elastic / elastic/cloudbeat

Remove dependency on PSPs, allowing us to bump K8s libraries' versions

Open
#2,353 2 comments 1 reaction 0 assignees View on GitHub
cloudbeat dependency Team:Cloud Security
Dominant language
Go
Stars
58
Forks
55
Avg merge
9h 9m
Merged PRs (30d)
424

Description

## Description

Cloudbeat relies on Kubernetes (K8s) libraries that provide PodSecurityPolicy definitions. However, due to PSP deprecation, we are stuck with outdated libraries, preventing us from updating other dependencies and remediating CVEs.

## Details

_PodSecurityPolicies_ (PSPs) have been deprecated (K8s v1.21) and removed (K8s v1.25). `cloudbeat` officially supports K8s v1.23, hence we keep all golang libraries that interact [with K8s pinned to v0.28](https://github.com/elastic/cloudbeat/blob/85023e0c02ac62a69c754815175afb4e427f419c/go.mod#L82-L84). That is the last version containing PSPs, which were removed in [v0.29 and later](https://github.com/kubernetes/api/commit/5a75c6e751ef86e3cc1bb758c2fc8c30df53b03c).

Remediating CVEs often requires a bump of a dependency version, which is prevented by the pinned K8s library version.

The one piece of code blocking the upgrade is the dependency on `policyv1beta1.PodSecurityPolicy` type definition, used to spawn an `Informer` to watch for events. [See: internal/resources/fetching/fetchers/k8s/kube_fetcher.go](https://github.com/elastic/cloudbeat/blob/85023e0c02ac62a69c754815175afb4e427f419c/internal/resources/fetching/fetchers/k8s/kube_fetcher.go#L84-L89)

## Proposed solution

Check if K8s API serves PSPs. If yes, use Dynamic Informer to watch them without having to provide a full type. If not, do not watch them at all (K8s >=v1.25).

- Use [ServerResourcesForGroupVersion](https://pkg.go.dev/k8s.io/client-go/discovery#DiscoveryClient.ServerResourcesForGroupVersion) to query K8s API and see if PSPs are available in `policy/v1beta1` group
- If yes, use a [DynamicInformer](https://pkg.go.dev/k8s.io/client-go/dynamic/dynamicinformer) to watch them

**Extra examples:**
- https://blog.dsb.dev/posts/creating-dynamic-informers/
- https://firehydrant.com/blog/dynamic-kubernetes-informers/

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.