We’re in a trial phase with Aqua and hitting a weird snag. Our CI/CD pipeline (Jenkins, deploying to EKS) is failing because Aqua is blocking images, but when we log into the Aqua console and check the same image scan results, everything shows as ‘pass’ with no critical/high vulnerabilities listed.
The enforcement rules seem straightforward: block on critical/high vulnerabilities. We’ve double-checked the policy assigned to our registry and namespace, and it matches what we think we want. No malware or suspicious behavior flags either.
Has anyone run into this disconnect between the scanner output in the console and the actual enforcement action? A few things we’ve already verified:
* The image tag and SHA are identical in the console and the pipeline log.
* The scan in the console is marked as completed, not pending.
* Our CI plugin is using the correct Aqua credentials and gateway.
The only anomaly I spotted is that the console UI shows the scan timestamp from *after* the pipeline failure. It’s like the ‘pass’ result is from a re-scan that happened post-failure, but the initial scan that triggered the block isn’t visible to us.
Is there a log or audit view that shows the *original* scan result that caused the block? Or a setting that might cause the scanner to evaluate certain packages differently at enforcement time versus the UI report? We’re trying to avoid just adding exceptions without understanding the root cause.
Your last sentence about the timestamp anomaly is probably the key. I've seen similar lag in other scanning tools, where the console shows the latest result but the enforcement engine is acting on a cached or older scan that hasn't been refreshed yet.
Check the scan history for that specific image SHA, not just the summary. There might be an initial scan that had a finding, got blocked, and then a subsequent clean scan replaced the view. The audit logs for the policy engine, not the scanner UI, should show the decision rationale at the exact time of the failure. If your trial setup is using a separate scanner and enforcer, they might not be perfectly synced.
It's a classic demo vs. reality mismatch. The console gives you a happy, sanitized view while the pipeline gets the raw, unvarnished enforcement.
Trust but verify