amd64.tar.gz
        if [[ $? -ne 0 ]]; then echo "curl != 200"; exit 1; fi
        tar --strip-components=2 -xzf d8-${D8_VERSION}-linux-amd64.tar.gz linux-amd64/bin/d8
        mv d8 "${D8_BIN}"
        chmod u+x "${D8_BIN}"
      fi
      echo "D8_BIN: $D8_BIN"

      echo "Writing vault token"
      export VAULT_TOKEN=$(${D8_BIN} stronghold write -field=token auth/fox/login role=$VAULT_ROLE jwt=$VAULT_ID_TOKEN)
      while IFS='=' read -r name value; do
        # Проверяем, начинается ли значение с 'vault:'
        if [[ $value == vault:* ]]; then
          # Удаляем префикс 'vault:'
          stripped_value=${value#vault:}
          secret_path="${stripped_value%%#*}"
          secret_value=$(${D8_BIN} stronghold read -field=data --format=json "${secret_path}" | jq --arg v "${stripped_value#*#}" '.[$v]' -r)
          export "$name=${secret_value}"
        fi

      done < <(env)
      echo "Variables written to environment"

      echo "Adding ssh key to ~/.ssh"
      mkdir -p ~/.ssh
      chmod 700 ~/.ssh
      printf '%s\n' "$CVE_TEST_SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
      chmod 600 ~/.ssh/id_rsa
      HOST=$(echo "$CVE_TEST_REPO_GIT" | sed -E 's/.*@([^:]+).*/\1/')
      if [ -n "$HOST" ]; then
        ssh-keyscan -H "$HOST" >> ~/.ssh/known_hosts 2>/dev/null || true
      fi
      echo "Known hosts file updated"

      echo "Cloning cve-scripts repository"
      rm -rf /tmp/cve-scripts
      git clone --depth 1 --branch v2.0 "$CVE_TEST_REPO_GIT" /tmp/cve-scripts
      cp /tmp/cve-scripts/*.sh /tmp/cve-scripts/*.py .
      chmod +x *.sh *.py
      echo "Scripts copied to current directory"
  script:
    - |
      export CS_SOURCE_TAG
      export CS_CASE
      export CS_EXTERNAL_MODULE_NAME
      export CS_RELEASE_IN_DEV
      export CS_SCAN_USERS
      export CS_SCAN_SEVERAL_LATEST_RELEASES
      export CS_LATEST_RELEASES_AMOUNT
      export CS_TRIVY_PROD_REGISTRY
      export CS_TRIVY_BIN_VERSION
      export CS_TRIVY_REPO_ID
      export CS_TRIVY_REPORTS_LOG_OUTPUT
      export CS_PROD_REGISTRY
      export CS_PROD_REGISTRY_USER
      export CS_PROD_REGISTRY_PASSWORD
      export CS_DEV_REGISTRY
      export CS_DEV_REGISTRY_USER
      export CS_DEV_REGISTRY_PASSWORD
      export CS_MODULE_PROD_REGISTRY_CUSTOM_PATH
      export CS_MODULE_DEV_REGISTRY_CUSTOM_PATH
      export CS_DIGEST_FROM_WERF
      export CS_DD_URL
      export CS_DD_TOKEN
      export CS_CODEOWNERS_REPO_TOKEN
      export CS_DECKHOUSE_PRIVATE_REPO
      export CS_CONFIGMAP_PROJECT_ID
      export CS_WORKDIR="${CI_PROJECT_DIR}/${CS_WORKDIR}"
      export CS_TRIVY_DB_URL="${CS_TRIVY_PROD_REGISTRY}/deckhouse/ee/security/trivy-db:2"
      export CS_TRIVY_JAVA_DB_URL="${CS_TRIVY_PROD_REGISTRY}/deckhouse/ee/security/trivy-java-db:1"
      export CS_TRIVY_POLICY_URL="${CS_TRIVY_PROD_REGISTRY}/deckhouse/ee/security/trivy-bdu:1"

      echo "Running cve_scan.sh"

      ./cve_scan.sh