Skip to content

Comments

[trivy] Include vizier and cloud dependency images in image scan#2231

Merged
ddelnano merged 19 commits intopixie-io:mainfrom
ddelnano:ddelnano/scan-pixie-deps-with-trivy
Jul 16, 2025
Merged

[trivy] Include vizier and cloud dependency images in image scan#2231
ddelnano merged 19 commits intopixie-io:mainfrom
ddelnano:ddelnano/scan-pixie-deps-with-trivy

Conversation

@ddelnano
Copy link
Member

@ddelnano ddelnano commented Jul 11, 2025

Summary: [trivy] Include vizier and cloud dependency images in image scan

While are aware of CVEs and vulnerabilities with Pixie's code, our dependency images are a blind spot in our security scanning. This change updates the trivy-image GitHub action to include the cloud and vizier dependency images so we can address those vulnerabilities in a timely manner.

This change makes it possible to add the operator dependency images in the future, but for now I've omitted them (dealing with helm is a bit challenging without some additional work).

Relevant Issues: N/A

Type of change: /kind dependencies

Test Plan: Verified the following

  • Simulated test works
$ bazel build k8s/cloud:cloud_image_list
$ cat bazel-bin/k8s/cloud/cloud_image_list.txt | grep -v '\/cloud'  | xargs -I{} sh -c 'trivy image {}'

$ bazel build k8s/vizier:vizier_image_list
$ cat bazel-bin/k8s/vizier/vizier_image_list.txt | grep -v '\/vizier'  | xargs -I{} sh -c 'trivy image {}'
  • GitHub action completed successfully (link)

@ddelnano ddelnano requested review from a team as code owners July 11, 2025 17:06
ddelnano added 2 commits July 11, 2025 19:34
Signed-off-by: Dom Del Nano <ddelnano@gmail.com>
Signed-off-by: Dom Del Nano <ddelnano@gmail.com>
@ddelnano ddelnano force-pushed the ddelnano/scan-pixie-deps-with-trivy branch from b01151d to 0698605 Compare July 11, 2025 19:34
ddelnano added 17 commits July 11, 2025 20:08
Signed-off-by: Dom Del Nano <ddelnano@gmail.com>
Signed-off-by: Dom Del Nano <ddelnano@gmail.com>
Signed-off-by: Dom Del Nano <ddelnano@gmail.com>
…ing deprecation

Signed-off-by: Dom Del Nano <ddelnano@gmail.com>
Signed-off-by: Dom Del Nano <ddelnano@gmail.com>
Signed-off-by: Dom Del Nano <ddelnano@gmail.com>
Signed-off-by: Dom Del Nano <ddelnano@gmail.com>
Signed-off-by: Dom Del Nano <ddelnano@gmail.com>
Signed-off-by: Dom Del Nano <ddelnano@gmail.com>
Signed-off-by: Dom Del Nano <ddelnano@gmail.com>
Signed-off-by: Dom Del Nano <ddelnano@gmail.com>
Signed-off-by: Dom Del Nano <ddelnano@gmail.com>
Signed-off-by: Dom Del Nano <ddelnano@gmail.com>
Signed-off-by: Dom Del Nano <ddelnano@gmail.com>
Signed-off-by: Dom Del Nano <ddelnano@gmail.com>
Signed-off-by: Dom Del Nano <ddelnano@gmail.com>
Signed-off-by: Dom Del Nano <ddelnano@gmail.com>
@ddelnano ddelnano merged commit 0a0ffb6 into pixie-io:main Jul 16, 2025
21 checks passed
@ddelnano ddelnano deleted the ddelnano/scan-pixie-deps-with-trivy branch July 16, 2025 19:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants