From 7bfddceef0711cec63f5fb50c7d992da99c8aeaf Mon Sep 17 00:00:00 2001 From: CatalogBot Date: Thu, 29 Aug 2024 14:18:42 +0000 Subject: [PATCH] add starboard-exporter-0.7.11-969c674c8f0121b89cbf4ccbdd743b9071bd9213.tgz starboard-exporter-0.7.11-969c674c8f0121b89cbf4ccbdd743b9071bd9213.tgz-meta/README.md starboard-exporter-0.7.11-969c674c8f0121b89cbf4ccbdd743b9071bd9213.tgz-meta/main.yaml starboard-exporter-0.7.11-969c674c8f0121b89cbf4ccbdd743b9071bd9213.tgz-meta/values.schema.json --- index.yaml | 20 +- ...9c674c8f0121b89cbf4ccbdd743b9071bd9213.tgz | Bin 0 -> 7272 bytes .../README.md | 188 ++++++++++++ .../main.yaml | 12 + .../values.schema.json | 272 ++++++++++++++++++ 5 files changed, 491 insertions(+), 1 deletion(-) create mode 100644 starboard-exporter-0.7.11-969c674c8f0121b89cbf4ccbdd743b9071bd9213.tgz create mode 100644 starboard-exporter-0.7.11-969c674c8f0121b89cbf4ccbdd743b9071bd9213.tgz-meta/README.md create mode 100644 starboard-exporter-0.7.11-969c674c8f0121b89cbf4ccbdd743b9071bd9213.tgz-meta/main.yaml create mode 100644 starboard-exporter-0.7.11-969c674c8f0121b89cbf4ccbdd743b9071bd9213.tgz-meta/values.schema.json diff --git a/index.yaml b/index.yaml index 3c6bf8e42e..7cbff7f364 100644 --- a/index.yaml +++ b/index.yaml @@ -44481,6 +44481,24 @@ entries: urls: - https://giantswarm.github.io/giantswarm-test-catalog/starboard-exporter-0.7.11-97d36c68fbcfbee6fa7acf6fe3addaf524122740.tgz version: 0.7.11-97d36c68fbcfbee6fa7acf6fe3addaf524122740 + - annotations: + application.giantswarm.io/metadata: https://giantswarm.github.io/giantswarm-test-catalog/starboard-exporter-0.7.11-969c674c8f0121b89cbf4ccbdd743b9071bd9213.tgz-meta/main.yaml + application.giantswarm.io/readme: https://giantswarm.github.io/giantswarm-test-catalog/starboard-exporter-0.7.11-969c674c8f0121b89cbf4ccbdd743b9071bd9213.tgz-meta/README.md + application.giantswarm.io/team: shield + application.giantswarm.io/values-schema: https://giantswarm.github.io/giantswarm-test-catalog/starboard-exporter-0.7.11-969c674c8f0121b89cbf4ccbdd743b9071bd9213.tgz-meta/values.schema.json + config.giantswarm.io/version: 1.x.x + apiVersion: v1 + appVersion: 0.7.11-969c674c8f0121b89cbf4ccbdd743b9071bd9213 + created: "2024-08-29T14:18:40.70766305Z" + description: A Helm chart for starboard-exporter, which exposes Prometheus metrics + from Aqua VulnerabilityReport and other custom resources. + digest: 6ccf05279deae7c59d35b864fee0149629b0f4805650ba797ffe14c6daadf25a + home: https://github.com/giantswarm/starboard-exporter + icon: https://s.giantswarm.io/app-icons/prometheus/1/light.svg + name: starboard-exporter + urls: + - https://giantswarm.github.io/giantswarm-test-catalog/starboard-exporter-0.7.11-969c674c8f0121b89cbf4ccbdd743b9071bd9213.tgz + version: 0.7.11-969c674c8f0121b89cbf4ccbdd743b9071bd9213 - annotations: application.giantswarm.io/metadata: https://giantswarm.github.io/giantswarm-test-catalog/starboard-exporter-0.7.11-8cec403800475cb62ba871da2481a431ccd527fa.tgz-meta/main.yaml application.giantswarm.io/readme: https://giantswarm.github.io/giantswarm-test-catalog/starboard-exporter-0.7.11-8cec403800475cb62ba871da2481a431ccd527fa.tgz-meta/README.md @@ -50385,4 +50403,4 @@ entries: urls: - https://giantswarm.github.io/giantswarm-test-catalog/zot-1.0.0-21b0af457fca705f0e3ab09f836213c46a310043.tgz version: 1.0.0-21b0af457fca705f0e3ab09f836213c46a310043 -generated: "2024-08-29T14:15:17.106315758Z" +generated: "2024-08-29T14:18:40.706318012Z" diff --git a/starboard-exporter-0.7.11-969c674c8f0121b89cbf4ccbdd743b9071bd9213.tgz b/starboard-exporter-0.7.11-969c674c8f0121b89cbf4ccbdd743b9071bd9213.tgz new file mode 100644 index 0000000000000000000000000000000000000000..bf2b81e13dd6a3c08d51b6bbb76778500ce99da5 GIT binary patch literal 7272 zcmV-u9GBxCiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PKBfbKEwzXg>2-py;_b$vicC(b9HTa;tP@PwW@VR!NShre;zq zG>Ik=kpKgLEy;@BZ-0e_JJ?N0E!j?*A8a+&gM+hSIR{)oHm8sU19X*ACJ-AQMUV;a z8Yb~KoB2kg(db}rPyIg{jhg>YM!WmpjQ0)>_Qs>}-of;n(RhEfJN^cYHq`&hFOwMf zX7u2`nuGgFK1c`^P+&^<%mDzVX^egK+Y2!yf?q}jX6NrhT&y@f(1cL;90pOm#I(&Kj%1eTk;0gqj8Q>8{@#=z0 z7-xtNxF4b9OPCD}kEh}Be&dul0Qi(FaM*+#F^(yjfw6bxT{$qtAM=#u*nw$U{JbMD zPJp=2a4J;gL+~2K3Gk&D0}IMPd$c>?GQxfY%>x8GK!>37QJ}gtAMY_%d_|l)YNoUEUY1pIbO>zeoQp`rk10<_v%}`hRaa z9X0j;WIEmI|EKsEQhJ8Zz}R6Z#9XjzX$S;VYS|eGIrXszKV=O0%)``iZ~{Xli)eY{ zu9Ru6DSwj1@fq?N5_|@3ZXG9#=^VzgnUn@+$j=xS*JlEf0J1=tA^;$=pv*_X3@l*G zk>jK^kU1GgOqamH42(ykkpn=;XqGlo9YOK?IM70G zDx{&`GsJ}f&`&cplZpD3poFsP8JJ8)$JhZN#tH6I(#eUj=paMK@aq3!ArL!3%tu7X z%1&Xo9A*I)TF)1x2D)6u_wH7I`u20$^#x#T3CLLaqq z7)mL}g0kyYmVjX;tp?9I4jd<;L{`KkoT>R>OYEa#o!A9wT++Jy$&gCGB;+NXKws09 z%912xa%AxkUCku>{9(HL!_R5h%!{biwxw6sVd3*L56% z#3f}HDUGqO#;Ae~>A^?vd3or>m0!8G3GlU8=@AC4pVd%}Jh3+pACgA|{ zfkYKrViG!zmQTmpLVbO5SQ~K8t+nC(z4A-uRfqTY$}cCMoOjxY^chT1kQq^ld`bdY zMpN?P5-}K}kJ3&!(|MAAB!13RMUdA7rYevePcz{-7bt*dK8#WDe*PQs#YTr97!E_k zawdCLAX)b6@n{%OpARSAcrx@U@lh)HP)bUP=>VlMy-pAjeE2MH$kEKD1y^Zyt7L^S zy(BijHJ2fF7z7M)J_A4K-#dUuG>Zc;M@GP8OpbU5ATRV9KrVgHk25Y1^J415c(%8< z`#(ho)k*q6|4=NkV{2H?;(0z9=Vmg>)_%{B6q7%oE9eXT%T$HS@SH9YJC_spT}MOz z9w)zkU$!P9hImBdUToA=H3JA05?4}IV}^nqwTjC) zz~WmDToH432h1}80+b?2U6d$p)7b7a=@I}$gjrw@K{1MY#wl9Nz_S`^!91q^MJJ$E zh>CG*i|Gg1NwHkar;i~h#mD@*LT7+p62wZpU0@P4PzF9|Qa!8z4k!ahnu@IX|5GgO zy6ykUg8qRv=4$(YJl&l%?f--Qz0ubGe~Rx$=~ee{dbZsea3%Z9hC?~;W|PUIEF9`T zpSe4_f)t6eG*wbOPfZz35tA0CI|Da`Vc<3uS1q@@y&|`x-6G#;5Nl?w`8lOAg2Zi= zy4`8FT2U_RTgF77P%e0SwOokt^$l|&ZMdH8ma1~Y5O-?+hxFsve^vT-i-qKdDW+}c zuOEoDr@lRwBU(eNt!_JMHvev|Iqg*2ymqXIHcUOX)zVjtZ#zVw)$103|?fL!y}!KTe>??k zmaOZW?GQG7h+-9Dy1}lsumS-+TPXImHcd>;U8t{ELp{JEsP7bh#W+}@rQhrNyVtp1E8(0`va9&<4+wf%CZ>Md#ldU=OR3fHwMYCJH zGo`EG88 ze+NsP%m7CMNC_la?8ii+#gEVo{C#+P>&Q~htE&`}K;3I1FhPJW^c_d#F6fwY0}!AE zCdeF7fq_Z&v{&IfS@91bSVnwsu&e&W$yv5o;49z`%JPT=>Tlikk-8maTzXXJ5)$Lr z0w4z&*LSB1fb{iL3s@?*>?dWIhy`%}ix2*byEQP)-^M8k{GqOULLUM5|G22%LmrF0wX9L8>L044#t%Au|73;=g^WjTP~Gb#{JU;s?~I15TJDhDmV z1J>~z7e&^MsoIzsmjT{%s>#J$0~62p;WR`rO}&e3ju=4#apk562@Fv%m|v^ry;Bq; z$dPxZPc^E|w<{NpQnIGOXW^Arts0>?@pv>;#8e-Lp|8e3nuyEy6W5`w9PhvivA$8b z29ND(m~a7!kLoxw%xMMtbIYmi_c-5b{h#lTJj?)CqyNYI)4ittKbUOqe?G}~2mNo9 zFw_cIF0$0U?Ak?U?l}L95CJI-xXP_us|S#w;-0gJ&^3tQQfhJlOBby1fzsd57l=7r z>r=6Ey^HVPANzvLPxd z=dF}yd5X3{_NKjTkTtL=&zihq9X^$1QD&AF&6(ecI`eCcxzJM`xbbAkfoWl&j}3ct zney~r9i=?&(|U0Y>VBPMaXjFv{uifHSIYnTwe1w%(hgawo*W!(<^NNB zii#J&`>35hniuswbHr}U&oW>G%mg*AQ^V!N(Vi)>WWe@ z&|MEq{Dnc3LQ~qf`&EtHRl-ZJ3<_UHwKG)X)y67In#x43p@;x`vMNuJuUsZ2@E_ED z-cz*D4b@PPrhK>@t8_j7mxZ!ZiEZP&Lrml#*Zkh30PdQVs?(ybS@nurS+nBOsB7vx zIlSD_?Sv|4KjoTTIDS?=&sKI&l+*14U~?N>-A1Rg!FE-$>2Ia{FO9bcMT1x)|EH5? z{D;YCyuY`V|4;GR1X@d&wdMC6gxcp6;mjrzSxx@sJ1n}F1PVWTTj|!`adjK2?E1j8 zC>Rtdysia3KziZh0Fbkn>9B&@ythj%q5|6bZJ$!6HUf8*wIxJ?{tG5?1+?d7#aw{V`o>(^Ohiq1ISzmNAgE%dKd)0&PCAR#a6l>XmKOVt_mhQ>`8=XH^w#SBWw5 zu>Rm;fe9AZWiyHz1U_tK0FW}YK#ZZ_WyUZG&-@4lnY7Q|goGB!uda}vsQ?a@ssq)o zY4ZbO$*gg5r>LNf#Qd{xP4(-~LF3xo=jcpnOvCG+(e(_}w=pBig%lgL8kY!%kqYQB zD$*ql*l?CRZr>ecb-I!`YYly%@$%{_Wr*`SIaEtsv>L;P!S{$yF89)PmdFS$X`DpS|4PmWTb2g}g4k27{Ca1DyW& zx9^Vsb$;^x<@uYF?;9lyoeg9kKi-kRY;7o0Wqm^pi>5?$MOo&Sw`X&c^{O7FZIE>C zKugshD;T{)qkn+kC?>$&aaU3zPyu)jL5zin5lCQ&eYFW1K@v!*3CzIdpNeG7Js55a zg&3jO{DV2q5FhUDj-EeLe@kNn5iyvK#=8g8(fCDU%-VN*0J8uKJ}^5Ja_kZ0Kcnk5 z3fj)zrSE{`NW=(az3LVFA%bP7JsUM#54aCWFZgUz)DJ@IMRpxN;O*fh@M`dz zDl$lQ87sy0XwO1ih%D<|ttCyt&^2wMG|WF3ZCNS{jN+i!u4(0*KoP0kCy^)LhNYuei z6_mpW!B|9}>RCA~<4Ur$YcPyoq8MHm0hxBI(3<#5WwfSJ?UmuzZf=_9d65bJ0J(`a zTB!wjw+if3(<^jiyEj8MpL^Z>XZcp{{}_kZL6CdI-ftUd_5RP^{=xpZx&OaA+28K} zJjK`03FS2%ujvh4sFlV^K(S$Tq_pKROl$i^)!hZt<@U z&FsLObmUjy8G9pd)E}M{5)|7&k#>L`h_hBsrTY!^EF>%0yZ+G5+Hl`EK^!rRIws%) zPE_Q&RslO0=C6`sVTW^~8)GhNL=2kOyXP5>#T(hfxZyccp{W^g2LoVe77PYWClf8F zTpa?mkr&~hBM1AG9MM?0__{2d!|z5rU@{)>fXV*;4j6ym>?TK7b$9l^!C{P;;LWmn zxn;R;uN}o)wOiG^(eJA5qeF7-n#h=~0s@A0X;J1BteD5LsFk>F!ndk;X@BLBYm4eG z3b3$X+g)Jp!}wnavNHjhIHp8I?hF)Tl=3KzK2RD9oYpcFjgl;m%M@X@Qze=X_V%9d zPp0Gj>HhPgM2yKrLu^We`yIV(qE2(g3Q=04vj%l$nt%RQDdTkD)UCWop!lVhsg@#I zUAB8Mi)fqwhU*&wwYW|tR8h8DMBe00ca4_wiJQPQH4!3gG*q^2+sxq2Mlfq@x*`*@*gIW?zJ6v-V8jlT4XnZyL zQaqoRfDFNAf!{JN@Z!2Ck_p-@LK#Lx1%H{ag%QwFqe{t&N7zH>>whCseV60>9)8Su1 z!Hg$&*Dx=(8U}1NOeO!3HO$-h|NP?A%UgQ6)h%1yVjXLr4*wFm<>2nRWjxv{7qC?> zmHbCmF7MvId-cU>mv@w)t$Nw27wcI2bof_LFOz#5?~lh@^#Zo)rIP>1>gAVrKfinb z&v##(hWUkD5PC_rN+yLd5&{kU7;=vN^_oTp@aPEXeTBL5GqcW@DR2@)UtNCg;CWSW z4%uOhLt@Ic?n|m5+wk&CT=T1WHEk!s`PDmYr zlnuFdUEfqiL~#YOyUY@QvI-i|5m8zW{Eg(JlosLBRU%}zQOKNs;y_){99!~JiitSG zpCl^wZB~E}WAqYp!SFm=5v{#oBLhmWvG9mqo=5=rD$?L7BvPjHZahln^)GC%#+m&5 zMIHChY92ig)(SuE-n;ZA$rqSr_t$TaB*{hKsUvZEk1`2;Dy9HJ8J$W)aYHKQOO(n23mGV+s zQ)z1|ef_4=i@uhU^)!EtsWjP|N?(Jil&5XRM#@`z1mh^qxIj#8EJ?u6Oizz%A{BnX zc7N(G$cVbjp~g!4Nt!&XbYFw_nwzfn9=A&4Pop$!$0+@k#`s{h))?>hQyU9Ph4mTZ zl?M*`)PvcNHF%b+KhBW$VXp%VS@1Q20m_AX=eRd|FtI|IfnEX)tQTsQ;nsDS-O)Z* zVuGd@-;GB*;E@hT{$J_+_($%cQrQ*AW9aRG{C7$@7PL$eF#O)44i|;0YX_bHT3>Pj zmAPS6;-B$U=7a`ZhnULUFNa-jG7J)~M`{>v4Z&$jp)7<%F4I_|CP<)uA3j~)D_a$Qfzw}De0ELzjv-mX1yvPI@pn7wh`*=2;sbiv)NO_dk892)|04Rb;mF0~hI{NwiL-fL*R`{Td zqf=nhy+r6jg-UUY=sHjG)WOR5Z{`^u{R+?hp8!}B|9>=X#eW-3N0V**x2O1SZmQwc z>JwfG_@*Pgy{kU#R0{%UDq<3P7ti%uisQb|2H2j9y8qh&n|eAxg>&BY(*T%+3~}?= zN+savpp5I8ubrB4L{X)tQu=z5K3u2Bq`p!m)Sqv3KhFAqnJf7}<>`YS{xILV_n&qT zn(zM|>`%Ave>}-&;wus=3Ly~2bPnTcJo7UFNdQ^EJwz6i`RyQ(niz-6@f-=52ZTH+ zTQDM{r$i`Ub9*Q^Ti(eq@2wY+YCRaI5o|n=s$LF6fq9f&9cs?Nw=5&lHW(VQ^KB_C zipTBC_4UF8lUJRxEJibMoN;lQkwYCXm_ZVvN@Vo}lWJhz1YXU+!T$d4zEh24Z)?sx zOz+f!*l(m?j^1LDT~!-X4IPqenVY4l4q6Fg)hX{NxTJBGphDPvs~^MrHvj48kwayQ zLj6gO&{y1t`ed%eY(%**s;Hj$=H#fJaPsD5p0JG_Z2eZse>R8y1{A;=`M*EfpEl+H zbhMTKPx4iTxSDR5iHI`%NxvFi8gnMbuRh8+r7?Qgt5Elr=u);Ag9oO#Ds@!S?-?uv zyLoK@Q!SLrK<9aB%XS?vGPO`rj|^0^mWa(OO@v4kf5(`YKQ5)YSp3S;K)?QEtUZ%C z0ECiL1K2O8Zz~PEL$~s`2?g(VfiM^hocmAZ|6&qg5`Lx`<=Ol<p+nbFkU`uy89Pfx2IFA3nS%ayP;l zpXC9(uYji>o0;_1#zR*&kE0Yfx58P?P3TG>qTU|s;;NJexx!S7IE<|Pm6D{=DDH^`E+~8c;?54_F7T+y5I)cbohFd*ktT z{r41K<9(G26u>hz>+kifcfJ2E3wk^nF2`#7EEm|-x}V8v`h3r~w;sc4VN)<1hKQMW z{PJHjXT=LxliI^F&3EFDr2eTraMS8@#ar=xYS-V3-#)(nC;L{*fAiiY)OOB&RlvIQ z-`&Z6^Zl>U!DuW0pW?H=UA6zP8}j1 zefZzJnRst8u!jF9yW>eq|L<=3|4BZ*NeW2-zVnV?s?WkO;@;uO8zUIF_Zo8GR$k8Z zDMM7T;cz*2zqdWEX-MbTkWS?)*)veS@CZzPE^)wj$C~lJuPrvax~_{W)7BRtwQLfg z9D`MEwbqW^xQrW5!FN3Dzt>tg=F+Y>NGUF#>G!7Vk6CN6S5NDHjkN(|?l4dQnJ08T z#@bQ8KFZpQ;k{weGXH~q0lTPPOYI3&t&R;e{kxLfb4nRflZr`Lnb%5U`BrwvWFM?S zR8KhcY@gboX=U9TCcf%gw9zPUp%~zwf6tCasPX~Ki%s8 zr}-N8KTOl&=g6CS6Gv;%Hkmk;@N_e92wtN&0lp+1u%OIRVFz4B*pGnx%@MC!0Y=Gy z1)~W#{5^xAN(2aymHGy@?OY3xK)!W;>a^4V}`t^rAt zA;gdfehFDJw2TP*awvH5E-8lNVT{8_czhW;%PQi=W2dncfvMU? zRR?SJmIZ>z47fbPC{{1;>Z?bMQbqG)@5;N{io5N%{kGpjzyBWq0RR6uW)zkH-~a&s CN-SLf literal 0 HcmV?d00001 diff --git a/starboard-exporter-0.7.11-969c674c8f0121b89cbf4ccbdd743b9071bd9213.tgz-meta/README.md b/starboard-exporter-0.7.11-969c674c8f0121b89cbf4ccbdd743b9071bd9213.tgz-meta/README.md new file mode 100644 index 0000000000..a1743df3f1 --- /dev/null +++ b/starboard-exporter-0.7.11-969c674c8f0121b89cbf4ccbdd743b9071bd9213.tgz-meta/README.md @@ -0,0 +1,188 @@ +[![CircleCI](https://circleci.com/gh/giantswarm/starboard-exporter.svg?style=shield)](https://circleci.com/gh/giantswarm/starboard-exporter) +[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/giantswarm/starboard-exporter/badge)](https://securityscorecards.dev/viewer/?uri=github.com/giantswarm/starboard-exporter) + +# starboard-exporter + +Exposes Prometheus metrics from [Trivy Operator][trivy-operator-upstream]'s `VulnerabilityReport`, `ConfigAuditReport`, and other custom resources (CRs). + +## Metrics + +This exporter exposes several types of metrics: + +### CIS Benchmarks + +#### Report Summary + +A report summary series exposes the count of checks of each status reported in a given `CISKubeBenchReport`. For example: + +```shell +starboard_exporter_ciskubebenchreport_report_summary_count{ + node_name="bj56o-master-bj56o-000000" + status="FAIL" + } 31 +``` + +#### Section Summary + +For slightly more granular reporting, a section summary series exposes the count of checks of each status reported in a given `CISKubeBenchSection`. For example: + +```shell +starboard_exporter_ciskubebenchreport_section_summary_count{ + node_name="bj56o-master-bj56o-000000" + node_type="controlplane" + section_name="Control Plane Configuration" + status="WARN" + } 4 +``` + +#### Result Detail + +A CIS benchmark result info series exposes fields from each instance of an Aqua `CISKubeBenchResult`. For example: + +```shell +starboard_exporter_ciskubebenchreport_result_info{ + node_name="bj56o-master-bj56o-000000" + node_type="controlplane" + pod="starboard-exporter-859955f485-cwkj6" + section_name="Control Plane Configuration" + test_desc="Client certificate authentication should not be used for users (Manual)" + test_number="3.1.1" + test_status="WARN" + } 1 +``` + +### Vulnerability Reports + +#### Report Summary + +A summary series exposes the count of CVEs of each severity reported in a given `VulnerabilityReport`. For example: + +```shell +starboard_exporter_vulnerabilityreport_image_vulnerability_severity_count{ + image_digest="", + image_namespace="demo", + image_registry="quay.io", + image_repository="giantswarm/starboard-operator", + image_tag="0.11.0", + report_name="replicaset-starboard-app-6894945788-starboard-app", + severity="MEDIUM" + } 4 +``` + +This indicates that the `giantswarm/starboard-operator` image in the `demo` namespace contains 4 medium-severity vulnerabilities. + +#### Vulnerability Details + +A "detail" or "vulnerability" series exposes fields from each instance of an Aqua `Vulnerability`. The value of the metric is the `Score` for the vulnerability. For example: + +```shell +starboard_exporter_vulnerabilityreport_image_vulnerability{ + fixed_resource_version="1.1.1l-r0", + image_digest="", + image_namespace="demo", + image_registry="quay.io", + image_repository="giantswarm/starboard-operator", + image_tag="0.11.0", + installed_resource_version="1.1.1k-r0", + report_name="replicaset-starboard-app-6894945788-starboard-app", + severity="HIGH", + vulnerability_id="CVE-2021-3712", + vulnerability_link="https://avd.aquasec.com/nvd/cve-2021-3712", + vulnerability_title="openssl: Read buffer overruns processing ASN.1 strings", + vulnerable_resource_name="libssl1.1" + } 7.4 +``` + +This indicates that the vulnerability with the id `CVE-2021-3712` was found in the `giantswarm/starboard-operator` image in the `demo` namespace, and it has a CVSS 3.x score of 7.4. + +An additional series would be exposed for every combination of those labels. + +### Config Audit Reports + +#### Report Summary + +A summary series exposes the count of checks of each severity reported in a given `ConfigAuditReport`. For example: + +```shell +starboard_exporter_configauditreport_resource_checks_summary_count{ + resource_name="replicaset-chart-operator-748f756847", + resource_namespace="giantswarm", + severity="LOW" + } 7 +``` + +#### A Note on Cardinality + +For some use cases, it is helpful to export additional fields from `VulnerabilityReport` CRs. However, because many fields contain unbounded arbitrary data, including them in Prometheus metrics can lead to extremely high cardinality. This can drastically impact Prometheus performance. For this reason, we only expose summary data by default and allow users to opt-in to higher-cardinality fields. + +### Sharding Reports + +In large clusters or environments with many reports and/or vulnerabilities, a single exporter can consume a large amount of memory, and Prometheus may need a long time to scrape the exporter, leading to scrape timeouts. To help spread resource consumption and scrape effort, `starboard-exporter` watches its own service endpoints and will shard metrics for all report types across the available endpoints. In other words, if there are 3 exporter instances, each instance will serve roughly 1/3 of the metrics. This behavior is enabled by default and does not require any additional configuration. To use it, simply change the number of replicas in the Deployment. However, you should read the section on cardinality and be aware that consuming large amounts of high-cardinality data can have performance impacts on Prometheus. + +## Customization + +Summary metrics of the format described above are always enabled. + +To enable an additional detail series *per Vulnerability*, use the `--target-labels` flag to specify which labels should be exposed. For example: + +```shell +# Expose only select image and CVE fields. +--target-labels=image_namespace,image_repository,image_tag,vulnerability_id + +# Run with (almost) all fields exposed as labels, if you're feeling really wild. +--target-labels=all +``` + +Target labels can also be set via Helm values: + +```yaml +exporter: + vulnerabilityReports: + targetLabels: + - image_namespace + - image_repository + - image_tag + - vulnerability_id + - ... +``` + +The same can be done for CIS Benchmark Results. To enable an additional detail series *per CIS Benchmark Result*, use the `--cis-detail-report-labels` flag to specify which labels should be exposed. For example: + +```shell +# Expose only section_name, test_name and test_status +--cis-detail-report-labels=section_name,test_name,test_status + +# Run with (almost) all fields exposed as labels. +--cis-detail-report-labels=all +``` + +CIS detail target labels can also be set via Helm values: + +```yaml +exporter: + CISKubeBenchReports: + targetLabels: + - node_name + - node_type + - section_name + - test_name + - test_status + - ... +``` + +## Helm + +How to install the starboard-exporter using helm: + +```shell +helm repo add giantswarm https://giantswarm.github.io/giantswarm-catalog +helm repo update +helm upgrade -i starboard-exporter --namespace giantswarm/starboard-exporter +``` + +## Scaling for Prometheus scrape timeouts + +When exporting a large volume of metrics, Prometheus might time out before retrieving them all from a single exporter instance. It is possible to automatically scale the number of exporters to keep the scrape time below the configured timeout. To enable HPA scaling based on Prometheus metrics, [here](./docs/custom_metrics_hpa.md) + + +[trivy-operator-upstream]: https://github.com/aquasecurity/trivy-operator diff --git a/starboard-exporter-0.7.11-969c674c8f0121b89cbf4ccbdd743b9071bd9213.tgz-meta/main.yaml b/starboard-exporter-0.7.11-969c674c8f0121b89cbf4ccbdd743b9071bd9213.tgz-meta/main.yaml new file mode 100644 index 0000000000..1168ec953e --- /dev/null +++ b/starboard-exporter-0.7.11-969c674c8f0121b89cbf4ccbdd743b9071bd9213.tgz-meta/main.yaml @@ -0,0 +1,12 @@ +annotations: + application.giantswarm.io/metadata: https://giantswarm.github.io/giantswarm-test-catalog/starboard-exporter-0.7.11-969c674c8f0121b89cbf4ccbdd743b9071bd9213.tgz-meta/main.yaml + application.giantswarm.io/readme: https://giantswarm.github.io/giantswarm-test-catalog/starboard-exporter-0.7.11-969c674c8f0121b89cbf4ccbdd743b9071bd9213.tgz-meta/README.md + application.giantswarm.io/team: shield + application.giantswarm.io/values-schema: https://giantswarm.github.io/giantswarm-test-catalog/starboard-exporter-0.7.11-969c674c8f0121b89cbf4ccbdd743b9071bd9213.tgz-meta/values.schema.json + config.giantswarm.io/version: 1.x.x +chartApiVersion: v1 +chartFile: starboard-exporter-0.7.11-969c674c8f0121b89cbf4ccbdd743b9071bd9213.tgz +dateCreated: '2024-08-29T14:18:30.648092' +digest: 6ccf05279deae7c59d35b864fee0149629b0f4805650ba797ffe14c6daadf25a +home: https://github.com/giantswarm/starboard-exporter +icon: https://s.giantswarm.io/app-icons/prometheus/1/light.svg diff --git a/starboard-exporter-0.7.11-969c674c8f0121b89cbf4ccbdd743b9071bd9213.tgz-meta/values.schema.json b/starboard-exporter-0.7.11-969c674c8f0121b89cbf4ccbdd743b9071bd9213.tgz-meta/values.schema.json new file mode 100644 index 0000000000..4e4b95c846 --- /dev/null +++ b/starboard-exporter-0.7.11-969c674c8f0121b89cbf4ccbdd743b9071bd9213.tgz-meta/values.schema.json @@ -0,0 +1,272 @@ +{ + "$schema": "http://json-schema.org/schema#", + "type": "object", + "properties": { + "customMetricsHPA": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + }, + "maxReplicas": { + "type": "integer" + }, + "metricName": { + "type": "string" + }, + "minReplicas": { + "type": "integer" + }, + "targetAverageValueSeconds": { + "type": "integer" + } + } + }, + "exporter": { + "type": "object", + "properties": { + "configAuditReports": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + } + } + }, + "requeueMaxJitterPercent": { + "type": "integer" + }, + "vulnerabilityReports": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + }, + "targetLabels": { + "type": "array" + } + } + } + } + }, + "global": { + "type": "object", + "properties": { + "podSecurityStandards": { + "type": "object", + "properties": { + "enforced": { + "type": "boolean" + } + } + } + } + }, + "image": { + "type": "object", + "properties": { + "name": { + "type": "string" + } + } + }, + "imagePullSecrets": { + "type": "object" + }, + "kedaScaledObject": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + }, + "maxReplicas": { + "type": "integer" + }, + "minReplicas": { + "type": "integer" + }, + "triggers": { + "type": "array" + } + } + }, + "maxReplicas": { + "type": "integer" + }, + "minReplicas": { + "type": "integer" + }, + "monitoring": { + "type": "object", + "properties": { + "grafanaDashboard": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + } + } + }, + "serviceMonitor": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + }, + "labels": { + "type": "object" + }, + "metricRelabelings": { + "type": "array" + }, + "relabelings": { + "type": "array", + "items": { + "type": "object", + "properties": { + "action": { + "type": "string" + }, + "regex": { + "type": "string" + } + } + } + } + } + } + } + }, + "networkpolicy": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + } + } + }, + "nodeSelector": { + "type": "object" + }, + "pod": { + "type": "object", + "properties": { + "group": { + "type": "object", + "properties": { + "id": { + "type": "integer" + } + } + }, + "user": { + "type": "object", + "properties": { + "id": { + "type": "integer" + } + } + } + } + }, + "podAnnotations": { + "type": "object" + }, + "podLabels": { + "type": "object" + }, + "podSecurityContext": { + "type": "object", + "properties": { + "runAsNonRoot": { + "type": "boolean" + }, + "seccompProfile": { + "type": "object", + "properties": { + "type": { + "type": "string" + } + } + } + } + }, + "registry": { + "type": "object", + "properties": { + "domain": { + "type": "string" + } + } + }, + "replicas": { + "type": "integer" + }, + "resources": { + "type": "object", + "properties": { + "limits": { + "type": "object", + "properties": { + "cpu": { + "type": "string" + }, + "memory": { + "type": "string" + } + } + }, + "requests": { + "type": "object", + "properties": { + "cpu": { + "type": "string" + }, + "memory": { + "type": "string" + } + } + } + } + }, + "securityContext": { + "type": "object", + "properties": { + "allowPrivilegeEscalation": { + "type": "boolean" + }, + "capabilities": { + "type": "object", + "properties": { + "drop": { + "type": "array", + "items": { + "type": "string" + } + } + } + }, + "privileged": { + "type": "boolean" + }, + "readOnlyRootFilesystem": { + "type": "boolean" + }, + "runAsNonRoot": { + "type": "boolean" + }, + "seccompProfile": { + "type": "object", + "properties": { + "type": { + "type": "string" + } + } + } + } + }, + "tolerations": { + "type": "array" + } + } +}