Cut down feed ingress vulnerabilities #230
Conversation
To avoid talking to a real aws service. The endpoint simply returns OK on any request which feed-ingress inteprets to mean no ELB. * Define endpoint for ec2 metadata So we can make our fake-elb return a mock response for the instance metadata * Remove unused feed args This test doesn't use any ELB, so no need for feed to run on hostNetwork or define ports to receive ELB traffic from
To cut down on the attach surface and so reduce the number of vulnerabilities. alpine 3.13 shows we have 0 vulnerablities when run via trivy
This reverts commit 908f7db.
To make it clear which alpine release feed-ingress is based on.
Use trivy to fail the build when either HIGH or CRITICAL vulnerabilities are found.
|
trivy scan output based on the new image:
|
|
This commit 908f7db showed how we used |
We've now tested opentracing too and found that it works fine. The path to the jaeger plugin was wrong, so we fixed it in b102ece. |
To cut down on the attack surface
and so reduce the number of vulnerabilities.
The previous debian:strech-slim was showing a lot of vulnerabilities
that have all gone away once switching to alpine (3.13).
Also used trivy to fail the build when either HIGH or CRITICAL
vulnerabilities are found.