Enable vulnerability reporting on Red Hat Enterprise Linux with Podman

You can enable vulnerability reporting on a Red Hat Enterprise Linux deployment by editing the service configuration file and restarting the periodic service. After you complete this procedure, the flightctl-periodic service begins syncing CVE data from Red Hat Trusted Profile Analyzer.

Procedure

  1. Edit /etc/flightctl/service-config.yaml and set the vulnerabilityReporting block: 
    vulnerabilityReporting:
  enabled: true
  syncInterval: 15m
  trustify:
    endpoint: https://rhtpa.example.com
    auth:
      mode: client-credentials
      oidcIssuerUrl: https://sso.example.com/realms/rhtpa
      clientId: <client_id>
      clientSecret: <client_secret>
    Important

    Do not store client secrets in plain text in production. Use environment variable overrides as described in Configuration reference.
  2. Restart the periodic service: 
    $ sudo systemctl restart flightctl-periodic.service

Results

  1. Confirm flightctl-periodic logs contain vulnerability-sync entries after the sync interval elapses.
  2. Run flightctl get vuln --summary-only after devices report an imageDigest and Red Hat Trusted Profile Analyzer has data for those digests.

For troubleshooting, see Troubleshooting vulnerability reporting.