Vulnerability configuration reference

Use the following tables to configure vulnerability reporting fields and environment variable overrides for Red Hat Edge Manager.

Configuration fields
Copy link

The following table describes fields under the vulnerabilityReporting key in Helm values or /etc/flightctl/service-config.yaml.

Field Type Default Description
backend string trustify Vulnerability data source to use. Accepted values: trustify, quay. Set to quay to use Quay and Clair instead of Red Hat Trusted Profile Analyzer.
enabled boolean false Enables vulnerability sync and API endpoints.
syncInterval duration 15m Interval between sync runs. Use Go duration syntax (for example, 15m, 1h).
trustify.endpoint string Not set Red Hat Trusted Profile Analyzer API base URL. Required when enabled is true.
trustify.auth.mode string none Authentication mode: none or client-credentials.
trustify.auth.oidcIssuerUrl string Not set OIDC issuer URL when mode is client-credentials.
trustify.auth.clientId string Not set OAuth2 client ID for Podman deployments.
trustify.auth.clientSecret string Not set OAuth2 client secret for Podman deployments.
trustify.auth.secretName string Not set Kubernetes secret name with client_id and client_secret keys for Helm deployments.
trustify.caFile string Not set Path to a CA bundle for verifying the Trustify server TLS certificate.
trustify.skipTlsVerify boolean false Disables Trustify TLS certificate verification. Use only in lab or air-gapped environments.
quay.endpoint string Not set Quay API base URL. Required when backend is quay.
quay.token string Not set Bearer token for authenticating to the Quay Security API. For Helm deployments, use quay.secretName to reference a Kubernetes secret instead.
quay.secretName string Not set Kubernetes secret name with a token key for Helm deployments. Use instead of quay.token when deploying on Red Hat OpenShift Container Platform or Kubernetes.
quay.maxConcurrentRequests integer 5 Maximum number of concurrent requests to the Quay Security API during a sync run.
quay.caFile string Not set Path to a CA bundle for verifying the Quay server TLS certificate. For Helm deployments, use quay.caCertConfigMapName instead.
quay.caCertConfigMapName string Not set Name of a Kubernetes ConfigMap with a ca-cert.pem key containing the CA bundle for Quay TLS verification. For Helm deployments, use instead of quay.caFile.
quay.skipTlsVerify boolean false Disables Quay TLS certificate verification. Use only in lab or air-gapped environments.

Environment variable overrides
Copy link

You can override any value with environment variables on flightctl-periodic and flightctl-api:

Environment variable Description
FLIGHTCTL_VULNERABILITY_REPORTING_ENABLED true, 1, false, or 0
FLIGHTCTL_VULNERABILITY_REPORTING_SYNC_INTERVAL Sync interval (for example, 15m)
FLIGHTCTL_VULNERABILITY_REPORTING_TRUSTIFY_ENDPOINT Red Hat Trusted Profile Analyzer API base URL
FLIGHTCTL_VULNERABILITY_REPORTING_TRUSTIFY_AUTH_MODE none or client-credentials
FLIGHTCTL_VULNERABILITY_REPORTING_TRUSTIFY_OIDC_ISSUER_URL OIDC issuer URL
FLIGHTCTL_VULNERABILITY_REPORTING_TRUSTIFY_CLIENT_ID OAuth2 client ID
FLIGHTCTL_VULNERABILITY_REPORTING_TRUSTIFY_CLIENT_SECRET OAuth2 client secret
FLIGHTCTL_VULNERABILITY_REPORTING_TRUSTIFY_CA_FILE Path to a CA bundle for Trustify TLS verification
FLIGHTCTL_VULNERABILITY_REPORTING_TRUSTIFY_SKIP_TLS_VERIFY Disables Trustify TLS certificate verification when set to true or 1
FLIGHTCTL_VULNERABILITY_REPORTING_BACKEND Vulnerability backend: trustify or quay
FLIGHTCTL_VULNERABILITY_REPORTING_QUAY_ENDPOINT Quay API base URL
FLIGHTCTL_VULNERABILITY_REPORTING_QUAY_TOKEN Bearer token for the Quay Security API
FLIGHTCTL_VULNERABILITY_REPORTING_QUAY_MAX_CONCURRENT_REQUESTS Maximum concurrent Quay API requests (integer)
FLIGHTCTL_VULNERABILITY_REPORTING_QUAY_CA_FILE Path to a CA bundle for Quay TLS verification
FLIGHTCTL_VULNERABILITY_REPORTING_QUAY_SKIP_TLS_VERIFY Disables Quay TLS certificate verification when set to true or 1

Environment variables take precedence over the configuration file.