Chapter 4. Checking policy compliance

• You have configured the ROX_ENDPOINT environment variable using the following command:

  $ export ROX_ENDPOINT=<host:port> 

  1

  Copy to Clipboard Toggle word wrap

  1

  The host and port information that you want to store in the ROX_ENDPOINT environment variable.

Procedure

• Run the following command to check the build-time and deploy-time violations of your security policies in YAML deployment files:

  $ roxctl deployment check --file=<yaml_filename> \

  1

  
  --namespace=<cluster_namespace> \

  2

  
  --cluster=<cluster_name_or_id> \

  3

  
  --verbose 

  4

  Copy to Clipboard Toggle word wrap

  1

  For the <yaml_filename>, specify the YAML file with one or more deployments to send to Central for policy evaluation. You can also specify multiple YAML files to send to Central for policy evaluation by using the --file flag, for example --file=<yaml_filename1>, --file=<yaml_filename2>, and so on.

  2

  For the <cluster_namespace>, specify a namespace to enhance deployments with context information such as network policies, role-based access controls (RBACs) and services for deployments that do not have a namespace in their specification. The namespace defined in the specification is not changed. The default value is default.

  3

  For the <cluster_name_or_id>, specify the cluster name or ID that you want to use as the context for the evaluation to enable extended deployments with cluster-specific information.

  4

  By enabling the --verbose flag, you receive additional information for each deployment during the policy check. The extended information includes the RBAC permission level and a comprehensive list of network policies that is applied.

  Note

  You can see the additional information for each deployment in your JSON output, regardless of whether you enable the --verbose flag or not.

  The format is defined in the API reference. To cause Red Hat Advanced Cluster Security for Kubernetes (RHACS) to re-pull image metadata and image scan results from the associated registry and scanner, add the --force option.

  Note

  To check specific image scan results, you must have a token with both read and write permissions for the Image resource. The default Continuous Integration system role already has the required permissions.

  This command validates the following items:

  • Configuration options in a YAML file, such as resource limits or privilege options
  • Aspects of the images used in a YAML file, such as components or vulnerabilities

Procedure

• Run the following command to check the build-time violations of your security policies in images:

  $ roxctl image check --image=<image_name>

  Copy to Clipboard Toggle word wrap

  The format is defined in the API reference. To cause Red Hat Advanced Cluster Security for Kubernetes (RHACS) to re-pull image metadata and image scan results from the associated registry and scanner, add the --force option.

  Note

  To check specific image scan results, you must have a token with both read and write permissions for the Image resource. The default Continuous Integration system role already has the required permissions.

Procedure

• Run the following command to return the components and vulnerabilities found in the image in JSON format:

  $ roxctl image scan --image <image_name>

  Copy to Clipboard Toggle word wrap

  The format is defined in the API reference. To cause Red Hat Advanced Cluster Security for Kubernetes (RHACS) to re-pull image metadata and image scan results from the associated registry and scanner, add the --force option.

  Note

  To check specific image scan results, you must have a token with both read and write permissions for the Image resource. The default Continuous Integration system role already has the required permissions.