Chapter 9. Scanning pod images with the Container Security Operator

Procedure

1. On the OpenShift Container Platform console page, select Operators OperatorHub and search for Container Security Operator.
2. Select the Container Security Operator, then select Install to go to the Create Operator Subscription page.
3. Check the settings (all namespaces and automatic approval strategy, by default), and select Subscribe. The Container Security appears after a few moments on the Installed Operators screen.

4. Optional: you can add custom certificates to the CSO. In this example, create a certificate named quay.crt in the current directory. Then, run the following command to add the certificate to the CSO:

   $ oc create secret generic container-security-operator-extra-certs --from-file=quay.crt -n openshift-operators

   Note

   You must restart the Operator pod for the new certificates to take effect.

5. Navigate to Home Overview. A link to Image Vulnerabilities appears under the status section, with a listing of the number of vulnerabilities found so far. Select the link to see a security breakdown, as shown in the following image:

   

   Important

   The Container Security Operator currently provides broken links for Red Hat Security advisories. For example, the following link might be provided: https://access.redhat.com/errata/RHSA-2023:1842%20https://access.redhat.com/security/cve/CVE-2023-23916. The %20 in the URL represents a space character, however it currently results in the combination of the two URLs into one incomplete URL, for example, https://access.redhat.com/errata/RHSA-2023:1842 and https://access.redhat.com/security/cve/CVE-2023-23916. As a temporary workaround, you can copy each URL into your browser to navigate to the proper page. This is a known issue and will be fixed in a future version of Red Hat Quay.

6. You can do one of two things at this point to follow up on any detected vulnerabilities:

   1. Select the link to the vulnerability. You are taken to the container registry, Red Hat Quay or other registry where the container came from, where you can see information about the vulnerability. The following figure shows an example of detected vulnerabilities from a Quay.io registry:

      

   2. Select the namespaces link to go to the Image Manifest Vulnerabilities page, where you can see the name of the selected image and all namespaces where that image is running. The following figure indicates that a particular vulnerable image is running in two namespaces:

      

Procedure

1. Enter the following command to query for detected vulnerabilities:

   $ oc get vuln --all-namespaces

   Example output

   NAMESPACE     NAME              AGE
   default       sha256.ca90...    6m56s
   skynet        sha256.ca90...    9m37s

2. Optional. To display details for a particular vulnerability, identify a specific vulnerability and its namespace, and use the oc describe command. The following example shows an active container whose image includes an RPM package with a vulnerability:

   $ oc describe vuln --namespace <namespace> sha256.ac50e3752...

   Example output

   Name:         sha256.ac50e3752...
   Namespace:    quay-enterprise
   ...
   Spec:
     Features:
       Name:            nss-util
       Namespace Name:  centos:7
       Version:         3.44.0-3.el7
       Versionformat:   rpm
       Vulnerabilities:
         Description: Network Security Services (NSS) is a set of libraries...

Procedure

1. On the OpenShift Container Platform web console, click Operators Installed Operators.
2. Click the menu kebab of the Container Security Operator.
3. Click Uninstall Operator. Confirm your decision by clicking Uninstall in the popup window.

4. Remove the imagemanifestvulns.secscan.quay.redhat.com custom resource definition by entering the following command:

   $ oc delete customresourcedefinition imagemanifestvulns.secscan.quay.redhat.com

   Example output

   customresourcedefinition.apiextensions.k8s.io "imagemanifestvulns.secscan.quay.redhat.com" deleted