Onboarding Quay.io Container Registry
To configure container registry scanning of a Quay.io Container Registry
A collection of repositories used to store and access container images. environment, you need to onboard the environment to CloudGuard. It supports the SaaS solution provided by Quay.io for private repositories in an organization with the quay.io/organization pattern.
Prerequisites
-
Before onboarding your Container
A lightweight and portable executable image that contains software and all of its dependencies.
Containers decouple applications from underlying host infrastructure to make deployment easier in different cloud or OS environments, and for easier scaling. Registry for scanning, select a type of hosting environment (Kubernetes Kubernetes, often abbreviated as “K8s”, orchestrates containerized applications to run on a cluster of hosts. or ECS Amazon Elastic Container Service (ECS) - a fully managed container orchestration service that helps you deploy, manage, and scale Docker containers running applications, services, and batch processes. Scanner). -
For authentication with the Quay.io container registry, create a robot account. For more information, see the Quay documentation. CloudGuard discovers and scans all repositories to which this user has Read access.
Onboarding
To onboard a Quay Container Registry to CloudGuard:
STEP 1 - Registry Configurations
-
In the CloudGuard portal, navigate to Asset > Environments.
-
From the top menu, select Add > Container Registry and follow the setup steps.
Alternatively, in Kubernetes cluster scanning environment, you can open the hosting cluster page and click Scan Registry on the top menu.
-
In the Container Registry Onboarding wizard, enter the registry details:
-
Environment Name - Enter a new name for the registry or use the default name. This name allows you to identify the registry later in CloudGuard.
-
Environment Description - Optionally, enter a description.
-
Select an Organizational Unit.
-
Select the type of environment to host your scanner - Kubernetes or AWS
Amazon® Web Services. Public cloud platform that offers global compute, storage, database, application and other cloud services. ECS Scanner. -
Select a Kubernetes cluster or an AWS environment on which you can run the registry scanner:
-
For Kubernetes, select from the list of clusters with enabled Image Assurance. For a new cluster, click Onboard a new Kubernetes Cluster and see Onboarding Kubernetes Clusters. In this case, you quit the registry onboarding and, after onboarding a new cluster, you need to start the registry onboarding from the beginning.
-
For AWS, select from the list of all AWS environments onboarded to CloudGuard.
-
-
Registry Type - Select Quay.io Container Registry.
-
Registry URI - Use a URI in the format
quay.io/<organization>. -
Authentication Method - Quay Access Token - For the Kubernetes scanner, enter the details below each method. For the AWS ECS scanner, only select the method and enter the details later in Step 3.
Pull Secret Name - Enter the image pull secret name that you create on the hosting cluster with your credentials.
Make sure that the
<secret-name>is a valid Kubernetes name. For more details, see the Kubernetes Documentation.To create the secret, run:
kubectl create secret docker-registry <pull-secret-name>--namespace <namespace>--docker-server=quay.io/<organization>--docker-username=<robot-account-user-name>--docker-password=<robot-account-token>
-
-
Click Next to continue with Cluster Configurations.
STEP 2 - Cluster Configurations
In this step, you configure the CloudGuard Service Account credentials if in Step 1 you selected to onboard with a new cluster or with the existing cluster that requires an agent update.
For onboarding with the hosting cluster that has updated agents, this step is skipped.
-
Configure a Service Account by one of these methods:
-
Select an existing Service Account with its corresponding API Key.
-
Enter a Service Account manually.
-
Click Add Service Account to create a new account.
-
-
Click Next to continue to the next step.
For Onboarding with the Kubernetes Scanner
STEP 3 - Instructions
This step appears when you select to associate the registry with a new cluster or with an existing cluster that requires an agent update. CloudGuard instructs you how to install Image Assurance agents or to update them to the latest version on the cluster.
For onboarding with the hosting cluster that has updated agents, this step is skipped.
CloudGuard shows the details of your new registry and its related cluster.
-
Follow the on-screen instructions to copy the Helm
A Kubernetes deployment tool for automating creation, packaging, configuration, and deployment of applications and services to Kubernetes clusters. commands and run them on your cluster with Helm 3. -
Click Next.
STEP 4 - Onboarding Summary
CloudGuard shows the full details of your new registry and its related cluster. If your registry onboarding includes onboarding or updating the cluster, this page shows the cluster onboarding summary. The cluster deployment takes several minutes, and you can see its progress in the Cluster and Registry Status.
For more information on the cluster onboarding summary, see STEP 4 - Onboarding Summary.
-
Wait for the deployment completion based on the Cluster and Agent Status or click Finish to skip the process.
For Onboarding with the ECS Scanner
STEP 3 - AWS Configurations
Follow the on-screen instructions to use the provided CloudFormation Template and launch the CFT for the ECS scanner.
-
Select to use a new ECS cluster or an existing one.
-
Use the URL to review the CloudFormation Template.
-
Open the AWS Secrets Manager and click Secrets.
-
Click Store a new secret to create an image pull secret with:
-
Secret type: Other type of secret
-
Key: <registry_URI>
-
Value: <QUAY_USERNAME>: <QUAY_PASSWORD>
-
-
Open the image pull secret and copy Secret ARN from Secret details. You need this ARN
Amazon Resource Names (ARNs) uniquely identify AWS resources. They are required to specify a resource unambiguously across all of AWS, such as in IAM policies, Amazon Relational Database Service (Amazon RDS) tags, and API calls. in step 6g. -
In CloudGuard wizard, click the link in step 4 to start the CloudFormation Stack Creation Process in your AWS account:
-
On the Stacks page, click Create stack.
-
In Step 1 Create stack, for Prepare template, select Choose an existing template.
-
For Template source, select Amazon S3 URL.
-
In the Amazon S3 URL field, paste the URL you copied in step 2 and click Next.
-
In Step 2 Specify stack details, enter a name for the stack.
-
In Parameters > CloudGuard, paste these details copied from step 5 of the CloudGuard wizard:
-
Environment ID
-
CloudGuard API Key ID
-
CloudGuard API Key Secret
-
-
In AWS, enter these details:
-
Subnet - Select a subnet.
-
Optional - Registry Secret ARN - Enter the ARN of the secret created in step 3.
-
Optional - Custom CA Certificates ARN - see Certificate for AWS ECS Scanner.
-
-
-
After the creation of the stack, click Finish.
CloudGuard opens the onboarded registry. For onboarding validation, see the Scanners tab that shows the status of the registry and its scanning environment (cluster or AWS ECS).
For registries with the Kubernetes scanner, the related Kubernetes cluster page shows information about the registries that the cluster scans, in the list on Blades > Image Assurance > Image Scan Engine agent.