Chapter 7. Clair Security Scanning

1. Set your current project to the name of the project in which Red Hat Quay is running. For example:

   $ oc project quay-enterprise

2. Create a Postgres deployment file for Clair v4 (for example, clairv4-postgres.yaml) as follows.

   clairv4-postgres.yaml

   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: clairv4-postgres
     namespace: quay-enterprise
     labels:
       quay-component: clairv4-postgres
   spec:
     replicas: 1
     selector:
       matchLabels:
         quay-component: clairv4-postgres
     template:
       metadata:
         labels:
           quay-component: clairv4-postgres
       spec:
         volumes:
           - name: postgres-data
             persistentVolumeClaim:
               claimName: clairv4-postgres
         containers:
           - name: postgres
             image: postgres:11.5
             imagePullPolicy: "IfNotPresent"
             ports:
               - containerPort: 5432
             env:
               - name: POSTGRES_USER
                 value: "postgres"
               - name: POSTGRES_DB
                 value: "clair"
               - name: POSTGRES_PASSWORD
                 value: "postgres"
               - name: PGDATA
                 value: "/etc/postgres/data"
             volumeMounts:
               - name: postgres-data
                 mountPath: "/etc/postgres"
   ---
   apiVersion: v1
   kind: PersistentVolumeClaim
   metadata:
     name: clairv4-postgres
     labels:
       quay-component: clairv4-postgres
   spec:
     accessModes:
       - "ReadWriteOnce"
     resources:
       requests:
         storage: "5Gi"
       volumeName: "clairv4-postgres"
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: clairv4-postgres
     labels:
       quay-component: clairv4-postgres
   spec:
     type: ClusterIP
     ports:
       - port: 5432
         protocol: TCP
         name: postgres
         targetPort: 5432
     selector:
       quay-component: clairv4-postgres

3. Deploy the postgres database as follows:

   $ oc create -f ./clairv4-postgres.yaml

4. Create a Clair config.yaml file to use for Clair v4. For example:

   config.yaml

   introspection_addr: :8089
   http_listen_addr: :8080
   log_level: debug
   indexer:
     connstring: host=clairv4-postgres port=5432 dbname=clair user=postgres password=postgres sslmode=disable
     scanlock_retry: 10
     layer_scan_concurrency: 5
     migrations: true
   matcher:
     connstring: host=clairv4-postgres port=5432 dbname=clair user=postgres password=postgres sslmode=disable
     max_conn_pool: 100
     run: ""
     migrations: true
     indexer_addr: clair-indexer
   notifier:
     connstring: host=clairv4-postgres port=5432 dbname=clair user=postgres password=postgres sslmode=disable
     delivery: 1m
     poll_interval: 5m
     migrations: true
   auth:
     psk:
       key: MTU5YzA4Y2ZkNzJoMQ== 1
       iss: ["quay"]
   # tracing and metrics
   trace:
     name: "jaeger"
     probability: 1
     jaeger:
       agent_endpoint: "localhost:6831"
       service_name: "clair"
   metrics:
     name: "prometheus"

   1

   To generate a Clair pre-shared key (PSK), enable scanning in the Security Scanner section of the User Interface and click Generate PSK.

1. Create a secret from the Clair config.yaml:

   $ oc create secret generic clairv4-config-secret --from-file=./config.yaml

2. Create the Clair v4 deployment file (for example, clair-combo.yaml) and modify it as necessary:

   clair-combo.yaml

   ---
   apiVersion: extensions/v1beta1
   kind: Deployment
   metadata:
     labels:
       quay-component: clair-combo
     name: clair-combo
   spec:
     replicas: 1
     selector:
       matchLabels:
         quay-component: clair-combo
     template:
       metadata:
         labels:
           quay-component: clair-combo
       spec:
         containers:
           - image: registry.redhat.io/quay/clair-rhel8:v3.7.13  1
             imagePullPolicy: IfNotPresent
             name: clair-combo
             env:
               - name: CLAIR_CONF
                 value: /clair/config.yaml
               - name: CLAIR_MODE
                 value: combo
             ports:
               - containerPort: 8080
                 name: clair-http
                 protocol: TCP
               - containerPort: 8089
                 name: clair-intro
                 protocol: TCP
             volumeMounts:
               - mountPath: /clair/
                 name: config
         imagePullSecrets:
           - name: redhat-pull-secret
         restartPolicy: Always
         volumes:
           - name: config
             secret:
               secretName: clairv4-config-secret
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: clairv4 2
     labels:
       quay-component: clair-combo
   spec:
     ports:
       - name: clair-http
         port: 80
         protocol: TCP
         targetPort: 8080
       - name: clair-introspection
         port: 8089
         protocol: TCP
         targetPort: 8089
     selector:
       quay-component: clair-combo
     type: ClusterIP

   1

   Change image to latest clair image name and version.

   2

   With the Service set to clairv4, the scanner endpoint for Clair v4 is entered later into the Red Hat Quay config.yaml in the SECURITY_SCANNER_V4_ENDPOINT as http://clairv4.

3. Create the Clair v4 deployment as follows:

   $ oc create -f ./clair-combo.yaml

4. Modify the config.yaml file for your Red Hat Quay deployment to add the following entries at the end:

   FEATURE_SECURITY_NOTIFICATIONS: true
   FEATURE_SECURITY_SCANNER: true
   SECURITY_SCANNER_V4_ENDPOINT: http://clairv4 1

   1

   Identify the Clair v4 service endpoint

5. Redeploy the modified config.yaml to the secret containing that file (for example, quay-enterprise-config-secret:

   $ oc delete secret quay-enterprise-config-secret
   $ oc create secret generic quay-enterprise-config-secret --from-file=./config.yaml

6. For the new config.yaml to take effect, you need to restart the Red Hat Quay pods. Simply deleting the quay-app pods causes pods with the updated configuration to be deployed.

Procedure

1. Submit the API key request form to obtain the Quay-specific CRDA remote matcher.

2. Set the CRDA configuration in your clair-config.yaml file:

   matchers:
     config:
       crda:
         url: https://gw.api.openshift.io/api/v2/
         key: <CRDA_API_KEY> 1
         source: <QUAY_SERVER_HOSTNAME> 2

   1

   Insert the Quay-specific CRDA remote matcher from the API key request form here.

   2

   The hostname of your Quay server.