Container Registry and Software Supply Chain Platform  ·  View 19 of 33  ·  4 · Runtime

Advisory-Driven Re-Evaluation

What happens when the world's knowledge changes and the image does not.

Editable source SVG draw.io All views
Advisory change New or Amended reconciled record Withdrawn marked, never deleted Match Component Index Lookup purl + range Affected Digests ~120 of 40,000 Fan out Re-Evaluation Jobs one per digest Running workloads first Re-evaluate Finding Set Rebuild Suppression Check expiry aware Reachability where supported Evidence update New Finding Record supersedes, appends Signed Scan Result new referrer Impact Running Workload Map cluster + workload Verdict Change Event Act Owner Notification Alert Above Severity Eviction or Drain phase 3, not automatic affected workloads Re-Evaluation When the Advisory Moves, Not the Image Queue / topic Application we own Data store Decision point Security / platform Risk / gap event / async Cost scales with affected artifacts, not stored artifacts. Advisory to re-evaluated finding set p95 ≤ 60 min. v 1.0 · owner Security Architecture · date 2026-09

Decisions

  • Re-evaluation is index-driven: match the advisory against the component index, then fan out to the affected digests only
  • Artifacts referenced by running workloads are re-evaluated first, but stored artifacts are re-evaluated too — audit asks about them
  • A new finding record supersedes the previous one; nothing is overwritten and nothing is deleted

Targets

  • New advisory to re-evaluated finding set on all affected artifacts: p95 ≤ 60 minutes
  • An event is emitted when a running workload's image acquires a finding above a configured severity, naming affected clusters and workloads
  • Count of running workloads in violation of current policy is a first-class metric

The gap we are keeping

  • A changed verdict denies the next admission but does not evict the running pod
  • Automated eviction or drain is phase 3, and it is a different problem from admission — it needs a disruption budget and an owner
  • Until then the answer is a notification and a human, which is honest but slow
◀  Advisory Ingest and Reconciliation All views Air-Gapped Verification  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 33 views · open-source, on-premises19-advisory-re-evaluation