search

elastisys / compliantkubernetes-apps

Elastisys Compliant Kubernetes is an open source, Certified Kubernetes distribution designed according to the ISO27001 controls: providing you with security tooling and observability from day one.
https://elastisys.io/compliantkubernetes/
Apache License 2.0
46 stars 7 forks source link

[1]Starboard: Set sane value for OPERATOR_VULNERABILITY_SCANNER_REPORT_TTL #853

Closed cristiklein closed 2 years ago

cristiklein commented 2 years ago

Is your feature request related to a problem? Please describe.

Please set a sane default value for OPERATOR_VULNERABILITY_SCANNER_REPORT_TTL. The default value should trade two conflicting goals:

Describe the solution you'd like

A value which is large enough to ensure the vulnerability dashboard always works, e.g., 2x frequency of scanning. Unfortunately, I have been unable to determine at a glance how often starboard does scanning.

Describe alternatives you've considered

Additional context

Definition of done:

Pavan-Gunda commented 2 years ago

It seems like 30 days (720h) is a good retention period for vulnerability reports and I see that the older reports are not deleted automatically, (the controller responsible for automatic deletion looks for an annotation report-ttl), as the older reports don't have the annotation. They wanted the admins to delete the reports.

So it's a bit of work for admins during the maintenance window. but I think It is only done once.

https://github.com/aquasecurity/starboard/pull/879 https://github.com/aquasecurity/starboard/pull/863 https://github.com/aquasecurity/starboard/commit/ab3974f34d367bd5fc311e8832be289430650f25#diff-d3f7d7d560e713a8e799f56e1c0316a5f024a0957d58814fde1802453266ad07R20

cristiklein commented 2 years ago

@Pavan-Gunda Just to make sure I understand, you recommend setting starboard.vulnerabilityScanner.reportTTL: 30d in defaults/common-config.yaml?

If yes, then it sounds good to me!