Use ES to fetch vulnerability severity counts
What does this MR do and why?
Use elastic search to fetch vulnerability severity counts. The graphQL endpoint remains the same i.e, vulnerabilitySeverityCounts.
- Added
owasp_top_10_2021as a new argument to filter by owasp 2021 values. Works only with ES configured. - If identifier_name param is passed we always use ES now if its configured. Which means no 20k vulnerability count limit!
- All the existing filters should work as expected on the endpoint.
References
Screenshots or screen recordings
| Before | After |
|---|---|
How to set up and validate locally
-
Ensure that ES is setup in local and the vulnerabilities Index is created.
-
Ensure that local setup is running SASS mode steps here
-
Enable the FF globally in rails console
Feature.enable(:advanced_vulnerability_management) -
Go to Security > Vulnerability report and filter by
Identifier. The vulnerability counts should be fetched from ES and it should match the count vulnerabilities returned. -
Go to GraphQL explorer
http://gdk.test:3000/-/graphql-explorerand query forvulnerabilitySeveritiesCountwithowaspTopTen2021filter applied. It should also fetch counts from ES now.Example query
{ project(fullPath: "gitlab-org/yarn-remediation") { id vulnerabilitySeveritiesCount(owaspTopTen2021: A1_2021) { critical high medium low info unknown } } }
MR acceptance checklist
Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Relates to - #534629 (closed) Relates to - #534633 (closed)