このページは、 Google Cloudにファースト パーティの脆弱性検出ソリューションを実装する際に、適切な判断を行うための情報と、ワークロードの脆弱性スキャンの使用方法に関する情報を必要とするセキュリティ担当者を対象としています。 Google Cloud のコンテンツで使用されている一般的なロールとタスクの例の詳細については、一般的な GKE Enterprise ユーザーロールとタスクをご覧ください。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-07-29 UTC。"],[],[],null,["# About workload vulnerability scanning\n\n[Autopilot](/kubernetes-engine/docs/concepts/autopilot-overview) [Standard](/kubernetes-engine/docs/concepts/choose-cluster-mode)\n\n*** ** * ** ***\n\n| **Caution:** Starting on July 23, 2024, container OS vulnerability scanning is deprecated and is scheduled for shutdown on July 31, 2025. Starting on June 16, 2025, Advanced Vulnerability Insights is deprecated and is scheduled for shutdown on June 16, 2026. For more information about deprecation and shutdown dates, see [Vulnerability scanning removal from GKE](/kubernetes-engine/docs/deprecations/vulnerability-scanning-gkee).\n\nThis page describes workload vulnerability scanning, a feature of the Google Kubernetes Engine (GKE)\nsecurity posture dashboard. This feature helps you improve the security of your\ndeployments by automatically scanning for vulnerabilities in your container\nimages and language packages during runtime. You can view identified vulnerability\nissues and recommended actions in the security posture dashboard.\n\nThis page is for Security specialists with information for making informed\ndecisions and details about using workload vulnerability scanning when\nimplementing a first-party vulnerability detection solution within Google Cloud. To learn more about\ncommon roles and example tasks that we reference in Google Cloud content, see\n[Common GKE user roles and tasks](/kubernetes-engine/enterprise/docs/concepts/roles-tasks).\n\nBefore reading this page, ensure that you're familiar with information about how the security posture dashboard fits into your\nsecurity strategy by reading\n[Usage as part of a broad security strategy](/kubernetes-engine/docs/concepts/about-security-posture-dashboard#broad-security-strategy).\n\nTypes of vulnerability scanning\n-------------------------------\n\nWorkload vulnerability scanning includes the following capabilities:\n\n- Container operating system (OS) vulnerability scanning\n- Language package vulnerability scanning\n\nIf a vulnerability is found in your container images or language packages,\nGKE displays the results in the security posture dashboard in\nthe Google Cloud console. GKE also adds entries to Cloud Logging\nfor auditing and traceability.\n\n### Container OS vulnerability scanning\n\nGKE continuously scans container images that run on enrolled\nGKE clusters. GKE uses vulnerability data from\npublic CVE databases such as [NIST](https://nvd.nist.gov/vuln/search).\nThe images can come from any image registry. The OS version must be supported\nfor scanning. For a list of supported operating systems, see\n[Supported Linux versions](/artifact-analysis/docs/os-overview#linux-versions).\n\nFor instructions, see\n[Enable container OS vulnerability scanning](/kubernetes-engine/docs/how-to/security-posture-vulnerability-scanning#enable).\n\n### Language package vulnerability scanning\n\nGKE continuously scans containers for known vulnerabilities in\nlanguage packages, such as Go or Maven packages. We get vulnerability data\nfrom public sources such as the\n[GitHub Advisory Database](https://github.com/advisories).\nThe scanner is the Artifact Analysis scanner, which you can separately\nimplement to safeguard your Artifact Registry repositories. In the\nsecurity posture dashboard, the container images can come from any image\nregistry because GKE scans the images while the workloads run.\nFor information about Artifact Analysis scanning, see\n[Types of scanning](/artifact-analysis/docs/scanning-types).\n\nGKE provides *continuous* scanning of your language packages\ninstead of only scanning on-demand or when your workflows push changes to your\ncontainer images. Continuous scanning ensures that you're notified of new\nvulnerabilities as soon as fixes are available, which reduces your time to\ndiscovery and remediation.\n\nGKE scans the following language packages:\n\n- Go\n- Maven\n- Javascript\n- Python\n\nOnly vulnerabilities that have an associated CVE number are displayed in the\nsecurity posture dashboard.\n\nEnable vulnerability scanning in GKE\n------------------------------------\n\nYou can enable vulnerability scanning for GKE\nclusters as follows:\n\nFor enablement instructions, see\n[Automatically scan workloads for known vulnerabilities](/kubernetes-engine/docs/how-to/security-posture-vulnerability-scanning).\n\nPricing\n-------\n\nFor pricing information, see\n[GKE security posture dashboard pricing](/kubernetes-engine/docs/concepts/about-security-posture-dashboard#pricing)\n\nWhat actions does GKE suggest?\n------------------------------\n\nEach vulnerability in the security posture dashboard has detailed information\nsuch as the following:\n\n- A full description of the vulnerability, including potential impact, attack pathways, and severity.\n- Fixed packages and version numbers.\n- Links to the relevant entries in public CVE databases.\n\nGKE doesn't show a vulnerability if there is no corresponding\nCVE with an actionable mitigation.\n\nFor an overview of the security posture dashboard interface, see\n[About the security posture dashboard](/kubernetes-engine/docs/concepts/about-security-posture-dashboard#about-interface).\n\nLimitations\n-----------\n\n- GKE doesn't support scanning of proprietary packages and their dependencies.\n- GKE only displays results for vulnerabilities that have an available fix and an available CVE number in the security posture dashboard. You might see more results, such as vulnerabilities without an available fix, if you scan the same container images in a container registry.\n- GKE uses the following memory on each worker node for workload vulnerability scanning:\n - Container OS scanning: 50 MiB\n - Advanced vulnerability insights: 100 MiB\n- GKE has the following limitations on the size of each file that contains package data in your images. GKE won't scan files that exceed the size limit.\n - Container OS scanning: 30 MiB\n - Advanced vulnerability insights: 60 MiB\n- Windows Server containers aren't supported.\n- Workload vulnerability scanning is only available for clusters with less than 1000 nodes.\n- GKE doesn't scan nodes that use Arm architecture, such as the T2A machine type.\n- The security posture dashboard supports up to 150,000 active\n workload vulnerability scanning findings for each cluster. When the number of\n findings for a cluster exceeds this maximum, the\n security posture dashboard stops showing vulnerability findings for that\n cluster.\n\n To resolve this issue, use a scanning mechanism at the registry level to\n identify vulnerabilities in images and apply patches. Alternatively, in a new\n cluster, deploy your workloads in batches to identify and mitigate\n vulnerabilities. When the number of vulnerability findings is less than\n 150,000, the security posture dashboard starts displaying findings for the\n cluster.\n\nWhat's next\n-----------\n\n- [Enable and use workload vulnerability scanning](/kubernetes-engine/docs/how-to/security-posture-vulnerability-scanning)\n- [Learn about other scanning capabilities in the security posture dashboard](/kubernetes-engine/docs/concepts/about-security-posture-dashboard#how-it-works)"]]
