Image security scanning in Kubernetes - Step-by-Step Execution

Process Flow - Image security scanning

Start: New Container Image

↓

Trigger Scan on Image

↓

Scan Image for Vulnerabilities

↓

Report Vulnerabilities Found?

No→Approve Image

Yes↓

Block or Alert

↓

Deploy or Reject Image

The flow starts with a new container image, triggers a scan, checks for vulnerabilities, then either approves or blocks deployment based on scan results.

Execution Sample

Kubernetes

kubectl create deployment myapp --image=myapp:v1
kubectl scan image myapp:v1
# Scan reports vulnerabilities
kubectl rollout status deployment/myapp

This sequence deploys an app, scans its image for vulnerabilities, and checks deployment status.

Process Table

Step	Action	Command/Check	Result	Next Step
1	Create deployment with image	kubectl create deployment myapp --image=myapp:v1	Deployment created with image myapp:v1	Trigger image scan
2	Trigger image scan	kubectl scan image myapp:v1	Scan started for image myapp:v1	Scan completes
3	Scan completes	Scan engine analyzes image layers	Vulnerabilities found: 3 critical, 5 medium	Block deployment and alert
4	Block deployment	Policy enforcement	Deployment paused, alert sent to team	Wait for image fix
5	Fix image and re-scan	kubectl scan image myapp:v1-fixed	No vulnerabilities found	Approve deployment
6	Approve deployment	kubectl rollout status deployment/myapp	Deployment successful	End

💡 Deployment approved only after image passes security scan with no critical vulnerabilities.

Status Tracker

Variable	Start	After Step 2	After Step 3	After Step 5	Final
image_status	Not scanned	Scanning	Vulnerabilities found	No vulnerabilities	Approved
deployment_status	Not created	Created	Blocked	Pending approval	Deployed

Key Moments - 3 Insights

Why does the deployment get blocked after the scan?

Because the scan found critical vulnerabilities (see execution_table step 3), the policy blocks deployment to keep the system safe.

What happens if no vulnerabilities are found?

The deployment is approved and proceeds (see execution_table step 5 and 6), allowing the app to run safely.

Can deployment proceed before scanning?

No, scanning is mandatory before deployment to ensure security (see execution_table step 2 and 3).

Visual Quiz - 3 Questions

Look at the execution_table, what is the image_status after step 3?

A Scanning

B Vulnerabilities found

C No vulnerabilities

D Approved

💡 Hint

Check the variable_tracker row for image_status after step 3.

At which step does the deployment get blocked due to vulnerabilities?

A Step 2

B Step 3

C Step 4

D Step 5

💡 Hint

Look at execution_table action and result columns around deployment status.

If the scan found no vulnerabilities at step 3, what would be the next step?

A Approve deployment

B Block deployment and alert

C Fix image and re-scan

D Create deployment

💡 Hint

Refer to execution_table steps 3 and 5 for flow after scan results.

Concept Snapshot

Image security scanning in Kubernetes:
- Deploy container image
- Trigger scan on image
- Scan checks for vulnerabilities
- If critical found, block deployment
- Fix image and re-scan
- Approve deployment if clean
- Ensures only safe images run

Full Transcript

Image security scanning in Kubernetes starts when a new container image is deployed. The system triggers a scan that checks the image layers for vulnerabilities. If critical vulnerabilities are found, deployment is blocked and alerts are sent. The image must be fixed and rescanned. Once no vulnerabilities remain, the deployment is approved and the application runs safely. This process protects the system by ensuring only secure images are deployed.