ROX-27689: provide example for non-delegated roxctl image scan #87112

RTann · 2025-01-15T22:21:18Z

Version(s):

4.4+

Issue:

https://issues.redhat.com/browse/ROX-27689

Link to docs preview:

QE review:

QE has approved this change.

Additional information:

openshift-ci-robot · 2025-01-15T22:21:21Z

@RTann: This pull request references ROX-27689 which is a valid jira issue.

In response to this:

Version(s):

4.4+

Issue:

https://issues.redhat.com/browse/ROX-27689

Link to docs preview:

QE review:

QE has approved this change.

Additional information:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

ocpdocs-previewbot · 2025-01-15T22:38:53Z

🤖 Wed Jan 15 22:38:52 - Prow CI generated the docs preview:

https://87112--ocpdocs-pr.netlify.app/openshift-acs/latest/cli/image-scanning-by-using-the-roxctl-cli.html

openshift-ci · 2025-01-15T22:39:12Z

@RTann: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/validate-asciidoc	`3d45f5a`	link	true	`/test validate-asciidoc`
ci/prow/validate-portal	`3d45f5a`	link	true	`/test validate-portal`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

dcaravel · 2025-01-15T22:32:33Z

cli/image-scanning-by-using-the-roxctl-cli.adoc

@@ -9,6 +9,58 @@ toc::[]
 [role="_abstract"]
 You can scan images stored in image registries, including cluster local registries such as the {ocp} integrated image registry by using the `roxctl` CLI.

+[id="scanning-images-by-using-a-remote-cluster_{context}"]
+== Scanning images by using the Central cluster


Not sure how to best message this, but IF the delegated scanning config has an entry matching the image being scanned, it will be sent to a secured cluster / not scanned by Central.

dcaravel · 2025-01-15T22:39:10Z

cli/image-scanning-by-using-the-roxctl-cli.adoc

+<reference> may be:
+  * blank
+  * a tag preceded by a colon, for example, `:latest`
+  * a digest preceded by an at sign, for example, `@sha256:710ecc84318c54c9d1e08fe89d03e74cc09350909e5b12e5d07ac6941fd02b27`


Would adding the actual characters render correctly / be more clear here? For example:

Suggested change

* a digest preceded by an at sign, for example, `@sha256:710ecc84318c54c9d1e08fe89d03e74cc09350909e5b12e5d07ac6941fd02b27`

* a digest preceded by '@', for example, `@sha256:710ecc84318c54c9d1e08fe89d03e74cc09350909e5b12e5d07ac6941fd02b27`

Or perhaps stating that the reference must be valid per... (and link the spec?)

I think we should shorten the SHA id for security reasons?

FWIW - the SHAs (digests) are not secrets in the image context, from a risk perspective it's generally recommended to reference images by digest instead of the tags because tags change, digests do not. Are other ways to address this 'tag change' risk, but a bit off-topic for this PR.

To be a valid sha256 the length has to be exactly 64 'hex' characters (each character represent 4 bits, for a total of 256 bits).

agantony · 2025-01-16T10:19:56Z

cli/image-scanning-by-using-the-roxctl-cli.adoc

@@ -9,6 +9,58 @@ toc::[]
 [role="_abstract"]
 You can scan images stored in image registries, including cluster local registries such as the {ocp} integrated image registry by using the `roxctl` CLI.

+[id="scanning-images-by-using-a-remote-cluster_{context}"]
+== Scanning images by using the Central cluster


Suggested change

== Scanning images by using the Central cluster

== Scanning images by using StackRox Scanner or Scanner V4 installed in the Central cluster

agantony · 2025-01-16T10:20:54Z

cli/image-scanning-by-using-the-roxctl-cli.adoc

+[id="scanning-images-by-using-a-remote-cluster_{context}"]
+== Scanning images by using the Central cluster
+
+The following outlines the procedure for scanning images via the StackRox Scanner or Scanner V4 installed in the Central cluster.


Suggested change

The following outlines the procedure for scanning images via the StackRox Scanner or Scanner V4 installed in the Central cluster.

To scan the images, you can use StackRox Scanner or Scanner V4 installed in the Central cluster.

agantony · 2025-01-16T10:22:24Z

cli/image-scanning-by-using-the-roxctl-cli.adoc

+
+.Procedure
+
+* Run the following command to scan the specified image:


Suggested change

* Run the following command to scan the specified image:

* To scan the specified image, run the following command:

https://github.com/openshift/openshift-docs/blob/main/contributing_to_docs/doc_guidelines.adoc#procedure-step-that-introduces-a-command

agantony · 2025-01-16T10:22:45Z

cli/image-scanning-by-using-the-roxctl-cli.adoc

+
+* Run the following command to scan the specified image:
+
+[source,terminal,subs="+quotes"]


Suggested change

[source,terminal,subs="+quotes"]

[source,terminal]

agantony · 2025-01-16T10:23:07Z

cli/image-scanning-by-using-the-roxctl-cli.adoc

+$ roxctl image scan \
+  --image=_<image_registry>_/_<image_name>_[_<reference>_] \// <1>
+  [flags] <2>


Suggested change

$ roxctl image scan \

--image=_<image_registry>_/_<image_name>_[_<reference>_] \// <1>

[flags] <2>

$ roxctl image scan \

--image=<image_registry>/<image_name>[reference] \// <1>

[flags] <2>

https://github.com/openshift/openshift-docs/blob/main/contributing_to_docs/doc_guidelines.adoc#command-syntax-for-replaceable-values

agantony · 2025-01-16T10:55:09Z

cli/image-scanning-by-using-the-roxctl-cli.adoc

+<1> For `<image_registry>`, specify the registry where the image is located, for example, `registry.redhat.io`.
+For `<image_name>`, specify the name of the image you want to scan, for example, `default/image`.
+<reference> may be:
+  * blank
+  * a tag preceded by a colon, for example, `:latest`
+  * a digest preceded by an at sign, for example, `@sha256:710ecc84318c54c9d1e08fe89d03e74cc09350909e5b12e5d07ac6941fd02b27`


Suggested change

<1> For `<image_registry>`, specify the registry where the image is located, for example, `registry.redhat.io`.

For `<image_name>`, specify the name of the image you want to scan, for example, `default/image`.

<reference> may be:

* blank

* a tag preceded by a colon, for example, `:latest`

* a digest preceded by an at sign, for example, `@sha256:710ecc84318c54c9d1e08fe89d03e74cc09350909e5b12e5d07ac6941fd02b27`

<1> For `<image_registry>`, specify the registry where the image is located, for example, `registry.redhat.io`.

+

For `<image_name>`, specify the name of the image you want to scan, for example, `default/image`.

+

Optional: For `[reference]`, choose the appropriate method to specify the version or identifier of the image.

+

* To scan the default image, leave it blank.

* To specify a tag, precede it with a colon (:). For example,`:latest`.

* To specify a digest, precede it with an at sign (@). For example, `@sha256:710ecc84318xxxxxx`.

agantony · 2025-01-16T11:47:01Z

cli/image-scanning-by-using-the-roxctl-cli.adoc

+[source,text,subs=attributes+]
+----
+{
+  "Id": "sha256:3f439d7d71adb0a0c8e05257c091236ab00c6343bc44388d091450ff58664bf9", <1>


Suggested change

"Id": "sha256:3f439d7d71adb0a0c8e05257c091236ab00c6343bc44388d091450ff58664bf9", <1>

"Id": "sha256:3f439d7d71adb0axxxxxx", <1>

agantony · 2025-01-16T11:47:02Z

cli/image-scanning-by-using-the-roxctl-cli.adoc

+[source,text,subs=attributes+]
+----
+{
+  "Id": "sha256:3f439d7d71adb0a0c8e05257c091236ab00c6343bc44388d091450ff58664bf9", <1>


Suggested change

"Id": "sha256:3f439d7d71adb0a0c8e05257c091236ab00c6343bc44388d091450ff58664bf9", <1>

"Id": "sha256:3f439d7d71adb0axxxxxx", <1>

Due to security reasons

agantony

Added a few comments for your consideration; overall lgtm!
Most of the comments also apply to the "Scanning images by using a remote cluster" section.
Please cross-check ..

agantony · 2025-01-16T11:47:20Z

cli/image-scanning-by-using-the-roxctl-cli.adoc

+[source,text,subs=attributes+]
+----
+{
+  "Id": "sha256:3f439d7d71adb0a0c8e05257c091236ab00c6343bc44388d091450ff58664bf9", <1>


Due to security reasons

agantony · 2025-01-16T11:47:36Z

cli/image-scanning-by-using-the-roxctl-cli.adoc

+----
+
+--
+<1> A unique identifier for the image that serves as a fingerprint for the image. It helps ensure the integrity and authenticity of the image.


Suggested change

<1> A unique identifier for the image that serves as a fingerprint for the image. It helps ensure the integrity and authenticity of the image.

<1> A unique identifier for the image that serves as a fingerprint for the image.

kcarmichael08 · 2025-02-13T19:31:12Z

Hi, was wondering if there are any updates on this?

openshift-bot · 2025-05-15T01:00:21Z

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jan 15, 2025

openshift-ci bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Jan 15, 2025

RTann force-pushed the ross-roxctl-update branch from 8f38296 to eba9dba Compare January 15, 2025 22:23

ROX-27689: provide example for non-delegated roxctl image scan

3d45f5a

RTann force-pushed the ross-roxctl-update branch from eba9dba to 3d45f5a Compare January 15, 2025 22:24

dcaravel reviewed Jan 15, 2025

View reviewed changes

agantony reviewed Jan 16, 2025

View reviewed changes

agantony added peer-review-done Signifies that the peer review team has reviewed this PR rhacs-docs-4.4 Label for PRs that apply to RHACS 4.4 rhacs-docs-4.5 rhacs-docs-4.6 rhacs-docs-4.7 labels Jan 16, 2025

agantony added this to the Continuous Release milestone Jan 16, 2025

openshift-ci bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label May 15, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ROX-27689: provide example for non-delegated roxctl image scan #87112

ROX-27689: provide example for non-delegated roxctl image scan #87112

RTann commented Jan 15, 2025

openshift-ci-robot commented Jan 15, 2025 •

edited by openshift-ci bot

Loading

ocpdocs-previewbot commented Jan 15, 2025

openshift-ci bot commented Jan 15, 2025

dcaravel Jan 15, 2025

dcaravel Jan 15, 2025 •

edited

Loading

agantony Jan 16, 2025

dcaravel Jan 17, 2025

agantony Jan 16, 2025

agantony Jan 16, 2025 •

edited

Loading

agantony Jan 16, 2025

agantony Jan 16, 2025

agantony Jan 16, 2025

agantony Jan 16, 2025

agantony Jan 16, 2025

agantony Jan 16, 2025

agantony Jan 16, 2025

agantony Jan 16, 2025

agantony Jan 16, 2025

agantony left a comment •

edited

Loading

agantony Jan 16, 2025

agantony Jan 16, 2025

kcarmichael08 commented Feb 13, 2025

openshift-bot commented May 15, 2025

	* a digest preceded by an at sign, for example, `@sha256:710ecc84318c54c9d1e08fe89d03e74cc09350909e5b12e5d07ac6941fd02b27`
	* a digest preceded by '@', for example, `@sha256:710ecc84318c54c9d1e08fe89d03e74cc09350909e5b12e5d07ac6941fd02b27`

	== Scanning images by using the Central cluster
	== Scanning images by using StackRox Scanner or Scanner V4 installed in the Central cluster

	The following outlines the procedure for scanning images via the StackRox Scanner or Scanner V4 installed in the Central cluster.
	To scan the images, you can use StackRox Scanner or Scanner V4 installed in the Central cluster.


		.Procedure

		* Run the following command to scan the specified image:

	* Run the following command to scan the specified image:
	* To scan the specified image, run the following command:

	"Id": "sha256:3f439d7d71adb0a0c8e05257c091236ab00c6343bc44388d091450ff58664bf9", <1>
	"Id": "sha256:3f439d7d71adb0axxxxxx", <1>

	<1> A unique identifier for the image that serves as a fingerprint for the image. It helps ensure the integrity and authenticity of the image.
	<1> A unique identifier for the image that serves as a fingerprint for the image.

ROX-27689: provide example for non-delegated roxctl image scan #87112

Are you sure you want to change the base?

ROX-27689: provide example for non-delegated roxctl image scan #87112

Conversation

RTann commented Jan 15, 2025

openshift-ci-robot commented Jan 15, 2025 • edited by openshift-ci bot Loading

ocpdocs-previewbot commented Jan 15, 2025

openshift-ci bot commented Jan 15, 2025

Choose a reason for hiding this comment

dcaravel Jan 15, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

agantony Jan 16, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

agantony left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kcarmichael08 commented Feb 13, 2025

openshift-bot commented May 15, 2025

openshift-ci-robot commented Jan 15, 2025 •

edited by openshift-ci bot

Loading

dcaravel Jan 15, 2025 •

edited

Loading

agantony Jan 16, 2025 •

edited

Loading

agantony left a comment •

edited

Loading