13.5. Setting up scanning
You can configure settings for scanning, such as automatic scanning of active and inactive images.
13.5.1. Automatic scanning of active images 复制链接链接已复制到粘贴板!
Red Hat Advanced Cluster Security for Kubernetes periodically scans all active images and updates the image scan results to reflect the latest vulnerability definitions. Active images are the images you have deployed in your environment.
From Red Hat Advanced Cluster Security for Kubernetes 3.0.57, you can enable automatic scanning of inactive images by configuring the Watch setting for images.
Central fetches the image scan results for all active images from Scanner or other integrated image scanners that you use and updates the results every 4 hours.
You can also use the roxctl CLI to check the image scan results on demand.
13.5.2. Scanning inactive images 复制链接链接已复制到粘贴板!
Red Hat Advanced Cluster Security for Kubernetes (RHACS) scans all active (deployed) images every 4 hours and updates the image scan results to reflect the latest vulnerability definitions.
You can also configure RHACS to scan inactive (not deployed) images automatically.
Procedure
-
In the RHACS portal, click Vulnerability Management
Results. -
Click More Views
Inactive images. - Click Manage watched images.
-
In the Image name field, enter the fully-qualified image name that begins with the registry and ends with the image tag, for example,
docker.io/library/nginx:latest. - Click Add image to watch list.
Optional: To remove a watched image, locate the image in the Manage watched images window, and click Remove watch.
重要In the RHACS portal, click Platform Configuration
System Configuration to view the data retention configuration. All the data related to the image removed from the watched image list continues to appear in the RHACS portal for the number of days mentioned on the System Configuration page and is only removed after that period is over.
- Click Close to return to the Inactive images page.