vbatts/quay
Archived
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Merge pull request #2661 from kleesc/securityworker_cpu

Browse source 
Raise an APIRequestFailure exception when security scanner is unavail…
This commit is contained in:
Kenny Lee Sin Cheong 2017-06-03 12:15:45 -04:00 committed by GitHub
commit 1f76e9dc3b
3 changed files with 9 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
test/test_secscan.py
View file

@ -8,7 +8,7 @@ from data.database import Image, IMAGE_NOT_SCANNED_ENGINE_VERSION
from endpoints.notificationevent import VulnerabilityFoundEvent from endpoints.notificationevent import VulnerabilityFoundEvent
from endpoints.v2 import v2_bp from endpoints.v2 import v2_bp
from initdb import setup_database_for_testing, finished_database_for_testing from initdb import setup_database_for_testing, finished_database_for_testing
from util.secscan.api import SecurityScannerAPI from util.secscan.api import SecurityScannerAPI, APIRequestFailure
from util.secscan.analyzer import LayerAnalyzer from util.secscan.analyzer import LayerAnalyzer
from util.secscan.fake import fake_security_scanner from util.secscan.fake import fake_security_scanner
from util.secscan.notifier import SecurityNotificationHandler, ProcessNotificationPageResult from util.secscan.notifier import SecurityNotificationHandler, ProcessNotificationPageResult
@ -160,6 +160,7 @@ class TestSecurityScanner(unittest.TestCase):
security_scanner.set_internal_error_layer_id(security_scanner.layer_id(layer)) security_scanner.set_internal_error_layer_id(security_scanner.layer_id(layer))
analyzer = LayerAnalyzer(app.config, self.api) analyzer = LayerAnalyzer(app.config, self.api)
with self.assertRaises(APIRequestFailure) as ctx:
analyzer.analyze_recursively(layer) analyzer.analyze_recursively(layer)
layer = model.tag.get_tag_image(ADMIN_ACCESS_USER, SIMPLE_REPO, 'latest') layer = model.tag.get_tag_image(ADMIN_ACCESS_USER, SIMPLE_REPO, 'latest')

4
util/secscan/analyzer.py
View file

@ -57,7 +57,7 @@ class LayerAnalyzer(object):
except AnalyzeLayerRetryException: except AnalyzeLayerRetryException:
# Something went wrong when trying to analyze the layer, but we should retry, so leave # Something went wrong when trying to analyze the layer, but we should retry, so leave
# the layer unindexed. Another worker will come along and handle it. # the layer unindexed. Another worker will come along and handle it.
pass raise APIRequestFailure
except MissingParentLayerException: except MissingParentLayerException:
# Pass upward, as missing parent is handled in the analyze_recursively method. # Pass upward, as missing parent is handled in the analyze_recursively method.
raise raise
@ -145,7 +145,7 @@ class LayerAnalyzer(object):
try: try:
layer_data = self._api.get_layer_data(layer, include_vulnerabilities=True) layer_data = self._api.get_layer_data(layer, include_vulnerabilities=True)
except APIRequestFailure: except APIRequestFailure:
layer_data = None raise
if layer_data is not None: if layer_data is not None:
# Dispatch events for any detected vulnerabilities # Dispatch events for any detected vulnerabilities

5
workers/securityworker.py
View file

@ -10,7 +10,7 @@ from workers.worker import Worker
from data.database import UseThenDisconnect from data.database import UseThenDisconnect
from data.model.image import (get_images_eligible_for_scan, get_image_pk_field, from data.model.image import (get_images_eligible_for_scan, get_image_pk_field,
get_max_id_for_sec_scan, get_min_id_for_sec_scan) get_max_id_for_sec_scan, get_min_id_for_sec_scan)
from util.secscan.api import SecurityConfigValidator from util.secscan.api import SecurityConfigValidator, APIRequestFailure
from util.secscan.analyzer import LayerAnalyzer, PreemptedException from util.secscan.analyzer import LayerAnalyzer, PreemptedException
from util.migrate.allocator import yield_random_entries from util.migrate.allocator import yield_random_entries
from endpoints.v2 import v2_bp from endpoints.v2 import v2_bp
@ -73,6 +73,9 @@ class SecurityWorker(Worker):
except PreemptedException: except PreemptedException:
logger.info('Another worker pre-empted us for layer: %s', candidate.id) logger.info('Another worker pre-empted us for layer: %s', candidate.id)
abt.set() abt.set()
except APIRequestFailure:
logger.exception('Security scanner service unavailable')
return
unscanned_images_gauge.Set(num_remaining) unscanned_images_gauge.Set(num_remaining)