diff --git a/examples/trivy.go b/examples/trivy.go index 52b1a2a..c8d2706 100644 --- a/examples/trivy.go +++ b/examples/trivy.go @@ -30,19 +30,20 @@ func main() { fmt.Println("Current namespace:", cluster.GetCurrentNamespace()) + trivyk8sCopy := trivyk8s.New(cluster, logger.Sugar(), trivyk8s.WithExcludeOwned(true)) trivyk8s := trivyk8s.New(cluster, logger.Sugar(), trivyk8s.WithExcludeOwned(true)) - fmt.Println("Scanning kind 'pods' with exclude-owned=true") - artifacts, err := trivyk8s.Resources("pod").AllNamespaces().ListArtifacts(ctx) + fmt.Println("Scanning cluster") + + //trivy k8s #cluster + artifacts, err := trivyk8s.ListArtifacts(ctx) if err != nil { log.Fatal(err) } printArtifacts(artifacts) - fmt.Println("Scanning cluster") - - //trivy k8s #cluster - artifacts, err = trivyk8s.ListArtifacts(ctx) + fmt.Println("Scanning kind 'pods' with exclude-owned=true") + artifacts, err = trivyk8s.Resources("pod").AllNamespaces().ListArtifacts(ctx) if err != nil { log.Fatal(err) } @@ -50,13 +51,13 @@ func main() { fmt.Println("Scanning namespace 'default'") //trivy k8s --namespace default - artifacts, err = trivyk8s.Namespace("default").ListArtifacts(ctx) + artifacts, err = trivyk8sCopy.Namespace("default").ListArtifacts(ctx) if err != nil { log.Fatal(err) } printArtifacts(artifacts) fmt.Println("Scanning all namespaces ") - artifacts, err = trivyk8s.AllNamespaces().ListArtifacts(ctx) + artifacts, err = trivyk8sCopy.AllNamespaces().ListArtifacts(ctx) if err != nil { log.Fatal(err) } @@ -65,7 +66,7 @@ func main() { fmt.Println("Scanning namespace 'default', resource 'deployment/orion'") //trivy k8s --namespace default deployment/orion - artifact, err := trivyk8s.Namespace("default").GetArtifact(ctx, "deploy", "orion") + artifact, err := trivyk8sCopy.Namespace("default").GetArtifact(ctx, "deploy", "orion") if err != nil { log.Fatal(err) } @@ -74,7 +75,7 @@ func main() { fmt.Println("Scanning 'deployments'") //trivy k8s deployment - artifacts, err = trivyk8s.Namespace("default").Resources("deployment").ListArtifacts(ctx) + artifacts, err = trivyk8sCopy.Namespace("default").Resources("deployment").ListArtifacts(ctx) if err != nil { log.Fatal(err) } @@ -82,7 +83,7 @@ func main() { fmt.Println("Scanning 'cm,pods'") //trivy k8s clusterroles,pods - artifacts, err = trivyk8s.Namespace("default").Resources("cm,pods").ListArtifacts(ctx) + artifacts, err = trivyk8sCopy.Namespace("default").Resources("cm,pods").ListArtifacts(ctx) if err != nil { log.Fatal(err) } @@ -112,7 +113,7 @@ func main() { } // collect node info - ar, err := trivyk8s.ListArtifactAndNodeInfo(ctx, "trivy-temp", map[string]string{"chen": "test"}, tolerations...) + ar, err := trivyk8sCopy.ListArtifactAndNodeInfo(ctx, "trivy-temp", map[string]string{"chen": "test"}, tolerations...) if err != nil { log.Fatal(err) } diff --git a/pkg/trivyk8s/trivyk8s.go b/pkg/trivyk8s/trivyk8s.go index aa98875..cdb91fb 100644 --- a/pkg/trivyk8s/trivyk8s.go +++ b/pkg/trivyk8s/trivyk8s.go @@ -138,7 +138,6 @@ func (c *client) ListArtifacts(ctx context.Context) ([]*artifacts.Artifact, erro if c.ignoreResource(resource) { continue } - // assume that the owner is a built-in workload by default ownerIsBuiltIn := true if len(resource.GetOwnerReferences()) > 0 { @@ -152,8 +151,8 @@ func (c *client) ListArtifacts(ctx context.Context) ([]*artifacts.Artifact, erro } } - // if excludeOwned is enabled and workload is a built-in workload, we skip it - if c.excludeOwned && ownerIsBuiltIn { + // if excludeOwned is enabled and workload is a built-in workload and if ownerExists, we skip it + if c.excludeOwned && ownerIsBuiltIn && len(resource.GetOwnerReferences()) > 0 { continue }