Chapter 12. Examining images for vulnerabilities

Procedure

1. In the cluster where Central is installed, in the console, click Ecosystem Installed Operators and select the RHACS Operator.
2. Click Central in the menu bar.
3. Click the name of the cluster where Central was installed. The default value is stackrox-central-services.
4. Click the YAML tab.

5. Edit the YAML file as shown in the following example:

     scannerV4:
       scannerComponent: Enabled

   Copy to Clipboard Toggle word wrap

Procedure

1. In the secured cluster, click Ecosystem Installed Operators and select the RHACS Operator.
2. Click Secured Cluster in the menu bar.
3. Click the default cluster name, stackrox-secured-cluster-services, or the name that you entered during installation.
4. Click the YAML tab.

5. Edit the YAML file as shown in the following example:

     scannerV4:
       scannerComponent: AutoSense

   Copy to Clipboard Toggle word wrap

Procedure

1. On the cluster where Central is installed, run the following command, using the instructions in "Changing configuration options after deploying the central-services Helm chart" if you need more information:

   $ helm upgrade -n stackrox \
       stackrox-central-services rhacs/central-services \
       --reuse-values \
       -f <path_to_values_public.yaml> \
       -f <path_to_generated-values.yaml> \
       --set scannerV4.disable=false

   Copy to Clipboard Toggle word wrap

   where:

   <path_to_generated-values.yaml>

   Specifies the path to the generated values YAML file. When updating the system and installing a new component, you must provide the internal CA. See "Retrieving the automatically generated certificate authority".

Procedure

1. On the secured cluster, run the following command, using the instructions in "Configuring the secured-cluster-services Helm chart with customizations" if you need more information:

   $ helm upgrade -n stackrox \
       stackrox-central-services rhacs/secured-cluster-services \
       --reuse-values \
       -f <path_to_values_public.yaml> \
       -f <path_to_generated-values.yaml> \
       --set scannerV4.disable=false

   Copy to Clipboard Toggle word wrap

   where:

   <path_to_generated-values.yaml>

   Specifies the path to the generated values YAML file. When updating the system and installing a new component, you must provide the internal CA. See "Retrieving the automatically generated certificate authority".

1. Only supported in the StackRox Scanner.
2. Only supported in Scanner V4.
3. Images older than June 2020 are not supported in Scanner V4.

1. Only supported in Scanner V4.

Procedure

1. Set the VM feature flag environment variable ROX_VIRTUAL_MACHINES=true on the following components:

   • Central container in the Central pod
   • Sensor container in the Sensor pod
   • Compliance container in the Collector pod

2. Enable vsock support in RHOCPV by adding the following annotation:

   metadata:
    annotations:
      kubevirt.kubevirt.io/jsonpatch: |-
        [
          {
            "op":"add",
            "path":"/spec/configuration/developerConfiguration/featureGates/-",
            "value":"VSOCK"
          }
        ]

   Copy to Clipboard Toggle word wrap

   You can add the annotation by editing the CR manually. For example, you can apply a JSON patch by entering the following command:

   $ cat << EOF | kubectl apply -f -
   apiVersion: hco.kubevirt.io/v1beta1
   kind: HyperConverged
   metadata:
     name: kubevirt-hyperconverged
     namespace: openshift-cnv
     annotations:
       kubevirt.kubevirt.io/jsonpatch: |-
         [
           {
             "op":"add",
             "path":"/spec/configuration/developerConfiguration/featureGates/-",
             "value":"VSOCK"
           }
         ]
   spec: {}
   EOF

   Copy to Clipboard Toggle word wrap

Procedure

1. In the RHACS portal, click Platform Configuration Clusters.
2. In the Clusters view header, click Delegated scanning.

3. In the Delegated Image Scanning page, provide the following information:

   • Delegate scanning for: To choose the scope of the image delegation, select one of the following options:

     • None: The default option. This option specifies that the secured clusters do not scan any images, except for images from the integrated OpenShift image registry.
     • All registries: This option indicates that the secured clusters scan all the images.
     • Specified registries: This option specifies the images that secured clusters should scan based on the registries list.
   • Select default cluster to delegate to: From the drop-down list, select the name of the default cluster. The default cluster processes the scan requests coming from the command-line interface (CLI) and API. This is optional and you can select None if required.

   • Optional: To specify the source registry and destination cluster details, click Add registry.

     For example, specify the source registry as example.com, and select remote from the drop-down list for the destination cluster. You can add more than one source registry and destination cluster if required.

     Important

     You can select the destination cluster as None if the scan requests are not coming from the CLI and API.

4. Click Save.

Procedure

1. In the RHACS portal, click Vulnerability Management Results.
2. Click More Views Inactive images.

3. Optional: Choose the appropriate method to view the component and advisory data associated with a CVE:

   • To view the component and advisory data associated with a CVE from the list of CVEs, complete the following steps:

     1. Click the <number> CVEs tab.

     2. In the list of CVEs, click a CVE to do any of the following tasks:

        • To view the component and advisory data associated with an image:

          1. Click the <number> Images tab.

          2. Expand the image.

             You can find the component data in the Component column, and you can find the advisory data in the Advisory column.

        • To view the component and advisory data associated with a deployment:

          1. Click the <number> Deployments tab.

          2. Expand the deployment.

             You can find the component data in the Component column, and you can find the advisory data in the Advisory column.

   • To view the component and advisory data associated with a CVE from the list of images, complete the following steps:

     1. Click the <number> Images tab.
     2. In the list of images, click an image.

     3. To view the component and advisory data associated with a CVE, expand the CVE.

        You can find the component data in the Component column, and you can find the advisory data in the Advisory column.

   • To view the component and advisory data associated with a CVE from the list of deployments, complete the following steps:

     1. Click the <number> Deployments tab.
     2. In the list of deployments, click a deployment.

     3. To view the component and advisory data associated with a CVE, expand the CVE.

        You can find the component data in the Component column, and you can find the advisory data in the Advisory column.

4. Click Manage watched images.
5. In the Image name field, enter the fully-qualified image name that begins with the registry and ends with the image tag, for example, docker.io/library/nginx:latest.
6. Click Add image to watch list.

7. Optional: To remove a watched image, locate the image in the Manage watched images window, and click Remove watch.

   Important

   In the RHACS portal, click Platform Configuration System Configuration to view the data retention configuration.

   All the data related to the image removed from the watched image list continues to appear in the RHACS portal for the number of days mentioned on the System Configuration page and is only removed after that period is over.

8. Click Close to return to the Inactive images page.

Procedure

1. Select Platform Configuration Base Images and click Add base image.

2. Enter the path to the base image repository, including the repository address and the image tag, in the format <hostname>/<project-id>/<repository-name>:<tag>. You can include a pattern to filter the tag, including using * to match any sequence of nonseparator characters or ? to match any single nonseparator character. For more filtering syntax information, see the Go filepath match documentation. For example, registry.redhat.io/ubi9:9.* would add Red Hat Universal Base Image 9 images with tags starting with 9.

   Note

   To prevent undue system resource use, RHACS only tracks information for the most recent 100 tags.

3. Click Save. The list of base images is compared against the repository and tags are updated every 4 hours.