Enable operational container scanning to scan container images from private registries
requested to merge 415451-container-images-from-private-registries-are-not-being-scanned-in-operational-container into master
What does this MR do and why?
This MR adds support to scan private images configured with imagePullSecrets
Specifically these are the steps implemented to scan private images
- Trivy scanner pod retrieves the
ImagePullSecret
of each image in the namespace and creates a new secret to store the credentials in thegitlab-agent
namespace- Store the credentials as keys
usernames
andpasswords
in the secret - In the scenario where there are multiple secrets, they will be delimited with
,
as described in Trivy's docs.
- Store the credentials as keys
- Define
TRIVY_PASSWORD
andTRIVY_USERNAME
as env variables referencing the respective keys in the secret created above in the Trivy Scanner Pod spec - Once scan is complete, delete the secret
How to set up and validate locally
- Create a container that uses a private image in your cluster. See steps 1-4
- Start an operational container scan for your project
- Validate that vulnerabilities are created for the private image
Edited by Shao Ming Tan