Available in:  Ultimate/EE

Included in extensions:  Advanced Infrastructure Security

The module lifecycle stage: Generally available version

The module has requirements for installation

The module regularly scans the images of running workloads for known CVEs, including vulnerabilities from the Astra Linux, RED OS, and ALT Linux databases. It is based on the Trivy project, using public vulnerability databases enriched with Astra Linux, ALT Linux, and RED OS data.

The module also performs cluster compliance analysis against the CIS Kubernetes Benchmark and other standards. The full list is in Compliance reports.

Main features

  • Automatic CVE scanning of container images in labeled namespaces. By default reports are regenerated every 24 hours; the interval is set by scanPeriods.workloadRescanPeriod.
  • CIS Kubernetes Benchmark compliance analysis with results stored in ClusterComplianceReport.
  • SBOM generation for all scanned container images (SbomReport).
  • Optional node host filesystem scanning for OS-level vulnerabilities (NodeVulnerabilityReport).
  • Optional periodic scanning of images in external container registries (RegistryScanTarget).
  • Exposed secrets detection in container images (ExposedSecretReport).
  • Optional admission-time blocking of vulnerable images (denyVulnerableImages).
  • Security events about found vulnerabilities, secrets and misconfigurations for the security-events-manager module.
  • Optional runtime application and network map (nodeAgent, preview).
  • Prometheus metrics and Deckhouse Console for vulnerability scan results; CIS and other compliance results in ClusterComplianceReport.

Read more about scanning, VulnerabilityReport and SbomReport reports, blocking vulnerable images, and CVE databases in Vulnerability scanning. The full list of module settings is in Configuration.

System requirements

The module has the following requirements:

  • Deckhouse Platform (DP) 1.76 or later.
  • A StorageClass backed by network or local block devices, or by local paths (localpath), for module data. The module stores scan results and runtime behaviour models in its own database (security-storage) instead of the cluster’s etcd. To keep scan results in etcd, set securityStorageForReports to false. Do not use a StorageClass backed by network file or object storage, such as NFS, CephFS, or S3. The apiServerStorageClass parameter sets the StorageClass for security-storage. The caches of the Trivy server and other scanner components use storageClass.
  • For blocking vulnerable images (denyVulnerableImages), the admission-policy-engine module.

Availability in editions

The module is available in the DP Enterprise Edition (EE) and Certified Security Edition (CSE). In CSE, the module is enabled by default in the Default and Managed bundles.

Scanning scope

The module splits its scanners into two groups with different scopes.

Image scanning is opt-in. It runs only in namespaces that have the label security-scanning.deckhouse.io/enabled="", and it produces VulnerabilityReport, SbomReport, and ExposedSecretReport. If the cluster has no namespaces with this label, the default namespace is scanned. Once a namespace with the label appears in the cluster, scanning of the default namespace stops.

To turn scanning back on for the default namespace, set the label:

d8 k label namespace default security-scanning.deckhouse.io/enabled=""

DP updates the list of scanned namespaces and restarts the operator, after which the namespace enters the image scanning scope.

Configuration scanning needs no label and covers every namespace, so that ClusterComplianceReport is built over the whole cluster. It produces ConfigAuditReport, RbacAssessmentReport, and InfraAssessmentReport. The complianceReports.skipSystemResources parameter is set to true by default, and then ConfigAuditReport and RbacAssessmentReport are not created in the d8-*, kube-*, and default namespaces at all. The Namespace label security.deckhouse.io/skip-compliance=true excludes a namespace in the same way, regardless of the parameter value. InfraAssessmentReport is exempt from these exclusions, so the CIS Kubernetes Benchmark checks for control plane components keep working.

Because of this split, the operator log reports the install mode as AllNamespaces with an empty target namespace list, even when a single namespace is labeled. That line describes the scope of configuration scanning, not of image scanning.

Removing the label stops new image scans in the namespace, but the reports already created there are not deleted at once. VulnerabilityReport is removed when its lifetime expires, within one scanPeriods.workloadRescanPeriod (24h by default), and is not created again. ExposedSecretReport and SbomReport have no lifetime of their own and remain until their workload is deleted.

Conditions for starting scanning

A scan starts automatically when a report becomes older than scanPeriods.workloadRescanPeriod (default 24h), and when components that use new images are deployed in namespaces where scanning is enabled.

Where to view scan results

In Deckhouse Console, a summary of vulnerabilities in images and cluster resources is in System → System management → Security → Vulnerabilities → By workloads.

Scan results are also stored in cluster objects:

The aggregated security score is published as resources: ClusterSecurityScore for the cluster and SecurityScore in every user namespace. How it is calculated is described in the Security score section.