Security Scans
Last updated
Last updated
Devtron's CI pipeline provides a Scan for vulnerabilities option as shown below. Once you enable this option, it will automatically scan the image for vulnerabilities.
To access the comprehensive security scan reports, follow these steps:
In the left sidebar, click Security and go to the Security Scans tab.
Select the desired application from the available list.
This action provides a detailed overview of the application's security scan, including CVE IDs, severity levels of vulnerabilities, and more, as shown below.
Each vulnerability is identified by a CVE ID and categorized based on Severity, Package, Current Version, and Fixed In Version.
CVE ID - Refers to the Common Vulnerability ID assigned to each vulnerability.
Severity - Indicates the severity of the vulnerability and can be classified as Critical, Medium, or Low.
Package - Contains metadata associated with the vulnerability. The CURRENT VERSION refers to the specific version of the vulnerability.
Fixed In Version - Displays the version name if the vulnerability has been addressed in a subsequent release; otherwise, it remains blank.
Devtron provides the capability to identify vulnerabilities before image deployment in the Continuous Deployment (CD) pipeline. This ensures that potential vulnerabilities are detected and addressed early in the deployment process.
To access security vulnerability details during image deployment in Devtron, follow these steps:
Click Show Source Info option for the desired image during the deployment process.
Navigate to the Security tab.
In the Security tab, you will find the security vulnerability details associated with the image.
Vulnerability information will only be displayed for images that have undergone vulnerability scanning. If no vulnerabilities were identified during the scan, the Security tab will display a zero count, indicating Security (0).
Devtron offers the capability to identify vulnerabilities even after an image has been deployed. By navigating to the App Details page, you can find comprehensive details about the vulnerabilities associated with the deployed image.
With this capability, Devtron empowers users to stay informed about the security vulnerabilities present in their deployed images.
Clicking the 'Details' link in the security vulnerabilities report (shown above) reveals detailed information about those found within the deployed image.
