[FEATURE] Add CI to scan docker image vulnerabilities

[ChenYi015]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

What is the outcome that you are trying to reach?

Describe the solution you would like

Describe alternatives you have considered

Additional context

[ImpSy]

Hey 👋

I've already a fully functioning scanning pipeline on my company fork, would you be interested in a contribution for this ?
It's build around trivy

It's important to note before activating it that you'll mostly pickup security errors from the spark base image
Patching JVM related issue could be out-of-scope for this project

A daily/weekly rebuild of the image + a dependabot like tool to upgrade the base spark image to the latest version could also replace/compliment this feature

[ChenYi015]

@ImpSy It would be great if you are willing to contribute this CI, there is an issue #2152 related to the image vulnerabilities.

A daily/weekly rebuild of the image + a dependabot like tool to upgrade the base spark image to the latest version could also replace/compliment this feature

Totally agree, we should use the latest spark base image to rebuild spark operator images.

[jacobsalway]

I'd need to research whether there's anything else in the apache/spark image that the operator depends on, but it's possible we may be able to construct a different base image that downloads the Spark JARs separately (from Maven for example). This may reduce the surface area of CVEs but would obviously be more effort to maintain.

If there are a significant number of users of the Spark operator who need the final image to have no critical or high CVEs for example, this may be worth the maintenance effort.

[ChenYi015]

Close this issue by #2177.