Setup trivy for vulnerability scanning

[srm09]

/kind feature

Describe the solution you'd like
CAPI has trivy to get an early signal on CVE vulnerabilities:
kubernetes-sigs/cluster-api#7604 related issue in the CAPI repo
kubernetes-sigs/cluster-api#7632 has links to other similar issues for some other providers

We should have a similar setup for CAPV PRs and make it not required, so even if it fails we could get the PR merged and open a follow up PR to remediate the issue.

Anything else you would like to add:
n/a

/priority important-soon
/lifecycle active

[PatrickLaabs]

Seems like CAPI and the AWS-Provider do run the scans with a cron defined in the GitHub action yaml.

I like the idea of having a scan on new releases as soon as the pr kicks off, and also on we weekly basis.
Maybe both ways are good to have?

Which images should be included from https://console.cloud.google.com/gcr/images/cluster-api-provider-vsphere ?
Only the ones inside the release-folder?

Best
Patrick

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[zhanggbj]

Hey @srm09, is this still a valid issue, if it is true, I would like to work on it.

[killianmuldoon]

@zhanggbj I think this should be done now and closed with a few PRs that merged yesterday - e.g. #1978, #1909, #1908.

We could close this now IMO.

[sbueringer]

Yup looks good. @zhanggbj Sorry wasn't aware of this issue when we did the PRs.

I'll follow-up with some PRs to fix the found CVE's:

• [release-1.5] 🌱 Bump docker/distribution to v2.8.2 and golang.org/x/net to v0.7.0 #1989
• [release-1.6] 🌱 Bump docker/distribution to v2.8.2 #1988

[sbueringer]

/close

[k8s-ci-robot]

@sbueringer: Closing this issue.

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.