Application Scanning about mondoo-operator HOT 8 CLOSED

Perfect kubeapi and kubenodes make sense. I also agree about changing config to credentials

from mondoo-operator.

mondoo picks up the default kubectl config from ~/.kube/config

If you define the inventory as following:

apiVersion: v1
kind: Inventory
metadata:
  name: mondoo-k8s-api-inventory
  labels:
    environment: production
spec:
  assets:
    - id: api
      connections:
        - backend: k8s

mondoo scan --inventory mondoo-app-inventory.yaml will scan the Kubernetes API.

• CIS Kubernetes Benchmark Level 1 Profile is for the Hosts
• Kubernetes Application Benchmark by Mondoo is for the API scan

from mondoo-operator.

In order to configure both the node and app scanning, we need to adapt the configuration for the operator:

apiVersion: k8s.mondoo.com/v1alpha1
kind: MondooClient
metadata:
  name: mondoo-client
  namespace: mondoo-operator-system
data:
  config: |
    ..
  kubeapi:
    disable: false
    inventory: |
      ...
  daemonset:
    disable: false
    inventory: |
      ...

The first version could look like this:

apiVersion: k8s.mondoo.com/v1alpha1
kind: MondooClient
metadata:
  name: mondoo-client
  namespace: mondoo-operator-system
data:
  config: |
    mrn: //agents.api.mondoo.app/spaces/test-infallible-taussig-796596/serviceaccounts/1u20vCfgWqaxOjGmWFFCH4qi2se
    space_mrn: //captain.api.mondoo.app/spaces/test-infallible-taussig-796596
    private_key: |
      -----BEGIN PRIVATE KEY-----
      MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDB4SxLzF7ZQvD0dxoWa
      ...
      pJLAp0cuKBUrUNpOQ62qaQ9F17/r6/TBejq6FaYkok7og+MkQVr8gos=
      -----END PRIVATE KEY-----
    certificate: |
      -----BEGIN CERTIFICATE-----
      MIICfDCCAgGgAwIBAgIRAKqQ9zkDA/rIBj96r4g+qJswCgYIKoZIzj0EAwMwSTFH
      ...
      Rc3OFH5K0IWA0yDdL5QVoQ==
      -----END CERTIFICATE-----
    api_endpoint: https://api.mondoo.app
 
  kubeapi:
    disable: true
    inventory: |
      apiVersion: v1
      kind: Inventory
      metadata:
        name: mondoo-k8s-api-inventory
        labels:
          environment: production
      spec:
        assets:
          - id: api
            connections:
              - backend: k8s
  kubenodes:
    disable: true
    inventory: |
      apiVersion: v1
      kind: ConfigMap
      metadata:
        name: mondoo-inventory
      data:
        inventory: |
          apiVersion: v1
          kind: Inventory
          metadata:
            name: mondoo-k8s-inventory
            labels:
              environment: production
          spec:
            assets:
              - id: host
                connections:
                  - host: /mnt/host
                    backend: fs

To simplify the configuration for the user, we want to provide defaults in case the user does not set anything in yaml. The operator would set the following default if kubeapi or kubenodes are not set:

  kubeapi:
    disable: false
    inventory: (set default inventory for kubeapi
  nodes:
    disable: false
    inventory: (set default inventory for nodes)

Optionally users could also just not overwrite the inventory and the operator would set the sensible default. With those changes the simple config with the credential would enable Kubernetes nodes and api scanning as default:

```yaml
apiVersion: k8s.mondoo.com/v1alpha1
kind: MondooClient
metadata:
  name: mondoo-client
  namespace: mondoo-operator-system
data:
  config: |
    mrn: //agents.api.mondoo.app/spaces/test-infallible-taussig-796596/serviceaccounts/1u20vCfgWqaxOjGmWFFCH4qi2se
    space_mrn: //captain.api.mondoo.app/spaces/test-infallible-taussig-796596
    private_key: |
      -----BEGIN PRIVATE KEY-----
      MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDB4SxLzF7ZQvD0dxoWa
      ...
      pJLAp0cuKBUrUNpOQ62qaQ9F17/r6/TBejq6FaYkok7og+MkQVr8gos=
      -----END PRIVATE KEY-----
    certificate: |
      -----BEGIN CERTIFICATE-----
      MIICfDCCAgGgAwIBAgIRAKqQ9zkDA/rIBj96r4g+qJswCgYIKoZIzj0EAwMwSTFH
      ...
      Rc3OFH5K0IWA0yDdL5QVoQ==
      -----END CERTIFICATE-----
    api_endpoint: https://api.mondoo.app

from mondoo-operator.

In order to configure both the node and app scanning, we need to adapt the configuration for the operator:

apiVersion: k8s.mondoo.com/v1alpha1
kind: MondooClient
metadata:
  name: mondoo-client
  namespace: mondoo-operator-system
data:
  config: |
    ..
  kubeapi:
    disable: false
    inventory: |
      ...
  daemonset:
    disable: false
    inventory: |
      ...

The first version could look like this:

apiVersion: k8s.mondoo.com/v1alpha1
kind: MondooClient
metadata:
  name: mondoo-client
  namespace: mondoo-operator-system
data:
  config: |
    mrn: //agents.api.mondoo.app/spaces/test-infallible-taussig-796596/serviceaccounts/1u20vCfgWqaxOjGmWFFCH4qi2se
    space_mrn: //captain.api.mondoo.app/spaces/test-infallible-taussig-796596
    private_key: |
      -----BEGIN PRIVATE KEY-----
      MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDB4SxLzF7ZQvD0dxoWa
      ...
      pJLAp0cuKBUrUNpOQ62qaQ9F17/r6/TBejq6FaYkok7og+MkQVr8gos=
      -----END PRIVATE KEY-----
    certificate: |
      -----BEGIN CERTIFICATE-----
      MIICfDCCAgGgAwIBAgIRAKqQ9zkDA/rIBj96r4g+qJswCgYIKoZIzj0EAwMwSTFH
      ...
      Rc3OFH5K0IWA0yDdL5QVoQ==
      -----END CERTIFICATE-----
    api_endpoint: https://api.mondoo.app
 
  kubeapi:
    disable: true
    inventory: |
      apiVersion: v1
      kind: Inventory
      metadata:
        name: mondoo-k8s-api-inventory
        labels:
          environment: production
      spec:
        assets:
          - id: api
            connections:
              - backend: k8s
  kubenodes:
    disable: true
    inventory: |
      apiVersion: v1
      kind: ConfigMap
      metadata:
        name: mondoo-inventory
      data:
        inventory: |
          apiVersion: v1
          kind: Inventory
          metadata:
            name: mondoo-k8s-inventory
            labels:
              environment: production
          spec:
            assets:
              - id: host
                connections:
                  - host: /mnt/host
                    backend: fs

To simplify the configuration for the user, we want to provide defaults in case the user does not set anything in yaml. The operator would set the following default if kubeapi or kubenodes are not set:

  kubeapi:
    disable: false
    inventory: (set default inventory for kubeapi
  nodes:
    disable: false
    inventory: (set default inventory for nodes)

Optionally users could also just not overwrite the inventory and the operator would set the sensible default. With those changes the simple config with the credential would enable Kubernetes nodes and api scanning as default:

```yaml
apiVersion: k8s.mondoo.com/v1alpha1
kind: MondooClient
metadata:
  name: mondoo-client
  namespace: mondoo-operator-system
data:
  config: |
    mrn: //agents.api.mondoo.app/spaces/test-infallible-taussig-796596/serviceaccounts/1u20vCfgWqaxOjGmWFFCH4qi2se
    space_mrn: //captain.api.mondoo.app/spaces/test-infallible-taussig-796596
    private_key: |
      -----BEGIN PRIVATE KEY-----
      MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDB4SxLzF7ZQvD0dxoWa
      ...
      pJLAp0cuKBUrUNpOQ62qaQ9F17/r6/TBejq6FaYkok7og+MkQVr8gos=
      -----END PRIVATE KEY-----
    certificate: |
      -----BEGIN CERTIFICATE-----
      MIICfDCCAgGgAwIBAgIRAKqQ9zkDA/rIBj96r4g+qJswCgYIKoZIzj0EAwMwSTFH
      ...
      Rc3OFH5K0IWA0yDdL5QVoQ==
      -----END CERTIFICATE-----
    api_endpoint: https://api.mondoo.app

I want to remove the term daemonset from CRD. While coding it might cause confusion even though we are using a daemonset controller under covers.

apiVersion: k8s.mondoo.com/v1alpha1
kind: MondooClient
metadata:
  name: mondoo-client
  namespace: mondoo-operator-system
data:
  config: |
    ..
  kubeapi:
    disable: false
    inventory: |
      ...
  nodescanner:
    disable: false
    inventory: |
      ...

from mondoo-operator.

I agree, lets not use daemon. I want to avoid the term scanner. Maybe we use kubeapi and kubenodes? Also it seems that config should really be credentials

from mondoo-operator.

apiVersion: k8s.mondoo.com/v1alpha1
kind: MondooClient
metadata:
  name: mondoo-client
  namespace: mondoo-operator-system
data:
  credential: |
    ..
  kubeapi:
    enable: true
    inventory: |
      ...
  kubenodes:
    enable: true
    inventory: |
      ...

Checking non existence of false value is tricky and to keep it simple the switch should be enable : true and disable by default

from mondoo-operator.

Can you give an example why this is tricky? Can we not just check if the struct kubenodes is nil and if so just set the default values then?

from mondoo-operator.

I cant give you an example of the top of my head right now but I will try what you suggested and get back to you.

from mondoo-operator.