《OpenShift 4.x HOL教程汇总》
说明:本文已经在OpenShift 4.9环境中验证
安装配置Trivy Operator
- 使用默认配置安装 Trivy Operator,然后创建一个 “NamespaceScanner” 实例。
apiVersion: trivy-operator.devopstales.io/v1
kind: NamespaceScanner
metadata:
name: trivy-operator-main-config
namespace: openshift-operators
spec:
crontab: '*/5 * * * *'
namespace_selector: trivy-scan
- 根据 trivy-operator 的服务创建 Route。
$ oc expose svc trivy-operator -n openshift-operators
$ TRIVY_ADDR=$(oc get route trivy-operator -o jsonpath='{.spec.host}' -n openshift-operators)
扫描项目镜像
- 在 OpenShift 执行以下YAML 创建测试应用资源。注意:使用 trivy-scan: “true” 标签声明项目需要用Trivy扫描。
apiVersion: v1
kind: Namespace
metadata:
labels:
trivy-scan: "true"
trivy-operator-validation: "false"
name: trivytest
---
apiVersion: v1
kind: Pod
metadata:
name: nginx
namespace: trivytest
spec:
initContainers:
- name: init
image: nginxinc/nginx-unprivileged:latest
command: ['sh', '-c', 'echo The app is running! && sleep 10']
containers:
- image: nginx:1.18
imagePullPolicy: IfNotPresent
name: nginx
- 执行命令,查看Trivy的扫描结果。
$ curl -s ${TRIVY_ADDR}/metrics | grep so_vulnerabilities
# HELP so_vulnerabilities Container vulnerabilities
# TYPE so_vulnerabilities gauge
so_vulnerabilities{exported_namespace="trivytest",image="docker.io/library/nginx:1.18",severity="UNKNOWN"} 8.0
so_vulnerabilities{exported_namespace="trivytest",image="docker.io/library/nginx:1.18",severity="LOW"} 126.0
so_vulnerabilities{exported_namespace="trivytest",image="docker.io/library/nginx:1.18",severity="MEDIUM"} 25.0
so_vulnerabilities{exported_namespace="trivytest",image="docker.io/library/nginx:1.18",severity="HIGH"} 43.0
so_vulnerabilities{exported_namespace="trivytest",image="docker.io/library/nginx:1.18",severity="CRITICAL"} 21.0
so_vulnerabilities{exported_namespace="trivytest",image="docker.io/library/nginx:1.18",severity="scanning_error"} 1.0
so_vulnerabilities{exported_namespace="trivytest",image="docker.io/nginxinc/nginx-unprivileged:latest",severity="UNKNOWN"} 8.0
so_vulnerabilities{exported_namespace="trivytest",image="docker.io/nginxinc/nginx-unprivileged:latest",severity="LOW"} 83.0
so_vulnerabilities{exported_namespace="trivytest",image="docker.io/nginxinc/nginx-unprivileged:latest",severity="MEDIUM"} 5.0
so_vulnerabilities{exported_namespace="trivytest",image="docker.io/nginxinc/nginx-unprivileged:latest",severity="HIGH"} 7.0
so_vulnerabilities{exported_namespace="trivytest",image="docker.io/nginxinc/nginx-unprivileged:latest",severity="CRITICAL"} 4.0
so_vulnerabilities{exported_namespace="trivytest",image="docker.io/nginxinc/nginx-unprivileged:latest",severity="scanning_error"} 1.0
so_vulnerabilities{exported_namespace="trivytest",image="quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:2109bd8a42870060074ea82f56d34d53e925740bda31b6e6e55c6f60ba8e74f0",severity="scanning_error"} 1.0
so_vulnerabilities{exported_namespace="trivytest",image="image-registry.openshift-image-registry.svc:5000/trivytest/httpd-sample@sha256:00e075fd12cfb2466c3a83262410e080373a64a3a0c0ac1bfb043996c01eb6a5",severity="scanning_error"} 1.0
- 还可执行命令统计不同等级 CVE 的数量。
curl -s ${TRIVY_ADDR}/metrics | grep CRITICAL | wc -l
curl -s ${TRIVY_ADDR}/metrics | grep HIGH | wc -l
curl -s ${TRIVY_ADDR}/metrics | grep LOW | wc -l
参考
https://github.com/devopstales/trivy-operator
https://staging.artifacthub.io/packages/helm/devopstales/trivy-operator