From daade25359ff8d85ea03837fa9d48e4ffdbca381 Mon Sep 17 00:00:00 2001 From: Steven Smith Date: Tue, 13 Dec 2022 13:43:51 -0500 Subject: [PATCH] Updates cso information --- ...roc_container-security-operator-setup.adoc | 36 ++++++++++++------- 1 file changed, 23 insertions(+), 13 deletions(-) diff --git a/modules/proc_container-security-operator-setup.adoc b/modules/proc_container-security-operator-setup.adoc index f37a55130..4af70919f 100644 --- a/modules/proc_container-security-operator-setup.adoc +++ b/modules/proc_container-security-operator-setup.adoc @@ -1,17 +1,21 @@ -[[container-security-operator-setup]] -= Scan pod images with the Container Security Operator +:_content-type: PROCEDURE +[id="container-security-operator-setup"] += Scanning pod images with the Container Security Operator -Using the link:https://operatorhub.io/operator/container-security-operator[Container Security Operator], -(CSO) you can scan container images associated -with active pods, running on OpenShift (4.2 or later) and other Kubernetes -platforms, for known vulnerabilities. The CSO: +The link:https://operatorhub.io/operator/container-security-operator[Container Security Operator] (CSO) is an addon for the Clair security scanner available on {ocp} and other Kubernetes platforms. With the CSO, users can scan container images associated with active pods for known vulnerabilities. -* Watches containers associated with pods on all or specified namespaces -* Queries the container registry where the containers came from for vulnerability information provided an image’s registry supports image scanning (such as a Quay registry with Clair scanning) -* Exposes vulnerabilities via the ImageManifestVuln object in the Kubernetes API +[NOTE] +==== +The CSO does not work without {productname} and Clair. +==== + +The Container Security Operator (CSO) performs the following features: + +* Watches containers associated with pods on either specified or all namespaces. -Using the instructions here, the CSO is installed in the `marketplace-operators` namespace, -so it is available to all namespaces on your OpenShift cluster. +* Queries the container registry where the containers came from for vulnerability information (provided that an image's registry supports image scanning, such a a {productname} registry with Clair scanning). + +* Exposes vulnerabilities via the `ImageManifestVuln` object in the Kubernetes API. [NOTE] ==== @@ -19,9 +23,15 @@ To see instructions on installing the CSO on Kubernetes, select the Install button from the link:https://operatorhub.io/operator/container-security-operator[Container Security OperatorHub.io] page. ==== -== Run the CSO in OpenShift +[id="running-cso-openshift"] +== Downloading and running the Container Security Operator in {ocp} + +Use the following procedure to download the Container Security Operator. -To start using the CSO in OpenShift, do the following: +[NOTE] +==== +In the following procedure, the CSO is installed in the `marketplace-operators` namespace. This allows the CSO to be used in all namespaces of your {ocp} cluster. +==== . Go to Operators -> OperatorHub (select Security) to see the available `Container Security` Operator.