Use trusted registries, enforce image scanning, and maintain a curated image policy to minimize CVE risks in Kubernetes deployments.

Practical Workflow for CVE-Free Images

1. Identify Trusted Registries

   • Use official language/runtime images (e.g., golang, node, python from Docker Hub).
   • Prefer vendor-supported images (e.g., Red Hat UBI, AWS ECR Optimized, Google Artifact Registry).
   • Avoid third-party images without audit trails or update guarantees.

2. Scan Images at Build/Deploy

   • Integrate tools like Trivy, Clair, or Snyk into CI/CD pipelines.
   • Example Trivy command:

     trivy image --severity CRITICAL,HIGH --exit-code 1 ubuntu:22.04  
     

   • Fail builds on critical/high CVEs; log warnings for lower severity issues.

3. Enforce Image Policies

   • Use OpenShift’s Image DisallowedContent or Kubernetes Admission Controllers (e.g., OPA Gatekeeper).
   • Example policy to block untrusted registries:

     package kubernetes.admission  
          
     deny[msg] {  
       input.request.kind.kind == "Pod"  
       not startsWith(input.request.image, ["docker.io/library/", "quay.io/openshift4/"])  
       msg := "Image registry not allowed: " + input.request.image  
     }  
     

4. Monitor and Rotate Images

   • Schedule periodic image rebuilds to pull latest patched base images.
   • Use tools like Dependabot or Renovate to track dependency updates.

Tooling Recommendations

• Scanners: Trivy (speed), Clair (scalable), Snyk (commercial support).
• Registries:
  • Red Hat UBI (no support costs, CVE patches guaranteed).
  • AWS ECR (integrated scanning, private registry controls).
  • Google Artifact Registry (built-in vulnerability scanning).
• Policy Engines: OPA Gatekeeper, OpenShift ContainerImageAdmissionController.

Tradeoffs and Caveats

• False Positives: Scanners may flag non-exploitable CVEs (e.g., unpatched but unused packages). Tune exclusion lists carefully.
• Registry Lockdown: Blocking all non-whitelisted registries may break legacy apps; phase in policies gradually.
• Base Image Lag: Official images (e.g., ubuntu:22.04) may lag behind upstream patches; consider rolling your own if critical.

Troubleshooting Common Issues

• Scanner Misses:
  • Ensure tools are updated weekly (CVE databases change rapidly).
  • Cross-check findings with NVD or vendor advisories.
• Policy Enforcement Failures:
  • Verify admission controllers are enabled (e.g., kubectl describe clusterconfigmanager | grep -i admission).
  • Check for exempted namespaces or service accounts.
• Image Pull Errors:
  • Confirm registry credentials are valid and not rate-limited.
  • Use kubectl describe pod <name> to debug image-specific failures.

Final Note

No image source is 100% CVE-proof. Combine trusted sources, automated scanning, and strict policies to reduce exposure. Prioritize speed of patching over perfection—most breaches exploit known vulnerabilities that weren’t patched in time.

Source thread: Where are people getting the best CVE-free images for Kubernetes?