Clair with Quay in air-gapped cluster - is it possible?

[strus38]

Hi

I am trying to get a setup with Quay and enabling the Clair security scanner in a K8S cluster which does not have access to internet.
Is there an env variable to enable to point to a local Clair CVE DB to make it working?
Thanks

[crozzy]

Hi @strus38 please see the document: https://github.com/quay/clair/blob/main/Documentation/concepts/updatersandairgap.md

[strus38]

Hi
I have followed the instructions here: https://quay.github.io/clair/howto/testing.html
All is running, then: curl -L https://raw.githubusercontent.com/jgsqware/clairctl/master/install.sh | sh
Tweaking the clairctl.yml for the right configuration.
However:

• the clairctl health is not working (port 6061not exposed from the https://quay.github.io/clair/howto/testing.html how-to)

• it does not seem to be the right clairctl command:

clairctl --help

Analyze your docker image with Clair, directly from your registry or local images.

Usage:
clairctl [command]

Available Commands:
analyze Analyze Docker image
cluster Scan and analyze all Docker images in cluster
delete Delete Docker image
health Get Health of clairctl and underlying services
pull Pull Docker image to Clair
push Push Docker image to Clair
report Generate Docker Image vulnerabilities report
version Get Versions of Clairctl and underlying services

Any hints?

[crozzy]

Hi,

The link you downloaded is an old/unmaintained version of clairctl, please compile the clairctl binary from this repo. You will need either need to compile it yourself (go build -o . ./cmd/clairctl/), or alternatively you can docker exec into the indexer container and run clairctl there (docker exec -it clair-indexer /src/clair/clairctl --help).

[strus38]

Ah ... I was expecting this binary in clair and not clair-index. Thanks, I am going to try right away!
It works. Thanks.

[strus38]

The command worked... however it gets killed... any hints - how big is the generated file?
[root@bird-docker clair]# ./clairctl --config ../clairctl.yml export-updaters /mnt/foo/updates.gz
....
....
2021-06-30T16:16:40-04:00 INF starting fetch component=pkg/ovalutil/Fetcher.Fetch database=https://www.redhat.com/security/data/oval/v2/RHEL6/rhel-6.2-aus.oval.xml.bz2 updater=RHEL6-rhel-6.2-aus
2021-06-30T16:18:12-04:00 INF starting parse component=rhel/Updater.Parse updater=RHEL6-rhel-6.2-aus
Killed
[root@bird-docker clair]#
[root@bird-docker clair]#
[root@bird-docker clair]#
[root@bird-docker clair]# df -h
Filesystem Size Used Avail Use% Mounted on
devtmpfs 1.4G 0 1.4G 0% /dev
tmpfs 1.5G 0 1.5G 0% /dev/shm
tmpfs 1.5G 9.4M 1.4G 1% /run
tmpfs 1.5G 0 1.5G 0% /sys/fs/cgroup
/dev/mapper/cl-root 18G 18G 111M 100% /
/dev/sda1 1014M 177M 838M 18% /boot
tmpfs 287M 0 287M 0% /run/user/0
/dev/sdb 12G 41M 11G 1% /mnt/foo
overlay 18G 18G 111M 100% /var/lib/docker/overlay2/b80fa02343d5fc3db8e3f013daa349db130075737b98811b4719e440ab183f8f/merged
overlay 18G 18G 111M 100% /var/lib/docker/overlay2/c1df598dc9ae12e3558227d7bf65b3887ba1ef4e84963f165c4184672dd69b73/merged
overlay 18G 18G 111M 100% /var/lib/docker/overlay2/1fa284bc29688002228f1bc399d856d00e57f80435c323d3f27b81f16283d1c7/merged
overlay 18G 18G 111M 100% /var/lib/docker/overlay2/417e3d893beba423a5465fb43ae1fc206d2c6ff706c22f1122b03d0b451fc5c0/merged
overlay 18G 18G 111M 100% /var/lib/docker/overlay2/538a6bde760ebf3925b7bc39445b40931aadbbd93da40268fce3582e6b1153e7/merged
overlay 18G 18G 111M 100% /var/lib/docker/overlay2/79106f03a6da26b54d4e2f18b342d75709cfb4cb31201e68497eff8f3eb7799e/merged
overlay 18G 18G 111M 100% /var/lib/docker/overlay2/7d35788357217766266371f09c333ec413a6e40ced895693ae451f79c54cf08b/merged
overlay 18G 18G 111M 100% /var/lib/docker/overlay2/7c9f2e932841f1e5efff3105f47d1cb31a0670e23dedef71c15076bed12a8590/merged
overlay 18G 18G 111M 100% /var/lib/docker/overlay2/003930d82fe5ed4fa4d056d222f72e6c0ec24e2051536400bb52b49951bd8808/merged
overlay 18G 18G 111M 100% /var/lib/docker/overlay2/a2e360ee1c41fabb64cbb604dd0dd3dbe580194a1f1b0392714429b92d97cc82/merged
overlay 18G 18G 111M 100% /var/lib/docker/overlay2/918685406e7541450dd0e40520c53ba0ba903afa80fd87e0e179d79a61d9d65a/merged
overlay 18G 18G 111M 100% /var/lib/docker/overlay2/3624b581bde16404f35bef4802bb26bf45f8def330c295884f3e0453b6fc0557/merged
overlay 18G 18G 111M 100% /var/lib/docker/overlay2/2bfd82b3ad4bd7be8a0ac4d144347d40e574e322dc944bb12f0d769593a01b20/merged

Thanks

[strus38]

ok just noticed I got an OutOfMemory from this server ... well how much memeroy is needed by this process to run?

[strus38]

OK, so after many tries ... I finally succeed in running the clairtcl export-updaters command... but I really wonder the minimum conf requirements since to make it working, I had to:

• Move from a 4GB linux env to a 8GB env
• Add a memory swap file of 10GB
  It seems to consume a lot of RAM, so any advised values?
  Thanks.

[hdonnay]

It does indeed use quite a bit of RAM. The command was written and tested thinking it'd be run on a workstation, so I'm not sure what minimums are.

[strus38]

Ok, understood. We are running in an air-gapped environment, so i was hopping people could easily get this db on a laptop before putting it in their cluster. But more importantly, why is this db a lot heavier than for example the trivy cve db ?
I will look at reducing the urls where it gets the updates since I saw it contains a lot of them 6.x, and old stuff.
Anyway thanks for the help.