Chapter 3. Clair security scanner

Procedure

1. Install the clairctl program for a Clair deployment in an OpenShift Container Platform cluster by entering the following command:

   $ oc -n quay-enterprise exec example-registry-clair-app-64dd48f866-6ptgw -- cat /usr/bin/clairctl > clairctl

   Note

   Unofficially, the clairctl tool can be downloaded

2. Set the permissions of the clairctl file so that it can be executed and run by the user, for example:

   $ chmod u+x ./clairctl

Procedure

1. Enter the following command to retrieve and decode the configuration secret, and then save it to a Clair configuration YAML:

   $ oc get secret -n quay-enterprise example-registry-clair-config-secret  -o "jsonpath={$.data['config\.yaml']}" | base64 -d > clair-config.yaml

2. Update the clair-config.yaml file so that the disable_updaters and airgap parameters are set to true, for example:

   ---
   indexer:
     airgap: true
   ---
   matcher:
     disable_updaters: true
   ---

Procedure

1. Determine your Clair database service by using the oc CLI tool, for example:

   $ oc get svc -n quay-enterprise

   Example output

   NAME                                  TYPE           CLUSTER-IP       EXTERNAL-IP   PORT(S)                             AGE
   example-registry-clair-app            ClusterIP      172.30.224.93    <none>        80/TCP,8089/TCP                     4d21h
   example-registry-clair-postgres       ClusterIP      172.30.246.88    <none>        5432/TCP                            4d21h
   ...

2. Forward the Clair database port so that it is accessible from the local machine. For example:

   $ oc port-forward -n quay-enterprise service/example-registry-clair-postgres 5432:5432

3. Update your Clair config.yaml file, for example:

   indexer:
       connstring: host=localhost port=5432 dbname=postgres user=postgres password=postgres sslmode=disable 1
       scanlock_retry: 10
       layer_scan_concurrency: 5
       migrations: true
       scanner:
         repo:
           rhel-repository-scanner: 2
             repo2cpe_mapping_file: /data/cpe-map.json
         package:
           rhel_containerscanner: 3
             name2repos_mapping_file: /data/repo-map.json

   1

   Replace the value of the host in the multiple connstring fields with localhost.

   2

   For more information about the rhel-repository-scanner parameter, see "Mapping repositories to Common Product Enumeration information".

   3

   For more information about the rhel_containerscanner parameter, see "Mapping repositories to Common Product Enumeration information".

Procedure

1. Install the clairctl program for a self-managed Clair deployment by using the podman cp command, for example:

   $ sudo podman cp clairv4:/usr/bin/clairctl ./clairctl

2. Set the permissions of the clairctl file so that it can be executed and run by the user, for example:

   $ chmod u+x ./clairctl

Procedure

1. Create a folder for your Clair configuration file, for example:

   $ mkdir /etc/clairv4/config/

2. Create a Clair configuration file with the disable_updaters parameter set to true, for example:

   ---
   indexer:
     airgap: true
   ---
   matcher:
     disable_updaters: true
   ---

3. Start Clair by using the container image, mounting in the configuration from the file you created:

   $ sudo podman run -it --rm --name clairv4 \
   -p 8081:8081 -p 8088:8088 \
   -e CLAIR_CONF=/clair/config.yaml \
   -e CLAIR_MODE=combo \
   -v /etc/clairv4/config:/clair:Z \
   registry.redhat.io/quay/clair-rhel8:v3.13.1

Procedure

1. Determine your Clair database service by using the oc CLI tool, for example:

   $ oc get svc -n quay-enterprise

   Example output

   NAME                                  TYPE           CLUSTER-IP       EXTERNAL-IP   PORT(S)                             AGE
   example-registry-clair-app            ClusterIP      172.30.224.93    <none>        80/TCP,8089/TCP                     4d21h
   example-registry-clair-postgres       ClusterIP      172.30.246.88    <none>        5432/TCP                            4d21h
   ...

2. Forward the Clair database port so that it is accessible from the local machine. For example:

   $ oc port-forward -n quay-enterprise service/example-registry-clair-postgres 5432:5432

3. Update your Clair config.yaml file, for example:

   indexer:
       connstring: host=localhost port=5432 dbname=postgres user=postgres password=postgres sslmode=disable 1
       scanlock_retry: 10
       layer_scan_concurrency: 5
       migrations: true
       scanner:
         repo:
           rhel-repository-scanner: 2
             repo2cpe_mapping_file: /data/cpe-map.json
         package:
           rhel_containerscanner: 3
             name2repos_mapping_file: /data/repo-map.json

   1

   Replace the value of the host in the multiple connstring fields with localhost.

   2

   For more information about the rhel-repository-scanner parameter, see "Mapping repositories to Common Product Enumeration information".

   3

   For more information about the rhel_containerscanner parameter, see "Mapping repositories to Common Product Enumeration information".