Security Center:Add image repositories to Security Center

Limits

Only the Ultimate edition of Security Center supports this feature. For more information about how to purchase and upgrade Security Center, see Purchase Security Center and Upgrade and downgrade Security Center.

Limits

You can add the following types of image repositories to Security Center:

• Image repositories of Container Registry Enterprise Edition and Container Registry Personal Edition.

  You can synchronize information about the images in these image repositories to Security Center. Security Center can scan only the images of Container Registry Enterprise Edition.

• Third-party image repositories: Harbor, Quay, and GitLab repositories.

Prerequisites

Security Center Ultimate is purchased, and the container image scan feature is enabled. For more information, see Purchase Security Center and Enable container image scan.

Add an image repository of Container Registry to Security Center

If you use Container Registry Personal Edition, you can add image repositories of a Container Registry Personal Edition instance to Security Center after you create the instance. If you use Container Registry Enterprise Edition, you can add image repositories of a Container Registry Enterprise Edition instance to Security Center only after you configure a virtual private cloud (VPC) access control list (ACL) for the instance. For more information, see Configure a VPC ACL.

You can use one of the following methods to synchronize the information about the images in the image repositories of Container Registry Enterprise Edition and Container Registry Personal Edition:

• Automatic synchronization: Security Center automatically synchronizes the information in the early morning every day.

• Manual synchronization: You can manually synchronize the most recent information. For more information, see View security information about containers.

Add a third-party image repository to Security Center

If you create an access control policy for your image repository, make sure that the access control policy allows access from the IP address pools in the region in which the image repository resides.

1. If your third-party image service is deployed in a data center and connected over VPCs, you must forward the traffic destined for the image service. In this case, you must use an Elastic Compute Service (ECS) instance to forward traffic to the server in the data center in which the third-party image service is deployed.

   In the following sample commands, traffic on Port A of the ECS instance is forwarded to Port B of the on-premises server that uses the IP address 192.168.XX.XX.

   • Sample commands for CentOS 7

     • Use firewall-cmd

       firewall-cmd --permanent --add-forward-port=port=<Port A>:proto=tcp:toaddr=<192.168.XX.XX>:toport=<Port B>

     • Use iptables:

       1. Enable port forwarding.

          echo "1" > /proc/sys/net/ipv4/ip_forward                                                                                                                                                                                                                                                                                                                                                                                                                                                                           

       2. Configure port forwarding.

          iptables -t nat -A PREROUTING -p tcp --dport <Port A> -j DNAT --to-destination <192.168.XX.XX>:<Port B>

   • Sample commands for Windows

     netsh interface portproxy add v4tov4 listenport=<Port A> listenaddress=* connectaddress=<192.168.XX.XX> connectport=<Port B> protocol=tcp

2. Log on to the Security Center console. In the top navigation bar, select the region of the asset that you want to manage. You can select China or Outside China.

3. In the left-side navigation pane, choose Assets > Container.

4. On the Container page, click the Image tab. On this tab, click Add below Add Third-party Image Repository.

5. In the Add Image Repository panel, configure the following parameters and click Next.

   Parameter	Description
   Private Repository Type	The type of the third-party image repository. Valid values: harbor, quay and gitlab.
   Version	The version of the third-party image repository. Valid values: V1: If the version of the image repository is 1.X.X, select this option. V2: If the version of the image repository is 2.X.X or later, select this option. When you select gitlab as the Private Repository Type, V1 is the default option and cannot be changed.
   Communication Type	The protocol that you want Security Center to use to communicate with the third-party image repository. Valid values: http https
   Network Type	The network type of the third-party image repository. Valid values: Internet VPC
   RegionId	The ID of the region in which the third-party image repository resides.
   IP	The IP address and port number of the third-party image repository. If you configured traffic forwarding rules for your image service, you must set the IP parameter and port number to the ones of the ECS instance that forwards traffic destined for the image service.
   Port
   Domain Name	The domain name of the third-party image repository.
   Speed Limit	The number of images that can be added to Security Center per hour. Default value: 10. Important If a large number of images are added per hour, your services may be adversely affected. In most cases, we do not recommend that you set this parameter to Unlimited.
   Username	The username of the account that has administrative rights and is used to access the third-party image repository.
   Password	The password of the account.
   Quay Namespace Information	This parameter is required only if you set Private Repository Type to quay. In the Image Repository Organization field, enter the name of the organization to which the image repository belongs. In the Auth_token field, enter the Auth_token that corresponds to the organization. You can click Add to specify organizations to which multiple image repositories belong.
   GitLab Group Information	This parameter is required only if you set Private Repository Type to gitlab. In the Group Information field, enter the name of the group to which the image repository belongs. In the Access_token field, enter the Access_token that corresponds to the group. You can click Add to specify groups to which multiple image repositories belong.

   After the third-party image repository is added to Security Center, you can click Scan Settings in the upper-right corner of the Image Security page to view information about the added image repository in the Scan Settings panel. To go to the Image Security page, choose Protection Configuration > Container Protection > Image Security in the left-side navigation pane.

Error codes