Chapter 16. Scanning pods for vulnerabilities Using the Red Hat Quay Container Security Operator, you can access vulnerability scan results from the OpenShift Container Platform web console for container images used in active pods on the cluster. The Red Hat Quay Container Security Operator: Watches containers associated with pods on all or specified namespaces Queries the container registry where the containers came from for vulnerability information, provided an image's registry is running image scanning (such as Quay.io or a Red Hat Quay registry with Clair scanning) Exposes vulnerabilities via the ImageManifestVuln object in the Kubernetes API Using the instructions here, the Red Hat Quay Container Security Operator is installed in the openshift-operators namespace, so it is available to all namespaces on your OpenShift Container Platform cluster. 16.1. Installing the Red Hat Quay Container Security Operator You can install the Red Hat Quay Container Security Operator from the OpenShift Container Platform web console Operator Hub, or by using the CLI. Prerequisites You have installed the oc CLI. You have administrator privileges to the OpenShift Container Platform cluster. You have containers that come from a Red Hat Quay or Quay.io registry running on your cluster. Procedure You can install the Red Hat Quay Container Security Operator by using the OpenShift Container Platform web console: On the web console, navigate to Operators OperatorHub and select Security . Select the Red Hat Quay Container Security Operator Operator, and then select Install . On the Red Hat Quay Container Security Operator page, select Install . Update channel , Installation mode , and Update approval are selected automatically. The Installed Namespace field defaults to openshift-operators . You can adjust these settings as needed. Select Install . The Red Hat Quay Container Security Operator appears after a few moments on the Installed Operators page. Optional: You can add custom certificates to the Red Hat Quay Container Security Operator. For example, create a certificate named quay.crt in the current directory. Then, run the following command to add the custom certificate to the Red Hat Quay Container Security Operator: USD oc create secret generic container-security-operator-extra-certs --from-file=quay.crt -n openshift-operators Optional: If you added a custom certificate, restart the Red Hat Quay Container Security Operator pod for the new certificates to take effect. Alternatively, you can install the Red Hat Quay Container Security Operator by using the CLI: Retrieve the latest version of the Container Security Operator and its channel by entering the following command: USD oc get packagemanifests container-security-operator \ -o jsonpath='{range .status.channels[*]}{@.currentCSV} {@.name}{"\n"}{end}' \ | awk '{print "STARTING_CSV=" USD1 " CHANNEL=" USD2 }' \ | sort -Vr \ | head -1 Example output STARTING_CSV=container-security-operator.v3.8.9 CHANNEL=stable-3.8 Using the output from the command, create a Subscription custom resource for the Red Hat Quay Container Security Operator and save it as container-security-operator.yaml . For example: apiVersion: operators.coreos.com/v1alpha1 kind: Subscription metadata: name: container-security-operator namespace: openshift-operators spec: channel: USD{CHANNEL} 1 installPlanApproval: Automatic name: container-security-operator source: redhat-operators sourceNamespace: openshift-marketplace startingCSV: USD{STARTING_CSV} 2 1 Specify the value you obtained in the step for the spec.channel parameter. 2 Specify the value you obtained in the step for the spec.startingCSV parameter. Enter the following command to apply the configuration: USD oc apply -f container-security-operator.yaml Example output subscription.operators.coreos.com/container-security-operator created 16.2. Using the Red Hat Quay Container Security Operator The following procedure shows you how to use the Red Hat Quay Container Security Operator. Prerequisites You have installed the Red Hat Quay Container Security Operator. Procedure On the OpenShift Container Platform web console, navigate to Home Overview . Under the Status section, Image Vulnerabilities provides the number of vulnerabilities found. Click Image Vulnerabilities to reveal the Image Vulnerabilities breakdown tab, which details the severity of the vulnerabilities, whether the vulnerabilities can be fixed, and the total number of vulnerabilities. You can address detected vulnerabilities in one of two ways: Select a link under the Vulnerabilities section. This takes you to the container registry that the container came from, where you can see information about the vulnerability. Select the namespace link. This takes you to the Image Manifest Vulnerabilities page, where you can see the name of the selected image and all of the namespaces where that image is running. After you have learned what images are vulnerable, how to fix those vulnerabilities, and the namespaces that the images are being run in, you can improve security by performing the following actions: Alert anyone in your organization who is running the image and request that they correct the vulnerability. Stop the images from running by deleting the deployment or other object that started the pod that the image is in. Note If you delete the pod, it might take several minutes for the vulnerability information to reset on the dashboard. 16.3. Querying image vulnerabilities from the CLI Using the oc command, you can display information about vulnerabilities detected by the Red Hat Quay Container Security Operator. Prerequisites You have installed the Red Hat Quay Container Security Operator on your OpenShift Container Platform instance. Procedure Enter the following command to query for detected container image vulnerabilities: USD oc get vuln --all-namespaces Example output NAMESPACE NAME AGE default sha256.ca90... 6m56s skynet sha256.ca90... 9m37s To display details for a particular vulnerability, append the vulnerability name and its namespace to the oc describe command. The following example shows an active container whose image includes an RPM package with a vulnerability: USD oc describe vuln --namespace mynamespace sha256.ac50e3752... Example output Name: sha256.ac50e3752... Namespace: quay-enterprise ... Spec: Features: Name: nss-util Namespace Name: centos:7 Version: 3.44.0-3.el7 Versionformat: rpm Vulnerabilities: Description: Network Security Services (NSS) is a set of libraries... 16.4. Uninstalling the Red Hat Quay Container Security Operator To uninstall the Container Security Operator, you must uninstall the Operator and delete the imagemanifestvulns.secscan.quay.redhat.com custom resource definition (CRD). Procedure On the OpenShift Container Platform web console, click Operators Installed Operators . Click the menu of the Container Security Operator. Click Uninstall Operator . Confirm your decision by clicking Uninstall in the popup window. Use the CLI to delete the imagemanifestvulns.secscan.quay.redhat.com CRD. Remove the imagemanifestvulns.secscan.quay.redhat.com custom resource definition by entering the following command: USD oc delete customresourcedefinition imagemanifestvulns.secscan.quay.redhat.com Example output customresourcedefinition.apiextensions.k8s.io "imagemanifestvulns.secscan.quay.redhat.com" deleted

Commands:
oc create secret generic container-security-operator-extra-certs --from-file=quay.crt -n openshift-operators
oc get packagemanifests container-security-operator -o jsonpath='{range .status.channels[*]}{@.currentCSV} {@.name}{"\n"}{end}' | awk '{print "STARTING_CSV=" USD1 " CHANNEL=" USD2 }' | sort -Vr | head -1
STARTING_CSV=container-security-operator.v3.8.9 CHANNEL=stable-3.8
apiVersion: operators.coreos.com/v1alpha1 kind: Subscription metadata: name: container-security-operator namespace: openshift-operators spec: channel: USD{CHANNEL} 1 installPlanApproval: Automatic name: container-security-operator source: redhat-operators sourceNamespace: openshift-marketplace startingCSV: USD{STARTING_CSV} 2
oc apply -f container-security-operator.yaml
subscription.operators.coreos.com/container-security-operator created
oc get vuln --all-namespaces
NAMESPACE NAME AGE default sha256.ca90... 6m56s skynet sha256.ca90... 9m37s
oc describe vuln --namespace mynamespace sha256.ac50e3752
Name: sha256.ac50e3752 Namespace: quay-enterprise Spec: Features: Name: nss-util Namespace Name: centos:7 Version: 3.44.0-3.el7 Versionformat: rpm Vulnerabilities: Description: Network Security Services (NSS) is a set of libraries
oc delete customresourcedefinition imagemanifestvulns.secscan.quay.redhat.com
customresourcedefinition.apiextensions.k8s.io "imagemanifestvulns.secscan.quay.redhat.com" deleted