From 63f48874ad0baf2159a04e9fce3d96ba5d11f275 Mon Sep 17 00:00:00 2001 From: Madhu Rajanna Date: Thu, 16 Nov 2023 08:42:16 +0100 Subject: [PATCH 1/2] ci: add snyk for container image adding a github action to do security scanning for the cephcsi container image Signed-off-by: Madhu Rajanna --- .github/workflows/snyk-container-image.yaml | 43 +++++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 .github/workflows/snyk-container-image.yaml diff --git a/.github/workflows/snyk-container-image.yaml b/.github/workflows/snyk-container-image.yaml new file mode 100644 index 000000000..bbe8b39a4 --- /dev/null +++ b/.github/workflows/snyk-container-image.yaml @@ -0,0 +1,43 @@ +--- +# A workflow which checks out the code, builds a container +# image using Docker and scans that image for vulnerabilities using +# Snyk. The results are then uploaded to GitHub Security Code Scanning +# +# For more examples, including how to limit scans to only high-severity +# issues, monitor images for newly disclosed vulnerabilities in Snyk and +# fail PR checks for new vulnerabilities, see https://github.com/snyk/actions/ +name: Snyk Container +# yamllint disable-line rule:truthy +on: + schedule: + # Run weekly on every Monday + - cron: '0 0 * * 1' + push: + tags: + - v* + branches: + - release-* + +permissions: + contents: read + +jobs: + snyk: + if: github.repository == 'ceph/ceph-csi' + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Build a Docker image + run: make image-cephcsi + - name: Run Snyk to check Docker image for vulnerabilities + continue-on-error: true + uses: snyk/actions/docker@master + env: + SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} + with: + image: quay.io/cephcsi/cephcsi:${{ github.base_ref }} + args: --file=Dockerfilei + - name: Upload result to GitHub Code Scanning + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: snyk.sarif From 0c13a703639cb38b412d9bc098a4892dd6f76c22 Mon Sep 17 00:00:00 2001 From: Niels de Vos Date: Tue, 14 Nov 2023 15:49:28 +0100 Subject: [PATCH 2/2] util: include request-IDs in all gRPC calls for the Controller Snapshot procedures do not seem to contain the `Req-ID:` prefix in the logs anymore (or weren't they there at all?) for some reason. This adds them back. Signed-off-by: Niels de Vos --- internal/csi-common/server.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/csi-common/server.go b/internal/csi-common/server.go index 8dc4331a0..428473375 100644 --- a/internal/csi-common/server.go +++ b/internal/csi-common/server.go @@ -97,7 +97,7 @@ func (s *nonBlockingGRPCServer) serve(endpoint string, srv Servers) { klog.Fatalf("Failed to listen: %v", err) } - server := grpc.NewServer() + server := grpc.NewServer(NewMiddlewareServerOption(false)) s.server = server if srv.IS != nil {