sbom-operator
sbom-operator copied to clipboard
Feature request: Map k8s pod labels as project tags
As a System Operator, I would like to add pod labels as project tags in DependencyTrack So that grouping/filtering by label in dtrack is possible
Background: We use k8s pod labels to determine and group things like application, stage, department, ...
Given the following deployment was applied to k8s cluster:
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: dependencytrack-frontend
namespace: dependencytrack-sales-live
spec:
template:
metadata:
labels:
app=dependencytrack
stage=live
department=sales
service=inventory
spec:
containers:
- name: dependencytrack-frontend
image: dependencytrack-frontend:4.5.1
---
When the sbom-operator scans the pod and adds the project to dtrack
Then the following tags should be added to dtrack:
[namespace=dependencytrack-sales-live, app=dependencytrack, stage=live, department=sales, ...]
But currently only the following tags are added:
[namespace=dependencytrack-sales-live, ...]
What do you think about the idea of adding Labels map[string]string
to struct libk8s.PodInfo
and allow custom mapping of labels to dtrack project tags?
What would be an appropriate way to configure the custom mapping?
sbom-operator is awesome. Thank you!
Hi @muellerst-hg, thanks for your request. Sure, the Dependency Track integration can be extended with the pod-labels as you specified. What do you mean with "custom mapping"? Can you give a few more details about this?
Maybe "custom mapping" isn't the right term.
Given I have the following labels:
spec:
template:
metadata:
labels:
app=dependencytrack
stage=live
department=sales
service=inventory
pod-template-hash=12c5401afc
And I have selected "app" and "stage" as labels to be added as tags
Then the following project tags should be added to dtrack
app=dependencytrack
stage=live
With two labels "app=dependencytrack" and "app=nginx", some magic would be required to identify both by matching "app" left of the equals sign.
A user could provide a regex for matching labels like SBOM_DTRACK_LABEL_TAG_MATCHER="^(?:app|stage)="
I got it, you want to control which pod-labels should be mapped to Dependency Track.