Skip to content

Commit 09bcb71

Browse files
sjpbbertiethorpe
authored and
MaxBed4d
committed
Add trivy image scanning (#413)
* add trivy image scanning * bump fatimage workflow to ubuntu 22.04 * make setup script work in CI TODO: FIXME * fix libguestfs install * run only 1x build per matrix entry, & only builds required * fix packer README * fix image download * Use shorter names for CI clusters (#415) * use run_number as a shorter ID for CI * slurmci group name warning * Revert "slurmci group name warning" - underscores not valid linux hostname and stripped in host, leading to slurmdbd config failure This reverts commit 61dfad6. --------- Co-authored-by: Bertie <[email protected]> * install ood apps in fatimage * add ood jupyter install to fatimage * jupyter_compute ood into fatimage * bump fatimage * allow items in compute mapping to have different keys e.g. only specify image_id for some compute groups (#412) * Support ansible-init for remote collections (#411) * Add ansible-init role to requirements.yml * Add ansible-init to groups and plays * Configure cluster_infra ansible-init metadata * Only run site.yml once ansible-init has completed * Wait for ansible init to finish before running bootstrap * revert to using cluster_infra metadata defaults * update image * revert sausage bastion changes * set ansible_init_wait as common var * use run_number as a shorter ID for CI * install ood apps in fatimage * add ood jupyter install to fatimage * bump image * jupyter_compute ood into fatimage * bump fatimage for jupyter_compute ood * Update stackhpc.yml * duplicate tuned inventory group name * Fix invalid group name for slurmci * Update stackhpc.yml undo groupname changes * slurmci group name warning * rm ood changes * bump fatimage * change azimuth collection in bootstrap * update azimuth image utils version * update requirements * Update bastion.yml * Use azimuth image utils collection for ansible-init * bump fatimage --------- Co-authored-by: bertie <[email protected]> Co-authored-by: bertiethorpe <[email protected]> * avoid python-openstackclient v7 due to rebuild bug (#420) * Update hpctests to obey UCX_NET_DEVICES when RoCE devices present (#421) * Turn off higher priority MPI net devices * Update pingmatrix.sh.j2 * Update pingmatrix.sh.j2 * Update pingpong.sh.j2 * Replace j2 comments with bash * Update pingpong.sh.j2 --------- Co-authored-by: Steve Brasier <[email protected]> * delete trivy scanned vulnerabilities * update grafana * bump image * Update environments/.stackhpc/hooks/post.yml Co-authored-by: Steve Brasier <[email protected]> * Update setup-env.sh --------- Co-authored-by: Bertie <[email protected]> Co-authored-by: bertiethorpe <[email protected]> Co-authored-by: bertiethorpe <[email protected]>
1 parent c2d796c commit 09bcb71

File tree

4 files changed

+82
-24
lines changed

4 files changed

+82
-24
lines changed

‎.github/workflows/fatimage.yml

Lines changed: 64 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -2,27 +2,26 @@
22
name: Build fat image
33
'on':
44
workflow_dispatch:
5-
inputs:
6-
use_RL8:
7-
required: true
8-
description: Include RL8 image build
9-
type: boolean
10-
default: false
115
concurrency:
12-
group: ${{ github.ref }}-{{ matrix.os_version }} # to branch/PR + OS
6+
group: ${{ github.ref }}-{{ matrix.os_version }}-{{ matrix.build }} # to branch/PR + OS + build
137
cancel-in-progress: true
148
jobs:
159
openstack:
1610
name: openstack-imagebuild
17-
runs-on: ubuntu-20.04
11+
runs-on: ubuntu-22.04
1812
strategy:
1913
matrix:
20-
os_version: [RL8, RL9]
21-
rl8_selected:
22-
- ${{ inputs.use_RL8 == true }} # only potentially true for workflow_dispatch
14+
os_version:
15+
- RL8
16+
- RL9
17+
build:
18+
- openstack.openhpc
19+
- openstack.openhpc-ofed
2320
exclude:
2421
- os_version: RL8
25-
rl8_selected: false
22+
build: openstack.openhpc-ofed
23+
- os_version: RL9
24+
build: openstack.openhpc
2625
env:
2726
ANSIBLE_FORCE_COLOR: True
2827
OS_CLOUD: openstack
@@ -63,19 +62,64 @@ jobs:
6362
. environments/.stackhpc/activate
6463
cd packer/
6564
packer init .
66-
PACKER_LOG=1 packer build -on-error=${{ vars.PACKER_ON_ERROR }} -except=openstack.openhpc-extra -var-file=$PKR_VAR_environment_root/${{ vars.CI_CLOUD }}.pkrvars.hcl openstack.pkr.hcl
65+
PACKER_LOG=1 packer build -on-error=${{ vars.PACKER_ON_ERROR }} -only=${{ matrix.build }} -var-file=$PKR_VAR_environment_root/${{ vars.CI_CLOUD }}.pkrvars.hcl openstack.pkr.hcl
6766
env:
6867
PKR_VAR_os_version: ${{ matrix.os_version }}
6968

7069
- name: Get created image names from manifest
7170
id: manifest
7271
run: |
7372
. venv/bin/activate
74-
for IMAGE_ID in $(jq --raw-output '.builds[].artifact_id' packer/packer-manifest.json)
75-
do
76-
while ! openstack image show -f value -c name $IMAGE_ID; do
77-
sleep 5
78-
done
79-
IMAGE_NAME=$(openstack image show -f value -c name $IMAGE_ID)
80-
echo $IMAGE_NAME
73+
IMAGE_ID=$(jq --raw-output '.builds[-1].artifact_id' packer/packer-manifest.json)
74+
while ! openstack image show -f value -c name $IMAGE_ID; do
75+
sleep 5
8176
done
77+
IMAGE_NAME=$(openstack image show -f value -c name $IMAGE_ID)
78+
echo "image-name=${IMAGE_NAME}" >> "$GITHUB_OUTPUT"
79+
echo "image-id=$IMAGE_ID" >> "$GITHUB_OUTPUT"
80+
81+
- name: Download image
82+
run: |
83+
. venv/bin/activate
84+
openstack image save --file ${{ steps.manifest.outputs.image-name }}.qcow2 ${{ steps.manifest.outputs.image-name }}
85+
86+
- name: Set up QEMU
87+
uses: docker/setup-qemu-action@v3
88+
89+
- name: install libguestfs
90+
run: |
91+
sudo apt -y update
92+
sudo apt -y install libguestfs-tools
93+
94+
- name: mkdir for mount
95+
run: sudo mkdir -p './${{ steps.manifest.outputs.image-name }}'
96+
97+
- name: mount qcow2 file
98+
run: sudo guestmount -a ${{ steps.manifest.outputs.image-name }}.qcow2 -i --ro -o allow_other './${{ steps.manifest.outputs.image-name }}'
99+
100+
- name: Run Trivy vulnerability scanner
101+
uses: aquasecurity/[email protected]
102+
with:
103+
scan-type: fs
104+
scan-ref: "./${{ steps.manifest.outputs.image-name }}"
105+
scanners: "vuln"
106+
format: sarif
107+
output: "${{ steps.manifest.outputs.image-name }}.sarif"
108+
# turn off secret scanning to speed things up
109+
110+
- name: Upload Trivy scan results to GitHub Security tab
111+
uses: github/codeql-action/upload-sarif@v3
112+
with:
113+
sarif_file: "${{ steps.manifest.outputs.image-name }}.sarif"
114+
category: "${{ matrix.os_version }}-${{ matrix.build }}"
115+
116+
- name: Fail if scan has CRITICAL vulnerabilities
117+
uses: aquasecurity/[email protected]
118+
with:
119+
scan-type: fs
120+
scan-ref: "./${{ steps.manifest.outputs.image-name }}"
121+
scanners: "vuln"
122+
format: table
123+
exit-code: '1'
124+
severity: 'CRITICAL'
125+
ignore-unfixed: true

‎environments/.stackhpc/hooks/post.yml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
- hosts: openondemand
2+
become: yes
3+
gather_facts: false
4+
tasks:
5+
- name: Delete ondemand files causing Trivy scan false-positives
6+
# Raised at https://github.com/OSC/ondemand/security/advisories/GHSA-f7j8-ppqm-m5vw
7+
# All declared not to be an issue by Open Ondemand as relevant packages not installed
8+
ansible.builtin.file:
9+
path: "{{ item }}"
10+
state: absent
11+
with_items:
12+
- /opt/ood/ondemand/root/usr/share/gems/3.1/ondemand/3.1.7-1/gems/bootstrap_form-2.7.0/test/dummy/Gemfile.lock
13+
- /opt/ood/ondemand/root/usr/share/gems/3.1/ondemand/3.1.7-1/gems/bootstrap_form-4.5.0/demo/yarn.lock
14+
- /var/www/ood/apps/sys/dashboard/node_modules/data-confirm-modal/Gemfile.lock

‎environments/.stackhpc/terraform/main.tf

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,9 +29,9 @@ variable "cluster_image" {
2929
description = "single image for all cluster nodes, keyed by os_version - a convenience for CI"
3030
type = map(string)
3131
default = {
32-
# https://github.com/stackhpc/ansible-slurm-appliance/pull/411
33-
RL8: "openhpc-RL8-240725-1710-325c7b47"
34-
RL9: "openhpc-ofed-RL9-240725-1710-325c7b47"
32+
# https://github.com/stackhpc/ansible-slurm-appliance/pull/413
33+
RL8: "openhpc-RL8-240813-1317-1b370a36"
34+
RL9: "openhpc-ofed-RL9-240813-1317-1b370a36"
3535
}
3636
}
3737

‎environments/common/inventory/group_vars/all/grafana.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
# See: https://github.com/cloudalchemy/ansible-grafana
44
# for variable definitions.
5-
grafana_version: '9.0.3'
5+
grafana_version: '9.5.21'
66

77
# need to copy some role defaults here so we can use in inventory:
88
grafana_port: 3000

0 commit comments

Comments
 (0)