About workload vulnerability scanning

This page describes the workload vulnerability scanning capabilities offered in the Google Kubernetes Engine (GKE) security posture dashboard. This page is intended for security administrators who want to implement first-party vulnerability detection solutions.

Workload vulnerability scanning is a set of capabilities in the security posture dashboard that automatically scans for known vulnerabilities in your container images and in specific language packages during the runtime phase of the software delivery lifecycle. If GKE detects vulnerabilities, the security posture dashboard displays details about the issues and provides actionable remediation steps to mitigate the vulnerabilities.

For information about how the security posture dashboard fits into your security strategy, see Usage as part of a broad security strategy.

Types of vulnerability scanning

Workload vulnerability scanning includes the following capabilities:

  • Container operating system (OS) vulnerability scanning
  • Language package vulnerability scanning

If a vulnerability is found in your container images or language packages, GKE displays the results in the security posture dashboard in the Google Cloud console. GKE also adds entries to Cloud Logging for auditing and traceability.

Container OS vulnerability scanning

GKE continuously scans container images that run on enrolled GKE clusters. GKE uses vulnerability data from public CVE databases such as NIST. The images can come from any image registry. The OS version must be supported for scanning. For a list of supported operating systems, see Supported Linux versions.

For instructions, see Enable container OS vulnerability scanning.

Language package vulnerability scanning

GKE continuously scans containers for known vulnerabilities in language packages, such as Go or Maven packages. We get vulnerability data from public sources such as the GitHub Advisory Database. The scanner is the Artifact Analysis scanner, which you can separately implement to safeguard your Artifact Registry repositories. In the security posture dashboard, the container images can come from any image registry because GKE scans the images while the workloads run. For information about Artifact Analysis scanning, see Types of scanning.

GKE provides continuous scanning of your language packages instead of only scanning on-demand or when your workflows push changes to your container images. Continuous scanning ensures that you're notified of new vulnerabilities as soon as fixes are available, which reduces your time to discovery and remediation.

GKE scans the following language packages:

  • Go
  • Maven
  • Javascript
  • Python

Only vulnerabilities that have an associated CVE number are displayed in the security posture dashboard.

Enable vulnerability scanning in GKE

You can enable vulnerability scanning for GKE clusters as follows:

Tier Enabled capabilities GKE version requirement
Standard
standard		 Container OS vulnerability scanning
  • Requires version 1.23.5-gke.700 or later
  • Enabled by default in Autopilot clusters running version 1.27 or later
  • Disabled by default in Standard clusters
Advanced vulnerability insights
enterprise
  • Container OS vulnerability scanning
  • Language package vulnerability scanning
  • Requires version 1.27 or later
  • Disabled by default in Autopilot and Standard

For enablement instructions, see Automatically scan workloads for known vulnerabilities.

Pricing

For pricing information, see GKE security posture dashboard pricing

What actions does GKE suggest?

Each vulnerability in the security posture dashboard has detailed information such as the following:

  • A full description of the vulnerability, including potential impact, attack pathways, and severity.
  • Fixed packages and version numbers.
  • Links to the relevant entries in public CVE databases.

GKE doesn't show a vulnerability if there is no corresponding CVE with an actionable mitigation.

For an overview of the security posture dashboard interface, see About the security posture dashboard.

Limitations

  • GKE doesn't support scanning of proprietary packages and their dependencies.
  • GKE only displays results for vulnerabilities that have an available fix and an available CVE number in the security posture dashboard. You might see more results, such as vulnerabilities without an available fix, if you scan the same container images in a container registry.
  • GKE uses the following memory on each worker node for workload vulnerability scanning:
    • Container OS scanning: 50 MiB
    • Advanced vulnerability insights: 100 MiB
  • GKE has the following limitations on the size of each file that contains package data in your images. GKE won't scan files that exceed the size limit.
    • Container OS scanning: 30 MiB
    • Advanced vulnerability insights: 60 MiB
  • Windows Server containers aren't supported.
  • Workload vulnerability scanning is only available for clusters with less than 1000 nodes.
  • GKE doesn't scan nodes that use Arm architecture, such as the T2A machine type.

  • The security posture dashboard supports up to 150,000 active workload vulnerability scanning findings for each cluster. When the number of findings for a cluster exceeds this maximum, the security posture dashboard stops showing vulnerability findings for that cluster.

    To resolve this issue, use a scanning mechanism at the registry level to identify vulnerabilities in images and apply patches. Alternatively, in a new cluster, deploy your workloads in batches to identify and mitigate vulnerabilities. When the number of vulnerability findings is less than 150,000, the security posture dashboard starts displaying findings for the cluster.

What's next