Skip to content

Commit ad0cbea

Browse files
jason1028krjason1028kr
committed
test: full append
1 parent cdbdfd3 commit ad0cbea

File tree

3 files changed

+32
-32
lines changed

3 files changed

+32
-32
lines changed

‎.pipelines/templates/.builder-release-template.yaml

+16-16
Original file line numberDiff line numberDiff line change
@@ -111,17 +111,18 @@ steps:
111111
echo "##vso[task.setvariable variable=SKU_NAME]$SKU_NAME"
112112
echo "Set SKU_NAME to $SKU_NAME"
113113
displayName: Set SKU Name
114-
# - bash: make -f packer.mk run-packer
115-
# displayName: Build VHD
116-
# retryCountOnTaskFailure: 3
117-
# env:
118-
# OS_TYPE: Linux
119-
# GIT_VERSION: $(Build.SourceVersion)
120-
# BRANCH: $(Build.SourceBranch)
121-
# BUILD_NUMBER: $(Build.BuildNumber)
122-
# BUILD_ID: $(Build.BuildId)
123-
# BUILD_DEFINITION_NAME: $(Build.DefinitionName)
124-
# UA_TOKEN: $(ua-token)
114+
115+
- bash: make -f packer.mk run-packer
116+
displayName: Build VHD
117+
retryCountOnTaskFailure: 3
118+
env:
119+
OS_TYPE: Linux
120+
GIT_VERSION: $(Build.SourceVersion)
121+
BRANCH: $(Build.SourceBranch)
122+
BUILD_NUMBER: $(Build.BuildNumber)
123+
BUILD_ID: $(Build.BuildId)
124+
BUILD_DEFINITION_NAME: $(Build.DefinitionName)
125+
UA_TOKEN: $(ua-token)
125126

126127
- bash: |
127128
PACKER_VNET_RESOURCE_GROUP_NAME="$(cat vhdbuilder/packer/settings.json | grep "vnet_resource_group_name" | awk -F':' '{print $2}' | awk -F'"' '{print $2}')" && \
@@ -137,11 +138,11 @@ steps:
137138
echo "##vso[task.setvariable variable=SIG_IMAGE_NAME]${SIG_IMAGE_NAME}" && \
138139
echo "##vso[task.setvariable variable=CAPTURED_SIG_VERSION]${CAPTURED_SIG_VERSION}" && \
139140
echo "##vso[task.setvariable variable=IMPORTED_IMAGE_NAME]$(cat vhdbuilder/packer/settings.json | grep "imported_image_name" | awk -F':' '{print $2}' | awk -F'"' '{print $2}')" && \
140-
echo "##vso[task.setvariable variable=OS_DISK_URI]" && \
141-
echo "##vso[task.setvariable variable=MANAGED_SIG_ID]/subscriptions/c4c3550e-a965-4993-a50c-628fd38cd3e1/resourceGroups/aksvhdtestbuildrg/providers/Microsoft.Compute/galleries/PackerSigGalleryEastUS/images/2204containerd/versions/1.1738120749.14404" && \
142-
echo "##vso[task.setvariable variable=SIG_GALLERY_NAME]PackerSigGalleryEastUS" && \
141+
echo "##vso[task.setvariable variable=OS_DISK_URI]$(cat packer-output | grep "OSDiskUri:" | cut -d " " -f 2)" && \
142+
echo "##vso[task.setvariable variable=MANAGED_SIG_ID]$(cat packer-output | grep "ManagedImageSharedImageGalleryId:" | cut -d " " -f 2)" && \
143+
echo "##vso[task.setvariable variable=SIG_GALLERY_NAME]$(cat vhdbuilder/packer/settings.json | grep "sig_gallery_name" | awk -F':' '{print $2}' | awk -F'"' '{print $2}')" && \
143144
echo "##vso[task.setvariable variable=PERFORMANCE_DATA_FILE]vhd-build-performance-data.json" && \
144-
echo "##vso[task.setvariable variable=PKR_RG_NAME]aksvhdtestbuildrg" && \
145+
echo "##vso[task.setvariable variable=PKR_RG_NAME]$(cat packer-output | grep "ResourceGroupName" | cut -d "'" -f 2 | head -1)" && \
145146
echo "##vso[task.setvariable variable=IS_NOT_1804]$( [[ "${OS_VERSION}" != "18.04" ]] && echo true || echo false )" && \
146147
echo "##vso[task.setvariable variable=OS_NAME]Linux" && \
147148
echo "##vso[task.setvariable variable=OS_TYPE]Linux" && \
@@ -171,7 +172,6 @@ steps:
171172
PACKER_VNET_NAME: $(PACKER_VNET_NAME)
172173
SKIP_SCANNING: $(SKIP_SCANNING)
173174
DRY_RUN: $(DRY_RUN)
174-
DEFAULT_WORKING_DIRECTORY: $(System.DefaultWorkingDirectory)
175175

176176
- task: PublishPipelineArtifact@0
177177
condition: always()

‎vhdbuilder/packer/trivy-scan.sh

+7-2
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ export SYSTEM_TEAMPROJECT=${27}
4242
export BUILD_BUILDID=${28}
4343
export IMAGE_VERSION=${29}
4444
CVE_DIFF_UPLOAD_REPORT_NAME=${30}
45+
SCAN_RESOURCE_PREFIX=${31}
4546

4647
retrycmd_if_failure() {
4748
retries=$1; wait_sleep=$2; timeout=$3; shift && shift && shift
@@ -133,7 +134,7 @@ rm "trivy_${TRIVY_VERSION}_${TRIVY_ARCH}.tar.gz"
133134
chmod a+x trivy
134135

135136
# pull vuln-to-kusto binary
136-
MODULE_VERSION="v0.0.3-03a822ef770"
137+
MODULE_VERSION="v0.0.3-a60608e7896"
137138
az storage blob download --auth-mode login --account-name ${ACCOUNT_NAME} -c vuln-to-kusto \
138139
--name ${MODULE_VERSION}/${MODULE_NAME}_linux_${GO_ARCH} \
139140
--file ./${MODULE_NAME}
@@ -190,15 +191,19 @@ for CONTAINER_IMAGE in $IMAGE_LIST; do
190191
fi
191192
done
192193

193-
./vuln-to-kusto-vhd query-report query-diff 12h\
194+
./vuln-to-kusto-vhd query-report query-diff 24h \
194195
--vhd-vhdname=${VHD_ARTIFACT_NAME} \
196+
--vhd-nodeimageversion=${IMAGE_VERSION} \
197+
--severity="HIGH" \
198+
--scan-resource-prefix=${SCAN_RESOURCE_PREFIX} \
195199
--kusto-endpoint=${KUSTO_ENDPOINT} \
196200
--kusto-database=${KUSTO_DATABASE} \
197201
--kusto-table=${KUSTO_TABLE} \
198202
--kusto-managed-identity-client-id=${UMSI_CLIENT_ID} >> ${CVE_DIFF_QUERY_OUTPUT_PATH}
199203

200204
rm ./trivy
201205

206+
chmod a+r "${CVE_DIFF_QUERY_OUTPUT_PATH}"
202207
chmod a+r "${TRIVY_REPORT_ROOTFS_JSON_PATH}"
203208
chmod a+r "${TRIVY_REPORT_IMAGE_TABLE_PATH}"
204209

‎vhdbuilder/packer/vhd-scanning.sh

+9-14
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,10 @@ SIG_CONTAINER_NAME="vhd-scans"
2222
SCAN_VM_ADMIN_USERNAME="azureuser"
2323

2424
RELEASE_NOTES_FILEPATH="${DEFAULT_WORKING_DIRECTORY}/release-notes.txt"
25-
# if [ ! -f "${RELEASE_NOTES_FILEPATH}" ]; then
26-
# echo "${RELEASE_NOTES_FILEPATH} does not exist"
27-
# exit 1
28-
# fi
25+
if [ ! -f "${RELEASE_NOTES_FILEPATH}" ]; then
26+
echo "${RELEASE_NOTES_FILEPATH} does not exist"
27+
exit 1
28+
fi
2929

3030
# we must create VMs in a vnet subnet which has access to the storage account, otherwise they will not be able to access the VHD blobs
3131
SCANNING_SUBNET_ID="/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${PACKER_VNET_RESOURCE_GROUP_NAME}/providers/Microsoft.Network/virtualNetworks/${PACKER_VNET_NAME}/subnets/scanning"
@@ -59,7 +59,7 @@ function cleanup() {
5959
echo "Deleting resource group ${RESOURCE_GROUP_NAME}"
6060
az group delete --name $RESOURCE_GROUP_NAME --yes --no-wait
6161
}
62-
trap cleanup EXIT
62+
# trap cleanup EXIT
6363
capture_benchmark "${SCRIPT_NAME}_set_variables_and_create_scan_resource_group"
6464

6565
# VM_OPTIONS="--size Standard_D8ds_v5"
@@ -151,7 +151,8 @@ az vm run-command invoke \
151151
"SYSTEM_TEAMPROJECT"=${SYSTEM_TEAMPROJECT} \
152152
"BUILDID"=${BUILD_ID} \
153153
"IMAGE_VERSION"=${IMAGE_VERSION} \
154-
"CVE_DIFF_UPLOAD_REPORT_NAME"=${CVE_DIFF_UPLOAD_REPORT_NAME}
154+
"CVE_DIFF_UPLOAD_REPORT_NAME"=${CVE_DIFF_UPLOAD_REPORT_NAME} \
155+
"SCAN_RESOURCE_PREFIX"=${SCAN_RESOURCE_PREFIX}
155156

156157
capture_benchmark "${SCRIPT_NAME}_run_az_scan_command"
157158

@@ -165,14 +166,8 @@ az storage blob delete --account-name ${STORAGE_ACCOUNT_NAME} --container-name $
165166

166167
capture_benchmark "${SCRIPT_NAME}_download_and_delete_blobs"
167168

168-
if [ ! -f "${RELEASE_NOTES_FILEPATH}" ]; then
169-
echo "${RELEASE_NOTES_FILEPATH} does not exist"
170-
exit 1
171-
fi
172-
173-
echo "This is a new line" >> ${RELEASE_NOTES_FILEPATH}
174-
175-
cat ${RELEASE_NOTES_FILEPATH}
169+
echo "=== CVEs fixed in version: ${IMAGE_VERSION}"
170+
cat cve-diff.txt >> ${RELEASE_NOTES_FILEPATH}
176171

177172
echo -e "Trivy Scan Script Completed\n\n\n"
178173
capture_benchmark "${SCRIPT_NAME}_overall" true

0 commit comments

Comments
 (0)