Skip to content

Commit 99426be

Browse files
stevsmitstevsmit
authored
Merge pull request #61727 from stevsmit/OSDOCS-3499-CSO-CLI
Updates scanning pods for vulernabilities docs
2 parents 51d12d1 + 6e1b456 commit 99426be

File tree

4 files changed

+111
-52
lines changed

4 files changed

+111
-52
lines changed

‎modules/security-pod-scan-cso-using.adoc

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/pod-vulnerabilities-scan.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="security-pod-scan-cso-using_{context}"]
7+
= Using the {rhq-cso}
8+
9+
The following procedure shows you how to use the {rhq-cso}.
10+
11+
.Prerequisites
12+
13+
* You have installed the {rhq-cso}.
14+
15+
.Procedure
16+
17+
. On the {product-title} web console, navigate to *Home* -> *Overview*. Under the *Status* section, *Quay Image Security* provides the number of vulnerabilities found.
18+
19+
. Click *Quay Image Security* to reveal the *Quay Image Security breakdown*, which details the severity of the vulnerabilities, whether the vulnerabilities can be fixed, and the total number of vulnerabilities. For example:
20+
+
21+
image:image_security.png[Access image scanning data from {product-title} dashboard]
22+
23+
. You can address detected vulnerabilities in one of two ways:
24+
+
25+
.. Select the link to the vulnerability. This takes you to the container registry that the container came from, where you can see information about the vulnerability. The following example shows detected vulnerabilities from a Quay.io registry:
26+
+
27+
image:cso-registry-vulnerable.png[The {rhq-cso} points you to a registry containing the vulnerable image]
28+
29+
.. Select the *namespace* link. This takes you to the *ImageManifestVuln* page, where you can see the name of the selected image and all of the namespaces where that image is running. For example, the following image shows you that a particular vulnerable image is running in the `quay-enterprise` namespace:
30+
+
31+
image:cso-namespace-vulnerable.png[View namespaces a vulnerable image is running in]
32+
33+
. After you have learned what images are vulnerable, how to fix those vulnerabilities, and the namespaces that the images are being run in, you can improve security by performing the following actions:
34+
35+
.. Alert anyone in your organization who is running the image and request that they correct the vulnerability.
36+
37+
.. Stop the images from running by deleting the deployment or other object that started the pod that the image is in.
38+
+
39+
[NOTE]
40+
====
41+
If you delete the pod, it might take several minutes for the vulnerability information to reset on the dashboard.
42+
====

‎modules/security-pod-scan-cso.adoc

Lines changed: 61 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1,72 +1,90 @@
11
// Module included in the following assemblies:
22
//
3-
// * security/pod-vulnerabilities-scan.adoc
3+
// * security/pod-vulnerability-scan.adoc
44

55
:_content-type: PROCEDURE
66
[id="security-pod-scan-cso_{context}"]
7-
= Running the {rhq-cso}
7+
= Installing the {rhq-cso}
88

9-
You can start the {rhq-cso} from the {product-title}
10-
web console by selecting and installing that Operator from the Operator Hub,
11-
as described here.
9+
You can install the {rhq-cso} from the {product-title} web console Operator Hub, or by using the CLI.
1210

1311
.Prerequisites
1412

15-
* Have administrator privileges to the {product-title} cluster
16-
* Have containers that come from a Red Hat Quay or Quay.io registry running on your cluster
13+
* You have installed the `oc` CLI.
14+
* You have administrator privileges to the {product-title} cluster.
15+
* You have containers that come from a Red Hat Quay or Quay.io registry running on your cluster.
1716
1817
.Procedure
1918

20-
. Navigate to *Operators* -> *OperatorHub* and select *Security*.
19+
. You can install the {rhq-cso} by using the {product-title} web console:
2120

22-
. Select the *Container Security* Operator, then select *Install*
23-
to go to the Create Operator Subscription page.
21+
.. On the web console, navigate to *Operators* -> *OperatorHub* and select *Security*.
2422

25-
. Check the settings. All namespaces and automatic approval strategy are selected, by default.
23+
.. Select the *{rhq-cso}* Operator, and then select *Install*.
2624

27-
. Select *Install*. The *Container Security* Operator appears after a few moments on the *Installed Operators* screen.
25+
.. On the *{rhq-cso}* page, select *Install*. *Update channel*, *Installation mode*, and *Update approval* are selected automatically. The *Installed Namespace* field defaults to `openshift-operators`. You can adjust these settings as needed.
2826

29-
. Optional: You can add custom certificates to the {rhq-cso}. In this example, create a certificate
30-
named `quay.crt` in the current directory. Then run the following command to add the cert to the {rhq-cso}:
27+
.. Select *Install*. The *{rhq-cso}* appears after a few moments on the *Installed Operators* page.
28+
29+
.. Optional: You can add custom certificates to the {rhq-cso}. For example, create a certificate named `quay.crt` in the current directory. Then, run the following command to add the custom certificate to the {rhq-cso}:
3130
+
3231
[source,terminal]
3332
----
3433
$ oc create secret generic container-security-operator-extra-certs --from-file=quay.crt -n openshift-operators
3534
----
3635

37-
. If you added a custom certificate, restart the Operator pod for the new certs to take effect.
36+
.. Optional: If you added a custom certificate, restart the {rhq-cso} pod for the new certificates to take effect.
3837

39-
. Open the OpenShift Dashboard (`Home` -> `Overview`). A link to
40-
*Quay Image Security* appears under the status section, with a listing of the number
41-
of vulnerabilities found so far. Select the link to see a *Quay Image Security breakdown*, as shown in the following figure:
42-
+
43-
image:image_security.png[Access image scanning data from {product-title} dashboard]
38+
. Alternatively, you can install the {rhq-cso} by using the CLI:
4439

45-
. You can do one of two things at this point to follow up on any detected vulnerabilities:
46-
+
47-
* Select the link to the vulnerability. You are taken to the container
48-
registry that the container came
49-
from, where you can see information about the vulnerability. The following
50-
figure shows an example of detected vulnerabilities from a Quay.io registry:
40+
.. Retrieve the latest version of the Container Security Operator and its channel by entering the following command:
5141
+
52-
image:cso-registry-vulnerable.png[The {rhq-cso} points you to a registry containing the vulnerable image]
42+
[source,terminal]
43+
----
44+
$ oc get packagemanifests container-security-operator \
45+
-o jsonpath='{range .status.channels[*]}{@.currentCSV} {@.name}{"\n"}{end}' \
46+
| awk '{print "STARTING_CSV=" $1 " CHANNEL=" $2 }' \
47+
| sort -nr \
48+
| head -1
49+
----
5350
+
54-
* Select the namespaces link to go to the *ImageManifestVuln* screen,
55-
where you can see the name of the selected image
56-
and all namespaces where that image is running.
57-
The following figure indicates that a particular vulnerable image
58-
is running in the `quay-enterprise` namespace:
51+
.Example output
5952
+
60-
image:cso-namespace-vulnerable.png[View namespaces a vulnerable image is running in]
61-
62-
At this point, you know what images are vulnerable, what
63-
you need to do to fix those vulnerabilities,
64-
and every namespace that the image was run in. So you can:
53+
[source,terminal]
54+
----
55+
STARTING_CSV=container-security-operator.v3.8.9 CHANNEL=stable-3.8
56+
----
6557

66-
* Alert anyone running the image that
67-
they need to correct the vulnerability
68-
* Stop the images from running by deleting the deployment
69-
or other object that started the pod that the image is in
58+
.. Using the output from the previous command, create a `Subscription` custom resource for the {rhq-cso} and save it as `container-security-operator.yaml`. For example:
59+
+
60+
[source,yaml]
61+
----
62+
apiVersion: operators.coreos.com/v1alpha1
63+
kind: Subscription
64+
metadata:
65+
name: container-security-operator
66+
namespace: openshift-operators
67+
spec:
68+
channel: ${CHANNEL} <1>
69+
installPlanApproval: Automatic
70+
name: container-security-operator
71+
source: redhat-operators
72+
sourceNamespace: openshift-marketplace
73+
startingCSV: ${STARTING_CSV} <2>
74+
----
75+
<1> Specify the value you obtained in the previous step for the `spec.channel` parameter.
76+
<2> Specify the value you obtained in the previous step for the `spec.startingCSV` parameter.
7077

71-
Note that if you do delete the pod, it may take several minutes
72-
for the vulnerability to reset on the dashboard.
78+
.. Enter the following command to apply the configuration:
79+
+
80+
[source,terminal]
81+
----
82+
$ oc apply -f container-security-operator.yaml
83+
----
84+
+
85+
.Example output
86+
+
87+
[source,terminal]
88+
----
89+
subscription.operators.coreos.com/container-security-operator created
90+
----

‎modules/security-pod-scan-query-cli.adoc

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,20 @@
11
// Module included in the following assemblies:
22
//
3-
// * security/pod-vulnerabilities-scan.adoc
3+
// * security/pod-vulnerability-scan.adoc
44

55
:_content-type: PROCEDURE
66
[id="security-pod-scan-query-cli_{context}"]
77
= Querying image vulnerabilities from the CLI
8-
Using the `oc` command, you can display information about
9-
vulnerabilities detected by the {rhq-cso}.
8+
9+
Using the `oc` command, you can display information about vulnerabilities detected by the {rhq-cso}.
1010

1111
.Prerequisites
12-
* Be running the {rhq-cso} on your
13-
{product-title} instance
12+
13+
* You have installed the {rhq-cso} on your {product-title} instance.
1414
1515
.Procedure
1616

17-
* To query for detected container image vulnerabilities, type:
17+
. Enter the following command to query for detected container image vulnerabilities:
1818
+
1919
[source,terminal]
2020
----
@@ -29,9 +29,7 @@ default sha256.ca90... 6m56s
2929
skynet sha256.ca90... 9m37s
3030
----
3131

32-
* To display details for a particular vulnerability, provide the
33-
vulnerability name and its namespace to the `oc describe` command.
34-
This example shows an active container whose image includes an RPM package with a vulnerability:
32+
. To display details for a particular vulnerability, append the vulnerability name and its namespace to the `oc describe` command. The following example shows an active container whose image includes an RPM package with a vulnerability:
3533
+
3634
[source,terminal]
3735
----

‎security/pod-vulnerability-scan.adoc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ namespace, so it is available to all namespaces on your {product-title} cluster.
2323

2424
//
2525
include::modules/security-pod-scan-cso.adoc[leveloffset=+1]
26+
include::modules/security-pod-scan-cso-using.adoc[leveloffset=+1]
2627

2728
//
2829
include::modules/security-pod-scan-query-cli.adoc[leveloffset=+1]

0 commit comments

Comments
 (0)