Run scanner closer to the clusters and able to push result to central.

[flowdopip]

Following the Stackrox architecture:

The scanner component is only available next to the Central and scans the images that all sensors report to the central services. If the Kubernetes clusters are across regions ( Europe, the US or others) and each region has a dedicated registry, the scanner will try to pull images from all registries across all regions and can impact the bandwidth available across regions.

The goal is to try to have a dedicated scanner in each cluster consuming the local registry and report the results to central.

[RTann]

This is something we are currently in the process of doing, especially when image registries are only accessible from within specific clusters or at least not accessible from the Central Cluster.

[flowdopip]

Hi, thanks @RTann.

Any idea when it became available? It's something that we can collaborate to delivery ASAP?

[flowdopip]

Hi,
Any news?
Any roadmap to share with the community?

[md2119]

@flowdopip we do not have a roadmap to share with the community. As Ross pointed out this feature is being worked on and will be released soon. Please continue checking the release announcements.

[flowdopip]

Any news here?

[dcaravel]

Hi @flowdopip , with the 4.1 release this capability has been added - configurable via the API only (for now). For details lookup DelegatedRegistryConfigService in the API reference within the UI (or code here).

It requires a slim version of scanner to be installed in the secured cluster(s), which has been the default in OCP clusters (for some time now) and shown in the architecture docs:

With the release, scanner slim can now be installed in non-OCP secured clusters (via helm). That combined with the configuration mentioned above - registry interactions (scans) can be set to occur via the secured clusters as desired.