Skip to content

Commit c677893

Browse files
ggjulioggjulio
committed
Add trivy scan IaC + devcontainer definition.
1 parent 6d108d4 commit c677893

5 files changed

Lines changed: 195 additions & 0 deletions

File tree

‎.devcontainer/Dockerfile‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
# syntax=docker/dockerfile:1
2+
3+
# renovate: datasource=github-releases packageName=helm/chart-testing
4+
ARG CHART_TESTING_VERSION='3.14.0'
5+
# renovate: datasource=github-releases packageName=helm/helm
6+
ARG HELM_VERSION='3.19.2'
7+
# renovate: datasource=github-releases packageName=kubernetes-sigs/kind
8+
ARG KIND_VERSION='0.30.0'
9+
# renovate: datasource=github-tags depName=kubectl packageName=kubernetes/kubectl extractVersion=^kubernetes-(?<version>.+)$
10+
ARG KUBECTL_VERSION='1.34.2'
11+
# renovate: datasource=github-releases packageName=aquasecurity/trivy
12+
ARG TRIVY_VERSION='0.68.1'
13+
# renovate: datasource=github-releases packageName=git-lfs/git-lfs
14+
ARG GIT_LFS_VERSION='3.7.1'
15+
16+
FROM mcr.microsoft.com/devcontainers/python:3.14-bookworm AS base
17+
SHELL ["/bin/bash", "-euxo", "pipefail", "-c"]
18+
ARG TARGETPLATFORM
19+
20+
RUN <<EOT
21+
if [ "${TARGETPLATFORM}" != 'linux/amd64' ] && [ "${TARGETPLATFORM}" != 'linux/arm64' ]; then
22+
echo "Platform ${TARGETPLATFORM} currently not supported!" >&2
23+
exit 2
24+
fi
25+
mkdir -p /tmp/output-bin/
26+
EOT
27+
28+
FROM base AS tools-misc
29+
ARG TARGETARCH
30+
ARG TRIVY_VERSION GIT_LFS_VERSION
31+
32+
RUN <<EOF
33+
34+
arch="$(echo "${TARGETARCH}" | sed s/arm64/ARM/ | sed s/amd64/64bit/)"
35+
curl -fsSL -o /tmp/trivy.tar.gz "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-${arch}.tar.gz"
36+
tar -xzf /tmp/trivy.tar.gz -C /tmp/output-bin/ --no-same-owner trivy
37+
rm -f /tmp/trivy.tar.gz
38+
/tmp/output-bin/trivy --version
39+
40+
wget -qO /tmp/git-lfs.tar.gz "https://github.com/git-lfs/git-lfs/releases/download/v${GIT_LFS_VERSION}/git-lfs-linux-${TARGETARCH}-v${GIT_LFS_VERSION}.tar.gz"
41+
tar -xzf /tmp/git-lfs.tar.gz -C /tmp/output-bin/ --no-same-owner "git-lfs-${GIT_LFS_VERSION}/git-lfs" --strip-components=1
42+
rm -f /tmp/git-lfs.tar.gz
43+
/tmp/output-bin/git-lfs version
44+
EOF
45+
46+
FROM base AS tools-k8s
47+
ARG KUBECTL_VERSION KIND_VERSION HELM_VERSION CHART_TESTING_VERSION
48+
ARG TARGETARCH
49+
50+
RUN <<EOF
51+
mkdir -p /tmp/output-bin/
52+
wget -qO /tmp/output-bin/kubectl "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/linux/${TARGETARCH}/kubectl"
53+
chmod +x /tmp/output-bin/kubectl
54+
/tmp/output-bin/kubectl version --client
55+
56+
wget -qO /tmp/helm.tar.gz "https://get.helm.sh/helm-v${HELM_VERSION}-linux-${TARGETARCH}.tar.gz"
57+
tar -xzf /tmp/helm.tar.gz -C /tmp/output-bin/ "linux-${TARGETARCH}/helm" --strip-components=1
58+
rm /tmp/helm.tar.gz
59+
/tmp/output-bin/helm version
60+
61+
wget -qO /tmp/output-bin/kind "https://github.com/kubernetes-sigs/kind/releases/download/v${KIND_VERSION}/kind-linux-${TARGETARCH}"
62+
chmod +x /tmp/output-bin/kind
63+
/tmp/output-bin/kind version
64+
65+
wget -qO /tmp/chart-testing.tar.gz "https://github.com/helm/chart-testing/releases/download/v${CHART_TESTING_VERSION}/chart-testing_${CHART_TESTING_VERSION}_linux_${TARGETARCH}.tar.gz"
66+
tar -xzf /tmp/chart-testing.tar.gz -C /tmp/output-bin/ --no-same-owner ct
67+
rm -f /tmp/chart-testing.tar.gz
68+
/tmp/output-bin/ct version
69+
EOF
70+
71+
FROM base AS development-base
72+
73+
RUN <<EOF
74+
packages=(
75+
# General
76+
file
77+
iputils-ping
78+
dnsutils
79+
# IntelliJ requirements
80+
libxtst6
81+
libxrender1
82+
libfontconfig1
83+
libxi6
84+
libgtk-3-0
85+
)
86+
apt-get update
87+
apt-get install -y --no-install-recommends "${packages[@]}"
88+
apt-get clean
89+
rm -rf /var/lib/apt/lists/*
90+
91+
pip install pre-commit
92+
pre-commit -V
93+
EOF
94+
95+
FROM development-base AS development
96+
97+
COPY --from=tools-k8s /tmp/output-bin /usr/local/bin/
98+
COPY --from=tools-misc /tmp/output-bin /usr/local/bin/

‎.devcontainer/devcontainer.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"name": "otel helm charts",
3+
"build": {
4+
"dockerfile": "Dockerfile",
5+
"target": "development",
6+
},
7+
"hostRequirements": {
8+
"cpus": 2,
9+
"memory": "4gb",
10+
"storage": "8gb"
11+
},
12+
"features": {
13+
// Don't add more features as they are very slow to build, use the Dockerfile instead.
14+
// Only dind feature makes sense to install as it is non trivial to setup manually.
15+
"ghcr.io/devcontainers/features/docker-in-docker:2": {},
16+
},
17+
"forwardPorts": [
18+
],
19+
"portsAttributes": {},
20+
"otherPortsAttributes": {
21+
"onAutoForward" : "ignore"
22+
},
23+
"mounts": [
24+
{
25+
"source": "vscode-home-${devcontainerId}",
26+
"target": "/home/vscode/",
27+
"type": "volume"
28+
}
29+
],
30+
"customizations": {
31+
"vscode": {
32+
"extensions": [
33+
"docker.docker",
34+
"exiasr.hadolint",
35+
"github.vscode-github-actions",
36+
"aquasecurityofficial.trivy-vulnerability-scanner",
37+
38+
"eamodio.gitlens",
39+
"mutantdino.resourcemonitor",
40+
"shd101wyy.markdown-preview-enhanced",
41+
"streetsidesoftware.code-spell-checker",
42+
],
43+
"settings": {
44+
"resmon.show.battery": false,
45+
"resmon.show.cpufreq": false,
46+
"telemetry.enableTelemetry": false,
47+
"terminal.integrated.defaultProfile.linux": "zsh",
48+
// Prefer .vscode/settings.json over putting settings here.
49+
}
50+
}
51+
}
52+
}

‎.github/workflows/scan.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: Scan
2+
3+
on:
4+
push:
5+
branches: [ "main" ]
6+
pull_request:
7+
8+
permissions:
9+
contents: read
10+
11+
jobs:
12+
build:
13+
permissions:
14+
contents: read
15+
security-events: write
16+
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
17+
name: Trivy IaC Scan
18+
runs-on: ubuntu-latest
19+
steps:
20+
- name: Checkout code
21+
uses: actions/checkout@v4
22+
23+
- name: Run Trivy vulnerability scanner in IaC mode
24+
uses: aquasecurity/trivy-action@0.33.1
25+
with:
26+
scan-type: 'config'
27+
hide-progress: true
28+
format: 'sarif'
29+
output: 'trivy-results.sarif'
30+
31+
- name: Upload Trivy scan results to GitHub Security tab
32+
if: always()
33+
uses: github/codeql-action/upload-sarif@v4
34+
with:
35+
sarif_file: 'trivy-results.sarif'

‎.trivyignore.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
misconfigurations:
2+
- id: AVD-DS-0026
3+
statement: No healthcheck instruction is not applicable for devcontainer.
4+
paths:
5+
- .devcontainer/Dockerfile
6+
- id: AVD-DS-0002
7+
statement: Image user should not be root is not applicable for devcontainer.
8+
paths:
9+
- .devcontainer/Dockerfile

‎trivy.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
ignorefile: .trivyignore.yaml # experimental so the doc say we must specify it explicitly

0 commit comments

Comments
 (0)