Enterprise Container registry - An important Pillar for DevSecOps

Having a centralized container repository is a very important pillar in DevSecOps practice. You build once and deploy the Golden Image across different environments/cluster. This image, which is very secure today and running in production can become vulnerable in a few weeks time. It is very important to store these images securely and continuously keep on scanning for security vulnerabilities. One such Enterprise Registry is Red Hat Quay. This article describes how to get started with Quay and keep scanning images for security vulnerabilities with Clair.

Prerequisite:

Quay installation required object storage before installing Red Hat Quay. In this article, objectbucketclaims object from RedHat Openshift Data Foundation is used.

Installation:

• Install the RedHat Quay via the operator as described in the doc.
• Create a secret

apiVersion: v1
stringData:
  config.yaml: |
    FEATURE_GENERAL_OCI_SUPPORT: true
    FEATURE_USER_INITIALIZE: true
    BROWSER_API_CALLS_XHR_ONLY: false
    SUPER_USERS:
    - quayadmin
    FEATURE_USER_CREATION: false
kind: Secret
metadata:
  name: quay-config-bundle
  namespace: {{ quay_project_name }}
type: Opaque

list of SUPER_USERS are the super user configured by default.

Get Shrishs’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

FEATURE_USER_INITIALIZE Enables the /api/v1/user/initialize Quay API endpoint to create the first user.

Create QuayRegistry

apiVersion: quay.redhat.com/v1
kind: QuayRegistry
metadata:
  name: demo-registry
  namespace: {{ quay_project_name }}
spec:
  configBundleSecret: quay-config-bundle
  components:
    - managed: true
      kind: clair
    - managed: true
      kind: postgres
    - managed: true
      kind: objectstorage
    - managed: true
      kind: redis
    - managed: true
      kind: horizontalpodautoscaler
    - managed: true
      kind: route
    - managed: true
      kind: mirror
    - managed: true
      kind: monitoring
    - managed: true
      kind: tls
    - managed: true
      kind: quay
    - managed: true
      kind: clairpostgres

Important to notice in the above definition that is registry is installed with Clair for default security vulnerability scanning.

• verify if all the pods are running.

[ocp@jumpbox tekton]$ oc get pods -n quay-demo
NAME                                                READY   STATUS      RESTARTS      AGE
demo-registry-clair-app-7bdc6f599f-ph9jv            1/1     Running     0             29m
demo-registry-clair-app-7bdc6f599f-w88zn            1/1     Running     3 (35m ago)   36m
demo-registry-clair-app-7bdc6f599f-z6z58            1/1     Running     3 (35m ago)   36m
demo-registry-clair-postgres-768c98d989-z5m2q       1/1     Running     1 (35m ago)   36m
demo-registry-quay-app-8564bd48cc-6d8zc             1/1     Running     0             35m
demo-registry-quay-app-8564bd48cc-h58bd             1/1     Running     0             35m
demo-registry-quay-app-upgrade-hffkq                0/1     Completed   2             36m
demo-registry-quay-config-editor-7cdf8b588f-9g4k9   1/1     Running     0             36m
demo-registry-quay-database-69f64b8fb6-rx2mc        1/1     Running     0             36m
demo-registry-quay-mirror-78bdd86f87-5tw9d          1/1     Running     0             35m
demo-registry-quay-mirror-78bdd86f87-cpzdv          1/1     Running     0             35m
demo-registry-quay-redis-9965b9658-j28wl            1/1     Running     0             36m

Initialize the superuser

export HOST=`oc get route demo-registry-quay -n quay-demo -o jsonpath='{.spec.host}'`
curl -k -X POST \
  -H 'Content-Type: application/json' \
  -d @- <<EOF \
  https://$HOST/api/v1/user/initialize
{
  "username": "quayadmin",
  "email": "email@email.com",
  "password": "quaypass123",
  "access_token": "true"
}
EOF
{"access_token":"DMYE8NK70U7FPI7JVUPG11GGE2CDSVJYTKFGJHPA","email":"email@email.com","encrypted_password":"o1Dek2LddMewY1LUMhxLvdglA4CT7D6Lgz+ZWAV/PfjFXqQuk9o0rutzr9yWkbam","username":"quayadmin"}

NOTE: This command can be executed once only (Initialize user in the empty database)

• Sign in to the quay console with the above-initialized user and password.

Using Quay

• Create organization.

• Create a repository in the above-created organization, and mark it as public for ease of use(test purpose)

• Create a robot account.

• Give this robot account, admin permission to the above-created repository.

• Check the credential for login into this repository.

• Copy the above command and login to the repository using docker/podman.
• Trying copying some image from the command line to the repository

skopeo copy docker://registry.redhat.io/rhel8/go-toolset:1.16.7-5 docker://$HOST/mydemoorg/pipelines-vote-api

• Verify your repository if the image is already pushed.

• Notice in the above image, by default Clair, scans the images for security vulnerabilities. Click on the scanned result to see a detailed report.

• One can create a notification(Quay Notification/Webhook/slack/..in case of any kind of security vulnerability is found while scanning.