Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: update client/server docs for misconf and license scanning #7277

Merged
merged 2 commits into from
Aug 7, 2024
Merged

docs: update client/server docs for misconf and license scanning #7277

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a80135f
docs: update client/server docs for misconf and license scanning
nikpivkin Jul 31, 2024
31bbb06
docs: add a scanner table
knqyf263 Aug 7, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions docs/docs/references/modes/client-server.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,12 @@

Trivy has client/server mode. Trivy server has vulnerability database and Trivy client doesn't have to download vulnerability database. It is useful if you want to scan images or files at multiple locations and do not want to download the database at every location.

| Client/Server Mode | Image | Rootfs | Filesystem | Repository | Config | AWS | K8s |
|:---------------------:|:-----:|:------:|:----------:|:----------:|:------:|:---:|:---:|
| Supported | ✅ | ✅ | ✅ | ✅ | ✅ | X | X |
| Client/Server Mode | Image | Rootfs | Filesystem | Repository | Config | K8s |
|:---------------------:|:-----:|:------:|:----------:|:----------:|:------:|:---:|
| Supported | ✅ | ✅ | ✅ | ✅ | X | X |

!!! note
Scanning of misconfigurations and licenses is performed on the client side (as in standalone mode). Otherwise, the client would need to send files to the server that may contain sensitive information. The checks bundle is also downloaded on the client side.

## Server
At first, you need to launch Trivy server. It downloads vulnerability database automatically and continue to fetch the latest DB in the background.
Expand Down
53 changes: 26 additions & 27 deletions pkg/commands/artifact/run.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,6 @@ const (
TargetFilesystem TargetKind = "fs"
TargetRootfs TargetKind = "rootfs"
TargetRepository TargetKind = "repo"
TargetImageArchive TargetKind = "archive"
TargetSBOM TargetKind = "sbom"
TargetVM TargetKind = "vm"
)
Expand Down Expand Up @@ -345,6 +344,15 @@ func Run(ctx context.Context, opts flag.Options, targetKind TargetKind) (err err
}
}()

if opts.ServerAddr != "" && opts.Scanners.AnyEnabled(types.MisconfigScanner, types.SecretScanner) {
log.WarnContext(ctx,
fmt.Sprintf(
"Trivy runs in client/server mode, but misconfiguration and license scanning will be done on the client side, see %s",
doc.URL("/docs/references/modes/client-server", ""),
),
)
}

if opts.GenerateDefaultConfig {
log.Info("Writing the default config to trivy-default.yaml...")
return viper.SafeWriteConfigAs("trivy-default.yaml")
Expand All @@ -359,32 +367,23 @@ func Run(ctx context.Context, opts flag.Options, targetKind TargetKind) (err err
}
defer r.Close(ctx)

var report types.Report
Copy link
Contributor Author

@nikpivkin nikpivkin Jul 31, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Linter complained about the complexity of the Run method

switch targetKind {
case TargetContainerImage, TargetImageArchive:
if report, err = r.ScanImage(ctx, opts); err != nil {
return xerrors.Errorf("image scan error: %w", err)
}
case TargetFilesystem:
if report, err = r.ScanFilesystem(ctx, opts); err != nil {
return xerrors.Errorf("filesystem scan error: %w", err)
}
case TargetRootfs:
if report, err = r.ScanRootfs(ctx, opts); err != nil {
return xerrors.Errorf("rootfs scan error: %w", err)
}
case TargetRepository:
if report, err = r.ScanRepository(ctx, opts); err != nil {
return xerrors.Errorf("repository scan error: %w", err)
}
case TargetSBOM:
if report, err = r.ScanSBOM(ctx, opts); err != nil {
return xerrors.Errorf("sbom scan error: %w", err)
}
case TargetVM:
if report, err = r.ScanVM(ctx, opts); err != nil {
return xerrors.Errorf("vm scan error: %w", err)
}
scans := map[TargetKind]func(context.Context, flag.Options) (types.Report, error){
TargetContainerImage: r.ScanImage,
TargetFilesystem: r.ScanFilesystem,
TargetRootfs: r.ScanRootfs,
TargetRepository: r.ScanRepository,
TargetSBOM: r.ScanSBOM,
TargetVM: r.ScanVM,
}

scanFunction, exists := scans[targetKind]
if !exists {
return xerrors.Errorf("unknown target kind: %s", targetKind)
}

report, err := scanFunction(ctx, opts)
if err != nil {
return xerrors.Errorf("%s scan error: %w", targetKind, err)
}

report, err = r.Filter(ctx, opts, report)
Expand Down