add CronJob to refresh NVD cve dictionary

argocd-helm-charts/vuls-dictionary/Chart.yaml

@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.2.0
+version: 0.3.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

argocd-helm-charts/vuls-dictionary/README.md

@@ -46,6 +46,28 @@ When enabled, two init containers run before the vuls server starts:
 
 Both init containers skip work if a valid database (>5 GB) already exists on the PVC.
 
+### NVD CVE dictionary (`cveDictionary`)
+
+The vuls-nightly-db carries distro advisory scores (e.g. `redhat_api`, `ubuntu_api`) but not NVD CVSS scores. A CronJob fills `/vuls/cve.sqlite3` on the results PVC with [go-cve-dictionary](https://github.com/vulsio/go-cve-dictionary) NVD data so scan results also include the `nvd` source.
+
+| Parameter | Description | Default |
+|-----------|-------------|---------|
+| `cveDictionary.enabled` | Deploy the NVD refresh CronJob | `true` |
+| `cveDictionary.image.repository` | go-cve-dictionary image | `vuls/go-cve-dictionary` |
+| `cveDictionary.image.tag` | Image tag | `v0.16.2` |
+| `cveDictionary.schedule` | Cron schedule for the refresh | `0 3 * * 0` (Sunday 03:00) |
+| `cveDictionary.resources` | Resource requests/limits | 100m/500m CPU, 256Mi/1Gi |
+
+Notes:
+
+- The first fill takes hours (unauthenticated NVD API). Trigger it manually instead of waiting for the schedule:
+  ```sh
+  kubectl create job --from=cronjob/<release>-cve-dictionary-fetch cve-fetch-initial -n <namespace>
+  ```
+- The job fetches into `cve.sqlite3.new` and swaps atomically, so the running vuls server never reads a half-written file. It keeps serving the old data until restarted — run `kubectl rollout restart deploy/<release>-vuls-server` after a refresh.
+- The NVD dataset is several GB; size `vulsServer.resultsStorage.size` with headroom on top of the ~11 GB vuls.db.
+- The job requires a node co-located with the vuls server pod (podAffinity) so the results PVC works with `ReadWriteOnce`.
+
 ### Vuls server
 
 | Parameter | Description | Default |

argocd-helm-charts/vuls-dictionary/templates/cronjob-cve-dictionary.yaml

@@ -0,0 +1,78 @@
+{{- if and .Values.vulsServer.enabled .Values.cveDictionary.enabled }}
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: {{ include "vuls-dictionary.fullname" . }}-cve-dictionary-fetch
+  labels:
+    {{- include "vuls-dictionary.labels" . | nindent 4 }}
+    app.kubernetes.io/component: cve-dictionary
+spec:
+  schedule: {{ .Values.cveDictionary.schedule | quote }}
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 2
+      # The full NVD fetch can take hours; cap it at 12h.
+      activeDeadlineSeconds: 43200
+      template:
+        metadata:
+          labels:
+            {{- include "vuls-dictionary.labels" . | nindent 12 }}
+            app.kubernetes.io/component: cve-dictionary
+        spec:
+          restartPolicy: Never
+          {{- with .Values.imagePullSecrets }}
+          imagePullSecrets:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          serviceAccountName: {{ include "vuls-dictionary.serviceAccountName" . }}
+          securityContext:
+            {{- toYaml .Values.podSecurityContext | nindent 12 }}
+          # Co-locate with the vuls server so the results PVC can stay
+          # ReadWriteOnce (same-node mounts are allowed).
+          affinity:
+            podAffinity:
+              requiredDuringSchedulingIgnoredDuringExecution:
+                - topologyKey: kubernetes.io/hostname
+                  labelSelector:
+                    matchLabels:
+                      {{- include "vuls-dictionary.selectorLabels" . | nindent 22 }}
+                      app.kubernetes.io/component: vuls-server
+          containers:
+            - name: fetch-nvd
+              securityContext:
+                {{- toYaml .Values.securityContext | nindent 16 }}
+              image: "{{ .Values.cveDictionary.image.repository }}:{{ .Values.cveDictionary.image.tag }}"
+              imagePullPolicy: {{ .Values.cveDictionary.image.pullPolicy }}
+              command: ["/bin/sh", "-c"]
+              args:
+                - |
+                  set -e
+                  # Fetch into a staging file and swap atomically so the vuls
+                  # server never reads a half-written database.
+                  if [ -f /vuls/cve.sqlite3 ]; then
+                    cp /vuls/cve.sqlite3 /vuls/cve.sqlite3.new
+                  fi
+                  go-cve-dictionary fetch nvd --dbpath /vuls/cve.sqlite3.new
+                  mv -f /vuls/cve.sqlite3.new /vuls/cve.sqlite3
+                  ls -lh /vuls/cve.sqlite3
+              volumeMounts:
+                - name: results
+                  mountPath: /vuls
+              resources:
+                {{- toYaml .Values.cveDictionary.resources | nindent 16 }}
+          volumes:
+            - name: results
+              persistentVolumeClaim:
+                claimName: {{ include "vuls-dictionary.fullname" . }}-results-pvc
+          {{- with .Values.nodeSelector }}
+          nodeSelector:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.tolerations }}
+          tolerations:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+{{- end }}

argocd-helm-charts/vuls-dictionary/values.yaml

@@ -77,6 +77,31 @@ vuls2:
     tag: "0"
     pullPolicy: IfNotPresent
 
+# NVD CVE dictionary (go-cve-dictionary). A CronJob refreshes
+# /vuls/cve.sqlite3 on the results PVC so the vuls server enriches scan
+# results with NVD CVSS scores (the "nvd" source in cveContents).
+# The full NVD dataset is several GB — make sure resultsStorage.size has
+# headroom on top of the ~11 GB vuls.db.
+# The vuls server only picks up a refreshed dictionary after a restart
+# (it holds the old file handle), so restart the deployment after a run.
+cveDictionary:
+  enabled: true
+  image:
+    repository: vuls/go-cve-dictionary
+    tag: v0.16.2
+    pullPolicy: IfNotPresent
+  # The first fill takes hours (unauthenticated NVD API). Trigger it
+  # manually instead of waiting for the schedule:
+  #   kubectl create job --from=cronjob/<release>-cve-dictionary-fetch cve-fetch-initial
+  schedule: "0 3 * * 0"
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      cpu: 500m
+      memory: 1Gi
+
 vulsServer:
   enabled: true
   image: