Overview of the Kubernetes integration
Snyk is able to integrate with Kubernetes, enabling you to import and scan your running workloads. This helps you identify vulnerabilities in their associated images and configurations that can make those workloads less secure. After workloads are imported, Snyk continues to monitor them and to identify additional security issues as new images are deployed and the workload configuration changes.
How the Kubernetes integration works
The Kubernetes integration follows the below process:
Your administrator installs a controller on your cluster, authenticating the integration with a unique integration ID and a service account token with the needed permissions generated from the Snyk account. For more information, including the permissions needed, see Prerequisites for installing the Snyk Controller.
The Controller communicates with the Kubernetes API to determine which workloads are running on the cluster (for example, the Deployment, ReplicationController, CronJob, and so on), find their associated images, and scan them for vulnerabilities directly on the cluster.
On the Snyk side, collaborators select which workloads to import or which workloads can be imported automatically using annotations. See Automatically import and delete Kubernetes workload Projects.
For each workload that your collaborators import, Snyk displays the vulnerabilities found in each image as well as a summary of the configuration issues that have been identified with the workload.
Snyk continuously monitors your imported workloads and reports new vulnerabilities it identifies whenever they affect your Projects.
Based on your configurations, if vulnerabilities are found, Snyk notifies you through email or Slack so that you can take immediate action.
To maintain the health of the database, Snyk removes any information relating to a workload that has not been changed or updated for eight days. This can lead to failure when rescanning the workload.
If an image and its corresponding Project are removed, and you reimport the same workload during the eight days when the metadata still resides in the Snyk database, you can create the Project again.
The architecture of Snyk and Kubernetes integration
Based on the process exemplified in this diagram:
The customer's Snyk Organization is enabled for the Kubernetes integration.
The Customer installs the Snyk Controller into their Kubernetes cluster.
The Snyk Controller reads image information and pulls images from container registries.
The Snyk Controller scans the images.
The Snyk Controller sends scan results to the Snyk Platform to analyze issues.
The customer views the vulnerability issues on the Snyk Platform.
Terms and conditions
The Snyk Container Kubernetes integration uses Red Hat UBI (Universal Base Image).
Before downloading or using this application, you must agree to the Red Hat subscription agreement located on the Red Hat website. If you do not agree with these terms, do not download or use the application.
If you have an existing Red Hat Enterprise Agreement (or other negotiated agreement with Red Hat) with terms that govern subscription services associated with Containers, then your existing agreement will control.
Kubernetes integration troubleshooting
For troubleshooting information on the Kubernetes integration or the Snyk Controller, as well as for common onboarding errors, see the Kubernetes integration troubleshooting support page.
Last updated
