Skip to main content

Snyk

Snyk is a comprehensive developer-friendly security platform that scans for vulnerabilities, license issues, and misconfigurations across code, open-source dependencies, containers, and Kubernetes configurations. It helps teams shift security left by integrating directly into CI/CD pipelines and development environments.

In Kubernetes environments, Snyk plays a critical role in securing container images and IaC (Infrastructure as Code), including Kubernetes manifests and Helm charts.

Usage​

1. Install Snyk CLI​

npm install -g snyk

Authenticate your CLI with:

snyk auth

2. Scan Kubernetes Manifests and Helm Charts​

snyk iac test path/to/k8s/deployment.yaml

Or for Helm:

snyk iac test path/to/chart/

Snyk identifies issues such as:

  • Containers running as root
  • Privileged mode enabled
  • Lack of resource limits
  • Insecure hostPath mounts

3. Scan Container Images​

snyk container test <image-name>

This checks for known vulnerabilities in OS packages and language dependencies (e.g., Alpine, Ubuntu, Python, Node.js, etc.).

Example:

snyk container test nginx:latest

4. Monitor for Fixable Issues​

You can monitor projects continuously:

snyk monitor

This sends results to the Snyk UI and alerts you when new vulnerabilities are discovered in used images or dependencies.

5. Integrate with CI/CD and Git Repositories​

Snyk integrates with:

  • GitHub, GitLab, Bitbucket
  • Jenkins, GitHub Actions, CircleCI, Azure DevOps, and more

Add a GitHub Action, for example:

- name: Snyk Container Scan
  uses: snyk/actions/docker@master
  with:
    image: my-app:latest
    args: --file=Dockerfile
  env:
    SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

Best Practices​

  • Include snyk iac test in pull request workflows to catch misconfigurations early.
  • Scan all production images before publishing to container registries.
  • Set up monitoring on critical workloads for real-time vulnerability awareness.
  • Regularly review and patch fixable issues identified in Kubernetes resources and base images.
  • Combine with kubectl plugins or GitOps workflows to embed scanning into cluster updates.

Resources​

Last updated on by Itai Ganot