Skip to content

Commit 5a6fa3d

Browse files
clubandersonvMaroon
clubanderson
authored and
vMaroon
committed
test trivy scan
1 parent 814ebd0 commit 5a6fa3d

File tree

5 files changed

+230
-24
lines changed

5 files changed

+230
-24
lines changed

‎.tekton/benchmark.yaml

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
apiVersion: tekton.dev/v1
2+
kind: Task
3+
metadata:
4+
name: benchmark-task
5+
spec:
6+
params:
7+
- name: openshift_host
8+
description: "The OpenShift API server URL"
9+
type: string
10+
- name: openshift_namespace
11+
description: "The OpenShift namespace to use"
12+
type: string
13+
steps:
14+
- name: clone-and-install-fmperf
15+
image: continuumio/miniconda3:latest
16+
script: |
17+
#!/bin/bash
18+
set -ex
19+
20+
# Initialize conda (this sets up the environment for conda commands)
21+
source /opt/conda/etc/profile.d/conda.sh
22+
23+
echo "Cloning fmperf repository..."
24+
git clone https://github.com/fmperf-project/fmperf.git
25+
cd fmperf
26+
27+
echo "Creating conda environment 'fmperf-env' with Python 3.11..."
28+
conda create -y -n fmperf-env python=3.11
29+
30+
echo "Activating the conda environment..."
31+
conda activate fmperf-env
32+
33+
echo "Installing required dependencies..."
34+
pip install -r requirements.txt
35+
pip install -e .
36+
37+
echo "Setting up environment variables for OpenShift connection..."
38+
export OPENSHIFT_HOST="$(params.openshift_host)"
39+
export OPENSHIFT_TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
40+
export OPENSHIFT_NAMESPACE="$(params.openshift_namespace)"
41+
42+
echo "Running fmperf benchmark..."
43+
python examples/example_vllm.py || true

‎.tekton/buildah-build.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@ spec:
88
description: "Application version"
99
- name: image_tag_base
1010
description: "Image tag base"
11+
results:
12+
- name: image-url
13+
description: "The full image URL including tag"
1114
workspaces:
1215
- name: source
1316
- name: registry
@@ -65,3 +68,4 @@ spec:
6568
echo "🚀 Calling make buildah-build with IMG=$IMG..."
6669
make buildah-build IMG=$IMG
6770
71+
echo "$IMG" > /tekton/results/image-url

‎.tekton/pipelinerun.yaml

+96-24
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,14 @@ metadata:
1212
(!has(body.ref) || body.ref == 'refs/heads/main' || body.ref == 'refs/heads/dev') &&
1313
(!has(body.head_commit) || !has(body.head_commit.author) || !body.head_commit.author.name.matches("(?i).*ci-tag-bot.*")) &&
1414
(!has(body.pull_request) || (body.pull_request.base.ref == 'main' || body.pull_request.base.ref == 'dev'))
15+
results.tekton.dev/columns: |
16+
[
17+
{
18+
"name": "Vulnerabilities",
19+
"type": "string",
20+
"jsonPath": ".status.pipelineResults[?(@.name==\"vulnerabilities\")].value"
21+
}
22+
]
1523
spec:
1624
podTemplate:
1725
serviceAccountName: pipeline
@@ -58,31 +66,17 @@ spec:
5866
- name: source
5967
workspace: source
6068

61-
# - name: debug-user
62-
# taskSpec:
63-
# workspaces:
64-
# - name: source
65-
# workspace: source
66-
# steps:
67-
# - name: show-user-info
68-
# image: busybox
69-
# script: |
70-
# #!/bin/sh
71-
# echo "Current UID:"
72-
# id -u
73-
# echo "Current GID:"
74-
# id -g
75-
# echo "Permissions on /workspace/source:"
76-
# ls -ld /workspace/source
77-
# workspaces:
78-
# - name: source
79-
# workspace: source
69+
- name: read-cluster-name
70+
taskRef:
71+
name: read-cluster-name
72+
runAfter:
73+
- fix-permissions
8074

8175
- name: which-branch
8276
taskRef:
8377
name: print-branch-task
8478
runAfter:
85-
- fix-permissions
79+
- read-cluster-name
8680
params:
8781
- name: source-branch
8882
value: "$(params.source_branch)"
@@ -113,6 +107,9 @@ spec:
113107
- input: "$(params.runOptional)"
114108
operator: in
115109
values: ["true"]
110+
- input: "$(tasks.read-cluster-name.results.cluster-name)"
111+
operator: in
112+
values: ["cluster-platform-eval"]
116113
taskRef:
117114
name: go-lint-task
118115
runAfter:
@@ -126,11 +123,13 @@ spec:
126123
- input: "$(params.runOptional)"
127124
operator: in
128125
values: ["true"]
126+
- input: "$(tasks.read-cluster-name.results.cluster-name)"
127+
operator: in
128+
values: ["cluster-platform-eval"]
129129
taskRef:
130130
name: go-test-task
131131
runAfter:
132132
- go-lint
133-
# - fetch-repository
134133
workspaces:
135134
- name: source
136135
workspace: source
@@ -140,6 +139,9 @@ spec:
140139
- input: "$(params.runOptional)"
141140
operator: in
142141
values: ["true"]
142+
- input: "$(tasks.read-cluster-name.results.cluster-name)"
143+
operator: in
144+
values: ["cluster-platform-eval"]
143145
taskRef:
144146
name: go-build-task
145147
runAfter:
@@ -168,6 +170,9 @@ spec:
168170
- input: "$(params.source_branch)"
169171
operator: in
170172
values: ["main"]
173+
- input: "$(tasks.read-cluster-name.results.cluster-name)"
174+
operator: in
175+
values: ["cluster-platform-eval"]
171176
taskRef:
172177
name: promote-to-prod-task
173178
params:
@@ -193,6 +198,9 @@ spec:
193198
- input: "$(params.source_branch)"
194199
operator: in
195200
values: ["dev"]
201+
- input: "$(tasks.read-cluster-name.results.cluster-name)"
202+
operator: in
203+
values: ["cluster-platform-eval"]
196204
params:
197205
- name: dev-version
198206
value: "$(tasks.extract-version-and-registry.results.dev-version)"
@@ -210,10 +218,40 @@ spec:
210218
- name: registry
211219
workspace: registry-secret
212220

221+
- name: vulnerability-scan
222+
when:
223+
- input: "$(params.runOptional)"
224+
operator: in
225+
values: ["true"]
226+
- input: "$(tasks.read-cluster-name.results.cluster-name)"
227+
operator: in
228+
values: ["cluster-platform-eval"]
229+
runAfter:
230+
- buildah-build
231+
taskRef:
232+
name: trivy-scan
233+
params:
234+
- name: IMAGE_URL
235+
value: "$(tasks.buildah-build.results.image-url)"
236+
- name: SEVERITY
237+
value: "CRITICAL,HIGH"
238+
- name: ARGS
239+
value: "--exit-code 0"
240+
workspaces:
241+
- name: registry-secret
242+
workspace: registry-secret
243+
- name: output
244+
workspace: output
245+
213246
- name: sync-after-promote-or-build
247+
when:
248+
- input: "$(tasks.read-cluster-name.results.cluster-name)"
249+
operator: in
250+
values: ["cluster-platform-eval"]
214251
runAfter:
215252
- promote-to-prod
216-
- buildah-build
253+
# - buildah-build
254+
- vulnerability-scan
217255
taskRef:
218256
name: noop-task
219257

@@ -240,6 +278,9 @@ spec:
240278
- input: "$(params.source_branch)"
241279
operator: in
242280
values: ["main", "dev"]
281+
- input: "$(tasks.read-cluster-name.results.cluster-name)"
282+
operator: in
283+
values: ["cluster-platform-eval"]
243284
taskRef:
244285
name: tag-version-task
245286
params:
@@ -310,12 +351,35 @@ spec:
310351
workspaces:
311352
- name: source
312353
workspace: source
313-
354+
355+
- name: benchmark
356+
when:
357+
- input: "$(params.source_branch)"
358+
operator: in
359+
values: ["dev"]
360+
- input: "$(tasks.read-cluster-name.results.cluster-name)"
361+
operator: in
362+
values: ["cluster-platform-eval"]
363+
continueOn:
364+
errors: true
365+
params:
366+
- name: openshift_host
367+
value: "https://api.fmaas-platform-eval.fmaas.res.ibm.com:6443"
368+
- name: openshift_namespace
369+
value: "hc4ai-operator-dev"
370+
taskRef:
371+
name: benchmark-task
372+
runAfter:
373+
- go-test-post-deploy
374+
314375
- name: increment-versions
315376
when:
316377
- input: "$(params.source_branch)"
317378
operator: in
318379
values: ["main"]
380+
- input: "$(tasks.read-cluster-name.results.cluster-name)"
381+
operator: in
382+
values: ["cluster-platform-eval"]
319383
params:
320384
- name: source-branch
321385
value: "$(params.source_branch)"
@@ -347,7 +411,7 @@ spec:
347411
operator: in
348412
values: ["dev"]
349413
runAfter:
350-
- go-test-post-deploy
414+
- benchmark
351415
taskRef:
352416
name: noop-task
353417

@@ -360,6 +424,14 @@ spec:
360424
resources:
361425
requests:
362426
storage: 1Gi
427+
- name: output
428+
volumeClaimTemplate:
429+
spec:
430+
accessModes:
431+
- ReadWriteOnce
432+
resources:
433+
requests:
434+
storage: 1Gi
363435
- name: basic-auth
364436
secret:
365437
secretName: "{{ git_auth_secret }}"

‎.tekton/read-cluster-name.yaml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
apiVersion: tekton.dev/v1
2+
kind: Task
3+
metadata:
4+
name: read-cluster-name
5+
spec:
6+
results:
7+
- name: cluster-name
8+
steps:
9+
- name: get-cluster-name
10+
image: registry.access.redhat.com/ubi8/ubi-minimal
11+
script: |
12+
#!/bin/sh
13+
cat /etc/config/cluster-name | tee $(results.cluster-name.path)
14+
volumeMounts:
15+
- name: config-vol
16+
mountPath: /etc/config
17+
volumes:
18+
- name: config-vol
19+
configMap:
20+
name: cluster-info

‎.tekton/vuln-scan-trivy.yaml

+67
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
apiVersion: tekton.dev/v1
2+
kind: Task
3+
metadata:
4+
name: trivy-scan
5+
spec:
6+
params:
7+
- name: IMAGE_URL
8+
type: string
9+
description: Full image URL (e.g., quay.io/org/image:tag)
10+
- name: SEVERITY
11+
type: string
12+
default: "CRITICAL,HIGH"
13+
description: Comma-separated severity levels
14+
- name: ARGS
15+
type: string
16+
default: ""
17+
description: Additional Trivy arguments
18+
workspaces:
19+
- name: registry-secret
20+
description: Workspace with Docker config.json (auth for private registries)
21+
- name: output
22+
results:
23+
- name: vulnerabilities
24+
type: string
25+
steps:
26+
- name: trivy-scan
27+
image: docker:20.10.24-dind
28+
securityContext:
29+
privileged: true
30+
script: |
31+
#!/bin/sh
32+
set -e
33+
34+
echo "🔧 Starting Docker daemon..."
35+
dockerd-entrypoint.sh &
36+
37+
echo "⏳ Waiting for Docker daemon to be ready..."
38+
until docker info > /dev/null 2>&1; do
39+
sleep 1
40+
done
41+
42+
echo "🔐 Setting up Docker credentials..."
43+
mkdir -p /root/.docker
44+
cp /workspace/registry-secret/.dockerconfigjson /root/.docker/config.json
45+
46+
echo "⬇️ Installing Trivy..."
47+
apk add --no-cache curl jq
48+
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
49+
50+
IMAGE="$(echo $(params.IMAGE_URL))"
51+
IMAGE=$(echo "$IMAGE" | tr -d '\n\r' | xargs)
52+
53+
echo "🔍 Running Trivy remote scan on: $IMAGE"
54+
if ! trivy image \
55+
--severity "$(params.SEVERITY)" \
56+
--format json \
57+
$(params.ARGS) \
58+
"$IMAGE" > /workspace/output/trivy-results.json; then
59+
echo "❌ Trivy scan failed"
60+
echo -n "-1" > $(results.vulnerabilities.path)
61+
exit 1
62+
fi
63+
64+
echo "📊 Counting vulnerabilities..."
65+
vuln_count=$(jq '[.Results[].Vulnerabilities[]?] | length' /workspace/output/trivy-results.json)
66+
echo "📊 Found $vuln_count vulnerabilities"
67+
echo -n "$vuln_count" > /tekton/results/vulnerabilities

0 commit comments

Comments
 (0)