OpenShift 4 - 使用 Trivy Operator 对项目中的镜像进行安全扫描

《OpenShift 4.x HOL教程汇总》
说明：本文已经在OpenShift 4.9环境中验证

安装配置Trivy Operator

1. 使用默认配置安装 Trivy Operator，然后创建一个 “NamespaceScanner” 实例。

apiVersion: trivy-operator.devopstales.io/v1
kind: NamespaceScanner
metadata:
  name: trivy-operator-main-config
  namespace: openshift-operators
spec:
  crontab: '*/5 * * * *'
  namespace_selector: trivy-scan

2. 根据 trivy-operator 的服务创建 Route。

$ oc expose svc trivy-operator -n openshift-operators
$ TRIVY_ADDR=$(oc get route trivy-operator -o jsonpath='{.spec.host}' -n openshift-operators)

扫描项目镜像

1. 在 OpenShift 执行以下YAML 创建测试应用资源。注意：使用 trivy-scan: “true” 标签声明项目需要用Trivy扫描。

apiVersion: v1
kind: Namespace
metadata:
  labels:
    trivy-scan: "true"
    trivy-operator-validation: "false"
  name: trivytest
---
apiVersion: v1
kind: Pod
metadata:
  name: nginx
  namespace: trivytest
spec:
  initContainers:
  - name: init
    image: nginxinc/nginx-unprivileged:latest
    command: ['sh', '-c', 'echo The app is running! && sleep 10']
  containers:
  - image: nginx:1.18
    imagePullPolicy: IfNotPresent
    name: nginx

2. 执行命令，查看Trivy的扫描结果。

$ curl -s ${TRIVY_ADDR}/metrics | grep so_vulnerabilities
# HELP so_vulnerabilities Container vulnerabilities
# TYPE so_vulnerabilities gauge
so_vulnerabilities{exported_namespace="trivytest",image="docker.io/library/nginx:1.18",severity="UNKNOWN"} 8.0
so_vulnerabilities{exported_namespace="trivytest",image="docker.io/library/nginx:1.18",severity="LOW"} 126.0
so_vulnerabilities{exported_namespace="trivytest",image="docker.io/library/nginx:1.18",severity="MEDIUM"} 25.0
so_vulnerabilities{exported_namespace="trivytest",image="docker.io/library/nginx:1.18",severity="HIGH"} 43.0
so_vulnerabilities{exported_namespace="trivytest",image="docker.io/library/nginx:1.18",severity="CRITICAL"} 21.0
so_vulnerabilities{exported_namespace="trivytest",image="docker.io/library/nginx:1.18",severity="scanning_error"} 1.0
so_vulnerabilities{exported_namespace="trivytest",image="docker.io/nginxinc/nginx-unprivileged:latest",severity="UNKNOWN"} 8.0
so_vulnerabilities{exported_namespace="trivytest",image="docker.io/nginxinc/nginx-unprivileged:latest",severity="LOW"} 83.0
so_vulnerabilities{exported_namespace="trivytest",image="docker.io/nginxinc/nginx-unprivileged:latest",severity="MEDIUM"} 5.0
so_vulnerabilities{exported_namespace="trivytest",image="docker.io/nginxinc/nginx-unprivileged:latest",severity="HIGH"} 7.0
so_vulnerabilities{exported_namespace="trivytest",image="docker.io/nginxinc/nginx-unprivileged:latest",severity="CRITICAL"} 4.0
so_vulnerabilities{exported_namespace="trivytest",image="docker.io/nginxinc/nginx-unprivileged:latest",severity="scanning_error"} 1.0
so_vulnerabilities{exported_namespace="trivytest",image="quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:2109bd8a42870060074ea82f56d34d53e925740bda31b6e6e55c6f60ba8e74f0",severity="scanning_error"} 1.0
so_vulnerabilities{exported_namespace="trivytest",image="image-registry.openshift-image-registry.svc:5000/trivytest/httpd-sample@sha256:00e075fd12cfb2466c3a83262410e080373a64a3a0c0ac1bfb043996c01eb6a5",severity="scanning_error"} 1.0

5. 还可执行命令统计不同等级 CVE 的数量。

curl -s ${TRIVY_ADDR}/metrics | grep CRITICAL | wc -l
curl -s ${TRIVY_ADDR}/metrics | grep HIGH | wc -l
curl -s ${TRIVY_ADDR}/metrics | grep LOW | wc -l

参考

https://github.com/devopstales/trivy-operator
https://staging.artifacthub.io/packages/helm/devopstales/trivy-operator