Vulnerability scanning is an automated examination of software or artifacts for known security weaknesses. In an engineering platform, it turns security requirements into a repeatable pipeline capability rather than a manual handoff. section 8.2.1 section 4.1.1
Distinguish scanning from the controls that consume its results:
- Run the scan through reusable, versioned pipeline code that appears in preconfigured project pipelines. section 4.1.1
- Record the image commit SHA with the successful scan result so later deployment checks can identify the scanned artifact. section 4.1.1
- Use an admission controller to verify that a successful scan record exists; it confirms completed scanning rather than scanning the image itself. section 4.1.1
- Let stakeholders define outcomes, while platform teams choose scanning and alerting technologies that make compliance automatic and avoid ticket queues. section 8.2.1
Image deployment gate
A reusable pipeline scans a container image and stores a successful result against its commit SHA. Before deployment, a Kubernetes admission controller compares that SHA with the scan log and accepts the deployment only when evidence exists. section 4.1.1
Figure 4.3 Kubernetes admission controller
Shows the Kubernetes admission-controller pattern that verifies deployment requirements after scanning has produced authoritative evidence. section 4.1.1
