From 05ce37cf9536685a846c0f3e43a2ce78838cf2c3 Mon Sep 17 00:00:00 2001 From: Michele Mangili Date: Fri, 19 Sep 2025 17:16:57 +0200 Subject: [PATCH] feat(registry-scanner): added imageAnalyzer configuration options --- charts/registry-scanner/Chart.yaml | 4 +- charts/registry-scanner/README.md | 155 +++++++++--------- .../registry-scanner/templates/configmap.yaml | 5 + .../tests/configmap_test.yaml | 63 +++++++ charts/registry-scanner/values.yaml | 7 + 5 files changed, 156 insertions(+), 78 deletions(-) diff --git a/charts/registry-scanner/Chart.yaml b/charts/registry-scanner/Chart.yaml index 99b5f6f72..49f553f73 100644 --- a/charts/registry-scanner/Chart.yaml +++ b/charts/registry-scanner/Chart.yaml @@ -4,7 +4,7 @@ description: Sysdig Registry Scanner type: application home: https://www.sysdig.com/ icon: https://avatars.githubusercontent.com/u/5068817?s=200&v=4 -version: 1.7.5 -appVersion: 0.8.3 +version: 1.8.0 +appVersion: 0.9.0 maintainers: - name: sysdiglabs diff --git a/charts/registry-scanner/README.md b/charts/registry-scanner/README.md index 9d1f990dc..1e79dca11 100644 --- a/charts/registry-scanner/README.md +++ b/charts/registry-scanner/README.md @@ -51,81 +51,84 @@ Once installed, you can view the scan results in the [Vulnerabilities UI](https: The following table lists the configurable parameters of the Sysdig Registry Scanner chart and their default values: -| Parameter | Description | Default | -|--------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------| -| cronjob.schedule | The cronjob expression for registry scan scheduling. See https://crontab.guru/ for help. | "0 6 * * 6" | -| cronjob.failedJobsHistoryLimit | The number of failed job history to keep on the cluster. | 5 | -| cronjob.successfulJobsHistoryLimit | The number of successful job history to keep on the cluster. | 2 | -| cronjob.restartPolicy | The restart policy for a failed registry scan execution. | Never | -| cronjob.timeZone | Timezone settings for the cronjob. Value default will be null to guarantee we only set the timezone if the user provides it. | "" | -| reportToPersistentVolumeClaim | Specify a volume claim to write the final JSON report there instead of standard output. | "" | -| config.logging | The log level. Use one of the following: trace, debug, info, error. | "info" | -| config.registryURL | The URL of the registry to scan. | "" | -| config.registryApiUrl | The API URL of the registry to scan. This is required if your registry type is Artifactory. | "" | -| config.registryUser | The username for registry authentication. | "" | -| config.registryPassword | The password for registry authentication. | "" | -| config.registryType | **required**
The registry Type. Supported types: artifactory, ecr, icr, acr, quay, harbor, gar, gcr, nexus, ocp and dockerv2. | "" | -| config.registryAccountId | The account ID. Applicable only for ICR registry type. | "" | -| config.icrIamApi | The ICR IAM API. Applicable only for ICR registry type. | "" | -| config.icrIamApiSkipTLS | Ignore TLS certificate for IAM API. Applicable only for ICR registry type. | false | -| config.aws.accessKeyId | The AWS credentials: `AccessKeyId`. | "" | -| config.aws.secretAccessKey | The AWS credentials: `SecretAccessKey`. | "" | -| config.aws.region | For single account. It is the region where the registry is located. | "us-east-1" | -| config.aws.managementAccountRoleARN | The management role ARN to be used to impersonate the member accounts. | | -| config.aws.memberAccountsRoleName | The member account role name (available in all member accounts) to dig into their registries. | "OrganizationAccountAccessRole" | -| config.aws.allowListMemberAccountIDs | The organization account IDs in which the registry scan is performed. If not configured, the scan will be performed in all the member accounts of the organization. | [] | -| config.aws.allowListRegions | For organizational accounts. It is the AWS regions where the registries are located. If not configured, the scan will be performed in all available regions. | [] | -| config.registrySkipTLS | Ignore registry TLS certificate errors (self-signed, etc.). | false | -| config.registryMaxRetries | Max number of retries to call the registtry APIs in case of failure or 409. | 10 | -| config.registryMaxRetryWait | Max wait time between retries. | 10m | -| config.registryMinRetryWait | Min wait time between retries. | 5s | -| config.secureBaseURL | **required**
The Sysdig Secure Base URL. | https://secure.sysdig.com | -| config.secureAPIToken | **required**
The API Token to access Sysdig Secure. | "" | -| config.secureOnPrem | Specify that Sysdig Secure installation is on-prem. | false | -| config.secureSkipTLS | Ignore Sysdig Secure TLS certificate errors. | false | -| config.maxWorkers | The maximum number of parallel job scan workers to spawn. | 5 | -| config.filter.include | The list of regular expressions.
Images matching any of these expressions are *always* included when scanning. To ensure that only included images are scanned and all others are explicitly excluded, set `exclude` to [".*"]. | [] | -| config.filter.exclude | The list of regular expressions.
Images matching any of these expressions are excluded when scanning. | [] | -| config.filter.maxAgeDays | Based on its creation date, excludes images older than the specified number of days.
The maximum is 365 days. | 90 | -| config.filter.maxTagsPerRepository | Based on its creation date, newer ones take precedence, the maximum number of tags to scan per repository.
The maximum is 50. | 5 | -| config.filter.maxRepositoriesPerRegistry | The number of repositories to scan per registry.
The maximum is 10000. | 500 | -| config.scan.inlineScanImage | Override the default image for the inline scanner job. | "" | -| config.scan.securityContext | The security context for the Inline Scanner container. | {} | -| config.scan.orchestrator.ttlSecondsAfterFinished | The Time to Live (ttl) value for the orchestrator job. Provide an empty value to accept the default. | 3600 | -| config.scan.jobs.ttlSecondsAfterFinished | The ttl value for scanner worker jobs. | 600 | -| config.scan.jobs.resources.requests.memory | The memory request for the scanner job. | 500Mi | -| config.scan.jobs.resources.requests.cpu | The CPU request for the scanner job. | 500m | -| config.scan.jobs.resources.limits.memory | The memory limit for the scanner job. | 2Gi | -| config.scan.jobs.resources.limits.cpu | The CPU limit for the scanner job. | 1 | -| config.scan.jobs.temporaryVolumeSizeLimit | The size limit for the emptyDir volume used by the scanner job.
This volume is used to store both the vulnerability database and the image to scan. | 2Gi | -| config.scan.jobs.nodeSelector | NodeSelector for child jobs. If only .Values.nodeSelector is specified, child jobs will inherit the same nodeSelector as the main pod | {} | -| config.scan.disablePlatformScanning | Force the scan to happen on the client component rather than relying on backend scanning | false | -| config.parallelGoRoutines | Number of goroutines running in parallel in metadata phase for ECR Org setup. | 100 | -| ssl.ca.certs | For outbound connections.
List of PEM-encoded x509 certificate authority. | [] | -| customLabels | The additional labels to add to CronJob and Scanning Jobs. The custom labels to be added to kubernetes manifests of all the resources created. | {} | -| proxy.httpProxy | The URL of the proxy for HTTP connections. Leave it empty if not using proxy, which sets the `http_proxy` environment variable. | | -| proxy.httpsProxy | The URL of the proxy for HTTPS connections. Leave it empty if not using proxy, which sets the `https_proxy` environment variable. | | -| proxy.noProxy | The comma-separated list of domain extensions proxy should not be used for. Include the internal IP of the Kube API server in noProxy configuration. You probably need to add your registry if it is inside the cluster. | | -| image.registry | The Sysdig Registry Scanner image registry. | quay.io | -| image.repository | The Sysdig Registry Scanner image repository. | sysdig/registry-scanner | -| image.tag | The Registry Scanner image tag. If empty, default to appVersion in `Chart.yaml`. | | -| image.pullPolicy | The PullPolicy for Registry Scanner image. | Always | -| image.fips | Whether or not to use a Federal Information Processing Standard (FIPS) compliant image. | false | -| serviceAccount.create | Specifies whether a service account should be created. | true | -| serviceAccount.annotations | The additional annotations to add to the service account. | {} | -| serviceAccount.name | The name of the service account to use. If the value is not set and create is set to `true`, a name is generated using the fullname template. | "" | -| imagePullSecrets | The image pull secrets. | [] | -| nameOverride | The chart name override | "" | -| fullnameOverride | The chart fullname override | "" | -| existingSecretName | Specify the name of a Kubernetes secret containing 'secureAPIToken', 'registryUser', and 'registryPassword' entries. If you are using `ecr` as `registryType`, ensure that you add 'accessKeyId', 'secretAccessKey', and 'region' entries. | "" | -| podAnnotations | Pod annotations for the Registry scanner. | {} | -| securityContext | Security context for Registry Scanner container. | {} | -| resources | Resource limits for the main registry scanner orchestrator.
For scanner job resources, use `config.scan.jobs.resources`. | {} | -| scanOnStart.enabled | Specify whether to start the post-install scanner job, in addition to the cronjob.
Beware that `concurrencyPolicy` does not work on jobs (only cronjobs).
Always check for active scanning and if so, remove it. | false | -| scanOnStart.jobName | The name of the job created for the post-install scanner job | "registry-scanner-scan-on-start" | -| scanOnStart.asPostInstallHook | Specify whether to launch the job as a post-install helm hook.
Used for testing purpose. | false | -| extraEnvVars | The additional environment variables to be set. | [] | -| memProfileToPersistentVolumeClaim | Write memory profile dumps to Persistent Volume Claim (provide PVC name) | "" | +| Parameter | Description | Default | +|-----------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------| +| cronjob.schedule | The cronjob expression for registry scan scheduling. See https://crontab.guru/ for help. | "0 6 * * 6" | +| cronjob.failedJobsHistoryLimit | The number of failed job history to keep on the cluster. | 5 | +| cronjob.successfulJobsHistoryLimit | The number of successful job history to keep on the cluster. | 2 | +| cronjob.restartPolicy | The restart policy for a failed registry scan execution. | Never | +| cronjob.timeZone | Timezone settings for the cronjob. Value default will be null to guarantee we only set the timezone if the user provides it. | "" | +| reportToPersistentVolumeClaim | Specify a volume claim to write the final JSON report there instead of standard output. | "" | +| config.logging | The log level. Use one of the following: trace, debug, info, error. | "info" | +| config.registryURL | The URL of the registry to scan. | "" | +| config.registryApiUrl | The API URL of the registry to scan. This is required if your registry type is Artifactory. | "" | +| config.registryUser | The username for registry authentication. | "" | +| config.registryPassword | The password for registry authentication. | "" | +| config.registryType | **required**
The registry Type. Supported types: artifactory, ecr, icr, acr, quay, harbor, gar, gcr, nexus, ocp and dockerv2. | "" | +| config.registryAccountId | The account ID. Applicable only for ICR registry type. | "" | +| config.icrIamApi | The ICR IAM API. Applicable only for ICR registry type. | "" | +| config.icrIamApiSkipTLS | Ignore TLS certificate for IAM API. Applicable only for ICR registry type. | false | +| config.aws.accessKeyId | The AWS credentials: `AccessKeyId`. | "" | +| config.aws.secretAccessKey | The AWS credentials: `SecretAccessKey`. | "" | +| config.aws.region | For single account. It is the region where the registry is located. | "us-east-1" | +| config.aws.managementAccountRoleARN | The management role ARN to be used to impersonate the member accounts. | | +| config.aws.memberAccountsRoleName | The member account role name (available in all member accounts) to dig into their registries. | "OrganizationAccountAccessRole" | +| config.aws.allowListMemberAccountIDs | The organization account IDs in which the registry scan is performed. If not configured, the scan will be performed in all the member accounts of the organization. | [] | +| config.aws.allowListRegions | For organizational accounts. It is the AWS regions where the registries are located. If not configured, the scan will be performed in all available regions. | [] | +| config.registrySkipTLS | Ignore registry TLS certificate errors (self-signed, etc.). | false | +| config.registryMaxRetries | Max number of retries to call the registtry APIs in case of failure or 409. | 10 | +| config.registryMaxRetryWait | Max wait time between retries. | 10m | +| config.registryMinRetryWait | Min wait time between retries. | 5s | +| config.secureBaseURL | **required**
The Sysdig Secure Base URL. | https://secure.sysdig.com | +| config.secureAPIToken | **required**
The API Token to access Sysdig Secure. | "" | +| config.secureOnPrem | Specify that Sysdig Secure installation is on-prem. | false | +| config.secureSkipTLS | Ignore Sysdig Secure TLS certificate errors. | false | +| config.maxWorkers | The maximum number of parallel job scan workers to spawn. | 5 | +| config.filter.include | The list of regular expressions.
Images matching any of these expressions are *always* included when scanning. To ensure that only included images are scanned and all others are explicitly excluded, set `exclude` to [".*"]. | [] | +| config.filter.exclude | The list of regular expressions.
Images matching any of these expressions are excluded when scanning. | [] | +| config.filter.maxAgeDays | Based on its creation date, excludes images older than the specified number of days.
The maximum is 365 days. | 90 | +| config.filter.maxTagsPerRepository | Based on its creation date, newer ones take precedence, the maximum number of tags to scan per repository.
The maximum is 50. | 5 | +| config.filter.maxRepositoriesPerRegistry | The number of repositories to scan per registry.
The maximum is 10000. | 500 | +| config.scan.inlineScanImage | Override the default image for the inline scanner job. | "" | +| config.scan.securityContext | The security context for the Inline Scanner container. | {} | +| config.scan.orchestrator.ttlSecondsAfterFinished | The Time to Live (ttl) value for the orchestrator job. Provide an empty value to accept the default. | 3600 | +| config.scan.jobs.ttlSecondsAfterFinished | The ttl value for scanner worker jobs. | 600 | +| config.scan.jobs.resources.requests.memory | The memory request for the scanner job. | 500Mi | +| config.scan.jobs.resources.requests.cpu | The CPU request for the scanner job. | 500m | +| config.scan.jobs.resources.limits.memory | The memory limit for the scanner job. | 2Gi | +| config.scan.jobs.resources.limits.cpu | The CPU limit for the scanner job. | 1 | +| config.scan.jobs.temporaryVolumeSizeLimit | The size limit for the emptyDir volume used by the scanner job.
This volume is used to store both the vulnerability database and the image to scan. | 2Gi | +| config.scan.jobs.nodeSelector | NodeSelector for child jobs. If only .Values.nodeSelector is specified, child jobs will inherit the same nodeSelector as the main pod | {} | +| config.scan.disablePlatformScanning | Force the scan to happen on the client component rather than relying on backend scanning | false | +| config.scan.imageAnalyzer.maxFileSizeBytes | Maximum size (in bytes) of files that will be analyzed. Larger files, will be skipped during analysis. Default set to 100MB. | 104857600 | +| config.scan.imageAnalyzer.maxFileSizeBytesInMemory | Maximum size (in bytes) of files that will be analyzed in memory. Larger files will be first written to disk as temporary files. Default set to 5MB. | 5242880 | +| config.scan.imageAnalyzer.parallelFileAnalysisCount | Number of files that can be analyzed in parallel | 15 | +| config.parallelGoRoutines | Number of goroutines running in parallel in metadata phase for ECR Org setup. | 100 | +| ssl.ca.certs | For outbound connections.
List of PEM-encoded x509 certificate authority. | [] | +| customLabels | The additional labels to add to CronJob and Scanning Jobs. The custom labels to be added to kubernetes manifests of all the resources created. | {} | +| proxy.httpProxy | The URL of the proxy for HTTP connections. Leave it empty if not using proxy, which sets the `http_proxy` environment variable. | | +| proxy.httpsProxy | The URL of the proxy for HTTPS connections. Leave it empty if not using proxy, which sets the `https_proxy` environment variable. | | +| proxy.noProxy | The comma-separated list of domain extensions proxy should not be used for. Include the internal IP of the Kube API server in noProxy configuration. You probably need to add your registry if it is inside the cluster. | | +| image.registry | The Sysdig Registry Scanner image registry. | quay.io | +| image.repository | The Sysdig Registry Scanner image repository. | sysdig/registry-scanner | +| image.tag | The Registry Scanner image tag. If empty, default to appVersion in `Chart.yaml`. | | +| image.pullPolicy | The PullPolicy for Registry Scanner image. | Always | +| image.fips | Whether or not to use a Federal Information Processing Standard (FIPS) compliant image. | false | +| serviceAccount.create | Specifies whether a service account should be created. | true | +| serviceAccount.annotations | The additional annotations to add to the service account. | {} | +| serviceAccount.name | The name of the service account to use. If the value is not set and create is set to `true`, a name is generated using the fullname template. | "" | +| imagePullSecrets | The image pull secrets. | [] | +| nameOverride | The chart name override | "" | +| fullnameOverride | The chart fullname override | "" | +| existingSecretName | Specify the name of a Kubernetes secret containing 'secureAPIToken', 'registryUser', and 'registryPassword' entries. If you are using `ecr` as `registryType`, ensure that you add 'accessKeyId', 'secretAccessKey', and 'region' entries. | "" | +| podAnnotations | Pod annotations for the Registry scanner. | {} | +| securityContext | Security context for Registry Scanner container. | {} | +| resources | Resource limits for the main registry scanner orchestrator.
For scanner job resources, use `config.scan.jobs.resources`. | {} | +| scanOnStart.enabled | Specify whether to start the post-install scanner job, in addition to the cronjob.
Beware that `concurrencyPolicy` does not work on jobs (only cronjobs).
Always check for active scanning and if so, remove it. | false | +| scanOnStart.jobName | The name of the job created for the post-install scanner job | "registry-scanner-scan-on-start" | +| scanOnStart.asPostInstallHook | Specify whether to launch the job as a post-install helm hook.
Used for testing purpose. | false | +| extraEnvVars | The additional environment variables to be set. | [] | +| memProfileToPersistentVolumeClaim | Write memory profile dumps to Persistent Volume Claim (provide PVC name) | "" | ## On-Prem Deployment @@ -137,7 +140,7 @@ Use the following command to deploy: helm upgrade --install registry-scanner \ --namespace sysdig-agent \ --create-namespace \ - --version=1.7.5 \ + --version=1.8.0 \ --set config.secureBaseURL= \ --set config.secureAPIToken= \ --set config.secureSkipTLS=true \ diff --git a/charts/registry-scanner/templates/configmap.yaml b/charts/registry-scanner/templates/configmap.yaml index 3aedeeb25..58e12021b 100644 --- a/charts/registry-scanner/templates/configmap.yaml +++ b/charts/registry-scanner/templates/configmap.yaml @@ -72,6 +72,11 @@ data: namespace: {{ .Release.Namespace }} workers: {{ .Values.config.maxWorkers }} disablePlatformScanning: {{ default false .Values.config.scan.disablePlatformScanning }} + imageAnalyzer: + maxFileSizeBytes: {{ default 104857600 .Values.config.scan.imageAnalyzer.maxFileSizeBytes | int64 }} + maxFileSizeBytesInMemory: {{ default 5242880 .Values.config.scan.imageAnalyzer.maxFileSizeBytesInMemory | int64 }} + parallelFileAnalysisCount: {{ default 15 .Values.config.scan.imageAnalyzer.parallelFileAnalysisCount }} + jobs: ttlSecondsAfterFinished: {{ .Values.config.scan.jobs.ttlSecondsAfterFinished }} serviceAccountName: {{ include "registry-scanner.serviceAccountName" . }} diff --git a/charts/registry-scanner/tests/configmap_test.yaml b/charts/registry-scanner/tests/configmap_test.yaml index 230c27235..16681bf82 100644 --- a/charts/registry-scanner/tests/configmap_test.yaml +++ b/charts/registry-scanner/tests/configmap_test.yaml @@ -226,3 +226,66 @@ tests: - matchRegex: path: data['config.yaml'] pattern: "scan:((.|\n)*)inlineScanImage: foo:bar\n" + + - it: imageAnalyzer options default if no custom setup is given + asserts: + - matchRegex: + path: data['config.yaml'] + pattern: "maxFileSizeBytes: 104857600" + - matchRegex: + path: data['config.yaml'] + pattern: "maxFileSizeBytesInMemory: 5242880" + - matchRegex: + path: data['config.yaml'] + pattern: "parallelFileAnalysisCount: 15" + + - it: maxFileSizeBytes wires if custom setup is given + set: + config: + scan: + imageAnalyzer: + maxFileSizeBytes: 666 + asserts: + - matchRegex: + path: data['config.yaml'] + pattern: "maxFileSizeBytes: 666" + - matchRegex: + path: data['config.yaml'] + pattern: "maxFileSizeBytesInMemory: 5242880" + - matchRegex: + path: data['config.yaml'] + pattern: "parallelFileAnalysisCount: 15" + + - it: maxFileSizeBytesInMemory wires if custom setup is given + set: + config: + scan: + imageAnalyzer: + maxFileSizeBytesInMemory: 666 + asserts: + - matchRegex: + path: data['config.yaml'] + pattern: "maxFileSizeBytes: 104857600" + - matchRegex: + path: data['config.yaml'] + pattern: "maxFileSizeBytesInMemory: 666" + - matchRegex: + path: data['config.yaml'] + pattern: "parallelFileAnalysisCount: 15" + + - it: parallelFileAnalysisCount wires if custom setup is given + set: + config: + scan: + imageAnalyzer: + parallelFileAnalysisCount: 666 + asserts: + - matchRegex: + path: data['config.yaml'] + pattern: "maxFileSizeBytes: 104857600" + - matchRegex: + path: data['config.yaml'] + pattern: "maxFileSizeBytesInMemory: 5242880" + - matchRegex: + path: data['config.yaml'] + pattern: "parallelFileAnalysisCount: 666" diff --git a/charts/registry-scanner/values.yaml b/charts/registry-scanner/values.yaml index 90c215408..5c93ebd14 100644 --- a/charts/registry-scanner/values.yaml +++ b/charts/registry-scanner/values.yaml @@ -118,6 +118,13 @@ config: nodeSelector: {} # Force the scan to happen on the client component rather than relying on backend scanning disablePlatformScanning: false + imageAnalyzer: + # Maximum size (in bytes) of files that will be analyzed. Larger files, will be skipped during analysis. Default set to 100MB. + maxFileSizeBytes: 104857600 + # Maximum size (in bytes) of files that will be analyzed in memory. Larger files will be first written to disk as temporary files. Default set to 5MB. + maxFileSizeBytesInMemory: 5242880 + # Number of files that can be analyzed in parallel + parallelFileAnalysisCount: 15 # Number of goroutines running in parallel in metadata phase for ECR Org setup. parallelGoRoutines: 100 ssl: