From 0470209d64a772bb308978368fe252d8f48ead0c Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Sat, 4 Jul 2026 13:30:49 +0200 Subject: [PATCH] fix(kubescape): remount scanner config.json so offline posture scans persist MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The kubescape-operator 1.40.2 scanner Deployment mounts the empty `kubescape-volume` emptyDir onto the FILE path /home/nonroot/.kubescape/config.json (subPath config.json). kubelet materialises the non-existent target as a DIRECTORY, so the scanner's config write fails ("open .../config.json: is a directory"), the scan aborts at finalize, the aggregate ConfigurationScanSummary is never written, and no posture (Cluster)SecurityException is ever applied — so the compliance dashboard freezes (last persisted scan 2026-06-27) and every by-design exception (e.g. C-0007) renders failed. Reproduce upstream fix kubescape/helm-charts#862 (issue #857) via a Flux postRenderer that remounts the volume at the parent dir, until a chart release ships it. Offline mode / submit=false unchanged. Co-Authored-By: Claude Opus 4.8 --- .../controllers/kubescape/helm-release.yaml | 32 +++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml b/k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml index b522c0965..06c1f8961 100644 --- a/k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml @@ -142,3 +142,35 @@ spec: limits: cpu: 500m memory: 1Gi + # Offline-mode chart bug (kubescape-operator 1.40.2): the scanner Deployment + # mounts the empty `kubescape-volume` emptyDir onto the FILE path + # /home/nonroot/.kubescape/config.json (subPath config.json). When the target + # does not exist kubelet MATERIALISES it as a DIRECTORY, so ksserver's + # config-write (GenerateAccountID) fails with `open .../config.json: is a + # directory`; the scan aborts at finalize ("scanning failed"), the aggregate + # ConfigurationScanSummary is never written, and NO posture + # (Cluster)SecurityException is ever applied — so every by-design exception + # (e.g. C-0007) renders as failed and the compliance dashboard freezes. + # Strictly offline-specific: with kubescapeOffline disabled the chart mounts + # the volume at the parent DIR, so only the config.json FILE is created. + # Upstream fix kubescape/helm-charts#862 (issue #857) remounts at the parent + # dir; it is merged to main (2026-06-24) but NOT in any released chart (latest + # is 1.40.2), so reproduce it here via post-render until a chart release ships + # it — then bump spec.chart.spec.version and DELETE this postRenderer. The + # `test` op pins the assumption (kubescape-volume is volumeMounts[1] on chart + # 1.40.2, verified against the live Deployment) so a future mount-order change + # fails the reconcile loudly instead of silently remounting the wrong volume. + # Offline mode and submit=false are untouched — no cloud egress is re-enabled. + postRenderers: + - kustomize: + patches: + - target: + kind: Deployment + name: kubescape + patch: | + - op: test + path: /spec/template/spec/containers/0/volumeMounts/1/mountPath + value: /home/nonroot/.kubescape/config.json + - op: replace + path: /spec/template/spec/containers/0/volumeMounts/1/mountPath + value: /home/nonroot/.kubescape