Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

K8s watcher fail to be set resulting with no findings from kube-fetcher #2137

Open
uri-weisman opened this issue Apr 15, 2024 · 0 comments
Open
Labels
bug Something isn't working Team:Cloud Security Cloud Security team related

Comments

@uri-weisman
Copy link
Contributor

Bug Description
This bug is relevant for customers running KSPM on Kubernetes version v1.25 or higher.
In k8s v1.25, Pod Security Policy (PSP) was removed, and setting a watcher for this resource will fail, as shown here.

If we fail to initialize a Kubernetes watcher for a specific resource, we stop running the kube-fetcher, resulting in no findings from this fetcher.

Preconditions
KSPM integration installed on Kubernetes v1.25 or above.

Steps to Reproduce

  1. Run ELK stack + Elastic agent (version 8.13.x).
  2. Install the latest KSPM integration.
  3. Observe that no Kubernetes resources findings arrive.

Expected Behavior
We should receive findings from all three fetchers (filesystem, process, kube).

Possible Solutions

  1. Continue setting other Kubernetes resource watchers even if one fails to be set.
  2. Determine the Kubernetes version we're running and set watchers only for the supported resources in this Kubernetes version.
@uri-weisman uri-weisman added bug Something isn't working Team:Cloud Security Cloud Security team related labels Apr 15, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working Team:Cloud Security Cloud Security team related
Projects
None yet
Development

No branches or pull requests

1 participant