OpenShift 4.3: Quay Container Security Integration

Overview

In the Red Hat OpenShift 4.2 Web UI Console, we introduced a new Cluster Overview Dashboard as the landing page when users first log in. The dashboard is there to help users resolve issues more efficiently and maintain a healthy cluster. With the latest 4.3 release, we added an image security section to the cluster health dashboard card. This section will appear on the dashboard when the Container Security Operator gets installed.

Container Security Operator

The Container Security Operator brings Quay and Clair metadata into OpenShift.
 

Installing this operator enables cluster administrators to monitor known container image vulnerabilities in pods running on their Kubernetes cluster.

After deployment, there is no additional configuration for the operator to start querying the container registry for vulnerability data. If the registry supports image scanning, like Quay, then the vulnerabilities found will be exposed to the user by populating the ImageManifestVuln resource list and surfacing it on the cluster dashboard.

Vulnerability Details

Users will see the new “Image Security” section on the cluster health dashboard card. The card will list the number of vulnerabilities found and will provide a link to access more detailed information on the type of vulnerabilities.
 

Clicking on the link opens a popover with the breakdown of vulnerability by severity. Critical and high vulnerabilities will be listed first, followed by medium and lower risk. Fixable vulnerabilities are listed with two links. One link is the vulnerability name that goes out to the vulnerability view for the Quay instance the image is hosted on (for example, Quay.io), and the other is a link to view the Image Manifest Vulnerability resource details in the affected namespace.

Only the top five most severe vulnerabilities will be listed in the popover. For cases where there are more than five, users can navigate to the custom resource definition list to view all Image Manifest Vulnerability instances under the ImageManifestVuln resource.

Learn More

We are focused on helping users resolve issues rapidly to maintain healthy clusters. The Container Security Operator can now help by exposing vulnerability information on the cluster dashboard. Be on the lookout for additional security information to be surfaced in upcoming releases.

If you’d like to learn more about what the OpenShift team is up to or provide feedback on any of the new 4.3 features, please take this brief 3-minute survey.