Codecollection exploration

[saurabh3460]

Below are the list that may be next code bundles:

• Istio
  • Check if mTLS is enabled
  • Detect external service not reachable (e.g RDS endpoint)
  • Cert expiration [present in public codecollection ]
• PV, PVC
  • Check if any PV and PVC is in pending state (may be Storage class issue) [present in cli codecollection]
• RBAC
  • Not decided but could be a detection (TBD)

[saurabh3460]

WIP: check mTLS enabled sli

We can use prometheus RW library with this istio_requests_total{connection_security_policy!="mutual_tls"} PromQL query.

runbook may be adding PeerAuthentication CRD to missing resource or namespace level

[saurabh3460]

WIP: Detect external service health check

provisional approach:

1. Wrap RDS endpoint with ServiceEntry
2. Monitor ServiceEntry using PromQL (which query is TBD)