--- title: "How to integrate Calico Image Scanner with Argo CI/CD" source: "https://wordpress-1075849-4005834.cloudwaysapps.com/blog/how-to-integrate-calico-image-scanner-with-argo-ci-cd/" description: "Keep your images safe from CVEs by integrating the Calico Image Scanner into your CI/CD pipeline using Argo." --- [Technical Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/technical-blog/) # How to integrate Calico Image Scanner with Argo CI/CD By [Rui De Abreu](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/rui-de-abreu/) on May 12, 2023 • 5 min read In today’s fast-paced software development environment, developers often use common public libraries and modules to quickly build applications. However, this presents a significant challenge for DevOps teams who must ensure that these applications are safe to use. As organizations move towards dynamic models of software development that rely on Continuous Integration and Continuous Deployment, the responsibility for deploying secure applications has shifted from traditional security teams to development teams. To address this challenge, I will provide general guidelines on how to integrate the [Calico Image Scanning feature](https://wordpress-1075849-4005834.cloudwaysapps.com/tigera-products/compare-products/) into a CI/CD pipeline, using Argo. This will help ensure that images are built safely and free from Common Vulnerabilities and Exposures (CVEs). In this blog post, we will use a Kubernetes validating webhook configuration to attach a Calico Cloud admission controller that can accept or reject certain actions on resources, such as the creation of pods. This will prevent the deployment of images that contain known CVEs, thus strengthening the overall security of your software development process. ## Overall Architecture The building blocks to use Argo as an example of this integration are below: ![Diagram of Argo integration: Git repo triggers Argo Events, which triggers Argo Workflows, which syncs to ArgoCD for K8s](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2023/05/image1-3.png) ## Relevant Calico configuration Before even committing changes to our application, we must setup the Calico Admission Controller within our Calico Cloud setup, as detailed in our [Docs page](https://docs.tigera.io/calico-cloud/image-assurance/install-the-admission-controller). Then an “admissioncontrollerpolicy” resource must be created. In this example, we  will be preventing anything that has a CVSS score of “Failed” to be deployed in our environment (For other operations, please check the relevant [resource doc page](https://docs.tigera.io/calico-cloud/reference/resources/containeradmissionpolicy). ``` `apiVersion: containersecurity.wordpress-1075849-4005834.cloudwaysapps.com/v1beta1 kind: ContainerAdmissionPolicy metadata: ... name: reject-failed ... spec: namespaceSelector: all() order: 10 rules: - action: Allow imageScanStatus: operator: IsOneOf values: - Pass - Warn - action: Reject selector: all()` ``` ## Sequence of events To test the above, this will be the sequence of events in our pipeline: - A webhook in the repo sends any push event done to an ingress controller. ![Webhook delivery details showing request and response headers, status code, and completion time](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2023/05/image3-1.png) - This specific k8s ingress has a service whose endpoint is an “eventsource” resource in the Argo Events namespace. - The “eventsource” receives the event, and then triggers a “sensor” resource in Argo Events which creates a corresponding workflow. ``` `{"level":"info","ts":1679935064.284753,"logger":"argo-events.eventsource","caller":"github/start.go:130","msg":"received a request, processing it...","eventSourceName":"github","eventSourceType":"github","eventName":"example","endpoint":"/push","port":"12000","http-method":"POST"} {"level":"info","ts":1679935064.2853296,"logger":"argo-events.eventsource","caller":"github/start.go:164","msg":"dispatching event on route's data channel","eventSourceName":"github","eventSourceType":"github","eventName":"example","endpoint":"/push","port":"12000","http-method":"POST"} {"level":"info","ts":1679935064.2854376,"logger":"argo-events.eventsource","caller":"github/start.go:166","msg":"request successfully processed","eventSourceName":"github","eventSourceType":"github","eventName":"example","endpoint":"/push","port":"12000","http-method":"POST"} {"level":"info","ts":1679935064.2854986,"logger":"argo-events.eventsource","caller":"webhook/webhook.go:187","msg":"new event received, dispatching it...","eventSourceName":"github","eventSourceType":"github","eventName":"example"} {"level":"info","ts":1679935064.2905464,"logger":"argo-events.eventsource","caller":"eventsources/eventing.go:558","msg":"Succeeded to publish an event","eventSourceName":"github","eventName":"example","eventSourceType":"github","eventID":"65313037333131362d346161322d343363622d613833322d303265656563316636333338"} … {"level":"info","ts":1679935064.3465035,"logger":"argo-events.sensor","caller":"sensors/listener.go:417","msg":"Successfully processed trigger 'github-workflow-trigger'","sensorName":"github","triggerName":"github-workflow-trigger","triggerType":"Kubernetes","triggeredBy":["test-dep"],"triggeredByEvents":["65313037333131362d346161322d343363622d613833322d303265656563316636333338"]}` ``` - This workflow will build an image with the required changes, and then a second workflow will create another pod with a binary (the Tigera CLI scanner) which will look for vulnerabilities in this new image. Those scan results will be sent to Calico Cloud, so we will have not just the option of seeing those, but Calico Cloud will report if any running container is using such image in case we did not implement our Admission Controller before they were deployed: ![Screenshot of Calico Cloud's image scanning results, showing a "fail" status and critical CVEs found in a scanned image](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2023/05/image2-2.png) - Finally, ArgoCD will try to deploy the required applications with the new image based on what is defined in the repo it syncs from. - Beforehand, we applied an “admissioncontainerpolicy” resource that Calico manages. This webhook will prevent deploying any image that does not meet the criteria outlined in the previous section (“Relevant Calico configuration”). In our example, the applied policy will prevent the image if there is any vulnerability which has a CVSS score above the threshold of what will be considered a “Warn” value. We can see that for a failing test case, we will have a relevant entry in the application controller:   ``` `% kubectl logs -n argocd argocd-application-controller-0 | grep Reject | tail -1 time="2023-03-29T09:47:20Z" level=info msg="Updating operation state. phase: Running -> Failed, message: 'one or more tasks are running' -> 'one or more objects failed to apply, reason: admission webhook "image-assurance.wordpress-1075849-4005834.cloudwaysapps.com" denied the request: Action 'Reject' enforced by ContainerPolicy reject-failed rule index 1'" application=argocd/java-app syncId=00014-WkFyP` ``` And the relevant application will be shown as “Out of sync” in ArgoCD: ![ArgoCD UI showing "java-app" as "OutOfSync" and "Syncing," while "java-client" is "Healthy" and "Synced](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2023/05/image4-1.png) ## Conclusion Cloud native applications often rely on open source software and libraries, which can pose a significant threat to the security of your Kubernetes environment. The widespread use of these components means that a single vulnerability can quickly spread throughout your system. Fortunately, Calico Cloud offers a solution by preventing dangerous images from being deployed at build time through close integration with your CI/CD pipeline. If you’re interested in learning more about how Calico Cloud can help secure your Kubernetes environment, we invite you to watch our brief [3-minute video](https://tigera.wistia.com/medias/d4sy2ll2qr). This video will guide you through the necessary steps to integrate Calico Cloud into your CI/CD pipeline. Ready to get started? [Try a free trial](https://link.tigera.io/ueOp4). [How-To](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/how-to/) Add Tigera as a preferred source on Google to see more of our content in your search results. [![Add as a preferred source on Google](https://wordpress-1075849-4005834.cloudwaysapps.com/app/themes/tigera2021/dist/img/google-preferred-source-light.png)](https://www.google.com/preferences/source?q=tigera.io) ## Related posts [![AI Assistant for Calico: Troubleshooting at the Speed of Thought](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/03/Blog-Mar-20-AI-Assistant-for-Calico.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/ai-assistant-for-calico-troubleshooting-at-the-speed-of-thought/) #### [AI Assistant for Calico: Troubleshooting at the Speed of Thought](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/ai-assistant-for-calico-troubleshooting-at-the-speed-of-thought/) By [Veronika Smolik](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/veronika-smolik/) on Mar 19, 2026 Despite the wealth of data available, distilling a coherent narrative from a Kubernetes cluster remains a challenge for modern infrastructure teams. Even with powerful visualization tools like the Policy Board, Service Graph, and specialized dashboards,... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/ai-assistant-for-calico-troubleshooting-at-the-speed-of-thought/) [![What Your EKS Flow Logs Aren’t Telling You](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/03/Blog-Mar-18-What-Your-EKS-Flow-Logs-Arent-Telling-You.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/what-your-eks-flow-logs-arent-telling-you/) #### [What Your EKS Flow Logs Aren’t Telling You](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/what-your-eks-flow-logs-arent-telling-you/) By [Phil DiCorpo](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/phil-dicorpo/) on Mar 18, 2026 If you’re running workloads on Amazon EKS, there’s a good chance you already have some form of network observability in place. VPC Flow Logs have been a staple of AWS networking for years, and AWS... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/what-your-eks-flow-logs-arent-telling-you/) [![Kubernetes Network Observability: Comparing Calico, Cilium, Retina, and Netobserv](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/02/Blog-Feb-11-Comparing-Calico-Cilium-Retina-and-Netobserv-1.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/kubernetes-network-observability-comparing-calico-cilium-retina-and-netobserv/) #### [Kubernetes Network Observability: Comparing Calico, Cilium, Retina, and Netobserv](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/kubernetes-network-observability-comparing-calico-cilium-retina-and-netobserv/) By [Reza Ramezanpour](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/rezar/) on Feb 11, 2026 Calico, Cilium, Retina, and Netobserv: Which Observability Tool is Right for Your Kubernetes Cluster? Network observability is a tale as old as the OSI model itself and anyone who has managed a network or even... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/kubernetes-network-observability-comparing-calico-cilium-retina-and-netobserv/)