Skip to content

Commit ec9b5d1

Browse files
MaddosaurusMaddosaurus
authored
ROX-26089,ROX-26519: v4.VulnerabilityReport conversion (#12798)
1 parent c77ea26 commit ec9b5d1

File tree

13 files changed

+861
-170
lines changed

13 files changed

+861
-170
lines changed

‎central/graphql/resolvers/generated.go‎

Lines changed: 25 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎central/sensor/service/pipeline/nodeindex/pipeline.go‎

Lines changed: 25 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ import (
1313
"github.com/stackrox/rox/central/sensor/service/pipeline/reconciliation"
1414
"github.com/stackrox/rox/generated/internalapi/central"
1515
"github.com/stackrox/rox/pkg/centralsensor"
16+
"github.com/stackrox/rox/pkg/features"
1617
"github.com/stackrox/rox/pkg/logging"
1718
"github.com/stackrox/rox/pkg/nodes/enricher"
1819
)
@@ -56,7 +57,11 @@ func (p pipelineImpl) Match(msg *central.MsgFromSensor) bool {
5657
return msg.GetEvent().GetIndexReport() != nil
5758
}
5859

59-
func (p pipelineImpl) Run(ctx context.Context, clusterID string, msg *central.MsgFromSensor, _ common.MessageInjector) error {
60+
func (p pipelineImpl) Run(ctx context.Context, _ string, msg *central.MsgFromSensor, _ common.MessageInjector) error {
61+
if !features.ScannerV4.Enabled() {
62+
// If Scanner V4 is disabled do not run this pipeline
63+
return nil
64+
}
6065
event := msg.GetEvent()
6166
report := event.GetIndexReport()
6267
if report == nil {
@@ -66,37 +71,36 @@ func (p pipelineImpl) Run(ctx context.Context, clusterID string, msg *central.Ms
6671
log.Errorf("index report from node %s has unsupported action: %q", event.GetNode().GetName(), event.GetAction())
6772
return nil
6873
}
69-
log.Debugf("received node index report with %d packages from %d content sets for node %s",
70-
len(report.GetContents().Packages), len(report.GetContents().Repositories), event.GetId())
71-
cr := report.CloneVT()
74+
log.Debugf("received node index report for node %s with %d packages from %d content sets",
75+
event.GetId(), len(report.GetContents().Packages), len(report.GetContents().Repositories))
76+
report = report.CloneVT()
7277

73-
// Read the node from the database, if not found we fail.
74-
node, found, err := p.nodeDatastore.GetNode(ctx, event.GetId())
78+
// Query storage for the node this report comes from
79+
nodeId := event.GetId()
80+
node, found, err := p.nodeDatastore.GetNode(ctx, nodeId)
7581
if err != nil {
76-
return errors.WithMessagef(err, "fetching node: %s", event.GetId())
82+
return errors.WithMessagef(err, "failed to fetch node %s from database", nodeId)
7783
}
7884
if !found {
79-
return errors.WithMessagef(err, "node does not exist: %s", event.GetId())
85+
return errors.WithMessagef(err, "node %s not found in datastore", nodeId)
8086
}
8187

82-
// Send the Node and Index Report to Scanner for enrichment
83-
err = p.enricher.EnrichNodeWithInventory(node, nil, cr)
88+
// Send the Node and Index Report to Scanner for enrichment. The result will be persisted in node.NodeScan
89+
err = p.enricher.EnrichNodeWithInventory(node, nil, report)
8490
if err != nil {
85-
return errors.WithMessagef(err, "enriching node %s with index report", event.GetId())
91+
return errors.WithMessagef(err, "enriching node %s with index report", nodeId)
8692
}
87-
log.Infof("Successfully enriched node %s with index report.", node.GetName())
93+
log.Debugf("Successfully enriched node %s with %s report - found %d components (id: %s)",
94+
node.GetName(), node.GetScan().GetScannerVersion().String(), len(node.GetScan().GetComponents()), nodeId)
8895

89-
// TODO(ROX-26089): Update the whole node in the database with the new and previous information after conversion
90-
/*
91-
err = p.riskManager.CalculateRiskAndUpsertNode(node)
92-
if err != nil {
93-
log.Error(err)
94-
return err
95-
}
96-
*/
96+
// Update the whole node in the database with the new and previous information.
97+
err = p.riskManager.CalculateRiskAndUpsertNode(node)
98+
if err != nil {
99+
log.Error(err)
100+
return err
101+
}
97102

98103
return nil
99-
100104
}
101105

102106
func (p pipelineImpl) Reconcile(_ context.Context, _ string, _ *reconciliation.StoreMap) error {

‎central/sensor/service/pipeline/nodeinventory/pipeline.go‎

Lines changed: 25 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,9 @@ import (
1414
"github.com/stackrox/rox/central/sensor/service/pipeline"
1515
"github.com/stackrox/rox/central/sensor/service/pipeline/reconciliation"
1616
"github.com/stackrox/rox/generated/internalapi/central"
17+
"github.com/stackrox/rox/generated/storage"
1718
"github.com/stackrox/rox/pkg/centralsensor"
19+
"github.com/stackrox/rox/pkg/features"
1820
"github.com/stackrox/rox/pkg/logging"
1921
"github.com/stackrox/rox/pkg/metrics"
2022
"github.com/stackrox/rox/pkg/nodes/enricher"
@@ -90,6 +92,16 @@ func (p *pipelineImpl) Run(ctx context.Context, _ string, msg *central.MsgFromSe
9092
return errors.WithMessagef(err, "node does not exist: %s", ninv.GetNodeId())
9193
}
9294

95+
// Discard message if NodeScanning v4 and v2 are running in parallel - v4 scans are prioritized in that case.
96+
// The message will be kept even if a v4 scan is already persisted for the node if the feature flag for
97+
// Scanner v4 has been disabled. This ensures node scans are updated even if a customer falls back to Scanner v2.
98+
if node.GetScan() != nil && node.GetScan().GetScannerVersion() == storage.NodeScan_SCANNER_V4 && features.ScannerV4.Enabled() {
99+
// To prevent resending the inventory, still acknowledge receipt of it
100+
sendComplianceAck(ctx, node, ninv, injector)
101+
log.Debugf("Discarding v2 NodeScan in favor of v4 NodeScan")
102+
return nil
103+
}
104+
93105
// Call Scanner to enrich the node inventory and attach the results to the node object.
94106
err = p.enricher.EnrichNodeWithInventory(node, ninv, nil)
95107
if err != nil {
@@ -106,17 +118,22 @@ func (p *pipelineImpl) Run(ctx context.Context, _ string, msg *central.MsgFromSe
106118
return err
107119
}
108120

109-
if injector != nil {
110-
reply := replyCompliance(node.GetClusterId(), ninv.GetNodeName(), central.NodeInventoryACK_ACK)
111-
if err := injector.InjectMessage(ctx, reply); err != nil {
112-
log.Warnf("Failed sending node-scanning-ACK to Sensor for %s: %v", nodeDatastore.NodeString(node), err)
113-
} else {
114-
log.Debugf("Sent node-scanning-ACK for %s", nodeDatastore.NodeString(node))
115-
}
116-
}
121+
sendComplianceAck(ctx, node, ninv, injector)
117122
return nil
118123
}
119124

125+
func sendComplianceAck(ctx context.Context, node *storage.Node, ninv *storage.NodeInventory, injector common.MessageInjector) {
126+
if injector == nil {
127+
return
128+
}
129+
reply := replyCompliance(node.GetClusterId(), ninv.GetNodeName(), central.NodeInventoryACK_ACK)
130+
if err := injector.InjectMessage(ctx, reply); err != nil {
131+
log.Warnf("Failed sending node-scanning-ACK to Sensor for %s: %v", nodeDatastore.NodeString(node), err)
132+
} else {
133+
log.Debugf("Sent node-scanning-ACK for %s", nodeDatastore.NodeString(node))
134+
}
135+
}
136+
120137
func replyCompliance(clusterID, nodeName string, t central.NodeInventoryACK_Action) *central.MsgToSensor {
121138
return &central.MsgToSensor{
122139
Msg: &central.MsgToSensor_NodeInventoryAck{

‎generated/api/v1/node_service.swagger.json‎

Lines changed: 12 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)