Integrating image scanning into the CI/CD pipeline
Image scanning can be triggered at multiple stages in the DevOps pipeline and we've already talked about the advantages of scanning an image in an early stage of the pipeline. However, new vulnerabilities will be discovered, and your vulnerability database should be updated constantly. This indicates that passing an image scan in the build stage doesn't mean it will pass at the runtime stage if there is a new critical vulnerability found that also exists in the image. You should stop the workload deployment when it happens and apply mitigation strategies accordingly. Before we dive into integration, let's look at a rough definition of the DevOps stages that are applicable for image scanning:
- Build: When the image is built in the CI/CD pipeline
- Deployment: When the image is about to be deployed in a Kubernetes cluster
- Runtime: After the image is deployed to a Kubernetes cluster and the containers are up...
