Google Artifact Registry 和 Jenkins：防止部署具有高或严重漏洞的容器

Question

I have a Jenkins Pipeline that is building a container image and is pushing it to Google Artifact Registry successfully. I have another job that takes the image tag and can deploy it into the K8s cluster, but for security reasons I need to include in my pipeline a step that reviews the vulnerabilities from the artifact registry scan and prevent the deployment if there are high or critical vulnerabilities, what would be the best option for accomplish with it?

Answer 1

I solved it with the use of SDK: https://cloud.google.com/sdk/gcloud/reference/artifacts/docker/images/describe

Just used: gcloud artifacts docker images describe IMAGE --show-package-vulnerability

Note that the service account we are using in jenkins should get the appropriate permissions.