Skip to content

feat(openprotection): publish active-rule open-protection union as ConfigMap #385

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
matthyx wants to merge 3 commits into
base: main
Choose a base branch
from
Open

feat(openprotection): publish active-rule open-protection union as ConfigMap #385

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e953a9e
chore(deps): bump armoapi-go to v0.0.719
matthyx Jun 12, 2026
68990cc
chore(deps): pull in rulelibrary + bump node-agent/storage for open-p…
matthyx Jun 15, 2026
0d1620e
feat(openprotection): publish active-rule open-protection union as Co…
matthyx Jun 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions config/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,6 +132,11 @@ type Config struct {
RulesUpdateConfig rulesupdate.RulesUpdaterConfig `mapstructure:"rulesUpdateConfig"`
SkipProfilesWithoutInstances bool `mapstructure:"skipProfilesWithoutInstances"`
NodeAgentAutoscaler NodeAgentAutoscalerConfig `mapstructure:"nodeAgentAutoscaler"`
// OpenProtectionConfigMapName, when non-empty, enables the open-protection
// watcher: the operator resolves active RuntimeRuleAlertBinding selectors to
// the union of their profileDataRequired.opens and publishes it into this
// ConfigMap (in the operator namespace) for the storage apiserver to read.
OpenProtectionConfigMapName string `mapstructure:"openProtectionConfigMapName"`
}

// IConfig is an interface for all config types used in the operator
Expand All @@ -158,6 +163,7 @@ type IConfig interface {
SkipProfilesWithoutInstances() bool
RulesUpdateEnabled() bool
NodeAgentAutoscalerConfig() NodeAgentAutoscalerConfig
OpenProtectionConfigMapName() string
}

// OperatorConfig implements IConfig
Expand Down Expand Up @@ -213,6 +219,10 @@ func (c *OperatorConfig) Namespace() string {
return c.serviceConfig.Namespace
}

func (c *OperatorConfig) OpenProtectionConfigMapName() string {
return c.serviceConfig.OpenProtectionConfigMapName
}

func (c *OperatorConfig) CleanUpRoutineInterval() time.Duration {
return c.serviceConfig.CleanUpRoutineInterval
}
Expand Down
51 changes: 26 additions & 25 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,14 @@ module github.com/kubescape/operator
go 1.25.8

require (
github.com/armosec/armoapi-go v0.0.673
github.com/armosec/armoapi-go v0.0.719
github.com/armosec/registryx v0.0.35
github.com/armosec/rulelibrary v0.0.71-0.20260612121633-c246d476b172
github.com/armosec/utils-go v0.0.58
github.com/armosec/utils-k8s-go v0.0.35
github.com/aws/aws-sdk-go-v2 v1.41.2
github.com/aws/aws-sdk-go-v2/config v1.32.10
github.com/aws/aws-sdk-go-v2/credentials v1.19.10
github.com/aws/aws-sdk-go-v2 v1.41.5
github.com/aws/aws-sdk-go-v2/config v1.32.12
github.com/aws/aws-sdk-go-v2/credentials v1.19.12
github.com/aws/aws-sdk-go-v2/service/ecr v1.55.3
github.com/cenkalti/backoff v2.2.1+incompatible
github.com/cenkalti/backoff/v4 v4.3.0
Expand All @@ -21,13 +22,13 @@ require (
github.com/google/uuid v1.6.0
github.com/goradd/maps v1.3.0
github.com/gorilla/mux v1.8.1
github.com/kubescape/backend v0.0.37
github.com/kubescape/backend v0.0.40
github.com/kubescape/go-logger v0.0.28
github.com/kubescape/k8s-interface v0.0.202
github.com/kubescape/k8s-interface v0.0.206
github.com/kubescape/kubescape-network-scanner v0.0.15
github.com/kubescape/node-agent v0.3.38
github.com/kubescape/node-agent v0.3.98-0.20260423123245-49b120190105
github.com/kubescape/opa-utils v0.0.285
github.com/kubescape/storage v0.0.239
github.com/kubescape/storage v0.0.268
github.com/panjf2000/ants/v2 v2.11.3
github.com/spf13/viper v1.21.0
github.com/stretchr/testify v1.11.1
Expand All @@ -47,7 +48,7 @@ require (
)

require (
cloud.google.com/go/auth v0.18.1 // indirect
cloud.google.com/go/auth v0.18.2 // indirect
cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
cloud.google.com/go/compute/metadata v0.9.0 // indirect
cloud.google.com/go/container v1.45.0 // indirect
Expand Down Expand Up @@ -110,20 +111,20 @@ require (
github.com/armosec/gojay v1.2.17 // indirect
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
github.com/aws/aws-sdk-go v1.55.7 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.18 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.18 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.18 // indirect
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 // indirect
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 // indirect
github.com/aws/aws-sdk-go-v2/service/ecs v1.71.0 // indirect
github.com/aws/aws-sdk-go-v2/service/eks v1.48.5 // indirect
github.com/aws/aws-sdk-go-v2/service/iam v1.35.3 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.5 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.18 // indirect
github.com/aws/aws-sdk-go-v2/service/signin v1.0.6 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.30.11 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.15 // indirect
github.com/aws/aws-sdk-go-v2/service/sts v1.41.7 // indirect
github.com/aws/smithy-go v1.24.1 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 // indirect
github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 // indirect
github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 // indirect
github.com/aws/smithy-go v1.24.2 // indirect
github.com/becheran/wildmatch-go v1.0.0 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/blang/semver v3.5.1+incompatible // indirect
Expand Down Expand Up @@ -196,7 +197,7 @@ require (
github.com/google/go-containerregistry v0.21.2 // indirect
github.com/google/licensecheck v0.3.1 // indirect
github.com/google/s2a-go v0.1.9 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.3.11 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.3.14 // indirect
github.com/googleapis/gax-go/v2 v2.17.0 // indirect
github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
Expand All @@ -209,7 +210,7 @@ require (
github.com/jmespath/go-jmespath v0.4.0 // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/klauspost/compress v1.18.4 // indirect
github.com/klauspost/compress v1.18.5 // indirect
github.com/kubescape/kubescape/v3 v3.0.4 // indirect
github.com/kubescape/rbac-utils v0.0.21-0.20230806101615-07e36f555520 // indirect
github.com/kubescape/regolibrary v1.0.317-0.20240320124840-1d84ac7186ea // indirect
Expand Down Expand Up @@ -249,7 +250,7 @@ require (
github.com/pelletier/go-toml/v2 v2.2.4 // indirect
github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
github.com/petermattis/goid v0.0.0-20241211131331-93ee7e083c43 // indirect
github.com/picatz/xcel v0.0.0-20250816143731-885b5f678a12 // indirect
github.com/picatz/xcel v0.0.0-20260226001349-6958ffac5706 // indirect
github.com/pierrec/lz4/v4 v4.1.22 // indirect
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
github.com/pkg/errors v0.9.1 // indirect
Expand Down Expand Up @@ -298,7 +299,7 @@ require (
github.com/yashtewari/glob-intersection v0.2.0 // indirect
github.com/yl2chen/cidranger v1.0.2 // indirect
github.com/yusufpapurcu/wmi v1.2.4 // indirect
go.mongodb.org/mongo-driver v1.17.4 // indirect
go.mongodb.org/mongo-driver v1.17.6 // indirect
go.opencensus.io v0.24.0 // indirect
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/contrib/bridges/otelslog v0.18.0 // indirect
Expand Down Expand Up @@ -332,7 +333,7 @@ require (
golang.org/x/text v0.37.0 // indirect
golang.org/x/time v0.15.0 // indirect
gonum.org/v1/gonum v0.17.0 // indirect
google.golang.org/api v0.267.0 // indirect
google.golang.org/api v0.271.0 // indirect
google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
Expand Down
Loading
Loading