---
title: "Reference architecture for HA scanning with Red Hat Advanced Cluster Security for Kubernetes"
description: "Red Hat Advanced Cluster Security for Kubernetes exposes an image-scanning API through Central, but upgrades and restarts can interrupt CI/CD pipelines. The reference architecture uses two independent Central Service instances—primary and failover—with separate databases, scanner deployments, and namespaces, plus a client-side script that probes the primary’s health endpoint before each scan and falls back when needed. Operators install the failover instance, duplicate image registry integrations and build-time policies, configure CI authentication, and pause reconciliation on the failover Central custom resource while upgrading the primary, then resume it to upgrade the second instance. This avoids scan API unavailability during the staged upgrade process, but failover caches are cold, requiring temporarily longer scans and additional registry traffic. The instances do not synchronize databases, caches, configuration, or vulnerability updates, and the design does not provide general-purpose HA for secured cluster services or delegated scanning."
---

# Reference architecture for HA scanning with Red Hat Advanced Cluster Security for Kubernetes

[Red Hat](https://yomu.fyi/company/red-hat) · Johannes Malsam · Sep 7, 2026

**Type:** Problem & solution

## Summary

Red Hat Advanced Cluster Security for Kubernetes exposes an image-scanning API through Central, but upgrades and restarts can interrupt CI/CD pipelines. The reference architecture uses two independent Central Service instances—primary and failover—with separate databases, scanner deployments, and namespaces, plus a client-side script that probes the primary’s health endpoint before each scan and falls back when needed. Operators install the failover instance, duplicate image registry integrations and build-time policies, configure CI authentication, and pause reconciliation on the failover Central custom resource while upgrading the primary, then resume it to upgrade the second instance. This avoids scan API unavailability during the staged upgrade process, but failover caches are cold, requiring temporarily longer scans and additional registry traffic. The instances do not synchronize databases, caches, configuration, or vulnerability updates, and the design does not provide general-purpose HA for secured cluster services or delegated scanning.

## Context

Central Service upgrades, configuration changes, and restarts can make the image-scanning API unavailable for seconds, minutes, or hours, potentially blocking critical CI builds. Running multiple Central instances alone is insufficient because the operator upgrades all Central custom resources together, and the instances cannot synchronize their data.

## Approach / What changed

Run independent primary and failover Central Service instances in separate namespaces with separate databases and scanner deployments. A CI-side script checks the primary health endpoint before each scan and switches to the failover when necessary. Image integrations, authentication, and build-time policies are configured on both instances, while reconciliation is paused on the failover during a staged primary upgrade.

## Takeaways

- The failover instance can serve image scans after duplicating registry integrations and build-time policy configuration, but its cold caches initially make scans slower and increase registry traffic.
- Staggered upgrades use manual operator approval and the stackrox.io/pause-reconcile=true annotation on the failover Central custom resource.
- The two Central instances have no shared databases, caches, configuration, or vulnerability-update schedule, so brief differences in vulnerability detection can occur.

**Tags:** [CI/CD](https://yomu.fyi/topic/ci-cd), [High Availability](https://yomu.fyi/topic/high-availability), [Kubernetes](https://yomu.fyi/topic/kubernetes), [OpenShift](https://yomu.fyi/topic/openshift)

- Source: [Red Hat](https://developers.redhat.com/articles/2026/09/07/reference-architecture-for-ha-scanning-with-red-hat-advanced-cluster-security-for-kubernetes)
- Source URL: https://developers.redhat.com/articles/2026/09/07/reference-architecture-for-ha-scanning-with-red-hat-advanced-cluster-security-for-kubernetes
- Ingested by Yomu: 2026-09-07T04:00:47.780Z

[Read original post](https://developers.redhat.com/articles/2026/09/07/reference-architecture-for-ha-scanning-with-red-hat-advanced-cluster-security-for-kubernetes)