@@ -4,6 +4,10 @@ import (
44 "context"
55 "fmt"
66
7+ "golang.org/x/xerrors"
8+
9+ "github.com/google/uuid"
10+
711 "github.com/coder/coder/v2/codersdk"
812 "github.com/coder/xray/jfrog"
913
@@ -23,10 +27,11 @@ type K8sReporter struct {
2327 Namespace string
2428 CoderClient CoderClient
2529 Logger slog.Logger
26- JFrogClient * jfrog.Client
30+ JFrogClient jfrog.Client
31+ ResultsChan chan codersdk.JFrogXrayScan
2732
2833 // Unexported fields are initialized on calls to Init.
29- podInformer cache. SharedIndexInformer
34+ factory informers. SharedInformerFactory
3035}
3136
3237type WorkspaceAgent struct {
@@ -35,14 +40,14 @@ type WorkspaceAgent struct {
3540}
3641
3742func (k * K8sReporter ) Init (ctx context.Context ) error {
38- podFactory : =informers .NewSharedInformerFactoryWithOptions (k .Client , 0 , informers .WithNamespace (k .Namespace ), informers .WithTweakListOptions (func (lo * v1.ListOptions ) {
43+ k . factory = informers .NewSharedInformerFactoryWithOptions (k .Client , 0 , informers .WithNamespace (k .Namespace ), informers .WithTweakListOptions (func (lo * v1.ListOptions ) {
3944 lo .FieldSelector = k .FieldSelector
4045 lo .LabelSelector = k .LabelSelector
4146 }))
4247
43- k . podInformer = podFactory .Core ().V1 ().Pods ().Informer ()
48+ podInformer := k . factory .Core ().V1 ().Pods ().Informer ()
4449
45- _ , err := k . podInformer .AddEventHandler (cache.ResourceEventHandlerFuncs {
50+ _ , err := podInformer .AddEventHandler (cache.ResourceEventHandlerFuncs {
4651 AddFunc : func (obj interface {}) {
4752 pod , ok := obj .(* corev1.Pod )
4853 if ! ok {
@@ -53,63 +58,72 @@ func (k *K8sReporter) Init(ctx context.Context) error {
5358 log := k .Logger .With (
5459 slog .F ("pod_name" , pod .Name ),
5560 )
56- var isWorkspace bool
5761 for _ , container := range pod .Spec .Containers {
58- var agentToken string
59- for _ , env := range container .Env {
60- if env .Name != "CODER_AGENT_TOKEN" {
61- continue
62- }
63- isWorkspace = true
64- agentToken = env .Value
65- break
66- }
67- if agentToken == "" {
68- continue
69- }
70-
7162 log = log .With (
7263 slog .F ("container_name" , container .Name ),
7364 slog .F ("container_image" , container .Image ),
7465 )
7566
76- image , err := jfrog .ParseImage (container .Image )
77- if err != nil {
78- log .Error (ctx , "parse image" , slog .Error (err ))
79- return
80- }
67+ scan , err := func () (codersdk.JFrogXrayScan , error ) {
68+ var agentToken string
69+ for _ , env := range container .Env {
70+ if env .Name != "CODER_AGENT_TOKEN" {
71+ continue
72+ }
73+ agentToken = env .Value
74+ break
75+ }
76+ if agentToken == "" {
77+ return codersdk.JFrogXrayScan {}, nil
78+ }
8179
82- scan , err := k .JFrogClient .ScanResults (image )
83- if err != nil {
84- log .Error (ctx , "fetch scan results" , slog .Error (err ))
85- return
86- }
80+ image , err := jfrog .ParseImage (container .Image )
81+ if err != nil {
82+ return codersdk.JFrogXrayScan {}, xerrors .Errorf ("parse image: %w" , err )
83+ }
8784
88- manifest , err := k .CoderClient .AgentManifest (ctx , agentToken )
89- if err != nil {
90- log .Error (ctx , "Get agent manifest" , slog .Error (err ))
91- return
92- }
85+ scan , err := k .JFrogClient .ScanResults (image )
86+ if err != nil {
87+ return codersdk.JFrogXrayScan {}, xerrors .Errorf ("fetch scan results: %w" , err )
88+ }
9389
94- log = log .With (
95- slog .F ("workspace_id" , manifest .WorkspaceID ),
96- slog .F ("agent_id" , manifest .AgentID ),
97- slog .F ("workspace_name" , manifest .WorkspaceName ),
98- )
90+ manifest , err := k .CoderClient .AgentManifest (ctx , agentToken )
91+ if err != nil {
92+ return codersdk.JFrogXrayScan {}, xerrors .Errorf ("agent manifest: %w" , err )
93+ }
9994
100- err = k .CoderClient .PostJFrogXrayScan (ctx , codersdk.JFrogXrayScan {
101- WorkspaceID : manifest .WorkspaceID ,
102- AgentID : manifest .AgentID ,
103- Critical : scan .SecurityIssues .Critical ,
104- High : scan .SecurityIssues .High ,
105- })
95+ log = log .With (
96+ slog .F ("workspace_id" , manifest .WorkspaceID ),
97+ slog .F ("agent_id" , manifest .AgentID ),
98+ slog .F ("workspace_name" , manifest .WorkspaceName ),
99+ )
100+
101+ req := codersdk.JFrogXrayScan {
102+ WorkspaceID : manifest .WorkspaceID ,
103+ AgentID : manifest .AgentID ,
104+ Critical : scan .SecurityIssues .Critical ,
105+ High : scan .SecurityIssues .High ,
106+ }
107+ err = k .CoderClient .PostJFrogXrayScan (ctx , req )
108+ if err != nil {
109+ return codersdk.JFrogXrayScan {}, xerrors .Errorf ("post xray scan: %w" , err )
110+ }
111+
112+ return req , nil
113+ }()
106114 if err != nil {
107- log .Error (ctx , "post xray results" , slog .Error (err ))
108- return
115+ log .Error (ctx , "scan agent" , slog .Error (err ))
116+ break
117+ }
118+ if scan .AgentID != uuid .Nil {
119+ log .Info (ctx , "uploaded agent results!" , slog .F ("pod_name" , pod .Name ), slog .F ("namespace" , pod .Namespace ))
120+ if k .ResultsChan != nil {
121+ // This should only be populated during tests
122+ // so it's ok to assume an unbuffered channel is
123+ // going to block until read.
124+ k .ResultsChan <- scan
125+ }
109126 }
110- }
111- if isWorkspace {
112- log .Info (ctx , "uploaded workspace results!" , slog .F ("pod_name" , pod .Name ), slog .F ("namespace" , pod .Namespace ))
113127 }
114128 },
115129 })
@@ -120,5 +134,5 @@ func (k *K8sReporter) Init(ctx context.Context) error {
120134}
121135
122136func (k * K8sReporter ) Start (stop chan struct {}) {
123- k .podInformer . Run (stop )
137+ k .factory . Start (stop )
124138}
0 commit comments