最近准备花一周的时间准备CKS考试,在准备考试中发现有一个题目关于Trivy镜像安全扫描的题目。
What’s Trivy
Trivy的官方仓库https://github.com/aquasecurity/trivy,Trivy是一个开源的容器镜像漏洞扫描工具。它通过分析容器镜像中的操作系统包和应用程序依赖库,检测其中存在的已知漏洞。Trivy可以帮助用户及时发现容器镜像中的漏洞,并提供修复建议,从而提高容器镜像的安全性。它支持多种镜像仓库,如Docker镜像仓库、Container Registry等,并且可以与CI/CD工具集成,实现漏洞扫描的自动化。
Question 1
Scan all of the images used by Pods in the sunnydale namespace.
这个的目的就是让你利用Trivy对所有sunnydale下面的pod进行扫描
Practice
为了跟Question 2做铺垫,需要在Trivy中添加一些参数,至于参数的内容,我们可以使用trivy --help
进行查看
Usage:trivy [global flags] command [flags] targettrivy [command]Examples:# Scan a container image$ trivy image python:3.4-alpine# Scan a container image from a tar archive$ trivy image --input ruby-3.1.tar# Scan local filesystem$ trivy fs .# Run in server mode$ trivy serverScanning Commandsaws [EXPERIMENTAL] Scan AWS accountconfig Scan config files for misconfigurationsfilesystem Scan local filesystemimage Scan a container imagekubernetes [EXPERIMENTAL] Scan kubernetes clusterrepository Scan a repositoryrootfs Scan rootfssbom Scan SBOM for vulnerabilities and licensesvm [EXPERIMENTAL] Scan a virtual machine imageManagement Commandsmodule Manage modulesplugin Manage pluginsUtility Commandscompletion Generate the autocompletion script for the specified shellconvert Convert Trivy JSON report into a different formathelp Help about any commandserver Server modeversion Print the versionFlags:--cache-dir string cache directory (default "/home/cloud_user/snap/trivy/276/.cache/trivy")-c, --config string config path (default "trivy.yaml")-d, --debug debug mode-f, --format string version format (json)--generate-default-config write the default config to trivy-default.yaml-h, --help help for trivy--insecure allow insecure server connections-q, --quiet suppress progress bar and log output--timeout duration timeout (default 5m0s)-v, --version show version
通过trivy image --help
可以看到扫描镜像的用法
Examples:# Scan a container image$ trivy image python:3.4-alpine# Scan a container image from a tar archive$ trivy image --input ruby-3.1.tar# Filter by severities$ trivy image --severity HIGH,CRITICAL alpine:3.15# Ignore unfixed/unpatched vulnerabilities$ trivy image --ignore-unfixed alpine:3.15# Scan a container image in client mode$ trivy image --server http://127.0.0.1:4954 alpine:latest# Generate json result$ trivy image --format json --output result.json alpine:3.15# Generate a report in the CycloneDX format$ trivy image --format cyclonedx --output result.cdx alpine:3.15
因为Question 2问需要我们对HIGH,CRITICAL的pod进行删除,所以我们需要使用trivy image --severity HIGH,CRITICAL xxx
对所有镜像进行扫描
在扫描前,你需要使用kubectl get pod -n sunnydale
来看到所有的pod的名称,如果你需要查看镜像你可以使用如下的命令,列出所有的image和pod
kubectl get pod -n sunnydale -o custom-columns="Name:.metadata.name,Image:.spec.containers[*].image"
这里会出现结果:
此时你就可以依次对Image进行扫描了,如trivy image --severity HIGH,CRITICAL busybox:1.33.1
Question 2
Delete any Pods in the sunnydale namespace that have high or critical-level vulnerabilities. Feel free to use --force, as these Pods do not need to shift down gracefully.
这一问的目的就是让你对所有high or critical-level vulnerabilities的pod进行删除
Practice
对于上诉Question 1的扫描结果,如果出现如下的类似的内容,那么删除对应pod
至于怎么删除,不做过多赘述