sysdiglabs / image-scanning-admission-controller

Kubernetes admission controller that validate image in deployment is vulnerability free

Prerequiste

• k8s cluster is ready and kubeconfig(~/.kube/config) is properly configured that can be leveraged by kubectl tool
• Have the following enviroment variables setup:
  • ANCHORE_CLI_URL (e.g. http://anchore-demo-anchore-engine-api.default.svc.cluster.local:8228/v1 or https://api.sysdigcloud.com/api/scanning/v1/anchore)
  • ANCHORE_CLI_USER
  • ANCHORE_CLI_PASS

Deploy Image Scan Admission Webhook

run make deploy

Clean Image Scan Admission Webhook from Cluster

run make clean

Test

run make test

Limitation

There is a 30 seconds timeout for the webhook validation, it will be limited for the image scanner to return scanning result for a new image. This is because the image scanner need to download the image, unfold the image, and then conduct scanning. There is also a request to the upstream to make the webhook timeout configurable. So if there is new image to deploy for the first time, the admission controller will deny the request if no result returns in 30 seconds. However, due to complexity of the deployment workflow, the environment variable REJECT_IF_TIMEOUT in the YAML file is used to tune the admission controller timeout behavior.

image-scanning-admission-controller's Issues

ValidatingWebhookConfiguration not created on OpenShift 4.2

Step-by-step process followed:

https://github.com/marcredhat/crcdemos/blob/master/sysdig/admissioncontroller/README.adoc

Expected result: ValidatingWebhookConfiguration created

Actual results:
oc logs image-scan-k8s-webhook-controller-manager-0 --follow
{"level":"info","ts":1571949974.6266456,"logger":"entrypoint","msg":"setting up client for manager"}
{"level":"info","ts":1571949974.6283126,"logger":"entrypoint","msg":"setting up manager"}
{"level":"info","ts":1571949975.0136602,"logger":"entrypoint","msg":"Registering Components."}
{"level":"info","ts":1571949975.0137165,"logger":"entrypoint","msg":"setting up scheme"}
{"level":"info","ts":1571949975.0137308,"logger":"entrypoint","msg":"Setting up controller"}
{"level":"info","ts":1571949975.0137427,"logger":"entrypoint","msg":"setting up webhooks"}
{"level":"info","ts":1571949975.0138788,"logger":"entrypoint","msg":"Starting the Cmd."}
{"level":"info","ts":1571949975.11553,"logger":"kubebuilder.webhook","msg":"installing webhook configuration in cluster"}

However, the pod enters a crash loop and the ValidatingWebhookConfiguration is not created.

Note: Other ValidatingWebhookConfiguration are working fine in the same environment
oc get ValidatingWebhookConfiguration --all-namespaces
NAME CREATED AT
autoscaling.openshift.io 2019-10-16T10:27:28Z
multus.openshift.io 2019-10-16T10:14:17Z

For a lab environment, you can fix this as follows but we need a proper solution:
oc adm policy add-scc-to-user anyuid -z default
securitycontextconstraints.security.openshift.io/anyuid added to: ["system:serviceaccount:image-scan-k8s-webhook-system:default"]