Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

warn about costly scan scheduling in Helm output #256

Merged
merged 6 commits into from
Mar 26, 2024
Merged

warn about costly scan scheduling in Helm output #256

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
1badfa4
helm-chart: warn about costly scan scheduling in Helm output
matheusfm Mar 22, 2024
b689068
fix typo
matheusfm Mar 22, 2024
ae845b6
fix: check API version before calling lookup function
matheusfm Mar 22, 2024
ec81577
fix costly schedules check
matheusfm Mar 25, 2024
04d1c5a
Merge branch 'main' into UD-1299
matheusfm Mar 25, 2024
256cf99
Merge branch 'main' into UD-1299
matheusfm Mar 26, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
13 changes: 13 additions & 0 deletions charts/zora/templates/NOTES.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,3 +15,16 @@ Visit our documentation for in-depth information: https://zora-docs.undistro.io
{{ if .Values.saas.workspaceID -}}
Visit Zora Dashboard to explore your clusters and issues: {{ .Values.saas.server }}
{{- end }}

{{- $warnMisconfig := and .Values.scan.misconfiguration.schedule (include "zora.IsMisconfigScheduleMoreOftenThanHourly" .) }}
{{- if eq $warnMisconfig "true" }}
WARNING: The misconfiguration scan appears to be scheduled to run more frequently than hourly, you should be aware this
may lead to higher resource utilization and network traffic.
{{- end }}

{{- $warVuln := and .Values.scan.vulnerability.schedule (include "zora.IsVulnScheduleMoreOftenThanDaily" .) }}
{{- if eq $warVuln "true" }}
WARNING: The vulnerability scan appears to be scheduled to run more frequently than daily, potentially leading to
significant increases in networking costs and resource utilization. This is particularly relevant for
vulnerability scans, which involve downloading a vulnerability database and pulling images.
{{ end }}
19 changes: 19 additions & 0 deletions charts/zora/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,3 +130,22 @@ Truncate a name to a specific length
{{- .name }}
{{- end }}
{{- end }}

{{/* Returns true if the explicitly set misconfiguration schedule is more frequently than hourly */}}
{{- define "zora.IsMisconfigScheduleMoreOftenThanHourly" -}}
{{- $cron_fields := split " " .Values.scan.misconfiguration.schedule -}}
{{- $minute := $cron_fields._0 -}}
{{/* minute must be in range [0-59] */}}
{{- not (mustRegexMatch "^(?:\\d|[0-5]\\d)$" $minute) -}}
{{- end -}}

{{/* Returns true if the explicitly set vulnerability schedule is more frequently than daily */}}
{{- define "zora.IsVulnScheduleMoreOftenThanDaily" -}}
{{- $cron_fields := split " " .Values.scan.vulnerability.schedule -}}
{{- $minute := $cron_fields._0 -}}
{{- $hour := $cron_fields._1 -}}
{{/* minute and hour must be in range [0-59] */}}
{{- $isMinuteBad := not (mustRegexMatch "^(?:\\d|[0-5]\\d)$" $minute) -}}
{{- $isHourBad := not (mustRegexMatch "^(?:\\d|[0-5]\\d)$" $hour) -}}
{{- or $isMinuteBad $isHourBad -}}
{{- end -}}
4 changes: 2 additions & 2 deletions charts/zora/templates/clusterscan/clusterscan.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ metadata:
spec:
clusterRef:
name: {{ include "zora.clusterName" . }}
{{- $currentMisconfigScan := (lookup "zora.undistro.io/v1alpha1" "ClusterScan" .Release.Namespace $misconfigScanName) }}
{{- $currentMisconfigScan := and (.Capabilities.APIVersions.Has "zora.undistro.io/v1alpha1") (lookup "zora.undistro.io/v1alpha1" "ClusterScan" .Release.Namespace $misconfigScanName) }}
{{- if and $currentMisconfigScan (not .Values.scan.misconfiguration.schedule) }}
schedule: {{ $currentMisconfigScan.spec.schedule | quote }}
{{- else }}
Expand All @@ -62,7 +62,7 @@ metadata:
spec:
clusterRef:
name: {{ include "zora.clusterName" . }}
{{- $currentVulnScan := (lookup "zora.undistro.io/v1alpha1" "ClusterScan" .Release.Namespace $vulnScanName) }}
{{- $currentVulnScan := and (.Capabilities.APIVersions.Has "zora.undistro.io/v1alpha1") (lookup "zora.undistro.io/v1alpha1" "ClusterScan" .Release.Namespace $vulnScanName) }}
{{- if and $currentVulnScan (not .Values.scan.vulnerability.schedule) }}
schedule: {{ $currentVulnScan.spec.schedule | quote }}
{{- else }}
Expand Down