Repository navigation
Passing parameters to ScheduledScan #2315
Description
➹ New Feature implementation request
Is your feature request related to a problem?
When we invoke a scan, e.g. Trivy image scan, we pass an image:tag to the scanner as a parameter:
https://www.securecodebox.io/docs/scanners/trivy/#image-juice-shop
We can define an image and a tag when we create a Scan CRD.
However, if we want to scan periodically using the ScheduledScan, we have to hardcode an image:tag in the ScanSpec field, which forces the scan to run against the same image all the time.
Describe the solution you'd like
It would be great if we could set a custom logic, that calculates an image:tag at the time of scanning and passes the result to the scanner via a parameter.
We can define such logic via the InitContainers parameter, but the only way to pass the result to the scunner is via a mounted volume, which doesn't help e.g. in the case of the Trivy image scan.
It would be great if we could consume InitContainers run results as part of the parameters passed to the scanner.
Activity
J12934 commentedon Feb 26, 2024
Cool idea but not sure if we can or if we should support it.
couples of thoughts:
I think what is possible is to change the value in a configmap / secret the pod is mounting e.g. to inject a environments variable. The scan container could then use the value in the environment variable to generate the parameters but this wouldn't work when the scan container doesn't have a shell init. e.g. because it's build using a distroless image
for now if you need to change the parameters of a scheduledScan I'd suggest to do it simmilarly to the auto-discovery which changes the parameters of the scheduledscan and then triggers a premature execution of it by resetting the last executed at timestamp of the scheduledScan, which triggers a new execution right away. https://github.com/secureCodeBox/secureCodeBox/blob/main/operator/utils/retrigger_scheduled_scan.go#L17
It's not the nicest thing but works really well.
if somebody is willing to sketch out a design of a "dynamic parameter generator" for schedueld scans I'd be very interessted in looking at this :D (espeically if the the people would also be willing to implement and maintain it :) )