Airwave Tech

Scanning Pods with Anchore, Jenkins, Minikube, Windows

Shifting Security Left by scanning your container images

It’s been quite some time since I wrote a how-to article. A lot has changed since then with me personally but let’s get right into it.

Anchore Engine is an open-source tool that scans your container images to see if there are any open vulnerabilities.

For example, if your base image is node:alpine how do you know if that image is safe to use? Anchore will scan your built image and let you know if there are vulnerabilities that you can leverage during the build process.

Here’s the breakdown of what we’ll be doing:

⦁ Install Jenkins in our Minikube / Windows 10 setup.
⦁ Install Anchore
⦁ Configure Jenkins plugins
⦁ Set up a freestyle pipeline job to build, push and scan a custom container image

You’ll need:

⦁ A working instance of Minikube
⦁ Helm
⦁ Internet access
⦁ Dockerhub account (optional)

Installing Jenkins on Minikube / Windows 10

Github Repo: https://github.com/airwavetechio/jenkins-demo
Minikube version: v1.15.1
OS: Windows 10 Pro
Production-ready: No
Jenkins: 2.274

First off, you’ll want to clone the repo above. It’s a modified version of the Jenkins Helm chart, broken down to suit our demo needs.

We are going to be building Docker images inside of Jenkins so we’ll have to modify our Minikube node just a bit.

First, you’ll want to ssh into your Minikube instance.
minikube ssh

Next, we are going to ensure our docker user inside Minikube has the same group ID as the jenkins user inside of the Jenkins container we will be deploying. I’ll explain more in a bit why we need to do this, but first, check to see if your docker user’s group ID is 1000

id docker

This varies depending on which driver you are using — this one is using vm-driver=hyperv

If not, run this command to fix it:

sudo groupmod -g 1000 docker

This varies depending on which driver you are using — this one is using vm-driver=docker

Now check the permission of /var/run/docker.sock . We will need to use this for Jenkins so we can build Docker images.

ls -l /var/run/docker.sock

group is 999

If the group is 999, change that to 1000.

sudo chown root:1000 /var/run/docker.sock

The group is now “docker” since we changed the group id to 1000

Finally, we are going to create a directory on the Minikube host to store our Jenkins configurations in case you need to restart things. We will be mounting this to the deployment.

sudo mkdir -p /data/jenkins-home
sudo chown docker:1000 -R /data
ls -l /data
exit

/data/Jenkins-home permissions should look like this

Now navigate to the cloned repo and install some prerequisites like:
– a Jenkins namespace
– RBAC
– persistent volume
– Jenkins configmap
– Jenkins configuration as code
– Jenkins secret

git clone https://github.com/airwavetechio/jenkins-demo
cd jenkins-demo
kubectl apply -f prereqs

Now you want to install Jenkins itself.

kubectl apply -f deployment.yaml

Our installation comes prepackaged with the plugins you need to complete the demo. If you want to add our own plugins, look in the ./prereqs/jenkins-cm.yaml file and add your plugin within the plugins.txt config.

Jenkins should be up and running in a minute or two, but make sure you validate it.

kubectl get pods -n Jenkins

Install Anchore

Next, let’s install Anchore into your Minikube instance. Using Helm, install Anchore into the default namespace.

helm repo add anchore https://charts.anchore.io
helm install anchore-demo anchore/anchore-engine

A snippet of the Helm installation

Validate the installation

kubectl get deployments

Configure Jenkins plugins

Since we pre-installed plugins along with the Jenkins deployment, we will need to configure them.

Let’s connect to your Jenkins instance

kubectl –namespace jenkins port-forward svc/jenkins 8080:8080

Now open your browser to http://localhost:8080/ . The authentication secrets are in prereqs\secret.yaml

Click on Manage Jenkins > Configure System

This is where we will configure the plugins.

Configure Anchore

Scroll down to Anchore Container Image Scanner

Engine URL http://anchore-demo-anchore-engine-api.default:8228/v1
– This is the name of the Anchore API service with the namespace.

Engine Username admin

Engine Password foobar
– You can find this from the Anchore secret.

Configure the Docker Builder

Scroll down to Docker Builder and type in unix:///var/run/docker/docker.sock

The changes we made in the Minikube node allow us to connect to the socket. Our custom deployment of Jenkins mounts /var/run from your Minikube node to /var/run/docker within the Jenkins container. Also within the container, the jenkins user’s group ID is 1000, matching the group ID we changed earlier. In other words, we matched the group ID of the jenkins user in the container with the docker user of the Minikube node

Test the connection

Don’t forget to click Save at the bottom.

Set up a freestyle pipeline job to build a custom container image

In this phase, we are going to create a pipeline job to scan a Docker image following this flow.

Clone > Build > Push > Scan

Setting up the Freestyle Job

Click on Dashboard > Create a job

Create a job name with no spaces and click Freestyle project > OK

In this step, we will be cloning a pre-existing GitHub repository.

IF you have followed our guides before, then you might be familiar with this repo. If not, this is our example repo we use to test things, such as deployments. It’s a node app that serves a static page on port 5000.

You can use your own repo if you wish as long as there is a Dockerfile in the repo.

Scroll down to Source Code Management and add this Github URL https://github.com/airwavetechio/DemoService.git

Changes the branch to */main

In this step, we will be building the Docker image from the Dockerfile located in the repo. If you don’t have Docker Hub (or any other registry) access available to you, you can skip the two Execute Docker command build steps (this one and the next one).

Scroll down to Build > Add build step > Execute Docker command