Onboarding GitHub Container Registry

To configure container registry scanning of a GitHub Container RegistryClosed A collection of repositories used to store and access container images. environment, you need to onboard the environment to CloudGuard.

Prerequisites

Onboarding

To onboard a GitHub Container Registry to CloudGuard:

  1. In the CloudGuard portal, navigate to Asset > Environments.

  2. From the top menu, select Add > Container Registry and follow the setup steps.

    Alternatively, in KubernetesClosed Kubernetes, often abbreviated as “K8s”, orchestrates containerized applications to run on a cluster of hosts. cluster scanning environment, you can open the hosting cluster page and click Scan Registry on the top menu.

  3. In the Container Registry Onboarding wizard, enter the registry details:

    1. Environment Name - Enter a new name for the registry or use the default name. This name allows you to identify the registry later in CloudGuard.

    2. Environment Description - Optionally, enter a description.

    3. Select an Organizational Unit.

    4. Select the type of environment to host your scanner - Kubernetes or AWSClosed Amazon® Web Services. Public cloud platform that offers global compute, storage, database, application and other cloud services. ECS Scanner.

    5. Select a Kubernetes cluster or an AWS environment on which you can run the registry scanner:

    6. Registry Type - Select GitHub Container Registry.

    7. Registry URI - This field is not available for editing.

    8. Authentication Method - GitHub Container Registry Personal Access Token - For the Kubernetes scanner, enter the details below. For the AWS ECS scanner, only select the method and enter the details later in Step 3.

      1. Create a personal access token (classic) - see the GitHub Container Registry Documentation

      2. Pull Secret Name - Enter the image pull secret name that you create on the hosting cluster with your credentials.

        Make sure that the <secret-name> is a valid Kubernetes name. For more details, see the Kubernetes Documentation.

        To create the secret, run:

        Copy 
        kubectl create secret docker-registry <secret-name> \
          --namespace <cloudguard-namespace> \
          --docker-server=ghcr.io \
          --docker-username=github \
          --docker-password=<personal-access-token>

  4. Click Next to continue with Cluster Configurations.

In this step, you configure the CloudGuard Service Account credentials if in Step 1 you selected to onboard with a new cluster or with the existing cluster that requires an agent update.

For onboarding with the hosting cluster that has updated agents, this step is skipped.

  1. Configure a Service Account by one of these methods:

    • Select an existing Service Account with its corresponding API Key.

    • Enter a Service Account manually.

    • Click Add Service Account to create a new account.

  2. Click Next to continue to the next step.

This step appears when you select to associate the registry with a new cluster or with an existing cluster that requires an agent update. CloudGuard instructs you how to install Image Assurance agents or to update them to the latest version on the cluster.

For onboarding with the hosting cluster that has updated agents, this step is skipped.

CloudGuard shows the details of your new registry and its related cluster.

  1. Follow the on-screen instructions to copy the HelmClosed A Kubernetes deployment tool for automating creation, packaging, configuration, and deployment of applications and services to Kubernetes clusters. commands and run them on your cluster with Helm 3.

  2. Click Next.

CloudGuard shows the full details of your new registry and its related cluster. If your registry onboarding includes onboarding or updating the cluster, this page shows the cluster onboarding summary. The cluster deployment takes several minutes, and you can see its progress in the Cluster and Registry Status.

For more information on the cluster onboarding summary, see STEP 4 - Onboarding Summary.

  • Wait for the deployment completion based on the Cluster and Agent Status or click Finish to skip the process.

Follow the on-screen instructions to use the provided CloudFormation Template and launch the CFT for the ECS scanner.

  1. Select to use a new ECS cluster or an existing one.

  2. Use the URL to review the CloudFormation Template.

  3. Open the AWS Secrets Manager and click Secrets.

  4. Click Store a new secret to create an image pull secret with:

    • Secret type: Other type of secret

    • Key: <registry_URI>

    • Value: <GITHUB_USERNAME>: <GITHUB_PASSWORD>

  5. Open the image pull secret and copy Secret ARN from Secret details. You need this ARNClosed Amazon Resource Names (ARNs) uniquely identify AWS resources. They are required to specify a resource unambiguously across all of AWS, such as in IAM policies, Amazon Relational Database Service (Amazon RDS) tags, and API calls. in step 6g.

  6. In the CloudGuard wizard, click the link in step 4 to start the CloudFormation Stack Creation Process:

    1. On the Stacks page, click Create stack.

    2. In Step 1 Create stack, for Prepare template, select Choose an existing template.

    3. For Template source, select Amazon S3 URL.

    4. In the Amazon S3 URL field, paste the URL you copied in step 2 and click Next.

    5. In Step 2 Specify stack details, enter a name for the stack.

    6. In Parameters > CloudGuard, paste these details copied from step 5 of the CloudGuard wizard:

      • Environment ID

      • CloudGuard API Key ID

      • CloudGuard API Key Secret

    7. In AWS, enter these details:

      • Subnet - Select a subnet.

      • Optional - Registry Secret ARN - Enter the ARN of the secret created in step 3.

      • Optional - Custom CA Certificates ARN - see Certificate for AWS ECS Scanner.

  7. After the creation of the stack, click Finish.

CloudGuard opens the onboarded registry. For onboarding validation, see the Scanners tab that shows the status of the registry and its scanning environment (cluster or AWS ECS).

For registries with the Kubernetes scanner, the related Kubernetes cluster page shows information about the registries that the cluster scans, in the list on Blades > Image Assurance > Image Scan Engine agent.

More Links