openshift / openshift/tls-scanner

Allow component filtering by pod label or image labels

Open
#57 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

lifecycle/frozen
Dominant language
Go
Stars
5
Forks
29
Avg merge
2h 37m
Merged PRs (30d)
2

Description

Issue

The switch component-filter is a comma delimited list which appears to be an explicit map to the image name of the container being scanned. This restricts configuring the scanner for use in CI environments in order to automate testing. For example, the cluster-logging-operator uses OpenShift CI to build images for every PR and run E2E tests. The images are tagged like 2026-05-07T15:15:38.513331598Z Successfully pushed image-registry.openshift-image-registry.svc:5000/ci-op-20mi4b8l/pipeline@sha256:617a8a3225bffaf8c108a03e58d3054738c20bd3a812729afd114b91208b55a9 where the name does not match the actual component which complicates writing an automated test. Additionally, this should speed up the scan as there should be no need to analyze every image in the cluster:

2026/05/08 14:39:16 Getting all pods from the cluster...
2026/05/08 14:39:16 Skipping pod openshift-logging/tls-scanner-zn6zz: no IP address assigned (phase: Pending)
2026/05/08 14:39:16 Found 80 pods in the cluster (with IP addresses)
2026/05/08 14:39:16 IP discovery summary: 80 total IPs across 80 pods (58 unique IPs).
2026/05/08 14:39:16 Filtering pods by component name(s): cluster-logging-operator,eventrouter,log-file-metric-exporter,vector
2026/05/08 14:39:16 Analyzing OpenShift image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:e654a79ed101e8027fe3237ffc3dfb59c33bd2ab533d7e0df4110d5fcea4bea8
2026/05/08 14:39:16 Successfully parsed component info from image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:e654a79ed101e8027fe3237ffc3dfb59c33bd2ab533d7e0df4110d5fcea4bea8 -> openshift-component

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the component-filter switch and the pod-discovery and filtering path reflected in the issue logs. Trace how component names are matched to image names, then determine how pod labels and image labels should select components without scanning unrelated images. Done means both label-based filtering modes work while existing component-name filtering remains intact.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
cli, devtools
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
50/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.