diff --git a/bin/check-container-vulnerabilities.rb b/bin/check-container-vulnerabilities.rb index 4174b72..96b91cd 100755 --- a/bin/check-container-vulnerabilities.rb +++ b/bin/check-container-vulnerabilities.rb @@ -44,10 +44,18 @@ class CheckContainerVulnerabilities < Sensu::Plugin::Check::CLI default: '', proc: proc { |w| w.split(',') } + option :ignore_namespace_names, + description: 'Namespace names to ignore', + short: '-n NAMESPACE_NAME[,NAMESPACE_NAME]', + long: '--ignore-namespace-names NAMESPACE_NAME[,NAMESPACE_NAME]', + default: '', + proc: proc { |w| w.split(',') } + def run status, message = Quayio::Scanner::Check.new(config[:docker_url], config[:quayio_token], - config[:whitelist]).run + config[:whitelist], + config[:ignore_namespace_names]).run if status == :ok ok message diff --git a/lib/quayio/scanner/check.rb b/lib/quayio/scanner/check.rb index 5b568df..7152a00 100644 --- a/lib/quayio/scanner/check.rb +++ b/lib/quayio/scanner/check.rb @@ -2,7 +2,7 @@ module Quayio module Scanner - Check = Struct.new(:docker_url, :quayio_token, :whitelist) do + Check = Struct.new(:docker_url, :quayio_token, :whitelist, :ignore_namespace_names) do def run Docker.url = docker_url @@ -27,7 +27,7 @@ def containers def vulnerable_images containers - .map { |container| Image.new(container, quayio_token, whitelist) } + .map { |container| Image.new(container, quayio_token, whitelist, ignore_namespace_names) } .select(&:vulnerable?) .map(&:name) end diff --git a/lib/quayio/scanner/image.rb b/lib/quayio/scanner/image.rb index 55f2be2..015544b 100644 --- a/lib/quayio/scanner/image.rb +++ b/lib/quayio/scanner/image.rb @@ -5,11 +5,12 @@ class Image QUAY_IO_REPO_NAME = %r{quay.io\/(?[\w-]+)\/(?[\w-]+):(?[\w.-]+)}.freeze - attr_reader :name, :whitelist, :repository + attr_reader :name, :whitelist, :repository, :ignore_namespace_names - def initialize(name, quayio_token, whitelist) + def initialize(name, quayio_token, whitelist, ignore_namespace_names) @name = name @whitelist = whitelist + @ignore_namespace_names = ignore_namespace_names @name.match(QUAY_IO_REPO_NAME) do |r| org, repo, tag = r.captures @@ -36,7 +37,8 @@ def vulnerabilities_present? !raw_scan['data']['Layer']['Features'].detect do |f| f['Vulnerabilities']&.detect do |v| RELEVANT_SEVERITIES.include?(v['Severity']) && \ - !whitelist.include?(v['Name']) + !whitelist.include?(v['Name']) && \ + !ignore_namespace_names.include?(v['NamespaceName']) end end.nil? end