Skip to content

Commit 27ad4e0

Browse files
prakash100198prakash100198
committed
Merge branch 'main' into maintaining_audit_logs
2 parents c7473c2 + 66a7896 commit 27ad4e0

File tree

8 files changed

+409
-72
lines changed

8 files changed

+409
-72
lines changed

‎internal/sql/repository/security/CvePolicyControle.go‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -46,10 +46,11 @@ const (
4646
Inherit PolicyAction = iota
4747
Allow
4848
Block
49+
Blockiffixed
4950
)
5051

5152
func (d PolicyAction) String() string {
52-
return [...]string{"inherit", "allow", "block"}[d]
53+
return [...]string{"inherit", "allow", "block", "blockiffixed"}[d]
5354
}
5455

5556
// ------------------
@@ -246,23 +247,23 @@ func (impl *CvePolicyRepositoryImpl) GetBlockedCVEList(cves []*CveStore, cluster
246247
if err != nil {
247248
return nil, err
248249
}
249-
blockedCve := impl.enforceCvePolicy(cves, cvePolicy, severityPolicy)
250+
blockedCve := EnforceCvePolicy(cves, cvePolicy, severityPolicy)
250251
return blockedCve, nil
251252
}
252253

253-
func (impl *CvePolicyRepositoryImpl) enforceCvePolicy(cves []*CveStore, cvePolicy map[string]*CvePolicy, severityPolicy map[Severity]*CvePolicy) (blockedCVE []*CveStore) {
254+
func EnforceCvePolicy(cves []*CveStore, cvePolicy map[string]*CvePolicy, severityPolicy map[Severity]*CvePolicy) (blockedCVE []*CveStore) {
254255

255256
for _, cve := range cves {
256257
if policy, ok := cvePolicy[cve.Name]; ok {
257258
if policy.Action == Allow {
258259
continue
259-
} else {
260+
} else if (policy.Action == Block) || (policy.Action == Blockiffixed && cve.FixedVersion != "") {
260261
blockedCVE = append(blockedCVE, cve)
261262
}
262263
} else {
263264
if severityPolicy[cve.Severity] != nil && severityPolicy[cve.Severity].Action == Allow {
264265
continue
265-
} else {
266+
} else if severityPolicy[cve.Severity] != nil && (severityPolicy[cve.Severity].Action == Block || (severityPolicy[cve.Severity].Action == Blockiffixed && cve.FixedVersion != "")) {
266267
blockedCVE = append(blockedCVE, cve)
267268
}
268269
}
@@ -346,6 +347,7 @@ func (impl *CvePolicyRepositoryImpl) getHighestPolicy(allPolicies map[string][]*
346347
}
347348
return applicablePolicies
348349
}
350+
349351
func (impl *CvePolicyRepositoryImpl) getHighestPolicyS(allPolicies map[Severity][]*CvePolicy) map[Severity]*CvePolicy {
350352
applicablePolicies := make(map[Severity]*CvePolicy)
351353
for key, policies := range allPolicies {

‎internal/sql/repository/security/CvePolicyControle_test.go‎

Lines changed: 179 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,179 @@
1+
package security
2+
3+
import (
4+
"github.com/go-pg/pg"
5+
"reflect"
6+
"testing"
7+
)
8+
9+
func TestCvePolicyRepositoryImpl_enforceCvePolicy(t *testing.T) {
10+
type fields struct {
11+
dbConnection *pg.DB
12+
}
13+
type args struct {
14+
cves []*CveStore
15+
cvePolicy map[string]*CvePolicy
16+
severityPolicy map[Severity]*CvePolicy
17+
}
18+
tests := []struct {
19+
name string
20+
fields fields
21+
args args
22+
wantBlockedCVE []*CveStore
23+
}{
24+
// TODO: Add test cases.
25+
{
26+
name: "Test 1",
27+
args: args{
28+
cves: []*CveStore{
29+
{
30+
Name: "abc",
31+
},
32+
{
33+
Severity: Low,
34+
},
35+
},
36+
cvePolicy: map[string]*CvePolicy{
37+
"abc": {
38+
Action: Allow,
39+
},
40+
},
41+
severityPolicy: map[Severity]*CvePolicy{
42+
Low: {
43+
Action: Allow,
44+
},
45+
},
46+
},
47+
wantBlockedCVE: nil,
48+
},
49+
{
50+
name: "Test 2",
51+
args: args{
52+
cves: []*CveStore{
53+
{
54+
Name: "abc",
55+
},
56+
},
57+
cvePolicy: map[string]*CvePolicy{
58+
"abc": {
59+
Action: Block,
60+
},
61+
},
62+
severityPolicy: map[Severity]*CvePolicy{},
63+
},
64+
wantBlockedCVE: []*CveStore{
65+
{
66+
Name: "abc",
67+
},
68+
},
69+
},
70+
{
71+
name: "Test 3",
72+
args: args{
73+
cves: []*CveStore{
74+
{
75+
Severity: High,
76+
},
77+
},
78+
cvePolicy: map[string]*CvePolicy{},
79+
severityPolicy: map[Severity]*CvePolicy{
80+
High: {
81+
Action: Block,
82+
},
83+
},
84+
},
85+
wantBlockedCVE: []*CveStore{
86+
{
87+
Severity: High,
88+
},
89+
},
90+
},
91+
{
92+
name: "Test 4",
93+
args: args{
94+
cves: []*CveStore{
95+
{
96+
Name: "abc",
97+
FixedVersion: "1.0.0",
98+
},
99+
},
100+
cvePolicy: map[string]*CvePolicy{
101+
"abc": {
102+
Action: Blockiffixed,
103+
},
104+
},
105+
severityPolicy: map[Severity]*CvePolicy{},
106+
},
107+
wantBlockedCVE: []*CveStore{
108+
{
109+
Name: "abc",
110+
FixedVersion: "1.0.0",
111+
},
112+
},
113+
},
114+
{
115+
name: "Test 5",
116+
args: args{
117+
cves: []*CveStore{
118+
{
119+
Name: "abc",
120+
},
121+
},
122+
cvePolicy: map[string]*CvePolicy{
123+
"abc": {
124+
Action: Blockiffixed,
125+
},
126+
},
127+
severityPolicy: map[Severity]*CvePolicy{},
128+
},
129+
wantBlockedCVE: nil,
130+
},
131+
{
132+
name: "Test 6",
133+
args: args{
134+
cves: []*CveStore{
135+
{
136+
Severity: High,
137+
FixedVersion: "1.0.0",
138+
},
139+
},
140+
cvePolicy: map[string]*CvePolicy{},
141+
severityPolicy: map[Severity]*CvePolicy{
142+
High: {
143+
Action: Blockiffixed,
144+
},
145+
},
146+
},
147+
wantBlockedCVE: []*CveStore{
148+
{
149+
Severity: High,
150+
FixedVersion: "1.0.0",
151+
},
152+
},
153+
},
154+
{
155+
name: "Test 7",
156+
args: args{
157+
cves: []*CveStore{
158+
{
159+
Severity: High,
160+
},
161+
},
162+
cvePolicy: map[string]*CvePolicy{},
163+
severityPolicy: map[Severity]*CvePolicy{
164+
High: {
165+
Action: Blockiffixed,
166+
},
167+
},
168+
},
169+
wantBlockedCVE: nil,
170+
},
171+
}
172+
for _, tt := range tests {
173+
t.Run(tt.name, func(t *testing.T) {
174+
if gotBlockedCVE := EnforceCvePolicy(tt.args.cves, tt.args.cvePolicy, tt.args.severityPolicy); !reflect.DeepEqual(gotBlockedCVE, tt.wantBlockedCVE) {
175+
t.Errorf("EnforceCvePolicy() = %v, want %v", gotBlockedCVE, tt.wantBlockedCVE)
176+
}
177+
})
178+
}
179+
}

‎pkg/pipeline/CdConfig.go‎

Lines changed: 25 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,10 @@ package pipeline
1919

2020
import (
2121
"fmt"
22+
"github.com/caarlos0/env"
2223
blob_storage "github.com/devtron-labs/common-lib/blob-storage"
2324
"github.com/devtron-labs/devtron/internal/sql/repository/pipelineConfig"
2425
"strings"
25-
26-
"github.com/caarlos0/env"
2726
)
2827

2928
type CdConfig struct {
@@ -32,12 +31,16 @@ type CdConfig struct {
3231
ReqCpu string `env:"CD_REQ_CI_CPU" envDefault:"0.5"`
3332
ReqMem string `env:"CD_REQ_CI_MEM" envDefault:"3G"`
3433
TaintKey string `env:"CD_NODE_TAINTS_KEY" envDefault:"dedicated"`
34+
ExternalTaintKey string `env:"EXTERNAL_CD_NODE_TAINTS_KEY" envDefault:"dedicated"`
35+
UseExternalNode bool `env:"USE_EXTERNAL_NODE" envDefault:"false"`
3536
WorkflowServiceAccount string `env:"CD_WORKFLOW_SERVICE_ACCOUNT" envDefault:"cd-runner"`
3637
DefaultBuildLogsKeyPrefix string `env:"DEFAULT_BUILD_LOGS_KEY_PREFIX" `
3738
DefaultArtifactKeyPrefix string `env:"DEFAULT_CD_ARTIFACT_KEY_LOCATION" `
3839
TaintValue string `env:"CD_NODE_TAINTS_VALUE" envDefault:"ci"`
40+
ExternalTaintValue string `env:"EXTERNAL_CD_NODE_TAINTS_VALUE" envDefault:"ci"`
3941
DefaultBuildLogsBucket string `env:"DEFAULT_BUILD_LOGS_BUCKET" `
4042
NodeLabelSelector []string `env:"CD_NODE_LABEL_SELECTOR"`
43+
ExternalNodeLabelSelector []string `env:"EXTERNAL_CD_NODE_LABEL_SELECTOR"`
4144
CdArtifactLocationFormat string `env:"CD_ARTIFACT_LOCATION_FORMAT" envDefault:"%d/%d.zip"`
4245
DefaultNamespace string `env:"DEFAULT_CD_NAMESPACE"`
4346
DefaultImage string `env:"DEFAULT_CI_IMAGE"`
@@ -47,6 +50,7 @@ type CdConfig struct {
4750
OrchestratorHost string `env:"ORCH_HOST" envDefault:"http://devtroncd-orchestrator-service-prod.devtroncd/webhook/msg/nats"`
4851
OrchestratorToken string `env:"ORCH_TOKEN" envDefault:""`
4952
NodeLabel map[string]string
53+
ExternalNodeLabel map[string]string
5054
CloudProvider blob_storage.BlobStorageType `env:"BLOB_STORAGE_PROVIDER" envDefault:"S3"`
5155
BlobStorageEnabled bool `env:"BLOB_STORAGE_ENABLED" envDefault:"false"`
5256
BlobStorageS3AccessKey string `env:"BLOB_STORAGE_S3_ACCESS_KEY"`
@@ -74,17 +78,31 @@ type CdConfig struct {
7478
func GetCdConfig() (*CdConfig, error) {
7579
cfg := &CdConfig{}
7680
err := env.Parse(cfg)
77-
cfg.NodeLabel = make(map[string]string)
78-
for _, l := range cfg.NodeLabelSelector {
81+
if err != nil {
82+
return nil, err
83+
}
84+
cfg.NodeLabel, err = assignNodeLabelSelector(cfg.NodeLabelSelector)
85+
if err != nil {
86+
return nil, err
87+
}
88+
cfg.ExternalNodeLabel, err = assignNodeLabelSelector(cfg.ExternalNodeLabelSelector)
89+
if err != nil {
90+
return nil, err
91+
}
92+
return cfg, err
93+
}
94+
95+
func assignNodeLabelSelector(labelSelector []string) (map[string]string, error) {
96+
label := make(map[string]string)
97+
for _, l := range labelSelector {
7998
if l == "" {
8099
continue
81100
}
82101
kv := strings.Split(l, "=")
83102
if len(kv) != 2 {
84103
return nil, fmt.Errorf("invalid ci node label selector %s, it must be in form key=value, key2=val2", kv)
85104
}
86-
cfg.NodeLabel[kv[0]] = kv[1]
105+
label[kv[0]] = kv[1]
87106
}
88-
89-
return cfg, err
107+
return label, nil
90108
}

‎pkg/pipeline/CdWorkflowService.go‎

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -238,17 +238,28 @@ func (impl *CdWorkflowServiceImpl) SubmitWorkflow(workflowRequest *CdWorkflowReq
238238
workflowTemplate.Secrets = workflowSecrets
239239

240240
workflowTemplate.ServiceAccountName = impl.cdConfig.WorkflowServiceAccount
241-
workflowTemplate.NodeSelector = map[string]string{impl.cdConfig.TaintKey: impl.cdConfig.TaintValue}
242-
workflowTemplate.Tolerations = []v12.Toleration{{Key: impl.cdConfig.TaintKey, Value: impl.cdConfig.TaintValue, Operator: v12.TolerationOpEqual, Effect: v12.TaintEffectNoSchedule}}
241+
if workflowRequest.IsExtRun && impl.cdConfig.UseExternalNode {
242+
if impl.cdConfig.ExternalTaintKey != "" {
243+
workflowTemplate.NodeSelector = map[string]string{impl.cdConfig.ExternalTaintKey: impl.cdConfig.ExternalTaintValue}
244+
}
245+
workflowTemplate.Tolerations = []v12.Toleration{{Key: impl.cdConfig.ExternalTaintKey, Value: impl.cdConfig.ExternalTaintValue, Operator: v12.TolerationOpEqual, Effect: v12.TaintEffectNoSchedule}}
246+
if len(impl.cdConfig.ExternalNodeLabel) > 0 {
247+
workflowTemplate.NodeSelector = impl.cdConfig.ExternalNodeLabel
248+
}
249+
} else {
250+
if impl.cdConfig.TaintKey != "" {
251+
workflowTemplate.NodeSelector = map[string]string{impl.cdConfig.TaintKey: impl.cdConfig.TaintValue}
252+
}
253+
workflowTemplate.Tolerations = []v12.Toleration{{Key: impl.cdConfig.TaintKey, Value: impl.cdConfig.TaintValue, Operator: v12.TolerationOpEqual, Effect: v12.TaintEffectNoSchedule}}
254+
if len(impl.cdConfig.NodeLabel) > 0 {
255+
workflowTemplate.NodeSelector = impl.cdConfig.NodeLabel
256+
}
257+
}
243258
workflowTemplate.Volumes = ExtractVolumesFromCmCs(workflowConfigMaps, workflowSecrets)
244259
workflowTemplate.ArchiveLogs = storageConfigured
245260
workflowTemplate.ArchiveLogs = workflowTemplate.ArchiveLogs && !ciCdTriggerEvent.CdRequest.InAppLoggingEnabled
246261
workflowTemplate.RestartPolicy = v12.RestartPolicyNever
247262

248-
if len(impl.cdConfig.NodeLabel) > 0 {
249-
workflowTemplate.NodeSelector = impl.cdConfig.NodeLabel
250-
}
251-
252263
limitCpu := impl.cdConfig.LimitCpu
253264
limitMem := impl.cdConfig.LimitMem
254265
reqCpu := impl.cdConfig.ReqCpu

0 commit comments

Comments
 (0)