search

cyberark / KubiScan

A tool to scan Kubernetes cluster for risky permissions
GNU General Public License v3.0
1.31k stars 130 forks source link

Privacy Declaration? #56

Open dharapvj opened 1 year ago

dharapvj commented 1 year ago

Summary

This is more of a question rather than a bug. Does kubiscan contact any internet server as part of the scan? Since your recommended method to run is a docker container. I was not sure what it can / will do? I cannot run this in corporate environment unless there is explicit clarity on whether kubiscan phones home with any data or not.

Steps to Reproduce

run kubiscan

Expected Results

kubiscan works without sending any information to any 3rd party server.

Actual Results

Currently, it is unclear if kubiscan sends any information to any 3rd party server or not.

Reproducible

g3rzi commented 1 year ago

Hi @dharapvj,

KubiScan doesn't contact any internet server as part of the scan. It only communicates with the cluster's API server.
Regarding the privacy declaration, I will need to check it with our legal team.

Thanks

g3rzi commented 1 year ago

We recommended running with docker because it is easier, everything is already inside docker.
You can run also from outside, like from your host, you will need to make sure you have credentials with enough permissions (like the service account we suggested to create).