Skip to content

Aqua Enterprise Scanner

You can use Aqua's commercial scanner to scan container images and generate vulnerability reports. The Starboard connector for Aqua attempts to fetch the vulnerability report for the specified image digest via Aqua's API. If the report is not found, it spins up an ad-hoc scan by executing the scannercli command.

The value of aqua.imageRef determines the version of the actual scannercli binary executable and must be compatible with the version of your Aqua server. By default, scannercli 5.3 is used, but if you are running, for example, Aqua 5.2, change the value to docker.io/aquasec/scanner:5.2.

To integrate Aqua scanner change the value of the vulnerabilityReports.scanner property to Aqua:

kubectl patch cm starboard -n <starboard_namespace> \
  --type merge \
  -p "$(cat <<EOF
{
  "data": {
    "vulnerabilityReports.scanner": "Aqua"
  }
}
EOF
)"

Specify the container image of Aqua scanner and server URL:

AQUA_SERVER_URL=<your console URL>

kubectl create configmap starboard-aqua-config -n <starboard_namespace> \
  --from-literal=aqua.imageRef=docker.io/aquasec/scanner:5.3 \
  --from-literal=aqua.serverURL=$AQUA_SERVER_URL

Finally, create or edit the starboard-aqua-config secret to configure aqua.username and aqua.password credentials, which are used to connect to the Aqua's management console:

AQUA_CONSOLE_USERNAME=<your username>
AQUA_CONSOLE_PASSWORD=<your password>

kubectl create secret generic starboard-aqua-config -n <starboard_namespace> \
  --from-literal=aqua.username=$AQUA_CONSOLE_USERNAME \
  --from-literal=aqua.password=$AQUA_CONSOLE_PASSWORD

Tip

You can use Helm installer to enable Aqua Enterprise scanner as follows:

AQUA_SERVER_URL=<your console URL>
AQUA_CONSOLE_USERNAME=<your username>
AQUA_CONSOLE_PASSWORD=<your password>

helm install starboard-operator ./deploy/helm \
  --namespace starboard-system --create-namespace \
  --set="targetNamespaces=default" \
  --set="operator.vulnerabilityReportsPlugin=Aqua" \
  --set="aqua.imageRef=docker.io/aquasec/scanner:5.3" \
  --set="aqua.serverURL=$AQUA_SERVER_URL" \
  --set="aqua.username=$AQUA_CONSOLE_USERNAME" \
  --set="aqua.password=$AQUA_CONSOLE_PASSWORD"

Settings

CONFIGMAP KEY DEFAULT DESCRIPTION
aqua.imageRef docker.io/aquasec/scanner:5.3 Aqua scanner image reference. The tag determines the version of the scanner binary executable and it must be compatible with version of Aqua console.
aqua.serverURL N/A The endpoint URL of Aqua management console
SECRET KEY DESCRIPTION
aqua.username Aqua management console username
aqua.password Aqua management console password