Chapter 13. Scanning pods for vulnerabilities Using the Red Hat Quay Container Security Operator, you can access vulnerability scan results from the OpenShift Container Platform web console for container images used in active pods on the cluster. The Red Hat Quay Container Security Operator: Watches containers associated with pods on all or specified namespaces Queries the container registry where the containers came from for vulnerability information, provided an image's registry is running image scanning (such as Quay.io or a Red Hat Quay registry with Clair scanning) Exposes vulnerabilities via the ImageManifestVuln object in the Kubernetes API Using the instructions here, the Red Hat Quay Container Security Operator is installed in the openshift-operators namespace, so it is available to all namespaces on your OpenShift Container Platform cluster. 13.1. Running the Red Hat Quay Container Security Operator You can start the Red Hat Quay Container Security Operator from the OpenShift Container Platform web console by selecting and installing that Operator from the Operator Hub, as described here. Prerequisites Have administrator privileges to the OpenShift Container Platform cluster Have containers that come from a Red Hat Quay or Quay.io registry running on your cluster Procedure Navigate to Operators OperatorHub and select Security . Select the Container Security Operator, then select Install to go to the Create Operator Subscription page. Check the settings. All namespaces and automatic approval strategy are selected, by default. Select Install . The Container Security Operator appears after a few moments on the Installed Operators screen. Optional: You can add custom certificates to the Red Hat Quay Container Security Operator. In this example, create a certificate named quay.crt in the current directory. Then run the following command to add the cert to the Red Hat Quay Container Security Operator: USD oc create secret generic container-security-operator-extra-certs --from-file=quay.crt -n openshift-operators If you added a custom certificate, restart the Operator pod for the new certs to take effect. Open the OpenShift Dashboard ( Home Overview ). A link to Quay Image Security appears under the status section, with a listing of the number of vulnerabilities found so far. Select the link to see a Quay Image Security breakdown , as shown in the following figure: You can do one of two things at this point to follow up on any detected vulnerabilities: Select the link to the vulnerability. You are taken to the container registry that the container came from, where you can see information about the vulnerability. The following figure shows an example of detected vulnerabilities from a Quay.io registry: Select the namespaces link to go to the ImageManifestVuln screen, where you can see the name of the selected image and all namespaces where that image is running. The following figure indicates that a particular vulnerable image is running in the quay-enterprise namespace: At this point, you know what images are vulnerable, what you need to do to fix those vulnerabilities, and every namespace that the image was run in. So you can: Alert anyone running the image that they need to correct the vulnerability Stop the images from running by deleting the deployment or other object that started the pod that the image is in Note that if you do delete the pod, it may take several minutes for the vulnerability to reset on the dashboard. 13.2. Querying image vulnerabilities from the CLI Using the oc command, you can display information about vulnerabilities detected by the Red Hat Quay Container Security Operator. Prerequisites Be running the Red Hat Quay Container Security Operator on your OpenShift Container Platform instance Procedure To query for detected container image vulnerabilities, type: USD oc get vuln --all-namespaces Example output NAMESPACE NAME AGE default sha256.ca90... 6m56s skynet sha256.ca90... 9m37s To display details for a particular vulnerability, provide the vulnerability name and its namespace to the oc describe command. This example shows an active container whose image includes an RPM package with a vulnerability: USD oc describe vuln --namespace mynamespace sha256.ac50e3752... Example output Name: sha256.ac50e3752... Namespace: quay-enterprise ... Spec: Features: Name: nss-util Namespace Name: centos:7 Version: 3.44.0-3.el7 Versionformat: rpm Vulnerabilities: Description: Network Security Services (NSS) is a set of libraries...

Commands:
oc create secret generic container-security-operator-extra-certs --from-file=quay.crt -n openshift-operators
oc get vuln --all-namespaces
NAMESPACE NAME AGE default sha256.ca90... 6m56s skynet sha256.ca90... 9m37s
oc describe vuln --namespace mynamespace sha256.ac50e3752
Name: sha256.ac50e3752 Namespace: quay-enterprise Spec: Features: Name: nss-util Namespace Name: centos:7 Version: 3.44.0-3.el7 Versionformat: rpm Vulnerabilities: Description: Network Security Services (NSS) is a set of libraries