CertGrid CertGrid
Hands-on Lab·Kubernetes and Cloud Native Security Associate

Image Scanning and Supply Chain Checks

Supply chain compliance asks two questions: what is in the thing you ship, and what is known to be wrong with it. An SBOM answers the first and a scanner answers the second. This guide runs both against a stale image and a minimal one, and reads what the answer depended on.

Compliance and Frameworks Guide 39 of 42 Intermediate

Written against the versions above. Trivy 0.67.2, run as an ordinary Pod with no privilege. It fetches images from the registry itself and downloads a vulnerability database at run time, which is why the same scan can give a different answer tomorrow.

The cka5001 cluster: one control plane and 3 schedulable workers, on Cilium.
Server NameIP AddressOSRolesCPURAMHDD
CKA5001192.168.0.41Ubuntu 26.04 LTSControl Plane Node (tainted NoSchedule)2 Core4 GB50 GB
CKA5001-NODE01192.168.0.42Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB
CKA5001-NODE02192.168.0.43Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB
CKA5001-NODE03192.168.0.44Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB

Before you start

  1. One scanner, two images

  2. A stale base image, by severity

  3. Findings against components

  4. The same scan against a minimal image

  5. What the answer depended on

Official sources

← All KCSA guides