2.5.3. 镜像漏洞策略
应用镜像漏洞策略，以利用 Container Security Operator 来检测容器镜像是否有漏洞。如果没有安装 Container Security Operator，该策略会在受管集群上安装它。
镜像漏洞策略由 Kubernetes 配置策略控制器负责检查。有关 Security Operator 的更多信息，请参阅 Quay 存储库中的 Container Security Operator。
备注：
- 镜像漏洞策略在断开连接的安装过程中无法正常工作。
-
IBM Power 和 IBM Z 架构不支持 镜像漏洞策略。它依赖于 Quay Container Security Operator。container-security-operator registry 中没有
ppc64le或s390x镜像。
查看以下部分以了解更多信息：
2.5.3.1. 镜像漏洞策略 YAML 结构
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
name: policy-imagemanifestvulnpolicy
namespace: default
annotations:
policy.open-cluster-management.io/standards: NIST-CSF
policy.open-cluster-management.io/categories: DE.CM Security Continuous Monitoring
policy.open-cluster-management.io/controls: DE.CM-8 Vulnerability Scans
spec:
remediationAction:
disabled:
policy-templates:
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name:
spec:
remediationAction:
severity: high
object-templates:
- complianceType:
objectDefinition:
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
name: container-security-operator
namespace:
spec:
channel:
installPlanApproval:
name:
source:
sourceNamespace:
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name:
spec:
remediationAction:
severity:
namespaceSelector:
exclude:
include:
object-templates:
- complianceType:
objectDefinition:
apiVersion: secscan.quay.redhat.com/v1alpha1
kind: ImageManifestVuln # checking for a kind
---
apiVersion: policy.open-cluster-management.io/v1
kind: PlacementBinding
metadata:
name: binding-policy-imagemanifestvulnpolicy
namespace: default
placementRef:
name:
kind:
apiGroup:
subjects:
- name:
kind:
apiGroup:
---
apiVersion: apps.open-cluster-management.io/v1
kind: PlacementRule
metadata:
name: placement-policy-imagemanifestvulnpolicy
namespace: default
spec:
clusterConditions:
- status:
type:
clusterSelector:
matchExpressions:
[] # selects all clusters if not specified