This the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

  • 1:

    Admission Controller

    This feature is offered through Sysdig Labs and is installed as its own component. See Admission Controller: Installation

    Understanding the Admission Controller

    Kubernetes' admission controllers help you define and customize which requests are allowed on your cluster. An admission controller intercepts and processes requests to the Kubernetes API prior to persistence of the object, but after the request is authenticated and authorized.

    Image Scanning Capabilities: Sysdig’s Admission Controller (UI-based) builds upon Kubernetes and enhances the capacity of the image scanner to check images for Common Vulnerabilities and Exposures (CVEs), misconfigurations, outdated images, etc., elevating the scan policies from detection to actual prevention. Container images that do not fulfill the configured admission policies will be rejected from the cluster before being assigned to a node and allowed to run.

    Kubernetes Audit Logging Capabilities: Enable the features.k8sAuditDetections=true option to use Kubernetes audit logging features with the admission controller. (See also: Kubernetes Audit Logging.)

    Usage Steps for Image Scanning with the AC

    The Admission Controller is installed per-cluster. The workflow is straightforward:


    • Enable the feature in Sysdig Labs to activate it in the Sysdig Secure backend, for image scanning.

    • Install the Admission Controller in the target cluster(s) and verify that it appears in the Sysdig UI as “Connected.”


    Create Admission Controller Policies

    Admission Controller Policies define the criteria to accept or reject a given container image at admission time. Remember that Policies must be assigned to a cluster to be enforced.

    1. Log in as Administrator to Sysdig Secure and select Image Scanning> Admission Controller|Policies.

      The Admission Controller Policies page displays a list of any previously defined policies.

    2. Click +Policy and enter a meaningful Name and Description.

    3. Define the policy Rules:

      • Evaluation Failure: Whether to reject images that are failing scanning policy evaluation

      • Evaluation Age: Whether to reject images when the evaluation is older than X days. You might set this condition to force a new vulnerability check, for example.

      • Unscanned Image: Whether to reject images that do not have an existing evaluation at admission time. Choose from three options:

        • Ignore: Ignore this condition

        • Reject: Reject the request

        • Reject and Scan: Reject the request and scan the image in parallel.

          Typically, Kubernetes will retry creating the pending image, so eventually the image will have a valid evaluation and then the other conditions will apply. Since scanning during admission can potentially slow down the deployment process, we don’t recommend this option unless you are confident that most images will have an evaluation before admission (i.e. instrumenting the CI/CD pipelines).

    4. Click Save.

    How Policy Conditions are Applied

    Policy conditions are applied using an AND operator.

    For example, if I set Evaluation Fail to Reject, AND Evaluation Age to Reject for older than 15 days, then if I receive an image with an existing evaluation that is passing, and that evaluation is 20 days old, the request will be rejected.

    Assign Admission Controller Policies

    1. Log in as Administrator to Sysdig Secure and select Image Scanning> Admission Controller|Policy Assignment.

      The admission controller policy assignment page displays the list of Kubernetes clusters with Admission Controllers, and their current status.

      • Connected/disconnected clusters: Clusters where the admission controller was never installed will not appear at all. Otherwise:

        • Connected: Clusters with a connected and healthy admission controller will show under the “Connected” label. 

        • Disconnected: A Kubernetes cluster that had an admission controller installed, but the admission controller component is not reporting back to the Sysdig backend, will appear under the “Disconnected” label.

      • Enabled/disabled Admission Controllers: You enable/ disable the admission controller for each cluster using the switch on the top right.

        • Enabled: A green dot by the cluster name shows the admission controller is enabled (enforcing)

        • Disabled: A grey dot means the admission controller is disabled.

    2. Click +Add Assignment and enter the basic assignment details.

      A cluster can have multiple assignments at different levels of granularity, and the policies are evaluated from top to bottom. See also: ???.

      • Namespace: Leave blank to match any namespace, or add a relevant entry.

      • Prefix: Leave blank to match any image name, or limit by entering a particular prefix. For example, the redis prefix would match images declared as redis:latest or redis:v2 in the container creation request.

      • Policy: Select a policy from the drop-down list.

    3. Choose Default policy if no other assignment matches: Select to Allow by default or Reject by default.

      Be very careful with the Reject by default option. Be sure to explicitly allow critical workloads in your system.

    4. Click Save.

    5. Optional: Drag the new assignment to a different position in the evaluation list if it should be applied before another assignment.

    Understanding Evaluation Order

    Assignments are evaluated from top to bottom. The first match dictates which policy will be applied,. The default cluster action will be applied if no assignment matches.

    For example:

    Assignment 1:  Namespace kube-system; any Image path uses Policy1

    Assignment 2: All namespaces; Image path starts with uses Policy2

    Default policy: If no other assignment matches, them Reject


    • Requesting to create a container with path in the kube-system namespace will apply Policy1

    • Requesting to create a container with path in the kube-system namespace will apply Policy1

    • Requesting to create a container with path in the mynamespace namespace will apply Policy2

    • Requesting to create a container with path in the mynamespace namespace will be Rejected.

    Usage Steps for Kubernetes Audit Logging with the AC

    • When Installing the Admission Controller, set features.k8sAuditDetections to true.

    • Create policies of the Kubernetes Audit Policy type.

    • Check the Events UI for entries.

    Enable/Disable the Admission Controller

    It is recommended to develop the policies and assignments while the Admission Controller is Disabled. Enable on a staging cluster to test before enabling in production.

    When you are happy with the defined behavior:

    1. Log in as Administrator to Sysdig Secure and select Image Scanning> Admission Controller|Policy Assignment.

    2. Select the relevant cluster from the left side menu.

    3. Slide the Admission Controller to Enabled.

    4. Monitor any resulting events as usual.

    The Disable function can also be used to quickly stop the Admission Controller if unexpected behavior is detected that adversely affects the function of a cluster.

    1 -

    Admission Controller (CLI-Based)

    A UI-based Admission Controller is now available, and is not backward-compatible with the CLI-based version. We advise not installing the CLI-based version at this time.

    Sysdig Admission Controller

    Sysdig’s Admission Controller (UI-based) combines the Sysdig Secure image scanner with a policy language to evaluate scan results and the admission context, providing great flexibility in the admission decision. It also provides the first line of defense against image-based security threats.

    By using Kubernetes API extensions to perform image scanning and other security checks on admission, we cover a major threat-prevention and hardening use case: “Only the images that are explicitly approved will be allowed to run on my cluster”.

    The admission decision relies not only on the image name and tag but also on additional context from the admission review, including namespace, pod metadata, etc.


    • Registry and repository whitelist / blacklist

    • Global and per-namespace admission configuration

    • Configurable pre-scan and post-scan behavior, i.e.:

      • Accept only the images that pass the scan (default)

      • Directly reject non-whitelisted registries / repos, without scanning

      • Accept the image even if it doesn’t pass the scan

      • Do not accept any image that hasn’t been scanned already

    • Pod mutation: image tag is replaced by digest to prevent TOCTOU (Time of Check, Time of Use) issue if the tag is updated between the scan and the pod scheduling


    • Helm 3

    • Kubernetes 1.15 or higher

    More Information