target/portauthority

API that leverages Clair to scan Docker Registries and Kubernetes Clusters for vulnerabilities

Introduction

Port Authority is an API service that delivers component based vulnerability assessments for Docker images at time of build and in run-time environments.

The Port Authority API is capable of orchestrating scans of individual public or private images as well as scanning entire private Docker registries like Docker Hub, Google Container Registry or Artifactory. To accomplish this, Port Authority breaks each Docker image into layers and sends it to the open source static analysis tool Clair in the backend to perform the scans and identify vulnerabilities. Upon completion of this workflow Port Authority maintains a manifest of the images and scan results.

Port Authority also supplies developers with customizable offerings to assist with the audit and governance of their container workloads. Port Authority provides a webhook that when leveraged by a Kubernetes admission controller will allow or deny deployments based off of user-defined policies and image attributes. Port Authority then achieves run-time inspection by integrating with Kubernetes to discover running containers and inventorying those deployed images for scanning.

Getting Started

Setup and Start Minikube

1. Install Minikube

2. Start Minikube:

   minikube start

NOTE: Supported Kubernetes versions (1.6.x - 1.9.x). Supported Clair versions v2.x.x.

Build and Deploy to Minikube

1. Use Minikube Docker:

   eval $(minikube docker-env)

2. Deploy official Port Authority stack:

   make deploy-minikube

(Optional). Local developer build stack:

1. Use Minikube Docker:

   eval $(minikube docker-env)

2. Get all Glide dependancies:

   make deps

3. Deploy official Port Authority stack:

   make deploy-minikube-dev

Optional Configuration

Different configuration adjustments can be made to the Port Authority deployment here: minikube/portauthority/portauthority/config.yml

✅ Add Docker Credentials used by the K8s Crawler scan feature

### Environment variables defined below are mapped to credentials used by the Kubernetes Crawler API (/v1/crawler/k8s)
### A 'Scan: true' flag will invoke their usage
k8scrawlcredentials:
  # Use "" for basic auth on registries that do not require a username and password
  - url: "docker.io" #basic auth is empty UN and PW
    username: "DOCKER_USER"
    password: "DOCKER_PASS"
  - url: "gcr.io" #basic auth is empty UN and PW
    username: "GCR_USER"
    password: "GCR_PASS"

✅ Enable the Kubernetes Admission Controller and change webhooks default behavior

# Setting imagewebhookdefaultblock to true will set the imagewebhooks endpoint default behavior to block any images with policy violations.
# If it is set to false a user can change enable the behavior by setting the portauthority-webhook deployment annotation to true
imagewebhookdefaultblock: false

Docs

Port Authority is an API service. See our complete API Documentation for further configuration, usage, Postman collections and more.

Contributing

We always welcome new PRs! See Contributing for further instructions.

Bugs and Feature Requests

Found something that doesn't seem right or have a feature request? Please open a new issue.

Copyright and License

©2018 Target Brands, Inc.

**Credit Renee French for original golang gopher

portauthority's Issues

Add support for token login Gitlab (Registry crawler)

We use a private Gitlab Docker registry which uses a JWT authentication service to issue auth tokens for the registry API. Instead of authenticating with a username and password for the registry crawler, is it possible to support the use of an authentication token?

For example we use https://gitlab.xxx/jwt/auth?service=container_registry&scope=repository:xxx/xxx:pull which gives us the token we need to authenticate with the registry.

Is it possible to either just use that token directly or to make an auth request to our JWT service?

⚠️ Archival Notice

This repository will be archived in 30 days in accordance with Target's internal retention policy.

Archived projects become read-only and will remain accessible to the public.
If you have questions or concerns, reach out here or internally to the OSPO team.

Authentication to gcr.io registries is broken

The token retrieved via docker.AuthRegistry isn't threaded into the call to docker.GetRegistry:

https://github.com/target/portauthority/blob/master/api/v1/routes.go#L388-L405

I hacked a fix that I'll try to polish up tomorrow; making an issue in case anyone runs into this problem in the meantime. Also useful to know that the way to make the request is as follows:

$ curl -XPOST -H 'content-type: application/json' localhost:31700/v1/images -d <<<EOF
{"Image":{
  "Registry":"https://gcr.io",
  "Repo":"<project-id>/<image-name>",
  "Tag":"<image-tag>",
  "RegistryPassword":"$(cat credentials.json | jq tostring)"
}} 
EOF

Clair copyright?

First off, this project is awesome, I really look forward to giving it a try, and seeing it grow.

However, I noticed some of the code in this project uses code from github.com/coreos/clair, this is awesome! That being said, it would be great if you could include the original copyright since you're re-using some of the code. If you've made changes, to the original file you can definitely add your copyright after the original. Additionally, the original project contains a NOTICE file (https://github.com/coreos/clair/blob/master/NOTICE) which you must include as well.

I noticed when looking at c12f84e#diff-604f4192deea5adf9c159e5f88f64630R1 and comparing it to https://github.com/coreos/clair/blob/release-2.0/api/api.go

Thanks!

Deployment image is not available

The deployment image used in the minikube deployment is unpublished. I manually edited it to target/portauthority:dockerbuilder, but I doubt that that tag is meant to be consumed.

Error upserting policy with AllowedRiskSeverity as list

A policy with AllowedRiskSeverity as a list fails to create:

$ curl -XPOST -H'content-type: application/json' -d '{"Policy":{"Name":"High","AllowedRiskSeverity":"[\"Negligible\",\"Low\",\"Medium\"]"}}' localhost:31700/v1/policies
{"Error":{"Message":"error upserting policy: pq: malformed array literal: \"{[\"Negligible\",\"Low\",\"Medium\"]}\""}}

The value is treated as a list when listing an image's vulnerabilities:

portauthority/api/v1/routes.go

Line 962 in f2513f0

err = json.Unmarshal([]byte(policy.AllowedRiskSeverity), &severities)

Maybe there's some marshaling required here: https://github.com/target/portauthority/blob/master/pkg/datastore/pgsql/policy.go#L60 ? My golang isn't too strong. Will try to look more into this tomorrow.

Feature request: Storing credentials for private registries in config file

It would be great if PA could store credentials for private registries so we wouldn't have to send them every time we run a scan.

Similar to what K8 Crawler.

Feature request: Handling environment variables in config file

It would be perfect if we could use environment variables to pull parts of the configuration, e.g. DB or registry credentials.