Container security Swift has become a task not about individual vulnerabilities, but about risk management architecture. When a critical payment flow passes through the network, manual checks cease to scale.
Swift operated in an environment where a simple delay in vulnerability detection turns into systemic risk. The company processes a flow comparable to the world’s GDP every three days, so security and availability are directly linked here. At such a scale, finding even one critical vulnerability among millions of container images distributed across several data centers can no longer be solved manually.
The team chose Red Hat Advanced Cluster Security for Kubernetes. This is a pragmatic choice for a model where it is necessary to secure build, deployment, and runtime simultaneously, rather than patching individual stages as incidents occur. The main compromise was moving away from a pull-based scheme, where a central CMDB polls each cluster. Such a model creates unnecessary network traffic and complicates operations as the number of clusters grows.
Instead, Swift built a stateless central architecture. A local agent in each Red Hat OpenShift environment collects data about images and sends it to a central object store. Then, a central scanning job queries a single Red Hat Advanced Cluster Security central instance, matches images with known CVEs, and enriches the result with ownership mapping data from Git. After that, the cleaned and prioritized risk profile is returned to the CMDB.
This data flow is important not only in terms of convenience. It makes the architecture more resilient to changes in the composition of clusters. If a cluster is removed, the system can recover automatically because the central state rebuilds from code. Here we see a classic engineering solution: less dependence on live state at the edge, more reliance on reproducible configuration.
A separate problem arose at the level of policy changes and versions of security tools. Updating such components often brings false positives and noise, which quickly leads to alert fatigue among developers. To avoid breaking the usual workflow, the team added an automated regression testing pipeline. Before moving a new policy or a new version of Red Hat Advanced Cluster Security from development to testing and production, it is run in a sandbox with test workloads that specifically trigger policy violations.
This is an important detail. The team checks not only that the system “works,” but also that it still sees exactly the violations it should see. This approach reduces the risk that an update to the security layer will start blocking normal changes or, conversely, miss expected signals.
Additionally, Swift uses daily automated scans for running images, including short-lived pods. Zero-touch certificate management is implemented through Argo CD and HashiCorp Vault. As a result, manual actions are minimized, and security teams engage only when a high-priority vulnerability is confirmed. For the platform team, this means a lower operational burden. For developers, it means maintaining delivery speed without losing control over risk.