Skip to content

fix(kubescape): mount scanner config.json dir so posture scans persist #2444

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
devantler wants to merge 1 commit into from
Closed

fix(kubescape): mount scanner config.json dir so posture scans persist #2444

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 35 additions & 0 deletions k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,3 +142,38 @@ spec:
limits:
cpu: 500m
memory: 1Gi
# Fix the scanner's config.json mount so posture scans actually persist.
# In OFFLINE mode (kubescapeOffline: enable) the chart mounts the writable
# `kubescape-volume` emptyDir at the FILE path /home/nonroot/.kubescape/config.json
# with `subPath: config.json`. An emptyDir + subPath makes Kubernetes create the
# subPath as a DIRECTORY, so config.json is a directory, not a file. The old
# v4.0.8 scanner never wrote it; v4.0.9 (pinned above for the CRD-exceptions
# getter) does — it writes a generated account ID there — so every scan now
# aborts with `open /home/nonroot/.kubescape/config.json: is a directory` BEFORE
# any WorkloadConfigurationScan result is persisted. Result: posture data goes
# stale and ClusterSecurityException posture exceptions are never evaluated.
# Mount the emptyDir at the .kubescape DIRECTORY instead (no subPath) — the same
# writable layout the chart's ONLINE branch uses — so the scanner can create
# config.json as a file; host-scanner.yaml stays a nested read-only mount.
# Drop once the chart fixes the offline mount upstream (kubescape/helm-charts).
postRenderers:
- kustomize:
patches:
- target:
kind: Deployment
name: kubescape
patch: |
apiVersion: apps/v1
kind: Deployment
metadata:
name: kubescape
spec:
template:
spec:
containers:
- name: kubescape
volumeMounts:
- mountPath: /home/nonroot/.kubescape/config.json
$patch: delete
- name: kubescape-volume
mountPath: /home/nonroot/.kubescape