Image security scanning in Kubernetes - Mini Project: Build & Apply

Image Security Scanning in Kubernetes

📖 Scenario: You work in a team that deploys applications on Kubernetes. Your team wants to make sure container images are safe before running them. You will create a simple Kubernetes manifest and add a security scan annotation to it.

🎯 Goal: Build a Kubernetes Pod manifest with a container image and add an annotation to enable image security scanning.

📋 What You'll Learn

Create a Kubernetes Pod manifest named pod.yaml

Use the container image nginx:1.21

Add an annotation security.scan/enabled: "true" under metadata.annotations

Print the final manifest content

💡 Why This Matters

🌍 Real World

Teams use image security scanning annotations to integrate automated security tools that check container images before deployment. This helps prevent vulnerabilities from reaching production.

💼 Career

Knowing how to add security scanning annotations and labels in Kubernetes manifests is a key skill for DevOps engineers and site reliability engineers to maintain secure and reliable applications.

1

Create the basic Pod manifest

Create a Kubernetes Pod manifest named pod.yaml with apiVersion: v1, kind: Pod, and metadata.name set to secure-nginx. Under spec.containers, add one container with name: nginx and image: nginx:1.21.

Kubernetes

# Your code here to create the basic Pod manifest

Hint

Start with the basic structure of a Pod manifest. Use apiVersion: v1 and kind: Pod. Add metadata with the name secure-nginx. Then add one container with the specified image.

2

Add security scan annotation

Add an annotation security.scan/enabled: "true" under metadata.annotations in the Pod manifest.

Kubernetes

apiVersion: v1
kind: Pod
metadata:
  name: secure-nginx
  # Add annotations below
spec:
  containers:
  - name: nginx
    image: nginx:1.21

Hint

Annotations go under metadata. Use indentation carefully. Add the key security.scan/enabled with the value "true".

3

Add a label for environment

Add a label environment: production under metadata.labels in the Pod manifest.

Kubernetes

apiVersion: v1
kind: Pod
metadata:
  name: secure-nginx
  annotations:
    security.scan/enabled: "true"
  # Add labels below
spec:
  containers:
  - name: nginx
    image: nginx:1.21

Hint

Labels are siblings to annotations under metadata. Add labels: and then the key-value pair environment: production.

4

Print the final Pod manifest

Print the entire Pod manifest content exactly as it is, including the annotations and labels.

Kubernetes

# Print the Pod manifest content
# Your code here

Hint

Use a multi-line string variable to hold the manifest and print it exactly.

Practice

1. What is the main purpose of image security scanning in Kubernetes?

easy

A. To find vulnerabilities in container images before deployment

B. To increase the size of container images

C. To speed up the container startup time

D. To monitor network traffic between containers

Solution

1. Step 1: Understand image security scanning

   Image security scanning checks container images for security issues like vulnerabilities.

2. Step 2: Identify the main goal

   The goal is to find and fix vulnerabilities before deploying containers to keep apps safe.

3. Final Answer:

   To find vulnerabilities in container images before deployment -> Option A

4. Quick Check:

   Image scanning = find vulnerabilities [OK]

Hint: Image scanning finds security holes before use [OK]

Common Mistakes:

• Confusing scanning with performance tuning
• Thinking it monitors network traffic
• Believing it changes image size

2. Which command correctly scans a Docker image named myapp:latest using Trivy?

easy

A. trivy myapp:latest scan

B. trivy scan myapp:latest

C. trivy image myapp:latest

D. trivy scan image myapp

Solution

1. Step 1: Recall Trivy scan syntax

   The correct command to scan an image is trivy image <image-name>.

2. Step 2: Match the command with options

   trivy image myapp:latest matches the correct syntax exactly.

3. Final Answer:

   trivy image myapp:latest -> Option C

4. Quick Check:

   Trivy scan command = trivy image [OK]

Hint: Use 'trivy image' to scan images [OK]

Common Mistakes:

• Using 'trivy scan' instead of 'trivy image'
• Placing 'scan' after image name
• Omitting the 'image' keyword

3. What will be the output of the command trivy image alpine:3.15 if the image has no vulnerabilities?

medium

A. No vulnerabilities detected, image is safe

B. Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

C. Error: image not found

D. Vulnerabilities found: 0

Solution

1. Step 1: Understand Trivy output for clean images

   When no vulnerabilities are found, Trivy outputs a table ending with Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0).

2. Step 2: Compare options with expected output

   Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) matches the typical Trivy message for no vulnerabilities.

3. Final Answer:

   Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) -> Option B

4. Quick Check:

   No vulnerabilities message = Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) [OK]

Hint: Look for 'Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)' in scan output [OK]

Common Mistakes:

• Expecting a numeric count output
• Confusing error messages with success
• Assuming 'no vulnerabilities' means error

4. You run trivy image myapp:latest but get an error: ERROR: unable to find image. What is the likely cause?

medium

A. The image name is misspelled or does not exist locally

B. Trivy is not installed correctly

C. The Kubernetes cluster is down

D. The Docker daemon is running

Solution

1. Step 1: Analyze the error message

   The error 'unable to find image' means Trivy cannot locate the specified image locally or remotely.

2. Step 2: Identify common causes

   Most often, this happens if the image name is wrong or the image is not pulled yet.

3. Final Answer:

   The image name is misspelled or does not exist locally -> Option A

4. Quick Check:

   Image not found error = wrong image name [OK]

Hint: Check image name spelling and availability [OK]

Common Mistakes:

• Blaming Kubernetes cluster status
• Assuming Trivy installation issue
• Ignoring image presence locally

5. You want to automate image scanning in your Kubernetes CI/CD pipeline using Trivy. Which approach is best to ensure images are scanned before deployment?

hard

A. Only scan images once a month regardless of deployment

B. Scan images manually after deployment to production

C. Ignore scanning if images come from trusted sources

D. Add a pipeline step that runs trivy image <image> and fails if vulnerabilities are found

Solution

1. Step 1: Understand CI/CD pipeline best practices

   Automated scanning before deployment helps catch vulnerabilities early and prevents unsafe images from running.

2. Step 2: Evaluate options for automation

   Add a pipeline step that runs trivy image <image> and fails if vulnerabilities are found. This integrates scanning into the pipeline and blocks deployment if issues exist, which is best practice.

3. Final Answer:

   Add a pipeline step that runs trivy image <image> and fails if vulnerabilities are found -> Option D

4. Quick Check:

   Automate scanning pre-deployment = Add a pipeline step that runs trivy image <image> and fails if vulnerabilities are found [OK]

Hint: Scan images in pipeline and fail on vulnerabilities [OK]

Common Mistakes:

• Scanning only after deployment
• Ignoring scans for trusted images
• Scanning too infrequently