Container Vulnerability Management in Kubernetes
summary
Pipeline enforces scanning, signing and runtime checks: 11,000 images scanned nightly by Trivy (eight workers), results stored in Harbor and exported to Prometheus/Alertmanager with MS Teams notifications, + dashboards for metrics. CVEs are triaged by CVSS, exploitability and service priority; allowlist entries expire after four weeks. Renovate auto-creates update MRs, fork-and-pin is used when needed, and cosign signatures are verified by a Kubernetes admission webhook. Custom tools (Harbor exporter, label-mapper) tie image usage to alerts and runbooks.
AI-written summary · about
chapters (8)
- 0:00Introduction and background
- 2:11Identifying CVEs in containers
- 7:14Prioritizing vulnerabilities
- 11:31Fixing CVEs in clusters
- 15:24Verifying container images
- 17:10Documenting vulnerabilities
- 21:28Overview of the setup
- 28:41Q&A session
related talks
22mIntegrating Security in the Build Pipeline
27mSurviving Day2 : Picking the Right Tool To Secure Your Kubernetes Habitat
24mSecuring Container Workloads
32mStrengthening Kubernetes Security
07mImplementing a Continuous & Proactive Security Mechanism to Protect K8s
33mDetection of vulnerabilities and misconfigurations in production images
38mTutorial: Building Security into Kubernetes Deployment Pipelines
35mKeeping Up with the CVEs: How to Find a Needle in a Haystack?