Skip to content

Replace host sensor with node agent sensing #773

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Bezbran wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Replace host sensor with node agent sensing #773

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
14b1b0d
Replace host sensor with node agent sensing
Bezbran Dec 31, 2025
c07edfe
prepare next release
matthyx Mar 17, 2026
050623a
Add host sensor configuration options to configmap
matthyx Mar 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions charts/kubescape-operator/.helmignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,2 @@
tests
templates/node-agent-crds/README.md
4 changes: 2 additions & 2 deletions charts/kubescape-operator/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,14 +9,14 @@ type: application
# to the chart and its templates, including the app version.
# Versions are expected to follow Semantic Versioning (https://semver.org/)

version: 1.30.5
version: 1.31.0

# This is the version number of the application being deployed. This version number should be
# incremented each time you make changes to the application. Versions are not expected to
# follow Semantic Versioning. They should reflect the version the application is using.
# It is recommended to use it with quotes.

appVersion: 1.30.5
appVersion: 1.31.0

maintainers:
- name: Ben Hirschberg
Expand Down
4 changes: 1 addition & 3 deletions charts/kubescape-operator/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Kubescape Operator

![Version: 1.30.5](https://img.shields.io/badge/Version-1.30.5-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.30.5](https://img.shields.io/badge/AppVersion-v1.30.5-informational?style=flat-square)
![Version: 1.31.0](https://img.shields.io/badge/Version-1.31.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.31.0](https://img.shields.io/badge/AppVersion-v1.31.0-informational?style=flat-square)

[Kubescape operator documentation](https://kubescape.io/docs/install-operator/)

Expand Down Expand Up @@ -153,8 +153,6 @@ However, we recommend that you give Kubescape no less than 500m CPU no matter th
| operator.nodeSelector | object | `{}` | [Node selector](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/) |
| operator.volumes | object | `[]` | Additional volumes for the web socket |
| operator.volumeMounts | object | `[]` | Additional volumeMounts for the web socket |
| hostScanner.volumes | object | `[]` | Additional volumes for the host scanner |
| hostScanner.volumeMounts | object | `[]` | Additional volumeMounts for the host scanner |
| awsIamRoleArn | string | `nil` | AWS IAM arn role |
| cloudProviderMetadata.secretRef.name | string | `nil` | secret name to define values for the provider's metadata |
| cloudProviderMetadata.cloudRegion | string or through `cloudProviderMetadata.secretRef.cloudRegionKey` if `cloudProviderMetadata.secretRef.name` is set | `nil` | cloud region |
Expand Down
129 changes: 0 additions & 129 deletions charts/kubescape-operator/assets/host-scanner-definition.yaml
View file
Open in desktop

This file was deleted.

3 changes: 0 additions & 3 deletions charts/kubescape-operator/templates/_common.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,6 @@
capabilitiesConfig: {{ include (printf "%s/%s/%s" $.Template.BasePath $.Values.global.configMapsDirectory "components-configmap.yaml") . | replace .Chart.AppVersion "" | sha256sum }}
cloudConfig: {{ include (printf "%s/%s/%s" $.Template.BasePath $.Values.global.configMapsDirectory "cloudapi-configmap.yaml") . | replace .Chart.AppVersion "" | sha256sum }}
cloudSecret: {{ include (printf "%s/%s/%s" $.Template.BasePath $.Values.global.configMapsDirectory "cloud-secret.yaml" ) . | replace .Chart.AppVersion "" | sha256sum }}
hostScannerConfig: {{ include (printf "%s/kubescape/host-scanner-definition-configmap.yaml" $.Template.BasePath ) . | replace .Chart.AppVersion "" | sha256sum }}
matchingRulesConfig: {{ include (printf "%s/%s/%s" $.Template.BasePath $.Values.global.configMapsDirectory "matchingRules-configmap.yaml") . | replace .Chart.AppVersion "" | sha256sum }}
nodeAgentConfig: {{ include (printf "%s/node-agent/configmap.yaml" $.Template.BasePath) . | replace .Chart.AppVersion "" | sha256sum }}
operatorConfig: {{ include (printf "%s/operator/configmap.yaml" $.Template.BasePath) . | replace .Chart.AppVersion "" | sha256sum }}
Expand Down Expand Up @@ -50,8 +49,6 @@ submit: {{ $submit }}
{{- $nodeScanEnabled := and (eq .Values.capabilities.nodeScan "enable") (not $configurations.backendStorageEnabled) }}
{{- $configurationScanEnabled := and (eq .Values.capabilities.configurationScan "enable") (not $configurations.backendStorageEnabled) }}
{{- $vulnerabilityScanEnabled := and (eq .Values.capabilities.vulnerabilityScan "enable") (not $configurations.backendStorageEnabled) }}
hostScanner:
enabled: {{ $nodeScanEnabled }}
kubescape:
enabled: {{ $configurationScanEnabled }}
kubescapeScheduler:
Expand Down
16 changes: 16 additions & 0 deletions charts/kubescape-operator/templates/kubescape/clusterrole.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,4 +86,20 @@ rules:
- apiGroups: ["kubescape.io"]
resources: ["servicesscanresults"]
verbs: ["get", "watch", "list"]
{{- if .Values.nodeAgent.config.hostSensor.enabled }}
- apiGroups: ["hostdata.kubescape.cloud"]
resources:
- osreleasefiles
- kernelversions
- linuxsecurityhardeningstatuses
- openportslists
- linuxkernelvariables
- kubeletinfos
- kubeproxyinfos
- controlplaneinfos
- cloudproviderinfos
- cniinfos
verbs: ["get", "list", "watch"]
{{- end }}

{{ end }}
3 changes: 1 addition & 2 deletions charts/kubescape-operator/templates/kubescape/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,6 @@ spec:
annotations:
{{- include "kubescape-operator.annotations" (dict "Values" .Values) | nindent 8 }}
{{- with .Values.kubescape.podAnnotations }}{{- toYaml . | nindent 8 }}{{- end }}
checksum/host-scanner-configmap: {{ $checksums.hostScannerConfig }}
checksum/cloud-secret: {{ $checksums.cloudSecret }}
checksum/cloud-config: {{ $checksums.cloudConfig }}
{{- if ne .Values.global.proxySecretFile "" }}
Expand Down Expand Up @@ -153,7 +152,7 @@ spec:
- name: KS_DEFAULT_CLOUD_CONFIGMAP_NAME
value: {{ .Values.global.cloudConfig }}
- name: KS_ENABLE_HOST_SCANNER
value: "{{ $components.hostScanner.enabled }}"
value: "{{ .Values.nodeAgent.config.hostSensor.enabled }}"
- name: KS_SKIP_UPDATE_CHECK
value: "{{ .Values.kubescape.skipUpdateCheck }}"
- name: KS_HOST_SCAN_YAML
Expand Down
7 changes: 7 additions & 0 deletions charts/kubescape-operator/templates/node-agent-crds/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
### CRDs location inside the chart tree
These CRDs are placed in the `templates/` directory instead of the standard `crds/` directory to allow Helm to manage their full lifecycle.
This ensures they are updated during `helm upgrade` and removed during `helm uninstall`, supporting the evolving sensing capabilities of the node-agent.
No need to install them before kubescape operator chart since they are about to be used only after node-agent is up and running.

### tech debt
1. move CRDs group from `kubescape.cloud` to `kubescape.io`
38 changes: 38 additions & 0 deletions charts/kubescape-operator/templates/node-agent-crds/cloudproviderinfo-crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
{{- $components := fromYaml (include "components" .) }}
{{- if $components.nodeAgent.enabled }}
{{- if .Values.nodeAgent.config.hostSensor.enabled }}
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
name: cloudproviderinfos.hostdata.kubescape.cloud
spec:
group: hostdata.kubescape.cloud
names:
kind: CloudProviderInfo
listKind: CloudProviderInfoList
plural: cloudproviderinfos
singular: cloudproviderinfo
scope: Cluster
versions:
- name: v1beta1
served: true
storage: true
schema:
openAPIV3Schema:
type: object
properties:
spec:
type: object
x-kubernetes-preserve-unknown-fields: true
status:
type: object
x-kubernetes-preserve-unknown-fields: true
additionalPrinterColumns:
- name: Node
type: string
jsonPath: .spec.nodeName
- name: Last Sensed
type: string
jsonPath: .status.lastSensed
{{- end }}
{{- end }}
38 changes: 38 additions & 0 deletions charts/kubescape-operator/templates/node-agent-crds/cniinfo-crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
{{- $components := fromYaml (include "components" .) }}
{{- if $components.nodeAgent.enabled }}
{{- if .Values.nodeAgent.config.hostSensor.enabled }}
Comment on lines +2 to +3
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Avoid tying CRD lifecycle to hostSensor.enabled.

At Line 3, disabling nodeAgent.config.hostSensor.enabled on upgrade will stop rendering this CRD, and Helm can delete it (and its stored objects). For cluster-scoped host data, this is a risky lifecycle coupling to a runtime flag.

Proposed change 
 {{- $components := fromYaml (include "components" .) }}
 {{- if $components.nodeAgent.enabled }}
-{{- if .Values.nodeAgent.config.hostSensor.enabled }}
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   name: cniinfos.hostdata.kubescape.cloud
@@
-{{- end }}
 {{- end }}

Also applies to: 37-37

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@charts/kubescape-operator/templates/node-agent-crds/cniinfo-crd.yaml` around
lines 2 - 3, The CRD rendering is currently gated by the host sensor flag
(.Values.nodeAgent.config.hostSensor.enabled) which can cause Helm to delete the
CRD when that runtime flag is disabled; update the template so the CRD is not
tied to hostSensor.enabled—only gate it by the broader node agent enablement
($components.nodeAgent.enabled) or render it unconditionally for cluster scope;
remove the inner if that checks .Values.nodeAgent.config.hostSensor.enabled
around the CRD (and mirror the same change for the other occurrence noted) so
CRD lifecycle is independent of the hostSensor runtime flag.

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
name: cniinfos.hostdata.kubescape.cloud
spec:
group: hostdata.kubescape.cloud
names:
kind: CNIInfo
listKind: CNIInfoList
plural: cniinfos
singular: cniinfo
scope: Cluster
versions:
- name: v1beta1
served: true
storage: true
schema:
openAPIV3Schema:
type: object
properties:
spec:
type: object
x-kubernetes-preserve-unknown-fields: true
status:
type: object
x-kubernetes-preserve-unknown-fields: true
additionalPrinterColumns:
- name: Node
type: string
jsonPath: .spec.nodeName
- name: Last Sensed
type: string
jsonPath: .status.lastSensed
{{- end }}
{{- end }}
38 changes: 38 additions & 0 deletions charts/kubescape-operator/templates/node-agent-crds/controlplaneinfo-crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
{{- $components := fromYaml (include "components" .) }}
{{- if $components.nodeAgent.enabled }}
{{- if .Values.nodeAgent.config.hostSensor.enabled }}
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
name: controlplaneinfos.hostdata.kubescape.cloud
spec:
group: hostdata.kubescape.cloud
names:
kind: ControlPlaneInfo
listKind: ControlPlaneInfoList
plural: controlplaneinfos
singular: controlplaneinfo
scope: Cluster
versions:
- name: v1beta1
served: true
storage: true
schema:
openAPIV3Schema:
type: object
properties:
spec:
type: object
x-kubernetes-preserve-unknown-fields: true
status:
type: object
x-kubernetes-preserve-unknown-fields: true
additionalPrinterColumns:
- name: Node
type: string
jsonPath: .spec.nodeName
- name: Last Sensed
type: string
jsonPath: .status.lastSensed
{{- end }}
{{- end }}
38 changes: 38 additions & 0 deletions charts/kubescape-operator/templates/node-agent-crds/kernelversion-crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
{{- $components := fromYaml (include "components" .) }}
{{- if $components.nodeAgent.enabled }}
{{- if .Values.nodeAgent.config.hostSensor.enabled }}
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
name: kernelversions.hostdata.kubescape.cloud
spec:
group: hostdata.kubescape.cloud
names:
kind: KernelVersion
listKind: KernelVersionList
plural: kernelversions
singular: kernelversion
scope: Cluster
versions:
- name: v1beta1
served: true
storage: true
schema:
openAPIV3Schema:
type: object
properties:
spec:
type: object
x-kubernetes-preserve-unknown-fields: true
status:
type: object
x-kubernetes-preserve-unknown-fields: true
additionalPrinterColumns:
- name: Node
type: string
jsonPath: .spec.nodeName
- name: Last Sensed
type: string
jsonPath: .status.lastSensed
{{- end }}
{{- end }}
Loading
Loading