secureCodeBox / secureCodeBox/secureCodeBox

Scan Jobs hang if Cluster / Namespace uses Istio

Open
#132 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Go
Stars
988
Forks
184
Avg merge
1d 23h
Merged PRs (30d)
42

Description

Describe the bug

When the cluster has istio sidecar injection enabled the secureCodeBox cannot properly run its scans in the namespace as the jobs never terminate as the sidecar is still running even hours after the scan has completed.

Depending on the istio config this can also mess with the ability of the operator / lurcher / parsers to talk to the kubernetes API.

To Reproduce
Steps to reproduce the behavior:

  1. Start any scan in a istio injection enabled namespace
  2. Scan will never terminate

Expected behavior

Scans should work normally in istio enabled namespaces.

As a temporary workaround, or to wait untill proper sidecar support is added to kubernetes, it would be best to disable the injection via a "sidecar.istio.io/inject": "false"pod label on scan, parse and hook pods, see: https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#automatic-sidecar-injection

Ideally the secureCodeBox Operator could support istio and other service meshes directly and proxy scanner traffic thought the sidecar.

System (please complete the following information):

  • Kubernetes: any version
  • Istio: any version

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the operator's scan, parse, and hook pod entry points and checking how their pod labels are assembled. Reproduce a scan in a namespace with Istio injection enabled, then verify that disabling injection for these pods lets the operator, lurcher, and parsers communicate with the Kubernetes API and that scans terminate normally.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
devops, infrastructure, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.