FWI-5394 - CI - skip scanning Repo files with YAML file parser errors (…

…#859)

* skip errored files and continue getting resources

* bump changelog and version

plugins/ci/CHANGELOG.md

@@ -1,5 +1,8 @@
 # Changelog
 
+## 5.3.2
+* Only skip failed files instead of halting the process
+
 ## 5.3.1
 * Print soft-errors to output to increase error awareness
 

plugins/ci/pkg/ci/ci.go

@@ -17,6 +17,7 @@ import (
 	"strings"
 
 	trivymodels "github.com/fairwindsops/insights-plugins/plugins/trivy/pkg/models"
+	"github.com/hashicorp/go-multierror"
 	"github.com/samber/lo"
 	"github.com/sirupsen/logrus"
 	"gopkg.in/yaml.v3"
@@ -94,23 +95,27 @@ func (ci *CIScan) Close() {
 
 // getAllResources scans a folder of yaml files and returns all of the images and resources used.
 func (ci *CIScan) getAllResources() ([]trivymodels.Image, []models.Resource, error) {
-	images := make([]trivymodels.Image, 0)
-	resources := make([]models.Resource, 0)
+	var images []trivymodels.Image
+	var resources []models.Resource
+	var errors *multierror.Error
 	err := filepath.Walk(ci.configFolder, func(path string, info os.FileInfo, err error) error {
 		if !strings.HasSuffix(info.Name(), ".yaml") && !strings.HasSuffix(info.Name(), ".yml") {
 			return nil
 		}
 
 		displayFilename, helmName, err := ci.getDisplayFilenameAndHelmName(path)
 		if err != nil {
-			return err
+			errors = multierror.Append(errors, fmt.Errorf("error getting displayFilename and helmName for file %s: %v", path, err))
+			return nil
 		}
 
-		file, err := os.Open(path)
+		fileHandler, err := os.Open(path)
 		if err != nil {
-			return fmt.Errorf("error opening file %s: %v", path, err)
+			errors = multierror.Append(errors, fmt.Errorf("error opening file %s: %v", path, err))
+			return nil
 		}
-		decoder := yaml.NewDecoder(file)
+
+		decoder := yaml.NewDecoder(fileHandler)
 		for {
 			// yaml.Node has access to the comments
 			// This allows us to get at the Filename comments that Helm leaves
@@ -119,14 +124,16 @@ func (ci *CIScan) getAllResources() ([]trivymodels.Image, []models.Resource, err
 			err = decoder.Decode(&yamlNodeOriginal)
 			if err != nil {
 				if err != io.EOF {
-					return fmt.Errorf("error decoding file %s: %v", file.Name(), err)
+					errors = multierror.Append(errors, fmt.Errorf("error decoding file %s: %v", path, err))
+					return nil
 				}
-				break
+				break // EOF
 			}
 			yamlNode := map[string]interface{}{}
 			err = yamlNodeOriginal.Decode(&yamlNode)
 			if err != nil {
-				return fmt.Errorf("error decoding[2] file %s: %v", file.Name(), err)
+				errors = multierror.Append(errors, fmt.Errorf("error decoding document %s: %v", path, err))
+				return nil
 			}
 			kind, ok := yamlNode["kind"].(string)
 			if !ok {
@@ -188,9 +195,10 @@ func (ci *CIScan) getAllResources() ([]trivymodels.Image, []models.Resource, err
 		return nil
 	})
 	if err != nil {
-		return nil, nil, err
+		errors = multierror.Append(errors, fmt.Errorf("error walking directory %s: %v", ci.configFolder, err))
+		return nil, nil, errors
 	}
-	return images, resources, nil
+	return images, resources, errors.ErrorOrNil()
 }
 
 func (ci *CIScan) getDisplayFilenameAndHelmName(path string) (string, string, error) {

plugins/ci/pkg/ci/ci_test.go

@@ -77,3 +77,17 @@ func TestHasEnvSubstitution(t *testing.T) {
 	assert.False(t, hasEnvVar("161177611123.dkr.ecr.us-east-1.amazonaws.com/fairwinds-insights-api:5541f8d19d1e0a1ae860388c8b25b737773fd6ec"))
 	assert.False(t, hasEnvVar("161177611123.dkr.ecr.us-east-1.amazonaws.com/fairwinds-insights-api:11.0.0"))
 }
+
+func TestGetAllResources(t *testing.T) {
+	ci := CIScan{configFolder: "testdata/walk", config: &models.Configuration{}}
+	images, resources, err := ci.getAllResources()
+	assert.Equal(t, err.Error(), `2 errors occurred:
+	* error decoding document testdata/walk/helm-release-pruner-yaml/templates/configmap_error.yml: yaml: unmarshal errors:
+  line 5: mapping key "kind" already defined at line 4
+	* error decoding document testdata/walk/helm-release-pruner-yaml/templates/cronjob_error.yml: yaml: unmarshal errors:
+  line 5: mapping key "kind" already defined at line 4
+
+`)
+	assert.Len(t, images, 3, "even though there are errors, we should still get the images")
+	assert.Len(t, resources, 7, "even though there are errors, we should still get the resources")
+}

plugins/ci/pkg/ci/testdata/walk/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2021 Vitor Rodrigo Vezani
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

plugins/ci/pkg/ci/testdata/walk/README.md

@@ -0,0 +1 @@
+# README file

plugins/ci/pkg/ci/testdata/walk/failing.yaml

@@ -0,0 +1,29 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment-2
+  labels:
+    app: nginx
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nginx
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      containers:
+      - name: nginx
+        image: alpine:3.13.0
+        ports:
+        - containerPort: 80
+        securityContext:
+          allowPrivilegeEscalation: true
+          privileged: true
+          readOnlyRootFilesystem: true
+          runAsNonRoot: false
+          capabilities:
+            add:
+              - ALL

plugins/ci/pkg/ci/testdata/walk/helm-release-pruner-yaml/templates/configmap_error.yml

@@ -0,0 +1,10 @@
+---
+# Source: helm-release-pruner-yaml/templates/configmap.yml
+apiVersion: v1
+kind: ConfigMap
+kind: ConfigMap
+metadata:
+  name:  RELEASE-NAME-helm-release-pruner-yaml
+data:
+  start-up.sh: |-
+    #!/bin/sh

plugins/ci/pkg/ci/testdata/walk/helm-release-pruner-yaml/templates/cronjob_error.yml

@@ -0,0 +1,57 @@
+---
+# Source: helm-release-pruner-yaml/templates/cronjob.yml
+apiVersion: batch/v1beta1
+kind: CronJob
+kind: CronJob
+metadata:
+  name: RELEASE-NAME-helm-release-pruner-yaml
+  labels:
+    app: helm-release-pruner-yaml
+    chart: helm-release-pruner-yaml-3.0.1
+    release: RELEASE-NAME
+    heritage: Helm
+spec:
+  schedule: "0 */4 * * *"
+  concurrencyPolicy: Forbid
+  startingDeadlineSeconds: 300
+  jobTemplate:
+    spec:
+      backoffLimit: 3
+      template:
+        metadata:
+          name: RELEASE-NAME-helm-release-pruner-yaml
+          labels:
+            app: helm-release-pruner-yaml
+            release: RELEASE-NAME
+        spec:
+          serviceAccountName: RELEASE-NAME-helm-release-pruner-yaml
+          restartPolicy: Never
+          containers:
+          - name: helm-release-pruner-yaml
+            image: "quay.io/fairwinds/helm-release-pruner:v3.0.1"
+            imagePullPolicy: Always
+            command: ["/usr/local/bin/start-up.sh"]
+            volumeMounts:
+            - mountPath: /usr/local/bin/start-up.sh
+              name: config
+              subPath: start-up.sh
+            securityContext:
+              readOnlyRootFilesystem: true
+              allowPrivilegeEscalation: false
+              runAsNonRoot: true
+              runAsUser: 10324
+              capabilities:
+                drop:
+                  - ALL
+            resources:
+              limits:
+                cpu: 25m
+                memory: 32Mi
+              requests:
+                cpu: 25m
+                memory: 32M
+          volumes:
+          - name: config
+            configMap:
+              name: RELEASE-NAME-helm-release-pruner-yaml
+              defaultMode: 0555

plugins/ci/pkg/ci/testdata/walk/helm-release-pruner-yaml/templates/rbac.yml

@@ -0,0 +1,36 @@
+---
+# Source: helm-release-pruner-yaml/templates/rbac.yml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: RELEASE-NAME-helm-release-pruner-yaml
+---
+# Source: helm-release-pruner-yaml/templates/rbac.yml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: RELEASE-NAME-helm-release-pruner-yaml
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  - secrets
+  verbs:
+  - delete
+  - get
+  - list
+---
+# Source: helm-release-pruner-yaml/templates/rbac.yml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: RELEASE-NAME-helm-release-pruner-yaml
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: RELEASE-NAME-helm-release-pruner-yaml
+subjects:
+- kind: ServiceAccount
+  name: RELEASE-NAME-helm-release-pruner-yaml
+  namespace: insights-agent

plugins/ci/pkg/ci/testdata/walk/nginx-flux-file.yaml

@@ -0,0 +1,28 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: default
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: nginx-ingress
+      version: ">= 0.10.2 <0.11.0"
+      sourceRef:
+        kind: HelmRepository
+        name: nginx-ingress
+        namespace: default
+      interval: 1m
+  upgrade:
+    remediation:
+      remediateLastFailure: true
+  test:
+    enable: true
+  values:
+    service:
+      grpcService: backend
+    resources:
+      requests:
+        cpu: 100m
+        memory: 64Mi 

plugins/ci/pkg/ci/testdata/walk/non-k8s-file.yml

@@ -0,0 +1,19 @@
+--- 
+calling-birds: 
+  - huey
+  - dewey
+  - louie
+  - fred
+doe: "a deer, a female deer"
+french-hens: 3
+pi: 3.14159
+ray: "a drop of golden sun"
+xmas: true
+xmas-fifth-day: 
+  calling-birds: four
+  french-hens: 3
+  golden-rings: 5
+  partridges: 
+    count: 1
+    location: "a pear tree"
+  turtle-doves: two

plugins/ci/pkg/ci/testdata/walk/passing.yaml

@@ -0,0 +1,44 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+  labels:
+    app: nginx
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: nginx
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:1.18-alpine
+        ports:
+        - containerPort: 80
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: http
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: http
+        resources:
+          requests:
+            cpu: 1000m
+            memory: 1G
+          limits:
+            cpu: 1000m
+            memory: 1G
+        securityContext:
+          allowPrivilegeEscalation: false
+          privileged: false
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          capabilities:
+            drop:
+              - ALL

plugins/ci/pkg/ci/testdata/walk/terraform/s3.tf

@@ -0,0 +1,8 @@
+resource "aws_s3_bucket" "data_exchange" {
+  bucket_prefix = var.name_prefix
+}
+
+resource "aws_s3_bucket_acl" "data_exchange" {
+  bucket = aws_s3_bucket.data_exchange.id
+  acl    = "private"
+}

plugins/ci/pkg/ci/testdata/walk/yml/failing_2.yml

@@ -0,0 +1,29 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment-2
+  labels:
+    app: nginx
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nginx
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      containers:
+      - name: nginx
+        image: alpine:3.13.0
+        ports:
+        - containerPort: 80
+        securityContext:
+          allowPrivilegeEscalation: true
+          privileged: true
+          readOnlyRootFilesystem: true
+          runAsNonRoot: false
+          capabilities:
+            add:
+              - ALL