Frequently asked questions

This is usually because you haven't created an API key to authenticate your requests with Container Security. For information on creating and using a Trend Micro Cloud One API key, see the API key help. Deprecated: For information on creating and using a legacy API key, see the Workload Security API key help.

Container Security currently does not require any inbound network access and does not require any extra IP addresses to be added to inbound firewall rules. Communication from the admission controller, as well as from Deep Security Smart Check to Trend Micro Cloud One™ - Container Security, is outbound-initiated only over HTTPS port 443.

• Trend Micro Cloud One (where <region> is your Trend Micro Cloud One region):
  • https://container.<region>.cloudone.trendmicro.com
  • https://iot.container.<region>.cloudone.trendmicro.com
• Runtime security (allow the endpoint for your Trend Micro Cloud One region):
  • US: https://sensor-components-prod-componentsstoragebucket-1tgz7758j5977.s3.amazonaws.com
  • India: https://sensor-components-prod-componentsstoragebucket-4t1tmfipzmxq.s3.amazonaws.com
  • UK: https://sensor-components-prod-componentsstoragebucket-177dw039ojo4z.s3.amazonaws.com
  • Japan: https://sensor-components-prod-componentsstoragebucket-a1g8t8ve13ql.s3.amazonaws.com
  • Germany: https://sensor-components-prod-componentsstoragebucket-dt9l26kxtrha.s3.amazonaws.com
  • Australia: https://sensor-components-prod-componentsstoragebucket-mqamem5enf3f.s3.amazonaws.com
  • Canada: https://sensor-components-prod-componentsstoragebucket-1lllr5j8i7dmf.s3.amazonaws.com
  • Singapore: https://sensor-components-prod-componentsstoragebucket-x75mv7yqzt9.s3.amazonaws.com
• Telemetry: https://telemetry.deepsecurity.trendmicro.com

You will need to create an exception for Smart Check images:

1. Open the Container Security web console.
2. Go to Policies.
3. Select the policy you want to change.
4. On the Deployment and Continuous tabs, scroll to the Exceptions section and enable this exception: Allow images with names that start with deepsecurity/

We support the keywords "contains" and "start with" for image registry, name, and tag in the first release. This provides a basic regular expressions interface.

Yes. Each Kubernetes cluster should have its own admission controller. If you need to, you can scale the desired replicas. The default is 1.

No. It only validates if a deployment request is allow or denied in a policy definition.

Yes. The admission controller queries Container Security everytime a review request happens in Kubernetes, both when doing a kubectl create or a kubectl apply.

No local cache is being used for queries or policies to ensure the policy is always up to date.

By default, review requests from the kube-system namespace are not forwarded to Container Security. For more information, see the admission controller yaml file.

For more information about data collection and telemetry, see Container Security Data Collection.

No alerts will be raised, but a warning icon () will appear on the cluster page after 24 hours of inactivity, and the admission controller will contain error logs. You can also configure the logging destination in your cluster, which allows you to integrate our logging solution in with Kubernetes.

If Cloud One is not responsive, you can also configure what happens by changing the failurePolicy property. By default, failurePolicy is set to Ignore, which allows the admission request if Cloud One is not accessible. If you set failurePolicy to Fail, then the admission request fails.

Consider increasing the replica count for the admission controller in large environments, where many admission requests may occur at the same time. Admission requests occur when a pod scales its replica counts, new deployments occur, etc.

Pods with multiple containers should have exceptions for all containers inside of them. Container Security only allows the admission request if all requested containers are not violating a policy rule or meet exception criteria.

If you are using the "Isolate" action in your Continuous Compliance policy or Runtime rules, the Kubernetes cluster where the protected resources are running must have Kubernetes network policies enabled. To enable Kubernetes network policies, install a network plugin with NetworkPolicy support using the provided guide in the helm chart README.

Smart Check scans both the installed package list as well as a set of applications commonly installed by copying them directly to the file system. Our labs team provides an active feed with up-to-date information about the supported applications.

Deep Security Smart Check updates its malware details and vulnerability definitions automatically. You will need to upgrade to get software updates, including new feature and security updates.

See Configure pre registry scanning for instructions.

If a scan finds a vulnerability or content scan issue but you know it's not a concern, you can override it using the Smart Check API. For details, see the Overrides section of the API.

You can use the checklist feature in the Smart Check API to verify whether a scanned image complies with common PCI requirements. The checklist feature is currently supported for CentOS and Red Hat images only. For details, see the Scans section of the API.