How To Install Trivy Image Scanning Offline DB On Air-Gapped Harbor in Tanzu Kubernetes Grid Integrated Edition
search cancel

How To Install Trivy Image Scanning Offline DB On Air-Gapped Harbor in Tanzu Kubernetes Grid Integrated Edition

book

Article ID: 316851

calendar_today

Updated On:

Products

VMware Tanzu Kubernetes Grid Integrated Edition

Issue/Introduction

To provide the instructions needed for installing Trivy on an air-gapped Tanzu Kubernetes Grid Integrated Edition (TKGI) deployed Harbor.

Resolution

Download the vulnerability database 

You must manually download the vulnerability database for use in air-gapped environments. Go to trivy-db and download trivy-offline.db.tgz in the latest release. If you download trivy-light-offline.db.tgz, you have to run Trivy with --light option.

wget https://github.com/aquasecurity/trivy-db/releases/latest/download/trivy-offline.db.tgz

Transfer the DB file into the air-gapped environment

  • Transfer the DB file to a VM with access to Bosh CLI or the OpsMan VM
  • Run a command similar to the following to copy the file to the Harbor VM via the bosh CLI:

bosh -d <HARBOR_SERVICE_INSTANCE> scp ~/Downloads/trivy-offline.db.tgz harbor-app/<UUID>:/tmp/trivy-offline.db.tgz

 

Put the DB file in Trivy's cache directory with permissions

Issue commands similar to the following:

bosh -d <HARBOR_SERVICE_INSTANCE> ssh harbor-app/<UUID>
sudo -i
mkdir -p /var/vcap/store/harbor/trivy-adapter/trivy/db/
mv /tmp/trivy-offline.db.tgz /var/vcap/store/harbor/trivy-adapter/trivy/db/trivy-offline.db.tgz
cd /var/vcap/store/harbor/trivy-adapter/trivy/db/
tar xvf trivy-offline.db.tgz
rm trivy-offline.db.tgz
chown 10000:10000 -R /data/trivy-adapter/trivy/db
chmod 700 /data/trivy-adapter/trivy/db $ chmod 644 /data/trivy-adapter/trivy/db/*

Note: In an air-gapped environment it is your responsibility to update the Trivy database on a regular basis, so that the scanner can detect recently-identified vulnerabilities.

 

Run Trivy with --skip-update option

In an air-gapped environment, specify --skip-update so that Trivy doesn't attempt to download the latest database file:

trivy image --skip-update alpine:3.12


Additional Information