Skip to content

fix(kubescape): remount scanner config.json so offline posture scans persist #2439

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
devantler wants to merge 1 commit into from
Closed

fix(kubescape): remount scanner config.json so offline posture scans persist #2439

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,3 +142,35 @@ spec:
limits:
cpu: 500m
memory: 1Gi
# Offline-mode chart bug (kubescape-operator 1.40.2): the scanner Deployment
# mounts the empty `kubescape-volume` emptyDir onto the FILE path
# /home/nonroot/.kubescape/config.json (subPath config.json). When the target
# does not exist kubelet MATERIALISES it as a DIRECTORY, so ksserver's
# config-write (GenerateAccountID) fails with `open .../config.json: is a
# directory`; the scan aborts at finalize ("scanning failed"), the aggregate
# ConfigurationScanSummary is never written, and NO posture
# (Cluster)SecurityException is ever applied — so every by-design exception
# (e.g. C-0007) renders as failed and the compliance dashboard freezes.
# Strictly offline-specific: with kubescapeOffline disabled the chart mounts
# the volume at the parent DIR, so only the config.json FILE is created.
# Upstream fix kubescape/helm-charts#862 (issue #857) remounts at the parent
# dir; it is merged to main (2026-06-24) but NOT in any released chart (latest
# is 1.40.2), so reproduce it here via post-render until a chart release ships
# it — then bump spec.chart.spec.version and DELETE this postRenderer. The
# `test` op pins the assumption (kubescape-volume is volumeMounts[1] on chart
# 1.40.2, verified against the live Deployment) so a future mount-order change
# fails the reconcile loudly instead of silently remounting the wrong volume.
# Offline mode and submit=false are untouched — no cloud egress is re-enabled.
postRenderers:
- kustomize:
patches:
- target:
kind: Deployment
name: kubescape
patch: |
- op: test
path: /spec/template/spec/containers/0/volumeMounts/1/mountPath
value: /home/nonroot/.kubescape/config.json
- op: replace
path: /spec/template/spec/containers/0/volumeMounts/1/mountPath
value: /home/nonroot/.kubescape