Remove dependency on PSPs, allowing us to bump K8s libraries' versions
- Dominant language
- Go
- Stars
- 58
- Forks
- 55
- Avg merge
- 9h 9m
- Merged PRs (30d)
- 424
Description
## Description
Cloudbeat relies on Kubernetes (K8s) libraries that provide PodSecurityPolicy definitions. However, due to PSP deprecation, we are stuck with outdated libraries, preventing us from updating other dependencies and remediating CVEs.
## Details
_PodSecurityPolicies_ (PSPs) have been deprecated (K8s v1.21) and removed (K8s v1.25). `cloudbeat` officially supports K8s v1.23, hence we keep all golang libraries that interact [with K8s pinned to v0.28](https://github.com/elastic/cloudbeat/blob/85023e0c02ac62a69c754815175afb4e427f419c/go.mod#L82-L84). That is the last version containing PSPs, which were removed in [v0.29 and later](https://github.com/kubernetes/api/commit/5a75c6e751ef86e3cc1bb758c2fc8c30df53b03c).
Remediating CVEs often requires a bump of a dependency version, which is prevented by the pinned K8s library version.
The one piece of code blocking the upgrade is the dependency on `policyv1beta1.PodSecurityPolicy` type definition, used to spawn an `Informer` to watch for events. [See: internal/resources/fetching/fetchers/k8s/kube_fetcher.go](https://github.com/elastic/cloudbeat/blob/85023e0c02ac62a69c754815175afb4e427f419c/internal/resources/fetching/fetchers/k8s/kube_fetcher.go#L84-L89)
## Proposed solution
Check if K8s API serves PSPs. If yes, use Dynamic Informer to watch them without having to provide a full type. If not, do not watch them at all (K8s >=v1.25).
- Use [ServerResourcesForGroupVersion](https://pkg.go.dev/k8s.io/client-go/discovery#DiscoveryClient.ServerResourcesForGroupVersion) to query K8s API and see if PSPs are available in `policy/v1beta1` group
- If yes, use a [DynamicInformer](https://pkg.go.dev/k8s.io/client-go/dynamic/dynamicinformer) to watch them
**Extra examples:**
- https://blog.dsb.dev/posts/creating-dynamic-informers/
- https://firehydrant.com/blog/dynamic-kubernetes-informers/
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.