Vulnerability findings

Vulnerability findings answer one question about every image your clusters run: does it have known vulnerabilities? The Vulnerability Scanning add-on scans running images inside your cluster and reports each CVE by severity (Critical, High, Medium, Low and Unknown), grouped by application. Open an application to see every CVE, its package, and whether a fix is published.

When you need it

• Which applications carry critical vulnerabilities, worst first, across a cluster.
• What to fix first: the CVEs with a published package fix, and the images they are in.
• Evidence for a security review: the current posture of every application, with what was and was not scanned.

Before you start

• The Vulnerability Scanning add-on on the cluster. Public images scan with no setup; images in a private registry need registry access.

In the console

1. Open a cluster from the cluster list and select Security: severity totals, and every application and add-on, worst first. The cluster's Overview carries the same summary as a tile.

2. Open an application or model and select Security: its severity counts, then each CVE grouped by image, with Package, Vulnerability, Severity, Installed, Fixed and Fix available. Filter by package, CVE or severity, or tick Fixable only.

   Open zoom view

   A model's Security tab: severity counts, then each CVE in its image with the installed and fixed version

   

3. Select a CVE to open its advisory.

You should see

Counts within about a minute of the first scan finishing, then a fresh summary after each rescan (daily by default). An application with nothing reported yet reads No scan result yet, never zero.

Open zoom view

An application's Security tab after a scan, with counts per severity and no vulnerabilities found

How to read the findings

• Coverage first. AstroPulse knows every application and add-on, so each is listed even with no result. It does not know how many workloads each one runs, so it can't promise a count is complete. Zero criticals is a real result, but only for what was scanned.
• Fixable means a fixed package version is published. It does not mean a newer image tag exists: rebuild the image on current packages to pick the fix up.
• Grouped by what you manage. Rows are your applications, AstroPulse's add-ons, and Other workloads for anything else the scan covers. Add-on namespaces are outside the scan scope by default.
• Current state, not history. Each scan replaces the last. There is no trend over time, on any plan.
• Images only. Node operating systems, workload misconfigurations and secrets inside images are not scanned.

How scanning works

The scanner runs inside your cluster; images are never sent anywhere to be scanned. Each workload is rescanned on the add-on's scanFrequency, once a day by default (from 1h to 720h), because the CVE database changes even when your images don't. AstroPulse stores only a summary per cluster, severity counts per workload for up to 500 workloads, worst kept first. The full CVE list is read from the cluster when you open it, so it needs the cluster connected at that moment.

Get alerted

Subscribe to the Security Alerts topic under Notifications, or with astroctl notifications subscriptions upsert --topic security-alerts --channels email. Once delivery is on for your organization, AstroPulse checks daily and sends one message per organization when a cluster has at least 1 Critical or 10 High findings, at most once a week per cluster unless it gets materially worse. The message lists the worst applications, how many findings have a published fix, and the images to start with. If you subscribed and get nothing, delivery may not be enabled yet: ask your AstroPulse contact.

Other ways in

• Nova: ask, for example, "does my-cluster's latest scan report any critical vulnerabilities?"
• API: the vulnerability calls in the API reference.

With astroctl

Terminal

astroctl infra k8s vulnerabilities my-cluster
astroctl app vulnerabilities checkout
astroctl infra k8s vulnerabilities my-cluster --application checkout

The first two read the stored summary; --application reads one application's CVE list from the cluster. Aliases: vuln, vulns, cve.

If it's refused

When a read has no results, the API answers with one notice saying why, and the CLI prints it with the command for the next step. The scanner's own health checks are on its page: Add-ons › Vulnerability Scanning › Overview, or astroctl infra k8s addons get <cluster> vulnerability-scanning -o yaml.

Vulnerability scanner isn't installed (ScannerNotInstalled): "Add-on <addon> is not installed on cluster <cluster>, so its images are not scanned."

Cause

The Vulnerability Scanning add-on is not installed

Fix

Install the vulnerability scanner: see Vulnerability Scanning

Nothing to scan (NothingToScan): "Nothing to scan on <cluster>: no workloads run in the namespaces the vulnerability scanner covers."

Cause

The scanner found no workload in its scope. This is an answer, not a failure

Fix

Deploy an application. With a custom scanScope, deploy into a namespace the scope covers

No image could be scanned (ImagesNotScannable): "No image on <cluster> could be scanned: its registries refused the scanner every image."

Cause

Every image's registry refused the scanner

Fix

Give the scanner read access to the registry: see Give it access to your cloud

No scan result yet (ScanPending): "No vulnerability scan report has been received for <cluster> yet: the scanner has not finished its first scan."

Cause

The first scan has not finished, and one scan interval (scanFrequency, 24h by default) has not passed

Fix

Wait for the first scan. The scanner's vulnerability reporting check says whether results are arriving

Scan results are overdue (ScanOverdue): "No vulnerability scan report has been received for <cluster> since <time>, longer than one scan interval (<interval>)."

Cause

A scan interval passed and nothing arrived

Fix

Check the scanner's status: astroctl infra k8s addons get <cluster> vulnerability-scanning -o yaml, and use the rows below

The vulnerability reporting check reads Failing: "Vulnerability results are not reaching AstroPulse; scanning may be running in the cluster, but its results are not being collected"

Cause

The scanner may run, but its results are not being collected by the cluster's agent

Fix

Check the cluster's connectivity pill and the astro-agent add-on's health, then read astroctl infra k8s addons events <cluster> vulnerability-scanning

The vulnerability scanning check reads "Vulnerability scanning is not confirmed healthy; results may be incomplete or stale"

Cause

The scanner itself is not healthy

Fix

Read astroctl infra k8s addons events <cluster> vulnerability-scanning --k8s and astroctl infra k8s addons logs <cluster> vulnerability-scanning --level Error

The check reads "Vulnerability results are reaching AstroPulse, but some images could not be scanned: <N> images not scannable: registry denied (<images>)", or "No images could be scanned: registry denied for <N> images (...); give the scanner registry access"

Cause

The scanner could not pull those images from their registry

Fix

Give the scanner read access to the registry: see Give it access to your cloud

"... not scannable: the scan did not finish within <limit> (<images>); ... raising limitsCpu under scanResources on the vulnerability-scanning add-on may let its scan finish sooner"

Cause

The image is too large to scan in the time limit, its download included

Fix

Raise scanResources.limitsCpu on the add-on and apply it again

"... not scannable: scan finished but its result was not stored (<images>); the usual cause is a result too large to store ..."

Cause

The scan finished, but its result was too large to store

Fix

Set ignoreUnfixed: true, or raise minimumSeverity, on the add-on and apply it again

An application or add-on row shows No scan result yet in the console. The CLI shows -- in every severity column, and a label and message for the row

Cause

The CLI's label and message say which case it is: "no scan result yet" ("The scanner has not reported a result for it yet."), or "not scanned" with the reason below

Fix

Read the row's message in astroctl infra k8s vulnerabilities <cluster>

CLI row message: "Not scanned: it is outside the scan scope. To scan it, change the scanScope setting of the vulnerability-scanning add-on."

Cause

Its namespace is outside scanScope

Fix

Add the namespace to scanScope and apply the add-on again

CLI row message: "Not scanned: the scan of <workload> finished but its result could not be stored. ..."

Cause

The result was too large to store

Fix

Set ignoreUnfixed or raise minimumSeverity

CLI row message: "Not scanned: the scanner could not report a result for <workload>."

Cause

The scanner gave no result for it

Fix

Read the add-on's vulnerability reporting check for registry or time-limit notes

CLI row label "scan result overdue": "The scanner has not reported a result for it in the <time> since it was deployed, longer than one scan interval (<interval>)."

Cause

It was deployed more than one scan interval before the latest report and still has no result

Fix

Resync the vulnerability-scanning add-on (Resync on its page, or astroctl infra k8s addons resync <cluster> vulnerability-scanning)

The live CVE list does not open: "... needs the cluster's agent to be connected ..." or "... needs a newer Astro agent. Run 'astroctl infra k8s register agent update --cluster-name <cluster>' ..."

Cause

The CVE detail is read live from the cluster

Fix

Reconnect or update the agent as the message says. The stored summary still shows while the agent is away

Next

• Vulnerability Scanning
• Security
• Cost