Red Hat OpenShift Container Platform

Image metadata

There are different types of image quality data, including package vulnerabilities and open source software (OSS) license compliance. Additionally, there might be more than one provider of this metadata. To that end, the following annotation format has been reserved:

quality.images.openshift.io/<qualityType>.<providerId>: {}

Table 47. Annotation key format
Component	Description	Acceptable values
`qualityType`	Metadata type	`vulnerability` `license` `operations` `policy`
`providerId`	Provider ID string	`openscap` `redhatcatalog` `redhatinsights` `blackduck` `jfrog`

Example annotation keys

quality.images.openshift.io/vulnerability.blackduck: {}
quality.images.openshift.io/vulnerability.jfrog: {}
quality.images.openshift.io/license.blackduck: {}
quality.images.openshift.io/vulnerability.openscap: {}

The value of the image quality annotation is structured data that must adhere to the following format:

Table 48. Annotation value format
Field	Required?	Description	Type
`name`	Yes	Provider display name	String
`timestamp`	Yes	Scan timestamp	String
`description`	No	Short description	String
`reference`	Yes	URL of information source or more details. Required so user might validate the data.	String
`scannerVersion`	No	Scanner version	String
`compliant`	No	Compliance pass or fail	Boolean
`summary`	No	Summary of issues found	List (see table below)

The summary field must adhere to the following format:

Table 49. Summary field value format
Field	Description	Type
`label`	Display label for component (for example, "critical," "important," "moderate," "low," or "health")	String
`data`	Data for this component (for example, count of vulnerabilities found or score)	String
`severityIndex`	Component index allowing for ordering and assigning graphical representation. The value is range `0..3` where `0` = low.	Integer
`reference`	URL of information source or more details. Optional.	String

Example annotation values

This example shows an OpenSCAP annotation for an image with vulnerability summary data and a compliance boolean:

OpenSCAP annotation

{
  "name": "OpenSCAP",
  "description": "OpenSCAP vulnerability score",
  "timestamp": "2016-09-08T05:04:46Z",
  "reference": "https://www.open-scap.org/930492",
  "compliant": true,
  "scannerVersion": "1.2",
  "summary": [
    { "label": "critical", "data": "4", "severityIndex": 3, "reference": null },
    { "label": "important", "data": "12", "severityIndex": 2, "reference": null },
    { "label": "moderate", "data": "8", "severityIndex": 1, "reference": null },
    { "label": "low", "data": "26", "severityIndex": 0, "reference": null }
  ]
}

This example shows the Container images section of the Red Hat Ecosystem Catalog annotation for an image with health index data with an external URL for additional details:

Red Hat Ecosystem Catalog annotation

{
  "name": "Red Hat Ecosystem Catalog",
  "description": "Container health index",
  "timestamp": "2016-09-08T05:04:46Z",
  "reference": "https://access.redhat.com/errata/RHBA-2016:1566",
  "compliant": null,
  "scannerVersion": "1.2",
  "summary": [
    { "label": "Health index", "data": "B", "severityIndex": 1, "reference": null }
  ]
}