Introduce configurable timeout & trivy report size for OCS scanning pod

Problem to solve

The timeout for a scanning pod of a namespace is hardcoded to 5 minutes right now. For OCS scans of a large namespace which might require a longer time, the scan fails due to the timeout. We should enable users to configure the timeout of the OCS scan.

Implementation Plan

  • 1. Introduce a scanner_timeout field in the OCS agent configuration.
    • Consider using the google.protobuf.Duration type
    • Define a default timeout if this field is not set
  • 2. Configure the scanning pod timeout with this value with an additional 5 minutes for reading the chained config map and transmitting the vuln report.
  • 3. Configure this timeout as an env var for the scanning pod
  • 4. Configure this timeout for the trivy scan in the trivy-k8s-wrapper repo based on the trivy timeout config
  • 5. Create a new release of trivy-k8s-wrapper
  • 6. Bump the version of trivy-k8s-wrapper used by gitlab agent
  • 6.5: Make the Trivy report size configurable
  • 7. Update OCS documentation with steps to configure timeout and report file size. Note that for timeout we would only be able to support configuration in seconds.
Edited Dec 04, 2024 by Nick Ilieskou
Assignee Loading
Time tracking Loading