Kyverno and Image Vulnerability check

This deck explains you about the scanning of image vulnerability and policy as a code using Kyverno which can act as a Gatekeeper for infrastructure.

Transcript

1. Securing Containerized Workloads - Subhash Gehlot
2. Technology professional with strong expertise in Kubernetes platforms, DevSecOps practices, and zero-trust security. With hands-on experience in implementing admission control policies, container security scanning, and secure deployment pipelines. Having worked across full-stack development, database architecture, on-call operations and cloud-native platforms. Brings you a decade of practical perspective to container security and development activities. - Subhash Gehlot
3. In this session, you will get insights on strengthening Kubernetes workloads using Kyverno policies and container image scanning to build resilient and compliant systems.
4. Why Container Security Matters CONTAINERS ARE FAST, LIGHTWEIGHT—BUT RISKY IF NOT CONTROLLED MISCONFIGURATIONS AND VULNERABLE IMAGES ARE COMMON ATTACK VECTORS POLICIES + SCANNING TOOLS CAN HELP ENFORCE SECURITY STANDARDS
5. Image Vulnerability Severity Levels Severity Color CVSS Range Description CRITICAL Red 9.0 – 10.0 Easily exploitable can cause full system compromise. Patch-immediately HIGH Red 7.0 – 8.9 Major risk attackers could exploit or cause denial of service. must-fix MEDIUM Yellow 4.0 – 6.9 Moderate risk may need specific conditions to exploit. Good to fix, but less urgent LOW Green 0.1 – 3.9 Low impact or hard to exploit. Fix as time permits. UNKNOWN Gray N/A Severity not yet classified. Needs self investigation.
6. How Do Images Become Vulnerable? Container images often inherit from a base OS (e.g., alpine, debian, ubuntu) which includes: System packages (glibc, openssl, libxml, etc.) App dependencies (e.g., npm, pip, maven, etc.) If these components are outdated or not patched, the image becomes vulnerable.
7. Tools for Image Vulnerability Scanning Scans container images, filesystems, Git repos Detects: vulnerabilities, misconfigs, secrets Easy CLI: trivy image nginx:1.21 Trivy (Aqua Security) Integrated into Docker Desktop Real-time scanning of local/remote images Shows severity breakdowns, suggestions Docker Scout Grype – Deep SBOM + CVE scanning (CLI) Snyk – DevSecOps scanning + cloud dashboard Clair – Registry-integrated scanning Harbor – Scanning built into image registry Other Tools
8. Docker Scout • docker scout quickview nginx:1.21 • docker scout cves nginx:1.21 • Trivy also has admission controller level webhook
9. Kyverno – Kubernetes Policy Engine Use Cases: • Disallow privileged containers • Enforce read-only filesystems • Require securityContext settings • Block dangerous capabilities Kyverno is a Kubernetes-native policy engine designed to validate, mutate, and generate Kubernetes resources using simple, declarative YAML policies — no need to learn a new language Types of validation: • Validating admission controller • Applies rules on K8s manifests (YAML) • Background scan
10. Where Can We Enforce Security? Security Level Tool/Concept Description Developer Workstation Trivy, Docker Scout Local image scan before push CI/CD Pipeline Trivy + Policy Checks Block insecure images before deploy Kubernetes Admission Kyverno (validate) Enforce rules before object creation Runtime Kyverno (mutate/verify) Runtime enforcement, background scanning Tip: Use multiple layers to create defense in depth.
11. • Kubernetes policy enforcement is no longer optional—it's foundational • Kyverno makes security declarative, repeatable and DevOps-friendly • Policies can validate, mutate, and generate—without writing a line of Go code • Integrate security early: in CI/CD and admission control • Shift Left is about building secure systems from the start Conclusion
12. Questions? Happy to discuss. Let’s connect & continue the conversation! https://www.linkedin.com/in/subhashgehlot/ A decade full of Strong expertise in Kubernetes Platform development, DevSecOps practices and zero trust security. Having worked as full-stack developer, database architect handling on call operations