How to update the vulnerability database in a closed loop

Updating the CVE database without Internet access.

In a closed loop, the cluster does not have access to public registries and vulnerability databases. To scan images up-to-date, you need to periodically update the vulnerability database through a mirror.

The update can be performed using the update.sh script or using a patch.

    Update with script update.sh

    • In the script update.sh it is necessary to fill in the variables MIRROR_FQDN, MIRROR_USERNAME, MIRROR_PASSWORD. The values of the variables can be viewed on the mirror, in the file config/config.yaml.
    • The script must be run without parameters. It can be run natively or in a container.

    Server requirements

    • There is access up to public.shturval.tech.
    • There is access to a local mirror.
    • Installed curl, added to $PATH (in case of native launch).

    To set oras run:

    curl -L -o /tmp/oras.tgz https://github.com/oras-project/oras/releases/download/v1.3.2/oras_1.3.2_linux_amd64.tar.gz && tar -zxvf /tmp/oras.tgz -C /bin/

    Preparing the image

    1. Prepare the script update.sh and Dockerfile and upload them to the mirror.

    Script update.sh:

    #!/bin/sh

MIRROR_FQDN=
MIRROR_USERNAME=
MIRROR_PASSWORD=
SHTURVAL_PUBLIC_REPO=public.shturval.tech

oras pull ${SHTURVAL_PUBLIC_REPO}/trivy-db:2
oras push ${MIRROR_FQDN}/trivy-db:2 ./db.tar.gz -u ${MIRROR_USERNAME}:${MIRROR_PASSWORD} --insecure
curl -k -u ${MIRROR_USERNAME}:${MIRROR_PASSWORD} -X POST "https://${MIRROR_FQDN}/service/rest/v1/components?repository=shturval_bin_public" -F "raw.directory=/vulndb/" -F "raw.asset0=@./db.tar.gz" -F "raw.asset0.filename=db.tar.gz"
rm -f db.tar.gz 

oras pull ${SHTURVAL_PUBLIC_REPO}/trivy-java-db:1
oras push ${MIRROR_FQDN}/trivy-java-db:1 ./javadb.tar.gz -u ${MIRROR_USERNAME}:${MIRROR_PASSWORD} --insecure
curl -k -u ${MIRROR_USERNAME}:${MIRROR_PASSWORD} -X POST "https://${MIRROR_FQDN}/service/rest/v1/components?repository=shturval_bin_public" -F "raw.directory=/vulndb/" -F "raw.asset0=@./javadb.tar.gz" -F "raw.asset0.filename=javadb.tar.gz"
rm -f javadb.tar.gz

oras pull ${SHTURVAL_PUBLIC_REPO}/trivy-checks:0
oras push ${MIRROR_FQDN}/trivy-checks:0 ./bundle.tar.gz -u ${MIRROR_USERNAME}:${MIRROR_PASSWORD} --insecure
rm -f bundle.tar.gz
oras pull ${SHTURVAL_PUBLIC_REPO}/trivy-checks:1
oras push ${MIRROR_FQDN}/trivy-checks:1 ./bundle.tar.gz -u ${MIRROR_USERNAME}:${MIRROR_PASSWORD} --insecure
rm -f bundle.tar.gz

    Example Dockerfile:

    FROM alpine:3
RUN apk add --update --no-cache curl tar gzip
RUN curl -L -o /tmp/oras.tgz https://github.com/oras-project/oras/releases/download/v1.3.2/oras_1.3.2_linux_amd64.tar.gz && tar -zxvf /tmp/oras.tgz -C /bin/
    1. On the VM where the mirror is located, start building the image from Dockerfile in the directory with the script update.sh and Dockerfile by running the command:
    docker build -t trivy-updater:latest .
    1. Run the script in the container by running the command:
    docker run -v $(pwd)/update.sh:/bin/update.sh trivy-updater:latest /bin/sh /bin/update.sh

    Update with patch

    Using a patch, you can add packages or images to the mirror without the need to rebuild the bundle or update the mirror.

    Request the preparation of a patch from the manager from Sturval. When updating the Trivy database, the Helm team prepares and submits a patch with the updated BDU.

    1. In the directory with the initialized mirror, create the shturval-patch directory, place the archive with the patch in it and run the command to apply the patch:
    stm patch apply
    ← How to enable Hubble UI
    What is VEX →