Security Automation with Ansible 2

Anchore CLI scanner

Now that we have the Anchore Engine service REST API with access details, we can use this to perform the scanning of container images in any host. The following steps are the Ansible Tower setup to perform continuous scanning of container images for vulnerabilities.

The playbook for scanning a container image is shown as follows:

- name: anchore-cli scan  hosts: anchore  become: yes  vars:    scan_image_name: "docker.io/library/ubuntu:latest"    anchore_vars:      ANCHORE_CLI_URL: http://localhost:8228/v1      ANCHORE_CLI_USER: admin      ANCHORE_CLI_PASS: secretpassword  tasks:    - name: installing anchore-cli      pip:        name: "{{ item }}"      with_items:        - anchorecli        - pyyaml        - name: downloading image      docker_image:         name: "{{ scan_image_name }}" - name: ...