Image security scanning in Kubernetes - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is image security scanning in Kubernetes?

Image security scanning is the process of checking container images for vulnerabilities before they are deployed in Kubernetes clusters. It helps ensure that images do not contain known security risks.

beginner

Name a popular tool used for image security scanning in Kubernetes.

Trivy is a popular open-source tool used for scanning container images for vulnerabilities in Kubernetes environments.

intermediate

Why should image scanning be part of the CI/CD pipeline?

Including image scanning in the CI/CD pipeline helps catch vulnerabilities early, preventing insecure images from reaching production and reducing security risks.

intermediate

What types of vulnerabilities can image scanning detect?

Image scanning can detect outdated software, known CVEs (Common Vulnerabilities and Exposures), misconfigurations, and insecure packages inside container images.

intermediate

How does integrating image scanning improve Kubernetes cluster security?

By scanning images before deployment, it prevents vulnerable containers from running, reducing attack surfaces and helping maintain a secure cluster environment.

What is the main purpose of image security scanning in Kubernetes?

A To speed up container startup time

B To find vulnerabilities in container images before deployment

C To monitor network traffic between pods

D To manage Kubernetes user permissions

Image security scanning checks container images for vulnerabilities before they are deployed to keep the environment safe.

Which tool is commonly used for scanning container images for vulnerabilities?

A Prometheus

B kubectl

C Trivy

D Helm

Trivy is a widely used open-source tool for scanning container images for security issues.

When is the best time to perform image security scanning in a DevOps workflow?

A During the CI/CD pipeline before deployment

B After the container is running in production

C Only when a security breach happens

D During Kubernetes cluster setup

Scanning images during the CI/CD pipeline helps catch vulnerabilities early and prevents risky images from being deployed.

Which of the following is NOT typically detected by image security scanning?

A Network latency issues

B Known software vulnerabilities

C Misconfigured container settings

D Outdated packages inside images

Network latency is not detected by image scanning; it focuses on vulnerabilities inside container images.

How does image scanning help maintain Kubernetes cluster security?

A By managing user access controls

B By automatically scaling pods

C By encrypting network traffic

D By preventing vulnerable images from running

Image scanning stops vulnerable container images from being deployed, reducing security risks in the cluster.

Explain what image security scanning is and why it is important in Kubernetes.

Think about how scanning helps keep containers safe before they run.

Describe how image security scanning fits into a CI/CD pipeline and its benefits.

Consider the flow from code to deployment and where scanning happens.

Practice

1. What is the main purpose of image security scanning in Kubernetes?

easy

A. To find vulnerabilities in container images before deployment

B. To increase the size of container images

C. To speed up the container startup time

D. To monitor network traffic between containers

Solution

1. Step 1: Understand image security scanning

   Image security scanning checks container images for security issues like vulnerabilities.

2. Step 2: Identify the main goal

   The goal is to find and fix vulnerabilities before deploying containers to keep apps safe.

3. Final Answer:

   To find vulnerabilities in container images before deployment -> Option A

4. Quick Check:

   Image scanning = find vulnerabilities [OK]

Hint: Image scanning finds security holes before use [OK]

Common Mistakes:

• Confusing scanning with performance tuning
• Thinking it monitors network traffic
• Believing it changes image size

2. Which command correctly scans a Docker image named myapp:latest using Trivy?

easy

A. trivy myapp:latest scan

B. trivy scan myapp:latest

C. trivy image myapp:latest

D. trivy scan image myapp

Solution

1. Step 1: Recall Trivy scan syntax

   The correct command to scan an image is trivy image <image-name>.

2. Step 2: Match the command with options

   trivy image myapp:latest matches the correct syntax exactly.

3. Final Answer:

   trivy image myapp:latest -> Option C

4. Quick Check:

   Trivy scan command = trivy image [OK]

Hint: Use 'trivy image' to scan images [OK]

Common Mistakes:

• Using 'trivy scan' instead of 'trivy image'
• Placing 'scan' after image name
• Omitting the 'image' keyword

3. What will be the output of the command trivy image alpine:3.15 if the image has no vulnerabilities?

medium

A. No vulnerabilities detected, image is safe

B. Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

C. Error: image not found

D. Vulnerabilities found: 0

Solution

1. Step 1: Understand Trivy output for clean images

   When no vulnerabilities are found, Trivy outputs a table ending with Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0).

2. Step 2: Compare options with expected output

   Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) matches the typical Trivy message for no vulnerabilities.

3. Final Answer:

   Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) -> Option B

4. Quick Check:

   No vulnerabilities message = Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) [OK]

Hint: Look for 'Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)' in scan output [OK]

Common Mistakes:

• Expecting a numeric count output
• Confusing error messages with success
• Assuming 'no vulnerabilities' means error

4. You run trivy image myapp:latest but get an error: ERROR: unable to find image. What is the likely cause?

medium

A. The image name is misspelled or does not exist locally

B. Trivy is not installed correctly

C. The Kubernetes cluster is down

D. The Docker daemon is running

Solution

1. Step 1: Analyze the error message

   The error 'unable to find image' means Trivy cannot locate the specified image locally or remotely.

2. Step 2: Identify common causes

   Most often, this happens if the image name is wrong or the image is not pulled yet.

3. Final Answer:

   The image name is misspelled or does not exist locally -> Option A

4. Quick Check:

   Image not found error = wrong image name [OK]

Hint: Check image name spelling and availability [OK]

Common Mistakes:

• Blaming Kubernetes cluster status
• Assuming Trivy installation issue
• Ignoring image presence locally

5. You want to automate image scanning in your Kubernetes CI/CD pipeline using Trivy. Which approach is best to ensure images are scanned before deployment?

hard

A. Only scan images once a month regardless of deployment

B. Scan images manually after deployment to production

C. Ignore scanning if images come from trusted sources

D. Add a pipeline step that runs trivy image <image> and fails if vulnerabilities are found

Solution

1. Step 1: Understand CI/CD pipeline best practices

   Automated scanning before deployment helps catch vulnerabilities early and prevents unsafe images from running.

2. Step 2: Evaluate options for automation

   Add a pipeline step that runs trivy image <image> and fails if vulnerabilities are found. This integrates scanning into the pipeline and blocks deployment if issues exist, which is best practice.

3. Final Answer:

   Add a pipeline step that runs trivy image <image> and fails if vulnerabilities are found -> Option D

4. Quick Check:

   Automate scanning pre-deployment = Add a pipeline step that runs trivy image <image> and fails if vulnerabilities are found [OK]

Hint: Scan images in pipeline and fail on vulnerabilities [OK]

Common Mistakes:

• Scanning only after deployment
• Ignoring scans for trusted images
• Scanning too infrequently