Red HatJohannes MalsamProblem & solution
Red Hat Advanced Cluster Security for Kubernetes exposes an image-scanning API through Central, but upgrades and restarts can interrupt CI/CD pipelines. The reference architecture uses two independent Central Service instances—primary and failover—with separate databases, scanner deployments, and namespaces, plus a client-side script that probes the primary’s health endpoint before each scan and falls back when needed. Operators install the failover instance, duplicate image registry integrations and build-time policies, configure CI authentication, and pause reconciliation on the failover Central custom resource while upgrading the primary, then resume it to upgrade the second instance. This avoids scan API unavailability during the staged upgrade process, but failover caches are cold, requiring temporarily longer scans and additional registry traffic. The instances do not synchronize databases, caches, configuration, or vulnerability updates, and the design does not provide general-purpose HA for secured cluster services or delegated scanning.
Central Service upgrades, configuration changes, and restarts can make the image-scanning API unavailable for seconds, minutes, or hours, potentially blocking critical CI builds. Running multiple Central instances alone is insufficient because the operator upgrades all Central custom resources together, and the instances cannot synchronize their data.
Run independent primary and failover Central Service instances in separate namespaces with separate databases and scanner deployments. A CI-side script checks the primary health endpoint before each scan and switches to the failover when necessary. Image integrations, authentication, and build-time policies are configured on both instances, while reconciliation is paused on the failover during a staged primary upgrade.
The failover instance can serve image scans after duplicating registry integrations and build-time policy configuration, but its cold caches initially make scans slower and increase registry traffic.
Staggered upgrades use manual operator approval and the stackrox.io/pause-reconcile=true annotation on the failover Central custom resource.
The two Central instances have no shared databases, caches, configuration, or vulnerability-update schedule, so brief differences in vulnerability detection can occur.
Summaries are generated from the original by a language model. Check the original before relying on it.
See the idea
Ansible excels at two different jobs: orchestrating multi-step infrastructure workflows and automating routine tasks hands-off. Learn the tradeoff between control and scale that should guide your choice.
Keep reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
One useful email. Unsubscribe anytime.
