Docs

Volcengine Kubernetes Engine

Diagnosis and inspection

Application inspection

Application inspection is based on industry security standards and incorporates container security best practices to provide application security inspection capabilities. Application inspection can promptly detect and block unsafe configurations and prompt you to fix these issues to prevent applications from being attacked or exploited. This helps ensure application security and stability.

Application inspection supplements baseline inspection by covering security scanning checks for Kubernetes-native resources such as Workload, Pod, and ConfigMap, which are not included in baseline inspection. The inspection system helps you identify potential security risks in Kubernetes-native resources and provides remedy suggestions, effectively enhancing the security of cloud-native applications in clusters.

Prerequisites

Kubernetes resources, such as Workload, Pod, and ConfigMap, have been created in the cluster. For details, see Workloads and Creating ConfigMaps.

The application-inspector add-on has been installed. For details, see Installing add-ons.

tip

If you uninstall the add-on, the system will automatically delete all application inspection data.

Configuring inspection policies

Before performing an inspection, you need to configure an inspection policy.

In the left navigation bar, click Cluster.

On the Cluster page, click the name of the target cluster.

In the left navigation bar, choose Security > Application inspection. Then, click Policy configuration.

In the Policy configuration dialog box, configure parameters as needed.

Parameters	Description
Periodic inspection	Turn on the switch to perform application inspection at a fixed cycle. For details, see Configuring periodic inspections.
Inspection item	VKE provides three inspection categories: Baseline policy, Reinforcement policy, and Vulnerability mitigation policy. Each category contains different inspection items. Select inspection items as needed. tip The configured inspection items take effect for both immediate inspection and periodic inspection. When you hover the mouse over a specific inspection item, you can view the policy statement for that inspection item.

Configuring immediate inspections

Manually trigger an application inspection immediately. You can use the following steps to perform an immediate inspection:

In the left navigation bar, click Cluster.

On the Cluster page, click the name of the target cluster.

In the left navigation bar, choose Security > Application inspection. Then, click Immediate inspection.

In the pop-up box, confirm the relevant information for the inspection task.

Click Confirm to start the inspection.

Configuring periodic inspections

Configure application inspection tasks to periodically run at a fixed time on a specific day of each month or week. You can use the following steps to configure periodic inspection:

In the left navigation bar, click Cluster.

On the Cluster page, click the name of the target cluster.

In the left navigation bar, choose Security > Application inspection. Then, click Policy configuration.

In the Policy configuration dialog box, enable Periodic inspection and configure the inspection cycle.

The inspection cycle can be Weekly or Monthly. You also need to configure a specific point of time. For information about how to configure inspection items, see Configuring inspection policies.

Click Confirm to save the periodic inspection configuration.

After configuration is complete, the system will automatically trigger inspection tasks and generate reports in each inspection cycle. Only the most recent inspection report is retained for application inspection. Remember to view inspection reports before they are removed.

Viewing inspection reports

After an inspection finishes and the inspection report is generated, you can filter results by risk type, resource level or other items.

In the left navigation bar, choose Security > Application inspection.

Filter results by Risk type or Resource level to view inspection information.

To view the result of each inspection item for a resource, find the resource and click Details in the Actions column.

Click Details next to the inspection item to view the policy statement, security risk statement, fix suggestion, and remarks.

Last updated: 2026.07.24 14:51:36