[feature] IsDeployed about guac HOT 6 OPEN

I like this idea! It might be good to collect/consume this info from KBOM (and/or pluggable other sources) instead of querying cluster(s) directly. An operator running in cluster(s) (like trivy-operator) can produce these results and guac can consume them.

cc @itaysk

from guac.

Nice writeup! I've always wondered how this fits into guac / how people are solving this

from guac.

We had a quick discussion about this with @ridhoq during the community meeting. Overall, this is a great feature that would add value. There are a few points that need discussion:

1. Should we store this information in GUAC or would it be better as an integration due to the dynamic nature of the data?
2. If stored in GUAC, how often would it need to be updated? As Ridwan stated, it would cause lots of data build-up and would require pruning.
3. What is the most effective way to obtain this information?
4. As discussed in the call, this would need to be in the form of an "attestation" (preferably an in-toto attestation). This could be signed and verified later down the line to ensure the trustworthiness of the data.

from guac.

@ridhoq and I have been discussing this offline. Our view is that we would like to have one single place where we can store all information related to the supply chain (of containers), not only the composition. The reason being if that information is stored in two (or more) separate systems, joining the information becomes more problematic.
We do see the supply chain as a graph (that we would like to search bi-directionally) that starts from acquisition of the base container images and any external packages and ends with deployment and eventually termination of the running container on the runtime nodes.
Two main scenarios we are targeting at the moment are:

• Inventory/impact assessment scenario
  In this scenario, we would like to identify all assets that are impacted by a certain vulnerability and what is the relation between them (including deployed/running assets), i.e. what is the flow through the supply chain
• Remediation sequence scenario
  In this scenario, we would like to understand what are the steps for remediating vulnerability that is discovered at runtime (or any other stage of the supply chain). This should answer questions like, what base image needs to be updated, what library needs to be updated, what applications/containers need to be redeployed, etc.

Hope this helps steer the conversation further.

from guac.

New Deployment attestation being developed: in-toto/attestation#341

Will need to determine if this fits into this discussion or not.

from guac.

Thanks for the ping @sozercan . While I think the gist of your comment makes sense, I just need to mention that Trivy KBOM does not include information about workloads, but rather information about the Kubernetes cluster components.

from guac.