Introduce configurable timeout & trivy report size for OCS scanning pod
Problem to solve
The timeout for a scanning pod of a namespace is hardcoded to 5 minutes right now. For OCS scans of a large namespace which might require a longer time, the scan fails due to the timeout. We should enable users to configure the timeout of the OCS scan.
Implementation Plan
- 1. Introduce a
scanner_timeoutfield in the OCS agent configuration.- Consider using the google.protobuf.Duration type
- Define a default timeout if this field is not set
- 2. Configure the scanning pod timeout with this value with an additional 5 minutes for reading the chained config map and transmitting the vuln report.
- 3. Configure this timeout as an env var for the scanning pod
- 4. Configure this timeout for the trivy scan in the trivy-k8s-wrapper repo based on the trivy timeout config
- 5. Create a new release of trivy-k8s-wrapper
- 6. Bump the version of trivy-k8s-wrapper used by gitlab agent
- 6.5: Make the Trivy report size configurable
- 7. Update OCS documentation with steps to configure
timeoutandreport file size. Note that fortimeoutwe would only be able to support configuration in seconds.
Edited by Nick Ilieskou