Scan images in OpenShift integrated Docker registry
Table of Contents
Expand all | Collapse all
-
- Getting started
- System Requirements
- Cluster Context
-
- Prisma Cloud Container Images
- Kubernetes
- Deploy the Prisma Cloud Console on Amazon ECS
- Console on Fargate
- Onebox
- Alibaba Cloud Container Service for Kubernetes (ACK)
- Azure Container Service (ACS) with Kubernetes
- Azure Kubernetes Service (AKS)
- Amazon Elastic Kubernetes Service (EKS)
- IBM Kubernetes Service (IKS)
- OpenShift v4
-
- Defender Types
- Manage your Defenders
- Redeploy Defenders
- Uninstall Defenders
-
- Deploy Orchestrator Defenders on Amazon ECS
- Automatically Install Container Defender in a Cluster
- Deploy Prisma Cloud Defender from the GCP Marketplace
- Deploy Defenders as DaemonSets
- VMware Tanzu Application Service (TAS) Defender
- Deploy Defender on Google Kubernetes Engine (GKE)
- Google Kubernetes Engine (GKE) Autopilot
- Deploy Defender on OpenShift v4
-
- Agentless Scanning Modes
-
- Onboard AWS Accounts for Agentless Scanning
- Onboard Azure Accounts for Agentless Scanning
- Configure Agentless Scanning for Azure
- Onboard GCP Accounts for Agentless Scanning
- Configure Agentless Scanning for GCP
- Onboard Oracle Cloud Infrastructure (OCI) Accounts for Agentless Scanning
- Configure Agentless Scanning for Oracle Cloud Infrastructure (OCI)
- Agentless Scanning Results
-
- Rule ordering and pattern matching
- Backup and Restore
- Custom feeds
- Configuring Prisma Cloud proxy settings
- Prisma Cloud Compute certificates
- Configure scanning
- User certificate validity period
- Enable HTTP access to Console
- Set different paths for Defender and Console (with DaemonSets)
- Authenticate to Console with Certificates
- Configure custom certs from a predefined directory
- Customize terminal output
- Collections
- Tags
- Logon settings
- Reconfigure Prisma Cloud
- Subject Alternative Names
- WildFire Settings
- Log Scrubbing
- Clustered-DB
- Permissions by feature
-
- Logging into Prisma Cloud
- Integrating with an IdP
- Integrate with Active Directory
- Integrate with OpenLDAP
- Integrate Prisma Cloud with Open ID Connect
- Integrate with Okta via SAML 2.0 federation
- Integrate Google G Suite via SAML 2.0 federation
- Integrate with Azure Active Directory via SAML 2.0 federation
- Integrate with PingFederate via SAML 2.0 federation
- Integrate with Windows Server 2016 & 2012r2 Active Directory Federation Services (ADFS) via SAML 2.0 federation
- Integrate Prisma Cloud with GitHub
- Integrate Prisma Cloud with OpenShift
- Non-default UPN suffixes
- Compute user roles
- Assign roles
-
- Prisma Cloud Vulnerability Feed
- Scanning Procedure
- Vulnerability Management Policies
- Vulnerability Scan Reports
- Scan Images for Custom Vulnerabilities
- Base images
- Vulnerability Explorer
- CVSS scoring
- CVE Viewer
-
- Configure Registry Scans
- Scan Images in Alibaba Cloud Container Registry
- Scan Images in Amazon Elastic Container Registry (ECR)
- Scan images in Azure Container Registry (ACR)
- Scan Images in Docker Registry v2 (including Docker Hub)
- Scan Images in GitLab Container Registry
- Scan images in Google Artifact Registry
- Scan Images in Google Container Registry (GCR)
- Scan Images in Harbor Registry
- Scan Images in IBM Cloud Container Registry
- Scan Images in JFrog Artifactory Docker Registry
- Scan Images in Sonatype Nexus Registry
- Scan images in OpenShift integrated Docker registry
- Scan Images in CoreOS Quay Registry
- Trigger Registry Scans with Webhooks
- Configure VM image scanning
- Configure code repository scanning
- Malware scanning
- Windows container image scanning
- Serverless Functions Scanning
- VMware Tanzu Blobstore Scanning
- Scan App-Embedded workloads
- Troubleshoot Vulnerability Detection
-
- Compliance Explorer
- Enforce compliance checks
- CIS Benchmarks
- Prisma Cloud Labs compliance checks
- Serverless functions compliance checks
- Windows compliance checks
- DISA STIG compliance checks
- Custom compliance checks
- Trusted images
- Host scanning
- VM image scanning
- App-Embedded scanning
- Detect secrets
- OSS license management
-
- Alert Mechanism
- AWS Security Hub
- Cortex XDR alerts
- Cortex XSOAR alerts
- Email alerts
- Google Cloud Pub/Sub
- Google Cloud Security Command Center
- IBM Cloud Security Advisor
- JIRA Alerts
- PagerDuty alerts
- ServiceNow alerts for Security Incident Response
- ServiceNow alerts for Vulnerability Response
- Slack Alerts
- Splunk Alerts
- Webhook alerts
- API
Scan images in OpenShift integrated Docker registry
To scan an OpenShift integrated registry, create a new registry scan setting.
Create a new registry scan
Prerequisites:
- Install a Defender and make sure that the defender can access the OpenShift registry.
- Install a Defender within in your OpenShift cluster.
- Use the twistlock-service service account to authenticate to the internal registry. The Defender authenticates to the OpenShift registry using this service account.
- Add the cluster role permission of registry-viewer to the twistlock-service account.oc adm policy add-cluster-role-to-user registry-viewer system:serviceaccount:<twistlock_project>:twistlock-serviceObtain the password for the twistlock-service account.
- To get the secret used by the service account run the command - oc describe sa twistlock-service -n <twistlock_project>.
- Use theImage pull secretsvalue (twistlock-service-dockercfg-64jtt) in the following command, for example:oc get secret twistlock-service-dockercfg-64jtt -n twistlock --output=json|grep openshift.io/token-secret.valueCopy the openshift.io/token-secret.value to be used later in the workflow.If you use the OpenShift UI to obtain the token, selectview-allto see the full token.
- Place the CA certificate (ca.cert) file in any of the following paths. As soon as the certificate is found in a path, the search stops and doesn’t go the next path.
- Set up OpenShift credentials with basic authentication in Credentials store and grant Prisma Cloud access to your repository in OpenShift.
- Open Console, then go toDefend > Vulnerabilities > Images > Registry settings.
- SelectAdd registry.
- InVersion, selectRed Hat OpenShift.
- InRegistry, enter the registry address.The internal address to access the OpenShift registry is image-registry.openshift-image-registry.svc:5000.
- InRepository, specify the repository to scan.If you leave this field blank or enter a wildcard, Prisma Cloud finds and scans all repositories in the registry.If you specify a partial string that ends with a wildcard, Prisma Cloud finds and scans all repositories that start with the partial string.If you specify an exact match, Prisma Cloud scans just the specified repository.
- EnterTagnumbers to scan, leave blank, or enter a wildcard (*) to scan all the tags.
- Optionally, enterTags to exclude, to avoid scanning images with specified tags.
- InCredential, select OpenShift credentials that you created in the prerequisites section.InPassword, enter your service account token.
- InOS type, specify whether the repo holdsLinuxorWindowsimages.
- InScanners scope, specify the collections of defenders to use for the scan.Console selects the available Defenders from the scope to execute the scan job according to theNumber of scannerssetting. For more information, see deployment patterns.
- InNumber of scanners, enter the number of Defenders across which scan jobs can be distributed.
- SetCapto the number of most recent images to scan. LeavingCapset to5will scan the 5 most recent images. Setting this field to0will scan all images.
- SelectAdd and scan. Verify that the images in the repository are being scanned underMonitor > Vulnerabilities > Images > Registries.
Troubleshooting
x509: certificate signed by unknown authority
- Check if the defender can access the OpenShift registry.
- Ensure that the defender is installed in the same cluster as the OpenShift registry.
- Make sure that you have installed the ca.cert file in any one of the following locations: