Kubernetes Clusters
The Clusters page provides centralized visibility into Kubernetes environments protected by Qualys. It brings together cluster inventory, workload security, vulnerability management, posture management, runtime protection, threat detection, file integrity monitoring, attack-path analysis, and admission control so teams can understand and reduce Kubernetes risk from a single view.
A cluster is represented as a first-class asset when Qualys has Kubernetes-aware cluster identity and inventory context. This allows Qualys to maintain relationships across the Kubernetes hierarchy and correlate findings from the cluster down to the workload, pod, container, and image.
Kubernetes Security Capabilities
Qualys provides security capabilities across the Kubernetes lifecycle — from configuration and deployment through vulnerability assessment, runtime protection, detection, and response.
| Capability | What It Provides |
|---|---|
| Runtime Vulnerability Management | Continuously assess vulnerabilities in running Kubernetes workloads. Add runtime context such as software drift and Runtime Reachability to identify vulnerabilities that are present in deployed workloads and determine which findings deserve the highest priority. |
| Kubernetes Security Posture Management (KSPM) | Continuously assess Kubernetes clusters and workloads for configuration risks, security best practices, and compliance requirements across managed and self-managed Kubernetes environments. |
| Insights & Attack Path | Correlate Kubernetes vulnerabilities, misconfigurations, identities, network exposure, cloud resources, and other risk signals to understand potential attack paths and prioritize exposures that can lead to critical assets. |
| Threat Detection | Detect suspicious and malicious activity in running containers using runtime telemetry across processes, files, network connections, DNS activity, and other workload behavior. |
| File Integrity Monitoring (FIM) | Monitor critical files and directories inside Kubernetes workloads for unexpected or unauthorized changes to support security monitoring and compliance use cases. |
| Admission Controllers & Policies | Evaluate workloads before they are deployed into Kubernetes. Admission policies can warn or block deployments based on vulnerabilities, image security, Kubernetes configuration, and organizational security requirements. |
Supported Cluster Environments
The Clusters page is designed for Kubernetes-aware environments. Managed Kubernetes services, enterprise distributions, and self-managed Kubernetes can appear as first-class clusters. Non-Kubernetes orchestrators can still contribute image and container assets, but they do not appear as Kubernetes clusters unless cluster-level Kubernetes context is available.
| Environment | Cluster Visibility | Vulnerability Management | KSPM | Runtime | Admission |
|---|---|---|---|---|---|
| Amazon EKS | ✓ | ✓ | ✓ | ✓ | ✓ |
| Microsoft AKS | ✓ | ✓ | ✓ | ✓ | ✓ |
| Google GKE | ✓ | ✓ | ✓ | ✓ | ✓ |
| Oracle OKE | ✓ | ✓ | ✓ | ✓ | ✓ |
| Red Hat OpenShift | ✓ | ✓ | ✓ | ✓ | ✓ |
| Rancher RKE2 | ✓ | ✓ | ✓ | ✓ | ✓ |
| VMware Tanzu Kubernetes Grid | ✓ | ✓ | ✓ | Supported configurations | ✓ |
| Self-managed Kubernetes | ✓ | ✓ | ✓ | Supported configurations | ✓ |
| Amazon ECS | — | Container-level | — | Container-level | — |
| HashiCorp Nomad | — | Container-level | — | Container-level where supported | — |
| Docker / other container environments | — | Container-level | — | Container-level where supported | — |
ECS, Nomad, Docker Swarm, standalone Docker hosts, and other non-Kubernetes environments can still surface containers and images under Assets > Containers and Assets > Images. They are not represented as first-class Kubernetes clusters on the Clusters page.
Sensors and Components
Qualys uses multiple sensors and components to enable Kubernetes security capabilities. The Cluster Sensor establishes Kubernetes-aware topology; additional sensors enrich that topology with vulnerability, runtime, and policy-enforcement context.
Multiple capabilities can be associated with the same cluster. For example, the Cluster Sensor establishes topology, the Container Security Sensor identifies vulnerabilities in deployed workloads, and the Runtime Sensor adds runtime context such as reachability and threat activity.
| Sensor / Component | Primary Purpose | Capabilities Enabled |
|---|---|---|
| Cluster Sensor | Kubernetes inventory and cluster context | Cluster discovery, namespaces, workloads, pods, KSPM context, and cluster-to-workload relationships |
| Container Security Sensor | Image and container assessment | Vulnerability management, image/container inventory, software/package visibility, and drift context |
| Container Runtime Sensor | Runtime workload telemetry | Runtime Reachability, threat detection, process/file/network/DNS telemetry, and runtime context |
| Admission Controller | Pre-deployment policy enforcement | Admission policies, vulnerability gates, pod/image controls, and deployment decisions |
| FIM capability | File and directory monitoring | File Integrity Monitoring and compliance monitoring for running workloads |
Cluster Listing
Navigate to Assets > Clusters to view Kubernetes clusters discovered and monitored by Qualys. Only environments for which Qualys has sufficient Kubernetes identity and inventory context are represented as first-class clusters.
Cluster List Information
The Clusters listing shows the following information for each cluster:
| Field | Description |
|---|---|
| Cluster Name | Name of the Kubernetes cluster. |
| Platform | EKS, AKS, GKE, OKE, OpenShift, Kubernetes, and so on. |
| Cloud Provider | AWS, Azure, GCP, OCI, or self-managed. |
| Region | Cloud region or cluster location. |
| Kubernetes Version | Kubernetes version reported for the cluster. |
| Workloads | Number of workloads discovered. |
| Containers | Containers associated with the cluster. |
| Cluster Sensor | Cluster Sensor deployment and status. |
| Runtime Sensor | Runtime protection status. |
| Admission Controller | Admission Controller deployment and status. |
| Last Seen | Most recent cluster inventory update. |
Security Coverage
The cluster listing provides an at-a-glance view of which Qualys security capabilities are enabled for each cluster. This turns the page into both an inventory view and a security coverage view.
Container-Only Environments
Not every container orchestration environment is represented as a Cluster. Examples include Amazon ECS, HashiCorp Nomad, Docker Swarm, standalone Docker/container hosts, and other non-Kubernetes environments. Qualys can continue to discover and assess their containers and images under Assets > Containers and Assets > Images.
Cluster Details
Select a cluster from the Clusters page to view detailed information about that Kubernetes environment. The cluster detail view provides cluster metadata, workload relationships, security coverage, and admission-control information.
Summary
The Summary view provides a quick understanding of the cluster and the Qualys protection deployed within it. Information includes:
- Cluster name and identifier
- Kubernetes platform
- Cloud provider and region
- Kubernetes version
- Sensor status
- Workload and container counts
- Security capabilities enabled for the cluster
- Last seen
Workloads
The Workloads view provides Kubernetes workload visibility for the selected cluster. You can inspect the deployment hierarchy and pivot from a cluster-level risk to the exact workload, container, image, and finding involved.
The following hierarchy is represented:
Cluster > Namespace > Workload > Pod > Container > Image
Information available for each workload includes:
- Namespace
- Workload
- Pod
- Container
- Image
- Workload and pod status
- Associated vulnerabilities and security findings
This relationship allows you to answer questions such as: Which cluster is affected? Which namespace and workload are involved? Which container and image introduced the risk? Which vulnerability, misconfiguration, runtime signal, or policy event needs action?
Admission Controller
The Admission Controller view provides details about the Qualys Admission Controller deployed within the selected cluster, including status, configuration, policies, enforcement mode, registries, and admission activity. Information includes:
- Admission Controller status
- Cluster association and configuration
- Policies assigned to the cluster
- Policy enforcement mode (Warn or Block)
- Configured registries
- Admission events
Admission Events
You can review admission decisions for workloads submitted to the Kubernetes API. Event details include:
- Evaluation result
- Enforcement action
- Cluster and namespace
- Kubernetes operation
- Policy name and version
- Images evaluated
- Rules evaluated
- Pod Security evaluation
- Applicable exclusions
Unified Kubernetes Security Model
The Clusters page brings multiple Qualys Kubernetes security capabilities together around a common asset model. Rather than treating each control as a separate tool, Qualys correlates inventory, posture, vulnerabilities, runtime telemetry, and policy decisions against the same cluster and workload relationships.
The unified Kubernetes security workflow follows this sequence:
- Cluster & Workload Inventory - Understand what Kubernetes environments and workloads exist.
- KSPM - Identify Kubernetes configuration, posture, and compliance risks.
- Runtime Vulnerability Management - Identify vulnerabilities in deployed workloads and prioritize using drift and Runtime Reachability.
- Insights & Attack Path - Understand how vulnerabilities, configuration, identity, exposure, and cloud context combine into meaningful risk.
- Admission Controllers & Policies - Prevent workloads that violate security requirements from being deployed.
- Threat Detection & FIM - Detect malicious behavior and unexpected file changes after workloads begin running.