Container images whose provenance, integrity, or vulnerability status is not verified may contain unsupported software, altered components, or embedded credentials and be admitted to the cluster. The image is then executed within the workload environment and can expose secrets, alter application data, or disrupt connected services.
Untrusted Container Images are Deployed
CCC.K8S.TH04
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CP04 | OCI Container Image Execution | The service always accepts OCI-compatible image references and executes their containerized workloads through a Kubernetes-compatible runtime. |
| CCC.K8S.CP05 | Container Registry Integration | The service can authenticate to private or public OCI-compatible registries and retrieve workload images with user-configured identities and credentials. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CN04 | Admit Only Trusted Container Images | Prevent unapproved, mutable, unverifiable, or critically vulnerable container images from entering the workload environment. |