Kubernetes

The kubernetes package is responsible for collecting information from kubernetes clusters. It currently supports the following platforms

1. AWS
2. Azure
3. GCP
4. Local

API

The kubernetes API provides the following Endpoints

tip

See Kubernetes API Reference for more details

1. POST /kubernetes/fetch - Fetch K8S data
2. POST /kubernetes/get - Get fetched K8S info by ID
3. POST /kubernetes/list - List fetched K8S info by ID
4. POST /kubernetes/auth-cli - Authenticate CLI of Cloud Providers for fetching K8S data

Fetching K8S Data

The kubernetes/fetch requires request body for cloud platforms

This endpoint does the following

1. Check if document with provided highLevelID exist in database
2. (If is Cloud Platform) Attempt to authenticate CLI with the given credentials
3. Authenticate Kubernetes CLI and fetch Cluster Context, context will be saved in Database
4. Get Cluster Context from DB
5. Get the Kubernetes Client Set using the Cluster Context
6. Initiate Kubernetes Information Fetch

AWS

{
  "platform": "aws",
  "awsAccessKeyId": "YOUR_ACCESS_KEY",
  "awsSecretAccessKey": "YOUR_SECRET",
  "highLevelID": "",
  "clusterName": "CLUSTER_NAME",
  "clusterZoneOrGroup": "CLUSTER_ZONE_OR_GROUP"
}

Azure

{
  "platform": "azure",
  "azureTenantId": "YOUR_TENANT_ID",
  "azureClientId": "YOUR_CLIENT_ID",
  "azureClientSecret": "YOUR_CLIENT_SECRET",
  "highLevelID": "",
  "clusterName": "CLUSTER_NAME",
  "clusterZoneOrGroup": "CLUSTER_ZONE_OR_GROUP"
}

GCP

{
  "platform": "gcp",
  "gcpJsonKey": "YOUR_JSON_KEY",
  "gcpProjectID": "YOUR_PROJECT_ID",
  "highLevelID": "",
  "clusterName": "CLUSTER_NAME",
  "clusterZoneOrGroup": "CLUSTER_ZONE_OR_GROUP"
}

Local

{
  "platform": "local",
  "highLevelID": "",
  "clusterName": "",
  "clusterZoneOrGroup": ""
}

Development Information

1. Currently, the kubernetes data structure is separated into two parts, high level and low level, the high level is the information that is fetched from the cloud provider, and the low level is the information that is fetched from the kubernetes cluster.
2. Context information is stored in the database, and tool commonly require direct access to the cluster context to fetch data.
   1. The initial aim was a separation between data fetching and data analysis, but the current implementation does not fully achieve this goal.
3. Initially, the local fetch (localk8s command) was designed to test vulnerability scanning of the tool, however, a prerequisite for this is a separation between data fetching and data analysis.