feat: add custom labels to report

deploy/helm/README.md

@@ -87,6 +87,7 @@ The values of the `OPERATOR_NAMESPACE` and `OPERATOR_TARGET_NAMESPACES` determin
 | `scanJob.tolerations`| N/A| JSON representation of the [tolerations] to be applied to the scanner pods and node-collector so that they can run on nodes with matching taints. Example: `'[{"key":"key1", "operator":"Equal", "value":"value1", "effect":"NoSchedule"}]'`                                                                       |
 | `scanJob.nodeSelector`| N/A| JSON representation of the [nodeSelector] to be applied to the scanner pods so that they can run on nodes with matching labels. Example: `'{"example.com/node-type":"worker", "cpu-type": "sandylake"}'`                                                                                        |
 | `scanJob.automountServiceAccountToken`         | `"false"`   | the flag to enable automount for service account token on scan job. Set `"true"` to enable.                                                                                                                                                                                                     |
+| `report.additionalLables`         | `""`   |  additionalReportLables comma-separated representation of the labels which the user wants the scanner pods to be labeled with. Example: `foo=bar,env=stage` will labeled the reports with the labels `foo: bar` and `env: stage`                                                                                                                                                                                                     |
 | `scanJob.annotations`| N/A| One-line comma-separated representation of the annotations which the user wants the scanner pods to be annotated with. Example: `foo=bar,env=stage` will annotate the scanner pods with the annotations `foo: bar` and `env: stage`                                                             |
 | `scanJob.templateLabel`| N/A| One-line comma-separated representation of the template labels which the user wants the scanner pods to be labeled with. Example: `foo=bar,env=stage` will labeled the scanner pods with the labels `foo: bar` and `env: stage`                                                                 |
 | `scanJob.podTemplatePodSecurityContext`| N/A| One-line JSON representation of the template securityContext which the user wants the scanner and node collector pods to be secured with. Example: `{"RunAsUser": 1000, "RunAsGroup": 1000, "RunAsNonRoot": true}`                                                                                                 |

deploy/helm/templates/config.yaml

@@ -19,6 +19,9 @@ data:
   {{- with .Values.trivyOperator.scanJobPodTemplateLabels }}
   scanJob.podTemplateLabels: {{ . | quote }}
   {{- end }}
+  {{- with .Values.trivyOperator.additionalReportLables }}
+  report.additionalLables: {{ . | quote }}
+  {{- end }}
   {{- with .Values.trivyOperator.scanJobNodeSelector }}
   scanJob.nodeSelector: {{ . | toJson | quote }}
   {{- end }}

deploy/helm/values.yaml

@@ -199,6 +199,10 @@ trivyOperator:
   # when including them in the Prometheus metrics
   metricsResourceLabelsPrefix: "k8s_label_"
 
+  # additionalReportLables comma-separated representation of the labels which the user wants the scanner pods to be
+  # labeled with. Example: `foo=bar,env=stage` will labeled the reports with the labels `foo: bar` and `env: stage`
+  additionalReportLables: ""
+
 trivy:
   # createConfig indicates whether to create config objects
   createConfig: true

docs/getting-started/installation/configuration.md

@@ -61,6 +61,7 @@ To change the target namespace from all namespaces to the `default` namespace ed
 | `scanJob.tolerations`| N/A| JSON representation of the [tolerations] to be applied to the scanner pods and node-collector so that they can run on nodes with matching taints. Example: `'[{"key":"key1", "operator":"Equal", "value":"value1", "effect":"NoSchedule"}]'`                                                                       |
 | `scanJob.nodeSelector`| N/A| JSON representation of the [nodeSelector] to be applied to the scanner pods so that they can run on nodes with matching labels. Example: `'{"example.com/node-type":"worker", "cpu-type": "sandylake"}'`                                                                                        |
 | `scanJob.automountServiceAccountToken`         | `"false"`   | the flag to enable automount for service account token on scan job. Set `"true"` to enable.                                                                                                                                                                                                     |
+| `report.additionalLables`         | `""`   |  additionalReportLables comma-separated representation of the labels which the user wants the scanner pods to be labeled with. Example: `foo=bar,env=stage` will labeled the reports with the labels `foo: bar` and `env: stage`                                                                                                                                                                                                     |
 | `scanJob.annotations`| N/A| One-line comma-separated representation of the annotations which the user wants the scanner pods to be annotated with. Example: `foo=bar,env=stage` will annotate the scanner pods with the annotations `foo: bar` and `env: stage`                                                             |
 | `scanJob.templateLabel`| N/A| One-line comma-separated representation of the template labels which the user wants the scanner pods to be labeled with. Example: `foo=bar,env=stage` will labeled the scanner pods with the labels `foo: bar` and `env: stage`                                                                 |
 | `scanJob.podTemplatePodSecurityContext`| N/A| One-line JSON representation of the template securityContext which the user wants the scanner pods to be secured with. Example: `{"RunAsUser": 1000, "RunAsGroup": 1000, "RunAsNonRoot": true}`                                                                                                 |

pkg/configauditreport/builder.go

@@ -26,6 +26,7 @@ type ReportBuilder struct {
 	data                    v1alpha1.ConfigAuditReportData
 	reportTTL               *time.Duration
 	resourceLabelsToInclude []string
+	additionalReportLabels  labels.Set
 }
 
 func NewReportBuilder(scheme *runtime.Scheme) *ReportBuilder {
@@ -59,6 +60,11 @@ func (b *ReportBuilder) ReportTTL(ttl *time.Duration) *ReportBuilder {
 	return b
 }
 
+func (b *ReportBuilder) AdditionalReportLabels(additionalReportLabels map[string]string) *ReportBuilder {
+	b.additionalReportLabels = additionalReportLabels
+	return b
+}
+
 func (b *ReportBuilder) ResourceLabelsToInclude(resourceLabelsToInclude []string) *ReportBuilder {
 	b.resourceLabelsToInclude = resourceLabelsToInclude
 	return b
@@ -76,12 +82,10 @@ func (b *ReportBuilder) reportName() string {
 
 func (b *ReportBuilder) GetClusterReport() (v1alpha1.ClusterConfigAuditReport, error) {
 	labelsSet := make(labels.Set)
-	objectLabels := b.controller.GetLabels()
-	for _, labelToInclude := range b.resourceLabelsToInclude {
-		if value, ok := objectLabels[labelToInclude]; ok {
-			labelsSet[labelToInclude] = value
-		}
-	}
+	// append matching resource labels by config to report
+	kube.AppendResourceLabels(b.resourceLabelsToInclude, b.controller.GetLabels(), labelsSet)
+	// append custom labels by config to report
+	kube.AppendCustomLabels(b.additionalReportLabels, labelsSet)
 	if b.resourceSpecHash != "" {
 		labelsSet[trivyoperator.LabelResourceSpecHash] = b.resourceSpecHash
 	}
@@ -118,12 +122,10 @@ func (b *ReportBuilder) GetClusterReport() (v1alpha1.ClusterConfigAuditReport, e
 
 func (b *ReportBuilder) GetReport() (v1alpha1.ConfigAuditReport, error) {
 	labelsSet := make(labels.Set)
-	objectLabels := b.controller.GetLabels()
-	for _, labelToInclude := range b.resourceLabelsToInclude {
-		if value, ok := objectLabels[labelToInclude]; ok {
-			labelsSet[labelToInclude] = value
-		}
-	}
+	// append matching resource labels by config to report
+	kube.AppendResourceLabels(b.resourceLabelsToInclude, b.controller.GetLabels(), labelsSet)
+	// append custom labels by config to report
+	kube.AppendCustomLabels(b.additionalReportLabels, labelsSet)
 	if b.resourceSpecHash != "" {
 		labelsSet[trivyoperator.LabelResourceSpecHash] = b.resourceSpecHash
 	}

pkg/configauditreport/controller/nodecollector.go

@@ -147,6 +147,10 @@ func (r *NodeCollectorJobController) processCompleteScanJob(ctx context.Context,
 		return fmt.Errorf("computing policies hash: %w", err)
 	}
 	resourceLabelsToInclude := r.GetReportResourceLabels()
+	additionalCustomLabels, err := r.GetAdditionalReportLabels()
+	if err != nil {
+		return err
+	}
 	misConfigData, err := evaluate(ctx, policies, node, r.BuildInfo, r.ConfigData, r.Config, nodeInfo)
 	if err != nil {
 		return fmt.Errorf("failed to evaluate policies on Node : %w", err)
@@ -156,6 +160,7 @@ func (r *NodeCollectorJobController) processCompleteScanJob(ctx context.Context,
 		ResourceSpecHash(resourceHash).
 		PluginConfigHash(policiesHash).
 		ResourceLabelsToInclude(resourceLabelsToInclude).
+		AdditionalReportLabels(additionalCustomLabels).
 		Data(misConfigData.infraAssessmentReportData)
 	if r.Config.ScannerReportTTL != nil {
 		infraReportBuilder.ReportTTL(r.Config.ScannerReportTTL)

pkg/configauditreport/controller/resource.go

@@ -205,6 +205,10 @@ func (r *ResourceController) reconcileResource(resourceKind kube.Kind) reconcile
 		}
 
 		resourceLabelsToInclude := r.GetReportResourceLabels()
+		additionalCustomLabel, err := r.GetAdditionalReportLabels()
+		if err != nil {
+			return ctrl.Result{}, err
+		}
 
 		log.V(1).Info("Checking whether configuration audit report exists")
 		hasReport, err := r.hasReport(ctx, resourceRef, resourceHash, policiesHash)
@@ -231,6 +235,7 @@ func (r *ResourceController) reconcileResource(resourceKind kube.Kind) reconcile
 				ResourceSpecHash(resourceHash).
 				PluginConfigHash(policiesHash).
 				ResourceLabelsToInclude(resourceLabelsToInclude).
+				AdditionalReportLabels(additionalCustomLabel).
 				Data(misConfigData.configAuditReportData)
 			if r.Config.ScannerReportTTL != nil {
 				reportBuilder.ReportTTL(r.Config.ScannerReportTTL)
@@ -245,6 +250,7 @@ func (r *ResourceController) reconcileResource(resourceKind kube.Kind) reconcile
 					ResourceSpecHash(resourceHash).
 					PluginConfigHash(policiesHash).
 					ResourceLabelsToInclude(resourceLabelsToInclude).
+					AdditionalReportLabels(additionalCustomLabel).
 					Data(misConfigData.infraAssessmentReportData)
 				if r.Config.ScannerReportTTL != nil {
 					infraReportBuilder.ReportTTL(r.Config.ScannerReportTTL)
@@ -261,6 +267,7 @@ func (r *ResourceController) reconcileResource(resourceKind kube.Kind) reconcile
 				ResourceSpecHash(resourceHash).
 				PluginConfigHash(policiesHash).
 				ResourceLabelsToInclude(resourceLabelsToInclude).
+				AdditionalReportLabels(additionalCustomLabel).
 				Data(misConfigData.rbacAssessmentReportData)
 			if r.Config.ScannerReportTTL != nil {
 				rbacReportBuilder.ReportTTL(r.Config.ScannerReportTTL)

pkg/exposedsecretreport/builder.go

@@ -9,6 +9,7 @@ import (
 	"github.com/aquasecurity/trivy-operator/pkg/kube"
 	"github.com/aquasecurity/trivy-operator/pkg/trivyoperator"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/util/validation"
 	"k8s.io/utils/pointer"
@@ -24,6 +25,7 @@ type ReportBuilder struct {
 	data                    v1alpha1.ExposedSecretReportData
 	reportTTL               *time.Duration
 	resourceLabelsToInclude []string
+	additionalReportLabels  labels.Set
 }
 
 func NewReportBuilder(scheme *runtime.Scheme) *ReportBuilder {
@@ -62,6 +64,11 @@ func (b *ReportBuilder) ResourceLabelsToInclude(resourceLabelsToInclude []string
 	return b
 }
 
+func (b *ReportBuilder) AdditionalReportLabels(additionalReportLabels map[string]string) *ReportBuilder {
+	b.additionalReportLabels = additionalReportLabels
+	return b
+}
+
 func (b *ReportBuilder) reportName() string {
 	kind := b.controller.GetObjectKind().GroupVersionKind().Kind
 	name := b.controller.GetName()
@@ -74,26 +81,24 @@ func (b *ReportBuilder) reportName() string {
 }
 
 func (b *ReportBuilder) Get() (v1alpha1.ExposedSecretReport, error) {
-	labels := map[string]string{
+	reportLabels := map[string]string{
 		trivyoperator.LabelContainerName: b.container,
 	}
 
-	objectLabels := b.controller.GetLabels()
-	for _, labelToInclude := range b.resourceLabelsToInclude {
-		if value, ok := objectLabels[labelToInclude]; ok {
-			labels[labelToInclude] = value
-		}
-	}
+	// append matching resource labels by config to report
+	kube.AppendResourceLabels(b.resourceLabelsToInclude, b.controller.GetLabels(), reportLabels)
+	// append custom labels by config to report
+	kube.AppendCustomLabels(b.additionalReportLabels, reportLabels)
 
 	if b.hash != "" {
-		labels[trivyoperator.LabelResourceSpecHash] = b.hash
+		reportLabels[trivyoperator.LabelResourceSpecHash] = b.hash
 	}
 
 	report := v1alpha1.ExposedSecretReport{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      b.reportName(),
 			Namespace: b.controller.GetNamespace(),
-			Labels:    labels,
+			Labels:    reportLabels,
 		},
 		Report: b.data,
 	}

pkg/infraassessment/builder.go

@@ -26,6 +26,7 @@ type ReportBuilder struct {
 	data                    v1alpha1.InfraAssessmentReportData
 	reportTTL               *time.Duration
 	resourceLabelsToInclude []string
+	additionalReportLabels  labels.Set
 }
 
 func NewReportBuilder(scheme *runtime.Scheme) *ReportBuilder {
@@ -64,6 +65,11 @@ func (b *ReportBuilder) ResourceLabelsToInclude(resourceLabelsToInclude []string
 	return b
 }
 
+func (b *ReportBuilder) AdditionalReportLabels(additionalReportLabels map[string]string) *ReportBuilder {
+	b.additionalReportLabels = additionalReportLabels
+	return b
+}
+
 func (b *ReportBuilder) reportName() string {
 	kind := b.controller.GetObjectKind().GroupVersionKind().Kind
 	name := b.controller.GetName()
@@ -76,12 +82,10 @@ func (b *ReportBuilder) reportName() string {
 
 func (b *ReportBuilder) GetReport() (v1alpha1.InfraAssessmentReport, error) {
 	labelsSet := make(labels.Set)
-	objectLabels := b.controller.GetLabels()
-	for _, labelToInclude := range b.resourceLabelsToInclude {
-		if value, ok := objectLabels[labelToInclude]; ok {
-			labelsSet[labelToInclude] = value
-		}
-	}
+	// append matching resource labels by config to report
+	kube.AppendResourceLabels(b.resourceLabelsToInclude, b.controller.GetLabels(), labelsSet)
+	// append custom labels by config to report
+	kube.AppendCustomLabels(b.additionalReportLabels, labelsSet)
 	if b.resourceSpecHash != "" {
 		labelsSet[trivyoperator.LabelResourceSpecHash] = b.resourceSpecHash
 	}
@@ -124,12 +128,10 @@ func (b *ReportBuilder) GetReport() (v1alpha1.InfraAssessmentReport, error) {
 
 func (b *ReportBuilder) GetClusterReport() (v1alpha1.ClusterInfraAssessmentReport, error) {
 	labelsSet := make(labels.Set)
-	objectLabels := b.controller.GetLabels()
-	for _, labelToInclude := range b.resourceLabelsToInclude {
-		if value, ok := objectLabels[labelToInclude]; ok {
-			labelsSet[labelToInclude] = value
-		}
-	}
+	// append matching resource labels by config to report
+	kube.AppendResourceLabels(b.resourceLabelsToInclude, b.controller.GetLabels(), labelsSet)
+	// append custom labels by config to report
+	kube.AppendCustomLabels(b.additionalReportLabels, labelsSet)
 	if b.resourceSpecHash != "" {
 		labelsSet[trivyoperator.LabelResourceSpecHash] = b.resourceSpecHash
 	}

pkg/kube/labels.go

@@ -0,0 +1,17 @@
+package kube
+
+// AppendResourceLabels match resource labels by config and append it to report labels
+func AppendResourceLabels(configLabelsNames []string, resourceLabels map[string]string, reportLabels map[string]string) {
+	for _, labelToInclude := range configLabelsNames {
+		if value, ok := resourceLabels[labelToInclude]; ok {
+			reportLabels[labelToInclude] = value
+		}
+	}
+}
+
+// AppendCustomLabels append custom labels to report
+func AppendCustomLabels(configCustomLabels map[string]string, reportLabels map[string]string) {
+	for key, value := range configCustomLabels {
+		reportLabels[key] = value
+	}
+}

pkg/rbacassessment/builder.go

@@ -26,6 +26,7 @@ type ReportBuilder struct {
 	data                    v1alpha1.RbacAssessmentReportData
 	reportTTL               *time.Duration
 	resourceLabelsToInclude []string
+	additionalReportLabels  labels.Set
 }
 
 func NewReportBuilder(scheme *runtime.Scheme) *ReportBuilder {
@@ -64,6 +65,11 @@ func (b *ReportBuilder) ResourceLabelsToInclude(resourceLabelsToInclude []string
 	return b
 }
 
+func (b *ReportBuilder) AdditionalReportLabels(additionalReportLabels map[string]string) *ReportBuilder {
+	b.additionalReportLabels = additionalReportLabels
+	return b
+}
+
 func (b *ReportBuilder) reportName() string {
 	kind := b.controller.GetObjectKind().GroupVersionKind().Kind
 	name := b.controller.GetName()
@@ -76,12 +82,10 @@ func (b *ReportBuilder) reportName() string {
 
 func (b *ReportBuilder) GetClusterReport() (v1alpha1.ClusterRbacAssessmentReport, error) {
 	labelsSet := make(labels.Set)
-	objectLabels := b.controller.GetLabels()
-	for _, labelToInclude := range b.resourceLabelsToInclude {
-		if value, ok := objectLabels[labelToInclude]; ok {
-			labelsSet[labelToInclude] = value
-		}
-	}
+	// append matching resource labels by config to report
+	kube.AppendResourceLabels(b.resourceLabelsToInclude, b.controller.GetLabels(), labelsSet)
+	// append custom labels by config to report
+	kube.AppendCustomLabels(b.additionalReportLabels, labelsSet)
 	if b.resourceSpecHash != "" {
 		labelsSet[trivyoperator.LabelResourceSpecHash] = b.resourceSpecHash
 	}
@@ -118,12 +122,10 @@ func (b *ReportBuilder) GetClusterReport() (v1alpha1.ClusterRbacAssessmentReport
 
 func (b *ReportBuilder) GetReport() (v1alpha1.RbacAssessmentReport, error) {
 	labelsSet := make(labels.Set)
-	objectLabels := b.controller.GetLabels()
-	for _, labelToInclude := range b.resourceLabelsToInclude {
-		if value, ok := objectLabels[labelToInclude]; ok {
-			labelsSet[labelToInclude] = value
-		}
-	}
+	// append matching resource labels by config to report
+	kube.AppendResourceLabels(b.resourceLabelsToInclude, b.controller.GetLabels(), labelsSet)
+	// append custom labels by config to report
+	kube.AppendCustomLabels(b.additionalReportLabels, labelsSet)
 	if b.resourceSpecHash != "" {
 		labelsSet[trivyoperator.LabelResourceSpecHash] = b.resourceSpecHash
 	}

pkg/trivyoperator/config.go

@@ -72,6 +72,7 @@ const (
 	KeyMetricsResourceLabelsPrefix         = "metrics.resourceLabelsPrefix"
 	KeyTrivyServerURL                      = "trivy.serverURL"
 	KeyNodeCollectorImageRef               = "node.collector.imageRef"
+	KeyAdditionalReportLables              = "report.additionalLables"
 )
 
 // ConfigData holds Trivy-operator configuration settings as a set of key-value
@@ -241,6 +242,25 @@ func (c ConfigData) GetScanJobPodTemplateLabels() (labels.Set, error) {
 	return scanJobPodTemplateLabelsMap, nil
 }
 
+func (c ConfigData) GetAdditionalReportLabels() (labels.Set, error) {
+	additionalReportLabelsStr, found := c[KeyAdditionalReportLables]
+	if !found || strings.TrimSpace(additionalReportLabelsStr) == "" {
+		return labels.Set{}, nil
+	}
+
+	additionalReportLablesMap := map[string]string{}
+	for _, annotation := range strings.Split(additionalReportLabelsStr, ",") {
+		sepByEqual := strings.Split(annotation, "=")
+		if len(sepByEqual) != 2 {
+			return labels.Set{}, fmt.Errorf("failed parsing incorrectly formatted custom report labels: %s", additionalReportLabelsStr)
+		}
+		key, value := sepByEqual[0], sepByEqual[1]
+		additionalReportLablesMap[key] = value
+	}
+
+	return additionalReportLablesMap, nil
+}
+
 func (c ConfigData) GetReportResourceLabels() []string {
 	resourceLabelsStr, found := c[KeyReportResourceLabels]
 	if !found || strings.TrimSpace(resourceLabelsStr) == "" {