Skip to content

K8S.md

Latest commit

 

History

History
78 lines (62 loc) · 2.48 KB

K8S.md

File metadata and controls

78 lines (62 loc) · 2.48 KB
Raw

Kubernetes stack discovery

Opt-in discovery of infrastructure tools from Deployment container images in a Kubernetes cluster. Used by GET /api/v1/discovery/kubernetes (API v1).

Enable

K8S_DISCOVERY_ENABLED=true
# Optional: restrict namespaces (comma-separated). Omit for all namespaces.
# K8S_DISCOVERY_NAMESPACES=production,staging
# Optional: kubeconfig path (default: in-cluster SA or ~/.kube/config)
# K8S_KUBECONFIG=/path/to/kubeconfig

Requires API_SECRET (or equivalent auth) in production — discovery is not exposed anonymously. RBAC roles: admin, scanner.

When disabled, the endpoint returns 503 { "code": "K8S_DISCOVERY_DISABLED" }. Capabilities expose features.k8sDiscovery: true|false.

Response shape

{
  "enabled": true,
  "images": ["haproxy", "nginx", "redis"],
  "tools": ["HAProxy", "Nginx", "Redis"],
  "unmapped": ["my-sidecar"]
}
  • images — deduplicated image base names (registry/tag/digest stripped)
  • tools — mapped to preset names in server/lib/presets.ts (aligned with UI INFRA_PRESETS)
  • unmapped — bases with no preset mapping (add manually in Stack tab)

In-cluster ServiceAccount (read-only)

Minimal ClusterRole for listing Deployments:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: cve-radar-discovery
  namespace: cve-radar
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cve-radar-discovery
rules:
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["list", "get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cve-radar-discovery
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cve-radar-discovery
subjects:
  - kind: ServiceAccount
    name: cve-radar-discovery
    namespace: cve-radar

Mount the ServiceAccount token in the CVE Radar pod (default in-cluster config). For namespace-scoped access, use a Role + RoleBinding per namespace and set K8S_DISCOVERY_NAMESPACES.

UI integration

When features.k8sDiscovery is true, the Stack tab can call GET /api/v1/discovery/kubernetes and merge returned tools into the active stack (Import from cluster).

Security notes

  • Discovery is read-only — no cluster mutations.
  • Do not grant secrets, pods/exec, or write verbs to the discovery SA.
  • Run CVE Radar behind network policy; combine with tenant isolation (docs/self-hosted/TENANTS.md) on shared installs.