Introduce configurable timeout & trivy report size for OCS scanning pod
Problem to solve
The timeout for a scanning pod of a namespace is hardcoded to 5 minutes right now. For OCS scans of a large namespace which might require a longer time, the scan fails due to the timeout. We should enable users to configure the timeout of the OCS scan.
Implementation Plan
-
1. Introduce a scanner_timeout
field in the OCS agent configuration.- Consider using the google.protobuf.Duration type
- Define a default timeout if this field is not set
-
2. Configure the scanning pod timeout with this value with an additional 5 minutes for reading the chained config map and transmitting the vuln report. -
3. Configure this timeout as an env var for the scanning pod -
4. Configure this timeout for the trivy scan in the trivy-k8s-wrapper repo based on the trivy timeout config -
5. Create a new release of trivy-k8s-wrapper -
6. Bump the version of trivy-k8s-wrapper used by gitlab agent -
6.5: Make the Trivy report size configurable -
7. Update OCS documentation with steps to configure timeout
andreport file size
. Note that fortimeout
we would only be able to support configuration in seconds.
Edited by Nick Ilieskou