elastic / elastic/cloudbeat

K8s watcher fail to be set resulting with no findings from kube-fetcher

Open
#2,137 0 comments 0 reactions 0 assignees View on GitHub
bug cloudbeat Team:Cloud Security
Dominant language
Go
Stars
58
Forks
55
Avg merge
9h 9m
Merged PRs (30d)
424

Description

**Bug Description**
This bug is relevant for customers running KSPM on Kubernetes version v1.25 or higher.
In k8s v1.25, Pod Security Policy (PSP) was removed, and setting a watcher for this resource will fail, as shown [here](https://github.com/elastic/cloudbeat/blob/67eeb8619d6a0e92efd55b80fd1137ce7a311c0d/internal/resources/fetching/fetchers/k8s/kube_fetcher.go#L146).

If we fail to initialize a Kubernetes watcher for a specific resource, we stop running the kube-fetcher, resulting in no findings from this fetcher.

**Preconditions**
KSPM integration installed on Kubernetes v1.25 or above.

**Steps to Reproduce**
1. Run ELK stack + Elastic agent (version 8.13.x).
2. Install the latest KSPM integration.
3. Observe that no Kubernetes resources findings arrive.

**Expected Behavior**
We should receive findings from all three fetchers (filesystem, process, kube).

**Possible Solutions**
1. Continue setting other Kubernetes resource watchers even if one fails to be set.
2. Determine the Kubernetes version we're running and set watchers only for the supported resources in this Kubernetes version.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.