-
Notifications
You must be signed in to change notification settings - Fork 2.2k
/
cluster.go
62 lines (57 loc) · 2.27 KB
/
cluster.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
package commands
import (
"context"
"golang.org/x/xerrors"
k8sArtifacts "github.com/aquasecurity/trivy-kubernetes/pkg/artifacts"
"github.com/aquasecurity/trivy-kubernetes/pkg/k8s"
"github.com/aquasecurity/trivy-kubernetes/pkg/trivyk8s"
"github.com/aquasecurity/trivy/pkg/flag"
"github.com/aquasecurity/trivy/pkg/log"
"github.com/aquasecurity/trivy/pkg/types"
)
// clusterRun runs scan on kubernetes cluster
func clusterRun(ctx context.Context, opts flag.Options, cluster k8s.Cluster) error {
if err := validateReportArguments(opts); err != nil {
return err
}
var artifacts []*k8sArtifacts.Artifact
var err error
switch opts.Format {
case types.FormatCycloneDX:
artifacts, err = trivyk8s.New(cluster).ListClusterBomInfo(ctx)
if err != nil {
return xerrors.Errorf("get k8s artifacts with node info error: %w", err)
}
case types.FormatJSON, types.FormatTable:
k8sOpts := []trivyk8s.K8sOption{
trivyk8s.WithExcludeNamespaces(opts.ExcludeNamespaces),
trivyk8s.WithIncludeNamespaces(opts.IncludeNamespaces),
trivyk8s.WithExcludeKinds(opts.ExcludeKinds),
trivyk8s.WithIncludeKinds(opts.IncludeKinds),
trivyk8s.WithExcludeOwned(opts.ExcludeOwned),
}
if opts.Scanners.AnyEnabled(types.MisconfigScanner) && !opts.DisableNodeCollector {
artifacts, err = trivyk8s.New(cluster, k8sOpts...).ListArtifactAndNodeInfo(ctx,
trivyk8s.WithScanJobNamespace(opts.NodeCollectorNamespace),
trivyk8s.WithIgnoreLabels(opts.ExcludeNodes),
trivyk8s.WithScanJobImageRef(opts.NodeCollectorImageRef),
trivyk8s.WithTolerations(opts.Tolerations))
if err != nil {
return xerrors.Errorf("get k8s artifacts with node info error: %w", err)
}
} else {
artifacts, err = trivyk8s.New(cluster, k8sOpts...).ListArtifacts(ctx)
if err != nil {
return xerrors.Errorf("get k8s artifacts error: %w", err)
}
}
default:
return xerrors.Errorf(`unknown format %q. Use "json" or "table" or "cyclonedx"`, opts.Format)
}
if !opts.DisableNodeCollector && !opts.Quiet {
log.InfoContext(ctx, "Node scanning is enabled")
log.InfoContext(ctx, "If you want to disable Node scanning via an in-cluster Job, please try '--disable-node-collector' to disable the Node-Collector job.")
}
runner := newRunner(opts, cluster.GetCurrentContext())
return runner.run(ctx, artifacts)
}