once.Do(func() {

loop = NewLoop(connection.ManagerSingleton(), enrichment.ImageEnricherSingleton(), enrichment.ImageEnricherV2Singleton(),

enrichment.NodeEnricherSingleton(), deploymentDatastore.Singleton(), imageDatastore.Singleton(),

imageV2Datastore.Singleton(), nodeDatastore.Singleton(), manager.Singleton(), watchedImageDataStore.Singleton())

})

return loop

Start()

ShortCircuit()

Stop()

ReprocessRiskForDeployments(deploymentIDs ...string)

ReprocessSignatureVerifications(firstIntegration bool)

nodeEnricher nodeEnricher.NodeEnricher, deployments deploymentDatastore.DataStore, images imageDatastore.DataStore,

imagesV2 imageV2Datastore.DataStore, nodes nodeDatastore.DataStore, risk manager.Manager,

watchedImages watchedImageDataStore.DataStore) Loop {

return newLoopWithDuration(

connManager, imageEnricher, imageEnricherV2, nodeEnricher, deployments, images, imagesV2, nodes, risk,

watchedImages, env.ReprocessInterval.DurationSetting(), env.RiskReprocessInterval.DurationSetting())

nodeEnricher nodeEnricher.NodeEnricher, deployments deploymentDatastore.DataStore, images imageDatastore.DataStore,

imagesV2 imageV2Datastore.DataStore, nodes nodeDatastore.DataStore, risk manager.Manager,

watchedImages watchedImageDataStore.DataStore, enrichAndDetectDuration, deploymentRiskDuration time.Duration) *loopImpl {

return &loopImpl{

enrichAndDetectTickerDuration: enrichAndDetectDuration,

deploymentRiskTickerDuration: deploymentRiskDuration,

imageEnricher: imageEnricher,

imageEnricherV2: imageEnricherV2,

images: images,

imagesV2: imagesV2,

risk: risk,

watchedImages: watchedImages,

deployments: deployments,

deploymentRiskSet: set.NewStringSet(),

nodeEnricher: nodeEnricher,

nodes: nodes,

shortCircuitSig: concurrency.NewSignal(),

stopSig: concurrency.NewSignal(),

enrichmentStopped: concurrency.NewSignal(),

riskStopped: concurrency.NewSignal(),

signatureVerificationSig: concurrency.NewSignal(),

connManager: connManager,

injectMessageTimeoutDur: env.ReprocessInjectMessageTimeout.DurationSetting(),

}

enrichAndDetectTickerDuration time.Duration

enrichAndDetectTicker *time.Ticker

images imageDatastore.DataStore

imagesV2 imageV2Datastore.DataStore

risk manager.Manager

imageEnricher imageEnricher.ImageEnricher

imageEnricherV2 imageEnricher.ImageEnricherV2

watchedImages watchedImageDataStore.DataStore

deployments deploymentDatastore.DataStore

deploymentRiskSet set.StringSet

deploymentRiskLock sync.Mutex

deploymentRiskTicker *time.Ticker

deploymentRiskTickerDuration time.Duration

nodes nodeDatastore.DataStore

nodeEnricher nodeEnricher.NodeEnricher

shortCircuitSig concurrency.Signal

stopSig concurrency.Signal

riskStopped concurrency.Signal

enrichmentStopped concurrency.Signal

signatureVerificationSig concurrency.Signal

firstSignatureIntegration concurrency.Flag

reprocessingInProgress concurrency.Flag

connManager connection.Manager

injectMessageTimeoutDur time.Duration

l.deploymentRiskLock.Lock()

defer l.deploymentRiskLock.Unlock()

l.deploymentRiskSet.AddAll(deploymentIDs...)

l.enrichAndDetectTicker = time.NewTicker(l.enrichAndDetectTickerDuration)

l.deploymentRiskTicker = time.NewTicker(l.deploymentRiskTickerDuration)

go l.riskLoop()

go l.enrichLoop()

l.stopSig.Signal()

l.riskStopped.Wait()

l.enrichmentStopped.Wait()

// Signal that we should run a short circuited reprocessing. If the signal is already triggered, then the current

// signal is effectively deduped

l.shortCircuitSig.Signal()

// Signal that we should reprocess signature verifications for all images. This will only trigger a reprocess with

// refetch of signature verification results.

// If the signal is already triggered, then the current signal is effectively deduped.

l.firstSignatureIntegration.Set(firstIntegration)

l.signatureVerificationSig.Signal()

query := search.NewQueryBuilder().AddStringsHighlighted(search.ClusterID, search.WildcardString)

if len(deploymentIDs) > 0 {

query = query.AddDocIDs(deploymentIDs...)

}

results, err := l.deployments.SearchDeployments(allAccessCtx, query.ProtoQuery())

if err != nil {

log.Errorw("Error getting results for deployment reprocessing", logging.Err(err))

return

}

path, ok := deployments.OptionsMap.Get(search.ClusterID.String())

if !ok {

panic("No Cluster ID option for deployments")

}

for _, r := range results {

clusterIDs := r.GetFieldToMatches()[path.GetFieldPath()].GetValues()

if len(clusterIDs) == 0 {

log.Error("no cluster id found in fields")

continue

}

conn := l.connManager.GetConnection(clusterIDs[0])

if conn == nil {

continue

}

dedupeKey := uuid.NewV5(riskDedupeNamespace, r.GetId()).String()

msg := &central.MsgFromSensor{

HashKey: r.GetId(),

DedupeKey: dedupeKey,

Msg: &central.MsgFromSensor_Event{

Event: &central.SensorEvent{

Resource: &central.SensorEvent_ReprocessDeployment{

ReprocessDeployment: &central.ReprocessDeploymentRisk{

DeploymentId: r.GetId(),

},

},

},

},

}

conn.InjectMessageIntoQueue(msg)

}

if l.stopSig.IsDone() {

return

}

ids, err := getIDsFunc()

if err != nil {

log.Errorw("Failed to retrieve active IDs for entity", logging.String("entity", entityType),

logging.Err(err))

return

}

log.Infof("Found %d %ss to scan", len(ids), entityType)

sema := semaphore.NewWeighted(5)

wg := concurrency.NewWaitGroup(0)

nReprocessed := atomic.NewInt32(0)

for _, id := range ids {

wg.Add(1)

if err := sema.Acquire(concurrency.AsContext(&l.stopSig), 1); err != nil {

log.Errorw("Reprocessing stopped", logging.Err(err))

return

}

go func(id string) {

defer sema.Release(1)

defer wg.Add(-1)

if individualReprocessFunc(id) {

nReprocessed.Inc()

}

}(id)

}

select {

case <-wg.Done():

case <-l.stopSig.Done():

log.Info("Stopping reprocessing due to stop signal")

return

}

log.Infof("Successfully reprocessed %d/%d %ss", nReprocessed.Load(), len(ids), entityType)

reprocessingFunc imageReprocessingFunc) (*storage.Image, bool) {

image, exists, err := l.images.GetImage(allAccessCtx, id)

if err != nil {

log.Errorw("Error fetching image from database", logging.ImageID(id), logging.Err(err))

return nil, false

}

if !exists || image.GetNotPullable() || image.GetIsClusterLocal() {

return nil, false

}

result, err := reprocessingFunc(emptyCtx, imageEnricher.EnrichmentContext{

FetchOpt: fetchOpt,

}, image)

if err != nil {

log.Errorw("Error enriching image", logging.ImageName(image.GetName().GetFullName()), logging.ImageID(image.GetId()), logging.Err(err))

return nil, false

}

if result.ImageUpdated {

if err := l.risk.CalculateRiskAndUpsertImage(image); err != nil {

log.Errorw("Error upserting image into datastore",

logging.ImageName(image.GetName().GetFullName()), logging.ImageID(image.GetId()), logging.Err(err))

return nil, false

}

// We need to fetch the image again to make sure all fields are populated.

// GetImage will internally call a Merge function which will use the CVEEdges table to enrich fields like

// FirstImageOccurrence and FirstSystemOccurrence.

newImage, exists, err := l.images.GetImage(allAccessCtx, id)

if err != nil {

log.Errorw("Error fetching image from database", logging.ImageName(image.GetName().GetFullName()), logging.ImageID(image.GetId()), logging.Err(err))

return nil, false

}

if !exists {

log.Errorw("The image was not found after enrichement", logging.ImageName(image.GetName().GetFullName()), logging.ImageID(image.GetId()))

return nil, false

}

return newImage, true

}

return image, true

imgReprocessingFunc imageReprocessingFunc, imageQuery *v1.Query) {

if l.stopSig.IsDone() {

return

}

results, err := l.images.Search(allAccessCtx, imageQuery)

if err != nil {

log.Errorw("Error searching for active image IDs", logging.Err(err))

return

}

log.Infof("Found %d images to scan", len(results))

if len(results) == 0 {

return

}

sema := semaphore.NewWeighted(imageReprocessorSemaphoreSize)

wg := concurrency.NewWaitGroup(0)

nReprocessed := atomic.NewInt32(0)

skipClusterIDs := maputil.NewSyncMap[string, struct{}]()

for _, result := range results {

wg.Add(1)

if err := sema.Acquire(concurrency.AsContext(&l.stopSig), 1); err != nil {

log.Errorw("Reprocessing stopped", logging.Err(err))

return

}

// Duplicates can exist if the image is within multiple deployments

clusterIDSet := set.NewStringSet(result.Matches[imageClusterIDFieldPath]...)

go func(id string, clusterIDs set.StringSet) {

defer sema.Release(1)

defer wg.Add(-1)

image, successfullyProcessed := l.reprocessImage(id, fetchOpt, imgReprocessingFunc)

if !successfullyProcessed {

return

}

nReprocessed.Inc()

utils.FilterSuppressedCVEsNoClone(image)

utils.StripCVEDescriptionsNoClone(image)

// Send the updated image to relevant clusters.

for clusterID := range clusterIDs {

conn := l.connManager.GetConnection(clusterID)

if conn == nil {

continue

}

msg := &central.MsgToSensor{

Msg: &central.MsgToSensor_UpdatedImage{

UpdatedImage: image,

},

}

// If were prior errors, do not attempt to send a message to this cluster.

if skipClusterIDs.Contains(clusterID) {

metrics.IncrementMsgToSensorNotSentCounter(clusterID, msg, metrics.NotSentSkip)

log.Debugw("Not sending updated image to cluster due to prior errors",

logging.ImageID(image.GetId()),

logging.ImageName(image.GetName().GetFullName()),

logging.String("dst_cluster", clusterID),

)

continue

}

err := l.injectMessage(concurrency.AsContext(&l.stopSig), conn, msg)

if err != nil {

skipClusterIDs.Store(clusterID, struct{}{})

log.Errorw("Error sending updated image to cluster, skipping cluster until next reprocessing cycle",

logging.ImageName(image.GetName().GetFullName()),

logging.ImageID(image.GetId()), logging.Err(err),

// Not using logging.ClusterID() to avoid "duplicate resource ID field found" panic

logging.String("dst_cluster", clusterID),

)

}

}

}(result.ID, clusterIDSet)

}

select {

case <-wg.Done():

case <-l.stopSig.Done():

log.Info("Stopping reprocessing due to stop signal")

return

}

log.Infof("Successfully reprocessed %d/%d images", nReprocessed.Load(), len(results))

log.Info("Resyncing deployments now that images have been reprocessed...")

l.sendReprocessDeployments(skipClusterIDs)

reprocessingFunc imageReprocessingFuncV2) (*storage.ImageV2, bool) {

image, exists, err := l.imagesV2.GetImage(allAccessCtx, id)

if err != nil {

log.Errorw("Error fetching image from database", logging.ImageID(id), logging.Err(err))

return nil, false

}

migrateToV2 := false

if !exists {

// The image was not found in ImageV2 store, but it might be in the legacy ImageV1 store

var legacyImage *storage.Image

legacyImage, exists, err = l.images.GetImageMetadata(allAccessCtx, digest)

if err != nil {

log.Errorw("Error fetching legacy image from database", logging.ImageID(id), logging.Err(err))

return nil, false

}

if !exists {

return nil, false

}

image = utils.ConvertToV2(legacyImage)

migrateToV2 = true

}

if image == nil {

return nil, false

}

if image.GetNotPullable() || image.GetIsClusterLocal() {

// Skip reprocessing. Sensor will handle cluster-local images. But we still need to migrate the image to V2.

if migrateToV2 {

if err := l.imagesV2.UpsertImage(allAccessCtx, image); err != nil {

log.Errorw("Error migrating image to imageV2 store", logging.ImageName(image.GetName().GetFullName()), logging.ImageID(image.GetId()), logging.Err(err))

return nil, false

}

}

return nil, false

}

result, err := reprocessingFunc(emptyCtx, imageEnricher.EnrichmentContext{

FetchOpt: fetchOpt,

}, image)

if err != nil {

log.Errorw("Error enriching image", logging.ImageName(image.GetName().GetFullName()), logging.ImageID(image.GetId()), logging.Err(err))

return nil, false

}

if result.ImageUpdated {

if err := l.risk.CalculateRiskAndUpsertImageV2(image); err != nil {

log.Errorw("Error upserting image into datastore",

logging.ImageName(image.GetName().GetFullName()), logging.ImageID(image.GetId()), logging.Err(err))

return nil, false

}

// We need to fetch the image again to make sure all fields are populated.

// GetImage will internally call a Merge function which will use the CVEEdges table to enrich fields like

// FirstImageOccurrence and FirstSystemOccurrence.

newImage, exists, err := l.imagesV2.GetImage(allAccessCtx, id)

if err != nil {

log.Errorw("Error fetching image from database", logging.ImageName(image.GetName().GetFullName()), logging.ImageID(image.GetId()), logging.Err(err))

return nil, false

}

if !exists {

log.Errorw("The image was not found after enrichement", logging.ImageName(image.GetName().GetFullName()), logging.ImageID(image.GetId()))

return nil, false

}

return newImage, true

}

return image, true

imgReprocessingFunc imageReprocessingFuncV2, imageQuery *v1.Query) {

if l.stopSig.IsDone() {

return

}

results, err := l.deployments.GetContainerImageViews(allAccessCtx, imageQuery)

if err != nil {

log.Errorw("Error searching for active image IDs", logging.Err(err))

return

}

log.Infof("Found %d images to scan", len(results))

if len(results) == 0 {

return

}

sema := semaphore.NewWeighted(imageReprocessorSemaphoreSize)

wg := concurrency.NewWaitGroup(0)

nReprocessed := atomic.NewInt32(0)

skipClusterIDs := maputil.NewSyncMap[string, struct{}]()

for _, result := range results {

wg.Add(1)

if err := sema.Acquire(concurrency.AsContext(&l.stopSig), 1); err != nil {

log.Errorw("Reprocessing stopped", logging.Err(err))

return

}

clusterIDSet := set.NewStringSet(result.GetClusterIDs()...)

go func(id string, digest string, clusterIDs set.StringSet) {

defer sema.Release(1)

defer wg.Add(-1)

image, successfullyProcessed := l.reprocessImageV2(id, digest, fetchOpt, imgReprocessingFunc)

if !successfullyProcessed {

return

}

nReprocessed.Inc()

utils.FilterSuppressedCVEsNoCloneV2(image)

utils.StripCVEDescriptionsNoCloneV2(image)

// Gather all known image names with the same SHA to ensure backward compatibility

// with sensors that don't have the FlattenImageData capability.

// Skip if all sensors have the capability.

var allNames []*storage.ImageName

if !l.connManager.AllSensorsHaveCapability(centralsensor.FlattenImageData) {

var err error

allNames, err = l.imagesV2.GetImageNames(allAccessCtx, image.GetDigest())

if err != nil {

log.Warnw("Failed to retrieve image names by digest",

logging.ImageName(image.GetName().GetFullName()),

logging.ImageID(image.GetId()),

logging.String("digest", image.GetDigest()),

logging.Err(err),

)

}

}

convertedImage := utils.ConvertToV1(image, allNames...)

// Send the updated image to relevant clusters.

for clusterID := range clusterIDs {

conn := l.connManager.GetConnection(clusterID)

if conn == nil {

continue

}

msg := &central.MsgToSensor{

Msg: &central.MsgToSensor_UpdatedImage{

UpdatedImage: convertedImage,

},

}

// If were prior errors, do not attempt to send a message to this cluster.

if skipClusterIDs.Contains(clusterID) {

metrics.IncrementMsgToSensorNotSentCounter(clusterID, msg, metrics.NotSentSkip)

log.Debugw("Not sending updated image to cluster due to prior errors",

logging.ImageID(image.GetId()),

logging.ImageName(image.GetName().GetFullName()),

logging.String("dst_cluster", clusterID),

)

continue

}

err := l.injectMessage(concurrency.AsContext(&l.stopSig), conn, msg)

if err != nil {

skipClusterIDs.Store(clusterID, struct{}{})

log.Errorw("Error sending updated image to cluster, skipping cluster until next reprocessing cycle",

logging.ImageName(image.GetName().GetFullName()),

logging.ImageID(image.GetId()), logging.Err(err),

// Not using logging.ClusterID() to avoid "duplicate resource ID field found" panic

logging.String("dst_cluster", clusterID),

)

}

}

}(result.GetImageID(), result.GetImageDigest(), clusterIDSet)

}

select {

case <-wg.Done():

case <-l.stopSig.Done():

log.Info("Stopping reprocessing due to stop signal")

return

}

log.Infof("Successfully reprocessed %d/%d images", nReprocessed.Load(), len(results))

log.Info("Resyncing deployments now that images have been reprocessed...")

l.sendReprocessDeployments(skipClusterIDs)

// Once the images have been rescanned, then reprocess the deployments.

// This should not take a particularly long period of time.

if !l.stopSig.IsDone() {

msg := &central.MsgToSensor{

Msg: &central.MsgToSensor_ReprocessDeployments{

ReprocessDeployments: &central.ReprocessDeployments{},

},

}

ctx := concurrency.AsContext(&l.stopSig)

// Calculate the delay between sending reprocess messages to secured clusters.

conns := l.connManager.GetActiveConnections()

delay := env.ReprocessDeploymentsMsgDelay.DurationSetting()

if delay > 0 {

log.Infof("Sending reprocess deployments messages to %d clusters with %s delay between each message", len(conns), delay)

}

firstMessage := true

for i, conn := range conns {

clusterID := conn.ClusterID()

if skipClusterIDs.Contains(clusterID) {

metrics.IncrementMsgToSensorNotSentCounter(clusterID, msg, metrics.NotSentSkip)

log.Errorw("Not sending reprocess deployments to cluster due to prior errors",

logging.ClusterID(clusterID),

)

continue

}

// Sleep before sending if it is not the first message and a delay is specified.

if !firstMessage && delay > 0 {

log.Infof("Sleeping %s before sending reprocess deployments message to cluster %q [%d/%d]", delay, clusterID, i+1, len(conns))

select {

case <-time.After(delay):

case <-l.stopSig.Done():

log.Infof("Caught stop signal while waiting to send reprocess deployments to cluster %q", clusterID)

return

}

}

firstMessage = false

err := l.injectMessage(ctx, conn, msg)

if err != nil {

log.Errorw("Error sending reprocess deployments message to cluster",

logging.ClusterID(clusterID),

logging.Err(err),

)

}

}

}

log.Info("Done sending reprocess deployments messages")

if l.injectMessageTimeoutDur > 0 {

var cancel context.CancelFunc

ctx, cancel = context.WithTimeout(ctx, l.injectMessageTimeoutDur)

defer cancel()

}

err := conn.InjectMessage(ctx, msg)

if err != nil {

return errors.Wrap(err, "injecting message to sensor")

}

return nil

node, exists, err := l.nodes.GetNode(allAccessCtx, id)

if err != nil {

log.Errorw("Error fetching node from the database", logging.NodeID(id), logging.Err(err))

return false

}

if !exists {

log.Warnw("Error fetching non-existing node from the database", logging.NodeID(id))

return false

}

if nodeEnricher.SupportsNodeScanning(node) {

log.Infof("node %s is host-scanned: skipping reprocess", nodeDatastore.NodeString(node))

// False signals there was no writes to the database and no actual reprocessing.

return false

}

err = l.nodeEnricher.EnrichNode(node)

if err != nil {

log.Errorw("Error enriching node", logging.String("node", nodeDatastore.NodeString(node)), logging.Err(err))

return false

}

if err := l.risk.CalculateRiskAndUpsertNode(node); err != nil {

log.Error(err)

return false

}

return true

l.runReprocessingForObjects("node", func() ([]string, error) {

results, err := l.nodes.Search(allAccessCtx, search.EmptyQuery())

if err != nil {

return nil, err

}

return search.ResultsToIDs(results), nil

}, l.reprocessNode)

enrichmentCtx := imageEnricher.EnrichmentContext{

FetchOpt: imageEnricher.IgnoreExistingImages,

}

ctx := emptyCtx

if features.DelegateWatchedImageReprocessing.Enabled() {

ctx = delegateScanCtx

enrichmentCtx.Delegable = true

}

img, err := imageEnricher.EnrichImageByName(ctx, l.imageEnricher, enrichmentCtx, name)

if err != nil {

log.Errorw("Error enriching watched image", logging.ImageName(name), logging.Err(err))

return false

}

// Save the image

img.Id = utils.GetSHA(img)

if img.GetId() == "" {

return false

}

if err := l.risk.CalculateRiskAndUpsertImage(img); err != nil {

log.Errorw("Error upserting watched image after enriching", logging.ImageName(name), logging.ImageID(img.GetId()), logging.Err(err))

return false

}

return true

enrichmentCtx := imageEnricher.EnrichmentContext{

FetchOpt: imageEnricher.IgnoreExistingImages,

}

ctx := emptyCtx

if features.DelegateWatchedImageReprocessing.Enabled() {

ctx = delegateScanCtx

enrichmentCtx.Delegable = true

}

img, err := imageEnricher.EnrichImageV2ByName(ctx, l.imageEnricherV2, enrichmentCtx, name)

if err != nil {

log.Errorw("Error enriching watched image", logging.ImageName(name), logging.Err(err))

return false

}

// Save the image

img.Digest = utils.GetSHAV2(img)

img.Id, err = utils.GetImageV2ID(img)

if err != nil {

log.Errorw("Error getting enriched image ID", logging.ImageName(name), logging.Err(err))

return false

}

if img.GetId() == "" {

return false

}

if err := l.risk.CalculateRiskAndUpsertImageV2(img); err != nil {

log.Errorw("Error upserting watched image after enriching", logging.ImageName(name), logging.ImageID(img.GetId()), logging.Err(err))

return false

}

return true

var reprocessFunc func(name string) bool

if features.FlattenImageData.Enabled() {

reprocessFunc = l.reprocessWatchedImageV2

} else {

reprocessFunc = l.reprocessWatchedImage

}

l.runReprocessingForObjects("watched image", func() ([]string, error) {

watchedImages, err := l.watchedImages.GetAllWatchedImages(allAccessCtx)

if err != nil {

return nil, err

}

imageNames := make([]string, 0, len(watchedImages))

for _, img := range watchedImages {

imageNames = append(imageNames, img.GetName())

}

return imageNames, nil

}, reprocessFunc)

// In case the current reprocessing run takes longer than the ticker (i.e. > 4 hours when using a high number of

// images), we shouldn't trigger a parallel reprocessing run.

if l.reprocessingInProgress.TestAndSet(true) {

return

}

defer metrics.SetReprocessorDuration(time.Now())

l.reprocessNodes()

l.reprocessWatchedImages()

if features.FlattenImageData.Enabled() {

l.reprocessImagesV2AndResyncDeployments(imageFetchOpt, l.enrichImageV2, allV2ImagesQuery)

} else {

l.reprocessImagesAndResyncDeployments(imageFetchOpt, l.enrichImage, allImagesQuery)

}

l.reprocessingInProgress.Set(false)

defer metrics.SetSignatureVerificationReprocessorDuration(time.Now())

l.reprocessWatchedImages()

query := imagesWithSignaturesQuery

// If we have reprocessed when the _first_ signature integration is added, then take into account all images.

if l.firstSignatureIntegration.Get() {

query = allImagesQuery

}

if features.FlattenImageData.Enabled() {

l.reprocessImagesV2AndResyncDeployments(imageEnricher.ForceRefetchSignaturesOnly,

l.forceEnrichImageSignatureVerificationResultsV2, allV2ImagesQuery)

} else {

l.reprocessImagesAndResyncDeployments(imageEnricher.ForceRefetchSignaturesOnly,

l.forceEnrichImageSignatureVerificationResults, query)

}

l.firstSignatureIntegration.Set(false)

defer l.enrichAndDetectTicker.Stop()

defer l.enrichmentStopped.Signal()

// Call runReprocessing with ForceRefetch on start to ensure that the image metadata reflects any changes

// in the proto and to ensure that the images and nodes are pulling new scans on <= the reprocessing interval

l.runReprocessing(imageEnricher.ForceRefetch)

for !l.stopSig.IsDone() {

select {

case <-l.stopSig.Done():

return

case <-l.shortCircuitSig.Done():

l.shortCircuitSig.Reset()

l.runReprocessing(imageEnricher.UseCachesIfPossible)

case <-l.signatureVerificationSig.Done():

l.signatureVerificationSig.Reset()

l.runSignatureVerificationReprocessing()

case <-l.enrichAndDetectTicker.C:

l.runReprocessing(imageEnricher.ForceRefetchCachedValuesOnly)

}

}

defer l.riskStopped.Signal()

defer l.deploymentRiskTicker.Stop()

for !l.stopSig.IsDone() {

select {

case <-l.stopSig.Done():

return

case <-l.deploymentRiskTicker.C:

concurrency.WithLock(&l.deploymentRiskLock, func() {

if l.deploymentRiskSet.Cardinality() > 0 {

// goroutine to ensure this is non-blocking.

go l.sendDeployments(l.deploymentRiskSet.AsSlice())

l.deploymentRiskSet.Clear()

}

})

}

}