Scanning container images

Module shturval-scanner (Trivy), reports, interval and storage settings.

Introduction #

Scanning container images for vulnerabilities in the Shturval platform is performed by the Container Image Scanning Module (shturval-scanner) module using Trivy.

The scan results are displayed in the cluster in the Security section on the Image Analysis page.

Where to see results #

On the Image Analysis page, you can filter the results by namespace. By default, the results are displayed for all namespaces in the cluster.

The report can be downloaded:

• in CSV format - completely for all namespaces, for one namespace or in accordance with the filters configured in the table;
• in PDF format - only in the context of one namespace.

If there is no data in the report, an empty file is generated when downloading in CSV format.

The interface displays a report of one scan; each new report replaces the previous one.

Summary information shows the number of vulnerabilities by severity level, taking into account the selected namespace. If filters are configured in the table, the vulnerability summary is not updated based on those filters.

Clicking on a vulnerability line opens a sidebar with additional information (see the screenshot below).

Criticality classification (Trivy) #

Reports may display vulnerabilities with High and Critical severity, which are not applicable for container images of Shturval platform components. Such vulnerabilities can be excluded from the report using the instructions for marked vulnerabilities.

Report in CSV format #

To add a report in CSV format in MS Excel:

1. On the Image Analysis page, click Download Report and select Download CSV.
2. In the modal window that opens, select the namespaces and severity levels that should be in the report.
3. Create a new MS Excel file and go to the Data section.
4. On the left side of the control panel, select Get external data → From text, select the downloaded report file and click Import.
5. In the Text Wizard (Import) window, select the data format Delimited and click Next.
6. Select the delimiter Comma and click Next.
7. Select the column data format General and click Finish.

Configuring the scanning interval and report storage period #

By default, scanning is restarted every 24 hours, the report storage period before deletion is 24 hours. To change the retention interval and duration:

1. Prepare a manifest ShturvalServicePatch to apply to the ssc specification of the shturval-scanner module with parameters in customvalues.

   apiVersion: ops.shturval.tech/v1beta2
   kind: ShturvalServicePatch
   metadata:
     name: <resource name>
   spec:
     shturvalServiceConfigName: shturval-scanner
     customvalues:
       operator:
         scanJobTTL: "<your parameter value>"
         scannerReportTTL: "<your parameter value>"
   

   Parameter	Description	Data type	Example
   metadata.name	The name of the created ShturvalServicePatch	string	shturval-scanner-ttl
   operator.scanJobTTL	Scan restart interval. The default is 24 hours.	string	12h
   operator.scannerReportTTL	Retention period for reports before deletion. The default is 24 hours.	string	12h

2. Upload the manifest via import manifest in the cluster GUI (import icon → check → upload) (see the screenshot below).

   

   

3. Make sure that the patch is displayed in the Services and repositories section → Installed services → Container image scanning module → Applied ShturvalServicePatch tab, the service status is Patched (see the screenshot below).

   

Ways to eliminate vulnerabilities #

• Updating vulnerable packages to patched versions.
• Removing unused vulnerable packages from the image.
• Correction of vulnerabilities in the application code.
• Temporarily disabling a vulnerable component, installing a patch, or setting up other protection measures.