Harbor Scanner Adapter for Trivy

The Harbor Scanner Adapter for Trivy is a service that translates the Harbor scanning API into Trivy commands and allows Harbor to use Trivy for providing vulnerability reports on images stored in Harbor registry as part of its vulnerability scan feature.

TOC

• Deployment
  • Harbor >= 2.0 on Kubernetes
  • Harbor 1.10 on Kubernetes
• Configuration
• Documentation
• Troubleshooting
• Contributing

Deployment

Harbor >= 2.0 on Kubernetes

In Harbor >= 2.0 Trivy can be configured as the default vulnerability scanner, therefore you can install it with the official Harbor Helm chart, where HARBOR_CHART_VERSION >= 1.4:

$ helm repo add harbor https://helm.goharbor.io

$ HARBOR_CHART_VERSION=<chart version>
$
$ helm install harbor harbor/harbor \
    --version=$HARBOR_CHART_VERSION \
    --namespace harbor \
    --set clair.enabled=false \
    --set trivy.enabled=true

The adapter service is automatically registered under the Interrogation Service in the Harbor interface and designated as the default scanner.

Harbor 1.10 on Kubernetes

1. Generate certificate and private key files:

   $ openssl genrsa -out tls.key 2048
   $ openssl req -new -x509 \
       -key tls.key \
       -out tls.crt \
       -days 365 \
       -subj /CN=harbor-scanner-trivy.harbor
   

   NOTE: The Common Name (CN) is the fully qualified domain name of the adapter service. In this example we assumed that it is exposed as the harbor-scanner-trivy service in the harbor namespace.

2. Install the harbor-scanner-trivy chart:

   $ helm repo add aqua https://helm.aquasec.com
   

   $ helm install harbor-scanner-trivy aqua/harbor-scanner-trivy \
       --namespace harbor \
       --set service.port=8443 \
       --set scanner.api.tlsEnabled=true \
       --set scanner.api.tlsCertificate="$(cat tls.crt)" \
       --set scanner.api.tlsKey="$(cat tls.key)"
   

3. Configure the scanner adapter in the Harbor interface.
   1. Navigate to Interrogation Services and click + NEW SCANNER.
   2. Enter https://harbor-scanner-trivy.harbor:8443 as the Endpoint URL and click TEST CONNECTION.
   3. If everything is fine click ADD to save the configuration.
4. Select the Trivy scanner and set it as default by clicking SET AS DEFAULT. Make sure the Default label is displayed next to the Trivy scanner's name.

Configuration

Configuration of the adapter is done via environment variables at startup.

Documentation

• Architecture - architectural decisions behind designing harbor-scanner-trivy.
• Releases - how to release a new version of harbor-scanner-trivy.

Troubleshooting

Error: database error: --skip-update cannot be specified on the first run

If you set the value of the SCANNER_TRIVY_SKIP_UPDATE to true, make sure that you download the Trivy DB from GitHub and mount it in the /home/scanner/.cache/trivy/db/trivy.db path.

Error: failed to list releases: GET https://api.github.com/repos/aquasecurity/trivy-db/releases: 403 API rate limit exceeded

Trivy DB downloads from GitHub are subject to rate limiting. Make sure that the Trivy DB is mounted and cached in the /home/scanner/.cache/trivy/db/trivy.db path. If, for any reason, it's not enough you can set the value of the SCANNER_TRIVY_GITHUB_TOKEN environment variable (authenticated requests get a higher rate limit).

Contributing

Please read CONTRIBUTING.md for details on our code of conduct, and the process for submitting pull requests.