secureCodeBox / secureCodeBox/secureCodeBox
Scan Jobs hang if Cluster / Namespace uses Istio
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 988
- Forks
- 184
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 42
Description
Describe the bug
When the cluster has istio sidecar injection enabled the secureCodeBox cannot properly run its scans in the namespace as the jobs never terminate as the sidecar is still running even hours after the scan has completed.
Depending on the istio config this can also mess with the ability of the operator / lurcher / parsers to talk to the kubernetes API.
To Reproduce
Steps to reproduce the behavior:
- Start any scan in a istio injection enabled namespace
- Scan will never terminate
Expected behavior
Scans should work normally in istio enabled namespaces.
As a temporary workaround, or to wait untill proper sidecar support is added to kubernetes, it would be best to disable the injection via a "sidecar.istio.io/inject": "false"pod label on scan, parse and hook pods, see: https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#automatic-sidecar-injection
Ideally the secureCodeBox Operator could support istio and other service meshes directly and proxy scanner traffic thought the sidecar.
System (please complete the following information):
- Kubernetes: any version
- Istio: any version
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the operator's scan, parse, and hook pod entry points and checking how their pod labels are assembled. Reproduce a scan in a namespace with Istio injection enabled, then verify that disabling injection for these pods lets the operator, lurcher, and parsers communicate with the Kubernetes API and that scans terminate normally.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- devops, infrastructure, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100