Security Dashboard is not registering trivy artifacts
Hi folks!
I have an ultimate plan with you and I deployed both container security scanners: Klar and Trivy. Since the beginning of the implementation I was receiving vulnerabilities from both sensors on the security dashboard but sunddely the gitlab stopped to registry the Trivy artifacts.
Some facts:
- I'm using the Gitlab version 13.4.4-ee
- I'm able to download both artifacts form CI
Here is my trivy step configuration:
trivy:
stage: security
image: docker:stable
services:
- name: docker:dind
entrypoint: ["env", "-u", "DOCKER_HOST"]
command: ["dockerd-entrypoint.sh"]
variables:
DOCKER_HOST: tcp://docker:2375/
DOCKER_DRIVER: overlay2
# See https://github.com/docker-library/docker/pull/166
DOCKER_TLS_CERTDIR: ""
before_script:
- apk add --no-cache curl
- export VERSION=$(curl --silent "https://api.github.com/repos/aquasecurity/trivy/releases/latest" | grep '"tag_name":' | sed -E 's/.*"v([^"]+)".*/\1/')
- echo $VERSION
- wget https://github.com/aquasecurity/trivy/releases/download/v${VERSION}/trivy_${VERSION}_Linux-64bit.tar.gz
- tar zxvf trivy_${VERSION}_Linux-64bit.tar.gz
- docker login -u $CI_REGISTRY_USER -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
allow_failure: true
script:
# Build report
- ./trivy --exit-code 0 --cache-dir .trivycache/ --skip-dirs "/usr/lib/ruby/gems,/usr/local/bundle/gems" --no-progress --format template --template "@contrib/gitlab.tpl" -o gl-container-scanning-report.json $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:$CI_COMMIT_SHA
# Print report for high and critical vulnerabilities
- ./trivy --exit-code 0 --cache-dir .trivycache/ --skip-dirs "/usr/lib/ruby/gems,/usr/local/bundle/gems" --no-progress --severity HIGH,CRITICAL $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:$CI_COMMIT_SHA
cache:
paths:
- .trivycache/
# Enables https://docs.gitlab.com/ee/user/application_security/container_scanning/ (Container Scanning report is available on GitLab EE Ultimate or GitLab.com Gold)
artifacts:
reports:
container_scanning: gl-container-scanning-report.json
paths: [gl-container-scanning-report.json]
tags: [k8s]
rules:
- if: $CS_ENABLE == "true" && $CI_COMMIT_BRANCH == "master"
- if: $CS_ENABLE == "true" && $CI_COMMIT_BRANCH
- if: $CS_ENABLE == "true" && $CI_MERGE_REQUEST_ID
- if: $CI_COMMIT_MESSAGE =~ /k8s_sync_specs/i
when: never
Here is my Klar configuration:
container_scanning:
allow_failure: true
stage: security
artifacts:
reports:
container_scanning: gl-container-scanning-report.json
paths: [gl-container-scanning-report.json]
tags: [k8s]
rules:
- if: $CS_ENABLE == "true" && $CI_COMMIT_BRANCH == "master"
- if: $CS_ENABLE == "true" && $CI_COMMIT_BRANCH
- if: $CS_ENABLE == "true" && $CI_MERGE_REQUEST_ID
- if: $CI_COMMIT_MESSAGE =~ /k8s_sync_specs/i
when: never
I didn't found anything related to some possible change in how gitlab registry the vulnerabilities on the security dashboard. Could you please help me?