diff --git a/examples/trivy.go b/examples/trivy.go index fcae53a..80330b3 100644 --- a/examples/trivy.go +++ b/examples/trivy.go @@ -105,7 +105,7 @@ func main() { } // collect node info - ar, err := trivyk8s.ListArtifactAndNodeInfo(ctx, "trivy-temp", tolerations...) + ar, err := trivyk8s.ListArtifactAndNodeInfo(ctx, "trivy-temp", map[string]string{"chen": "test"}, tolerations...) if err != nil { log.Fatal(err) } diff --git a/pkg/artifacts/artifacts.go b/pkg/artifacts/artifacts.go index d1bf9d2..94276fc 100644 --- a/pkg/artifacts/artifacts.go +++ b/pkg/artifacts/artifacts.go @@ -10,6 +10,7 @@ import ( type Artifact struct { Namespace string Kind string + Labels map[string]string Name string Images []string RawResource map[string]interface{} @@ -35,10 +36,15 @@ func FromResource(resource unstructured.Unstructured) (*Artifact, error) { if err != nil { return nil, err } + var labels map[string]string + if resource.GetKind() == "Node" { + labels = resource.GetLabels() + } return &Artifact{ Namespace: resource.GetNamespace(), Kind: resource.GetKind(), + Labels: labels, Name: name, Images: images, RawResource: resource.Object, diff --git a/pkg/trivyk8s/trivyk8s.go b/pkg/trivyk8s/trivyk8s.go index 3383586..58008a5 100644 --- a/pkg/trivyk8s/trivyk8s.go +++ b/pkg/trivyk8s/trivyk8s.go @@ -39,7 +39,7 @@ type ArtifactsK8S interface { // GetArtifact return kubernete scanable artifact GetArtifact(context.Context, string, string) (*artifacts.Artifact, error) // ListArtifactAndNodeInfo return kubernete scanable artifact and node info - ListArtifactAndNodeInfo(context.Context, string, ...corev1.Toleration) ([]*artifacts.Artifact, error) + ListArtifactAndNodeInfo(context.Context, string, map[string]string, ...corev1.Toleration) ([]*artifacts.Artifact, error) // ListBomInfo returns kubernetes Bom (node,core components) information. ListBomInfo(context.Context) ([]*artifacts.Artifact, error) } @@ -130,7 +130,7 @@ func (c *client) ListArtifacts(ctx context.Context) ([]*artifacts.Artifact, erro } // ListArtifacts returns kubernetes scannable artifacs. -func (c *client) ListArtifactAndNodeInfo(ctx context.Context, namespace string, tolerations ...corev1.Toleration) ([]*artifacts.Artifact, error) { +func (c *client) ListArtifactAndNodeInfo(ctx context.Context, namespace string, ignoreLabels map[string]string, tolerations ...corev1.Toleration) ([]*artifacts.Artifact, error) { artifactList, err := c.ListArtifacts(ctx) if err != nil { return nil, err @@ -156,6 +156,10 @@ func (c *client) ListArtifactAndNodeInfo(ctx context.Context, namespace string, if resource.Kind != "Node" { continue } + if ignoreNodeByLabel(resource, ignoreLabels) { + continue + } + nodeLabels := map[string]string{ jobs.TrivyResourceName: resource.Name, jobs.TrivyResourceKind: resource.Kind, @@ -286,3 +290,12 @@ func isNodeStatusUnknown(resource unstructured.Unstructured) bool { } return true } + +func ignoreNodeByLabel(resource *artifacts.Artifact, ignoreLabels map[string]string) bool { + for key, val := range ignoreLabels { + if lVal, ok := resource.Labels[key]; !ok || lVal != val { + return false + } + } + return true +}