alexpires.me/a13labs.infra
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Refactor Trivy integration: update report generation scripts, enhance email dispatch logic, and remove obsolete test file

Browse Source
This commit is contained in:
Alexandre Pires
2025-09-22 19:23:45 +02:00
parent 1e8526f442
commit 4d00986273
5 changed files with 53 additions and 394 deletions
Download Patch File Download Diff File Expand all files Collapse all files
terraform/modules/utils/trivy/main.tf
+17 -38
View File
@@ -56,13 +56,14 @@ resource "kubernetes_secret" "email_credentials" {
}
}
resource "kubernetes_config_map" "send_report" {
resource "kubernetes_config_map" "scripts" {
metadata {
name = "trivy-send-report"
name = "trivy-scripts"
namespace = kubernetes_namespace.trivy.metadata[0].name
}
data = {
"send_report.py" = local.send_report_script
"send_report.py" = local.send_report_script
"generate_report.sh" = local.generate_report_script
}
}
@@ -97,19 +98,9 @@ resource "kubernetes_cron_job_v1" "trivy" {
service_account_name = kubernetes_service_account.trivy.metadata[0].name
automount_service_account_token = true
container {
image = "aquasec/trivy:${var.tag}"
name = "trivy"
args = [
"k8s",
"--report=${var.report_type}",
"--exit-code=0",
"--severity=${var.levels}",
"--cache-dir=/cache",
"-o", "/reports/trivy.json",
"--format", "json",
"--disable-node-collector",
"--parallel", "1"
]
image = "aquasec/trivy:${var.tag}"
name = "trivy"
command = ["/bin/sh", "-c", "/scripts/generate_report.sh"]
security_context {
run_as_non_root = true
run_as_user = 1000
@@ -117,13 +108,17 @@ resource "kubernetes_cron_job_v1" "trivy" {
allow_privilege_escalation = false
read_only_root_filesystem = true
}
volume_mount {
name = "trivy-reports"
mount_path = "/reports"
env {
name = "REPORT_TYPE"
value = var.report_type
}
env {
name = "LEVELS"
value = var.levels
}
volume_mount {
name = "trivy-cache"
mount_path = "/cache"
name = "trivy-scripts"
mount_path = "/scripts"
}
volume_mount {
name = "tmp"
@@ -134,10 +129,6 @@ resource "kubernetes_cron_job_v1" "trivy" {
name = "send-report"
image = "python:${local.python_version}"
args = ["/scripts/send_report.py"]
env {
name = "REPORT_PATH"
value = "/reports/trivy.json"
}
env {
name = "SMTP_HOST"
value = var.smtp_host
@@ -179,10 +170,6 @@ resource "kubernetes_cron_job_v1" "trivy" {
allow_privilege_escalation = false
read_only_root_filesystem = true
}
volume_mount {
name = "trivy-reports"
mount_path = "/reports"
}
volume_mount {
name = "trivy-scripts"
mount_path = "/scripts"
@@ -192,18 +179,10 @@ resource "kubernetes_cron_job_v1" "trivy" {
mount_path = "/tmp"
}
}
volume {
name = "trivy-reports"
empty_dir {}
}
volume {
name = "trivy-cache"
empty_dir {}
}
volume {
name = "trivy-scripts"
config_map {
name = kubernetes_config_map.send_report.metadata[0].name
name = kubernetes_config_map.scripts.metadata[0].name
default_mode = "0755"
}