From c16da21fba224373ece7faf7f7b7b4c4423b7621 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Simon=20H=C3=BClkenberg?= Date: Fri, 9 Sep 2022 19:10:48 +0200 Subject: [PATCH 1/2] Add managed by label to required labels in service autodiscovery MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Simon Hülkenberg --- .../kubernetes/controllers/service_scan_controller.go | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/auto-discovery/kubernetes/controllers/service_scan_controller.go b/auto-discovery/kubernetes/controllers/service_scan_controller.go index 440f5d9939..548cd3cd83 100644 --- a/auto-discovery/kubernetes/controllers/service_scan_controller.go +++ b/auto-discovery/kubernetes/controllers/service_scan_controller.go @@ -119,6 +119,7 @@ func (r *ServiceScanReconciler) Reconcile(ctx context.Context, req ctrl.Request) versionedLabels := map[string]string{ "auto-discovery.securecodebox.io/target-service": service.Name, "auto-discovery.securecodebox.io/target-port": fmt.Sprintf("%d", host.Port), + "app.kubernetes.io/managed-by": "securecodebox-autodiscovery", } for containerName, podDigest := range podDigests { // The map should only contain one entry at this point. As the reconciler breaks (see containerDigestsAllMatch) if the services points to a list pods with different digests per container name @@ -155,8 +156,6 @@ func (r *ServiceScanReconciler) Reconcile(ctx context.Context, req ctrl.Request) // service was never scanned log.Info("Discovered new unscanned service, scanning it now", "service", service.Name, "namespace", service.Namespace) - // label is added after the initial query as it was added later and isn't guaranteed to be on every auto-discovery managed scan. - versionedLabels["app.kubernetes.io/managed-by"] = "securecodebox-autodiscovery" versionedLabels = generateScanLabels(versionedLabels, r.Config.ServiceAutoDiscoveryConfig.ScanConfig, templateArgs) // No scan for this pod digest yet. Scanning now From 3eca5ac6381bde05536b7fbdc08b867ba4fdd55e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Simon=20H=C3=BClkenberg?= Date: Fri, 30 Sep 2022 20:33:53 +0200 Subject: [PATCH 2/2] Add upgrading section MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Simon Hülkenberg --- UPGRADING.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/UPGRADING.md b/UPGRADING.md index 30c61af9d4..063e345579 100644 --- a/UPGRADING.md +++ b/UPGRADING.md @@ -151,3 +151,7 @@ helm upgrade --install nmap secureCodeBox/nmap --set=cascadingRules.enabled=true ➡️ [Reference: #1347](https://github.com/secureCodeBox/secureCodeBox/pull/1347) + +### Service Autodiscovery - Managed-by label assumed to be presented for all scans +Old versions of the operator did not set `app.kubernetes.io/managed-by` label. Starting with V4 the service autodiscovery will assume every scheduled scan created by the autodiscovery will have this label. This means that older scheduled scans without the label will not be detected by the service autodiscovery and new duplicate scheduled scans will be created. Old scheduled scans without the `app.kubernetes.io/managed-by` label must be deleted manually. +➡️ [Reference: #1349](https://github.com/secureCodeBox/secureCodeBox/pull/1349) \ No newline at end of file