Kubernetes

Deploy security scanning as Kubernetes Jobs.

Warning Snippets on this page install the current CLI release rather than pinning one, so they do not go stale. If one no longer works, open an issue with the output of vulnetix --version.

Before You Start

Credentials come from A Secret consumed with secretKeyRef, never a mounted file, so the value stays out of the container filesystem.

Variable	Value
`VULNETIX_ORG_ID`	Organization UUID
`VULNETIX_API_KEY`	ApiKey hex digest

Environment variables authenticate on their own. Do not run vulnetix auth login on an ephemeral runner — see Authentication in CI/CD.

Quick Start

vulnetix-job.yaml:

apiVersion: batch/v1
kind: Job
metadata:
  name: vulnetix-scan
spec:
  template:
    spec:
      restartPolicy: Never
      initContainers:
      # No published Vulnetix image; stage the binary on a shared volume.
      - name: install-vulnetix
        image: alpine:3.20
        command: ["/bin/sh", "-c"]
        args:
          - |
            apk add --no-cache ca-certificates curl tar
            curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir /opt/vulnetix/bin
        volumeMounts:
        - name: cli
          mountPath: /opt/vulnetix/bin
      containers:
      - name: vulnetix
        image: alpine:3.20
        env:
        - name: VULNETIX_ORG_ID
          valueFrom:
            secretKeyRef:
              name: vulnetix-secrets
              key: org-id
        - name: VULNETIX_API_KEY
          valueFrom:
            secretKeyRef:
              name: vulnetix-secrets
              key: api-key
        command: ["/opt/vulnetix/bin/vulnetix"]
        args: ["scan", "--severity", "high"]
        volumeMounts:
        - name: cli
          mountPath: /opt/vulnetix/bin
        - name: workspace
          mountPath: /workspace
      volumes:
      - name: cli
        emptyDir: {}
      - name: workspace
        hostPath:
          path: /path/to/project

vulnetix auth verify on the first line fails the build immediately when the credential is missing or revoked, rather than halfway through a scan.

Note No Vulnetix image exists, so an initContainer stages the binary into an emptyDir that the scan container mounts. That also lets the scan container keep readOnlyRootFilesystem: true.

Running Individual Scans

Each subcommand runs standalone and uploads its own findings. Swap vulnetix scan for any of them:

vulnetix sca --severity high -o dist/sbom.cdx.json     # dependencies
vulnetix sast --severity high -o dist/sast.sarif       # source code
vulnetix secrets -o dist/secrets.sarif                 # hardcoded credentials
vulnetix license --allow MIT,Apache-2.0                # SPDX policy
vulnetix cbom --output-file dist/cbom.cdx.json         # cryptography, PQC posture
vulnetix aibom --output-file dist/aibom.cdx.json       # AI agents, SDKs, models

Note the flag split: the scan family takes -o <path>, while cbom, aibom, and malscan take --output-file. license takes neither. The full table is in the Subcommand Reference.

Keeping the Report

A PersistentVolumeClaim, or ship the SARIF straight to Vulnetix (the scans upload themselves).

The SARIF-producing scans write their file only when there are findings, so a clean run leaves nothing behind. Tolerate the missing path rather than failing on it.

Quality Gates

Gates are opt-in; without a gate flag the command reports and exits 0.

vulnetix scan --severity high --block-malware --block-eol --exploits active

To surface a breach without blocking the merge: backoffLimit: 0 and inspect the Job status.

Full gate list in the Subcommand Reference.

Uploading Third-Party Artifacts

The scans upload themselves. upload is for reports produced by other tools:

vulnetix upload --file reports/semgrep.sarif --format sarif

Accepted formats: cyclonedx, spdx, sarif, openvex, csaf_vex.