Feature Request: allow selecting projects and repos to be scanned by IMAGE_SCAN_ALL

dkulchinsky commented 2 years ago

Is your feature request related to a problem? Please describe. We would like to be able to exclude certain projects from being scanned for vulnerabilities when the IMAGE_SCAN_ALL scheduled job runs.

Specifically, we have two use cases where scanning is just a waste of resources and time:

Image layers cache storage - we use Kaniko in our CI to build and publish container images to Harbor, and we have a dedicated Project in Harbor where we store layers as cache (this is a feature in Kaniko and is other similar tools), these caches are used to speed up subsequent builds.
Playground project - used as a place where teams can store experimental images that they use in various early development cycles, there's no point in scanning them (for us) since these can't be deployed anywhere.

Describe the solution you'd like When scheduling the "Scan All" job, we would like to either select All projects, or a subset of Projects for the scanning.

I think it would also be relevant to be able have inclusion/exclusion rules to filter (or filter out) specific repos in the selected projects.

Describe the main design/architecture of your solution UI - select all or subset of projects to be scanned during "Scan All", have include/exclude rules to also filter based on repo names. API - allow the same to be configured via the API

Describe the development plan you've considered N/A

Additional context N/A

bitsf commented 2 years ago

Not if this is a strong requirement in community ?

dkulchinsky commented 2 years ago

Not if this is a strong requirement in community ?

Not sure I understand the comment, is this a question or a statement? Do you find this use case scenario relevant/ reasonable?

github-actions[bot] commented 2 years ago

This issue is being marked stale due to a period of inactivity. If this issue is still relevant, please comment or remove the stale label. Otherwise, this issue will close in 30 days.

dkulchinsky commented 2 years ago

still relevant

twhiteman commented 11 months ago

Project level scanning (with per-project repository include/exclude filters) would be a beneficial improvement for our use case as well. We have a lot of projects/images, some projects we want to have scanned for vulnerabilities and for others we don't need it.

twhiteman commented 11 months ago

Similar to issues #15164 and #12140.

goharbor / harbor

Feature Request: allow selecting projects and repos to be scanned by IMAGE_SCAN_ALL #15652