clair endpoint for integration about stackrox HOT 4 CLOSED

Hey @yuanlinios , it depends on what endpoint you have configured your Clair instance to listen on.

I don't have first-hand experience running Clair (v4, I assume?), but from https://access.redhat.com/documentation/en-us/red_hat_quay/3.3/html/manage_red_hat_quay/clair-v4 I deduce that 8080 seems to be a common port for the HTTP API. So, depending on whether or not Clair is configured for TLS, the correct value here would be https://hostname:8080 or http://hostname:8080.

from stackrox.

Hello, thanks for the reply. I deployed clair in the same openshift cluster, and also exposed it as a https edge route.

clairctl works OK in my environment

export CLAIR_HOST=https://clairv4-quay-enterprise.apps.<mydomain>
clairctl report -host $CLAIR_HOST container-registry.oracle.com/os/oraclelinux:8.3

oraclelinux:8.3 found sqlite-libs 3.26.0-11.el8
ELSA-2021-1581:  sqlite security update (MODERATE)
                (fixed: 0:3.26.0-13.el8)
oraclelinux:8.3 found sqlite-libs 3.26.0-11.el8
ELSA-2021-4396:  sqlite security update (MODERATE)
                (fixed: 0:3.26.0-15.el8)
oraclelinux:8.3 found json-c 0.13.1-0.2.el8
ELSA-2021-4382:  json-c security and bug fix update (MODERATE)
                (fixed: 0:0.13.1-2.el8)
...

The problem is clair expects request for specific api endpoints, but returns 404 for anything else. So I want to know how the integration between stackrox and clair can be done properly

from stackrox.

Our Clair integration was originally built with Clairv2, and I do not believe it supports Clairv4 (unless the endpoint is the same). From the looks of it, we use the GET /layers/<layerName> endpoint from Clairv2, which, I believe, assumes Clairv2 already completed the scan separately. We simply just retrieve the results.

from stackrox.

Thank you for the information

from stackrox.