deepfence / deepfence/ThreatMapper
Can't capture network flows on K8s/containerd
- Dominant language
- TypeScript
- Stars
- 5.3k
- Forks
- 631
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
_I understand that this issue is specific to K8s/containerd platforms, and is strictly a limitation in scope, where scope cannot accurately identify network connections and assign them correctly to processes within containers/pods when running on containerd _
Problem: when running on K8s/containerd, we do not accurately and completely identify network flows and associate them with running artefacts (containers, processes, etc). This has several implications:
* The topology graph is incomplete, and inconsistent between affected and unaffected systems.
* Our exploit prioritisation gives higher priority to network-based vulnerabilities that receive external traffic; we don't see the external traffic for some workloads, so corresponding vulnerabilities are de-prioritised
* We can't draw a appropriate attack path for these vulnerabilities
**To Reproduce**
Steps to reproduce the behavior:
For example, refer to the public ThreatMapper demo, and compare the topology visualisation for the *digitalocean_agent* host and the visualisation for a K8s cluster
Have reproduced this with a K8s 1.21.5 cluster with a simple workload (nginx-ingress load-balancing to 2 deployments of 5 services each) with active traffic. ThreatMapper agent does not identify all inbound and outbound connection flows for all of the processes
**Expected behavior**
The current visualisation for a docker host is a good illustration:

**Components/Services affected**
- [X] UI/Frontend
- [ ] API/Backend
- [X] Agent
- [ ] Deployment/YAMLs
- [ ] CI/CD Integration
- [ ] Other (specify)
**Additional context**
See also issue #141, which may be a prerequisite before this can be completed
Contributor guide
Assessment
This issue has not been assessed yet.