feat: azure workload identity support (aquasecurity#1267)

* feat: azure workload identity support Signed-off-by: chenk <hen.keinan@gmail.com> * feat: azure workload identity support Signed-off-by: chenk <hen.keinan@gmail.com> * feat: azure workload identity support Signed-off-by: chenk <hen.keinan@gmail.com> * feat: azure workload identity support Signed-off-by: chenk <hen.keinan@gmail.com> * feat: azure workload identity support Signed-off-by: chenk <hen.keinan@gmail.com> * feat: workload identity support Signed-off-by: chenk <hen.keinan@gmail.com> --------- Signed-off-by: chenk <hen.keinan@gmail.com>
DigitecGalaxus · Jun 8, 2023 · 63b6dd9 · 63b6dd9
1 parent c86f7e1
commit 63b6dd9
Show file tree

Hide file tree

Showing 5 changed files with 36 additions and 2 deletions.
diff --git a/deploy/helm/templates/config.yaml b/deploy/helm/templates/config.yaml
@@ -25,9 +25,13 @@ data:
   {{- with .Values.nodeCollector.excludeNodes }}
   nodeCollector.excludeNodes: {{ . | quote }}
   {{- end }}
+  {{- if .Values.trivyOperator.azureWorkloadIdentity }}
+  scanJob.podTemplateLabels: {{ printf "azure.workload.identity/use=true,%s" .Values.trivyOperator.scanJobPodTemplateLabels | quote }}
+  {{- else }}
   {{- with .Values.trivyOperator.scanJobPodTemplateLabels }}
   scanJob.podTemplateLabels: {{ . | quote }}
   {{- end }}
+  {{- end }}
   {{- with .Values.trivyOperator.additionalReportLabels }}
   report.additionalLabels: {{ . | quote }}
   {{- end }}

diff --git a/deploy/helm/templates/rbac.yaml b/deploy/helm/templates/rbac.yaml
@@ -7,10 +7,22 @@ metadata:
   namespace: {{ include "trivy-operator.namespace" . }}
   labels:
     {{- include "trivy-operator.labels" . | nindent 4 }}
-  {{- with .Values.serviceAccount.annotations }}
+     {{- if .Values.trivyOperator.azureWorkloadIdentity}}
+    {{- range $name, $value := .Values.trivyOperator.azureWorkloadIdentityUseLabel }}
+    {{ $name }}: {{ $value | quote }}
+    {{- end -}}
+     {{- end }}
+    {{- if or .Values.serviceAccount.annotations .Values.trivyOperator.azureWorkloadIdentity }}
   annotations:
+   {{- end }}
+   {{- with .Values.serviceAccount.annotations }}
     {{- . | toYaml | nindent 4 }}
   {{- end }}
+    {{- if .Values.trivyOperator.azureWorkloadIdentity}}
+     {{- range $name, $value := .Values.trivyOperator.azureWorkloadIdentityAnnotation }}
+    {{ $name }}: {{ $value | quote }}
+    {{- end -}}
+    {{- end }}
 {{- end }}
 
 {{- if .Values.rbac.create }}

diff --git a/deploy/helm/values.yaml b/deploy/helm/values.yaml
@@ -212,6 +212,13 @@ trivyOperator:
   # labeled with. Example: `foo=bar,env=stage` will labeled the reports with the labels `foo: bar` and `env: stage`
   additionalReportLabels: ""
 
+  # azureWorkloadIdentity if enable azure workload identity annotation and labels wil be added to trivy-operator service account and scan job must be used with azureWorkloadIdentityClientID, azurerkloadIdentityTenantID and azureWorkloadIdentityUseAnnotation
+  azureWorkloadIdentity: false
+  # azureWorkloadIdentityAnnotation annotation to be added to trivy-operator service account it is required to update the values of : <tenant-id> and <client-id>
+  azureWorkloadIdentityAnnotation: {azure.workload.identity/client-id: client-id, azure.workload.identity/tenant-id: tenant-id}
+  # azureWorkloadIdentityUseLabel label to be added to trivy-operator service account
+  azureWorkloadIdentityUseLabel: {azure.workload.identity/use: true}
+
 trivy:
   # createConfig indicates whether to create config objects
   createConfig: true

diff --git a/pkg/trivyoperator/config.go b/pkg/trivyoperator/config.go
@@ -279,7 +279,8 @@ func (c ConfigData) GetScanJobPodTemplateLabels() (labels.Set, error) {
 	}
 
 	scanJobPodTemplateLabelsMap := map[string]string{}
-	for _, annotation := range strings.Split(scanJobPodTemplateLabelsStr, ",") {
+	labelParts := strings.Split(strings.TrimSuffix(scanJobPodTemplateLabelsStr, ","), ",")
+	for _, annotation := range labelParts {
 		sepByEqual := strings.Split(annotation, "=")
 		if len(sepByEqual) != 2 {
 			return labels.Set{}, fmt.Errorf("failed parsing incorrectly formatted custom scan pod template labels: %s", scanJobPodTemplateLabelsStr)

diff --git a/pkg/trivyoperator/config_test.go b/pkg/trivyoperator/config_test.go
@@ -459,6 +459,16 @@ func TestConfigData_GetScanJobPodTemplateLabels(t *testing.T) {
 		expected    labels.Set
 		expectError string
 	}{
+		{
+			name: "scan job template labels with additional comma at the end can be fetched successfully",
+			config: trivyoperator.ConfigData{
+				"scanJob.podTemplateLabels": "a.b=c.d/e,foo=bar,",
+			},
+			expected: labels.Set{
+				"foo": "bar",
+				"a.b": "c.d/e",
+			},
+		},
 		{
 			name: "scan job template labels can be fetched successfully",
 			config: trivyoperator.ConfigData{