cloud-native-security-inspector
cloud-native-security-inspector copied to clipboard
Task: Implement resource collector
Resource collector's duty is to collect the data from the securiy insepctors of every demensions. Such as image scanners, k8s misconfigurations and runtime intrutions.
For single-cluster architechture, resource collector can:
- Proactively call K8s API to get the images of the pods.
- Proactively call Harbor API to fetch the image security issues.
- Provide an API endpoint for the daemonSet agents to report unstructured security data. The daemonSet agents are those ones must use the node information for doing things, such as misconfiguration detection and intrution detection by syscall.
- Can save the data to the database, for "Analyst" to use it.
For multi-cluster architechture:
- Above resource collector will become an deployment on each cluster.
- As long as the resource collectors can connect the DB, then things still will work.
After done this, there will be no conjobs in the whole Narrows scope.
- Resource collector will have a for loop internally to call external APIs to fetch information.
- The DaemonSets will be triggered by events to report their data.
So the subtasks of this task will be:
- Change Kubebench into DaemonSet.
- Remove the cronjobs of image scanner and risk scanner, but without functionality regression from the user's perspective.
- Modify the policy CRD controller, to adapt to this new design.