Kubernetes Vulnerability Scanning via Pod Image Extraction

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing vulnerability scanning tools require preliminary integration into CI pipelines or image registries, limiting their ability to provide real-time risk assessment of deployed containers within Kubernetes clusters, especially for public images not stored in user CI workflows.

Innovation Solution

A vulnerability scanning tool that extracts images from pods within a Kubernetes cluster, scans them in parallel, detects vulnerabilities, and assigns a vulnerability level, allowing for real-time risk assessment and policy enforcement without the need for preliminary integration, enabling continuous monitoring of running containers.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If vulnerability scanning is integrated into CI pipelines or image registries beforehand, then scanning coverage is limited to pre-deployed images, but real-time risk assessment of deployed containers cannot be provided

Engineering Contradiction:

Improvereal-time risk assessment capabilityVSAvoidscanning coverage for public images and control-plane components

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

Instead of scanning images before deployment (traditional approach), the system extracts and scans images from running pods after deployment. This inversion enables real-time vulnerability detection for deployed containers, including public images and control-plane components that were previously unscannable, directly resolving the contradiction between real-time assessment capability and scanning coverage.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The system extracts container images from running pods within the Kubernetes cluster and scans them independently. This extraction approach allows the vulnerability scanner to operate on actual deployed images without requiring preliminary integration into CI pipelines or image registries, enabling real-time risk assessment for any container regardless of its deployment source.

Inventive Principle:

Principle #2Taking out (Extraction)

2Adaptability or versatility

If scanning is performed on all images from running pods, then comprehensive coverage is achieved, but scanning time and resource consumption increase

Engineering Contradiction:

Improvescanning coverageVSAvoidscanning time

Core Design Contradiction:

Adaptability or versatilityVSLoss of time

Solution Approach 1:

The system segments the scanning process by first extracting images from pods, then identifying unique images, and finally scanning only the unique images in parallel. This segmentation reduces redundant scanning of identical images across multiple pods while maintaining comprehensive coverage of all unique container images in the cluster.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system scans only unique images rather than every individual pod image, using partial action to avoid redundant scanning. By identifying and scanning only the unique image set, the system achieves comprehensive vulnerability detection while minimizing scanning time and resource consumption compared to scanning all pod images individually.

Inventive Principle:

Principle #16Partial or excessive action

3Productivity

If parallel scanning of unique images is implemented, then scanning efficiency improves, but system complexity increases

Engineering Contradiction:

Improvescanning efficiencyVSAvoidsystem architecture complexity

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The system dynamically manages the scanning process by extracting images from running pods, identifying unique images, and launching parallel scans as needed. This dynamic approach allows the system to scale scanning operations based on the actual number of unique images detected, improving efficiency without requiring complex static architecture for handling all possible scanning scenarios.

Inventive Principle:

Principle #15Dynamics

Data Source

PatentUS11822672B1Systems and methods for scanning images for vulnerabilities

Publication Date: 2023.11.21 CISCO TECHNOLOGY INC

AI summary

In one embodiment, a method includes extracting, by a vulnerability scanning tool, a plurality of images from one or more pods running within a cluster. The method also includes determining, by the vulnerability scanning tool, a plurality of unique images from the plurality of images, scanning, by the vulnerability scanning tool, the plurality of unique images in parallel, and detecting, by the vulnerability scanning tool, one or more vulnerabilities within the plurality of unique images in response to scanning the plurality of unique images in parallel. The method further includes determining, by the vulnerability scanning tool, a vulnerability level associated with a pod of the one or more pods and assigning, by the vulnerability scanning tool, the vulnerability level to the pod.