Policies

Qualys Container Security (CS) allows you to define and enforce policies that evaluate container images against a set of security rules. Policies help you ensure that only compliant images are used across your CI/CD pipelines and Kubernetes clusters.

CS supports two types of policies:

• Image Assessment Policies - Evaluate images scanned through a CI/CD pipeline and block or warn when a violation is detected before deployment.
• Admission Controller Policies - Enforce compliance at the Kubernetes cluster level by allowing or blocking image deployments based on policy rules at runtime.

Policy Scope

Policy scope determines which assets a policy applies to.

Scope	Description
Default	Applies to all assets in your account that are not covered by a custom-scoped policy. Only one default-scoped policy can be active at a time.
Custom	Applies to a specific subset of assets defined by tags (Image Assessment) or by cluster, namespace, or deployment filters (Admission Controller).
Organization	Applies across the entire organization. Available for Admission Controller policies.

Policy Mode

Policy mode indicates whether a policy is currently being enforced.

Mode	Description
Active	The policy is enabled and its rules are evaluated against assets. Violations trigger the configured policy behavior.
Inactive	The policy is disabled and its rules are not evaluated. No violations are reported or enforced.

Policy Behavior

Policy behavior defines the action taken when an image fails to meet the policy rules.

Behavior	Description
Block	Prevents the image from being deployed or admitted to the cluster when a violation is detected.
Warn	Allows the image to proceed but generates a warning notification when a violation is detected.

Policy Evaluation

Policies are evaluated in the following order when multiple policies apply to the same asset:

1. Custom-scoped policies are evaluated before default-scoped policies.
2. If an image matches the inclusion tags of a custom policy but also matches its exclusion tags, the image is exempt from that policy.
3. If no custom policy applies, the default policy is evaluated.

Getting Started

To manage your policies, go to Policies in the left navigation menu. Use the Image Assessment and Admission Controller tabs to switch between policy types.

• To create a new policy, refer to Creating Security Policies topic.
• To view or edit an existing policy, click the policy name.
• To filter the policy list by mode, use the Policy Mode quick filter in the left panel.

Also see,

Image Assessment Policy
Admission Controller Policy