Image scanning in CI/CD
July 12, 2024
ID 273843
Kaspersky Container Security allows you to scan images that are used in CI/CD. To scan images from CI/CD, you should configure the integration of Kaspersky Container Security with CI/CD processes.
Data from listening to and intercepting network traffic must be securely transferred between the CI/CD environment and the solution.
To scan images or repositories (in order to scan configuration files) used in the CI/CD process, add a stage to the CI/CD pipeline that runs the Kaspersky Container Security scanner.
To scan images from CI/CD, in the configuration file used to integrate the repository, specify the API_BASE_URL
(web-address of the Kaspersky Container Security API server) and API_TOKEN
(token to access API of the Kaspersky Container Security) environment variables for the scanner. You must also specify API_CA_CERT
(certificate for verifying host server of the API solution) or SKIP_API_SERVER_VALIDATION = true
to skip this scan.
The scanning results are forwarded to the server and displayed in the Management Console in the Resources → CI/CD section. The provided table lists the images that were scanned, shows the results of the risk assessment, and indicates the detected vulnerabilities.
You can click the image name link to open a page with detailed information about image scanning results. This page is similar to the page showing the results of registry images scanning.
Kaspersky Container Security also displays the type of artifact for each object. Two main artifacts are used:
- File system is repository containing configuration files.
- Container image is template used for runtime implementation of the container.
For each scan object, you can specify the build number (BUILD_NUMBER
) and the build pipeline (BUILD_PIPELINE
) . These parameters can be used to determine the specific stage where the object failed.
For CI/CD images, rescanning is not provided.
Kaspersky Container Security performs the following types of scans in CI/CD:
- Scanning images from the image registry. The solution runs a scan after a successful build and saves the image into the image registry.
- Scanning of images in TAR archives. A TAR archive is stored as a build artifact that the solution scans in the next build pipeline.
- Scanning a Git repository, which can be performed in one of the following ways:
- for a project branch (individual development path) in the Git repository
- for a commit (state snapshot or checkpoint in the project's timeline)
To scan an image from an image registry:
Start the scan by running a command in the following format:
/scanner [TARGET] --stdout
where:
<TARGET>—
full address of the image in the registry;<--stdout>
—output to the security event log.
To access the registry, enter in the environment variables the login COMPANY_EXT_REGISTRY_USERNAME
password (token) COMPANY_EXT_REGISTRY_PASSWORD
.
Examples of scanning images in GitLab CI/CD and Jenkins CI/CD.
To scan an image from a TAR archive:
- Build an image and save it as a TAR archive using any application for creating containerized images.
- Start the scan by running a command in the following format:
/scanner [TARGET] --file --stdout
where:
<TARGET>
—path to the file with the image to be scanned<--file>
—flag indicating scanning of theTARGET
file<--stdout>
is the output to the security event log.
Example of a configuration file with settings for scanning a TAR archive
To scan the Git repository:
- In the configuration file of the Git repository, in the environment variables specify the token to access the repository (
GITHUB_TOKEN
orGITLAB_TOKEN
). - Start the scan by running a command in the following format:
/scanner [TARGET] --repo [--branch BRANCH] [--commit COMMIT] --stdout
where:
<TARGET>
—web address (URL) of the Git repository<--repo>
—flag indicating scanning of the
TARGET
file<--branch BRANCH>
—branch of the repository to be scanned
<--commit COMMIT>
—hash of the commit to be scanned
<--stdout>
is the output to the security event log.
Scan results can be viewed in Resources → CI/CD, or downloaded in the .SPDX, .JSON, and .HTML formats.