Security
The Security tab scans and visualizes the security posture of your cluster. It surfaces image vulnerabilities, exposed ports and plaintext credentials.
Related: Kubernetes
Sub-tabs
| Sub-tab | Content |
|---|---|
| Overview | Security score (0–100 with a grade), per-category summary, and Harbor registry status |
| Images | Vulnerability (CVE) scan results for running container images |
| Ports | Ports reachable on the nodes (NodePort / LoadBalancer) |
| Secrets | Credentials embedded in plaintext in ConfigMaps / Secrets |
Overview
- Security score: an aggregate 0–100 rating of the findings, shown with an A–F grade.
- Summary cards: counts of scanned images, exposed ports and detected secrets, broken down by severity (Critical / High / Medium / Low).
- Harbor registry: connection status, Trivy enabled/disabled, and version. Use Rescan to refresh.
Severity labels: shown as "Critical / High / Medium / Low" in Japanese and as "C / H / M / L" in English.
Images
Running images are scanned with Harbor + Trivy and CVEs are aggregated by severity.
- Run on demand with Scan all or the per-row Scan
- Filter with Only with vulnerabilities and Include system namespaces
- Click a row to see the CVE list (CVE ID / package / installed & fixed version / CVSS)
Ports
Lists NodePort / LoadBalancer services reachable from outside the cluster. Enable Live probe to actively verify whether they are actually reachable.
Secrets
Detects credentials and connection strings stored in plaintext in ConfigMaps / Secrets. The detail panel shows:
- Reason: what was detected
- Why it's risky: an explanation of the risk (e.g. ConfigMaps are stored/distributed in plaintext and readable by anyone with read access)
- Remediation: move to a Secret, rotate the credential, etc.
Detected values are masked — the actual secret is never shown on screen.
On this page
Sub-tabs
Overview
Images
Ports
Secrets