chore: fix issue caused by ownerIsBuiltIn being true by default (#216)

* chore: fix issue caused by ownerIsBuiltIn being true by default * chore: address PR comments
aquasecurity · Aug 30, 2023 · fe986af · fe986af
1 parent 95e88d5
commit fe986af
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 15 deletions.
diff --git a/examples/trivy.go b/examples/trivy.go
@@ -30,33 +30,34 @@ func main() {
 
 	fmt.Println("Current namespace:", cluster.GetCurrentNamespace())
 
+	trivyk8sCopy := trivyk8s.New(cluster, logger.Sugar(), trivyk8s.WithExcludeOwned(true))
 	trivyk8s := trivyk8s.New(cluster, logger.Sugar(), trivyk8s.WithExcludeOwned(true))
 
-	fmt.Println("Scanning kind 'pods' with exclude-owned=true")
-	artifacts, err := trivyk8s.Resources("pod").AllNamespaces().ListArtifacts(ctx)
+	fmt.Println("Scanning cluster")
+
+	//trivy k8s #cluster
+	artifacts, err := trivyk8s.ListArtifacts(ctx)
 	if err != nil {
 		log.Fatal(err)
 	}
 	printArtifacts(artifacts)
 
-	fmt.Println("Scanning cluster")
-
-	//trivy k8s #cluster
-	artifacts, err = trivyk8s.ListArtifacts(ctx)
+	fmt.Println("Scanning kind 'pods' with exclude-owned=true")
+	artifacts, err = trivyk8s.Resources("pod").AllNamespaces().ListArtifacts(ctx)
 	if err != nil {
 		log.Fatal(err)
 	}
 	printArtifacts(artifacts)
 
 	fmt.Println("Scanning namespace 'default'")
 	//trivy k8s --namespace default
-	artifacts, err = trivyk8s.Namespace("default").ListArtifacts(ctx)
+	artifacts, err = trivyk8sCopy.Namespace("default").ListArtifacts(ctx)
 	if err != nil {
 		log.Fatal(err)
 	}
 	printArtifacts(artifacts)
 	fmt.Println("Scanning all namespaces ")
-	artifacts, err = trivyk8s.AllNamespaces().ListArtifacts(ctx)
+	artifacts, err = trivyk8sCopy.AllNamespaces().ListArtifacts(ctx)
 	if err != nil {
 		log.Fatal(err)
 	}
@@ -65,7 +66,7 @@ func main() {
 	fmt.Println("Scanning namespace 'default', resource 'deployment/orion'")
 
 	//trivy k8s --namespace default deployment/orion
-	artifact, err := trivyk8s.Namespace("default").GetArtifact(ctx, "deploy", "orion")
+	artifact, err := trivyk8sCopy.Namespace("default").GetArtifact(ctx, "deploy", "orion")
 	if err != nil {
 		log.Fatal(err)
 	}
@@ -74,15 +75,15 @@ func main() {
 	fmt.Println("Scanning 'deployments'")
 
 	//trivy k8s deployment
-	artifacts, err = trivyk8s.Namespace("default").Resources("deployment").ListArtifacts(ctx)
+	artifacts, err = trivyk8sCopy.Namespace("default").Resources("deployment").ListArtifacts(ctx)
 	if err != nil {
 		log.Fatal(err)
 	}
 	printArtifacts(artifacts)
 
 	fmt.Println("Scanning 'cm,pods'")
 	//trivy k8s clusterroles,pods
-	artifacts, err = trivyk8s.Namespace("default").Resources("cm,pods").ListArtifacts(ctx)
+	artifacts, err = trivyk8sCopy.Namespace("default").Resources("cm,pods").ListArtifacts(ctx)
 	if err != nil {
 		log.Fatal(err)
 	}
@@ -112,7 +113,7 @@ func main() {
 	}
 
 	// collect node info
-	ar, err := trivyk8s.ListArtifactAndNodeInfo(ctx, "trivy-temp", map[string]string{"chen": "test"}, tolerations...)
+	ar, err := trivyk8sCopy.ListArtifactAndNodeInfo(ctx, "trivy-temp", map[string]string{"chen": "test"}, tolerations...)
 	if err != nil {
 		log.Fatal(err)
 	}

diff --git a/pkg/trivyk8s/trivyk8s.go b/pkg/trivyk8s/trivyk8s.go
@@ -138,7 +138,6 @@ func (c *client) ListArtifacts(ctx context.Context) ([]*artifacts.Artifact, erro
 			if c.ignoreResource(resource) {
 				continue
 			}
-
 			// assume that the owner is a built-in workload by default
 			ownerIsBuiltIn := true
 			if len(resource.GetOwnerReferences()) > 0 {
@@ -152,8 +151,8 @@ func (c *client) ListArtifacts(ctx context.Context) ([]*artifacts.Artifact, erro
 				}
 			}
 
-			// if excludeOwned is enabled and workload is a built-in workload, we skip it
-			if c.excludeOwned && ownerIsBuiltIn {
+			// if excludeOwned is enabled and workload is a built-in workload and if ownerExists, we skip it
+			if c.excludeOwned && ownerIsBuiltIn && len(resource.GetOwnerReferences()) > 0 {
 				continue
 			}