feat: add custom labels to report

deploy/helm/values.yaml

@@ -199,6 +199,10 @@ trivyOperator:
   # when including them in the Prometheus metrics
   metricsResourceLabelsPrefix: "k8s_label_"
 
+  # additionalReportLables comma-separated representation of the labels which the user wants the scanner pods to be
+  # labeled with. Example: `foo=bar,env=stage` will labeled the reports with the labels `foo: bar` and `env: stage`
+  additionalReportLables: ""
+
 trivy:
   # createConfig indicates whether to create config objects
   createConfig: true

pkg/configauditreport/builder.go

@@ -26,6 +26,7 @@ type ReportBuilder struct {
 	data                    v1alpha1.ConfigAuditReportData
 	reportTTL               *time.Duration
 	resourceLabelsToInclude []string
+	additionalReportLabels  labels.Set
 }
 
 func NewReportBuilder(scheme *runtime.Scheme) *ReportBuilder {
@@ -59,6 +60,11 @@ func (b *ReportBuilder) ReportTTL(ttl *time.Duration) *ReportBuilder {
 	return b
 }
 
+func (b *ReportBuilder) AdditionalReportLabels(additionalReportLabels map[string]string) *ReportBuilder {
+	b.additionalReportLabels = additionalReportLabels
+	return b
+}
+
 func (b *ReportBuilder) ResourceLabelsToInclude(resourceLabelsToInclude []string) *ReportBuilder {
 	b.resourceLabelsToInclude = resourceLabelsToInclude
 	return b
@@ -76,12 +82,10 @@ func (b *ReportBuilder) reportName() string {
 
 func (b *ReportBuilder) GetClusterReport() (v1alpha1.ClusterConfigAuditReport, error) {
 	labelsSet := make(labels.Set)
-	objectLabels := b.controller.GetLabels()
-	for _, labelToInclude := range b.resourceLabelsToInclude {
-		if value, ok := objectLabels[labelToInclude]; ok {
-			labelsSet[labelToInclude] = value
-		}
-	}
+	// append matching resource labels by config to report
+	kube.AppendResourceLabels(b.resourceLabelsToInclude, b.controller.GetLabels(), labelsSet)
+	// append custom labels by config to report
+	kube.AppendCustomLabels(b.additionalReportLabels, labelsSet)
 	if b.resourceSpecHash != "" {
 		labelsSet[trivyoperator.LabelResourceSpecHash] = b.resourceSpecHash
 	}
@@ -118,12 +122,10 @@ func (b *ReportBuilder) GetClusterReport() (v1alpha1.ClusterConfigAuditReport, e
 
 func (b *ReportBuilder) GetReport() (v1alpha1.ConfigAuditReport, error) {
 	labelsSet := make(labels.Set)
-	objectLabels := b.controller.GetLabels()
-	for _, labelToInclude := range b.resourceLabelsToInclude {
-		if value, ok := objectLabels[labelToInclude]; ok {
-			labelsSet[labelToInclude] = value
-		}
-	}
+	// append matching resource labels by config to report
+	kube.AppendResourceLabels(b.resourceLabelsToInclude, b.controller.GetLabels(), labelsSet)
+	// append custom labels by config to report
+	kube.AppendCustomLabels(b.additionalReportLabels, labelsSet)
 	if b.resourceSpecHash != "" {
 		labelsSet[trivyoperator.LabelResourceSpecHash] = b.resourceSpecHash
 	}

pkg/exposedsecretreport/builder.go

@@ -9,6 +9,7 @@ import (
 	"github.com/aquasecurity/trivy-operator/pkg/kube"
 	"github.com/aquasecurity/trivy-operator/pkg/trivyoperator"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/util/validation"
 	"k8s.io/utils/pointer"
@@ -24,6 +25,7 @@ type ReportBuilder struct {
 	data                    v1alpha1.ExposedSecretReportData
 	reportTTL               *time.Duration
 	resourceLabelsToInclude []string
+	additionalReportLabels  labels.Set
 }
 
 func NewReportBuilder(scheme *runtime.Scheme) *ReportBuilder {
@@ -62,6 +64,11 @@ func (b *ReportBuilder) ResourceLabelsToInclude(resourceLabelsToInclude []string
 	return b
 }
 
+func (b *ReportBuilder) AdditionalReportLabels(additionalReportLabels map[string]string) *ReportBuilder {
+	b.additionalReportLabels = additionalReportLabels
+	return b
+}
+
 func (b *ReportBuilder) reportName() string {
 	kind := b.controller.GetObjectKind().GroupVersionKind().Kind
 	name := b.controller.GetName()
@@ -78,12 +85,10 @@ func (b *ReportBuilder) Get() (v1alpha1.ExposedSecretReport, error) {
 		trivyoperator.LabelContainerName: b.container,
 	}
 
-	objectLabels := b.controller.GetLabels()
-	for _, labelToInclude := range b.resourceLabelsToInclude {
-		if value, ok := objectLabels[labelToInclude]; ok {
-			labels[labelToInclude] = value
-		}
-	}
+	// append matching resource labels by config to report
+	kube.AppendResourceLabels(b.resourceLabelsToInclude, b.controller.GetLabels(), labels)
+	// append custom labels by config to report
+	kube.AppendCustomLabels(b.additionalReportLabels, labels)
 
 	if b.hash != "" {
 		labels[trivyoperator.LabelResourceSpecHash] = b.hash

pkg/infraassessment/builder.go

@@ -26,6 +26,7 @@ type ReportBuilder struct {
 	data                    v1alpha1.InfraAssessmentReportData
 	reportTTL               *time.Duration
 	resourceLabelsToInclude []string
+	additionalReportLabels  labels.Set
 }
 
 func NewReportBuilder(scheme *runtime.Scheme) *ReportBuilder {
@@ -64,6 +65,11 @@ func (b *ReportBuilder) ResourceLabelsToInclude(resourceLabelsToInclude []string
 	return b
 }
 
+func (b *ReportBuilder) AdditionalReportLabels(additionalReportLabels map[string]string) *ReportBuilder {
+	b.additionalReportLabels = additionalReportLabels
+	return b
+}
+
 func (b *ReportBuilder) reportName() string {
 	kind := b.controller.GetObjectKind().GroupVersionKind().Kind
 	name := b.controller.GetName()
@@ -76,12 +82,10 @@ func (b *ReportBuilder) reportName() string {
 
 func (b *ReportBuilder) GetReport() (v1alpha1.InfraAssessmentReport, error) {
 	labelsSet := make(labels.Set)
-	objectLabels := b.controller.GetLabels()
-	for _, labelToInclude := range b.resourceLabelsToInclude {
-		if value, ok := objectLabels[labelToInclude]; ok {
-			labelsSet[labelToInclude] = value
-		}
-	}
+	// append matching resource labels by config to report
+	kube.AppendResourceLabels(b.resourceLabelsToInclude, b.controller.GetLabels(), labelsSet)
+	// append custom labels by config to report
+	kube.AppendCustomLabels(b.additionalReportLabels, labelsSet)
 	if b.resourceSpecHash != "" {
 		labelsSet[trivyoperator.LabelResourceSpecHash] = b.resourceSpecHash
 	}
@@ -124,12 +128,10 @@ func (b *ReportBuilder) GetReport() (v1alpha1.InfraAssessmentReport, error) {
 
 func (b *ReportBuilder) GetClusterReport() (v1alpha1.ClusterInfraAssessmentReport, error) {
 	labelsSet := make(labels.Set)
-	objectLabels := b.controller.GetLabels()
-	for _, labelToInclude := range b.resourceLabelsToInclude {
-		if value, ok := objectLabels[labelToInclude]; ok {
-			labelsSet[labelToInclude] = value
-		}
-	}
+	// append matching resource labels by config to report
+	kube.AppendResourceLabels(b.resourceLabelsToInclude, b.controller.GetLabels(), labelsSet)
+	// append custom labels by config to report
+	kube.AppendCustomLabels(b.additionalReportLabels, labelsSet)
 	if b.resourceSpecHash != "" {
 		labelsSet[trivyoperator.LabelResourceSpecHash] = b.resourceSpecHash
 	}

pkg/kube/labels.go

@@ -0,0 +1,17 @@
+package kube
+
+// AppendResourceLabels match resource labels by config and append it to report labels
+func AppendResourceLabels(configLabelsNames []string, resourceLabels map[string]string, reportLabels map[string]string) {
+	for _, labelToInclude := range configLabelsNames {
+		if value, ok := resourceLabels[labelToInclude]; ok {
+			reportLabels[labelToInclude] = value
+		}
+	}
+}
+
+// AppendCustomLabels append custom labels to report
+func AppendCustomLabels(configCustomLabels map[string]string, reportLabels map[string]string) {
+	for key, value := range configCustomLabels {
+		reportLabels[key] = value
+	}
+}

pkg/rbacassessment/builder.go

@@ -26,6 +26,7 @@ type ReportBuilder struct {
 	data                    v1alpha1.RbacAssessmentReportData
 	reportTTL               *time.Duration
 	resourceLabelsToInclude []string
+	additionalReportLabels  labels.Set
 }
 
 func NewReportBuilder(scheme *runtime.Scheme) *ReportBuilder {
@@ -64,6 +65,11 @@ func (b *ReportBuilder) ResourceLabelsToInclude(resourceLabelsToInclude []string
 	return b
 }
 
+func (b *ReportBuilder) AdditionalReportLabels(additionalReportLabels map[string]string) *ReportBuilder {
+	b.additionalReportLabels = additionalReportLabels
+	return b
+}
+
 func (b *ReportBuilder) reportName() string {
 	kind := b.controller.GetObjectKind().GroupVersionKind().Kind
 	name := b.controller.GetName()
@@ -76,12 +82,10 @@ func (b *ReportBuilder) reportName() string {
 
 func (b *ReportBuilder) GetClusterReport() (v1alpha1.ClusterRbacAssessmentReport, error) {
 	labelsSet := make(labels.Set)
-	objectLabels := b.controller.GetLabels()
-	for _, labelToInclude := range b.resourceLabelsToInclude {
-		if value, ok := objectLabels[labelToInclude]; ok {
-			labelsSet[labelToInclude] = value
-		}
-	}
+	// append matching resource labels by config to report
+	kube.AppendResourceLabels(b.resourceLabelsToInclude, b.controller.GetLabels(), labelsSet)
+	// append custom labels by config to report
+	kube.AppendCustomLabels(b.additionalReportLabels, labelsSet)
 	if b.resourceSpecHash != "" {
 		labelsSet[trivyoperator.LabelResourceSpecHash] = b.resourceSpecHash
 	}
@@ -118,12 +122,10 @@ func (b *ReportBuilder) GetClusterReport() (v1alpha1.ClusterRbacAssessmentReport
 
 func (b *ReportBuilder) GetReport() (v1alpha1.RbacAssessmentReport, error) {
 	labelsSet := make(labels.Set)
-	objectLabels := b.controller.GetLabels()
-	for _, labelToInclude := range b.resourceLabelsToInclude {
-		if value, ok := objectLabels[labelToInclude]; ok {
-			labelsSet[labelToInclude] = value
-		}
-	}
+	// append matching resource labels by config to report
+	kube.AppendResourceLabels(b.resourceLabelsToInclude, b.controller.GetLabels(), labelsSet)
+	// append custom labels by config to report
+	kube.AppendCustomLabels(b.additionalReportLabels, labelsSet)
 	if b.resourceSpecHash != "" {
 		labelsSet[trivyoperator.LabelResourceSpecHash] = b.resourceSpecHash
 	}

pkg/trivyoperator/config.go

@@ -72,6 +72,7 @@ const (
 	KeyMetricsResourceLabelsPrefix         = "metrics.resourceLabelsPrefix"
 	KeyTrivyServerURL                      = "trivy.serverURL"
 	KeyNodeCollectorImageRef               = "node.collector.imageRef"
+	KeyAdditionalReportLables              = ""
 )
 
 // ConfigData holds Trivy-operator configuration settings as a set of key-value
@@ -241,6 +242,25 @@ func (c ConfigData) GetScanJobPodTemplateLabels() (labels.Set, error) {
 	return scanJobPodTemplateLabelsMap, nil
 }
 
+func (c ConfigData) GetAdditionalReportLabels() (labels.Set, error) {
+	additionalReportLabelsStr, found := c[KeyAdditionalReportLables]
+	if !found || strings.TrimSpace(additionalReportLabelsStr) == "" {
+		return labels.Set{}, nil
+	}
+
+	additionalReportLablesMap := map[string]string{}
+	for _, annotation := range strings.Split(additionalReportLabelsStr, ",") {
+		sepByEqual := strings.Split(annotation, "=")
+		if len(sepByEqual) != 2 {
+			return labels.Set{}, fmt.Errorf("failed parsing incorrectly formatted custom scan pod template labels: %s", additionalReportLabelsStr)
+		}
+		key, value := sepByEqual[0], sepByEqual[1]
+		additionalReportLablesMap[key] = value
+	}
+
+	return additionalReportLablesMap, nil
+}
+
 func (c ConfigData) GetReportResourceLabels() []string {
 	resourceLabelsStr, found := c[KeyReportResourceLabels]
 	if !found || strings.TrimSpace(resourceLabelsStr) == "" {

pkg/vulnerabilityreport/builder.go

@@ -13,6 +13,7 @@ import (
 	batchv1 "k8s.io/api/batch/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/util/validation"
 	"k8s.io/utils/pointer"
@@ -224,6 +225,7 @@ type ReportBuilder struct {
 	data                    v1alpha1.VulnerabilityReportData
 	reportTTL               *time.Duration
 	resourceLabelsToInclude []string
+	additionalReportLabels  labels.Set
 }
 
 func NewReportBuilder(scheme *runtime.Scheme) *ReportBuilder {
@@ -262,6 +264,11 @@ func (b *ReportBuilder) ResourceLabelsToInclude(resourceLabelsToInclude []string
 	return b
 }
 
+func (b *ReportBuilder) AdditionalReportLabels(additionalReportLabels map[string]string) *ReportBuilder {
+	b.additionalReportLabels = additionalReportLabels
+	return b
+}
+
 func (b *ReportBuilder) reportName() string {
 	kind := b.controller.GetObjectKind().GroupVersionKind().Kind
 	name := b.controller.GetName()
@@ -281,13 +288,10 @@ func (b *ReportBuilder) Get() (v1alpha1.VulnerabilityReport, error) {
 	if b.hash != "" {
 		labels[trivyoperator.LabelResourceSpecHash] = b.hash
 	}
-
-	jobLabels := b.controller.GetLabels()
-	for _, labelToInclude := range b.resourceLabelsToInclude {
-		if value, ok := jobLabels[labelToInclude]; ok {
-			labels[labelToInclude] = value
-		}
-	}
+	// append matching resource labels by config to report
+	kube.AppendResourceLabels(b.resourceLabelsToInclude, b.controller.GetLabels(), labels)
+	// append custom labels by config to report
+	kube.AppendCustomLabels(b.additionalReportLabels, labels)
 
 	report := v1alpha1.VulnerabilityReport{
 		ObjectMeta: metav1.ObjectMeta{