deepfence / deepfence/ThreatMapper

Can't capture network flows on K8s/containerd

Open
#142 0 comments 0 reactions 1 assignee Claimed by @ramanan-ravi View on GitHub
bug needs-triage
Dominant language
TypeScript
Stars
5.3k
Forks
631
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**

_I understand that this issue is specific to K8s/containerd platforms, and is strictly a limitation in scope, where scope cannot accurately identify network connections and assign them correctly to processes within containers/pods when running on containerd _

Problem: when running on K8s/containerd, we do not accurately and completely identify network flows and associate them with running artefacts (containers, processes, etc). This has several implications:

* The topology graph is incomplete, and inconsistent between affected and unaffected systems.
* Our exploit prioritisation gives higher priority to network-based vulnerabilities that receive external traffic; we don't see the external traffic for some workloads, so corresponding vulnerabilities are de-prioritised
* We can't draw a appropriate attack path for these vulnerabilities

**To Reproduce**

Steps to reproduce the behavior:

For example, refer to the public ThreatMapper demo, and compare the topology visualisation for the *digitalocean_agent* host and the visualisation for a K8s cluster

Have reproduced this with a K8s 1.21.5 cluster with a simple workload (nginx-ingress load-balancing to 2 deployments of 5 services each) with active traffic. ThreatMapper agent does not identify all inbound and outbound connection flows for all of the processes

**Expected behavior**

The current visualisation for a docker host is a good illustration:

image

**Components/Services affected**

- [X] UI/Frontend
- [ ] API/Backend
- [X] Agent
- [ ] Deployment/YAMLs
- [ ] CI/CD Integration
- [ ] Other (specify)

**Additional context**

See also issue #141, which may be a prerequisite before this can be completed

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.