Image analysis

In the cluster Security section, the Image Analysis page shows container image vulnerability scan results using Trivy. On this page, you can:

• download a CSV report for all namespaces, a single namespace, or according to filters configured in the table. PDF reports are available for a single namespace only.
• filter results by namespace. By default, scan results are shown for all cluster namespaces.

The graphical interface displays only one scan report. Each new report replaces the previous one. Summary information shows the number of vulnerabilities by severity for the selected namespace. When table filters are configured, summary counts are not updated.

Reports may show High and Critical vulnerabilities that do not apply to Shturval platform component container images. To exclude such vulnerabilities from the report, follow the steps in the instructions.

Clicking a vulnerability row opens a sidebar with additional information.

Remediation options #

• Update vulnerable packages: Updating vulnerable packages to the latest versions can fix many vulnerabilities.
• Remove vulnerable packages: If a vulnerable package is no longer needed, remove it for additional security.
• Fix vulnerabilities in code: If a vulnerability is in application code, remediation may require code changes or new functionality.
• Temporarily disable the vulnerable component, apply a patch, or configure other protective measures.

CSV report #

To open a CSV report in MS Excel:

1. Download the report from the page by clicking Download report, then Download CSV. In the modal window, select the namespaces and severity levels to include in the report.
2. Create a new MS Excel file and go to the Data section.
3. On the left side of the control panel, select Get External Data, then From Text, select the downloaded report file, and click Import.
4. In the Text Import Wizard window, select the Delimited data format and click Next.
5. Select Comma as the delimiter and click Next.
6. Select General as the column data format and click Finish.

Configuring the container image analysis interval #

To set the container image vulnerability rescan interval and report retention period:

1. Prepare a manifest for the ShturvalServicePatch (PatchSSC) object to apply to the Container image scanning module (shturval-scanner) specification with the required parameters in customvalues, as shown in the example below.

apiVersion: ops.shturval.tech/v1beta2
kind: ShturvalServicePatch
metadata:
  name: <resource name>
spec:
  shturvalServiceConfigName: shturval-scanner
  customvalues:
    operator:
      scanJobTTL: "<your parameter value>"
      scannerReportTTL: "<your parameter value>"

2. In the graphical interface, use manifest import to load the ShturvalServicePatch into the cluster:

• Click the manifest import icon to the left of the user name. Upload the prepared ShturvalServicePatch file for shturval-scanner or drag the manifest into the window. Verify the manifest and click Upload.

3. In the cluster, go to Services and repositories → Installed services, find the Container image scanning module (shturval-scanner), and open its management page. On the Applied PatchSSC tab, the uploaded ShturvalServicePatch is displayed. After the ShturvalServicePatch is applied, the Service tab shows the status Patched.