Enable vulnerability reporting on Red Hat OpenShift Container Platform or Kubernetes

You can enable vulnerability reporting by setting Helm values for Red Hat Edge Manager and configuring Red Hat Trusted Profile Analyzer authentication. After you complete this procedure, the flightctl-periodic service begins syncing CVE data from Red Hat Trusted Profile Analyzer.

Procedure

  1. Set vulnerabilityReporting.enabled to true in your Red Hat Edge Manager Helm release values. Merge the following example with your existing configuration:

    vulnerabilityReporting Helm values 

    vulnerabilityReporting:
  enabled: true
  syncInterval: "15m"
  trustify:
    endpoint: "https://rhtpa.example.com"
    auth:
      mode: "none"
  2. If Red Hat Trusted Profile Analyzer uses OAuth2 client credentials, set auth.mode to client-credentials and set oidcIssuerUrl. Reference a Kubernetes secret for the client ID and secret: 
    vulnerabilityReporting:
  enabled: true
  syncInterval: "15m"
  trustify:
    endpoint: "https://rhtpa.example.com"
    auth:
      mode: "client-credentials"
      oidcIssuerUrl: "https://sso.example.com/realms/rhtpa"
      secretName: "rhtpa-credentials"
  3. Create the secret in the same namespace as the Red Hat Edge Manager release before you upgrade: 
    $ kubectl create secret generic rhtpa-credentials \
  --from-literal=client_id=<client_id> \
  --from-literal=client_secret=<client_secret> \
  -n <namespace>
  4. Upgrade the Helm release so flightctl-periodic loads the new configuration. The Red Hat Trusted Profile Analyzer credentials secret is mounted only into the periodic service pod.

Results

  1. Confirm the flightctl-periodic pod logs contain vulnerability-sync entries after the sync interval elapses.
  2. Run flightctl get vuln --summary-only after devices report an imageDigest and Red Hat Trusted Profile Analyzer has data for those digests.

For troubleshooting, see Troubleshooting vulnerability reporting.