search

openclarity / kubeclarity

KubeClarity is a tool for detection and management of Software Bill Of Materials (SBOM) and vulnerabilities of container images and filesystems
Apache License 2.0
31 stars 4 forks source link

FeatureRequest: remote write to another instance #655

Open jmueller42 opened 1 year ago

jmueller42 commented 1 year ago

We have a lot of k8s clusters, which means we have a separate kubeclarity instance per cluster, which does scheduled scanning.

It would be nice if each of these kubeclarity instances could push its results to a central kubeclarity instance, such that one could review the results of all clusters in one place. This feature could be like the remote write feature that prometheus offers.

github-actions[bot] commented 1 year ago

Thank you for your contribution! This issue has been automatically marked as stale because it has no recent activity in the last 60 days. It will be closed in 14 days, if no further activity occurs. If this issue is still relevant, please leave a comment to let us know, and the stale label will be automatically removed.

github-actions[bot] commented 1 year ago

This issue has been marked stale for 14 days, and is now closed due to inactivity. If the issue is still relevant, please re-open this issue or file a new one. Thank you!

akpsgit commented 1 year ago

Hi @jmueller42, thanks a lot for the feature request. We are planning to support this feature by a big change in KubeClarity very soon. The idea is to replace the scanner and the scan orchestrator logic by the much more advanced and scaleable capabilities that are under development in VMClarity. This will be addressed in the following features: https://github.com/openclarity/openclarity/issues/723 https://github.com/openclarity/vmclarity/issues/558

Once completed, we'll move into switching the infra of KubeClarity to VMClarity. Would love to hear your thoughts on it. Thanks!

jmueller42 commented 1 year ago

Hi @akpsgit ,

thank you for the information.

I think it would be better to have an agent based approach, especially in the kubernetes environment. So discovering the vulnerabilites can be centralized, but the creation of the SBOM should be done inside the clusters. So some sort of agent should reside in the cluster, such that SBOM generation is done inside the cluster. This has the security advantage, that the credentials needed to pull the container images (image pull secrets) never leave the cluster and only the SBOM needs to be transferred to the central instance, which then can compare the SBOM to different sources of CVE vulnerabilites. What I like about this centralized approach is the possibility to handle CVEs centrally, which will save a lot of manual work, when evaluating the found CVEs and planning corresponding measures.

akpsgit commented 1 year ago

@jmueller42 exactly! There will be a component ("agent" ) in the runtime environment that will analyze the content (e.g. SBOM) that will use image pull secrets, take container snapshots etc. This is the data-plane scanner that will have the privileges to do it only within the env, for the reasons you mentioned. For the example of CVEs for an image, we don't even need to scan it again, as the SBOM of images is fixed, we can just correlate it for newly discovered vulnerabilities in the centralized control-plane.

jmueller42 commented 1 year ago

@akpsgit That sounds great. Is there a timeline when this will be available?

github-actions[bot] commented 12 months ago

Thank you for your contribution! This issue has been automatically marked as stale because it has no recent activity in the last 60 days. It will be closed in 14 days, if no further activity occurs. If this issue is still relevant, please leave a comment to let us know, and the stale label will be automatically removed.

github-actions[bot] commented 11 months ago

This issue has been marked stale for 14 days, and is now closed due to inactivity. If the issue is still relevant, please re-open this issue or file a new one. Thank you!

akpsgit commented 11 months ago

Hi @jmueller42, sorry for the late response. The K8s scanning capabilities are under final review now in VMClarity in: https://github.com/openclarity/vmclarity/pull/864 https://github.com/openclarity/vmclarity/pull/711 @chrisgacsal, @lgecse, do you know when it is expected to be merged? Also, what is the timeline for the VMClarity & KubeClarity merge?

jmueller42 commented 11 months ago

@akpsgit Thank you. I will check out vmclarity when this is merged.