They should prioritise alternate storage when scan volume, object size, or revision churn makes report persistence a control plane risk. If vulnerability data is needed for analysis but does not need to live inside etcd, storing it externally protects availability without eliminating security visibility.
Why etcd becomes the wrong place to keep scan results
etcd is excellent for Kubernetes control-plane state, but it is not a general-purpose analytics store. Scan results can be large, numerous, and frequently updated, which turns routine persistence into extra write pressure, larger watch payloads, and more compaction churn. Once those reports stop being lightweight metadata, they begin to compete with the control plane’s core job: keeping cluster state available and consistent.
That trade-off matters because the control plane must stay responsive even when scans spike, retest, or produce repeated findings for many workloads. The issue is not whether the data is valuable, it is whether the data belongs in the same datastore as the cluster’s authoritative state.
For container-oriented persistence and runtime risk, the NIST container security guidance is a useful baseline for separating workload concerns from platform state, and the same principle shows up in NIST SP 800-190 Container Security.
When alternate storage is the better operational choice
Alternate storage should be the default once scan results become historical evidence rather than live cluster control data. That includes situations where teams need to retain vulnerability findings for trend analysis, auditor review, or offline correlation, but do not need every result to participate in scheduling, admission, or reconciliation decisions inside Kubernetes.
External storage is also the better fit when result size is variable or when scan frequency creates revision churn. Those conditions are what make etcd riskier, because every update expands the amount of state the control plane must manage, replicate, and compact. If the workload is generating more reporting data than configuration data, the storage design has crossed the line.
For teams modelling the boundary between platform state and persistence, CSA Cloud Controls Matrix and CIS Controls v8 both reinforce the need to match data handling to control boundaries instead of defaulting everything into the orchestration layer.
How to decide what stays in Kubernetes and what moves out
A practical rule is to keep only the smallest state needed for coordination in etcd, such as pointers, summaries, or references, and move the heavier scan artefacts elsewhere. If the object must be queried often by the control plane, stored as a Kubernetes resource, or used for immediate admission logic, it may still belong in-cluster. If it is mainly for reporting, triage, or longer retention, store it externally and link back.
That split preserves security visibility without making the control plane the long-term archive. It also reduces the chance that a burst of scanning activity turns into an availability event, especially in large clusters or environments with continuous rescanning.
Where storage strategy intersects with workload identity, secret handling, or privileged access paths, the broader container and identity guidance remains relevant. Teams can use Secrets in Docker Hub images (RWTH Aachen study) to understand why sensitive artefacts should not be left in places where platform state and secret material blur together.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST CSF 2.0, CSA Cloud Controls Matrix and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | Scan results need durable review and reporting outside control-plane state. |
| Recommendation — Store findings where they can be reviewed and retained without burdening cluster state. | ||
| NIST CSF 2.0 | PR.DS-01 — Data-at-rest is protected | Externally stored scan results still need protection as retained security data. |
| Recommendation — Protect persisted scan results wherever they are stored. | ||
| CSA Cloud Controls Matrix | DCS — Data Security and Privacy | Separating scan-result persistence from etcd is a data-handling control choice in cloud environments. |
| Recommendation — Place scan artefacts in a data store suited to retention and access control. | ||
| ISO/IEC 27001:2022 | A.8.13 — Information backup | Scan-result retention outside etcd needs defined storage and recovery handling. |
| Recommendation — Define how retained scan results are stored, restored, and protected. | ||
| CIS Controls v8 | CIS-3 — Data Protection | Large scan outputs should be protected as managed data, not incidental control-plane state. |
| Recommendation — Classify scan results as managed data and secure them accordingly. | ||
Practitioner Guidance
What to prioritise: Put a size and churn threshold on scan-result storage. Once persisted reports start behaving like a dataset, treat them as application data rather than Kubernetes control data.
What to verify: Confirm whether the cluster actually needs the full result object inside etcd, or only a reference for retrieval. If the answer is “analysis only,” move the payload out and keep the control-plane object minimal.
Decision rule: If storing the scan result increases etcd write load, watch size, or retention pressure without improving immediate cluster decisions, use alternate storage first and keep etcd as the index, not the archive.
Practitioner takeaway: The right boundary is defined by control-plane resilience, not convenience; keep etcd for authoritative Kubernetes state and place scan artefacts wherever they can be retained and queried without risking cluster availability.
Related resources from NHI Mgmt Group
- When should organisations prioritise EPSS and KEV over raw scan volume in Kubernetes vulnerability management?
- When should security teams prioritise Kubernetes mode over Docker in Docker for ARC runners?
- How should teams prioritise remediation when verification and scan results disagree?
- When should teams prioritise HttpOnly cookies over local storage for JWTs?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 11, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org